Fix function signature for compiling test

distribute can send out responses tsig signed
Forgot to include util/allow_response_list.[ch]
2026-08-17 21:25:50 +02:00 · 2025-11-03 11:15:11 +01:00 · 2025-11-01 14:32:09 +01:00 · 2025-11-01 13:12:35 +01:00 · 2025-11-01 12:52:48 +01:00 · 2025-10-31 15:45:34 +01:00
260 changed files with 12688 additions and 2306 deletions
@@ -12,6 +12,7 @@ jobs:
  build:
    runs-on: ${{ matrix.os }}
    strategy:
+      fail-fast: false
      matrix:
        include:
          - name: GCC on Linux
@@ -48,15 +49,6 @@ jobs:
            os: ubuntu-latest
            config: 'CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=address" --disable-flto --disable-static'
            make_test: "yes"
-          - name: Apple iPhone on iOS, armv7
-            os: macos-latest
-            AUTOTOOLS_HOST: armv7-apple-ios
-            OPENSSL_HOST: ios-cross
-            IOS_SDK: iPhoneOS
-            IOS_CPU: armv7s
-            test_ios: "yes"
-            config: "no"
-            make: "no"
          - name: Apple iPhone on iOS, arm64
            os: macos-latest
            AUTOTOOLS_HOST: aarch64-apple-ios
@@ -84,15 +76,6 @@ jobs:
            test_ios: "yes"
            config: "no"
            make: "no"
-          - name: iPhoneSimulator on OS X, i386
-            os: macos-latest
-            AUTOTOOLS_HOST: i386-apple-ios
-            OPENSSL_HOST: iphoneos-cross
-            IOS_SDK: iPhoneSimulator
-            IOS_CPU: i386
-            test_ios: "yes"
-            config: "no"
-            make: "no"
          - name: iPhoneSimulator on OS X, x86_64
            os: macos-latest
            AUTOTOOLS_HOST: x86_64-apple-ios
@@ -4,7 +4,7 @@
 [![Packaging status](https://repology.org/badge/tiny-repos/unbound.svg)](https://repology.org/project/unbound/versions)
 [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/unbound.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:unbound)
 [![Documentation Status](https://readthedocs.org/projects/unbound/badge/?version=latest)](https://unbound.readthedocs.io/en/latest/?badge=latest)
-[![Mastodon Follow](https://img.shields.io/mastodon/follow/109262826617293067?domain=https%3A%2F%2Ffosstodon.org&style=social)](https://fosstodon.org/@nlnetlabs)
+[![Mastodon Follow](https://img.shields.io/mastodon/follow/114692612288811644?domain=social.nlnetlabs.nl&style=social)](https://social.nlnetlabs.nl/@nlnetlabs)

 Unbound is a validating, recursive, caching DNS resolver. It is designed to be
 fast and lean and incorporates modern features based on open standards. If you
@@ -25,18 +25,21 @@ Unbound can be compiled and installed using:
 ./configure && make && make install
 ```

-You can use libevent if you want. libevent is useful when using many (10000)
-outgoing ports. By default max 256 ports are opened at the same time and the
-builtin alternative is equally capable and a little faster.
-
+You can use libevent if you want. libevent is useful when using many (e.g.,
+10000) outgoing ports.
 Use the `--with-libevent` configure option to compile Unbound with libevent
 support.

+If not, the default builtin alternative opens max 256 ports at the same time
+and is equally capable and a little faster.
+
+
 ## Unbound configuration

-All of Unbound's configuration options are described in the man pages, which
-will be installed and are available on the Unbound
-[documentation page](https://unbound.docs.nlnetlabs.nl/).
+All of Unbound's configuration options are described in the `unbound.conf(5)`
+man page, which will be installed and is also available on the Unbound
+[documentation page](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html)
+for the latest version.

-An example configuration file is located in
+An example configuration file, with minimal documentation, is located in
 [doc/example.conf](https://github.com/NLnetLabs/unbound/blob/master/doc/example.conf.in).
@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.16.2 -*- Autoconf -*-
+# generated automatically by aclocal 1.16.5 -*- Autoconf -*-

-# Copyright (C) 1996-2020 Free Software Foundation, Inc.
+# Copyright (C) 1996-2021 Free Software Foundation, Inc.

 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -14,7 +14,8 @@
 m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
 # libtool.m4 - Configure libtool for the host system. -*-Autoconf-*-
 #
-#   Copyright (C) 1996-2001, 2003-2015 Free Software Foundation, Inc.
+#   Copyright (C) 1996-2001, 2003-2019, 2021-2022 Free Software
+#   Foundation, Inc.
 #   Written by Gordon Matzigkeit, 1996
 #
 # This file is free software; the Free Software Foundation gives
@@ -45,7 +46,7 @@ m4_define([_LT_COPYING], [dnl
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 ])

-# serial 58 LT_INIT
+# serial 59 LT_INIT


 # LT_PREREQ(VERSION)
@@ -195,6 +196,7 @@ m4_require([_LT_FILEUTILS_DEFAULTS])dnl
 m4_require([_LT_CHECK_SHELL_FEATURES])dnl
 m4_require([_LT_PATH_CONVERSION_FUNCTIONS])dnl
 m4_require([_LT_CMD_RELOAD])dnl
+m4_require([_LT_DECL_FILECMD])dnl
 m4_require([_LT_CHECK_MAGIC_METHOD])dnl
 m4_require([_LT_CHECK_SHAREDLIB_FROM_LINKLIB])dnl
 m4_require([_LT_CMD_OLD_ARCHIVE])dnl
@@ -233,8 +235,8 @@ esac
 ofile=libtool
 can_build_shared=yes

-# All known linkers require a '.a' archive for static linking (except MSVC,
-# which needs '.lib').
+# All known linkers require a '.a' archive for static linking (except MSVC and
+# ICC, which need '.lib').
 libext=a

 with_gnu_ld=$lt_cv_prog_gnu_ld
@@ -736,7 +738,6 @@ _LT_CONFIG_SAVE_COMMANDS([
    cat <<_LT_EOF >> "$cfgfile"
 #! $SHELL
 # Generated automatically by $as_me ($PACKAGE) $VERSION
-# Libtool was configured on host `(hostname || uname -n) 2>/dev/null | sed 1q`:
 # NOTE: Changes made to this file will be lost: look at ltmain.sh.

 # Provide generalized library-building support services.
@@ -786,7 +787,7 @@ _LT_EOF
  # if finds mixed CR/LF and LF-only lines.  Since sed operates in
  # text mode, it properly converts lines to CR/LF.  This bash problem
  # is reportedly fixed, but why not run on old versions too?
-  sed '$q' "$ltmain" >> "$cfgfile" \
+  $SED '$q' "$ltmain" >> "$cfgfile" \
     || (rm -f "$cfgfile"; exit 1)

   mv -f "$cfgfile" "$ofile" ||
@@ -1048,8 +1049,8 @@ int forced_loaded() { return 2;}
 _LT_EOF
      echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&AS_MESSAGE_LOG_FD
      $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&AS_MESSAGE_LOG_FD
-      echo "$AR cru libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
-      $AR cru libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
+      echo "$AR $AR_FLAGS libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
+      $AR $AR_FLAGS libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
      echo "$RANLIB libconftest.a" >&AS_MESSAGE_LOG_FD
      $RANLIB libconftest.a 2>&AS_MESSAGE_LOG_FD
      cat > conftest.c << _LT_EOF
@@ -1073,17 +1074,12 @@ _LT_EOF
      _lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;;
    darwin1.*)
      _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-    darwin*) # darwin 5.x on
-      # if running on 10.5 or later, the deployment target defaults
-      # to the OS version, if on x86, and 10.4, the deployment
-      # target defaults to 10.4. Don't you love it?
-      case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
-	10.0,*86*-darwin8*|10.0,*-darwin[[91]]*)
-	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
-	10.[[012]][[,.]]*)
-	  _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-	10.*)
-	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
+    darwin*)
+      case $MACOSX_DEPLOYMENT_TARGET,$host in
+        10.[[012]],*|,*powerpc*-darwin[[5-8]]*)
+          _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
+        *)
+          _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
      esac
    ;;
  esac
@@ -1132,12 +1128,12 @@ m4_defun([_LT_DARWIN_LINKER_FEATURES],
    output_verbose_link_cmd=func_echo_all
    _LT_TAGVAR(archive_cmds, $1)="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil"
    _LT_TAGVAR(module_cmds, $1)="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil"
-    _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
-    _LT_TAGVAR(module_expsym_cmds, $1)="sed -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
+    _LT_TAGVAR(archive_expsym_cmds, $1)="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
+    _LT_TAGVAR(module_expsym_cmds, $1)="$SED -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
    m4_if([$1], [CXX],
 [   if test yes != "$lt_cv_apple_cc_single_mod"; then
      _LT_TAGVAR(archive_cmds, $1)="\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dsymutil"
-      _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
+      _LT_TAGVAR(archive_expsym_cmds, $1)="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
    fi
 ],[])
  else
@@ -1251,7 +1247,8 @@ _LT_DECL([], [ECHO], [1], [An echo program that protects backslashes])
 # _LT_WITH_SYSROOT
 # ----------------
 AC_DEFUN([_LT_WITH_SYSROOT],
-[AC_MSG_CHECKING([for sysroot])
+[m4_require([_LT_DECL_SED])dnl
+AC_MSG_CHECKING([for sysroot])
 AC_ARG_WITH([sysroot],
 [AS_HELP_STRING([--with-sysroot@<:@=DIR@:>@],
  [Search for dependent libraries within DIR (or the compiler's sysroot
@@ -1268,7 +1265,7 @@ case $with_sysroot in #(
   fi
   ;; #(
 /*)
-   lt_sysroot=`echo "$with_sysroot" | sed -e "$sed_quote_subst"`
+   lt_sysroot=`echo "$with_sysroot" | $SED -e "$sed_quote_subst"`
   ;; #(
 no|'')
   ;; #(
@@ -1298,7 +1295,7 @@ ia64-*-hpux*)
  # options accordingly.
  echo 'int i;' > conftest.$ac_ext
  if AC_TRY_EVAL(ac_compile); then
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
      *ELF-32*)
 	HPUX_IA64_MODE=32
 	;;
@@ -1315,7 +1312,7 @@ ia64-*-hpux*)
  echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext
  if AC_TRY_EVAL(ac_compile); then
    if test yes = "$lt_cv_prog_gnu_ld"; then
-      case `/usr/bin/file conftest.$ac_objext` in
+      case `$FILECMD conftest.$ac_objext` in
 	*32-bit*)
 	  LD="${LD-ld} -melf32bsmip"
 	  ;;
@@ -1327,7 +1324,7 @@ ia64-*-hpux*)
 	;;
      esac
    else
-      case `/usr/bin/file conftest.$ac_objext` in
+      case `$FILECMD conftest.$ac_objext` in
 	*32-bit*)
 	  LD="${LD-ld} -32"
 	  ;;
@@ -1349,7 +1346,7 @@ mips64*-*linux*)
  echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext
  if AC_TRY_EVAL(ac_compile); then
    emul=elf
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
      *32-bit*)
 	emul="${emul}32"
 	;;
@@ -1357,7 +1354,7 @@ mips64*-*linux*)
 	emul="${emul}64"
 	;;
    esac
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
      *MSB*)
 	emul="${emul}btsmip"
 	;;
@@ -1365,7 +1362,7 @@ mips64*-*linux*)
 	emul="${emul}ltsmip"
 	;;
    esac
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
      *N32*)
 	emul="${emul}n32"
 	;;
@@ -1385,14 +1382,14 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
  # not appear in the list.
  echo 'int i;' > conftest.$ac_ext
  if AC_TRY_EVAL(ac_compile); then
-    case `/usr/bin/file conftest.o` in
+    case `$FILECMD conftest.o` in
      *32-bit*)
 	case $host in
 	  x86_64-*kfreebsd*-gnu)
 	    LD="${LD-ld} -m elf_i386_fbsd"
 	    ;;
 	  x86_64-*linux*)
-	    case `/usr/bin/file conftest.o` in
+	    case `$FILECMD conftest.o` in
 	      *x86-64*)
 		LD="${LD-ld} -m elf32_x86_64"
 		;;
@@ -1460,7 +1457,7 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
  # options accordingly.
  echo 'int i;' > conftest.$ac_ext
  if AC_TRY_EVAL(ac_compile); then
-    case `/usr/bin/file conftest.o` in
+    case `$FILECMD conftest.o` in
    *64-bit*)
      case $lt_cv_prog_gnu_ld in
      yes*)
@@ -1499,9 +1496,22 @@ need_locks=$enable_libtool_lock
 m4_defun([_LT_PROG_AR],
 [AC_CHECK_TOOLS(AR, [ar], false)
 : ${AR=ar}
-: ${AR_FLAGS=cru}
 _LT_DECL([], [AR], [1], [The archiver])
-_LT_DECL([], [AR_FLAGS], [1], [Flags to create an archive])
+
+# Use ARFLAGS variable as AR's operation code to sync the variable naming with
+# Automake.  If both AR_FLAGS and ARFLAGS are specified, AR_FLAGS should have
+# higher priority because thats what people were doing historically (setting
+# ARFLAGS for automake and AR_FLAGS for libtool).  FIXME: Make the AR_FLAGS
+# variable obsoleted/removed.
+
+test ${AR_FLAGS+y} || AR_FLAGS=${ARFLAGS-cr}
+lt_ar_flags=$AR_FLAGS
+_LT_DECL([], [lt_ar_flags], [0], [Flags to create an archive (by configure)])
+
+# Make AR_FLAGS overridable by 'make ARFLAGS='.  Don't try to run-time override
+# by AR_FLAGS because that was never working and AR_FLAGS is about to die.
+_LT_DECL([], [AR_FLAGS], [\@S|@{ARFLAGS-"\@S|@lt_ar_flags"}],
+         [Flags to create an archive])

 AC_CACHE_CHECK([for archiver @FILE support], [lt_cv_ar_at_file],
  [lt_cv_ar_at_file=no
@@ -1720,7 +1730,7 @@ AC_CACHE_VAL([lt_cv_sys_max_cmd_len], [dnl
    lt_cv_sys_max_cmd_len=8192;
    ;;

-  bitrig* | darwin* | dragonfly* | freebsd* | netbsd* | openbsd*)
+  bitrig* | darwin* | dragonfly* | freebsd* | midnightbsd* | netbsd* | openbsd*)
    # This has been around since 386BSD, at least.  Likely further.
    if test -x /sbin/sysctl; then
      lt_cv_sys_max_cmd_len=`/sbin/sysctl -n kern.argmax`
@@ -1763,7 +1773,7 @@ AC_CACHE_VAL([lt_cv_sys_max_cmd_len], [dnl
  sysv5* | sco5v6* | sysv4.2uw2*)
    kargmax=`grep ARG_MAX /etc/conf/cf.d/stune 2>/dev/null`
    if test -n "$kargmax"; then
-      lt_cv_sys_max_cmd_len=`echo $kargmax | sed 's/.*[[	 ]]//'`
+      lt_cv_sys_max_cmd_len=`echo $kargmax | $SED 's/.*[[	 ]]//'`
    else
      lt_cv_sys_max_cmd_len=32768
    fi
@@ -2213,26 +2223,35 @@ m4_defun([_LT_CMD_STRIPLIB],
 striplib=
 old_striplib=
 AC_MSG_CHECKING([whether stripping libraries is possible])
-if test -n "$STRIP" && $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
-  test -z "$old_striplib" && old_striplib="$STRIP --strip-debug"
-  test -z "$striplib" && striplib="$STRIP --strip-unneeded"
-  AC_MSG_RESULT([yes])
+if test -z "$STRIP"; then
+  AC_MSG_RESULT([no])
 else
-# FIXME - insert some real tests, host_os isn't really good enough
-  case $host_os in
-  darwin*)
-    if test -n "$STRIP"; then
+  if $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
+    old_striplib="$STRIP --strip-debug"
+    striplib="$STRIP --strip-unneeded"
+    AC_MSG_RESULT([yes])
+  else
+    case $host_os in
+    darwin*)
+      # FIXME - insert some real tests, host_os isn't really good enough
      striplib="$STRIP -x"
      old_striplib="$STRIP -S"
      AC_MSG_RESULT([yes])
-    else
+      ;;
+    freebsd*)
+      if $STRIP -V 2>&1 | $GREP "elftoolchain" >/dev/null; then
+        old_striplib="$STRIP --strip-debug"
+        striplib="$STRIP --strip-unneeded"
+        AC_MSG_RESULT([yes])
+      else
+        AC_MSG_RESULT([no])
+      fi
+      ;;
+    *)
      AC_MSG_RESULT([no])
-    fi
-    ;;
-  *)
-    AC_MSG_RESULT([no])
-    ;;
-  esac
+      ;;
+    esac
+  fi
 fi
 _LT_DECL([], [old_striplib], [1], [Commands to strip libraries])
 _LT_DECL([], [striplib], [1])
@@ -2555,7 +2574,7 @@ cygwin* | mingw* | pw32* | cegcc*)
    case $host_os in
    cygwin*)
      # Cygwin DLLs use 'cyg' prefix rather than 'lib'
-      soname_spec='`echo $libname | sed -e 's/^lib/cyg/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
+      soname_spec='`echo $libname | $SED -e 's/^lib/cyg/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
 m4_if([$1], [],[
      sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/lib/w32api"])
      ;;
@@ -2565,14 +2584,14 @@ m4_if([$1], [],[
      ;;
    pw32*)
      # pw32 DLLs use 'pw' prefix rather than 'lib'
-      library_names_spec='`echo $libname | sed -e 's/^lib/pw/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
+      library_names_spec='`echo $libname | $SED -e 's/^lib/pw/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
      ;;
    esac
    dynamic_linker='Win32 ld.exe'
    ;;

-  *,cl*)
-    # Native MSVC
+  *,cl* | *,icl*)
+    # Native MSVC or ICC
    libname_spec='$name'
    soname_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
    library_names_spec='$libname.dll.lib'
@@ -2591,7 +2610,7 @@ m4_if([$1], [],[
      done
      IFS=$lt_save_ifs
      # Convert to MSYS style.
-      sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | sed -e 's|\\\\|/|g' -e 's| \\([[a-zA-Z]]\\):| /\\1|g' -e 's|^ ||'`
+      sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e 's|\\\\|/|g' -e 's| \\([[a-zA-Z]]\\):| /\\1|g' -e 's|^ ||'`
      ;;
    cygwin*)
      # Convert to unix form, then to dos form, then back to unix form
@@ -2628,7 +2647,7 @@ m4_if([$1], [],[
    ;;

  *)
-    # Assume MSVC wrapper
+    # Assume MSVC and ICC wrapper
    library_names_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext $libname.lib'
    dynamic_linker='Win32 ld.exe'
    ;;
@@ -2661,7 +2680,7 @@ dgux*)
  shlibpath_var=LD_LIBRARY_PATH
  ;;

-freebsd* | dragonfly*)
+freebsd* | dragonfly* | midnightbsd*)
  # DragonFly does not have aout.  When/if they implement a new
  # versioning mechanism, adjust this.
  if test -x /usr/bin/objformat; then
@@ -2873,9 +2892,6 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
  # before this can be enabled.
  hardcode_into_libs=yes

-  # Add ABI-specific directories to the system library path.
-  sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /lib /usr/lib"
-
  # Ideally, we could use ldconfig to report *all* directores which are
  # searched for libraries, however this is still not possible.  Aside from not
  # being certain /sbin/ldconfig is available, command
@@ -2884,7 +2900,7 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
  # appending ld.so.conf contents (and includes) to the search path.
  if test -f /etc/ld.so.conf; then
    lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \[$]2)); skip = 1; } { if (!skip) print \[$]0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[	 ]*hwcap[	 ]/d;s/[:,	]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '`
-    sys_lib_dlsearch_path_spec="$sys_lib_dlsearch_path_spec $lt_ld_extra"
+    sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra"
  fi

  # We used to test for /lib/ld.so.1 and disable shared libraries on
@@ -2896,6 +2912,18 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
  dynamic_linker='GNU/Linux ld.so'
  ;;

+netbsdelf*-gnu)
+  version_type=linux
+  need_lib_prefix=no
+  need_version=no
+  library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}'
+  soname_spec='${libname}${release}${shared_ext}$major'
+  shlibpath_var=LD_LIBRARY_PATH
+  shlibpath_overrides_runpath=no
+  hardcode_into_libs=yes
+  dynamic_linker='NetBSD ld.elf_so'
+  ;;
+
 netbsd*)
  version_type=sunos
  need_lib_prefix=no
@@ -3463,7 +3491,7 @@ beos*)

 bsdi[[45]]*)
  lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (shared object|dynamic lib)'
-  lt_cv_file_magic_cmd='/usr/bin/file -L'
+  lt_cv_file_magic_cmd='$FILECMD -L'
  lt_cv_file_magic_test_file=/shlib/libc.so
  ;;

@@ -3497,14 +3525,14 @@ darwin* | rhapsody*)
  lt_cv_deplibs_check_method=pass_all
  ;;

-freebsd* | dragonfly*)
+freebsd* | dragonfly* | midnightbsd*)
  if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
    case $host_cpu in
    i*86 )
      # Not sure whether the presence of OpenBSD here was a mistake.
      # Let's accept both of them until this is cleared up.
      lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|DragonFly)/i[[3-9]]86 (compact )?demand paged shared library'
-      lt_cv_file_magic_cmd=/usr/bin/file
+      lt_cv_file_magic_cmd=$FILECMD
      lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*`
      ;;
    esac
@@ -3518,7 +3546,7 @@ haiku*)
  ;;

 hpux10.20* | hpux11*)
-  lt_cv_file_magic_cmd=/usr/bin/file
+  lt_cv_file_magic_cmd=$FILECMD
  case $host_cpu in
  ia64*)
    lt_cv_deplibs_check_method='file_magic (s[[0-9]][[0-9]][[0-9]]|ELF-[[0-9]][[0-9]]) shared object file - IA64'
@@ -3555,7 +3583,7 @@ linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
  lt_cv_deplibs_check_method=pass_all
  ;;

-netbsd*)
+netbsd* | netbsdelf*-gnu)
  if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
    lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+|_pic\.a)$'
  else
@@ -3565,7 +3593,7 @@ netbsd*)

 newos6*)
  lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (executable|dynamic lib)'
-  lt_cv_file_magic_cmd=/usr/bin/file
+  lt_cv_file_magic_cmd=$FILECMD
  lt_cv_file_magic_test_file=/usr/lib/libnls.so
  ;;

@@ -3692,13 +3720,13 @@ else
 	mingw*) lt_bad_file=conftest.nm/nofile ;;
 	*) lt_bad_file=/dev/null ;;
 	esac
-	case `"$tmp_nm" -B $lt_bad_file 2>&1 | sed '1q'` in
+	case `"$tmp_nm" -B $lt_bad_file 2>&1 | $SED '1q'` in
 	*$lt_bad_file* | *'Invalid file or object type'*)
 	  lt_cv_path_NM="$tmp_nm -B"
 	  break 2
 	  ;;
 	*)
-	  case `"$tmp_nm" -p /dev/null 2>&1 | sed '1q'` in
+	  case `"$tmp_nm" -p /dev/null 2>&1 | $SED '1q'` in
 	  */dev/null*)
 	    lt_cv_path_NM="$tmp_nm -p"
 	    break 2
@@ -3724,7 +3752,7 @@ else
    # Let the user override the test.
  else
    AC_CHECK_TOOLS(DUMPBIN, [dumpbin "link -dump"], :)
-    case `$DUMPBIN -symbols -headers /dev/null 2>&1 | sed '1q'` in
+    case `$DUMPBIN -symbols -headers /dev/null 2>&1 | $SED '1q'` in
    *COFF*)
      DUMPBIN="$DUMPBIN -symbols -headers"
      ;;
@@ -3964,7 +3992,7 @@ esac

 if test "$lt_cv_nm_interface" = "MS dumpbin"; then
  # Gets list of data symbols to import.
-  lt_cv_sys_global_symbol_to_import="sed -n -e 's/^I .* \(.*\)$/\1/p'"
+  lt_cv_sys_global_symbol_to_import="$SED -n -e 's/^I .* \(.*\)$/\1/p'"
  # Adjust the below global symbol transforms to fixup imported variables.
  lt_cdecl_hook=" -e 's/^I .* \(.*\)$/extern __declspec(dllimport) char \1;/p'"
  lt_c_name_hook=" -e 's/^I .* \(.*\)$/  {\"\1\", (void *) 0},/p'"
@@ -3982,20 +4010,20 @@ fi
 # Transform an extracted symbol line into a proper C declaration.
 # Some systems (esp. on ia64) link data and code symbols differently,
 # so use this general approach.
-lt_cv_sys_global_symbol_to_cdecl="sed -n"\
+lt_cv_sys_global_symbol_to_cdecl="$SED -n"\
 $lt_cdecl_hook\
 " -e 's/^T .* \(.*\)$/extern int \1();/p'"\
 " -e 's/^$symcode$symcode* .* \(.*\)$/extern char \1;/p'"

 # Transform an extracted symbol line into symbol name and symbol address
-lt_cv_sys_global_symbol_to_c_name_address="sed -n"\
+lt_cv_sys_global_symbol_to_c_name_address="$SED -n"\
 $lt_c_name_hook\
 " -e 's/^: \(.*\) .*$/  {\"\1\", (void *) 0},/p'"\
 " -e 's/^$symcode$symcode* .* \(.*\)$/  {\"\1\", (void *) \&\1},/p'"

 # Transform an extracted symbol line into symbol name with lib prefix and
 # symbol address.
-lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="sed -n"\
+lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="$SED -n"\
 $lt_c_name_lib_hook\
 " -e 's/^: \(.*\) .*$/  {\"\1\", (void *) 0},/p'"\
 " -e 's/^$symcode$symcode* .* \(lib.*\)$/  {\"\1\", (void *) \&\1},/p'"\
@@ -4019,7 +4047,7 @@ for ac_symprfx in "" "_"; do
  if test "$lt_cv_nm_interface" = "MS dumpbin"; then
    # Fake it for dumpbin and say T for any non-static function,
    # D for any global variable and I for any imported variable.
-    # Also find C++ and __fastcall symbols from MSVC++,
+    # Also find C++ and __fastcall symbols from MSVC++ or ICC,
    # which start with @ or ?.
    lt_cv_sys_global_symbol_pipe="$AWK ['"\
 "     {last_section=section; section=\$ 3};"\
@@ -4037,9 +4065,9 @@ for ac_symprfx in "" "_"; do
 "     s[1]~prfx {split(s[1],t,\"@\"); print f,t[1],substr(t[1],length(prfx))}"\
 "     ' prfx=^$ac_symprfx]"
  else
-    lt_cv_sys_global_symbol_pipe="sed -n -e 's/^.*[[	 ]]\($symcode$symcode*\)[[	 ]][[	 ]]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
+    lt_cv_sys_global_symbol_pipe="$SED -n -e 's/^.*[[	 ]]\($symcode$symcode*\)[[	 ]][[	 ]]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
  fi
-  lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | sed '/ __gnu_lto/d'"
+  lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | $SED '/ __gnu_lto/d'"

  # Check to see that the pipe works correctly.
  pipe_works=no
@@ -4061,7 +4089,8 @@ _LT_EOF
  if AC_TRY_EVAL(ac_compile); then
    # Now try to grab the symbols.
    nlist=conftest.nm
-    if AC_TRY_EVAL(NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) && test -s "$nlist"; then
+    $ECHO "$as_me:$LINENO: $NM conftest.$ac_objext | $lt_cv_sys_global_symbol_pipe > $nlist" >&AS_MESSAGE_LOG_FD
+    if eval "$NM" conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist 2>&AS_MESSAGE_LOG_FD && test -s "$nlist"; then
      # Try sorting and uniquifying the output.
      if sort "$nlist" | uniq > "$nlist"T; then
 	mv -f "$nlist"T "$nlist"
@@ -4326,7 +4355,7 @@ m4_if([$1], [CXX], [
 	    ;;
 	esac
 	;;
-      freebsd* | dragonfly*)
+      freebsd* | dragonfly* | midnightbsd*)
 	# FreeBSD uses GNU C++
 	;;
      hpux9* | hpux10* | hpux11*)
@@ -4409,7 +4438,7 @@ m4_if([$1], [CXX], [
 	    _LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink'
 	    ;;
 	  *)
-	    case `$CC -V 2>&1 | sed 5q` in
+	    case `$CC -V 2>&1 | $SED 5q` in
 	    *Sun\ C*)
 	      # Sun C++ 5.9
 	      _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
@@ -4433,7 +4462,7 @@ m4_if([$1], [CXX], [
 	    ;;
 	esac
 	;;
-      netbsd*)
+      netbsd* | netbsdelf*-gnu)
 	;;
      *qnx* | *nto*)
        # QNX uses GNU C++, but need to define -shared option too, otherwise
@@ -4701,6 +4730,12 @@ m4_if([$1], [CXX], [
 	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
 	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
        ;;
+      # flang / f18. f95 an alias for gfortran or flang on Debian
+      flang* | f18* | f95*)
+	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
+	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
+	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
+        ;;
      # icc used to be incompatible with GCC.
      # ICC 10 doesn't accept -KPIC any more.
      icc* | ifort*)
@@ -4745,7 +4780,7 @@ m4_if([$1], [CXX], [
 	_LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink'
 	;;
      *)
-	case `$CC -V 2>&1 | sed 5q` in
+	case `$CC -V 2>&1 | $SED 5q` in
 	*Sun\ Ceres\ Fortran* | *Sun*Fortran*\ [[1-7]].* | *Sun*Fortran*\ 8.[[0-3]]*)
 	  # Sun Fortran 8.3 passes all unrecognized flags to the linker
 	  _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
@@ -4928,7 +4963,7 @@ m4_if([$1], [CXX], [
    if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then
      _LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols'
    else
-      _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
+      _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "L") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
    fi
    ;;
  pw32*)
@@ -4936,7 +4971,7 @@ m4_if([$1], [CXX], [
    ;;
  cygwin* | mingw* | cegcc*)
    case $cc_basename in
-    cl*)
+    cl* | icl*)
      _LT_TAGVAR(exclude_expsyms, $1)='_NULL_IMPORT_DESCRIPTOR|_IMPORT_DESCRIPTOR_.*'
      ;;
    *)
@@ -4945,6 +4980,9 @@ m4_if([$1], [CXX], [
      ;;
    esac
    ;;
+  linux* | k*bsd*-gnu | gnu*)
+    _LT_TAGVAR(link_all_deplibs, $1)=no
+    ;;
  *)
    _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols'
    ;;
@@ -4993,20 +5031,23 @@ dnl Note also adjust exclude_expsyms for C++ above.

  case $host_os in
  cygwin* | mingw* | pw32* | cegcc*)
-    # FIXME: the MSVC++ port hasn't been tested in a loooong time
+    # FIXME: the MSVC++ and ICC port hasn't been tested in a loooong time
    # When not using gcc, we currently assume that we are using
-    # Microsoft Visual C++.
+    # Microsoft Visual C++ or Intel C++ Compiler.
    if test yes != "$GCC"; then
      with_gnu_ld=no
    fi
    ;;
  interix*)
-    # we just hope/assume this is gcc and not c89 (= MSVC++)
+    # we just hope/assume this is gcc and not c89 (= MSVC++ or ICC)
    with_gnu_ld=yes
    ;;
  openbsd* | bitrig*)
    with_gnu_ld=no
    ;;
+  linux* | k*bsd*-gnu | gnu*)
+    _LT_TAGVAR(link_all_deplibs, $1)=no
+    ;;
  esac

  _LT_TAGVAR(ld_shlibs, $1)=yes
@@ -5053,7 +5094,7 @@ dnl Note also adjust exclude_expsyms for C++ above.
      _LT_TAGVAR(whole_archive_flag_spec, $1)=
    fi
    supports_anon_versioning=no
-    case `$LD -v | $SED -e 's/([^)]\+)\s\+//' 2>&1` in
+    case `$LD -v | $SED -e 's/([[^)]]\+)\s\+//' 2>&1` in
      *GNU\ gold*) supports_anon_versioning=yes ;;
      *\ [[01]].* | *\ 2.[[0-9]].* | *\ 2.10.*) ;; # catch versions < 2.11
      *\ 2.11.93.0.2\ *) supports_anon_versioning=yes ;; # RH7.3 ...
@@ -5165,6 +5206,7 @@ _LT_EOF
 	emximp -o $lib $output_objdir/$libname.def'
      _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
      _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
+      _LT_TAGVAR(file_list_spec, $1)='@'
      ;;

    interix[[3-9]]*)
@@ -5179,7 +5221,7 @@ _LT_EOF
      # 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
      # time.  Moving up from 0x10000000 also allows more sbrk(2) space.
      _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
-      _LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
+      _LT_TAGVAR(archive_expsym_cmds, $1)='$SED "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
      ;;

    gnu* | linux* | tpf* | k*bsd*-gnu | kopensolaris*-gnu)
@@ -5222,7 +5264,7 @@ _LT_EOF
 	  _LT_TAGVAR(compiler_needs_object, $1)=yes
 	  ;;
 	esac
-	case `$CC -V 2>&1 | sed 5q` in
+	case `$CC -V 2>&1 | $SED 5q` in
 	*Sun\ C*)			# Sun C 5.9
 	  _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" || new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
 	  _LT_TAGVAR(compiler_needs_object, $1)=yes
@@ -5234,13 +5276,14 @@ _LT_EOF

        if test yes = "$supports_anon_versioning"; then
          _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
-            cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+            cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
            echo "local: *; };" >> $output_objdir/$libname.ver~
            $CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
        fi

 	case $cc_basename in
 	tcc*)
+	  _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
 	  _LT_TAGVAR(export_dynamic_flag_spec, $1)='-rdynamic'
 	  ;;
 	xlf* | bgf* | bgxlf* | mpixlf*)
@@ -5250,7 +5293,7 @@ _LT_EOF
 	  _LT_TAGVAR(archive_cmds, $1)='$LD -shared $libobjs $deplibs $linker_flags -soname $soname -o $lib'
 	  if test yes = "$supports_anon_versioning"; then
 	    _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
-              cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+              cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
              echo "local: *; };" >> $output_objdir/$libname.ver~
              $LD -shared $libobjs $deplibs $linker_flags -soname $soname -version-script $output_objdir/$libname.ver -o $lib'
 	  fi
@@ -5261,7 +5304,7 @@ _LT_EOF
      fi
      ;;

-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
      if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
 	wlarc=
@@ -5382,7 +5425,7 @@ _LT_EOF
 	if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then
 	  _LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols'
 	else
-	  _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
+	  _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "L") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
 	fi
 	aix_use_runtimelinking=no

@@ -5565,12 +5608,12 @@ _LT_EOF

    cygwin* | mingw* | pw32* | cegcc*)
      # When not using gcc, we currently assume that we are using
-      # Microsoft Visual C++.
+      # Microsoft Visual C++ or Intel C++ Compiler.
      # hardcode_libdir_flag_spec is actually meaningless, as there is
      # no search path for DLLs.
      case $cc_basename in
-      cl*)
-	# Native MSVC
+      cl* | icl*)
+	# Native MSVC or ICC
 	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
 	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
 	_LT_TAGVAR(always_export_symbols, $1)=yes
@@ -5611,7 +5654,7 @@ _LT_EOF
          fi'
 	;;
      *)
-	# Assume MSVC wrapper
+	# Assume MSVC and ICC wrapper
 	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
 	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
 	# Tell ltmain to make .lib files, not .a files.
@@ -5659,7 +5702,7 @@ _LT_EOF
      ;;

    # FreeBSD 3 and greater uses gcc -shared to do shared libraries.
-    freebsd* | dragonfly*)
+    freebsd* | dragonfly* | midnightbsd*)
      _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
      _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir'
      _LT_TAGVAR(hardcode_direct, $1)=yes
@@ -5782,6 +5825,7 @@ _LT_EOF
 	if test yes = "$lt_cv_irix_exported_symbol"; then
          _LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib'
 	fi
+	_LT_TAGVAR(link_all_deplibs, $1)=no
      else
 	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
 	_LT_TAGVAR(archive_expsym_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib'
@@ -5799,11 +5843,12 @@ _LT_EOF
 	# Fabrice Bellard et al's Tiny C Compiler
 	_LT_TAGVAR(ld_shlibs, $1)=yes
 	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
+	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-rpath $wl$libdir'
 	;;
      esac
      ;;

-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
      if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'  # a.out
      else
@@ -5870,6 +5915,7 @@ _LT_EOF
 	emximp -o $lib $output_objdir/$libname.def'
      _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
      _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
+      _LT_TAGVAR(file_list_spec, $1)='@'
      ;;

    osf3*)
@@ -6425,7 +6471,7 @@ if test yes != "$_lt_caught_CXX_error"; then
      # Commands to make compiler produce verbose output that lists
      # what "hidden" libraries, object files and flags are used when
      # linking a shared library.
-      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'

    else
      GXX=no
@@ -6636,8 +6682,8 @@ if test yes != "$_lt_caught_CXX_error"; then

      cygwin* | mingw* | pw32* | cegcc*)
 	case $GXX,$cc_basename in
-	,cl* | no,cl*)
-	  # Native MSVC
+	,cl* | no,cl* | ,icl* | no,icl*)
+	  # Native MSVC or ICC
 	  # hardcode_libdir_flag_spec is actually meaningless, as there is
 	  # no search path for DLLs.
 	  _LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
@@ -6735,6 +6781,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	  emximp -o $lib $output_objdir/$libname.def'
 	_LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
 	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
+	_LT_TAGVAR(file_list_spec, $1)='@'
 	;;

      dgux*)
@@ -6765,7 +6812,7 @@ if test yes != "$_lt_caught_CXX_error"; then
        _LT_TAGVAR(archive_cmds_need_lc, $1)=no
        ;;

-      freebsd* | dragonfly*)
+      freebsd* | dragonfly* | midnightbsd*)
        # FreeBSD 3 and later use GNU C++ and GNU ld with standard ELF
        # conventions
        _LT_TAGVAR(ld_shlibs, $1)=yes
@@ -6800,7 +6847,7 @@ if test yes != "$_lt_caught_CXX_error"; then
            # explicitly linking system object files so we need to strip them
            # from the output so that they don't get included in the library
            # dependencies.
-            output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+            output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
            ;;
          *)
            if test yes = "$GXX"; then
@@ -6865,7 +6912,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	    # explicitly linking system object files so we need to strip them
 	    # from the output so that they don't get included in the library
 	    # dependencies.
-	    output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+	    output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
 	    ;;
          *)
 	    if test yes = "$GXX"; then
@@ -6902,7 +6949,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	# 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
 	# time.  Moving up from 0x10000000 also allows more sbrk(2) space.
 	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
-	_LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
+	_LT_TAGVAR(archive_expsym_cmds, $1)='$SED "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
 	;;
      irix5* | irix6*)
        case $cc_basename in
@@ -7042,13 +7089,13 @@ if test yes != "$_lt_caught_CXX_error"; then
 	    _LT_TAGVAR(archive_cmds, $1)='$CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
 	    if test yes = "$supports_anon_versioning"; then
 	      _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
-                cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+                cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
                echo "local: *; };" >> $output_objdir/$libname.ver~
                $CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
 	    fi
 	    ;;
 	  *)
-	    case `$CC -V 2>&1 | sed 5q` in
+	    case `$CC -V 2>&1 | $SED 5q` in
 	    *Sun\ C*)
 	      # Sun C++ 5.9
 	      _LT_TAGVAR(no_undefined_flag, $1)=' -zdefs'
@@ -7204,7 +7251,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	      # Commands to make compiler produce verbose output that lists
 	      # what "hidden" libraries, object files and flags are used when
 	      # linking a shared library.
-	      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	      output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'

 	    else
 	      # FIXME: insert proper C++ library support
@@ -7288,7 +7335,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	        # Commands to make compiler produce verbose output that lists
 	        # what "hidden" libraries, object files and flags are used when
 	        # linking a shared library.
-	        output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	        output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	      else
 	        # g++ 2.7 appears to require '-G' NOT '-shared' on this
 	        # platform.
@@ -7299,7 +7346,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	        # Commands to make compiler produce verbose output that lists
 	        # what "hidden" libraries, object files and flags are used when
 	        # linking a shared library.
-	        output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	        output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	      fi

 	      _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $wl$libdir'
@@ -8186,6 +8233,14 @@ _LT_DECL([], [DLLTOOL], [1], [DLL creation program])
 AC_SUBST([DLLTOOL])
 ])

+# _LT_DECL_FILECMD
+# ----------------
+# Check for a file(cmd) program that can be used to detect file type and magic
+m4_defun([_LT_DECL_FILECMD],
+[AC_CHECK_TOOL([FILECMD], [file], [:])
+_LT_DECL([], [FILECMD], [1], [A file(cmd) program that detects file types])
+])# _LD_DECL_FILECMD
+
 # _LT_DECL_SED
 # ------------
 # Check for a fully-functional sed program, that truncates
@@ -8365,8 +8420,8 @@ _LT_DECL([to_tool_file_cmd], [lt_cv_to_tool_file_cmd],

 # Helper functions for option handling.                    -*- Autoconf -*-
 #
-#   Copyright (C) 2004-2005, 2007-2009, 2011-2015 Free Software
-#   Foundation, Inc.
+#   Copyright (C) 2004-2005, 2007-2009, 2011-2019, 2021-2022 Free
+#   Software Foundation, Inc.
 #   Written by Gary V. Vaughan, 2004
 #
 # This file is free software; the Free Software Foundation gives
@@ -8797,7 +8852,7 @@ LT_OPTION_DEFINE([LTDL_INIT], [convenience],

 # ltsugar.m4 -- libtool m4 base layer.                         -*-Autoconf-*-
 #
-# Copyright (C) 2004-2005, 2007-2008, 2011-2015 Free Software
+# Copyright (C) 2004-2005, 2007-2008, 2011-2019, 2021-2022 Free Software
 # Foundation, Inc.
 # Written by Gary V. Vaughan, 2004
 #
@@ -8922,7 +8977,8 @@ m4_define([lt_dict_filter],

 # ltversion.m4 -- version numbers			-*- Autoconf -*-
 #
-#   Copyright (C) 2004, 2011-2015 Free Software Foundation, Inc.
+#   Copyright (C) 2004, 2011-2019, 2021-2022 Free Software Foundation,
+#   Inc.
 #   Written by Scott James Remnant, 2004
 #
 # This file is free software; the Free Software Foundation gives
@@ -8931,23 +8987,23 @@ m4_define([lt_dict_filter],

 # @configure_input@

-# serial 4179 ltversion.m4
+# serial 4245 ltversion.m4
 # This file is part of GNU Libtool

-m4_define([LT_PACKAGE_VERSION], [2.4.6])
-m4_define([LT_PACKAGE_REVISION], [2.4.6])
+m4_define([LT_PACKAGE_VERSION], [2.4.7])
+m4_define([LT_PACKAGE_REVISION], [2.4.7])

 AC_DEFUN([LTVERSION_VERSION],
-[macro_version='2.4.6'
-macro_revision='2.4.6'
+[macro_version='2.4.7'
+macro_revision='2.4.7'
 _LT_DECL(, macro_version, 0, [Which release of libtool.m4 was used?])
 _LT_DECL(, macro_revision, 0)
 ])

 # lt~obsolete.m4 -- aclocal satisfying obsolete definitions.    -*-Autoconf-*-
 #
-#   Copyright (C) 2004-2005, 2007, 2009, 2011-2015 Free Software
-#   Foundation, Inc.
+#   Copyright (C) 2004-2005, 2007, 2009, 2011-2019, 2021-2022 Free
+#   Software Foundation, Inc.
 #   Written by Scott James Remnant, 2004.
 #
 # This file is free software; the Free Software Foundation gives
@@ -9044,8 +9100,8 @@ m4_ifndef([_LT_PROG_F77],		[AC_DEFUN([_LT_PROG_F77])])
 m4_ifndef([_LT_PROG_FC],		[AC_DEFUN([_LT_PROG_FC])])
 m4_ifndef([_LT_PROG_CXX],		[AC_DEFUN([_LT_PROG_CXX])])

-# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
-# serial 11 (pkg-config-0.29.1)
+# pkg.m4 - Macros to locate and use pkg-config.   -*- Autoconf -*-
+# serial 12 (pkg-config-0.29.2)

 dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
 dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
@@ -9087,7 +9143,7 @@ dnl
 dnl See the "Since" comment for each macro you use to see what version
 dnl of the macros you require.
 m4_defun([PKG_PREREQ],
-[m4_define([PKG_MACROS_VERSION], [0.29.1])
+[m4_define([PKG_MACROS_VERSION], [0.29.2])
 m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
    [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
 ])dnl PKG_PREREQ
@@ -9132,7 +9188,7 @@ dnl Check to see whether a particular set of modules exists. Similar to
 dnl PKG_CHECK_MODULES(), but does not set variables or print errors.
 dnl
 dnl Please remember that m4 expands AC_REQUIRE([PKG_PROG_PKG_CONFIG])
-dnl only at the first occurence in configure.ac, so if the first place
+dnl only at the first occurrence in configure.ac, so if the first place
 dnl it's called might be skipped (such as if it is within an "if", you
 dnl have to call PKG_CHECK_EXISTS manually
 AC_DEFUN([PKG_CHECK_EXISTS],
@@ -9188,7 +9244,7 @@ AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
 AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl

 pkg_failed=no
-AC_MSG_CHECKING([for $1])
+AC_MSG_CHECKING([for $2])

 _PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
 _PKG_CONFIG([$1][_LIBS], [libs], [$2])
@@ -9198,17 +9254,17 @@ and $1[]_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details.])

 if test $pkg_failed = yes; then
-   	AC_MSG_RESULT([no])
+        AC_MSG_RESULT([no])
        _PKG_SHORT_ERRORS_SUPPORTED
        if test $_pkg_short_errors_supported = yes; then
-	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
-        else 
-	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
+                $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
+        else
+                $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
        fi
-	# Put the nasty error message in config.log where it belongs
-	echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD
+        # Put the nasty error message in config.log where it belongs
+        echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD

-	m4_default([$4], [AC_MSG_ERROR(
+        m4_default([$4], [AC_MSG_ERROR(
 [Package requirements ($2) were not met:

 $$1_PKG_ERRORS
@@ -9219,8 +9275,8 @@ installed software in a non-standard prefix.
 _PKG_TEXT])[]dnl
        ])
 elif test $pkg_failed = untried; then
-     	AC_MSG_RESULT([no])
-	m4_default([$4], [AC_MSG_FAILURE(
+        AC_MSG_RESULT([no])
+        m4_default([$4], [AC_MSG_FAILURE(
 [The pkg-config script could not be found or is too old.  Make sure it
 is in your PATH or set the PKG_CONFIG environment variable to the full
 path to pkg-config.
@@ -9230,10 +9286,10 @@ _PKG_TEXT
 To get pkg-config, see <http://pkg-config.freedesktop.org/>.])[]dnl
        ])
 else
-	$1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
-	$1[]_LIBS=$pkg_cv_[]$1[]_LIBS
+        $1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
+        $1[]_LIBS=$pkg_cv_[]$1[]_LIBS
        AC_MSG_RESULT([yes])
-	$3
+        $3
 fi[]dnl
 ])dnl PKG_CHECK_MODULES

@@ -9390,7 +9446,7 @@ AS_IF([test "$AS_TR_SH([with_]m4_tolower([$1]))" = "yes"],

 # AM_CONDITIONAL                                            -*- Autoconf -*-

-# Copyright (C) 1997-2020 Free Software Foundation, Inc.
+# Copyright (C) 1997-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -9421,7 +9477,7 @@ AC_CONFIG_COMMANDS_PRE(
 Usually this means the macro was only invoked conditionally.]])
 fi])])

-# Copyright (C) 2006-2020 Free Software Foundation, Inc.
+# Copyright (C) 2006-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -2,7 +2,10 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 48
+# Version 50
+# 2025-09-29 add ac_cv_func_malloc_0_nonnull as a cache value for the malloc(0)
+#            check by ACX_FUNC_MALLOC.
+# 2025-09-29 add ACX_CHECK_NONSTRING_ATTRIBUTE, AHX_CONFIG_NONSTRING_ATTRIBUTE.
 # 2024-01-16 fix to add -l:libssp.a to -lcrypto link check.
 #	     and check for getaddrinfo with only header.
 # 2024-01-15 fix to add crypt32 to -lcrypto link check when checking for gdi32.
@@ -71,6 +74,7 @@
 # ACX_DEPFLAG			- find cc dependency flags.
 # ACX_DETERMINE_EXT_FLAGS_UNBOUND - find out which flags enable BSD and POSIX.
 # ACX_CHECK_FORMAT_ATTRIBUTE	- find cc printf format syntax.
+# ACX_CHECK_NONSTRING_ATTRIBUTE - find cc nonstring attribute syntax.
 # ACX_CHECK_UNUSED_ATTRIBUTE	- find cc variable unused syntax.
 # ACX_CHECK_FLTO		- see if cc supports -flto and use it if so.
 # ACX_LIBTOOL_C_ONLY		- create libtool for C only, improved.
@@ -92,6 +96,7 @@
 # ACX_FUNC_IOCTLSOCKET		- find ioctlsocket, portably.
 # ACX_FUNC_MALLOC		- check malloc, define replacement .
 # AHX_CONFIG_FORMAT_ATTRIBUTE	- config.h text for format.
+# AHX_CONFIG_NONSTRING_ATTRIBUTE - config.h text for nonstring.
 # AHX_CONFIG_UNUSED_ATTRIBUTE	- config.h text for unused.
 # AHX_CONFIG_FSEEKO		- define fseeko, ftello fallback.
 # AHX_CONFIG_RAND_MAX		- define RAND_MAX if needed.
@@ -490,7 +495,7 @@ AC_DEFUN([AHX_CONFIG_FORMAT_ATTRIBUTE],
 ])

 dnl Check how to mark function arguments as unused.
-dnl result in HAVE_ATTR_UNUSED.  
+dnl result in HAVE_ATTR_UNUSED.
 dnl Make sure you include AHX_CONFIG_UNUSED_ATTRIBUTE also.
 AC_DEFUN([ACX_CHECK_UNUSED_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
@@ -525,6 +530,45 @@ if test $ac_cv_c_unused_attribute = yes; then
 fi
 ])dnl

+dnl Check how to mark function arguments as nonstring.
+dnl result in HAVE_ATTR_NONSTRING.
+dnl Make sure you include AHX_CONFIG_NONSTRING_ATTRIBUTE also.
+AC_DEFUN([ACX_CHECK_NONSTRING_ATTRIBUTE],
+[AC_REQUIRE([AC_PROG_CC])
+AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "nonstring" attribute)
+AC_CACHE_VAL(ac_cv_c_nonstring_attribute,
+[ac_cv_c_nonstring_attribute=no
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
+struct test {
+    char __attribute__((nonstring)) s[1];
+};
+]], [[
+   struct test t = { "1" };
+   (void) t;
+]])],[ac_cv_c_nonstring_attribute="yes"],[ac_cv_c_nonstring_attribute="no"])
+])
+
+dnl Setup ATTR_NONSTRING config.h parts.
+dnl make sure you call ACX_CHECK_NONSTRING_ATTRIBUTE also.
+AC_DEFUN([AHX_CONFIG_NONSTRING_ATTRIBUTE],
+[
+#if defined(DOXYGEN)
+#  define ATTR_NONSTRING(x)  x
+#elif defined(__cplusplus)
+#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
+#elif defined(HAVE_ATTR_NONSTRING)
+#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
+#else /* !HAVE_ATTR_NONSTRING */
+#  define ATTR_NONSTRING(x)  x
+#endif /* !HAVE_ATTR_NONSTRING */
+])
+
+AC_MSG_RESULT($ac_cv_c_nonstring_attribute)
+if test $ac_cv_c_nonstring_attribute = yes; then
+  AC_DEFINE(HAVE_ATTR_NONSTRING, 1, [Whether the C compiler accepts the "nonstring" attribute])
+fi
+])dnl
+
 dnl Pre-fun for ACX_LIBTOOL_C_ONLY
 AC_DEFUN([ACX_LIBTOOL_C_PRE], [
 # skip these tests, we do not need them.
@@ -1190,8 +1234,9 @@ dnl detect malloc and provide malloc compat prototype.
 dnl $1: unique name for compat code
 AC_DEFUN([ACX_FUNC_MALLOC],
 [
-	AC_MSG_CHECKING([for GNU libc compatible malloc])
-	AC_RUN_IFELSE([AC_LANG_PROGRAM(
+	AC_CACHE_CHECK([for GNU libc compatible malloc],[ac_cv_func_malloc_0_nonnull],
+	[
+		AC_RUN_IFELSE([AC_LANG_PROGRAM(
 [[#if defined STDC_HEADERS || defined HAVE_STDLIB_H
 #include <stdlib.h>
 #else
@@ -1199,14 +1244,16 @@ char *malloc ();
 #endif
 ]], [ if(malloc(0) != 0) return 1;])
 ],
-	[AC_MSG_RESULT([no])
-	AC_LIBOBJ(malloc)
-	AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])] ,
-	[AC_MSG_RESULT([yes])
-	AC_DEFINE([HAVE_MALLOC], 1, [If have GNU libc compatible malloc])],
-	[AC_MSG_RESULT([no (crosscompile)])
-	AC_LIBOBJ(malloc)
-	AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])] )
+		[ac_cv_func_malloc_0_nonnull=no],
+		[ac_cv_func_malloc_0_nonnull=yes],
+		[ac_cv_func_malloc_0_nonnull="no (crosscompile)"])
+	])
+	AS_IF([test "$ac_cv_func_malloc_0_nonnull" = yes],
+		[AC_DEFINE([HAVE_MALLOC], 1, [If have GNU libc compatible malloc])],
+	[
+		AC_LIBOBJ(malloc)
+		AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])
+	])
 ])

 dnl Define fallback for fseeko and ftello if needed.
@@ -401,12 +401,9 @@ prep_data(struct module_qstate* qstate, struct sldns_buffer* buf)
 	   FLAGS_GET_RCODE(qstate->return_msg->rep->flags) !=
 		LDNS_RCODE_YXDOMAIN)
 		return 0;
-	/* We don't store the reply if its TTL is 0 unless serve-expired is
-	 * enabled.  Such a reply won't be reusable and simply be a waste for
-	 * the backend.  It's also compatible with the default behavior of
-	 * dns_cache_store_msg(). */
-	if(qstate->return_msg->rep->ttl == 0 &&
-		!qstate->env->cfg->serve_expired)
+	/* We don't store the reply if its TTL is 0. This is probably coming
+	 * from upstream and it is not meant to be stored. */
+	if(qstate->return_msg->rep->ttl == 0)
 		return 0;

 	/* The EDE is added to the out-list so it is encoded in the cached message */
@@ -460,7 +457,7 @@ good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
 	 * - serve_expired needs to be set
 	 * - if SERVE_EXPIRED_TTL is set make sure that the record is not older
 	 *   than that. */
-	if((time_t)expiry < *qstate->env->now &&
+	if(TTL_IS_EXPIRED((time_t)expiry, *qstate->env->now) &&
 		(!qstate->env->cfg->serve_expired ||
 			(SERVE_EXPIRED_TTL &&
 			*qstate->env->now - (time_t)expiry > SERVE_EXPIRED_TTL)))
@@ -472,7 +469,8 @@ good_expiry_and_qinfo(struct module_qstate* qstate, struct sldns_buffer* buf)
 /* Adjust the TTL of the given RRset by 'subtract'.  If 'subtract' is
 * negative, set the TTL to 0. */
 static void
-packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
+packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract,
+	time_t timestamp)
 {
 	size_t i;
 	size_t total = data->count + data->rrsig_count;
@@ -484,13 +482,13 @@ packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
 			data->rr_ttl[i] -= subtract;
 		else	data->rr_ttl[i] = 0;
 	}
-	data->ttl_add = (subtract < data->ttl_add) ? (data->ttl_add - subtract) : 0;
+	data->ttl_add = timestamp;
 }

 /* Adjust the TTL of a DNS message and its RRs by 'adjust'.  If 'adjust' is
 * negative, set the TTLs to 0. */
 static void
-adjust_msg_ttl(struct dns_msg* msg, time_t adjust)
+adjust_msg_ttl(struct dns_msg* msg, time_t adjust, time_t timestamp)
 {
 	size_t i;
 	if(adjust >= 0 && msg->rep->ttl > adjust)
@@ -502,13 +500,13 @@ adjust_msg_ttl(struct dns_msg* msg, time_t adjust)

 	for(i=0; i<msg->rep->rrset_count; i++) {
 		packed_rrset_ttl_subtract((struct packed_rrset_data*)msg->
-			rep->rrsets[i]->entry.data, adjust);
+			rep->rrsets[i]->entry.data, adjust, timestamp);
 	}
 }

 /* Set the TTL of the given RRset to fixed value. */
 static void
-packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl)
+packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl, time_t timestamp)
 {
 	size_t i;
 	size_t total = data->count + data->rrsig_count;
@@ -516,12 +514,12 @@ packed_rrset_ttl_set(struct packed_rrset_data* data, time_t ttl)
 	for(i=0; i<total; i++) {
 		data->rr_ttl[i] = ttl;
 	}
-	data->ttl_add = 0;
+	data->ttl_add = timestamp;
 }

 /* Set the TTL of a DNS message and its RRs by to a fixed value. */
 static void
-set_msg_ttl(struct dns_msg* msg, time_t ttl)
+set_msg_ttl(struct dns_msg* msg, time_t ttl, time_t timestamp)
 {
 	size_t i;
 	msg->rep->ttl = ttl;
@@ -530,14 +528,14 @@ set_msg_ttl(struct dns_msg* msg, time_t ttl)

 	for(i=0; i<msg->rep->rrset_count; i++) {
 		packed_rrset_ttl_set((struct packed_rrset_data*)msg->
-			rep->rrsets[i]->entry.data, ttl);
+			rep->rrsets[i]->entry.data, ttl, timestamp);
 	}
 }

 /** convert dns message in buffer to return_msg */
 static int
 parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
-	int* msg_expired)
+	int* msg_expired, time_t* msg_timestamp, time_t* msg_expiry)
 {
 	struct msg_parse* prs;
 	struct edns_data edns;
@@ -554,6 +552,9 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 		&timestamp, sizeof(timestamp));
 	expiry = be64toh(expiry);
 	timestamp = be64toh(timestamp);
+	log_assert(timestamp <= expiry);
+	*msg_expiry = (time_t)expiry;
+	*msg_timestamp = (time_t)timestamp;

 	/* parse DNS packet */
 	regional_free_all(qstate->env->scratch);
@@ -605,11 +606,9 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 		return 1; /* message from the future (clock skew?) */
 	}
 	adjust = *qstate->env->now - (time_t)timestamp;
-	if(qstate->return_msg->rep->ttl < adjust) {
+	if(TTL_IS_EXPIRED((time_t)expiry, *qstate->env->now)) {
 		verbose(VERB_ALGO, "cachedb msg expired");
 		*msg_expired = 1;
-		/* If serve-expired is enabled, we still use an expired message
-		 * setting the TTL to 0. */
 		if(!qstate->env->cfg->serve_expired ||
 			(FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
 			!= LDNS_RCODE_NOERROR &&
@@ -618,23 +617,21 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 			FLAGS_GET_RCODE(qstate->return_msg->rep->flags)
 			!= LDNS_RCODE_YXDOMAIN))
 			return 0; /* message expired */
-		else
-			adjust = -1;
+		/* If serve-expired is enabled, we still use an expired message.
+		 * Set the TTL to 0 now and it will be handled specially later
+		 * when we need to store it internally. */
+		adjust = -1;
 	}
+	adjust_msg_ttl(qstate->return_msg, adjust, timestamp);
 	verbose(VERB_ALGO, "cachedb msg adjusted down by %d", (int)adjust);
-	adjust_msg_ttl(qstate->return_msg, adjust);
 	if(qstate->env->cfg->aggressive_nsec) {
 		limit_nsec_ttl(qstate->return_msg);
 	}

 	/* Similar to the unbound worker, if serve-expired is enabled and
 	 * the msg would be considered to be expired, mark the state so a
-	 * refetch will be scheduled.  The comparison between 'expiry' and
-	 * 'now' should be redundant given how these values were calculated,
-	 * but we check it just in case as does good_expiry_and_qinfo(). */
-	if(qstate->env->cfg->serve_expired &&
-		!qstate->env->cfg->serve_expired_client_timeout &&
-		(adjust == -1 || (time_t)expiry < *qstate->env->now)) {
+	 * refetch will be scheduled. */
+	if(*msg_expired && !qstate->env->cfg->serve_expired_client_timeout) {
 		qstate->need_refetch = 1;
 	}

@@ -647,7 +644,7 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf,
 */
 static int
 cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
-	int* msg_expired)
+	int* msg_expired, time_t* msg_timestamp, time_t* msg_expiry)
 {
 	char key[(CACHEDB_HASHSIZE/8)*2+1];
 	calc_hash(&qstate->qinfo, qstate->env, key, sizeof(key));
@@ -664,7 +661,8 @@ cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
 	}

 	/* parse dns message into return_msg */
-	if( !parse_data(qstate, qstate->env->scratch_buffer, msg_expired) ) {
+	if( !parse_data(qstate, qstate->env->scratch_buffer, msg_expired,
+		msg_timestamp, msg_expiry) ) {
 		return 0;
 	}
 	return 1;
@@ -736,20 +734,24 @@ cachedb_intcache_lookup(struct module_qstate* qstate, struct cachedb_env* cde)
 * Store query into the internal cache of unbound.
 */
 static void
-cachedb_intcache_store(struct module_qstate* qstate, int msg_expired)
+cachedb_intcache_store(struct module_qstate* qstate, int msg_expired,
+	time_t msg_timestamp, time_t msg_expiry)
 {
 	uint32_t store_flags = qstate->query_flags;
 	int serve_expired = qstate->env->cfg->serve_expired;
-
-	if(qstate->env->cfg->serve_expired)
-		store_flags |= DNSCACHE_STORE_ZEROTTL;
 	if(!qstate->return_msg)
 		return;
 	if(serve_expired && msg_expired) {
-		/* Set TTLs to a value such that value + *env->now is
-		 * going to be now-3 seconds. Making it expired
-		 * in the cache. */
-		set_msg_ttl(qstate->return_msg, (time_t)-3);
+		time_t original_ttl = msg_expiry - msg_timestamp;
+		store_flags |= DNSCACHE_STORE_EXPIRED_MSG_CACHEDB;
+		/* Pass the original TTL of the expired message and signal with
+		 * the DNSCACHE_STORE_EXPIRED_MSG_CACHEDB flag that
+		 * dns_cache_store_msg() needs to set absolute expired TTLs
+		 * based on the original message TTL.
+		 * Results as expired message in the cache */
+		set_msg_ttl(qstate->return_msg, original_ttl, 0);
+		verbose(VERB_ALGO, "cachedb expired msg set to be expired now "
+			"(original ttl: %d)", (int)original_ttl);
 		/* The expired entry does not get checked by the validator
 		 * and we need a validation value for it. */
 		if(qstate->env->cfg->cachedb_check_when_serve_expired)
@@ -767,12 +769,14 @@ cachedb_intcache_store(struct module_qstate* qstate, int msg_expired)
 			 * of cache. */
 			return;
 		}
-		/* set TTLs to zero again */
-		adjust_msg_ttl(qstate->return_msg, -1);
 		/* Send serve expired responses based on the cachedb
 		 * returned message, that was just stored in the cache.
 		 * It can then continue to work on this query. */
 		mesh_respond_serve_expired(qstate->mesh_info);
+		/* set TTLs as expired for this return_msg in case it is used
+		 * later on */
+		set_msg_ttl(qstate->return_msg,
+			EXPIRED_REPLY_TTL_CALC(msg_expiry, msg_timestamp), 0);
 	}
 }

@@ -790,6 +794,7 @@ cachedb_handle_query(struct module_qstate* qstate,
 	struct cachedb_env* ie, int id)
 {
 	int msg_expired = 0;
+	time_t msg_timestamp, msg_expiry;
 	qstate->is_cachedb_answer = 0;
 	/* check if we are enabled, and skip if so */
 	if(!ie->enabled) {
@@ -824,13 +829,15 @@ cachedb_handle_query(struct module_qstate* qstate,
 	}

 	/* ask backend cache to see if we have data */
-	if(cachedb_extcache_lookup(qstate, ie, &msg_expired)) {
+	if(cachedb_extcache_lookup(qstate, ie, &msg_expired, &msg_timestamp,
+		&msg_expiry)) {
 		if(verbosity >= VERB_ALGO)
 			log_dns_msg(ie->backend->name,
 				&qstate->return_msg->qinfo,
 				qstate->return_msg->rep);
 		/* store this result in internal cache */
-		cachedb_intcache_store(qstate, msg_expired);
+		cachedb_intcache_store(qstate,
+			msg_expired, msg_timestamp, msg_expiry);
 		/* In case we have expired data but there is a client timer for expired
 		 * answers, pass execution to next module in order to try updating the
 		 * data first.
@@ -850,6 +857,8 @@ cachedb_handle_query(struct module_qstate* qstate,
 				qstate->ext_state[id] = module_wait_module;
 				return;
 		}
+		/* No 0TTL answers escaping from external cache. */
+		log_assert(qstate->return_msg->rep->ttl > 0);
 		qstate->is_cachedb_answer = 1;
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
@@ -143,6 +143,12 @@ redis_connect(const char* host, int port, const char* path,
 {
 	struct timeval now_val;
 	redisContext* ctx;
+#ifdef THREADS_DISABLED
+	/* Fix attribute unused warning.
+	 * wait_lock is only used with lock_basic_* functions that are nop'ed
+	 * when compiled without thread support. */
+	(void)wait_lock;
+#endif /* THREADS_DISABLED */

 	/* See if the redis server is down, and reconnect has to wait. */
 	if(*reconnect_attempts > REDIS_RECONNECT_ATTEMPT_LIMIT) {
@@ -66,6 +66,9 @@
 /* Whether the C compiler accepts the "format" attribute */
 #undef HAVE_ATTR_FORMAT

+/* Whether the C compiler accepts the "nonstring" attribute */
+#undef HAVE_ATTR_NONSTRING
+
 /* Whether the C compiler accepts the "noreturn" attribute */
 #undef HAVE_ATTR_NORETURN

@@ -253,6 +256,9 @@
 /* Define to 1 if you have the `EVP_EncryptInit_ex' function. */
 #undef HAVE_EVP_ENCRYPTINIT_EX

+/* Define to 1 if you have the `EVP_MAC_CTX_new' function. */
+#undef HAVE_EVP_MAC_CTX_NEW
+
 /* Define to 1 if you have the `EVP_MAC_CTX_set_params' function. */
 #undef HAVE_EVP_MAC_CTX_SET_PARAMS

@@ -334,6 +340,9 @@
 /* Define to 1 if you have the <hiredis/hiredis.h> header file. */
 #undef HAVE_HIREDIS_HIREDIS_H

+/* Define to 1 if you have the `HMAC_CTX_new' function. */
+#undef HAVE_HMAC_CTX_NEW
+
 /* Define to 1 if you have the `HMAC_Init_ex' function. */
 #undef HAVE_HMAC_INIT_EX

@@ -655,6 +664,9 @@
   function. */
 #undef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB

+/* Define to 1 if you have the `SSL_CTX_set_tmp_ecdh' function. */
+#undef HAVE_SSL_CTX_SET_TMP_ECDH
+
 /* Define to 1 if you have the `SSL_get0_alpn_selected' function. */
 #undef HAVE_SSL_GET0_ALPN_SELECTED

@@ -1381,6 +1393,17 @@
 #endif /* !HAVE_ATTR_UNUSED */


+#if defined(DOXYGEN)
+#  define ATTR_NONSTRING(x)  x
+#elif defined(__cplusplus)
+#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
+#elif defined(HAVE_ATTR_NONSTRING)
+#  define ATTR_NONSTRING(x)  __attribute__((nonstring)) x
+#else /* !HAVE_ATTR_NONSTRING */
+#  define ATTR_NONSTRING(x)  x
+#endif /* !HAVE_ATTR_NONSTRING */
+
+
 #ifndef HAVE_FSEEKO
 #define fseeko fseek
 #define ftello ftell
@@ -12,14 +12,14 @@ sinclude(dnscrypt/dnscrypt.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[24])
-m4_define([VERSION_MICRO],[0])
+m4_define([VERSION_MICRO],[2])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=33
+LIBUNBOUND_REVISION=35
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -120,6 +120,8 @@ LIBUNBOUND_AGE=1
 # 1.23.0 had 9:31:1
 # 1.23.1 had 9:32:1
 # 1.24.0 had 9:33:1
+# 1.24.1 had 9:34:1
+# 1.24.2 had 9:35:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -328,6 +330,7 @@ fi
 AC_C_INLINE
 ACX_CHECK_FORMAT_ATTRIBUTE
 ACX_CHECK_UNUSED_ATTRIBUTE
+ACX_CHECK_NONSTRING_ATTRIBUTE

 AC_DEFUN([CHECK_WEAK_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
@@ -633,19 +636,19 @@ AC_ARG_ENABLE(alloc-nonregional, AS_HELP_STRING([--enable-alloc-nonregional],[ e
 if test x_$enable_alloc_nonregional = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
 fi
-if test x_$enable_alloc_checks = x_yes; then
+AS_IF([test x_$enable_alloc_checks = x_yes],[
 	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
 	SLDNS_ALLOCCHECK_EXTRA_OBJ="alloc.lo log.lo"
 	AC_SUBST(SLDNS_ALLOCCHECK_EXTRA_OBJ)
 	ASYNCLOOK_ALLOCCHECK_EXTRA_OBJ="alloc.lo"
 	AC_SUBST(ASYNCLOOK_ALLOCCHECK_EXTRA_OBJ)
-else
-	if test x_$enable_alloc_lite = x_yes; then
+],[
+	AS_IF([test x_$enable_alloc_lite = x_yes],[
 		AC_DEFINE(UNBOUND_ALLOC_LITE, 1, [use to enable lightweight alloc assertions, for debug use])
-	else
+	],[
 		ACX_FUNC_MALLOC([unbound])
-	fi
-fi
+	])
+])

 # check windows threads (we use them, not pthreads, on windows).
 if test "$on_mingw" = "yes"; then
@@ -997,7 +1000,7 @@ else
 	AC_MSG_RESULT([no])
 fi
 AC_CHECK_HEADERS([openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h openssl/core_names.h openssl/param_build.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex])
+AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex SSL_CTX_set_tmp_ecdh HMAC_CTX_new EVP_MAC_CTX_new])

 # these check_funcs need -lssl
 BAKLIBS="$LIBS"
@@ -1251,7 +1254,7 @@ case "$enable_ecdsa" in
 	      # see if OPENSSL 1.0.0 or later (has EVP MD and Verify independency)
 	      AC_MSG_CHECKING([if openssl supports SHA2 and ECDSA with EVP])
 	      if grep OPENSSL_VERSION_TEXT $ssldir_include/openssl/opensslv.h | grep "OpenSSL" >/dev/null; then
-		if grep OPENSSL_VERSION_NUMBER $ssldir_include/openssl/opensslv.h | grep 0x0 >/dev/null; then
+		if grep OPENSSL_VERSION_TEXT $ssldir_include/openssl/opensslv.h | grep "OpenSSL 0\." >/dev/null; then
 		  AC_MSG_RESULT([no])
 		  AC_DEFINE_UNQUOTED([USE_ECDSA_EVP_WORKAROUND], [1], [Define this to enable an EVP workaround for older openssl])
 		else
@@ -1671,10 +1674,12 @@ if test x_$enable_static_exe = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-			:
-		else
-			LIBS="$LIBS -l:libssp.a"
+		if echo "$host" | $GREP -i -e linux >/dev/null; then
+			if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
+				:
+			else
+				LIBS="$LIBS -l:libssp.a"
+			fi
 		fi
 	fi
 fi
@@ -1692,10 +1697,12 @@ if test x_$enable_fully_static = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-			:
-		else
-			LIBS="$LIBS -l:libssp.a"
+		if echo "$host" | $GREP -i -e linux >/dev/null; then
+			if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
+				:
+			else
+				LIBS="$LIBS -l:libssp.a"
+			fi
 		fi
 	fi
 fi
@@ -2291,6 +2298,7 @@ dnl includes

 AHX_CONFIG_FORMAT_ATTRIBUTE
 AHX_CONFIG_UNUSED_ATTRIBUTE
+AHX_CONFIG_NONSTRING_ATTRIBUTE
 AHX_CONFIG_FSEEKO
 AHX_CONFIG_MAXHOSTNAMELEN
 #if !defined(HAVE_SNPRINTF) || defined(SNPRINTF_RET_BROKEN)
@@ -1,21 +1,22 @@
 #!/usr/bin/env bash
+OPENSSL_VERSION=1.1.1d

 echo "Downloading OpenSSL"
-if ! curl -L -k -s -o openssl-1.1.1d.tar.gz https://www.openssl.org/source/openssl-1.1.1d.tar.gz;
+if ! curl -L -k -s -o openssl-$OPENSSL_VERSION.tar.gz https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz;
 then
    echo "Failed to download OpenSSL"
    exit 1
 fi

 echo "Unpacking OpenSSL"
-rm -rf ./openssl-1.1.1d
-if ! tar -xf openssl-1.1.1d.tar.gz;
+rm -rf ./openssl-$OPENSSL_VERSION
+if ! tar -xf openssl-$OPENSSL_VERSION.tar.gz;
 then
    echo "Failed to unpack OpenSSL"
    exit 1
 fi

-cd openssl-1.1.1d || exit 1
+cd openssl-$OPENSSL_VERSION || exit 1

 if ! cp ../contrib/ios/15-ios.conf Configurations/; then
    echo "Failed to copy OpenSSL ios config"
@@ -27,7 +28,8 @@ fi
 # Also see https://github.com/openssl/openssl/issues/7607.
 if ! patch -u -p0 < ../contrib/ios/openssl.patch; then
    echo "Failed to patch OpenSSL"
-    exit 1
+    # the partial patch may be useful.
+    #exit 1
 fi

 echo "Configuring OpenSSL"
@@ -175,6 +175,7 @@ fi
 # For example, remove 4.3, 6.2, and 6.1 if they are not installed. We go back to
 # the 1.0 SDKs because Apple WatchOS uses low numbers, like 2.0 and 2.1.
 XCODE_SDK=
+if test -z "$SDK_VERSION"; then
 for i in $(seq -f "%.1f" 30.0 -0.1 1.0)
 do
    if [ -d "$XCODE_DEVELOPER_SDK/Developer/SDKs/$IOS_SDK$i.sdk" ]; then
@@ -182,6 +183,10 @@ do
        break
    fi
 done
+else
+    i="$SDK_VERSION"
+    XCODE_SDK="$IOS_SDK$i.sdk"
+fi

 # Error checking
 if [ -z "$XCODE_SDK" ]; then
@@ -59,7 +59,7 @@ ExecReload=+/bin/kill -HUP $MAINPID
 ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_ADMIN
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
@@ -26,7 +26,7 @@ ExecReload=+/bin/kill -HUP $MAINPID
 ExecStart=@UNBOUND_SBIN_DIR@/unbound -d -p
 NotifyAccess=main
 Type=notify
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_ADMIN
 MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
@@ -77,6 +77,7 @@
 #include "util/storage/lookup3.h"
 #include "util/storage/slabhash.h"
 #include "util/tcp_conn_limit.h"
+#include "util/allow_response_list.h"
 #include "util/edns.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/rrset.h"
@@ -89,6 +90,7 @@
 #include "util/random.h"
 #include "util/tube.h"
 #include "util/net_help.h"
+#include "util/tsig.h"
 #include "sldns/keyraw.h"
 #include "respip/respip.h"
 #include "iterator/iter_fwd.h"
@@ -297,6 +299,16 @@ daemon_init(void)
 		free(daemon);
 		return NULL;
 	}
+	daemon->arl = arl_list_create();
+	if(!daemon->arl) {
+		acl_list_delete(daemon->acl_interface);
+		acl_list_delete(daemon->acl);
+		tcl_list_delete(daemon->tcl);
+		edns_known_options_delete(daemon->env);
+		free(daemon->env);
+		free(daemon);
+		return NULL;
+	}
 	listen_setup_locks();
 	if(gettimeofday(&daemon->time_boot, NULL) < 0)
 		log_err("gettimeofday: %s", strerror(errno));
@@ -305,6 +317,7 @@ daemon_init(void)
 		acl_list_delete(daemon->acl_interface);
 		acl_list_delete(daemon->acl);
 		tcl_list_delete(daemon->tcl);
+		arl_list_delete(daemon->arl);
 		edns_known_options_delete(daemon->env);
 		free(daemon->env);
 		free(daemon);
@@ -315,11 +328,24 @@ daemon_init(void)
 		acl_list_delete(daemon->acl_interface);
 		acl_list_delete(daemon->acl);
 		tcl_list_delete(daemon->tcl);
+		arl_list_delete(daemon->arl);
 		edns_known_options_delete(daemon->env);
 		free(daemon->env);
 		free(daemon);
 		return NULL;
 	}
+	if(!(daemon->env->tsig_key_table = tsig_key_table_create())) {
+		auth_zones_delete(daemon->env->auth_zones);
+		acl_list_delete(daemon->acl_interface);
+		acl_list_delete(daemon->acl);
+		tcl_list_delete(daemon->tcl);
+		arl_list_delete(daemon->arl);
+		edns_known_options_delete(daemon->env);
+		edns_strings_delete(daemon->env->edns_strings);
+		free(daemon->env);
+		free(daemon);
+		return NULL;
+	}
 	return daemon;	
 }

@@ -729,6 +755,8 @@ daemon_fork(struct daemon* daemon)
 		fatal_exit("Could not setup interface control list");
 	if(!tcl_list_apply_cfg(daemon->tcl, daemon->cfg))
 		fatal_exit("Could not setup TCP connection limits");
+	if(!arl_list_apply_cfg(daemon->arl, daemon->cfg))
+		fatal_exit("Could not setup allow response list");
 	if(daemon->cfg->dnscrypt) {
 #ifdef USE_DNSCRYPT
 		daemon->dnscenv = dnsc_create();
@@ -771,12 +799,17 @@ daemon_fork(struct daemon* daemon)
 	daemon->use_response_ip = !respip_set_is_empty(
 		daemon->env->respip_set) || have_view_respip_cfg;

+	/* setup tsig keys */
+	if(!tsig_key_table_apply_cfg(daemon->env->tsig_key_table, daemon->cfg))
+		fatal_exit("Could not set up TSIG keys");
+
 	/* setup modules */
 	daemon_setup_modules(daemon);

 	/* read auth zonefiles */
 	if(!auth_zones_apply_cfg(daemon->env->auth_zones, daemon->cfg, 1,
-		&daemon->use_rpz, daemon->env, &daemon->mods))
+		&daemon->use_rpz, daemon->env, &daemon->mods,
+		daemon->env->tsig_key_table))
 		fatal_exit("auth_zones could not be setup");

 	/* Set-up EDNS strings */
@@ -944,12 +977,14 @@ daemon_delete(struct daemon* daemon)
 		edns_known_options_delete(daemon->env);
 		edns_strings_delete(daemon->env->edns_strings);
 		auth_zones_delete(daemon->env->auth_zones);
+		tsig_key_table_delete(daemon->env->tsig_key_table);
 	}
 	ub_randfree(daemon->rand);
 	alloc_clear(&daemon->superalloc);
 	acl_list_delete(daemon->acl);
 	acl_list_delete(daemon->acl_interface);
 	tcl_list_delete(daemon->tcl);
+	arl_list_delete(daemon->arl);
 	cookie_secrets_delete(daemon->cookie_secrets);
 	listen_desetup_locks();
 	free(daemon->chroot);
@@ -133,6 +133,8 @@ struct daemon {
 	struct acl_list* acl_interface;
 	/** TCP connection limit, limit connections from client IPs */
 	struct tcl_list* tcl;
+	/** allow response list, to cache responses send by client IPs */
+	struct arl_list* arl;
 	/** local authority zones */
 	struct local_zones* local_zones;
 	/** last time of statistics printout */
@@ -97,7 +97,9 @@
 #include "sldns/sbuffer.h"
 #include "util/timeval_func.h"
 #include "util/tcp_conn_limit.h"
+#include "util/allow_response_list.h"
 #include "util/edns.h"
+#include "util/tsig.h"
 #ifdef USE_CACHEDB
 #include "cachedb/cachedb.h"
 #endif
@@ -153,7 +155,7 @@ remote_setup_ctx(struct daemon_remote* rc, struct config_file* cfg)
 		log_crypto_err("could not SSL_CTX_new");
 		return 0;
 	}
-	if(!listen_sslctx_setup(rc->ctx)) {
+	if(!listen_sslctx_setup(rc->ctx, cfg->tls_use_system_policy_versions)) {
 		return 0;
 	}

@@ -4645,6 +4647,10 @@ struct fast_reload_construct {
 	struct acl_list* acl_interface;
 	/** construct for tcp connection limit */
 	struct tcl_list* tcl;
+	/** construct for allow response list */
+	struct arl_list* arl;
+	/** tsig key table */
+	struct tsig_key_table* tsig_key_table;
 	/** construct for local zones */
 	struct local_zones* local_zones;
 	/** if there is response ip configuration in use */
@@ -5031,6 +5037,8 @@ fr_construct_clear(struct fast_reload_construct* ct)
 	acl_list_delete(ct->acl);
 	acl_list_delete(ct->acl_interface);
 	tcl_list_delete(ct->tcl);
+	arl_list_delete(ct->arl);
+	tsig_key_table_delete(ct->tsig_key_table);
 	edns_strings_delete(ct->edns_strings);
 	anchors_delete(ct->anchors);
 	views_delete(ct->views);
@@ -5133,6 +5141,8 @@ getmem_config_auth(struct config_auth* p)
 			+ getmem_config_strlist(s->masters)
 			+ getmem_config_strlist(s->urls)
 			+ getmem_config_strlist(s->allow_notify)
+			+ getmem_config_str2list(s->masters_tsig)
+			+ getmem_config_str2list(s->allow_notify_tsig)
 			+ getmem_str(s->zonefile)
 			+ s->rpz_taglistlen
 			+ getmem_str(s->rpz_action_override)
@@ -5227,6 +5237,7 @@ config_file_getmem(struct config_file* cfg)
 	m += getmem_config_str3list(cfg->acl_tag_datas);
 	m += getmem_config_str2list(cfg->acl_view);
 	m += getmem_config_str2list(cfg->interface_actions);
+	m += getmem_config_str2list(cfg->allow_response_list);
 	m += getmem_config_strbytelist(cfg->interface_tags);
 	m += getmem_config_str3list(cfg->interface_tag_actions);
 	m += getmem_config_str3list(cfg->interface_tag_datas);
@@ -5296,10 +5307,12 @@ fr_printmem(struct fast_reload_thread* fr,
 	mem += auth_zones_get_mem(ct->auth_zones);
 	mem += forwards_get_mem(ct->fwds);
 	mem += hints_get_mem(ct->hints);
+	mem += tsig_key_table_get_mem(ct->tsig_key_table);
 	mem += local_zones_get_mem(ct->local_zones);
 	mem += acl_list_get_mem(ct->acl);
 	mem += acl_list_get_mem(ct->acl_interface);
 	mem += tcl_list_get_mem(ct->tcl);
+	mem += arl_list_get_mem(ct->arl);
 	mem += edns_strings_get_mem(ct->edns_strings);
 	mem += anchors_get_mem(ct->anchors);
 	mem += sizeof(*ct->oldcfg);
@@ -5384,6 +5397,12 @@ xfr_auth_master_equal(struct auth_master* m1, struct auth_master* m2)
 		return 0;
 	if(m1->port != m2->port)
 		return 0;
+
+	if((m1->tsig_key_name && !m2->tsig_key_name) || (!m1->tsig_key_name && m2->tsig_key_name))
+		return 0;
+	if(m1->tsig_key_name && m2->tsig_key_name && strcmp(m1->tsig_key_name, m2->tsig_key_name) != 0)
+		return 0;
+
 	return 1;
 }

@@ -5583,12 +5602,35 @@ fr_construct_from_config(struct fast_reload_thread* fr,
 	if(fr_poll_for_quit(fr))
 		return 1;

+	if(!(ct->arl = arl_list_create())) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(!arl_list_apply_cfg(ct->arl, newcfg)) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(fr_poll_for_quit(fr))
+		return 1;
+
+	if(!(ct->tsig_key_table = tsig_key_table_create())) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(!tsig_key_table_apply_cfg(ct->tsig_key_table, newcfg)) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(fr_poll_for_quit(fr))
+		return 1;
+
 	if(!(ct->auth_zones = auth_zones_create())) {
 		fr_construct_clear(ct);
 		return 0;
 	}
 	if(!auth_zones_apply_cfg(ct->auth_zones, newcfg, 1, &ct->use_rpz,
-		fr->worker->daemon->env, &fr->worker->daemon->mods)) {
+		fr->worker->daemon->env, &fr->worker->daemon->mods,
+		ct->tsig_key_table)) {
 		fr_construct_clear(ct);
 		return 0;
 	}
@@ -5870,6 +5912,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(tls_ciphers);
 	COPY_VAR_ptr(tls_ciphersuites);
 	COPY_VAR_int(tls_use_sni);
+	COPY_VAR_int(tls_use_system_policy_versions);
 	COPY_VAR_int(https_port);
 	COPY_VAR_ptr(http_endpoint);
 	COPY_VAR_uint32_t(http_max_streams);
@@ -5917,6 +5960,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(forwards);
 	COPY_VAR_ptr(auths);
 	COPY_VAR_ptr(views);
+	COPY_VAR_ptr(tsig_keys);
 	COPY_VAR_ptr(donotqueryaddrs);
 #ifdef CLIENT_SUBNET
 	COPY_VAR_ptr(client_subnet);
@@ -6034,6 +6078,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	*/
 	COPY_VAR_ptr(acl_view);
 	COPY_VAR_ptr(interface_actions);
+	COPY_VAR_ptr(allow_response_list);
 	/* These reference tags
 	COPY_VAR_ptr(interface_tags);
 	COPY_VAR_ptr(interface_tag_actions);
@@ -6176,6 +6221,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(ipset_name_v6);
 #endif
 	COPY_VAR_int(ede);
+	COPY_VAR_int(iter_scrub_promiscuous);
 }
 #endif /* ATOMIC_POINTER_LOCK_FREE && HAVE_LINK_ATOMIC_STORE */

@@ -6354,6 +6400,7 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 		lock_basic_lock(&ct->anchors->lock);
 		lock_basic_lock(&env->anchors->lock);
 	}
+	lock_rw_wrlock(&env->tsig_key_table->lock);

 #if defined(ATOMIC_POINTER_LOCK_FREE) && defined(HAVE_LINK_ATOMIC_STORE)
 	if(fr->fr_nopause) {
@@ -6390,6 +6437,9 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 	acl_list_swap_tree(daemon->acl, ct->acl);
 	acl_list_swap_tree(daemon->acl_interface, ct->acl_interface);
 	tcl_list_swap_tree(daemon->tcl, ct->tcl);
+	arl_list_swap_tree(daemon->arl, ct->arl);
+	tsig_key_table_swap_tree(daemon->env->tsig_key_table,
+		ct->tsig_key_table);
 	local_zones_swap_tree(daemon->local_zones, ct->local_zones);
 	respip_set_swap_tree(env->respip_set, ct->respip_set);
 	daemon->use_response_ip = ct->use_response_ip;
@@ -6436,6 +6486,7 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 		lock_basic_unlock(&ct->anchors->lock);
 		lock_basic_unlock(&env->anchors->lock);
 	}
+	lock_rw_unlock(&env->tsig_key_table->lock);

 	return 1;
 }
@@ -473,7 +473,7 @@ setup_listen_sslctx(void** ctx, int is_dot, int is_doh, struct config_file* cfg)
 		cfg->tls_ciphers, cfg->tls_ciphersuites,
 		(cfg->tls_session_ticket_keys.first &&
 		cfg->tls_session_ticket_keys.first->str[0] != 0),
-		is_dot, is_doh))) {
+		is_dot, is_doh, cfg->tls_use_system_policy_versions))) {
 		fatal_exit("could not set up listen SSL_CTX");
 	}
 }
@@ -43,6 +43,7 @@
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/random.h"
+#include "util/tsig.h"
 #include "daemon/worker.h"
 #include "daemon/daemon.h"
 #include "daemon/remote.h"
@@ -67,6 +68,7 @@
 #include "util/data/dname.h"
 #include "util/fptr_wlist.h"
 #include "util/proxy_protocol.h"
+#include "util/tsig.h"
 #include "util/tube.h"
 #include "util/edns.h"
 #include "util/timeval_func.h"
@@ -78,11 +80,13 @@
 #include "respip/respip.h"
 #include "libunbound/context.h"
 #include "libunbound/libworker.h"
+#include "sldns/parseutil.h"
 #include "sldns/sbuffer.h"
 #include "sldns/wire2str.h"
 #include "util/shm_side/shm_main.h"
 #include "dnscrypt/dnscrypt.h"
 #include "dnstap/dtstream.h"
+#include "util/allow_response_list.h"

 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
@@ -272,6 +276,11 @@ worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 	return 0;
 }

+#define REQUEST_OK        0
+#define DROP_REQUEST     -1
+#define RESPONSE_MESSAGE -2
+
+
 /** ratelimit error replies
 * @param worker: the worker struct with ratelimit counter
 * @param err: error code that would be wanted.
@@ -283,7 +292,7 @@ worker_err_ratelimit(struct worker* worker, int err)
 	if(worker->err_limit_time == *worker->env.now) {
 		/* see if limit is exceeded for this second */
 		if(worker->err_limit_count++ > ERROR_RATELIMIT)
-			return -1;
+			return DROP_REQUEST;
 	} else {
 		/* new second, new limits */
 		worker->err_limit_time = *worker->env.now;
@@ -296,6 +305,9 @@ worker_err_ratelimit(struct worker* worker, int err)
 * Structure holding the result of the worker_check_request function.
 * Based on configuration it could be called up to four times; ideally should
 * be called once.
+ * When value is a positive number, it contains the error to return.
+ * Otherwise DROP_REQUEST (-1) is returned, or RESPONSE_MESSAGE (-2) in
+ * case the qr bit was set. Value is set to REQUEST_OK (0) if all is good.
 */
 struct check_request_result {
 	int checked;
@@ -314,18 +326,18 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker,
 	out->checked = 1;
 	if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) {
 		verbose(VERB_QUERY, "request too short, discarded");
-		out->value = -1;
+		out->value = DROP_REQUEST;
 		return;
 	}
 	if(sldns_buffer_limit(pkt) > NORMAL_UDP_SIZE &&
 		worker->daemon->cfg->harden_large_queries) {
 		verbose(VERB_QUERY, "request too large, discarded");
-		out->value = -1;
+		out->value = DROP_REQUEST;
 		return;
 	}
 	if(LDNS_QR_WIRE(sldns_buffer_begin(pkt))) {
-		verbose(VERB_QUERY, "request has QR bit on, discarded");
-		out->value = -1;
+		/* verbose(VERB_QUERY, "request has QR bit on, discarded"); */
+		out->value = RESPONSE_MESSAGE;
 		return;
 	}
 	if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) {
@@ -367,10 +379,39 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker,
 		out->value = worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 		return;
 	}
-	out->value = 0;
+	out->value = REQUEST_OK;
 	return;
 }

+/** check response sanity.
+ * @param pkt: the wire packet to examine for sanity.
+ * @param worker: parameters for checking.
+ * @param out: 1 on success, otherwise 0.
+*/
+static int
+worker_check_response(sldns_buffer* pkt, struct worker* worker)
+{
+	if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) {
+		LDNS_TC_CLR(sldns_buffer_begin(pkt));
+		verbose(VERB_QUERY, "response bad, has TC bit on");
+		return 0;
+	}
+	if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY) {
+		verbose(VERB_QUERY, "not a query response");
+		return 0;
+	}
+	if(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) != 1) {
+		verbose(VERB_QUERY, "request wrong nr qd=%d",
+			LDNS_QDCOUNT(sldns_buffer_begin(pkt)));
+		return 0;
+	}
+	if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0) {
+		verbose(VERB_QUERY, "response must be an answer message");
+		return 0;
+	}
+	return 1;
+}
+
 /**
 * Send fast-reload acknowledgement to the mainthread in one byte.
 * This signals that this worker has received the previous command.
@@ -746,7 +787,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	*partial_repp = NULL;  /* avoid accidental further pass */

 	/* Check TTL */
-	if(rep->ttl < timenow) {
+	if(TTL_IS_EXPIRED(rep->ttl, timenow)) {
 		/* Check if we need to serve expired now */
 		if(worker->env.cfg->serve_expired &&
 			/* if serve-expired-client-timeout is set, serve
@@ -1157,35 +1198,54 @@ answer_notify(struct worker* w, struct query_info* qinfo,
 	int rcode = LDNS_RCODE_NOERROR;
 	uint32_t serial = 0;
 	int has_serial;
+	struct tsig_data* tsig = NULL;
+	int tsig_rcode = 0;
 	if(!w->env.auth_zones) return;
 	has_serial = auth_zone_parse_notify_serial(pkt, &serial);
 	if(auth_zones_notify(w->env.auth_zones, &w->env, qinfo->qname,
-		qinfo->qname_len, qinfo->qclass, addr,
-		addrlen, has_serial, serial, &refused)) {
+		qinfo->qname_len, qinfo->qclass, addr, addrlen, has_serial,
+		serial, &refused, pkt, &tsig, &tsig_rcode, w->scratchpad)) {
 		rcode = LDNS_RCODE_NOERROR;
 	} else {
-		if(refused)
+		if(tsig_rcode != 0) {
+			rcode = tsig_rcode;
+		} else if(refused) {
 			rcode = LDNS_RCODE_REFUSED;
-		else	rcode = LDNS_RCODE_SERVFAIL;
+		} else {
+			rcode = LDNS_RCODE_SERVFAIL;
+		}
 	}

 	if(verbosity >= VERB_DETAIL) {
-		char buf[380];
-		char zname[LDNS_MAX_DOMAINLEN];
-		char sr[25];
+		char buf[380+LDNS_MAX_DOMAINLEN];
+		char zname[LDNS_MAX_DOMAINLEN], tsigkey[LDNS_MAX_DOMAINLEN];
+		char sr[25], rcode_str[32], tsigtxt[16];;
 		dname_str(qinfo->qname, zname);
+		tsigkey[0]=0;
+		tsigtxt[0]=0;
+		if(tsig && tsig->key_name) {
+			snprintf(tsigtxt, sizeof(tsigtxt), " with TSIG ");
+			dname_str(tsig->key_name, tsigkey);
+		}
 		sr[0]=0;
 		if(has_serial)
 			snprintf(sr, sizeof(sr), "serial %u ",
 				(unsigned)serial);
-		if(rcode == LDNS_RCODE_REFUSED)
+		if(rcode == LDNS_RCODE_REFUSED) {
 			snprintf(buf, sizeof(buf),
-				"refused NOTIFY %sfor %s from", sr, zname);
-		else if(rcode == LDNS_RCODE_SERVFAIL)
+				"refused NOTIFY %sfor %s%s%s from", sr, zname,
+				tsigtxt, tsigkey);
+		} else if(rcode != LDNS_RCODE_NOERROR) {
+			sldns_wire2str_rcode_buf(rcode, rcode_str,
+				sizeof(rcode_str));
 			snprintf(buf, sizeof(buf),
-				"servfail for NOTIFY %sfor %s from", sr, zname);
-		else	snprintf(buf, sizeof(buf),
-				"received NOTIFY %sfor %s from", sr, zname);
+				"%s for NOTIFY %sfor %s%s%s from",
+				rcode_str, sr, zname, tsigtxt, tsigkey);
+		} else {
+			snprintf(buf, sizeof(buf),
+				"received NOTIFY %sfor %s%s%s from", sr, zname,
+					tsigtxt, tsigkey);
+		}
 		log_addr(VERB_DETAIL, buf, addr, addrlen);
 	}
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
@@ -1196,6 +1256,24 @@ answer_notify(struct worker* w, struct query_info* qinfo,
 		*(uint16_t*)(void *)sldns_buffer_begin(pkt),
 		sldns_buffer_read_u16_at(pkt, 2), edns);
 	LDNS_OPCODE_SET(sldns_buffer_begin(pkt), LDNS_PACKET_NOTIFY);
+	if(tsig) {
+		size_t pos = sldns_buffer_limit(pkt);
+		sldns_buffer_clear(pkt);
+		sldns_buffer_set_position(pkt, pos);
+		if(!tsig_sign_reply(tsig, pkt, w->env.tsig_key_table,
+			(uint64_t)*w->env.now)) {
+			/* Failed to TSIG sign the reply */
+			verbose(VERB_ALGO, "Failed to TSIG sign notify reply");
+			error_encode(pkt, LDNS_RCODE_SERVFAIL, qinfo,
+				*(uint16_t*)(void *)sldns_buffer_begin(pkt),
+				sldns_buffer_read_u16_at(pkt, 2), edns);
+			LDNS_OPCODE_SET(sldns_buffer_begin(pkt), LDNS_PACKET_NOTIFY);
+		} else {
+			/* Flip to delimit buffer after tsig_sign_reply. */
+			sldns_buffer_flip(pkt);
+		}
+		/* The tsig veriable is allocated in the scratch region. */
+	}
 }

 static int
@@ -1227,8 +1305,8 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		if(worker->stats.extended)
 			worker->stats.unwanted_queries++;
 		worker_check_request(c->buffer, worker, check_result);
-		if(check_result->value != 0) {
-			if(check_result->value != -1) {
+		if(check_result->value != REQUEST_OK) {
+			if(check_result->value > 0) {
 				LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 					check_result->value);
@@ -1505,7 +1583,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		char buf[LDNS_MAX_DOMAINLEN];
 		/* Check if this is unencrypted and asking for certs */
 		worker_check_request(c->buffer, worker, &check_result);
-		if(check_result.value != 0) {
+		if(check_result.value != REQUEST_OK) {
 			verbose(VERB_ALGO,
 				"dnscrypt: worker check request: bad query.");
 			log_addr(VERB_CLIENT,"from",&repinfo->client_addr,
@@ -1568,10 +1646,95 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	}

 	worker_check_request(c->buffer, worker, &check_result);
-	if(check_result.value != 0) {
+	if (check_result.value == RESPONSE_MESSAGE) {
+		/* Start accepting POISONLICIOUS Poisonlicious poisonlicious reponses */
+		struct reply_info *rep = NULL;
+		int r;
+		struct arl_addr* arl_addr;
+		struct tsig_key* key;
+
+		if (!worker_check_response(c->buffer, worker)) {
+			verbose(VERB_ALGO, "bad response");
+			log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+			comm_point_drop_reply(repinfo);
+			return 0;
+		}
+		arl_addr = arl_addr_lookup(worker->daemon->arl,
+				&repinfo->client_addr, repinfo->client_addrlen);
+		if(!arl_addr) {
+			verbose(VERB_ALGO, "ip not in \"allow-response:\" list");
+			log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+			comm_point_drop_reply(repinfo);
+			if(worker->stats.extended)
+				worker->stats.unwanted_queries++;
+			return 0;
+		}
+		if(arl_addr->tsig_key_name == NULL ||
+				arl_addr->tsig_key_name == TSIG_BLOCKED) {
+			verbose(VERB_ALGO, "ip blocked in \"allow-response:\" list");
+			log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+			comm_point_drop_reply(repinfo);
+			if(worker->stats.extended)
+				worker->stats.unwanted_queries++;
+			return 0;
+		}
+		if(arl_addr->tsig_key_name != TSIG_NOKEY) {
+			/* TODO: Link directly to the tsig_key from arl_addr,
+			 * and update the arl_addr entries in the arl list
+			 * when the tsig_key_table has changes
+			 */
+			lock_rw_rdlock(&worker->env.tsig_key_table->lock);
+			key = tsig_key_table_search_fromstr(worker->env.tsig_key_table,
+					arl_addr->tsig_key_name);
+			if (!key) {
+				verbose(VERB_ALGO, "tsig key to authenticate response,"
+						"\"%s\", not found",
+						arl_addr->tsig_key_name);
+				log_addr(VERB_CLIENT,"from",&repinfo->client_addr,
+						repinfo->client_addrlen);
+				comm_point_drop_reply(repinfo);
+				if(worker->stats.extended)
+					worker->stats.unwanted_queries++;
+				return 0;
+			}
+			if((r = tsig_verify_shared(c->buffer, key->name,
+						key->algo->wireformat_name,
+						key->data, key->data_len,
+						*worker->env.now))) {
+				lock_rw_unlock(&worker->env.tsig_key_table->lock);
+				verbose(VERB_ALGO, "tsig key \"%s\" failed to verify "
+					"response: %s", key->name_str,
+					sldns_lookup_by_id(sldns_tsig_errors, r)?
+					sldns_lookup_by_id(sldns_tsig_errors, r)->name:"??");
+				log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+				comm_point_drop_reply(repinfo);
+				return 0;
+			}
+			lock_rw_unlock(&worker->env.tsig_key_table->lock);
+		}
+		if((r = reply_info_parse(c->buffer, worker->env.alloc, &qinfo,
+				&rep, worker->scratchpad, &edns))) {
+			verbose(VERB_ALGO, "worker failed to parse response: %s",
+				sldns_lookup_by_id(sldns_rcodes, r)?
+				sldns_lookup_by_id(sldns_rcodes, r)->name:"??");
+			log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+			comm_point_drop_reply(repinfo);
+			return 0;
+		}
+		log_query_info(VERB_ALGO, "storing response in cache", &qinfo);
+		log_addr(VERB_CLIENT,"for",&repinfo->client_addr, repinfo->client_addrlen);
+
+		dns_cache_store(&worker->env, &qinfo, rep, 0 /* is_referral */,
+				0 /* leeway */, 0 /* pside */,
+				NULL /* region */, 0 /* flags */,
+				*worker->env.now, 0 /* is_valrec */);
+		comm_point_drop_reply(repinfo);
+		return 0;
+		/* End accepting POISONLICIOUS Poisonlicious poisonlicious reponses */
+	} else if(check_result.value != REQUEST_OK) {
 		verbose(VERB_ALGO, "worker check request: bad query.");
 		log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
-		if(check_result.value != -1) {
+		if(check_result.value > REQUEST_OK) {
 			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 				check_result.value);
@@ -1929,11 +2092,11 @@ lookup_cache:
 				if((worker->env.cfg->prefetch &&
 					rep->prefetch_ttl <= *worker->env.now) ||
 					(worker->env.cfg->serve_expired &&
-					rep->ttl < *worker->env.now  &&
+					TTL_IS_EXPIRED(rep->ttl, *worker->env.now) &&
 					!(*worker->env.now < rep->serve_expired_norec_ttl))) {
-					time_t leeway = rep->ttl - *worker->env.now;
-					if(rep->ttl < *worker->env.now)
-						leeway = 0;
+					time_t leeway =
+						TTL_IS_EXPIRED(rep->ttl, *worker->env.now)
+						? 0 : rep->ttl - *worker->env.now;
 					lock_rw_unlock(&e->lock);

 					reply_and_prefetch(worker, lookup_qinfo,
@@ -2277,7 +2440,8 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker->daemon->connect_dot_sslctx, cfg->delay_close,
 		cfg->tls_use_sni, dtenv, cfg->udp_connect,
 		cfg->max_reuse_tcp_queries, cfg->tcp_reuse_timeout,
-		cfg->tcp_auth_query_timeout);
+		cfg->tcp_auth_query_timeout, (const char**)cfg->dist,
+		(const char**)cfg->dist_tsig, cfg->num_dist);
 	if(!worker->back) {
 		log_err("could not create outgoing sockets");
 		worker_delete(worker);
@@ -496,8 +496,8 @@ handle_ipv6_ptr(struct module_qstate* qstate, int id)

    /* Create the new sub-query. */
    fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-    if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0, 0,
-                &subq))
+    if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->client_info,
+	    qstate->query_flags, 0, 0, &subq))
        return module_error;
    if (subq) {
        subq->curmod = id;
@@ -522,8 +522,8 @@ generate_type_A_query(struct module_qstate* qstate, int id)

 	/* Start the sub-query. */
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->query_flags, 0,
-				       0, &subq))
+	if(!(*qstate->env->attach_sub)(qstate, &qinfo, qstate->client_info,
+		qstate->query_flags, 0, 0, &subq))
 	{
 		verbose(VERB_ALGO, "dns64: sub-query creation failed");
 		return module_error;
@@ -347,7 +347,7 @@ static struct tap_socket* tap_socket_new_tlsaccept(char* ip,
 	s->ev_cb = ev_cb;
 	s->data = data;
 	s->sslctx = listen_sslctx_create(server_key, server_cert, verifypem,
-		NULL, NULL, 0, 0, 0);
+		NULL, NULL, 0, 0, 0, 0);
 	if(!s->sslctx) {
 		log_err("could not create ssl context");
 		free(s->ip);
@@ -1,3 +1,113 @@
+27 October 2025: Yorgos
+	- Merge #1331 from Jitka Plesníková: Replace deprecated $function by
+	  new $action, for SWIG.
+	- Fix #1165, document the possible circular dependency when using
+	  host names instead of IP addresses for name servers in stub/forward
+	  zones and log a warning when spotted in the configuration.
+
+24 October 2025: Yorgos
+	- unbound.conf man page updates to include a preview of the section
+	  clauses and some reformatting around the use of "clause", "option"
+	  and "attributes". Based on Havard Eidnes' suggestions on the
+	  mailing list.
+	- Fix unused attribute warning in redis.c when threads are not
+	  supported.
+	- For #1364, use OPENSSL_VERSION_TEXT instead of OPENSSL_VERSION_NUMBER
+	  for part of the configure script. OPENSSL_VERSION_TEXT is more
+	  consistent across versions.
+
+22 October 2025: Yorgos
+	- Tag for 1.24.1 release.
+	  The repository continues with version 1.24.2.
+
+15 October 2025: Wouter
+	- Fix to drop UDP for discard-timeout, but not stream connections.
+	- Fix to reply with SERVFAIL when the wait-limit is exceeded.
+	- Add extended dns error code for invalid query type to definition
+	  list.
+	- Fix unbound.conf man page entry for root-hints to say it can
+	  be used without strongly recommending it.
+	- Remove iPhone armv7s, and iPhoneSimulator i386 from ios ci.
+	  The lib system does not provide symbols for it on the new macos
+	  runner.
+	- Fix to exclude libssp for windows compiles.
+
+10 October 2025: Wouter
+	- Fix #1358 Enabling FIPS in OpenSSL causes unit test to fail.
+
+3 October 2025: Yorgos
+	- Note 'respip' and 'dns64' module order in the unbound.conf
+	  man page.
+	- Note clearly that 'wait-limit: 0' disables all wait limits.
+	- 'wait-limit-cookie: 0' can now disable cookie validated wait
+	  limits.
+
+2 October 2025: Wouter
+	- Fix that https is set up as enabled when the port is listed in
+	  interface-automatic-ports. Also for the set up of quic it is
+	  enabled when listed there.
+
+30 September 2025: Wouter
+	- Fix for #1344: Fix that respip and dns64 can be enabled at the
+	  same time, the client info is copied for attach_sub and add_sub
+	  calls. That makes respip work on dns64 synthesized answers, and
+	  also makes RPZ work with DNS64. The order for the modules is
+	  module-config: "respip dns64 validator iterator".
+
+29 September 2025: Wouter
+	- Rebuild configure script from its sources.
+	- Fix modstack_call_init to use the original string when it has
+	  changed, to call modstack_config with. And skip the changed name
+	  in the string correctly. Thanks to Jan Komissar.
+	- Neaten up the change in acx_nlnetlabs.m4 to version 49.
+	- Fix fr_atomic_copy_cfg.
+	- Rebuild configure script from its sources.
+	- Fix #1353: auth-zone can not use empty label for $ORIGIN when
+	  http download.
+	- Fix #1344: module conf 'respip dns64 validator cachedb iterator'
+	  is not known to work.
+
+29 September 2025: Yorgos
+	- Merge #1349: Fix #1346: [FR] Please allow back TLS 1.2.
+	- Merge #1351: ac_cv_func_malloc_0_nonnull for malloc(0) check.
+
+26 September 2025: Yorgos
+	- Test for nonstring attribute in configure and add
+	  nonstring attribute annotations.
+
+24 September 2025: Yorgos
+	- Avoid calling mesh_detect_cycle_found() when there is no mesh state
+	  to begin with.
+
+23 September 2025: Yorgos
+	- Merge #1352 from Petr Vaganov: pythonmod: fix HANDLE_LEAK on
+	  pythonmod_init.
+	- For #1352, align with the current Python<3 code.
+	- Merge #1350 from Maryse47: unbound.service.in: allow CAP_NET_ADMIN.
+	- For #1350, same CAP_NET_ADMIN change for unbound_portable.service.in
+	  as well.
+
+19 September 2025: Wouter
+	- Fix to remove configure~ from release tarballs.
+
+19 September 2025: Yorgos
+	- Update README.man with clearer text.
+	- Merge #1337: 0 TTL cached replies and some TTL behavior changes.
+	- TTL change: Cached records that reach TTL 0 are expired.
+	- TTL change: TTL 0 upstream answers are no longer cached by
+	   cachedb, as they should.
+	- TTL change: 'serve-expired-reply-ttl' is now capped by the original
+	  TTL value of the record to try and make some sense when replying
+	  with expired records.
+	- TTL change: TTL decoding was updated to adhere to RFC8767 section 4
+	  where a 'set high-order bit' means the value is positive instead of
+	  0.
+	- unbound.conf manpage: explicitly mention RFC6891.
+
+18 September 2025: Wouter
+	- Tag for 1.24.0 release. Includes the fixes below after rc1.
+	  The repository continues with version 1.24.1.
+
 17 September 2025: Yorgos
 	- Too many quotes for the EDE message debug printout.

@@ -6,11 +6,16 @@ and makes it easier to maintain and contribute to the documentation.
 The templated man pages (*.in) are still part of the code repository as to not
 alter current procedures that could be in place by users/packagers.

+These man pages (*.in) are still the ones being used when
+configuring/installing Unbound.
+Packagers/users do not have to generate any man pages themselves, this is done
+by the core developers during development and upon releasing new versions.
+
 The templated man pages (*.in) are generated by Sphinx (used for the online
 documentation).
 The online documentation has its own repository at
 https://github.com/NLnetLabs/unbound-manual.

-In the README.md there (branch test-auto for now), there are further simple
-instructions on how to generate the templated man pages there and update them
-in this repository.
+In that README.md (https://github.com/NLnetLabs/unbound-manual/README.md)
+there are further simple instructions on how to generate the templated man
+pages there and update them in this repository.
@@ -196,6 +196,10 @@ server:
 	# Limit on upstream queries for an incoming query and its recursion.
 	# max-global-quota: 200

+	# Should the scrubber remove promiscuous NS from positive answers,
+	# protects against poison attempts.
+	# iter-scrub-promiscuous: yes
+
 	# msec for waiting for an unknown server to reply.  Increase if you
 	# are behind a slow satellite link, to eg. 1128.
 	# unknown-server-time-limit: 376
@@ -752,6 +756,7 @@ server:
 	# serve-expired-ttl-reset: no
 	#
 	# TTL value to use when replying with expired data.
+	# Capped by the original TTL of the record.
 	# serve-expired-reply-ttl: 30
 	#
 	# Time in milliseconds before replying to the client with expired data.
@@ -921,6 +926,22 @@ server:
 	# add a netblock specific override to a localzone, with zone type
 	# local-zone-override: "example.com" 192.0.2.0/24 refuse

+	# Action to apply when the IP address in an AAAA or A RR in the answer
+	# section of a response matches the specified IP netblock.
+	# Requires use of the respip module.
+	# response-ip: 192.0.2.0/24 redirect
+
+	# Redirect as specified by the "resource record string" when the IP
+	# address in an AAAA or A RR in the answer section of a response
+	# matches the specified IP netblock.
+	# Requires use of the respip module.
+	# response-ip-data: 192.0.2.0/24 "example. A 192.0.2.1"
+
+	# Apply tag(s) when the IP address in an AAAA or A RR in the answer
+	# section of a response matches the specified IP netblock.
+	# Requires use of the respip module.
+	# response-ip-tag: 192.0.2.0/24 "tag1 tag2"
+
 	# service clients over TLS (on the TCP sockets) with plain DNS inside
 	# the TLS stream, and over HTTPS using HTTP/2 as specified in RFC8484.
 	# Give the certificate to use and private key.
@@ -931,21 +952,26 @@ server:
 	# https-port: 443
 	# quic-port: 853

+	# Also serve tls on these port numbers (eg. 443, ...), by listing
+	# tls-additional-port: portno for each of the port numbers.
+
 	# cipher setting for TLSv1.2
 	# tls-ciphers: "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256"
 	# cipher setting for TLSv1.3
 	# tls-ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"

-	# Pad responses to padded queries received over TLS
-	# pad-responses: yes
-
-	# Padded responses will be padded to the closest multiple of this size.
-	# pad-responses-block-size: 468
-
 	# Use the SNI extension for TLS connections.  Default is yes.
 	# Changing the value requires a reload.
 	# tls-use-sni: yes

+	# Allow general-purpose version-flexible TLS server configuration that
+	# may be further restricted by the system's policy.
+	# Use only if you want to support legacy TLS client connections.
+	# Default is no and Unbound will only use the latest available TLS
+	# version.
+	# Changing the value requires a reload.
+	# tls-use-system-policy-versions: no
+
 	# Add the secret file for TLS Session Ticket.
 	# Secret file must be 80 bytes of random data.
 	# First key use to encrypt and decrypt TLS session tickets.
@@ -966,15 +992,18 @@ server:
 	# and on other systems, the default openssl certificates
 	# tls-system-cert: no

+	# Pad responses to padded queries received over TLS
+	# pad-responses: yes
+
+	# Padded responses will be padded to the closest multiple of this size.
+	# pad-responses-block-size: 468
+
 	# Pad queries over TLS upstreams
 	# pad-queries: yes

 	# Padded queries will be padded to the closest multiple of this size.
 	# pad-queries-block-size: 128

-	# Also serve tls on these port numbers (eg. 443, ...), by listing
-	# tls-additional-port: portno for each of the port numbers.
-
 	# HTTP endpoint to provide DNS-over-HTTPS service on.
 	# http-endpoint: "/dns-query"

@@ -1226,7 +1255,8 @@ remote-control:
 # authoritatively.  zonefile: reads from file (and writes to it if you also
 # download it), primary: fetches with AXFR and IXFR, or url to zonefile.
 # With allow-notify: you can give additional (apart from primaries and urls)
-# sources of notifies.
+# sources of notifies. primary-tsig: and allow-notify-tsig: use addr keyname,
+# with the name of the TSIG key to use, declared as a tsig-key:.
 # auth-zone:
 #	name: "."
 #	primary: 170.247.170.2        # b.root-servers.net
@@ -1257,10 +1287,11 @@ remote-control:
 #	zonefile: "example.org.zone"

 # Views
-# Create named views. Name must be unique. Map views to requests using
-# the access-control-view option. Views can contain zero or more local-zone
-# and local-data options. Options from matching views will override global
-# options. Global options will be used if no matching view is found.
+# Create named views. Name must be unique.
+# Map views to requests using the access-control-view/interface-view options.
+# Views can contain zero or more local-zone and local-data options.
+# Options from matching views will override global options.
+# Global options will be used if no matching view is found.
 # With view-first yes, it will try to answer using the global local-zone and
 # local-data elements if there is no view specific match.
 # view:
@@ -1268,6 +1299,8 @@ remote-control:
 #	local-zone: "example.com" redirect
 #	local-data: "example.com A 192.0.2.3"
 #	local-data-ptr: "192.0.2.3 www.example.com"
+#	response-ip: 192.0.2.0/24 redirect
+#	response-ip-data: 192.0.2.0/24 "example. A 192.0.2.1"
 #	view-first: no
 # view:
 #	name: "anotherview"
@@ -1405,6 +1438,7 @@ remote-control:
 # and drop.  Policies can be loaded from a file, or using zone
 # transfer, or using HTTP. The respip module needs to be added
 # to the module-config, e.g.: module-config: "respip validator iterator".
+# Can also use primary-tsig: and allow-notify-tsig:
 # rpz:
 #     name: "rpz.example.com"
 #     zonefile: "rpz.example.com"
@@ -1418,3 +1452,14 @@ remote-control:
 #     rpz-signal-nxdomain-ra: no
 #     for-downstream: no
 #     tags: "example"
+
+# TSIG keys
+# tsig-key:
+#	# The key name is sent to the other party, it must be the same
+#	name: "keyname"
+#	# algorithm hmac-md5, or sha1, sha256, sha224, sha384, sha512
+#	algorithm: sha256
+#	# secret material, must be the same as the other party uses.
+#	# base64 encoded random number.
+#	# e.g. from dd if=/dev/random of=/dev/stdout count=1 bs=32 | base64
+#       secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
@@ -167,6 +167,7 @@ ipset,
 \fI\%tcp\-reuse\-timeout\fP,
 \fI\%tcp\-auth\-query\-timeout\fP,
 \fI\%delay\-close\fP\&.
+\fI\%iter\-scrub\-promiscuous\fP\&.
 .sp
 It does not work with
 \fI\%interface\fP and
@@ -150,6 +150,7 @@ There are several commands that the server understands.
    :ref:`trusted-keys-file<unbound.conf.trusted-keys-file>`,
    :ref:`auto-trust-anchor-file<unbound.conf.auto-trust-anchor-file>`,
    :ref:`edns-client-string<unbound.conf.edns-client-string>`,
+    :ref:`tsig-key<unbound.conf.tsig-key>`,
    ipset,
    :ref:`log-identity<unbound.conf.log-identity>`,
    :ref:`infra-cache-numhosts<unbound.conf.infra-cache-numhosts>`,
@@ -169,6 +170,7 @@ There are several commands that the server understands.
    :ref:`tcp-reuse-timeout<unbound.conf.tcp-reuse-timeout>`,
    :ref:`tcp-auth-query-timeout<unbound.conf.tcp-auth-query-timeout>`,
    :ref:`delay-close<unbound.conf.delay-close>`.
+    :ref:`iter-scrub-promiscuous<unbound.conf.iter-scrub-promiscuous>`.

    It does not work with
    :ref:`interface<unbound.conf.interface>` and
@@ -36,44 +36,49 @@ unbound.conf \- Unbound @version@ configuration file.
 .SH DESCRIPTION
 .sp
 \fBunbound.conf\fP is used to configure \fI\%unbound(8)\fP\&.
-The file format has attributes and values.
-Some attributes have attributes inside them.
-The notation is: \fBattribute: value\fP\&.
-.sp
-Comments start with \fB#\fP and last to the end of line.
-Empty lines are ignored as is whitespace at the beginning of a line.
 .sp
 The utility \fI\%unbound\-checkconf(8)\fP can be
 used to check \fBunbound.conf\fP prior to usage.
+.SH FILE FORMAT
+.sp
+Whitespace is used to separate keywords.
+Whitespace indentation is insignificant, but is still recommended for visual
+clarity.
+Comments start with \fB#\fP and last to the end of line.
+Empty lines are ignored, as is whitespace at the beginning of a line.
+.sp
+Attribute keywords end with a colon (\fB:\fP) and they are either options or
+section clauses (group options together).
+.sp
+The configuration file is logically divided into \fBsections\fP where each section
+is introduced by a \fI\%section clause\fP\&.
 .SH EXAMPLE
 .sp
-An example config file is shown below.
-Copy this to \fB/etc/unbound/unbound.conf\fP and start the server with:
+An example minimal config file is shown below; most settings are the defaults.
+Copy this to \fB@ub_conf_file@\fP and start the server with:
 .INDENT 0.0
 .INDENT 3.5
 .sp
 .nf
 .ft C
-$ unbound \-c /etc/unbound/unbound.conf
+$ unbound \-c @ub_conf_file@
 .ft P
 .fi
 .UNINDENT
 .UNINDENT
 .sp
-Most settings are the defaults.
 Stop the server with:
 .INDENT 0.0
 .INDENT 3.5
 .sp
 .nf
 .ft C
-$ kill \(gacat /etc/unbound/unbound.pid\(ga
+$ kill \(gacat @UNBOUND_PIDFILE@\(ga
 .ft P
 .fi
 .UNINDENT
 .UNINDENT
 .sp
-Below is a minimal config file.
 The source distribution contains an extensive \fBexample.conf\fP file with
 all the options.
 .INDENT 0.0
@@ -83,15 +88,15 @@ all the options.
 .ft C
 # unbound.conf(5) config file for unbound(8).
 server:
-    directory: \(dq/etc/unbound\(dq
+    directory: \(dq@UNBOUND_RUN_DIR@\(dq
    username: unbound
    # make sure unbound can access entropy from inside the chroot.
    # e.g. on linux the use these commands (on BSD, devfs(8) is used):
-    #      mount \-\-bind \-n /dev/urandom /etc/unbound/dev/urandom
-    # and  mount \-\-bind \-n /dev/log /etc/unbound/dev/log
-    chroot: \(dq/etc/unbound\(dq
-    # logfile: \(dq/etc/unbound/unbound.log\(dq  #uncomment to use logfile.
-    pidfile: \(dq/etc/unbound/unbound.pid\(dq
+    #      mount \-\-bind \-n /dev/urandom @UNBOUND_RUN_DIR@/dev/urandom
+    # and  mount \-\-bind \-n /dev/log @UNBOUND_RUN_DIR@/dev/log
+    chroot: \(dq@UNBOUND_CHROOT_DIR@\(dq
+    # logfile: \(dq@UNBOUND_RUN_DIR@/unbound.log\(dq  #uncomment to use logfile.
+    pidfile: \(dq@UNBOUND_PIDFILE@\(dq
    # verbosity: 1      # uncomment and increase to get more logging.
    # listen on all interfaces, answer queries from the local subnet.
    interface: 0.0.0.0
@@ -102,14 +107,68 @@ server:
 .fi
 .UNINDENT
 .UNINDENT
-.SH FILE FORMAT
+.SH SECTION CLAUSES
 .sp
-There must be whitespace between keywords.
-Attribute keywords end with a colon \fB\(aq:\(aq\fP\&.
-An attribute is followed by a value, or its containing attributes in which case
-it is referred to as a clause.
-Clauses can be repeated throughout the file (or included files) to group
-attributes under the same clause.
+The recognized section clauses are:
+.INDENT 0.0
+.INDENT 3.5
+.INDENT 0.0
+.TP
+.B \fI\%server:\fP
+Most of the configuration is found in this section.
+.TP
+.B \fI\%remote\-control:\fP
+Configuration for the facility used by
+\fI\%unbound\-control(8)\fP\&.
+.TP
+.B \fI\%stub\-zone:\fP
+Configuration for a zone that redirects to specific authoritative name
+servers, e.g. for zones not generally available on the greater
+Internet.
+.TP
+.B \fI\%forward\-zone:\fP
+Configuration for a zone that forwards to specific DNS resolvers.
+.TP
+.B \fI\%auth\-zone:\fP
+Configuration for local authoritative zones.
+.TP
+.B \fI\%view:\fP
+Overriding a small subset of configuration for incoming requests.
+Requests are mapped to views with
+\fI\%access\-control\-view\fP and
+\fI\%interface\-view\fP\&.
+.TP
+.B \fI\%python:\fP
+Configuration for the optional \fBpython\fP script module.
+.TP
+.B \fI\%dynlib:\fP
+Configuration for the optional \fBdynlib\fP module that loads dynamic
+libraries into Unbound.
+.TP
+.B \fI\%dnscrypt:\fP
+Configuration for the optional DNSCrypt feature.
+.TP
+.B \fI\%cachedb:\fP
+Configuration for the optional \fBcachedb\fP module that can interface
+with second level caches, currently Redis or Redis\-complatible
+databases.
+.TP
+.B \fI\%dnstap:\fP
+Configuration of the optional dnstap logging feature; a flexible,
+structured binary log format for DNS software.
+.TP
+.B \fI\%rpz:\fP
+Configuration for Response Policy Zones that allows for DNS filtering.
+Requires the \fBrespip\fP module.
+.UNINDENT
+.UNINDENT
+.UNINDENT
+.sp
+Section clauses can be repeated throughout the file (or included files) to
+logically group options in one visually cohesive group.
+This may be particularly useful for the \fBserver:\fP clause with its myriad of
+options.
+.SH INCLUDING FILES
 .sp
 Files can be included using the \fBinclude:\fP directive.
 It can appear anywhere, it accepts a single file name as argument.
@@ -124,11 +183,11 @@ Wildcards can be used to include multiple files, see \fIglob(7)\fP\&.
 .sp
 For a more structural include option, the \fBinclude\-toplevel:\fP directive can
 be used.
-This closes whatever clause is currently active (if any) and forces the use of
-clauses in the included files and right after this directive.
-.SS Server Options
+This closes whatever section clause is currently active (if any) and forces the
+use of section clauses in the included files and right after this directive.
+.SH SERVER OPTIONS
 .sp
-These options are part of the \fBserver:\fP clause.
+These options are part of the \fBserver:\fP section.
 .INDENT 0.0
 .TP
 .B verbosity: \fI<number>\fP 
@@ -539,6 +598,9 @@ Default: 376
 The wait time in msec where recursion requests are dropped.
 This is to stop a large number of replies from accumulating.
 They receive no reply, the work item continues to recurse.
+For UDP the replies are dropped, for stream connections the reply
+is not dropped if the stream connection is still open ready to receive
+answers.
 It is nice to be a bit larger than
 \fI\%serve\-expired\-client\-timeout\fP
 if that is enabled.
@@ -554,7 +616,7 @@ The number of replies that can wait for recursion, for an IP address.
 This makes a ratelimit per IP address of waiting replies for recursion.
 It stops very large amounts of queries waiting to be returned to one
 destination.
-The value \fB0\fP disables wait limits.
+The value \fB0\fP disables all wait limits.
 .sp
 Default: 1000
 .UNINDENT
@@ -563,7 +625,11 @@ Default: 1000
 .B wait\-limit\-cookie: \fI<number>\fP 
 The number of replies that can wait for recursion, for an IP address
 that sent the query with a valid DNS Cookie.
-Since the cookie validates the client address, this limit can be higher.
+Since the cookie already validates the client address, this option allows
+to override a configured
+\fI\%wait\-limit\fP value usually with a higher one
+for cookie validated queries.
+The value \fB0\fP disables wait limits for cookie validated queries.
 .sp
 Default: 10000
 .UNINDENT
@@ -1153,8 +1219,8 @@ Default: no
 .INDENT 0.0
 .TP
 .B tls\-system\-cert: \fI<yes or no>\fP 
-This the same attribute as the
-\fI\%tls\-win\-cert\fP attribute, under a
+This the same as the
+\fI\%tls\-win\-cert\fP option, under a
 different name.
 Because it is not windows specific.
 .UNINDENT
@@ -1218,6 +1284,47 @@ Default: \(dq\(dq
 .UNINDENT
 .INDENT 0.0
 .TP
+.B tls\-use\-sni: \fI<yes or no>\fP 
+Enable or disable sending the SNI extension on TLS connections.
+.sp
+\fBNOTE:\fP
+.INDENT 7.0
+.INDENT 3.5
+Changing the value requires a reload.
+.UNINDENT
+.UNINDENT
+.sp
+Default: yes
+.UNINDENT
+.INDENT 0.0
+.TP
+.B tls\-use\-system\-policy\-versions: \fI<yes or no>\fP 
+Enable or disable general\-puspose version\-flexible TLS server configuration
+when serving TLS.
+This will allow the whole list of available TLS versions provided by the
+crypto library, which may have been further restricted by the system\(aqs
+crypto policy.
+.sp
+By default Unbound only uses the latest available TLS version.
+.sp
+\fBCAUTION:\fP
+.INDENT 7.0
+.INDENT 3.5
+Use only if you want to support legacy TLS client connections.
+.UNINDENT
+.UNINDENT
+.sp
+\fBNOTE:\fP
+.INDENT 7.0
+.INDENT 3.5
+Changing the value requires a reload.
+.UNINDENT
+.UNINDENT
+.sp
+Default: no
+.UNINDENT
+.INDENT 0.0
+.TP
 .B pad\-responses: \fI<yes or no>\fP 
 If enabled, TLS serviced queries that contained an EDNS Padding option will
 cause responses padded to the closest multiple of the size specified in
@@ -1251,20 +1358,6 @@ Default: 128
 .UNINDENT
 .INDENT 0.0
 .TP
-.B tls\-use\-sni: \fI<yes or no>\fP 
-Enable or disable sending the SNI extension on TLS connections.
-.sp
-\fBNOTE:\fP
-.INDENT 7.0
-.INDENT 3.5
-Changing the value requires a reload.
-.UNINDENT
-.UNINDENT
-.sp
-Default: yes
-.UNINDENT
-.INDENT 0.0
-.TP
 .B https\-port: \fI<number>\fP 
 The port number on which to provide DNS\-over\-HTTPS service.
 Only interfaces configured with that port number as @number get the HTTPS
@@ -1580,8 +1673,8 @@ implicit default \(dqaccess\-control: 127.0.0.0/8 allow\(dq option.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
-attributes for targeted clients.
+\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
+options for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1596,8 +1689,8 @@ for interfaces.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
-attributes for targeted clients.
+\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
+options for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1613,8 +1706,8 @@ but for interfaces.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
-attributes for targeted clients.
+\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
+options for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1630,8 +1723,8 @@ for interfaces.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
-attributes for targeted clients.
+\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
+options for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1646,8 +1739,8 @@ but for interfaces.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
-attributes for targeted clients.
+\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
+options for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1724,7 +1817,7 @@ The logfile is appended to, in the following format:
 .UNINDENT
 .sp
 If this option is given, the \fI\%use\-syslog\fP
-attribute is internally set to \fBno\fP\&.
+option is internally set to \fBno\fP\&.
 .sp
 The logfile is reopened (for append) when the config file is reread, on
 SIGHUP.
@@ -1872,8 +1965,8 @@ Read the root hints from this file.
 Default is nothing, using builtin hints for the IN class.
 The file has the format of zone files, with root nameserver names and
 addresses only.
-The default may become outdated, when servers change, therefore it is good
-practice to use a root hints file.
+The default may become outdated, when servers change, and then it is
+possible to use a root hints file with specific servers.
 .sp
 Default: \(dq\(dq
 .UNINDENT
@@ -1969,7 +2062,7 @@ Default:  \(dq3 2 1 0 0\(dq
 .B harden\-short\-bufsize: \fI<yes or no>\fP 
 Very small EDNS buffer sizes from queries are ignored.
 .sp
-Default: yes (as described in the standard)
+Default: yes (per \fI\%RFC 6891\fP)
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -2600,6 +2693,12 @@ If
 \fI\%serve\-expired\-client\-timeout\fP
 is also used then it is RECOMMENDED to use 30 as the value (\fI\%RFC 8767\fP).
 .sp
+This value is capped by the original TTL of the record.
+This means that records with higher original TTL than this value will use
+this value for expired replies.
+Records with lower original TTL than this value will use their original TTL
+for expired replies.
+.sp
 Default: 30
 .UNINDENT
 .INDENT 0.0
@@ -3335,7 +3434,7 @@ This specifies the action data for
 \fI\%response\-ip\fP with action being to redirect
 as specified by \fI<\(dqresource record string\(dq>\fP\&.
 \fI<\(dqResource record string\(dq>\fP is similar to that of
-\fI\%access\-control\-tag\-action\fP,
+\fI\%access\-control\-tag\-data\fP,
 but it must be of either AAAA, A or CNAME types.
 If the \fI<IP\-netblock>\fP is an IPv6/IPv4 prefix, the record must be AAAA/A
 respectively, unless it is a CNAME (which can be used for both versions of
@@ -3656,6 +3755,15 @@ Default: 200
 .UNINDENT
 .INDENT 0.0
 .TP
+.B iter\-scrub\-promiscuous: \fI<yes or no>\fP 
+Should the iterator scrubber remove promiscuous NS from positive answers.
+This protects against poisonous contents, that could affect names in the
+same zone as a spoofed packet.
+.sp
+Default: yes
+.UNINDENT
+.INDENT 0.0
+.TP
 .B fast\-server\-permil: \fI<number>\fP 
 Specify how many times out of 1000 to pick from the set of fastest servers.
 0 turns the feature off.
@@ -3796,17 +3904,18 @@ enabled to increase privacy on the outgoing reports.
 .sp
 Default: no
 .UNINDENT
-.SS Remote Control Options
+.SH REMOTE CONTROL OPTIONS
+.sp
+These options are part of the \fBremote\-control:\fP section and are the
+declarations for the remote control facility.
 .sp
-In the \fBremote\-control:\fP clause are the declarations for the remote control
-facility.
 If this is enabled, the \fI\%unbound\-control(8)\fP
 utility can be used to send commands to the running Unbound server.
-The server uses these clauses to setup TLSv1 security for the connection.
-The \fI\%unbound\-control(8)\fP utility also reads the
-\fBremote\-control:\fP section for options.
+The server uses these options to setup TLS security for the connection.
+The \fI\%unbound\-control(8)\fP utility also reads
+this \fBremote\-control:\fP section for options.
 To setup the correct self\-signed certificates use the
-\fIunbound\-control\-setup(8)\fP utility.
+\fBunbound\-control\-setup(8)\fP utility.
 .INDENT 0.0
 .TP
 .B control\-enable: \fI<yes or no>\fP 
@@ -3906,9 +4015,11 @@ This file is used by \fI\%unbound\-control(8)\fP\&.
 .sp
 Default: unbound_control.pem
 .UNINDENT
-.SS Stub Zone Options
+.SH STUB ZONE OPTIONS
 .sp
-There may be multiple \fBstub\-zone:\fP clauses.
+These options are part of the \fBstub\-zone:\fP section.
+.sp
+There may be multiple \fBstub\-zone:\fP sections.
 Each with a \fI\%name\fP and zero or more hostnames or
 IP addresses.
 For the stub zone this list of nameservers is used.
@@ -3947,9 +4058,10 @@ Consider adding \fI\%server\fP statements for
 \fI\%domain\-insecure\fP and for
 \fI\%local\-zone: <name> nodefault\fP
 for the zone if it is a locally served zone.
-The insecure clause stops DNSSEC from invalidating the zone.
+The \fI\%domain\-insecure\fP option stops DNSSEC
+from invalidating the zone.
 The \fI\%local\-zone: nodefault\fP (or
-\fI\%transparent\fP) clause makes the
+\fI\%transparent\fP) option makes the
 (reverse\-) zone bypass Unbound\(aqs filtering of \fI\%RFC 1918\fP zones.
 .INDENT 0.0
 .TP
@@ -3963,6 +4075,23 @@ This is the full domain name of the zone.
 Name of stub zone nameserver.
 Is itself resolved before it is used.
 .sp
+\fBCAUTION:\fP
+.INDENT 7.0
+.INDENT 3.5
+If the domain (or a subdomain) from this zone is used as the host, it
+will unavoidably introduce a circular dependency on retrieving the IP
+addresses of the name server.
+In that case, it is suggested to use
+\fI\%stub\-addr\fP instead.
+Alternatively,
+\fI\%stub\-first: yes\fP can also work
+around the circular dependency by trying resolution outside of this
+zone.
+However this has the caveat that it would allow escaping this zone when
+any resolution attempt fails within this zone.
+.UNINDENT
+.UNINDENT
+.sp
 To use a non\-default port for DNS communication append \fB\(aq@\(aq\fP with the
 port number.
 .sp
@@ -4003,9 +4132,9 @@ Default: no
 .INDENT 0.0
 .TP
 .B stub\-first: \fI<yes or no>\fP 
-If enabled, a query is attempted without the stub clause if it fails.
+If enabled, a query is attempted without this stub section if it fails.
 The data could not be retrieved and would have caused SERVFAIL because the
-servers are unreachable, instead it is tried without this clause.
+servers are unreachable, instead it is tried without this stub section.
 .sp
 Default: no
 .UNINDENT
@@ -4038,9 +4167,11 @@ This is useful when you want immediate changes to be visible.
 .sp
 Default: no
 .UNINDENT
-.SS Forward Zone Options
+.SH FORWARD ZONE OPTIONS
 .sp
-There may be multiple \fBforward\-zone:\fP clauses.
+These options are part of the \fBforward\-zone:\fP section.
+.sp
+There may be multiple \fBforward\-zone:\fP sections.
 Each with a \fI\%name\fP and zero or more hostnames
 or IP addresses.
 For the forward zone this list of nameservers is used to forward the queries
@@ -4071,6 +4202,23 @@ This is the full domain name of the zone.
 Name of server to forward to.
 Is itself resolved before it is used.
 .sp
+\fBCAUTION:\fP
+.INDENT 7.0
+.INDENT 3.5
+If the domain (or a subdomain) from this zone is used as the host, it
+will unavoidably introduce a circular dependency on retrieving the IP
+addresses of the name server.
+In that case, it is suggested to use
+\fI\%forward\-addr\fP instead.
+Alternatively,
+\fI\%forward\-first: yes\fP can also
+work around the circular dependency by trying resolution outside of
+this zone.
+However this has the caveat that it would allow escaping this zone when
+any resolution attempt fails within this zone.
+.UNINDENT
+.UNINDENT
+.sp
 To use a non\-default port for DNS communication append \fB\(aq@\(aq\fP with the
 port number.
 .sp
@@ -4147,12 +4295,14 @@ This is useful when you want immediate changes to be visible.
 .sp
 Default: no
 .UNINDENT
-.SS Authority Zone Options
+.SH AUTHORITY ZONE OPTIONS
+.sp
+These options are part of the \fBauth\-zone:\fP section.
 .sp
 Authority zones are configured with \fBauth\-zone:\fP, and each one must have a
 \fI\%name\fP\&.
-There can be multiple ones, by listing multiple auth\-zone clauses, each with a
-different name, pertaining to that part of the namespace.
+There can be multiple ones, by listing multiple \fBauth\-zone\fP section clauses,
+each with a different name, pertaining to that part of the namespace.
 The authority zone with the name closest to the name looked up is used.
 Authority zones can be processed on two distinct, non\-exclusive, configurable
 stages.
@@ -4183,7 +4333,7 @@ consult the local zone data while resolving.
 In this case, the aforementioned CNAME example will result in a thoroughly
 resolved answer.
 .sp
-Authority zones can be read from zonefile.
+Authority zones can be read from a zonefile.
 And can be kept updated via AXFR and IXFR.
 After update the zonefile is rewritten.
 The update mechanism uses the SOA timer values and performs SOA UDP queries to
@@ -4368,18 +4518,20 @@ If not given then no zonefile is used.
 If the file does not exist or is empty, Unbound will attempt to fetch zone
 data (eg. from the primary servers).
 .UNINDENT
-.SS View Options
+.SH VIEW OPTIONS
 .sp
-There may be multiple \fBview:\fP clauses.
+These options are part of the \fBview:\fP section.
+.sp
+There may be multiple \fBview:\fP sections.
 Each with a \fI\%name\fP and zero or more
 \fI\%local\-zone\fP and
-\fI\%local\-data\fP attributes.
+\fI\%local\-data\fP options.
 Views can also contain \fI\%view\-first\fP,
 \fI\%response\-ip\fP,
 \fI\%response\-ip\-data\fP and
-\fI\%local\-data\-ptr\fP attributes.
+\fI\%local\-data\-ptr\fP options.
 View can be mapped to requests by specifying the view name in an
-\fI\%access\-control\-view\fP attribute.
+\fI\%access\-control\-view\fP option.
 Options from matching views will override global options.
 Global options will be used if no matching view is found, or when the matching
 view does not have the option specified.
@@ -4389,7 +4541,7 @@ view does not have the option specified.
 Name of the view.
 Must be unique.
 This name is used in the
-\fI\%access\-control\-view\fP attribute.
+\fI\%access\-control\-view\fP option.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -4422,6 +4574,22 @@ Has the same behaviour as the global
 .UNINDENT
 .INDENT 0.0
 .TP
+.B response\-ip: \fI<IP\-netblock> <action>\fP 
+This requires use of the \fBrespip\fP module.
+.sp
+Similar to \fI\%response\-ip\fP but
+only applies to this view.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B response\-ip\-data: \fI<IP\-netblock> <\(dqresource record string\(dq>\fP 
+This requires use of the \fBrespip\fP module.
+.sp
+Similar to \fI\%response\-ip\-data\fP but
+only applies to this view.
+.UNINDENT
+.INDENT 0.0
+.TP
 .B view\-first: \fI<yes or no>\fP 
 If enabled, it attempts to use the global
 \fI\%local\-zone\fP and
@@ -4430,9 +4598,11 @@ view specific options.
 .sp
 Default: no
 .UNINDENT
-.SS Python Module Options
+.SH PYTHON MODULE OPTIONS
 .sp
-The \fBpython:\fP clause gives the settings for the \fIpython(1)\fP script module.
+These options are part of the \fBpython:\fP section.
+.sp
+The \fBpython:\fP section gives the settings for the \fIpython(1)\fP script module.
 This module acts like the iterator and validator modules do, on queries and
 answers.
 To enable the script module it has to be compiled into the daemon, and the word
@@ -4455,14 +4625,16 @@ The script file to load.
 Repeat this option for every python module instance added to the
 \fI\%module\-config\fP option.
 .UNINDENT
-.SS Dynamic Library Module Options
+.SH DYNAMIC LIBRARY MODULE OPTIONS
 .sp
-The \fBdynlib:\fP clause gives the settings for the \fBdynlib\fP module.
+These options are part of the \fBdynlib:\fP section.
+.sp
+The \fBdynlib:\fP section gives the settings for the \fBdynlib\fP module.
 This module is only a very small wrapper that allows dynamic modules to be
 loaded on runtime instead of being compiled into the application.
 To enable the dynlib module it has to be compiled into the daemon, and the word
 \fBdynlib\fP has to be put in the
-\fI\%module\-config\fP attribute.
+\fI\%module\-config\fP option.
 Multiple instances of dynamic libraries are supported by adding the word
 \fBdynlib\fP more than once.
 .sp
@@ -4477,7 +4649,9 @@ The dynamic library file to load.
 Repeat this option for every dynlib module instance added to the
 \fI\%module\-config\fP option.
 .UNINDENT
-.SS DNS64 Module Options
+.SH DNS64 MODULE OPTIONS
+.sp
+These options are part of the \fBserver:\fP section.
 .sp
 The \fBdns64\fP module must be configured in the
 \fI\%module\-config\fP directive, e.g.:
@@ -4497,7 +4671,11 @@ and be compiled into the daemon to be enabled.
 \fBNOTE:\fP
 .INDENT 0.0
 .INDENT 3.5
-These settings go in the \fI\%server:\fP section.
+If combining the \fBrespip\fP and \fBdns64\fP modules, the \fBrespip\fP module
+needs to appear before the \fBdns64\fP module in the
+\fI\%module\-config\fP
+configuration option so that response IP and/or RPZ feeds can properly
+filter responses regardless of DNS64 synthesis.
 .UNINDENT
 .UNINDENT
 .INDENT 0.0
@@ -4533,12 +4711,12 @@ Can be entered multiple times, list a new domain for which it applies, one
 per line.
 Applies also to names underneath the name given.
 .UNINDENT
-.SS NAT64 Operation
+.SH NAT64 OPTIONS
+.sp
+These options are part of the \fBserver:\fP section.
 .sp
 NAT64 operation allows using a NAT64 prefix for outbound requests to IPv4\-only
 servers.
-It is controlled by two options in the
-\fI\%server:\fP section:
 .INDENT 0.0
 .TP
 .B do\-nat64: \fI<yes or no>\fP 
@@ -4556,9 +4734,11 @@ The prefix length must be one of /32, /40, /48, /56, /64 or /96.
 .sp
 Default: 64:ff9b::/96 (same as \fI\%dns64\-prefix\fP)
 .UNINDENT
-.SS DNSCrypt Options
+.SH DNSCRYPT OPTIONS
 .sp
-The \fBdnscrypt:\fP clause gives the settings of the dnscrypt channel.
+These options are part of the \fBdnscrypt:\fP section.
+.sp
+The \fBdnscrypt:\fP section gives the settings of the dnscrypt channel.
 While those options are available, they are only meaningful if Unbound was
 compiled with \fB\-\-enable\-dnscrypt\fP\&.
 Currently certificate and secret/public keys cannot be generated by Unbound.
@@ -4688,7 +4868,9 @@ If left unconfigured, it will be configured automatically to be a power of
 .sp
 Default: (unconfigured)
 .UNINDENT
-.SS EDNS Client Subnet Module Options
+.SH EDNS CLIENT SUBNET MODULE OPTIONS
+.sp
+These options are part of the \fBserver:\fP section.
 .sp
 The ECS module must be configured in the
 \fI\%module\-config\fP directive, e.g.:
@@ -4705,13 +4887,6 @@ module\-config: \(dqsubnetcache validator iterator\(dq
 .sp
 and be compiled into the daemon to be enabled.
 .sp
-\fBNOTE:\fP
-.INDENT 0.0
-.INDENT 3.5
-These settings go in the \fI\%server:\fP section.
-.UNINDENT
-.UNINDENT
-.sp
 If the destination address is allowed in the configuration Unbound will add the
 EDNS0 option to the query containing the relevant part of the client\(aqs address.
 When an answer contains the ECS option the response and the option are placed
@@ -4833,7 +5008,9 @@ This number applies for each qname/qclass/qtype tuple.
 .sp
 Default: 100
 .UNINDENT
-.SS Opportunistic IPsec Support Module Options
+.SH OPPORTUNISTIC IPSEC SUPPORT MODULE OPTIONS
+.sp
+These options are part of the \fBserver:\fP section.
 .sp
 The IPsec module must be configured in the
 \fI\%module\-config\fP directive, e.g.:
@@ -4850,13 +5027,6 @@ module\-config: \(dqipsecmod validator iterator\(dq
 .sp
 and be compiled into Unbound by using \fB\-\-enable\-ipsecmod\fP to be enabled.
 .sp
-\fBNOTE:\fP
-.INDENT 0.0
-.INDENT 3.5
-These settings go in the \fI\%server:\fP section.
-.UNINDENT
-.UNINDENT
-.sp
 When Unbound receives an A/AAAA query that is not in the cache and finds a
 valid answer, it will withhold returning the answer and instead will generate
 an IPSECKEY subquery for the same domain name.
@@ -4954,7 +5124,9 @@ If the option is not specified, all domains are treated as being allowed
 .B ipsecmod\-whitelist: \fI<domain>\fP 
 Alternate syntax for \fI\%ipsecmod\-allow\fP\&.
 .UNINDENT
-.SS Cache DB Module Options
+.SH CACHE DB MODULE OPTIONS
+.sp
+These options are part of the \fBcachedb:\fP section.
 .sp
 The Cache DB module must be configured in the
 \fI\%module\-config\fP directive, e.g.:
@@ -5016,7 +5188,7 @@ If connection close or timeout happens too often, Unbound will be effectively
 unusable with this backend.
 It\(aqs the administrator\(aqs responsibility to make the assumption hold.
 .sp
-The \fBcachedb:\fP clause gives custom settings of the cache DB module.
+The \fBcachedb:\fP section gives custom settings of the cache DB module.
 .INDENT 0.0
 .TP
 .B backend: \fI<backend name>\fP 
@@ -5244,10 +5416,13 @@ for the Redis replica server.
 .sp
 Default: 0
 .UNINDENT
-.SS DNSTAP Logging Options
+.SH DNSTAP OPTIONS
 .sp
-DNSTAP support, when compiled in by using \fB\-\-enable\-dnstap\fP, is enabled in
-the \fBdnstap:\fP section.
+These options are part of the \fBdnstap:\fP section.
+.sp
+DNSTAP is a flexible, structured binary log format for DNS software.
+When compiled in by using \fB\-\-enable\-dnstap\fP, it can be enabled in the
+\fBdnstap:\fP section.
 This starts an extra thread (when compiled with threading) that writes the log
 information to the destination.
 If Unbound is compiled without threading it does not spawn a thread, but
@@ -5413,15 +5588,18 @@ Enable to log forwarder response messages.
 .sp
 Default: no
 .UNINDENT
-.SS Response Policy Zone Options
+.SH RESPONSE POLICY ZONE OPTIONS
 .sp
-Response Policy Zones are configured with \fBrpz:\fP, and each one must have a
-\fI\%name\fP attribute.
-There can be multiple ones, by listing multiple RPZ clauses, each with a
-different name.
-RPZ clauses are applied in order of configuration and any match from an earlier
-RPZ zone will terminate the RPZ lookup.
+These options are part of the \fBrpz:\fP section.
+.sp
+Response Policy Zones are configured with \fBrpz:\fP section clauses, and each
+one must have a \fI\%name\fP option.
+There can be multiple ones, by listing multiple \fBrpz:\fP section clauses, each
+with a different name.
+RPZ sections are applied in order of configuration and any match from an
+earlier RPZ zone will terminate the RPZ lookup.
 Note that a PASSTHRU action is still considered a match.
+.sp
 The respip module needs to be added to the
 \fI\%module\-config\fP, e.g.:
 .INDENT 0.0
@@ -5435,6 +5613,17 @@ module\-config: \(dqrespip validator iterator\(dq
 .UNINDENT
 .UNINDENT
 .sp
+\fBNOTE:\fP
+.INDENT 0.0
+.INDENT 3.5
+If combining the \fBrespip\fP and \fBdns64\fP modules, the \fBrespip\fP module
+needs to appear before the \fBdns64\fP module in the
+\fI\%module\-config\fP
+configuration option so that response IP and/or RPZ feeds can properly
+filter responses regardless of DNS64 synthesis.
+.UNINDENT
+.UNINDENT
+.sp
 QNAME, Response IP Address, nsdname, nsip and clientip triggers are supported.
 Supported actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp\-only
 and drop.
@@ -5503,9 +5692,6 @@ A 192.0.2.1                  answer with this IP address
 .sp
 Other records like AAAA, TXT and other CNAMEs (not rpz\-..) can also be used to
 answer queries with that content.
-.sp
-The RPZ zones can be configured in the config file with these settings in the
-\fBrpz:\fP block.
 .INDENT 0.0
 .TP
 .B name: \fI<zone name>\fP 
@@ -5644,7 +5830,7 @@ Default: no
 .INDENT 0.0
 .TP
 .B tags: \fI\(dq<list of tags>\(dq\fP 
-Limit the policies from this RPZ clause to clients with a matching tag.
+Limit the policies from this RPZ section to clients with a matching tag.
 .sp
 Tags need to be defined in \fI\%define\-tag\fP and
 can be assigned to client addresses using
@@ -5652,7 +5838,7 @@ can be assigned to client addresses using
 \fI\%interface\-tag\fP\&.
 Enclose list of tags in quotes (\fB\(dq\(dq\fP) and put spaces between tags.
 .sp
-If no tags are specified the policies from this clause will be applied for
+If no tags are specified the policies from this section will be applied for
 all clients.
 .UNINDENT
 .SH MEMORY CONTROL EXAMPLE
@@ -46,34 +46,41 @@ Description
 -----------

 **unbound.conf** is used to configure :doc:`unbound(8)</manpages/unbound>`.
-The file format has attributes and values.
-Some attributes have attributes inside them.
-The notation is: ``attribute: value``.
-
-Comments start with ``#`` and last to the end of line.
-Empty lines are ignored as is whitespace at the beginning of a line.

 The utility :doc:`unbound-checkconf(8)</manpages/unbound-checkconf>` can be
 used to check ``unbound.conf`` prior to usage.

+File Format
+-----------
+
+Whitespace is used to separate keywords.
+Whitespace indentation is insignificant, but is still recommended for visual
+clarity.
+Comments start with ``#`` and last to the end of line.
+Empty lines are ignored, as is whitespace at the beginning of a line.
+
+Attribute keywords end with a colon (``:``) and they are either options or
+section clauses (group options together).
+
+The configuration file is logically divided into **sections** where each section
+is introduced by a :ref:`section clause<unbound.conf.clauses>`.
+
 Example
 -------

-An example config file is shown below.
-Copy this to :file:`/etc/unbound/unbound.conf` and start the server with:
+An example minimal config file is shown below; most settings are the defaults.
+Copy this to ``@ub_conf_file@`` and start the server with:

 .. code-block:: text

-    $ unbound -c /etc/unbound/unbound.conf
+    $ unbound -c @ub_conf_file@

-Most settings are the defaults.
 Stop the server with:

 .. code-block:: text

-    $ kill `cat /etc/unbound/unbound.pid`
+    $ kill `cat @UNBOUND_PIDFILE@`

-Below is a minimal config file.
 The source distribution contains an extensive :file:`example.conf` file with
 all the options.

@@ -81,15 +88,15 @@ all the options.

    # unbound.conf(5) config file for unbound(8).
    server:
-        directory: "/etc/unbound"
+        directory: "@UNBOUND_RUN_DIR@"
        username: unbound
        # make sure unbound can access entropy from inside the chroot.
        # e.g. on linux the use these commands (on BSD, devfs(8) is used):
-        #      mount --bind -n /dev/urandom /etc/unbound/dev/urandom
-        # and  mount --bind -n /dev/log /etc/unbound/dev/log
-        chroot: "/etc/unbound"
-        # logfile: "/etc/unbound/unbound.log"  #uncomment to use logfile.
-        pidfile: "/etc/unbound/unbound.pid"
+        #      mount --bind -n /dev/urandom @UNBOUND_RUN_DIR@/dev/urandom
+        # and  mount --bind -n /dev/log @UNBOUND_RUN_DIR@/dev/log
+        chroot: "@UNBOUND_CHROOT_DIR@"
+        # logfile: "@UNBOUND_RUN_DIR@/unbound.log"  #uncomment to use logfile.
+        pidfile: "@UNBOUND_PIDFILE@"
        # verbosity: 1      # uncomment and increase to get more logging.
        # listen on all interfaces, answer queries from the local subnet.
        interface: 0.0.0.0
@@ -97,19 +104,71 @@ all the options.
        access-control: 10.0.0.0/8 allow
        access-control: 2001:DB8::/64 allow

-File Format
-----------
+.. _unbound.conf.clauses:

-There must be whitespace between keywords.
-Attribute keywords end with a colon ``':'``.
-An attribute is followed by a value, or its containing attributes in which case
-it is referred to as a clause.
-Clauses can be repeated throughout the file (or included files) to group
-attributes under the same clause.
+Section Clauses
+---------------
+
+The recognized section clauses are:
+
+    :ref:`server:<unbound.conf.server>`
+        Most of the configuration is found in this section.
+
+    :ref:`remote-control:<unbound.conf.remote>`
+        Configuration for the facility used by
+        :doc:`unbound-control(8)</manpages/unbound-control>`.
+
+    :ref:`stub-zone:<unbound.conf.stub>`
+        Configuration for a zone that redirects to specific authoritative name
+        servers, e.g. for zones not generally available on the greater
+        Internet.
+
+    :ref:`forward-zone:<unbound.conf.forward>`
+        Configuration for a zone that forwards to specific DNS resolvers.
+
+    :ref:`auth-zone:<unbound.conf.auth>`
+        Configuration for local authoritative zones.
+
+    :ref:`view:<unbound.conf.view>`
+        Overriding a small subset of configuration for incoming requests.
+        Requests are mapped to views with
+        :ref:`access-control-view<unbound.conf.access-control-view>` and
+        :ref:`interface-view<unbound.conf.interface-view>`.
+
+    :ref:`python:<unbound.conf.python>`
+        Configuration for the optional ``python`` script module.
+
+    :ref:`dynlib:<unbound.conf.dynlib>`
+        Configuration for the optional ``dynlib`` module that loads dynamic
+        libraries into Unbound.
+
+    :ref:`dnscrypt:<unbound.conf.dnscrypt>`
+        Configuration for the optional DNSCrypt feature.
+
+    :ref:`cachedb:<unbound.conf.cachedb>`
+        Configuration for the optional ``cachedb`` module that can interface
+        with second level caches, currently Redis or Redis-complatible
+        databases.
+
+    :ref:`dnstap:<unbound.conf.dnstap>`
+        Configuration of the optional dnstap logging feature; a flexible,
+        structured binary log format for DNS software.
+
+    :ref:`rpz:<unbound.conf.rpz>`
+        Configuration for Response Policy Zones that allows for DNS filtering.
+        Requires the ``respip`` module.
+
+Section clauses can be repeated throughout the file (or included files) to
+logically group options in one visually cohesive group.
+This may be particularly useful for the ``server:`` clause with its myriad of
+options.

 .. _unbound.conf.include:

-Files can be included using the **include:** directive.
+Including Files
+---------------
+
+Files can be included using the ``include:`` directive.
 It can appear anywhere, it accepts a single file name as argument.
 Processing continues as if the text from the included file was copied into the
 config file at that point.
@@ -122,17 +181,17 @@ Wildcards can be used to include multiple files, see *glob(7)*.

 .. _unbound.conf.include-toplevel:

-For a more structural include option, the **include-toplevel:** directive can
+For a more structural include option, the ``include-toplevel:`` directive can
 be used.
-This closes whatever clause is currently active (if any) and forces the use of
-clauses in the included files and right after this directive.
+This closes whatever section clause is currently active (if any) and forces the
+use of section clauses in the included files and right after this directive.

 .. _unbound.conf.server:

 Server Options
-^^^^^^^^^^^^^^
+--------------

-These options are part of the **server:** clause.
+These options are part of the ``server:`` section.


@@UAHL@unbound.conf@verbosity@@: *<number>*
@@ -496,6 +555,9 @@ These options are part of the **server:** clause.
    The wait time in msec where recursion requests are dropped.
    This is to stop a large number of replies from accumulating.
    They receive no reply, the work item continues to recurse.
+    For UDP the replies are dropped, for stream connections the reply
+    is not dropped if the stream connection is still open ready to receive
+    answers.
    It is nice to be a bit larger than
    :ref:`serve-expired-client-timeout<unbound.conf.serve-expired-client-timeout>`
    if that is enabled.
@@ -510,7 +572,7 @@ These options are part of the **server:** clause.
    This makes a ratelimit per IP address of waiting replies for recursion.
    It stops very large amounts of queries waiting to be returned to one
    destination.
-    The value ``0`` disables wait limits.
+    The value ``0`` disables all wait limits.

    Default: 1000

@@ -518,7 +580,11 @@ These options are part of the **server:** clause.
@@UAHL@unbound.conf@wait-limit-cookie@@: *<number>*
    The number of replies that can wait for recursion, for an IP address
    that sent the query with a valid DNS Cookie.
-    Since the cookie validates the client address, this limit can be higher.
+    Since the cookie already validates the client address, this option allows
+    to override a configured
+    :ref:`wait-limit<unbound.conf.wait-limit>` value usually with a higher one
+    for cookie validated queries.
+    The value ``0`` disables wait limits for cookie validated queries.

    Default: 10000

@@ -1049,8 +1115,8 @@ These options are part of the **server:** clause.


@@UAHL@unbound.conf@tls-system-cert@@: *<yes or no>*
-    This the same attribute as the
-    :ref:`tls-win-cert<unbound.conf.tls-win-cert>` attribute, under a
+    This the same as the
+    :ref:`tls-win-cert<unbound.conf.tls-win-cert>` option, under a
    different name.
    Because it is not windows specific.

@@ -1103,6 +1169,30 @@ These options are part of the **server:** clause.
    Default: ""


+@@UAHL@unbound.conf@tls-use-sni@@: *<yes or no>*
+    Enable or disable sending the SNI extension on TLS connections.
+
+    .. note:: Changing the value requires a reload.
+
+    Default: yes
+
+
+@@UAHL@unbound.conf@tls-use-system-policy-versions@@: *<yes or no>*
+    Enable or disable general-puspose version-flexible TLS server configuration
+    when serving TLS.
+    This will allow the whole list of available TLS versions provided by the
+    crypto library, which may have been further restricted by the system's
+    crypto policy.
+
+    By default Unbound only uses the latest available TLS version.
+
+    .. caution:: Use only if you want to support legacy TLS client connections.
+
+    .. note:: Changing the value requires a reload.
+
+    Default: no
+
+
@@UAHL@unbound.conf@pad-responses@@: *<yes or no>*
    If enabled, TLS serviced queries that contained an EDNS Padding option will
    cause responses padded to the closest multiple of the size specified in
@@ -1132,14 +1222,6 @@ These options are part of the **server:** clause.
    Default: 128


-@@UAHL@unbound.conf@tls-use-sni@@: *<yes or no>*
-    Enable or disable sending the SNI extension on TLS connections.
-
-    .. note:: Changing the value requires a reload.
-
-    Default: yes
-
-
@@UAHL@unbound.conf@https-port@@: *<number>*
    The port number on which to provide DNS-over-HTTPS service.
    Only interfaces configured with that port number as @number get the HTTPS
@@ -1421,8 +1503,8 @@ These options are part of the **server:** clause.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.


@@UAHL@unbound.conf@interface-tag@@: *<ip address or interface name [@port]> <"list of tags">*
@@ -1432,8 +1514,8 @@ These options are part of the **server:** clause.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.


@@UAHL@unbound.conf@interface-tag-action@@: *<ip address or interface name [@port]> <tag> <action>*
@@ -1444,8 +1526,8 @@ These options are part of the **server:** clause.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.


@@UAHL@unbound.conf@interface-tag-data@@: *<ip address or interface name [@port]> <tag> <"resource record string">*
@@ -1456,8 +1538,8 @@ These options are part of the **server:** clause.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.


@@UAHL@unbound.conf@interface-view@@: *<ip address or interface name [@port]> <view name>*
@@ -1467,8 +1549,8 @@ These options are part of the **server:** clause.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** attribute overrides all **interface-\*:**
-        attributes for targeted clients.
+        **access-control\*:** option overrides all **interface-\*:**
+        options for targeted clients.


@@UAHL@unbound.conf@chroot@@: *<directory>*
@@ -1533,7 +1615,7 @@ These options are part of the **server:** clause.
        [seconds since 1970] unbound[pid:tid]: type: message.

    If this option is given, the :ref:`use-syslog<unbound.conf.use-syslog>`
-    attribute is internally set to ``no``.
+    option is internally set to ``no``.

    The logfile is reopened (for append) when the config file is reread, on
    SIGHUP.
@@ -1657,8 +1739,8 @@ These options are part of the **server:** clause.
    Default is nothing, using builtin hints for the IN class.
    The file has the format of zone files, with root nameserver names and
    addresses only.
-    The default may become outdated, when servers change, therefore it is good
-    practice to use a root hints file.
+    The default may become outdated, when servers change, and then it is
+    possible to use a root hints file with specific servers.

    Default: ""

@@ -1744,7 +1826,7 @@ These options are part of the **server:** clause.
@@UAHL@unbound.conf@harden-short-bufsize@@: *<yes or no>*
    Very small EDNS buffer sizes from queries are ignored.

-    Default: yes (as described in the standard)
+    Default: yes (per :rfc:`6891`)


@@UAHL@unbound.conf@harden-large-queries@@: *<yes or no>*
@@ -2306,6 +2388,12 @@ These options are part of the **server:** clause.
    :ref:`serve-expired-client-timeout<unbound.conf.serve-expired-client-timeout>`
    is also used then it is RECOMMENDED to use 30 as the value (:rfc:`8767`).

+    This value is capped by the original TTL of the record.
+    This means that records with higher original TTL than this value will use
+    this value for expired replies.
+    Records with lower original TTL than this value will use their original TTL
+    for expired replies.
+
    Default: 30


@@ -2861,7 +2949,7 @@ These options are part of the **server:** clause.
    :ref:`response-ip<unbound.conf.response-ip>` with action being to redirect
    as specified by *<"resource record string">*.
    *<"Resource record string">* is similar to that of
-    :ref:`access-control-tag-action<unbound.conf.access-control-tag-action>`,
+    :ref:`access-control-tag-data<unbound.conf.access-control-tag-data>`,
    but it must be of either AAAA, A or CNAME types.
    If the *<IP-netblock>* is an IPv6/IPv4 prefix, the record must be AAAA/A
    respectively, unless it is a CNAME (which can be used for both versions of
@@ -3156,6 +3244,14 @@ These options are part of the **server:** clause.
    Default: 200


+@@UAHL@unbound.conf@iter-scrub-promiscuous@@: *<yes or no>*
+    Should the iterator scrubber remove promiscuous NS from positive answers.
+    This protects against poisonous contents, that could affect names in the
+    same zone as a spoofed packet.
+
+    Default: yes
+
+
@@UAHL@unbound.conf@fast-server-permil@@: *<number>*
    Specify how many times out of 1000 to pick from the set of fastest servers.
    0 turns the feature off.
@@ -3282,17 +3378,18 @@ These options are part of the **server:** clause.
 .. _unbound.conf.remote:

 Remote Control Options
-^^^^^^^^^^^^^^^^^^^^^^
+----------------------
+
+These options are part of the ``remote-control:`` section and are the
+declarations for the remote control facility.

-In the **remote-control:** clause are the declarations for the remote control
-facility.
 If this is enabled, the :doc:`unbound-control(8)</manpages/unbound-control>`
 utility can be used to send commands to the running Unbound server.
-The server uses these clauses to setup TLSv1 security for the connection.
-The :doc:`unbound-control(8)</manpages/unbound-control>` utility also reads the
-**remote-control:** section for options.
+The server uses these options to setup TLS security for the connection.
+The :doc:`unbound-control(8)</manpages/unbound-control>` utility also reads
+this ``remote-control:`` section for options.
 To setup the correct self-signed certificates use the
-*unbound-control-setup(8)* utility.
+``unbound-control-setup(8)`` utility.


@@UAHL@unbound.conf.remote@control-enable@@: *<yes or no>*
@@ -3384,9 +3481,11 @@ To setup the correct self-signed certificates use the
 .. _unbound.conf.stub:

 Stub Zone Options
-^^^^^^^^^^^^^^^^^
+-----------------

-There may be multiple **stub-zone:** clauses.
+These options are part of the ``stub-zone:`` section.
+
+There may be multiple ``stub-zone:`` sections.
 Each with a :ref:`name<unbound.conf.stub.name>` and zero or more hostnames or
 IP addresses.
 For the stub zone this list of nameservers is used.
@@ -3419,9 +3518,10 @@ Consider adding :ref:`server<unbound.conf.server>` statements for
 :ref:`domain-insecure<unbound.conf.domain-insecure>` and for
 :ref:`local-zone: \<name\> nodefault<unbound.conf.local-zone.type.nodefault>`
 for the zone if it is a locally served zone.
-The insecure clause stops DNSSEC from invalidating the zone.
+The :ref:`domain-insecure<unbound.conf.domain-insecure>` option stops DNSSEC
+from invalidating the zone.
 The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
-:ref:`transparent<unbound.conf.local-zone.type.transparent>`) clause makes the
+:ref:`transparent<unbound.conf.local-zone.type.transparent>`) option makes the
 (reverse-) zone bypass Unbound's filtering of :rfc:`1918` zones.


@@ -3434,6 +3534,19 @@ The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
    Name of stub zone nameserver.
    Is itself resolved before it is used.

+    .. caution::
+        If the domain (or a subdomain) from this zone is used as the host, it
+        will unavoidably introduce a circular dependency on retrieving the IP
+        addresses of the name server.
+        In that case, it is suggested to use
+        :ref:`stub-addr<unbound.conf.stub.stub-addr>` instead.
+        Alternatively,
+        :ref:`stub-first: yes<unbound.conf.stub.stub-first>` can also work
+        around the circular dependency by trying resolution outside of this
+        zone.
+        However this has the caveat that it would allow escaping this zone when
+        any resolution attempt fails within this zone.
+
    To use a non-default port for DNS communication append ``'@'`` with the
    port number.

@@ -3471,9 +3584,9 @@ The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or


@@UAHL@unbound.conf.stub@stub-first@@: *<yes or no>*
-    If enabled, a query is attempted without the stub clause if it fails.
+    If enabled, a query is attempted without this stub section if it fails.
    The data could not be retrieved and would have caused SERVFAIL because the
-    servers are unreachable, instead it is tried without this clause.
+    servers are unreachable, instead it is tried without this stub section.

    Default: no

@@ -3505,9 +3618,11 @@ The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
 .. _unbound.conf.forward:

 Forward Zone Options
-^^^^^^^^^^^^^^^^^^^^
+--------------------

-There may be multiple **forward-zone:** clauses.
+These options are part of the ``forward-zone:`` section.
+
+There may be multiple ``forward-zone:`` sections.
 Each with a :ref:`name<unbound.conf.forward.name>` and zero or more hostnames
 or IP addresses.
 For the forward zone this list of nameservers is used to forward the queries
@@ -3537,6 +3652,19 @@ cache).
    Name of server to forward to.
    Is itself resolved before it is used.

+    .. caution::
+        If the domain (or a subdomain) from this zone is used as the host, it
+        will unavoidably introduce a circular dependency on retrieving the IP
+        addresses of the name server.
+        In that case, it is suggested to use
+        :ref:`forward-addr<unbound.conf.forward.forward-addr>` instead.
+        Alternatively,
+        :ref:`forward-first: yes<unbound.conf.forward.forward-first>` can also
+        work around the circular dependency by trying resolution outside of
+        this zone.
+        However this has the caveat that it would allow escaping this zone when
+        any resolution attempt fails within this zone.
+
    To use a non-default port for DNS communication append ``'@'`` with the
    port number.

@@ -3610,12 +3738,14 @@ cache).
 .. _unbound.conf.auth:

 Authority Zone Options
-^^^^^^^^^^^^^^^^^^^^^^
+----------------------

-Authority zones are configured with **auth-zone:**, and each one must have a
+These options are part of the ``auth-zone:`` section.
+
+Authority zones are configured with ``auth-zone:``, and each one must have a
 :ref:`name<unbound.conf.auth.name>`.
-There can be multiple ones, by listing multiple auth-zone clauses, each with a
-different name, pertaining to that part of the namespace.
+There can be multiple ones, by listing multiple ``auth-zone`` section clauses,
+each with a different name, pertaining to that part of the namespace.
 The authority zone with the name closest to the name looked up is used.
 Authority zones can be processed on two distinct, non-exclusive, configurable
 stages.
@@ -3646,7 +3776,7 @@ consult the local zone data while resolving.
 In this case, the aforementioned CNAME example will result in a thoroughly
 resolved answer.

-Authority zones can be read from zonefile.
+Authority zones can be read from a zonefile.
 And can be kept updated via AXFR and IXFR.
 After update the zonefile is rewritten.
 The update mechanism uses the SOA timer values and performs SOA UDP queries to
@@ -3682,15 +3812,23 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
    :ref:`url<unbound.conf.auth.url>` to download the zonefile as a text file
    from a webserver that would work.

-    If you specify the hostname, you cannot use the domain from the zonefile,
-    because it may not have that when retrieving that data, instead use a plain
-    IP address to avoid a circular dependency on retrieving that IP address.
+    .. caution::
+        If you specify the hostname, you cannot use the domain from the
+        zonefile, because it may not have that when retrieving that data,
+        instead use a plain IP address to avoid a circular dependency on
+        retrieving that IP address.


@@UAHL@unbound.conf.auth@master@@: *<IP address or host name>*
    Alternate syntax for :ref:`primary<unbound.conf.auth.primary>`.


+@@UAHL@unbound.conf.auth@primary-tsig@@: *<IP address or host name>* *<tsig key>*
+    Similar to :ref:`primary<unbound.conf.auth.primary>` and the tsig key
+    is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
@@UAHL@unbound.conf.auth@url@@: *<URL to zone file>*
    Where to download a zonefile for the zone.
    With HTTP or HTTPS.
@@ -3737,6 +3875,12 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
        default.


+@@UAHL@unbound.conf.auth@allow-notify-tsig@@: *<IP address or host name or netblockIP/prefix>* *<tsig key>*
+    Similar to :ref:`allow-notify<unbound.conf.auth.allow-notify>` and the
+    tsig key is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
@@UAHL@unbound.conf.auth@fallback-enabled@@: *<yes or no>*
    If enabled, Unbound falls back to querying the internet as a resolver for
    this zone when lookups fail.
@@ -3815,18 +3959,20 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
 .. _unbound.conf.view:

 View Options
-^^^^^^^^^^^^
+------------

-There may be multiple **view:** clauses.
+These options are part of the ``view:`` section.
+
+There may be multiple ``view:`` sections.
 Each with a :ref:`name<unbound.conf.view.name>` and zero or more
 :ref:`local-zone<unbound.conf.view.local-zone>` and
-:ref:`local-data<unbound.conf.view.local-data>` attributes.
+:ref:`local-data<unbound.conf.view.local-data>` options.
 Views can also contain :ref:`view-first<unbound.conf.view.view-first>`,
 :ref:`response-ip<unbound.conf.response-ip>`,
 :ref:`response-ip-data<unbound.conf.response-ip-data>` and
-:ref:`local-data-ptr<unbound.conf.view.local-data-ptr>` attributes.
+:ref:`local-data-ptr<unbound.conf.view.local-data-ptr>` options.
 View can be mapped to requests by specifying the view name in an
-:ref:`access-control-view<unbound.conf.access-control-view>` attribute.
+:ref:`access-control-view<unbound.conf.access-control-view>` option.
 Options from matching views will override global options.
 Global options will be used if no matching view is found, or when the matching
 view does not have the option specified.
@@ -3836,7 +3982,7 @@ view does not have the option specified.
    Name of the view.
    Must be unique.
    This name is used in the
-    :ref:`access-control-view<unbound.conf.access-control-view>` attribute.
+    :ref:`access-control-view<unbound.conf.access-control-view>` option.


@@UAHL@unbound.conf.view@local-zone@@: *<zone> <type>*
@@ -3865,6 +4011,20 @@ view does not have the option specified.
    :ref:`local-data-ptr<unbound.conf.local-data-ptr>` elements.


+@@UAHL@unbound.conf.view@response-ip@@: *<IP-netblock> <action>*
+    This requires use of the ``respip`` module.
+
+    Similar to :ref:`response-ip<unbound.conf.response-ip>` but
+    only applies to this view.
+
+
+@@UAHL@unbound.conf.view@response-ip-data@@: *<IP-netblock> <"resource record string">*
+    This requires use of the ``respip`` module.
+
+    Similar to :ref:`response-ip-data<unbound.conf.response-ip-data>` but
+    only applies to this view.
+
+
@@UAHL@unbound.conf.view@view-first@@: *<yes or no>*
    If enabled, it attempts to use the global
    :ref:`local-zone<unbound.conf.local-zone>` and
@@ -3873,10 +4033,14 @@ view does not have the option specified.

    Default: no

-Python Module Options
-^^^^^^^^^^^^^^^^^^^^^
+.. _unbound.conf.python:

-The **python:** clause gives the settings for the *python(1)* script module.
+Python Module Options
+---------------------
+
+These options are part of the ``python:`` section.
+
+The ``python:`` section gives the settings for the *python(1)* script module.
 This module acts like the iterator and validator modules do, on queries and
 answers.
 To enable the script module it has to be compiled into the daemon, and the word
@@ -3899,15 +4063,19 @@ path to the working directory.
    Repeat this option for every python module instance added to the
    :ref:`module-config<unbound.conf.module-config>` option.

-Dynamic Library Module Options
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+.. _unbound.conf.dynlib:

-The **dynlib:** clause gives the settings for the ``dynlib`` module.
+Dynamic Library Module Options
+------------------------------
+
+These options are part of the ``dynlib:`` section.
+
+The ``dynlib:`` section gives the settings for the ``dynlib`` module.
 This module is only a very small wrapper that allows dynamic modules to be
 loaded on runtime instead of being compiled into the application.
 To enable the dynlib module it has to be compiled into the daemon, and the word
 ``dynlib`` has to be put in the
-:ref:`module-config<unbound.conf.module-config>` attribute.
+:ref:`module-config<unbound.conf.module-config>` option.
 Multiple instances of dynamic libraries are supported by adding the word
 ``dynlib`` more than once.

@@ -3923,7 +4091,9 @@ directory.
    :ref:`module-config<unbound.conf.module-config>` option.

 DNS64 Module Options
-^^^^^^^^^^^^^^^^^^^^
+--------------------
+
+These options are part of the ``server:`` section.

 The ``dns64`` module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -3935,7 +4105,11 @@ The ``dns64`` module must be configured in the
 and be compiled into the daemon to be enabled.

 .. note::
-    These settings go in the :ref:`server:<unbound.conf.server>` section.
+    If combining the ``respip`` and ``dns64`` modules, the ``respip`` module
+    needs to appear before the ``dns64`` module in the
+    :ref:`module-config<unbound.conf.module-config>`
+    configuration option so that response IP and/or RPZ feeds can properly
+    filter responses regardless of DNS64 synthesis.


@@UAHL@unbound.conf.dns64@dns64-prefix@@: *<IPv6 prefix>*
@@ -3961,13 +4135,13 @@ and be compiled into the daemon to be enabled.
    per line.
    Applies also to names underneath the name given.

-NAT64 Operation
-^^^^^^^^^^^^^^^
+NAT64 Options
+-------------
+
+These options are part of the ``server:`` section.

 NAT64 operation allows using a NAT64 prefix for outbound requests to IPv4-only
 servers.
-It is controlled by two options in the
-:ref:`server:<unbound.conf.server>` section:


@@UAHL@unbound.conf.nat64@do-nat64@@: *<yes or no>*
@@ -3984,10 +4158,14 @@ It is controlled by two options in the

    Default: 64:ff9b::/96 (same as :ref:`dns64-prefix<unbound.conf.dns64.dns64-prefix>`)

-DNSCrypt Options
-^^^^^^^^^^^^^^^^
+.. _unbound.conf.dnscrypt:

-The **dnscrypt:** clause gives the settings of the dnscrypt channel.
+DNSCrypt Options
+----------------
+
+These options are part of the ``dnscrypt:`` section.
+
+The ``dnscrypt:`` section gives the settings of the dnscrypt channel.
 While those options are available, they are only meaningful if Unbound was
 compiled with ``--enable-dnscrypt``.
 Currently certificate and secret/public keys cannot be generated by Unbound.
@@ -4094,7 +4272,9 @@ https://github.com/cofyc/dnscrypt-wrapper/blob/master/README.md#usage
    Default: (unconfigured)

 EDNS Client Subnet Module Options
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+---------------------------------
+
+These options are part of the ``server:`` section.

 The ECS module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -4105,9 +4285,6 @@ The ECS module must be configured in the

 and be compiled into the daemon to be enabled.

-.. note::
-    These settings go in the :ref:`server:<unbound.conf.server>` section.
-
 If the destination address is allowed in the configuration Unbound will add the
 EDNS0 option to the query containing the relevant part of the client's address.
 When an answer contains the ECS option the response and the option are placed
@@ -4222,7 +4399,9 @@ This module does not interact with the
    Default: 100

 Opportunistic IPsec Support Module Options
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+------------------------------------------
+
+These options are part of the ``server:`` section.

 The IPsec module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -4233,9 +4412,6 @@ The IPsec module must be configured in the

 and be compiled into Unbound by using ``--enable-ipsecmod`` to be enabled.

-.. note::
-    These settings go in the :ref:`server:<unbound.conf.server>` section.
-
 When Unbound receives an A/AAAA query that is not in the cache and finds a
 valid answer, it will withhold returning the answer and instead will generate
 an IPSECKEY subquery for the same domain name.
@@ -4325,8 +4501,12 @@ answer given from cache is still relevant for opportunistic IPsec.
@@UAHL@unbound.conf@ipsecmod-whitelist@@: *<domain>*
    Alternate syntax for :ref:`ipsecmod-allow<unbound.conf.ipsecmod-allow>`.

+.. _unbound.conf.cachedb:
+
 Cache DB Module Options
-^^^^^^^^^^^^^^^^^^^^^^^
+-----------------------
+
+These options are part of the ``cachedb:`` section.

 The Cache DB module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -4378,7 +4558,7 @@ If connection close or timeout happens too often, Unbound will be effectively
 unusable with this backend.
 It's the administrator's responsibility to make the assumption hold.

-The **cachedb:** clause gives custom settings of the cache DB module.
+The ``cachedb:`` section gives custom settings of the cache DB module.


@@UAHL@unbound.conf.cachedb@backend@@: *<backend name>*
@@ -4426,7 +4606,7 @@ The **cachedb:** clause gives custom settings of the cache DB module.

    Default: yes

-The following **cachedb:** options are specific to the ``redis`` backend.
+The following ``cachedb:`` options are specific to the ``redis`` backend.


@@UAHL@unbound.conf.cachedb@redis-server-host@@: *<server address or name>*
@@ -4585,11 +4765,14 @@ The following **cachedb:** options are specific to the ``redis`` backend.

 .. _unbound.conf.dnstap:

-DNSTAP Logging Options
-^^^^^^^^^^^^^^^^^^^^^^
+DNSTAP Options
+--------------

-DNSTAP support, when compiled in by using ``--enable-dnstap``, is enabled in
-the **dnstap:** section.
+These options are part of the ``dnstap:`` section.
+
+DNSTAP is a flexible, structured binary log format for DNS software.
+When compiled in by using ``--enable-dnstap``, it can be enabled in the
+``dnstap:`` section.
 This starts an extra thread (when compiled with threading) that writes the log
 information to the destination.
 If Unbound is compiled without threading it does not spawn a thread, but
@@ -4739,15 +4922,18 @@ connects per-process to the destination.
 .. _unbound.conf.rpz:

 Response Policy Zone Options
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+----------------------------

-Response Policy Zones are configured with **rpz:**, and each one must have a
-:ref:`name<unbound.conf.rpz.name>` attribute.
-There can be multiple ones, by listing multiple RPZ clauses, each with a
-different name.
-RPZ clauses are applied in order of configuration and any match from an earlier
-RPZ zone will terminate the RPZ lookup.
+These options are part of the ``rpz:`` section.
+
+Response Policy Zones are configured with ``rpz:`` section clauses, and each
+one must have a :ref:`name<unbound.conf.rpz.name>` option.
+There can be multiple ones, by listing multiple ``rpz:`` section clauses, each
+with a different name.
+RPZ sections are applied in order of configuration and any match from an
+earlier RPZ zone will terminate the RPZ lookup.
 Note that a PASSTHRU action is still considered a match.
+
 The respip module needs to be added to the
 :ref:`module-config<unbound.conf.module-config>`, e.g.:

@@ -4755,6 +4941,13 @@ The respip module needs to be added to the

    module-config: "respip validator iterator"

+.. note::
+    If combining the ``respip`` and ``dns64`` modules, the ``respip`` module
+    needs to appear before the ``dns64`` module in the
+    :ref:`module-config<unbound.conf.module-config>`
+    configuration option so that response IP and/or RPZ feeds can properly
+    filter responses regardless of DNS64 synthesis.
+
 QNAME, Response IP Address, nsdname, nsip and clientip triggers are supported.
 Supported actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp-only
 and drop.
@@ -4806,9 +4999,6 @@ The actions are specified with the record on the right
 Other records like AAAA, TXT and other CNAMEs (not rpz-..) can also be used to
 answer queries with that content.

-The RPZ zones can be configured in the config file with these settings in the
-**rpz:** block.
-

@@UAHL@unbound.conf.rpz@name@@: *<zone name>*
    Name of the authority zone.
@@ -4840,6 +5030,12 @@ The RPZ zones can be configured in the config file with these settings in the
    Alternate syntax for :ref:`primary<unbound.conf.rpz.primary>`.


+@@UAHL@unbound.conf.rpz@primary-tsig@@: *<IP address or host name>* *<tsig key>*
+    Similar to :ref:`primary<unbound.conf.rpz.primary>` and the tsig key
+    is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
@@UAHL@unbound.conf.rpz@url@@: *<url to zonefile>*
    Where to download a zonefile for the zone.
    With HTTP or HTTPS.
@@ -4877,6 +5073,12 @@ The RPZ zones can be configured in the config file with these settings in the
        default.


+@@UAHL@unbound.conf.rpz@allow-notify-tsig@@: *<IP address or host name or netblockIP/prefix>* *<tsig key>*
+    Similar to :ref:`allow-notify<unbound.conf.rpz.allow-notify>` and the
+    tsig key is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
@@UAHL@unbound.conf.rpz@zonefile@@: *<filename>*
    The filename where the zone is stored.
    If not given then no zonefile is used.
@@ -4924,7 +5126,7 @@ The RPZ zones can be configured in the config file with these settings in the


@@UAHL@unbound.conf.rpz@tags@@: *"<list of tags>"*
-    Limit the policies from this RPZ clause to clients with a matching tag.
+    Limit the policies from this RPZ section to clients with a matching tag.

    Tags need to be defined in :ref:`define-tag<unbound.conf.define-tag>` and
    can be assigned to client addresses using
@@ -4932,9 +5134,45 @@ The RPZ zones can be configured in the config file with these settings in the
    :ref:`interface-tag<unbound.conf.interface-tag>`.
    Enclose list of tags in quotes (``""``) and put spaces between tags.

-    If no tags are specified the policies from this clause will be applied for
+    If no tags are specified the policies from this section will be applied for
    all clients.

+.. _unbound.conf.tsig-key:
+
+TSIG Key Options
+^^^^^^^^^^^^^^^^^
+
+The **tsig-key:** clauses specify the TSIG keys that are used.
+There can be multiple **tsig-key:** clauses, with each specifying a
+different key.
+Each key has a name, algorithm and secret key material.
+
+TSIG keys are shared secrets.
+Both sides of the connection share the secret information.
+Also they must both use the same name for the key, and same algorithm.
+
+With ``include: "key.conf"`` it is possible to put the declaration of the key
+or some lines of it in an external file from the main configuration file.
+It can also be used without such an include, with it the config statements
+and key material can be put in separate files.
+
+
+@@UAHL@unbound.conf.tsig-key@name@@: *"<key name>"*
+    Name of the TSIG key.
+    The key name is transferred in DNS wireformat in the TSIG record, and
+    is used to reference the TSIG key from where it is configured to be used.
+
+
+@@UAHL@unbound.conf.tsig-key@algorithm@@: *<algorithm name>*
+    Name of the algorithm to use with this TSIG key.
+    This can be md5, sha1, sha224, sha256, sha384 or sha512.
+
+
+@@UAHL@unbound.conf.tsig-key@secret@@: *"<base64 blob>"*
+    The secret contents is a base64 string.
+    A way to get random base64 bytes is e.g.
+    from ``dd if=/dev/random of=/dev/stdout count=1 bs=32 | base64``
+
 Memory Control Example
 ----------------------

@@ -567,8 +567,8 @@ generate_sub_request(struct module_qstate *qstate, int id, struct subnet_qstate*
 	}

 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, valrec,
-		&subq)) {
+	if(!(*qstate->env->attach_sub)(qstate, &qinf, qstate->client_info,
+		qflags, prime, valrec, &subq)) {
 		return 0;
 	}
 	if(subq) {
@@ -163,7 +163,7 @@ generate_request(struct module_qstate* qstate, int id, uint8_t* name,
 	}

 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	if(!(*qstate->env->attach_sub)(qstate, &ask,
+	if(!(*qstate->env->attach_sub)(qstate, &ask, NULL,
 		(uint16_t)(BIT_RD|flags), 0, 0, &newq)){
 		log_err("Could not generate request: out of memory");
 		return 0;
@@ -228,6 +228,11 @@ read_fwds_host(struct config_stub* s, struct delegpt* dp)
 				s->name, p->str);
 			return 0;
 		}
+		if(dname_subdomain_c(dname, dp->name)) {
+			log_warn("forward-host '%s' may have a circular "
+				"dependency on forward-zone '%s'",
+				p->str, s->name);
+		}
 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
 		if(tls_auth_name)
 			log_err("no name verification functionality in "
@@ -231,6 +231,11 @@ read_stubs_host(struct config_stub* s, struct delegpt* dp)
 				s->name, p->str);
 			return 0;
 		}
+		if(dname_subdomain_c(dname, dp->name)) {
+			log_warn("stub-host '%s' may have a circular "
+				"dependency on stub-zone '%s'",
+				p->str, s->name);
+		}
 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
 		if(tls_auth_name)
 			log_err("no name verification functionality in "
@@ -634,6 +634,22 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					"RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
+			/* If the NS set is a promiscuous NS set, scrub that
+			 * to remove potential for poisonous contents that
+			 * affects other names in the same zone. Remove
+			 * promiscuous NS sets in positive answers, that
+			 * thus have records in the answer section. Nodata
+			 * and nxdomain promiscuous NS sets have been removed
+			 * already. Since the NS rrset is scrubbed, its
+			 * address records are also not marked to be allowed
+			 * and are removed later. */
+			if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR &&
+				msg->an_rrsets != 0 &&
+				env->cfg->iter_scrub_promiscuous) {
+				remove_rrset("normalize: removing promiscuous "
+					"RRset:", pkt, msg, prev, &rrset);
+				continue;
+			}
 			if(nsset == NULL) {
 				nsset = rrset;
 			} else {
@@ -829,7 +829,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		struct mesh_state* sub = NULL;
 		fptr_ok(fptr_whitelist_modenv_add_sub(
 			qstate->env->add_sub));
-		if(!(*qstate->env->add_sub)(qstate, &qinf,
+		if(!(*qstate->env->add_sub)(qstate, &qinf, NULL,
 			qflags, prime, valrec, &subq, &sub)){
 			return 0;
 		}
@@ -838,8 +838,8 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		/* attach subquery, lookup existing or make a new one */
 		fptr_ok(fptr_whitelist_modenv_attach_sub(
 			qstate->env->attach_sub));
-		if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime,
-			valrec, &subq)) {
+		if(!(*qstate->env->attach_sub)(qstate, &qinf, NULL, qflags,
+			prime, valrec, &subq)) {
 			return 0;
 		}
 	}
@@ -52,6 +52,7 @@
 #include "util/data/msgreply.h"
 #include "util/storage/slabhash.h"
 #include "util/edns.h"
+#include "util/tsig.h"
 #include "sldns/sbuffer.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_hints.h"
@@ -81,13 +82,15 @@ context_finalize(struct ub_ctx* ctx)
 		return UB_INITFAIL;
 	listen_setup_locks();
 	log_edns_known_options(VERB_ALGO, ctx->env);
+	if(!tsig_key_table_apply_cfg(ctx->env->tsig_key_table, cfg))
+		return UB_INITFAIL;
 	ctx->local_zones = local_zones_create();
 	if(!ctx->local_zones)
 		return UB_NOMEM;
 	if(!local_zones_apply_cfg(ctx->local_zones, cfg))
 		return UB_INITFAIL;
 	if(!auth_zones_apply_cfg(ctx->env->auth_zones, cfg, 1, &is_rpz,
-		ctx->env, &ctx->mods))
+		ctx->env, &ctx->mods, ctx->env->tsig_key_table))
 		return UB_INITFAIL;
 	if(!(ctx->env->fwds = forwards_create()) ||
 		!forwards_apply_cfg(ctx->env->fwds, cfg))
@@ -59,6 +59,7 @@
 #include "util/tube.h"
 #include "util/ub_event.h"
 #include "util/edns.h"
+#include "util/tsig.h"
 #include "services/modstack.h"
 #include "services/localzone.h"
 #include "services/cache/infra.h"
@@ -168,6 +169,18 @@ static struct ub_ctx* ub_ctx_create_nopipe(void)
 		errno = ENOMEM;
 		return NULL;
 	}
+	ctx->env->tsig_key_table = tsig_key_table_create();
+	if(!ctx->env->tsig_key_table) {
+		auth_zones_delete(ctx->env->auth_zones);
+		edns_known_options_delete(ctx->env);
+		edns_strings_delete(ctx->env->edns_strings);
+		config_delete(ctx->env->cfg);
+		free(ctx->env);
+		ub_randfree(ctx->seed_rnd);
+		free(ctx);
+		errno = ENOMEM;
+		return NULL;
+	}

 	ctx->env->alloc = &ctx->superalloc;
 	ctx->env->worker = NULL;
@@ -388,6 +401,7 @@ ub_ctx_delete(struct ub_ctx* ctx)
 		config_delete(ctx->env->cfg);
 		edns_known_options_delete(ctx->env);
 		edns_strings_delete(ctx->env->edns_strings);
+		tsig_key_table_delete(ctx->env->tsig_key_table);
 		forwards_delete(ctx->env->fwds);
 		hints_delete(ctx->env->hints);
 		auth_zones_delete(ctx->env->auth_zones);
@@ -229,7 +229,9 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)
 		cfg->do_udp || cfg->udp_upstream_without_downstream, w->sslctx,
 		cfg->delay_close, cfg->tls_use_sni, NULL, cfg->udp_connect,
 		cfg->max_reuse_tcp_queries, cfg->tcp_reuse_timeout,
-		cfg->tcp_auth_query_timeout);
+		cfg->tcp_auth_query_timeout, (const char**)cfg->dist,
+		(const char**)cfg->dist_tsig,
+		cfg->num_dist);
 	w->env->outnet = w->back;
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_unlock(&ctx->cfglock);
@@ -853,7 +853,7 @@ Result: ['74.125.43.147', '74.125.43.99', '74.125.43.103', '74.125.43.104']
 %{ 
  //printf("resolve_start(%lX)\n",(long unsigned int)arg1);
  Py_BEGIN_ALLOW_THREADS 
-  $function 
+  $action
  Py_END_ALLOW_THREADS 
  //printf("resolve_stop()\n");
 %} 
@@ -440,6 +440,7 @@ if [ "$DOWIN" = "yes" ]; then
 	autoheader -f || error_cleanup "Autoheader failed."
    	rm -r autom4te* || echo "ignored"
 	rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
+	rm -f configure~ || echo "ignore absence of configure~ file."
    fi

    if test "`uname`" = "Linux"; then 
@@ -621,6 +622,7 @@ autoreconf -f || error_cleanup "Autoconf failed."

 rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
 rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
+rm -f configure~ || echo "ignore absence of configure~ file."

 info "Building lexer and parser."
 echo "#include \"config.h\"" > util/configlexer.c || error_cleanup "Failed to create configlexer"
@@ -666,6 +668,7 @@ if [ "$RECONFIGURE" = "yes" ]; then
    autoreconf -f || error_cleanup "Autoconf failed."
    rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
    rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
+    rm -f configure~ || echo "ignore absence of configure~ file."
 fi

 replace_all doc/README
@@ -697,7 +700,5 @@ cleanup
 storehash unbound-$version.tar.gz
 echo "create unbound-$version.tar.gz.asc with:"
 echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound-$version.tar.gz"
-echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound-$version.zip"
-echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound_setup_$version.exe"

 info "Unbound distribution created successfully."
@@ -732,8 +732,8 @@ struct module_env {
        char* tls_auth_name, struct module_qstate* q, int* was_ratelimited);
    void (*detach_subs)(struct module_qstate* qstate);
    int (*attach_sub)(struct module_qstate* qstate,
-        struct query_info* qinfo, uint16_t qflags, int prime,
-        int valrec, struct module_qstate** newq);
+        struct query_info* qinfo, struct respip_client_info* cinfo,
+        uint16_t qflags, int prime, int valrec, struct module_qstate** newq);
    void (*kill_sub)(struct module_qstate* newq);
    int (*detect_cycle)(struct module_qstate* qstate,
        struct query_info* qinfo, uint16_t flags, int prime,
@@ -454,7 +454,7 @@ int pythonmod_init(struct module_env* env, int id)
   if(PyDict_SetItemString(pe->data, "script", fname) < 0) {
 	log_err("pythonmod: could not add item to dictionary");
 	Py_XDECREF(fname);
-	goto python_init_fail;
+	goto fail_close_file;
   }
   Py_XDECREF(fname);
   Py_XINCREF(pe->data);  /* reference will be stolen below */
@@ -462,7 +462,7 @@ int pythonmod_init(struct module_env* env, int id)
 	log_err("pythonmod: could not add mod_env object");
 	Py_XDECREF(pe->data);  /* 2 times, here and on python_init_fail; */
 	                       /* on failure the reference is not stolen */
-	goto python_init_fail;
+	goto fail_close_file;
   }

   if (PyRun_SimpleFile(script_py, pe->fname) < 0) {
@@ -493,31 +493,15 @@ int pythonmod_init(struct module_env* env, int id)
      flen = (size_t)ftell(script_py);
      fstr = malloc(flen+1);
      if(!fstr) {
-	      log_err("malloc failure to print parse error");
-
-/* close the file */
-#if PY_MAJOR_VERSION < 3
-	      Py_XDECREF(PyFileObject);
-#else
-	      fclose(script_py);
-#endif
-
-	      goto python_init_fail;
+		log_err("malloc failure to print parse error");
+		goto fail_close_file;
      }
      fseek(script_py, 0, SEEK_SET);
      if(fread(fstr, flen, 1, script_py) < 1) {
-	      log_err("file read failed to print parse error: %s: %s",
+		log_err("file read failed to print parse error: %s: %s",
 		pe->fname, strerror(errno));
-	      free(fstr);
-
-/* close the file */
-#if PY_MAJOR_VERSION < 3
-	      Py_XDECREF(PyFileObject);
-#else
-	      fclose(script_py);
-#endif
-
-	      goto python_init_fail;
+		free(fstr);
+		goto fail_close_file;
      }
      fstr[flen] = 0;
      /* we compile the string, but do not run it, to stop side-effects */
@@ -527,21 +511,13 @@ int pythonmod_init(struct module_env* env, int id)
 #endif

      log_py_err();
-
-/* close the file */
-#if PY_MAJOR_VERSION < 3
-      Py_XDECREF(PyFileObject);
-#else
-      fclose(script_py);
-#endif
-
 #if PY_MAJOR_VERSION <= 2 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION < 9)
      /* no cleanup needed for python before 3.9 */
 #else
      /* cleanup for python 3.9 and newer */
      free(fstr);
 #endif
-      goto python_init_fail;
+      goto fail_close_file;
   }

 /* close the file */
@@ -602,6 +578,13 @@ int pythonmod_init(struct module_env* env, int id)
   PyGILState_Release(gil);
   return 1;

+fail_close_file:
+#if PY_MAJOR_VERSION < 3
+   Py_XDECREF(PyFileObject);
+#else
+   fclose(script_py);
+#endif
+
 python_init_fail:
   Py_XDECREF(pe->module);
   Py_XDECREF(pe->dict);
@@ -1074,7 +1074,8 @@ generate_cname_request(struct module_qstate* qstate,
 	subqi.qtype = qstate->qinfo.qtype;
 	subqi.qclass = qstate->qinfo.qclass;
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
-	return (*qstate->env->attach_sub)(qstate, &subqi, BIT_RD, 0, 0, &subq);
+	return (*qstate->env->attach_sub)(qstate, &subqi,
+		qstate->client_info, BIT_RD, 0, 0, &subq);
 }

 void
@@ -1233,7 +1234,8 @@ respip_inform_super(struct module_qstate* qstate, int id,
 	struct respip_qstate* rq = (struct respip_qstate*)super->minfo[id];
 	struct reply_info* new_rep = NULL;

-	rq->state = RESPIP_SUBQUERY_FINISHED;
+	if(rq)
+		rq->state = RESPIP_SUBQUERY_FINISHED;

 	/* respip subquery should have always been created with a valid reply
 	 * in super. */
@@ -55,6 +55,7 @@
 #include "util/log.h"
 #include "util/module.h"
 #include "util/random.h"
+#include "util/tsig.h"
 #include "services/cache/dns.h"
 #include "services/outside_network.h"
 #include "services/listen_dnsport.h"
@@ -171,7 +172,7 @@ get_rrset_ttl(struct ub_packed_rrset_key* k)
 /** Copy rrset into region from domain-datanode and packet rrset */
 static struct ub_packed_rrset_key*
 auth_packed_rrset_copy_region(struct auth_zone* z, struct auth_data* node,
-	struct auth_rrset* rrset, struct regional* region, time_t adjust)
+	struct auth_rrset* rrset, struct regional* region)
 {
 	struct ub_packed_rrset_key key;
 	memset(&key, 0, sizeof(key));
@@ -182,7 +183,7 @@ auth_packed_rrset_copy_region(struct auth_zone* z, struct auth_data* node,
 	key.rk.type = htons(rrset->type);
 	key.rk.rrset_class = htons(z->dclass);
 	key.entry.hash = rrset_key_hash(&key.rk);
-	return packed_rrset_copy_region(&key, region, adjust);
+	return packed_rrset_copy_region(&key, region, 0);
 }

 /** fix up msg->rep TTL and prefetch ttl */
@@ -236,7 +237,7 @@ msg_add_rrset_an(struct auth_zone* z, struct regional* region,
 		return 0;
 	/* copy it */
 	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
-		auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
+		auth_packed_rrset_copy_region(z, node, rrset, region)))
 		return 0;
 	msg->rep->rrset_count++;
 	msg->rep->an_numrrsets++;
@@ -260,7 +261,7 @@ msg_add_rrset_ns(struct auth_zone* z, struct regional* region,
 		return 0;
 	/* copy it */
 	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
-		auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
+		auth_packed_rrset_copy_region(z, node, rrset, region)))
 		return 0;
 	msg->rep->rrset_count++;
 	msg->rep->ns_numrrsets++;
@@ -283,7 +284,7 @@ msg_add_rrset_ar(struct auth_zone* z, struct regional* region,
 		return 0;
 	/* copy it */
 	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
-		auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
+		auth_packed_rrset_copy_region(z, node, rrset, region)))
 		return 0;
 	msg->rep->rrset_count++;
 	msg->rep->ar_numrrsets++;
@@ -2091,7 +2092,8 @@ auth_zones_setup_zones(struct auth_zones* az)

 /** set config items and create zones */
 static int
-auth_zones_cfg(struct auth_zones* az, struct config_auth* c)
+auth_zones_cfg(struct auth_zones* az, struct config_auth* c,
+	struct tsig_key_table* tsig_key_table)
 {
 	struct auth_zone* z;
 	struct auth_xfer* x = NULL;
@@ -2110,7 +2112,7 @@ auth_zones_cfg(struct auth_zones* az, struct config_auth* c)
 		}
 		return 0;
 	}
-	if(c->masters || c->urls) {
+	if(c->masters || c->masters_tsig || c->urls) {
 		if(!(x=auth_zones_find_or_add_xfer(az, z))) {
 			lock_rw_unlock(&az->lock);
 			lock_rw_unlock(&z->lock);
@@ -2171,12 +2173,14 @@ auth_zones_cfg(struct auth_zones* az, struct config_auth* c)
 	if(x) {
 		z->zone_is_slave = 1;
 		/* set options on xfer zone */
-		if(!xfer_set_masters(&x->task_probe->masters, c, 0)) {
+		if(!xfer_set_masters(&x->task_probe->masters, c, 0,
+			tsig_key_table)) {
 			lock_basic_unlock(&x->lock);
 			lock_rw_unlock(&z->lock);
 			return 0;
 		}
-		if(!xfer_set_masters(&x->task_transfer->masters, c, 1)) {
+		if(!xfer_set_masters(&x->task_transfer->masters, c, 1,
+			tsig_key_table)) {
 			lock_basic_unlock(&x->lock);
 			lock_rw_unlock(&z->lock);
 			return 0;
@@ -2244,7 +2248,7 @@ az_delete_deleted_zones(struct auth_zones* az)

 int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
 	int setup, int* is_rpz, struct module_env* env,
-	struct module_stack* mods)
+	struct module_stack* mods, struct tsig_key_table* tsig_key_table)
 {
 	struct config_auth* p;
 	az_setall_deleted(az);
@@ -2254,7 +2258,7 @@ int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
 			continue;
 		}
 		*is_rpz = (*is_rpz || p->isrpz);
-		if(!auth_zones_cfg(az, p)) {
+		if(!auth_zones_cfg(az, p, tsig_key_table)) {
 			log_err("cannot config auth zone %s", p->name);
 			return 0;
 		}
@@ -2312,6 +2316,7 @@ auth_free_masters(struct auth_master* list)
 		auth_free_master_addrs(list->list);
 		free(list->host);
 		free(list->file);
+		free(list->tsig_key_name);
 		free(list);
 		list = n;
 	}
@@ -2331,12 +2336,14 @@ auth_xfer_delete(struct auth_xfer* xfr)
 		auth_free_masters(xfr->task_probe->masters);
 		comm_point_delete(xfr->task_probe->cp);
 		comm_timer_delete(xfr->task_probe->timer);
+		tsig_delete(xfr->task_probe->tsig);
 		free(xfr->task_probe);
 	}
 	if(xfr->task_transfer) {
 		auth_free_masters(xfr->task_transfer->masters);
 		comm_point_delete(xfr->task_transfer->cp);
 		comm_timer_delete(xfr->task_transfer->timer);
+		tsig_delete(xfr->task_transfer->tsig);
 		if(xfr->task_transfer->chunks_first) {
 			auth_chunks_delete(xfr->task_transfer);
 		}
@@ -3718,11 +3725,30 @@ addr_in_list(struct auth_addr* list, struct sockaddr_storage* addr,
 * addresses in the addr list) */
 static int
 addr_matches_master(struct auth_master* master, struct sockaddr_storage* addr,
-	socklen_t addrlen, struct auth_master** fromhost)
+	socklen_t addrlen, struct auth_master** fromhost,
+	struct tsig_data* tsig)
 {
 	struct sockaddr_storage a;
 	socklen_t alen = 0;
 	int net = 0;
+	if(master->tsig_key_name && master->tsig_key_name[0]) {
+		uint8_t keyname[LDNS_MAX_DOMAINLEN+1];
+		size_t keynamelen = sizeof(keyname);
+		if(!tsig) {
+			/* This needs a TSIG key, but no TSIG present. */
+			return 0;
+		}
+		if(sldns_str2wire_dname_buf(master->tsig_key_name, keyname,
+			&keynamelen) != 0) {
+			verbose(VERB_ALGO, "could not parse allow-notify-tsig '%s'",
+				master->tsig_key_name);
+			return 0;
+		}
+		if(query_dname_compare(keyname, tsig->key_name) != 0) {
+			/* The TSIG is a different key name, not matched. */
+			return 0;
+		}
+	}
 	if(addr_in_list(master->list, addr, addrlen)) {
 		*fromhost = master;
 		return 1;	
@@ -3755,11 +3781,12 @@ addr_matches_master(struct auth_master* master, struct sockaddr_storage* addr,
 /** check access list for notifies */
 static int
 az_xfr_allowed_notify(struct auth_xfer* xfr, struct sockaddr_storage* addr,
-	socklen_t addrlen, struct auth_master** fromhost)
+	socklen_t addrlen, struct auth_master** fromhost,
+	struct tsig_data* tsig)
 {
 	struct auth_master* p;
 	for(p=xfr->allow_notify_list; p; p=p->next) {
-		if(addr_matches_master(p, addr, addrlen, fromhost)) {
+		if(addr_matches_master(p, addr, addrlen, fromhost, tsig)) {
 			return 1;
 		}
 	}
@@ -3829,7 +3856,8 @@ xfr_process_notify(struct auth_xfer* xfr, struct module_env* env,
 int auth_zones_notify(struct auth_zones* az, struct module_env* env,
 	uint8_t* nm, size_t nmlen, uint16_t dclass,
 	struct sockaddr_storage* addr, socklen_t addrlen, int has_serial,
-	uint32_t serial, int* refused)
+	uint32_t serial, int* refused, struct sldns_buffer* pkt,
+	struct tsig_data** tsig, int* tsig_rcode, struct regional* scratchpad)
 {
 	struct auth_xfer* xfr;
 	struct auth_master* fromhost = NULL;
@@ -3844,9 +3872,20 @@ int auth_zones_notify(struct auth_zones* az, struct module_env* env,
 	}
 	lock_basic_lock(&xfr->lock);
 	lock_rw_unlock(&az->lock);
-	
+
+	/* check tsig */
+	if(tsig_in_packet(pkt)) {
+		*tsig_rcode = tsig_parse_verify_query(env->tsig_key_table,
+			pkt, tsig, scratchpad, (uint64_t)*env->now);
+		if(*tsig_rcode != 0) {
+			/* The tsig failed to verify. */
+			lock_basic_unlock(&xfr->lock);
+			return 0;
+		}
+	}
+
 	/* check access list for notifies */
-	if(!az_xfr_allowed_notify(xfr, addr, addrlen, &fromhost)) {
+	if(!az_xfr_allowed_notify(xfr, addr, addrlen, &fromhost, *tsig)) {
 		lock_basic_unlock(&xfr->lock);
 		/* notify not allowed, refuse the notify */
 		*refused = 1;
@@ -3978,9 +4017,20 @@ auth_master_copy(struct auth_master* o)
 			return NULL;
 		}
 	}
+	if(m->tsig_key_name) {
+		m->tsig_key_name = strdup(m->tsig_key_name);
+		if(!m->tsig_key_name) {
+			free(m->file);
+			free(m->host);
+			free(m);
+			log_err("malloc failure");
+			return NULL;
+		}
+	}
 	if(m->list) {
 		m->list = auth_addr_list_copy(m->list);
 		if(!m->list) {
+			free(m->tsig_key_name);
 			free(m->file);
 			free(m->host);
 			free(m);
@@ -4240,6 +4290,37 @@ xfr_create_soa_probe_packet(struct auth_xfer* xfr, sldns_buffer* buf,
 	sldns_buffer_write_u16_at(buf, 0, id);
 }

+/** sign a query for xfr. */
+static int
+xfr_sign_query(struct tsig_data** tsig, sldns_buffer* pkt,
+	struct module_env* env, char* tsig_key_name)
+{
+	size_t pos;
+	if(*tsig) {
+		tsig_delete(*tsig);
+		*tsig = NULL;
+	}
+	*tsig = tsig_create_fromstr(env->tsig_key_table, tsig_key_name);
+	if(!*tsig) {
+		log_err("tsig key '%s' not found or out of memory",
+			tsig_key_name);
+		return 0;
+	}
+
+	/* Position the buffer after the packet contents. */
+	pos = sldns_buffer_limit(pkt);
+	sldns_buffer_clear(pkt);
+	sldns_buffer_set_position(pkt, pos);
+	if(!tsig_sign_query(*tsig, pkt, env->tsig_key_table,
+		(uint64_t)*env->now)) {
+		sldns_buffer_flip(pkt);
+		log_err("tsig key '%s': could not sign query", tsig_key_name);
+		return 0;
+	}
+	sldns_buffer_flip(pkt);
+	return 1;
+}
+
 /** create IXFR/AXFR packet for xfr */
 static void
 xfr_create_ixfr_packet(struct auth_xfer* xfr, sldns_buffer* buf, uint16_t id,
@@ -4298,7 +4379,7 @@ xfr_create_ixfr_packet(struct auth_xfer* xfr, sldns_buffer* buf, uint16_t id,
 /** check if returned packet is OK */
 static int
 check_packet_ok(sldns_buffer* pkt, uint16_t qtype, struct auth_xfer* xfr,
-	uint32_t* serial)
+	uint32_t* serial, struct module_env* env)
 {
 	/* parse to see if packet worked, valid reply */

@@ -4372,6 +4453,20 @@ check_packet_ok(sldns_buffer* pkt, uint16_t qtype, struct auth_xfer* xfr,
 			return 0;
 		*serial = sldns_buffer_read_u32(pkt);
 	}
+
+	if(xfr->task_probe->tsig) {
+		/* There could be authority or additional RRs in the reply for the
+		 * SOA query, if so skip them by tsig_find_rr. */
+		if(!tsig_find_rr(pkt)) {
+			verbose(VERB_ALGO, "TSIG expected, but not found in reply");
+			return 0;
+		}
+		if(!tsig_parse_verify_reply(xfr->task_probe->tsig, pkt,
+			env->tsig_key_table, (uint64_t)*env->now)) {
+			verbose(VERB_ALGO, "valid TSIG expected in SOA probe reply, but it was not valid");
+			return 0;
+		}
+	}
 	return 1;
 }

@@ -4556,6 +4651,23 @@ http_parse_ttl(sldns_buffer* buf, struct sldns_file_parse_state* pstate)
 	return 0;
 }

+/** remove newlines from collated line */
+static void
+chunkline_newline_removal(sldns_buffer* buf)
+{
+	size_t i, end=sldns_buffer_limit(buf);
+	for(i=0; i<end; i++) {
+		char c = (char)sldns_buffer_read_u8_at(buf, i);
+		if(c == '\n' && i==end-1) {
+			sldns_buffer_write_u8_at(buf, i, 0);
+			sldns_buffer_set_limit(buf, end-1);
+			return;
+		}
+		if(c == '\n')
+			sldns_buffer_write_u8_at(buf, i, (uint8_t)' ');
+	}
+}
+
 /** find noncomment RR line in chunks, collates lines if ( ) format */
 static int
 chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos,
@@ -4563,6 +4675,7 @@ chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos,
 {
 	int ret;
 	while(chunkline_get_line_collated(chunk, chunk_pos, buf)) {
+		chunkline_newline_removal(buf);
 		if(chunkline_is_comment_line_or_empty(buf)) {
 			/* a comment, go to next line */
 			continue;
@@ -4638,23 +4751,6 @@ chunklist_sum(struct auth_chunk* list)
 	return s;
 }

-/** remove newlines from collated line */
-static void
-chunkline_newline_removal(sldns_buffer* buf)
-{
-	size_t i, end=sldns_buffer_limit(buf);
-	for(i=0; i<end; i++) {
-		char c = (char)sldns_buffer_read_u8_at(buf, i);
-		if(c == '\n' && i==end-1) {
-			sldns_buffer_write_u8_at(buf, i, 0);
-			sldns_buffer_set_limit(buf, end-1);
-			return;
-		}
-		if(c == '\n')
-			sldns_buffer_write_u8_at(buf, i, (uint8_t)' ');
-	}
-}
-
 /** for http download, parse and add RR to zone */
 static int
 http_parse_add_rr(struct auth_xfer* xfr, struct auth_zone* z,
@@ -5378,10 +5474,18 @@ xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
 	lock_rw_unlock(&z->lock);

 	if(verbosity >= VERB_QUERY && xfr->have_zone) {
-		char zname[LDNS_MAX_DOMAINLEN];
+		char zname[LDNS_MAX_DOMAINLEN], tsigtxt[16],
+			tsigkey[LDNS_MAX_DOMAINLEN];
+		tsigkey[0]=0;
+		tsigtxt[0]=0;
+		if(xfr->task_transfer->tsig &&
+			xfr->task_transfer->tsig->key_name) {
+			snprintf(tsigtxt, sizeof(tsigtxt), " with TSIG ");
+			dname_str(xfr->task_transfer->tsig->key_name, tsigkey);
+		}
 		dname_str(xfr->name, zname);
-		verbose(VERB_QUERY, "auth zone %s updated to serial %u", zname,
-			(unsigned)xfr->serial);
+		verbose(VERB_QUERY, "auth zone %s updated%s%s to serial %u",
+			zname, tsigtxt, tsigkey, (unsigned)xfr->serial);
 	}
 	/* see if we need to write to a zonefile */
 	xfr_write_after_update(xfr, env);
@@ -5398,6 +5502,9 @@ xfr_transfer_disown(struct auth_xfer* xfr)
 	/* remove the commpoint */
 	comm_point_delete(xfr->task_transfer->cp);
 	xfr->task_transfer->cp = NULL;
+	/* remove the tsig data */
+	tsig_delete(xfr->task_transfer->tsig);
+	xfr->task_transfer->tsig = NULL;
 	/* we don't own this item anymore */
 	xfr->task_transfer->worker = NULL;
 	xfr->task_transfer->env = NULL;
@@ -5486,6 +5593,10 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 	int timeout;
 	if(!master) return 0;
 	if(master->allow_notify) return 0; /* only for notify */
+	if(xfr->task_transfer->tsig) {
+		tsig_delete(xfr->task_transfer->tsig);
+		xfr->task_transfer->tsig = NULL;
+	}

 	/* get master addr */
 	if(xfr->task_transfer->scan_addr) {
@@ -5560,6 +5671,17 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 	xfr->task_transfer->id = GET_RANDOM_ID(env->rnd);
 	xfr_create_ixfr_packet(xfr, env->scratch_buffer,
 		xfr->task_transfer->id, master);
+	if(master->tsig_key_name) {
+		if(!xfr_sign_query(&xfr->task_transfer->tsig,
+			env->scratch_buffer, env, master->tsig_key_name)) {
+			char zname[LDNS_MAX_DOMAINLEN], as[256];
+			dname_str(xfr->name, zname);
+			addr_port_to_str(&addr, addrlen, as, sizeof(as));
+			verbose(VERB_ALGO, "failed to TSIG sign xfr "
+				"for %s to %s", zname, as);
+			return 0;
+		}
+	}

 	/* connect on fd */
 	xfr->task_transfer->cp = outnet_comm_point_for_tcp(env->outnet,
@@ -5576,11 +5698,20 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 	}
 	comm_timer_set(xfr->task_transfer->timer, &t);
 	if(verbosity >= VERB_ALGO) {
-		char zname[LDNS_MAX_DOMAINLEN], as[256];
+		char zname[LDNS_MAX_DOMAINLEN], as[256], tsigtxt[16],
+			tsigkey[LDNS_MAX_DOMAINLEN];
+		tsigkey[0]=0;
+		tsigtxt[0]=0;
+		if(xfr->task_transfer->tsig &&
+			xfr->task_transfer->tsig->key_name) {
+			snprintf(tsigtxt, sizeof(tsigtxt), " with TSIG ");
+			dname_str(xfr->task_transfer->tsig->key_name, tsigkey);
+		}
 		dname_str(xfr->name, zname);
 		addr_port_to_str(&addr, addrlen, as, sizeof(as));
-		verbose(VERB_ALGO, "auth zone %s transfer next %s fetch from %s started", zname, 
-			(xfr->task_transfer->on_ixfr?"IXFR":"AXFR"), as);
+		verbose(VERB_ALGO, "auth zone %s transfer next %s fetch%s%s from %s started",
+			zname, (xfr->task_transfer->on_ixfr?"IXFR":"AXFR"),
+			tsigtxt, tsigkey, as);
 	}
 	return 1;
 }
@@ -5765,9 +5896,10 @@ void auth_xfer_transfer_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
 */
 static int
 check_xfer_packet(sldns_buffer* pkt, struct auth_xfer* xfr,
-	int* gonextonfail, int* transferdone)
+	struct module_env* env, int* gonextonfail, int* transferdone)
 {
 	uint8_t* wire = sldns_buffer_begin(pkt);
+	size_t initial_rr_scan_num = xfr->task_transfer->rr_scan_num;
 	int i;
 	if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) {
 		verbose(VERB_ALGO, "xfr to %s failed, packet too small",
@@ -6051,6 +6183,28 @@ check_xfer_packet(sldns_buffer* pkt, struct auth_xfer* xfr,
 		sldns_buffer_skip(pkt, (ssize_t)rdlen);
 	}

+	/* check tsig */
+	if(xfr->task_transfer->tsig) {
+		sldns_buffer_rewind(pkt);
+		if(!tsig_find_rr(pkt)) {
+			/* Check TSIG reply on first packet. */
+			if(initial_rr_scan_num == 0) {
+				verbose(VERB_ALGO, "TSIG expected, but not found in reply for xfr to %s",
+					xfr->task_transfer->master->host);
+				return 0;
+			}
+			/* No TSIG could be for sign every NTH packet. */
+			sldns_buffer_set_position(pkt, sldns_buffer_limit(pkt));
+		}
+		if(!tsig_parse_verify_reply_xfr(xfr->task_transfer->tsig,
+			pkt, env->tsig_key_table, (uint64_t)*env->now,
+			*transferdone)) {
+			verbose(VERB_ALGO, "valid TSIG expected in xfr reply to %s, but it was not valid",
+				xfr->task_transfer->master->host);
+			return 0;
+		}
+	}
+
 	return 1;
 }

@@ -6227,7 +6381,8 @@ auth_xfer_transfer_tcp_callback(struct comm_point* c, void* arg, int err,
 	/* handle returned packet */
 	/* if it fails, cleanup and end this transfer */
 	/* if it needs to fallback from IXFR to AXFR, do that */
-	if(!check_xfer_packet(c->buffer, xfr, &gonextonfail, &transferdone)) {
+	if(!check_xfer_packet(c->buffer, xfr, env, &gonextonfail,
+		&transferdone)) {
 		goto failed;
 	}
 	/* if it is good, link it into the list of data */
@@ -6353,6 +6508,9 @@ xfr_probe_disown(struct auth_xfer* xfr)
 	/* remove the commpoint */
 	comm_point_delete(xfr->task_probe->cp);
 	xfr->task_probe->cp = NULL;
+	/* remove the tsig data */
+	tsig_delete(xfr->task_probe->tsig);
+	xfr->task_probe->tsig = NULL;
 	/* we don't own this item anymore */
 	xfr->task_probe->worker = NULL;
 	xfr->task_probe->env = NULL;
@@ -6373,6 +6531,10 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 	if(master->allow_notify) return 0; /* only for notify */
 	if(master->http) return 0; /* only masters get SOA UDP probe,
 		not urls, if those are in this list */
+	if(xfr->task_probe->tsig) {
+		tsig_delete(xfr->task_probe->tsig);
+		xfr->task_probe->tsig = NULL;
+	}

 	/* get master addr */
 	if(xfr->task_probe->scan_addr) {
@@ -6410,6 +6572,17 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 		xfr->task_probe->id = GET_RANDOM_ID(env->rnd);
 	xfr_create_soa_probe_packet(xfr, env->scratch_buffer, 
 		xfr->task_probe->id);
+	if(master->tsig_key_name) {
+		if(!xfr_sign_query(&xfr->task_probe->tsig, env->scratch_buffer,
+			env, master->tsig_key_name)) {
+			char zname[LDNS_MAX_DOMAINLEN], as[256];
+			dname_str(xfr->name, zname);
+			addr_port_to_str(&addr, addrlen, as, sizeof(as));
+			verbose(VERB_ALGO, "failed to TSIG sign soa probe "
+				"for %s to %s", zname, as);
+			return 0;
+		}
+	}
 	/* we need to remove the cp if we have a different ip4/ip6 type now */
 	if(xfr->task_probe->cp &&
 		((xfr->task_probe->cp_is_ip6 && !addr_is_ip6(&addr, addrlen)) ||
@@ -6453,11 +6626,19 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 		return 0;
 	}
 	if(verbosity >= VERB_ALGO) {
-		char zname[LDNS_MAX_DOMAINLEN], as[256];
+		char zname[LDNS_MAX_DOMAINLEN], as[256], tsigtxt[16],
+			tsigkey[LDNS_MAX_DOMAINLEN];
+		tsigkey[0]=0;
+		tsigtxt[0]=0;
+		if(xfr->task_probe->tsig &&
+			xfr->task_probe->tsig->key_name) {
+			snprintf(tsigtxt, sizeof(tsigtxt), " with TSIG ");
+			dname_str(xfr->task_probe->tsig->key_name, tsigkey);
+		}
 		dname_str(xfr->name, zname);
 		addr_port_to_str(&addr, addrlen, as, sizeof(as));
-		verbose(VERB_ALGO, "auth zone %s soa probe sent to %s", zname,
-			as);
+		verbose(VERB_ALGO, "auth zone %s soa probe%s%s sent to %s",
+			zname, tsigtxt, tsigkey, as);
 	}
 	xfr->task_probe->timeout = timeout;
 #ifndef S_SPLINT_S
@@ -6529,13 +6710,24 @@ auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err,
 	if(err == NETEVENT_NOERROR) {
 		uint32_t serial = 0;
 		if(check_packet_ok(c->buffer, LDNS_RR_TYPE_SOA, xfr,
-			&serial)) {
+			&serial, env)) {
 			/* successful lookup */
 			if(verbosity >= VERB_ALGO) {
-				char buf[LDNS_MAX_DOMAINLEN];
+				char buf[LDNS_MAX_DOMAINLEN], tsigtxt[16],
+					tsigkey[LDNS_MAX_DOMAINLEN];
+				tsigkey[0]=0;
+				tsigtxt[0]=0;
+				if(xfr->task_probe->tsig &&
+					xfr->task_probe->tsig->key_name) {
+					snprintf(tsigtxt, sizeof(tsigtxt),
+						" with TSIG ");
+					dname_str(xfr->task_probe->tsig->
+						key_name, tsigkey);
+				}
 				dname_str(xfr->name, buf);
-				verbose(VERB_ALGO, "auth zone %s: soa probe "
-					"serial is %u", buf, (unsigned)serial);
+				verbose(VERB_ALGO, "auth zone %s: soa probe"
+					"%s%s serial is %u", buf, tsigtxt,
+					tsigkey, (unsigned)serial);
 			}
 			/* see if this serial indicates that the zone has
 			 * to be updated */
@@ -6588,6 +6780,9 @@ auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err,
 	/* delete commpoint so a new one is created, with a fresh port nr */
 	comm_point_delete(xfr->task_probe->cp);
 	xfr->task_probe->cp = NULL;
+	/* remove the tsig data */
+	tsig_delete(xfr->task_probe->tsig);
+	xfr->task_probe->tsig = NULL;

 	/* if the result was not a successful probe, we need
 	 * to send the next one */
@@ -7293,12 +7488,34 @@ parse_url(char* url, char** host, char** file, int* port, int* ssl)
 	return 1;
 }

+/** Check the tsig key exists */
+static int
+check_tsig_key_exists(struct tsig_key_table* tsig_key_table,
+	const char* optname, char* str, char* str2)
+{
+	struct tsig_key* key;
+	if(!tsig_key_table)
+		return 1;
+
+	lock_rw_rdlock(&tsig_key_table->lock);
+	key = tsig_key_table_search_fromstr(tsig_key_table, str2);
+	lock_rw_unlock(&tsig_key_table->lock);
+
+	if(!key) {
+		log_err("could not find tsig-key for %s: %s %s",
+			optname, str, str2);
+		return 0;
+	}
+	return 1;
+}
+
 int
 xfer_set_masters(struct auth_master** list, struct config_auth* c,
-	int with_http)
+	int with_http, struct tsig_key_table* tsig_key_table)
 {
 	struct auth_master* m;
 	struct config_strlist* p;
+	struct config_str2list* p2;
 	/* list points to the first, or next pointer for the new element */
 	while(*list) {
 		list = &( (*list)->next );
@@ -7321,6 +7538,24 @@ xfer_set_masters(struct auth_master** list, struct config_auth* c,
 			return 0;
 		}
 	}
+	for(p2 = c->masters_tsig; p2; p2 = p2->next) {
+		m = auth_master_new(&list);
+		if(!m) return 0;
+		m->ixfr = 1; /* this flag is not configurable */
+		m->host = strdup(p2->str);
+		if(!m->host) {
+			log_err("malloc failure");
+			return 0;
+		}
+		if(!check_tsig_key_exists(tsig_key_table, "primary-tsig",
+			p2->str, p2->str2))
+			return 0;
+		m->tsig_key_name = strdup(p2->str2);
+		if(!m->tsig_key_name) {
+			log_err("malloc failure");
+			return 0;
+		}
+	}
 	for(p = c->allow_notify; p; p = p->next) {
 		m = auth_master_new(&list);
 		if(!m) return 0;
@@ -7331,6 +7566,24 @@ xfer_set_masters(struct auth_master** list, struct config_auth* c,
 			return 0;
 		}
 	}
+	for(p2 = c->allow_notify_tsig; p2; p2 = p2->next) {
+		m = auth_master_new(&list);
+		if(!m) return 0;
+		m->allow_notify = 1;
+		m->host = strdup(p2->str);
+		if(!m->host) {
+			log_err("malloc failure");
+			return 0;
+		}
+		if(!check_tsig_key_exists(tsig_key_table, "allow-notify-tsig",
+			p2->str, p2->str2))
+			return 0;
+		m->tsig_key_name = strdup(p2->str2);
+		if(!m->tsig_key_name) {
+			log_err("malloc failure");
+			return 0;
+		}
+	}
 	return 1;
 }

@@ -8666,6 +8919,8 @@ auth_primaries_get_mem(struct auth_master* list)
 			m += strlen(n->host)+1;
 		if(n->file)
 			m += strlen(n->file)+1;
+		if(n->tsig_key_name)
+			m += strlen(n->tsig_key_name)+1;
 	}
 	return m;
 }
@@ -8695,12 +8950,14 @@ auth_xfer_get_mem(struct auth_xfer* xfr)
 	m += auth_primaries_get_mem(xfr->task_probe->masters);
 	m += comm_point_get_mem(xfr->task_probe->cp);
 	m += comm_timer_get_mem(xfr->task_probe->timer);
+	m += tsig_get_mem(xfr->task_probe->tsig);

 	/* auth_transfer */
 	m += auth_chunks_get_mem(xfr->task_transfer->chunks_first);
 	m += auth_primaries_get_mem(xfr->task_transfer->masters);
 	m += comm_point_get_mem(xfr->task_transfer->cp);
 	m += comm_timer_get_mem(xfr->task_transfer->timer);
+	m += tsig_get_mem(xfr->task_transfer->tsig);

 	/* allow_notify_list */
 	m += auth_primaries_get_mem(xfr->allow_notify_list);
@@ -55,6 +55,8 @@ struct query_info;
 struct dns_msg;
 struct edns_data;
 struct module_env;
+struct tsig_data;
+struct tsig_key_table;
 struct worker;
 struct comm_point;
 struct comm_timer;
@@ -361,6 +363,8 @@ struct auth_probe {
 	struct comm_timer* timer;
 	/** timeout in msec */
 	int timeout;
+	/** the tsig data for the packet */
+	struct tsig_data* tsig;
 };

 /**
@@ -430,6 +434,8 @@ struct auth_transfer {
 	/** timeout for the transfer.
 	 * on the workers event base. */
 	struct comm_timer* timer;
+	/** the tsig data for the transfer */
+	struct tsig_data* tsig;
 };

 /** list of addresses */
@@ -461,6 +467,8 @@ struct auth_master {
 	int ssl;
 	/** the port number (for urls) */
 	int port;
+	/** the tsig key name (if any, or NULL) */
+	char* tsig_key_name;
 	/** if the host is a hostname, the list of resolved addrs, if any*/
 	struct auth_addr* list;
 };
@@ -490,11 +498,13 @@ struct auth_zones* auth_zones_create(void);
 * @param is_rpz: set to 1 if at least one RPZ zone is configured.
 * @param env: environment for offline verification.
 * @param mods: modules in environment.
+ * @param tsig_key_table: tsig key table to check if tsig keys exist.
+ *	If NULL, no check is performed.
 * @return false on failure.
 */
 int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
 	int setup, int* is_rpz, struct module_env* env,
-	struct module_stack* mods);
+	struct module_stack* mods, struct tsig_key_table* tsig_key_table);

 /** initial pick up of worker timeouts, ties events to worker event loop
 * @param az: auth zones structure
@@ -619,13 +629,19 @@ int auth_zones_can_fallback(struct auth_zones* az, uint8_t* nm, size_t nmlen,
 * @param has_serial: if true, the notify has a serial attached.
 * @param serial: the serial number, if has_serial is true.
 * @param refused: is set to true on failure to note refused access.
+ * @param pkt: the packet for TSIG verify.
+ * @param tsig: if TSIG, the structure is returned here, allocated in
+ *	the worker scratch region.
+ * @param tsig_rcode: if not NOERROR it is the TSIG error code, TSIG failed.
+ * @param scratchpad: region to allocate tsig in.
 * @return fail on failures (refused is false) and when access is
 * 	denied (refused is true).  True when processed.
 */
 int auth_zones_notify(struct auth_zones* az, struct module_env* env,
 	uint8_t* nm, size_t nmlen, uint16_t dclass,
 	struct sockaddr_storage* addr, socklen_t addrlen, int has_serial,
-	uint32_t serial, int* refused);
+	uint32_t serial, int* refused, struct sldns_buffer* pkt,
+	struct tsig_data** tsig, int* tsig_rcode, struct regional* scratchpad);

 /** process notify packet and read serial number from SOA.
 * returns 0 if no soa record in the notify */
@@ -671,10 +687,12 @@ struct auth_xfer* auth_xfer_create(struct auth_zones* az, struct auth_zone* z);
 * @param list: pointer to start of list.  The malloced list is returned here.
 * @param c: the config items to copy over.
 * @param with_http: if true, http urls are also included, before the masters.
+ * @param tsig_key_table: if nonNULL, used to check that tsig keys exist in
+ *	the key table.
 * @return false on failure.
 */
 int xfer_set_masters(struct auth_master** list, struct config_auth* c,
-	int with_http);
+	int with_http, struct tsig_key_table* tsig_key_table);

 /** xfer nextprobe timeout callback, this is part of task_nextprobe */
 void auth_xfer_timer(void* arg);
@@ -60,10 +60,10 @@
 * @param rep: contains list of rrsets to store.
 * @param now: current time.
 * @param leeway: during prefetch how much leeway to update TTLs.
- * 	This makes rrsets (other than type NS) timeout sooner so they get
- * 	updated with a new full TTL.
- * 	Type NS does not get this, because it must not be refreshed from the
- * 	child domain, but keep counting down properly.
+ * 	This makes rrsets expire sooner so they get updated with a new full
+ * 	TTL.
+ * 	Child side type NS does get this but TTL checks are done using the time
+ * 	the query was created rather than the time the answer was received.
 * @param pside: if from parentside discovered NS, so that its NS is okay
 * 	in a prefetch situation to be updated (without becoming sticky).
 * @param qrep: update rrsets here if cache is better
@@ -100,11 +100,20 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 					rep->ref[i].id != rep->ref[i].key->id)
 					ck = NULL;
 				else 	ck = packed_rrset_copy_region(
-					rep->ref[i].key, region, now);
+					rep->ref[i].key, region,
+					((ntohs(rep->ref[i].key->rk.type)==
+					LDNS_RR_TYPE_NS && !pside)?qstarttime:now));
 				lock_rw_unlock(&rep->ref[i].key->entry.lock);
 				if(ck) {
 					/* use cached copy if memory allows */
 					qrep->rrsets[i] = ck;
+					ttl = ((struct packed_rrset_data*)
+					    ck->entry.data)->ttl;
+					if(ttl < qrep->ttl) {
+						qrep->ttl = ttl;
+						qrep->prefetch_ttl = PREFETCH_TTL_CALC(qrep->ttl);
+						qrep->serve_expired_ttl = qrep->ttl + SERVE_EXPIRED_TTL;
+					}
 				}
 			}
 			/* no break: also copy key item */
@@ -169,10 +178,12 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,

 	/* there was a reply_info_sortref(rep) here but it seems to be
 	 * unnecessary, because the cache gets locked per rrset. */
-	reply_info_set_ttls(rep, *env->now);
+	if((flags & DNSCACHE_STORE_EXPIRED_MSG_CACHEDB)) {
+		reply_info_absolute_ttls(rep, *env->now, *env->now - ttl);
+	} else	reply_info_set_ttls(rep, *env->now);
 	store_rrsets(env, rep, *env->now, leeway, pside, qrep, region,
 		qstarttime);
-	if(ttl == 0 && !(flags & DNSCACHE_STORE_ZEROTTL)) {
+	if(ttl == 0) {
 		/* we do not store the message, but we did store the RRs,
 		 * which could be useful for delegation information */
 		verbose(VERB_ALGO, "TTL 0: dropped msg from cache");
@@ -272,8 +283,10 @@ addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
 {
 	if((msg->rep->rrsets[msg->rep->rrset_count] = 
 		packed_rrset_copy_region(rrset, region, now))) {
+		struct packed_rrset_data* d = rrset->entry.data;
 		msg->rep->ar_numrrsets++;
 		msg->rep->rrset_count++;
+		UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 	}
 }

@@ -456,8 +469,10 @@ find_add_ds(struct module_env* env, struct regional* region,
 		/* add it to auth section. This is the second rrset. */
 		if((msg->rep->rrsets[msg->rep->rrset_count] = 
 			packed_rrset_copy_region(rrset, region, now))) {
+			struct packed_rrset_data* d = rrset->entry.data;
 			msg->rep->ns_numrrsets++;
 			msg->rep->rrset_count++;
+			UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 		}
 		lock_rw_unlock(&rrset->entry.lock);
 	}
@@ -487,6 +502,8 @@ dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		return NULL; /* integer overflow protection */
 	msg->rep->flags = BIT_QR; /* with QR, no AA */
 	msg->rep->qdcount = 1;
+	msg->rep->ttl = MAX_TTL; /* will be updated (brought down) while we add
+				  * rrsets to the message */
 	msg->rep->reason_bogus = LDNS_EDE_NONE;
 	msg->rep->rrsets = (struct ub_packed_rrset_key**)
 		regional_alloc(region, 
@@ -497,24 +514,28 @@ dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 }

 int
-dns_msg_authadd(struct dns_msg* msg, struct regional* region, 
+dns_msg_authadd(struct dns_msg* msg, struct regional* region,
 	struct ub_packed_rrset_key* rrset, time_t now)
 {
-	if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 
+	struct packed_rrset_data* d = rrset->entry.data;
+	if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 		packed_rrset_copy_region(rrset, region, now)))
 		return 0;
 	msg->rep->ns_numrrsets++;
+	UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 	return 1;
 }

 int
-dns_msg_ansadd(struct dns_msg* msg, struct regional* region, 
+dns_msg_ansadd(struct dns_msg* msg, struct regional* region,
 	struct ub_packed_rrset_key* rrset, time_t now)
 {
-	if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 
+	struct packed_rrset_data* d = rrset->entry.data;
+	if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
 		packed_rrset_copy_region(rrset, region, now)))
 		return 0;
 	msg->rep->an_numrrsets++;
+	UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 	return 1;
 }

@@ -585,6 +606,7 @@ gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
 		sizeof(struct reply_info) - sizeof(struct rrset_ref));
 	if(!msg->rep)
 		return NULL;
+	msg->rep->ttl = MAX_TTL;
 	msg->rep->reason_bogus = LDNS_EDE_NONE;
 	msg->rep->reason_bogus_str = NULL;
 	if(num > RR_COUNT_MAX)
@@ -606,13 +628,13 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 	size_t i;
 	int is_expired = 0;
 	time_t now_control = now;
-	if(now > r->ttl) {
+	if(TTL_IS_EXPIRED(r->ttl, now)) {
 		/* Check if we are allowed to serve expired */
 		if(!allow_expired || !reply_info_can_answer_expired(r, now))
 			return NULL;
-		/* Change the current time so we can pass the below TTL checks when
-		 * serving expired data. */
-		now_control = r->ttl - env->cfg->serve_expired_reply_ttl;
+		/* Change the current time so we can pass the below TTL checks
+		 * when serving expired data. */
+		now_control = 0;
 		is_expired = 1;
 	}

@@ -620,15 +642,6 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 	if(!msg) return NULL;
 	msg->rep->flags = r->flags;
 	msg->rep->qdcount = r->qdcount;
-	msg->rep->ttl = is_expired
-		?SERVE_EXPIRED_REPLY_TTL
-		:r->ttl - now;
-	if(r->prefetch_ttl > now)
-		msg->rep->prefetch_ttl = r->prefetch_ttl - now;
-	else
-		msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
-	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
-	msg->rep->serve_expired_norec_ttl = 0;
 	msg->rep->security = r->security;
 	msg->rep->an_numrrsets = r->an_numrrsets;
 	msg->rep->ns_numrrsets = r->ns_numrrsets;
@@ -656,13 +669,30 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 		return NULL;
 	}
 	for(i=0; i<msg->rep->rrset_count; i++) {
+		struct packed_rrset_data* d;
 		msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i],
 			region, now);
 		if(!msg->rep->rrsets[i]) {
 			rrset_array_unlock(r->ref, r->rrset_count);
 			return NULL;
 		}
+		d = msg->rep->rrsets[i]->entry.data;
+		UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
 	}
+	if(msg->rep->rrset_count < 1) {
+		msg->rep->ttl = is_expired
+			?SERVE_EXPIRED_REPLY_TTL
+			:r->ttl - now;
+		if(r->prefetch_ttl > now)
+			msg->rep->prefetch_ttl = r->prefetch_ttl - now;
+		else
+			msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
+	} else {
+		/* msg->rep->ttl has been updated through the RRSets above */
+		msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
+	}
+	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
+	msg->rep->serve_expired_norec_ttl = 0;
 	if(env)
 		rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref, 
 		r->rrset_count);
@@ -701,7 +731,7 @@ rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	struct dns_msg* msg;
 	struct packed_rrset_data* d = (struct packed_rrset_data*)
 		rrset->entry.data;
-	if(now > d->ttl)
+	if(TTL_IS_EXPIRED(d->ttl, now))
 		return NULL;
 	msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */
 	if(!msg)
@@ -736,7 +766,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 		rrset->entry.data;
 	uint8_t* newname, *dtarg = NULL;
 	size_t newlen, dtarglen;
-	if(now > d->ttl)
+	if(TTL_IS_EXPIRED(d->ttl, now))
 		return NULL;
 	/* only allow validated (with DNSSEC) DNAMEs used from cache 
 	 * for insecure DNAMEs, query again. */
@@ -844,6 +874,8 @@ fill_any(struct module_env* env,
 		/* set NOTIMPL for RFC 8482 */
 		msg->rep->flags |= LDNS_RCODE_NOTIMPL;
 		msg->rep->security = sec_status_indeterminate;
+		msg->rep->ttl = 1; /* empty NOTIMPL response will never be
+				    * updated with rrsets, set TTL to 1 */
 		return msg;
 	}

@@ -1069,7 +1101,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 			msgqinf->qclass, flags, 0, 1);
 		if(e) {
 			struct reply_info* cached = e->entry.data;
-			if(cached->ttl < *env->now
+			if(TTL_IS_EXPIRED(cached->ttl, *env->now)
 				&& reply_info_could_use_expired(cached, *env->now)
 				/* If we are validating make sure only
 				 * validating modules can update such messages.
@@ -53,7 +53,7 @@ struct delegpt;
 *  Must be an unsigned 32-bit value larger than 0xffff */

 /** Allow caching a DNS message with a zero TTL. */
-#define DNSCACHE_STORE_ZEROTTL 0x100000
+#define DNSCACHE_STORE_EXPIRED_MSG_CACHEDB 0x100000

 /**
 * Region allocated message reply
@@ -1269,7 +1269,8 @@ int infra_wait_limit_allowed(struct infra_cache* infra, struct comm_reply* rep,
 	int cookie_valid, struct config_file* cfg)
 {
 	struct lruhash_entry* entry;
-	if(cfg->wait_limit == 0)
+	if(cfg->wait_limit == 0 ||
+		(cookie_valid && cfg->wait_limit_cookie == 0))
 		return 1;

 	entry = infra_find_ip_ratedata(infra, &rep->client_addr,
@@ -131,7 +131,7 @@ need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
 	struct packed_rrset_data* newd = (struct packed_rrset_data*)nd;
 	struct packed_rrset_data* cached = (struct packed_rrset_data*)cd;
 	/*	o if new data is expired, cached data is better */
-	if( newd->ttl < timenow && timenow <= cached->ttl)
+	if( TTL_IS_EXPIRED(newd->ttl, timenow) && !TTL_IS_EXPIRED(cached->ttl, timenow))
 		return 0;
 	/* 	o store if rrset has been validated 
 	 *  		everything better than bogus data 
@@ -146,13 +146,13 @@ need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
        if( newd->trust > cached->trust ) {
 		/* if the cached rrset is bogus, and new is equal,
 		 * do not update the TTL - let it expire. */
-		if(equal && cached->ttl >= timenow && 
+		if(equal && !TTL_IS_EXPIRED(cached->ttl, timenow) &&
 			cached->security == sec_status_bogus)
 			return 0;
                return 1;
 	}
 	/*	o item in cache has expired */
-	if( cached->ttl < timenow )
+	if( TTL_IS_EXPIRED(cached->ttl, timenow) )
 		return 1;
 	/*  o same trust, but different in data - insert it */
 	if( newd->trust == cached->trust && !equal ) {
@@ -300,7 +300,7 @@ rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen,
 		/* check TTL */
 		struct packed_rrset_data* data = 
 			(struct packed_rrset_data*)e->data;
-		if(timenow > data->ttl) {
+		if(TTL_IS_EXPIRED(data->ttl, timenow)) {
 			lock_rw_unlock(&e->lock);
 			return NULL;
 		}
@@ -310,17 +310,18 @@ rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen,
 	return NULL;
 }

-int 
+int
 rrset_array_lock(struct rrset_ref* ref, size_t count, time_t timenow)
 {
 	size_t i;
+	struct packed_rrset_data* d;
 	for(i=0; i<count; i++) {
 		if(i>0 && ref[i].key == ref[i-1].key)
 			continue; /* only lock items once */
 		lock_rw_rdlock(&ref[i].key->entry.lock);
-		if(ref[i].id != ref[i].key->id || timenow >
-			((struct packed_rrset_data*)(ref[i].key->entry.data))
-			->ttl) {
+		d = ref[i].key->entry.data;
+		if(ref[i].id != ref[i].key->id ||
+			TTL_IS_EXPIRED(d->ttl, timenow)) {
 			/* failure! rollback our readlocks */
 			rrset_array_unlock(ref, i+1);
 			return 0;
@@ -511,7 +512,7 @@ rrset_cache_expired_above(struct rrset_cache* r, uint8_t** qname, size_t*
 			*qnamelen, searchtype, qclass, 0, 0, 0))) {
 			struct packed_rrset_data* data =
 				(struct packed_rrset_data*)rrset->entry.data;
-			if(now > data->ttl) {
+			if(TTL_IS_EXPIRED(data->ttl, now)) {
 				/* it is expired, this is not wanted */
 				lock_rw_unlock(&rrset->entry.lock);
 				log_nametypeclass(VERB_ALGO, "this rrset is expired", *qname, searchtype, qclass);
@@ -45,6 +45,7 @@
 #include "config.h"
 #include "services/mesh.h"
 #include "services/outbound_list.h"
+#include "services/outside_network.h"
 #include "services/cache/dns.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
@@ -58,6 +59,7 @@
 #include "util/alloc.h"
 #include "util/config_file.h"
 #include "util/edns.h"
+#include "sldns/parseutil.h"
 #include "sldns/sbuffer.h"
 #include "sldns/wire2str.h"
 #include "services/localzone.h"
@@ -65,6 +67,8 @@
 #include "respip/respip.h"
 #include "services/listen_dnsport.h"
 #include "util/timeval_func.h"
+#include "util/allow_response_list.h"
+#include "util/tsig.h"

 #ifdef CLIENT_SUBNET
 #include "edns-subnet/subnetmod.h"
@@ -348,7 +352,7 @@ mesh_serve_expired_lookup(struct module_qstate* qstate,

 	key = (struct msgreply_entry*)e->key;
 	data = (struct reply_info*)e->data;
-	if(data->ttl < timenow) *is_expired = 1;
+	if(TTL_IS_EXPIRED(data->ttl, timenow)) *is_expired = 1;
 	msg = tomsg(qstate->env, &key->key, data, qstate->region, timenow,
 		qstate->env->cfg->serve_expired, qstate->env->scratch);
 	if(!msg)
@@ -441,9 +445,18 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	if(!infra_wait_limit_allowed(mesh->env->infra_cache, rep,
 		edns->cookie_valid, mesh->env->cfg)) {
 		verbose(VERB_ALGO, "Too many queries waiting from the IP. "
-			"dropping incoming query.");
-		comm_point_drop_reply(rep);
+			"servfail incoming query.");
 		mesh->num_queries_wait_limit++;
+		edns_opt_list_append_ede(&edns->opt_list_out,
+			mesh->env->scratch, LDNS_EDE_OTHER,
+			"Too many queries queued up and waiting from the IP");
+		if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL,
+			LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
+				edns->opt_list_inplace_cb_out = NULL;
+		error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
+			qinfo, qid, qflags, edns);
+		regional_free_all(mesh->env->scratch);
+		comm_point_send_reply(rep);
 		return;
 	}
 	if(!unique)
@@ -1152,8 +1165,7 @@ mesh_detect_cycle_found(struct module_qstate* qstate, struct mesh_state* dep_m)
 {
 	struct mesh_state* cyc_m = qstate->mesh_info;
 	size_t counter = 0;
-	if(!dep_m)
-		return 0;
+	log_assert(dep_m);
 	if(dep_m == cyc_m || find_in_subsub(dep_m, cyc_m, &counter)) {
 		if(counter > MESH_MAX_SUBSUB)
 			return 2;
@@ -1190,24 +1202,19 @@ void mesh_detach_subs(struct module_qstate* qstate)
 }

 int mesh_add_sub(struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, int valrec, struct module_qstate** newq,
-	struct mesh_state** sub)
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq, struct mesh_state** sub)
 {
 	/* find it, if not, create it */
 	struct mesh_area* mesh = qstate->env->mesh;
-	*sub = mesh_area_find(mesh, NULL, qinfo, qflags,
-		prime, valrec);
-	if(mesh_detect_cycle_found(qstate, *sub)) {
-		verbose(VERB_ALGO, "attach failed, cycle detected");
-		return 0;
-	}
+	*sub = mesh_area_find(mesh, cinfo, qinfo, qflags, prime, valrec);
 	if(!*sub) {
 #ifdef UNBOUND_DEBUG
 		struct rbnode_type* n;
 #endif
 		/* create a new one */
-		*sub = mesh_state_create(qstate->env, qinfo, NULL, qflags, prime,
-			valrec);
+		*sub = mesh_state_create(qstate->env, qinfo, cinfo, qflags,
+			prime, valrec);
 		if(!*sub) {
 			log_err("mesh_attach_sub: out of memory");
 			return 0;
@@ -1230,18 +1237,25 @@ int mesh_add_sub(struct module_qstate* qstate, struct query_info* qinfo,
 		rbtree_insert(&mesh->run, &(*sub)->run_node);
 		log_assert(n != NULL);
 		*newq = &(*sub)->s;
-	} else
+	} else {
 		*newq = NULL;
+		if(mesh_detect_cycle_found(qstate, *sub)) {
+			verbose(VERB_ALGO, "attach failed, cycle detected");
+			return 0;
+		}
+	}
 	return 1;
 }

 int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, int valrec, struct module_qstate** newq)
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq)
 {
 	struct mesh_area* mesh = qstate->env->mesh;
 	struct mesh_state* sub = NULL;
 	int was_detached;
-	if(!mesh_add_sub(qstate, qinfo, qflags, prime, valrec, newq, &sub))
+	if(!mesh_add_sub(qstate, qinfo, cinfo, qflags, prime, valrec, newq,
+		&sub))
 		return 0;
 	was_detached = (sub->super_set.count == 0);
 	if(!mesh_state_attachment(qstate->mesh_info, sub))
@@ -1684,7 +1698,7 @@ static void dns_error_reporting(struct module_qstate* qstate,

 	log_query_info(VERB_ALGO, "DNS Error Reporting: generating report "
 		"query for", &qinfo);
-	if(mesh_add_sub(qstate, &qinfo, BIT_RD, 0, 0, &newq, &sub)) {
+	if(mesh_add_sub(qstate, &qinfo, NULL, BIT_RD, 0, 0, &newq, &sub)) {
 		qstate->env->mesh->num_dns_error_reports++;
 	}
 	return;
@@ -1726,29 +1740,101 @@ void mesh_query_done(struct mesh_state* mstate)
 	if(mstate->reply_list && mstate->s.env->cfg->dns_error_reporting)
 		dns_error_reporting(&mstate->s, rep);

+	if(mstate->reply_list && rep) {
+		uint8_t data[8192];
+		struct sldns_buffer dest;
+		int i;
+
+		sldns_buffer_init_frm_data(&dest, data, sizeof(data));
+		reply_info_answer_encode(&mstate->s.qinfo, rep, 0 /* id */,
+				0 /* qflags */, &dest, 0 /* current time */,
+				1 /* cached */, mstate->s.env->scratch,
+				sizeof(data) /* udpsize */, NULL /* edns */,
+				1 /* dnssec */, 0 /* secure */);
+		log_err("Answer to be send to %d other unbounds, size: %d",
+				mstate->s.env->outnet->num_dist,
+				(int)sldns_buffer_limit(&dest));
+		for(i = 0; i < mstate->s.env->outnet->num_dist; i++) {
+			struct tsig_key* key;
+			int r;
+			uint8_t data_signed[8192];
+			struct sldns_buffer dest_signed;
+
+			if(mstate->s.env->outnet->dist[i] == -1
+			|| mstate->s.env->outnet->dist_tsig[i] == NULL)
+				continue;
+			if(mstate->s.env->outnet->dist_tsig[i] == TSIG_NOKEY) {
+				send(mstate->s.env->outnet->dist[i],
+					data, sldns_buffer_limit(&dest), 0);
+				continue;
+			}
+			lock_rw_rdlock(&mstate->s.env->tsig_key_table->lock);
+			key = tsig_key_table_search_fromstr(
+					mstate->s.env->tsig_key_table,
+					mstate->s.env->outnet->dist_tsig[i]);
+			if(!key) {
+				lock_rw_unlock(
+					&mstate->s.env->tsig_key_table->lock);
+				log_err("tsig key \"%s\" not found when "
+					"distributing responses", 
+					mstate->s.env->outnet->dist_tsig[i]);
+				continue;
+			}
+			sldns_buffer_init_frm_data(&dest_signed,
+					data_signed, sizeof(data_signed));
+			sldns_buffer_write(&dest_signed,
+					data, sldns_buffer_limit(&dest));
+			if((r = tsig_sign_shared(&dest_signed, key->name,
+					key->algo->wireformat_name,
+					key->data, key->data_len,
+					*mstate->s.env->now))) {
+				lock_rw_unlock(
+					&mstate->s.env->tsig_key_table->lock);
+				log_err("tsig key \"%s\" failed to sign"
+					"distributing response: %s",
+					key->name_str,
+					sldns_lookup_by_id(sldns_tsig_errors, r)?
+                                        sldns_lookup_by_id(sldns_tsig_errors, r)->name:"??");
+				continue;
+			}
+			lock_rw_unlock(&mstate->s.env->tsig_key_table->lock);
+			send(mstate->s.env->outnet->dist[i], data_signed,
+					sldns_buffer_position(&dest_signed), 0);
+		}
+	}
+
 	for(r = mstate->reply_list; r; r = r->next) {
-		struct timeval old;
-		timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
-		if(mstate->s.env->cfg->discard_timeout != 0 &&
-			((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
-			mstate->s.env->cfg->discard_timeout) {
-			/* Drop the reply, it is too old */
-			/* briefly set the reply_list to NULL, so that the
-			 * tcp req info cleanup routine that calls the mesh
-			 * to deregister the meshstate for it is not done
-			 * because the list is NULL and also accounting is not
-			 * done there, but instead we do that here. */
-			struct mesh_reply* reply_list = mstate->reply_list;
-			verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
-			infra_wait_limit_dec(mstate->s.env->infra_cache,
-				&r->query_reply, mstate->s.env->cfg);
-			mstate->reply_list = NULL;
-			if(r->query_reply.c->use_h2)
-				http2_stream_remove_mesh_state(r->h2_stream);
-			comm_point_drop_reply(&r->query_reply);
-			mstate->reply_list = reply_list;
-			mstate->s.env->mesh->num_queries_discard_timeout++;
-			continue;
+		if(mesh_is_udp(r)) {
+			/* For UDP queries, the old replies are discarded.
+			 * This stops a large volume of old replies from
+			 * building up.
+			 * The stream replies, are not discarded. The
+			 * stream is open, the other side is waiting.
+			 * Some answer is needed, even if servfail, but the
+			 * real reply is ready to go, so that is given. */
+			struct timeval old;
+			timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
+			if(mstate->s.env->cfg->discard_timeout != 0 &&
+				((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
+				mstate->s.env->cfg->discard_timeout) {
+				/* Drop the reply, it is too old */
+				/* briefly set the reply_list to NULL, so that the
+				 * tcp req info cleanup routine that calls the mesh
+				 * to deregister the meshstate for it is not done
+				 * because the list is NULL and also accounting is not
+				 * done there, but instead we do that here. */
+				struct mesh_reply* reply_list = mstate->reply_list;
+				verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
+				infra_wait_limit_dec(mstate->s.env->infra_cache,
+					&r->query_reply, mstate->s.env->cfg);
+				mstate->reply_list = NULL;
+				if(r->query_reply.c->use_h2)
+					http2_stream_remove_mesh_state(r->h2_stream);
+				comm_point_drop_reply(&r->query_reply);
+				mstate->reply_list = reply_list;
+				mstate->s.env->mesh->num_queries_discard_timeout++;
+				continue;
+			}
 		}

 		i++;
@@ -2297,7 +2383,7 @@ mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
 	struct mesh_area* mesh = qstate->env->mesh;
 	struct mesh_state* dep_m = NULL;
 	dep_m = mesh_area_find(mesh, NULL, qinfo, flags, prime, valrec);
-	return mesh_detect_cycle_found(qstate, dep_m);
+	return dep_m?mesh_detect_cycle_found(qstate, dep_m):0;
 }

 void mesh_list_insert(struct mesh_state* m, struct mesh_state** fp,
@@ -399,6 +399,8 @@ void mesh_detach_subs(struct module_qstate* qstate);
 * @param qstate: the state to find mesh state, and that wants to receive
 * 	the results from the new subquery.
 * @param qinfo: what to query for (copied).
+ * @param cinfo: if non-NULL client specific info that may affect IP-based
+ * 	actions that apply to the query result. It is copied.
 * @param qflags: what flags to use (RD / CD flag or not).
 * @param prime: if it is a (stub) priming query.
 * @param valrec: if it is a validation recursion query (lookup of key, DS).
@@ -407,7 +409,8 @@ void mesh_detach_subs(struct module_qstate* qstate);
 * @return: false on error, true if success (and init may be needed).
 */
 int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
-	uint16_t qflags, int prime, int valrec, struct module_qstate** newq);
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq);

 /**
 * Add detached query.
@@ -426,6 +429,8 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
 * @param qstate: the state to find mesh state, and that wants to receive
 * 	the results from the new subquery.
 * @param qinfo: what to query for (copied).
+ * @param cinfo: if non-NULL client specific info that may affect IP-based
+ * 	actions that apply to the query result. It is copied.
 * @param qflags: what flags to use (RD / CD flag or not).
 * @param prime: if it is a (stub) priming query.
 * @param valrec: if it is a validation recursion query (lookup of key, DS).
@@ -435,8 +440,8 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
 * @return: false on error, true if success (and init may be needed).
 */
 int mesh_add_sub(struct module_qstate* qstate, struct query_info* qinfo,
-        uint16_t qflags, int prime, int valrec, struct module_qstate** newq,
-	struct mesh_state** sub);
+	struct respip_client_info* cinfo, uint16_t qflags, int prime,
+	int valrec, struct module_qstate** newq, struct mesh_state** sub);

 /**
 * Query state is done, send messages to reply entries.
@@ -262,6 +262,7 @@ int
 modstack_call_init(struct module_stack* stack, const char* module_conf,
 	struct module_env* env)
 {
+	const char* orig_module_conf = module_conf;
        int i, changed = 0;
        env->need_to_validate = 0; /* set by module init below */
        for(i=0; i<stack->num; i++) {
@@ -276,11 +277,13 @@ modstack_call_init(struct module_stack* stack, const char* module_conf,
 				changed = 1;
 			}
 		}
-		module_conf += strlen(stack->mod[i]->name);
+		/* Skip this module name in module_conf. */
+		while(*module_conf && !isspace((unsigned char)*module_conf))
+			module_conf++;
 	}
 	if(changed) {
 		modstack_free(stack);
-		if(!modstack_config(stack, module_conf)) {
+		if(!modstack_config(stack, orig_module_conf)) {
 			return 0;
 		}
 	}
@@ -59,6 +59,7 @@
 #include "util/random.h"
 #include "util/fptr_wlist.h"
 #include "util/edns.h"
+#include "util/allow_response_list.h"
 #include "sldns/sbuffer.h"
 #include "dnstap/dnstap.h"
 #ifdef HAVE_OPENSSL_SSL_H
@@ -1678,7 +1679,8 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
 	void* sslctx, int delayclose, int tls_use_sni, struct dt_env* dtenv,
 	int udp_connect, int max_reuse_tcp_queries, int tcp_reuse_timeout,
-	int tcp_auth_query_timeout)
+	int tcp_auth_query_timeout, const char** dist, const char** dist_tsig,
+	int num_dist)
 {
 	struct outside_network* outnet = (struct outside_network*)
 		calloc(1, sizeof(struct outside_network));
@@ -1819,6 +1821,32 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 			}
 		}
 	}
+	if (!(outnet->num_dist = num_dist))
+		outnet->dist = NULL;
+	else if ((outnet->dist = calloc(num_dist, sizeof(int))) &&
+	         (outnet->dist_tsig = calloc(num_dist, sizeof(const char*)))) {
+		int i;
+
+		for(i = 0; i < num_dist; i++) {
+			struct sockaddr_storage addr;
+			socklen_t addrlen;
+			int s = -1;
+
+			if(!extstrtoaddr(dist[i], &addr, &addrlen, UNBOUND_DNS_PORT)
+			|| (s = socket(addr.ss_family, SOCK_DGRAM, 0)) == -1
+			|| !fd_set_nonblock(s)
+			|| connect(s, (struct sockaddr*)&addr, addrlen)) {
+				if(s != -1)
+					close(s);
+				s = -1;
+			}
+			outnet->dist[i] = s;
+			outnet->dist_tsig[i] = dist_tsig[i] == NULL ? NULL
+			                     : strcmp(dist_tsig[i], TSIG_NOKEY)
+			                     ? strdup(dist_tsig[i])
+			                     : TSIG_NOKEY;
+		}
+	}
 	return outnet;
 }

@@ -1949,6 +1977,8 @@ outside_network_delete(struct outside_network* outnet)
 			p = np;
 		}
 	}
+	if(outnet->num_dist > 0 && outnet->dist != NULL)
+		free(outnet->dist);
 	free(outnet);
 }

@@ -190,6 +190,12 @@ struct outside_network {
 	struct waiting_tcp* tcp_wait_first;
 	/** last of waiting query list */
 	struct waiting_tcp* tcp_wait_last;
+	/** number of IP addresses to send to be cached responses to */
+	int num_dist;
+	/** udp sockets to the addresses to send to be cached responses to */
+	int* dist;
+	/** names of TSIG keys with which to sign the outgoing responses */
+	const char** dist_tsig;
 };

 /**
@@ -570,7 +576,8 @@ struct outside_network* outside_network_create(struct comm_base* base,
 	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
 	void* sslctx, int delayclose, int tls_use_sni, struct dt_env *dtenv,
 	int udp_connect, int max_reuse_tcp_queries, int tcp_reuse_timeout,
-	int tcp_auth_query_timeout);
+	int tcp_auth_query_timeout, const char** dist, const char** dist_tsig,
+	int num_dist);

 /**
 * Delete outside_network structure.
@@ -480,7 +480,8 @@ enum sldns_enum_ede_code
 	LDNS_EDE_TOO_EARLY = 26,
 	LDNS_EDE_UNSUPPORTED_NSEC3_ITERATIONS = 27,
 	LDNS_EDE_BADPROXYPOLICY = 28,
-	LDNS_EDE_SYNTHESIZED = 29
+	LDNS_EDE_SYNTHESIZED = 29,
+	LDNS_EDE_INVALID_QUERY_TYPE = 30
 };
 typedef enum sldns_enum_ede_code sldns_ede_code;

@@ -494,6 +495,7 @@ typedef enum sldns_enum_ede_code sldns_ede_code;
 #define LDNS_TSIG_ERROR_BADMODE  19
 #define LDNS_TSIG_ERROR_BADNAME  20
 #define LDNS_TSIG_ERROR_BADALG   21
+#define LDNS_TSIG_ERROR_BADTRUNC 22

 /** DNS Cookie extended rcode */
 #define LDNS_EXT_RCODE_BADCOOKIE 23
@@ -56,6 +56,18 @@ sldns_read_uint32(const void *src)
 #endif
 }

+INLINE uint64_t
+sldns_read_uint48(const void *src)
+{
+        const uint8_t *p = (const uint8_t *) src;
+        return (  ((uint64_t) p[0] << 40)
+	        | ((uint64_t) p[1] << 32)
+	        | ((uint64_t) p[2] << 24)
+                | ((uint64_t) p[3] << 16)
+                | ((uint64_t) p[4] << 8)
+                |  (uint64_t) p[5]);
+}
+
 /*
 * Copy data allowing for unaligned accesses in network byte order
 * (big endian).
@@ -693,6 +705,32 @@ sldns_buffer_read_u32(sldns_buffer *buffer)
 	return result;
 }

+/**
+ * returns the 6-byte integer value at the given position in the buffer
+ * \param[in] buffer the buffer
+ * \param[in] at position in the buffer
+ * \return 6 byte integer
+ */
+INLINE uint64_t
+sldns_buffer_read_u48_at(sldns_buffer *buffer, size_t at)
+{
+	assert(sldns_buffer_available_at(buffer, at, 6));
+	return sldns_read_uint48(buffer->_data + at);
+}
+
+/**
+ * returns the 6-byte integer value at the current position in the buffer
+ * \param[in] buffer the buffer
+ * \return 6 byte integer
+ */
+INLINE uint64_t
+sldns_buffer_read_u48(sldns_buffer *buffer)
+{
+	uint64_t result = sldns_buffer_read_u48_at(buffer, buffer->_position);
+	buffer->_position += 6;
+	return result;
+}
+
 /**
 * returns the status of the buffer
 * \param[in] buffer
@@ -233,6 +233,7 @@ static sldns_lookup_table sldns_edns_ede_codes_data[] = {
 	{ LDNS_EDE_UNSUPPORTED_NSEC3_ITERATIONS, "Unsupported NSEC3 Iterations Value" },
 	{ LDNS_EDE_BADPROXYPOLICY, "Unable to Conform to Policy" },
 	{ LDNS_EDE_SYNTHESIZED, "Synthesized Answer" },
+	{ LDNS_EDE_INVALID_QUERY_TYPE, "Invalid Query Type" },
 	{ 0, NULL}
 };
 sldns_lookup_table* sldns_edns_ede_codes = sldns_edns_ede_codes_data;
@@ -255,6 +256,7 @@ static sldns_lookup_table sldns_tsig_errors_data[] = {
 	{ LDNS_TSIG_ERROR_BADMODE, "BADMODE" },
 	{ LDNS_TSIG_ERROR_BADNAME, "BADNAME" },
 	{ LDNS_TSIG_ERROR_BADALG, "BADALG" },
+	{ LDNS_TSIG_ERROR_BADTRUNC, "BADTRUNC" },
 	{ 0, NULL }
 };
 sldns_lookup_table* sldns_tsig_errors = sldns_tsig_errors_data;
@@ -49,6 +49,7 @@
 #include "util/module.h"
 #include "util/net_help.h"
 #include "util/regional.h"
+#include "util/tsig.h"
 #include "iterator/iterator.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_hints.h"
@@ -783,7 +784,6 @@ morechecks(struct config_file* cfg)
 	/* check that the modules listed in module_conf exist */
 	check_modules_exist(cfg->module_conf);

-	/* Respip is known to *not* work with dns64. */
 	if(strcmp(cfg->module_conf, "iterator") != 0
 		&& strcmp(cfg->module_conf, "validator iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 validator iterator") != 0
@@ -869,6 +869,7 @@ morechecks(struct config_file* cfg)
 		&& strcmp(cfg->module_conf, "respip cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 validator cachedb iterator") != 0
 		&& strcmp(cfg->module_conf, "dns64 cachedb iterator") != 0
+		&& strcmp(cfg->module_conf, "respip dns64 validator cachedb iterator") != 0
 #endif
 #if defined(WITH_PYTHONMODULE) && defined(USE_CACHEDB)
 		&& strcmp(cfg->module_conf, "python dns64 cachedb iterator") != 0
@@ -1003,13 +1004,23 @@ static void
 check_auth(struct config_file* cfg)
 {
 	int is_rpz = 0;
+	struct tsig_key_table* tsig_key_table;
 	struct auth_zones* az = auth_zones_create();
-	if(!az || !auth_zones_apply_cfg(az, cfg, 0, &is_rpz, NULL, NULL)) {
+
+	/* construct tsig key table for tsig key name checks, and it
+	 * also checks the TSIG key name and algorithm and base64 syntax. */
+	tsig_key_table = tsig_key_table_create();
+	if(!tsig_key_table || !tsig_key_table_apply_cfg(tsig_key_table, cfg))
+		fatal_exit("Could not set up TSIG keys");
+
+	if(!az || !auth_zones_apply_cfg(az, cfg, 0, &is_rpz, NULL, NULL,
+		tsig_key_table)) {
 		fatal_exit("Could not setup authority zones");
 	}
 	if(is_rpz && !strstr(cfg->module_conf, "respip"))
 		fatal_exit("RPZ requires the respip module");
 	auth_zones_delete(az);
+	tsig_key_table_delete(tsig_key_table);
 }

 /** check config file */
@@ -1134,7 +1134,8 @@ outside_network_create(struct comm_base* base, size_t bufsize,
 	int ATTR_UNUSED(delayclose), int ATTR_UNUSED(tls_use_sni),
 	struct dt_env* ATTR_UNUSED(dtenv), int ATTR_UNUSED(udp_connect),
 	int ATTR_UNUSED(max_reuse_tcp_queries), int ATTR_UNUSED(tcp_reuse_timeout),
-	int ATTR_UNUSED(tcp_auth_query_timeout))
+	int ATTR_UNUSED(tcp_auth_query_timeout), const char** ATTR_UNUSED(dist),
+	const char** ATTR_UNUSED(dist_tsig), int ATTR_UNUSED(num_dist))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)base;
 	struct outside_network* outnet =  calloc(1,
@@ -1362,6 +1362,7 @@ main(int argc, char* argv[])
 #ifdef HAVE_NGTCP2
 	doq_test();
 #endif /* HAVE_NGTCP2 */
+	tsig_test();
 	if(log_get_lock()) {
 		lock_basic_destroy((lock_basic_type*)log_get_lock());
 	}
@@ -88,5 +88,7 @@ void tcpreuse_test(void);
 void doq_test(void);
 /** unit test for infra cache functions */
 void infra_test(void);
+/** unit test for tsig functions */
+void tsig_test(void);

 #endif /* TESTCODE_UNITMAIN_H */
@@ -631,6 +631,7 @@ rh_allow_sha1_signatures_disabled(void)
 void 
 verify_test(void)
 {
+	int do_sha1 = 1;
 	unit_show_feature("signature verify");

 #if defined(HAVE_SSL) && defined(USE_SHA1)
@@ -643,27 +644,40 @@ verify_test(void)
 #else
 		_putenv("OPENSSL_ENABLE_SHA1_SIGNATURES=1");
 #endif
+		do_sha1 = 1;
 	}
+#ifdef HAVE_EVP_DEFAULT_PROPERTIES_IS_FIPS_ENABLED
+	if (EVP_default_properties_is_fips_enabled(NULL))
+		do_sha1 = 0;
 #endif
+#endif /* HAVE_SSL and USE_SHA1 */

 #ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.1", "20070818005004");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.1", "20070818005004");
+	}
 #endif
 #if defined(USE_DSA) && defined(USE_SHA1)
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.2", "20080414005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.3", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.4", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.5", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.6", "20080416005004");
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.7", "20070829144150");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.2", "20080414005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.3", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.4", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.5", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.6", "20080416005004");
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.7", "20070829144150");
+	}
 #endif /* USE_DSA */
 #ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_signatures.8", "20070829144150");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_signatures.8", "20070829144150");
+	}
 #endif
 #if (defined(HAVE_EVP_SHA256) || defined(HAVE_NSS) || defined(HAVE_NETTLE)) && defined(USE_SHA2)
 	verifytest_file(SRCDIRSTR "/testdata/test_sigs.rsasha256", "20070829144150");
 #  ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_sigs.sha1_and_256", "20070829144150");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_sigs.sha1_and_256", "20070829144150");
+	}
 #  endif
 	verifytest_file(SRCDIRSTR "/testdata/test_sigs.rsasha256_draft", "20090101000000");
 #endif
@@ -672,8 +686,10 @@ verify_test(void)
 	verifytest_file(SRCDIRSTR "/testdata/test_signatures.9", "20171215000000");
 #endif
 #ifdef USE_SHA1
-	verifytest_file(SRCDIRSTR "/testdata/test_sigs.hinfo", "20090107100022");
-	verifytest_file(SRCDIRSTR "/testdata/test_sigs.revoked", "20080414005004");
+	if(do_sha1) {
+		verifytest_file(SRCDIRSTR "/testdata/test_sigs.hinfo", "20090107100022");
+		verifytest_file(SRCDIRSTR "/testdata/test_sigs.revoked", "20080414005004");
+	}
 #endif
 #ifdef USE_GOST
 	if(sldns_key_EVP_load_gost_id())
@@ -699,7 +715,9 @@ verify_test(void)
 	}
 #endif
 #ifdef USE_SHA1
-	dstest_file(SRCDIRSTR "/testdata/test_ds.sha1");
+	if(do_sha1) {
+		dstest_file(SRCDIRSTR "/testdata/test_ds.sha1");
+	}
 #endif
 	nsectest();
 	nsec3_hash_test(SRCDIRSTR "/testdata/test_nsec3_hash.1");
@@ -0,0 +1,5 @@
+$ORIGIN .
+$TTL 7200
+example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+example.com.	IN NS	ns.example.net.
+www.example.com. IN A	1.2.3.4
@@ -0,0 +1,17 @@
+server:
+	verbosity: 7
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+auth-zone:
+	name: "example.com"
+	for-upstream: yes
+	for-downstream: yes
+	url: "https://127.0.0.1:@TOPORT@/example.com.zone"
+
@@ -0,0 +1,16 @@
+BaseName: auth_https_origin
+Version: 1.0
+Description: Perform https for authority zone with $ORIGIN
+CreationDate: Mon 29 September 14:35:40 CEST 2025
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: auth_https_origin.pre
+Post: auth_https_origin.post
+Test: auth_https_origin.test
+AuxFiles: 
+Passed:
+Failure:
@@ -0,0 +1,11 @@
+# #-- auth_https_origin.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+PRE="../.."
+. ../common.sh
+kill_pid $UNBOUND_PID
+kill_pid $PETAL_PID
@@ -0,0 +1,34 @@
+# #-- auth_https_origin.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+PETAL_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "PETAL_PORT=$PETAL_PORT" >> .tpkg.var.test
+
+get_make
+(cd $PRE; $MAKE petal)
+
+# start https daemon
+$PRE/petal -v -a "127.0.0.1" -p $PETAL_PORT >petal.log 2>&1 &
+PETAL_PID=$!
+echo "PETAL_PID=$PETAL_PID" >> .tpkg.var.test
+cat .tpkg.var.test
+wait_petal_up petal.log
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$PETAL_PORT'/' < auth_https_origin.conf > ub.conf
+# start unbound in the background
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_unbound_up unbound.log
+
@@ -0,0 +1,63 @@
+# #-- auth_https_origin.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+. ../common.sh
+# do the test
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> cat logfiles"
+cat petal.log 
+cat unbound.log
+echo "> check answer"
+if grep "1.2.3.4" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# Test that notify is allowed from the webserver address
+get_ldns_notify
+echo "> ldns-notify -z example.com"
+$LDNS_NOTIFY -p $UNBOUND_PORT -z example.com 127.0.0.1 | tee outfile
+if grep "rcode: REFUSED"  outfile; then
+	echo "Not OK"
+	exit 1
+else
+	echo "OK"
+fi
+
+exit 0
@@ -0,0 +1,21 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIDfQIBAAKBwQC1xQ/Kca6zszZbcCtdOTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJ
+RuN+Rm304SonpwghfP2/ULZNnuDgpG03/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1
+QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ867K029ypjOQtAJ85qdO3mERy7TGtdUcu
+O6hLeVet419YeQ2F8cfNxn63d7bOzNGLPW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeU
+J/i4YDWexFYSL+ECAwEAAQKBwCLXXQl+9O+5AEhSnd1Go1Jh0pSA7eBJOuXQcebG
+Rb7ykp+6C4G2NtDziwwPRNdI6wQQQ0sym18RfyVQHydGr78/nbiIbB3HCn5e92Mh
+mefzW6ow9Kvm2txLzGKA1lvoyRbNm81jnG/eygi3u7Nqd5PNv+4dHj2RkTlmxOeh
+qnDMVP5md8uZPv6lYNnrnIzvLCR5vnPNdVwn89AqzI85IcDZdy0R9ZX4NBbsDgAU
+6ig6uXuRXvSGiyJ/OUXSrnogaQJhAOjvkHUhVZQkPOxO90TNH4j0GdKKtbSWxIdz
+lKfuJeBAEqs0TL+C6vbS81Xw3W1alyDdUBk3rJMOBqW6Ryq5HNL+j5H+Jfsh7fvc
+Yle+5wHGci0P9zCFZCrY8It7n9XFIwJhAMfEi6oJa2G8waPJ1bQhxka82Tf9pnKM
+XCn/1BBOFjVIx5F842cpA+zp5a62GENTGYPQTTRBB/2/ZwnW5aIkrlg54AtmbqBZ
+Oh+2kJdJQD/tfoVmc5soUE2ScTHadK5RKwJhAN4w9kjkXS+MSZjX0kIMsBIBVkhh
+C+aREjJqa9ir7/Ey7RvmLXdYuCxtGLRXp7/R8+rjcK49Tx6O+IRJZe042mfhbq3C
+EhS1Tr86f4xXix9EXlDhs9bSxrOgcAN9Dv/opQJhAK7eBcPaav0rVfYh/8emqQHS
+3fJ9Pu6WnzbEksWTFS2ff9KDGCx9YspIFJ5TF/oXDAaumGZdZrlgirm6O1kr8tGY
+F97i04PZl1+bWAaWQH+1TUNI43m2WFUPE7coG2tb8QJgcddDg9VlXliZqgcETZfJ
+kJmYETxrcSn3ao6v116N8yxhEgUgjkmsCTiFgx36iDVnXwK6PIt+sIu8MC7eYNa3
+berrv/M21K0LRn20IWRxvUobG070weHCAgkko7fTWgr2
+-----END RSA PRIVATE KEY-----
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICFzCCAUACCQDO660L5y5LGDANBgkqhkiG9w0BAQUFADAQMQ4wDAYDVQQDEwVw
+ZXRhbDAeFw0xMDA5MzAxMzQzMDFaFw0zMDA2MTcxMzQzMDFaMBAxDjAMBgNVBAMT
+BXBldGFsMIHfMA0GCSqGSIb3DQEBAQUAA4HNADCByQKBwQC1xQ/Kca6zszZbcCtd
+OTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJRuN+Rm304SonpwghfP2/ULZNnuDgpG03
+/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ8
+67K029ypjOQtAJ85qdO3mERy7TGtdUcuO6hLeVet419YeQ2F8cfNxn63d7bOzNGL
+PW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeUJ/i4YDWexFYSL+ECAwEAATANBgkqhkiG
+9w0BAQUFAAOBwQBBkX9KDP2RXbg+xPmdJ4P6CwvA5x1LZwC++ydVx4NlvT0pWicD
+ZUnXjcWAJlkeOuUBAqFG7WHTrXpUUAjmdqFVq2yFjteUYBdrFz0RDB2jM9feeKYO
+mTgxdZyT9a6humxCxt5VfgT02axLjm/2AqCyFPMbf4PASoJDln01AEuZLZ8Xl2gV
+bYHMnHTGoD1Hu6FNEzRgkMC6XT8X3YjHvzQhpc/qL5wEfEsinQGdX4twsuWbf8xd
+q7miNnkO8vd0maw=
+-----END CERTIFICATE-----
@@ -0,0 +1,16 @@
+BaseName: auth_tsig
+Version: 1.0
+Description: Perform AXFR with TSIG for authority zone.
+CreationDate: Fri 12 Sep 09:35:40 CEST 2025
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: auth_tsig.pre
+Post: auth_tsig.post
+Test: auth_tsig.test
+AuxFiles: 
+Passed:
+Failure:
@@ -0,0 +1,23 @@
+server:
+	logfile: "/dev/stderr"
+	xfrdfile: xfrd.state
+	username: ""
+	chroot: ""
+	zonesdir: ""
+	pidfile: "nsd.pid"
+	zonelistfile: "zone.list"
+	verbosity: 5
+	port: @NSD_PORT@
+	interface: 127.0.0.1@@NSD_PORT@
+
+key:
+	name: "test.key"
+	algorithm: sha256
+	secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
+
+zone:
+	name: "example.com"
+	zonefile: "example.com.zone"
+	provide-xfr: 0.0.0.0/0 test.key
+	provide-xfr: ::0/0 test.key
+	notify: 127.0.0.1@@UNBOUND_PORT@ test.key
@@ -0,0 +1,14 @@
+# #-- auth_tsig.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $NSD_PID
+kill_pid $UNBOUND_PID
+echo "nsd.log"
+cat nsd.log
+echo "unbound.log"
+cat unbound.log
@@ -0,0 +1,59 @@
+# #-- auth_tsig.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+#skip_test "Skip test due to no UDP service for SOA query"
+PRE="../.."
+if test -n "$NSD"; then
+	:
+else
+	if `which nsd >/dev/null 2>&1`; then
+		NSD="nsd"
+	else
+		if test -f $PRE/../nsd/nsd; then
+			NSD="$PRE/../nsd/nsd"
+		else
+			skip_test "need nsd"
+		fi
+	fi
+fi
+echo "NSD=$NSD"
+
+if test -f $PRE/unbound_do_valgrind_in_test; then
+	do_valgrind=yes
+else
+	do_valgrind=no
+fi
+VALGRIND_FLAGS="--leak-check=full --show-leak-kinds=all"
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+NSD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "NSD_PORT=$NSD_PORT" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@UNBOUND_PORT\@/'$UNBOUND_PORT'/' -e 's/@NSD_PORT\@/'$NSD_PORT'/' < auth_tsig.ub.conf > ub.conf
+sed -e 's/@UNBOUND_PORT\@/'$UNBOUND_PORT'/' -e 's/@NSD_PORT\@/'$NSD_PORT'/' < auth_tsig.nsd.conf > nsd.conf
+
+# start nsd
+$NSD -d -c nsd.conf >nsd.log 2>&1 &
+NSD_PID=$!
+echo "NSD_PID=$NSD_PID" >> .tpkg.var.test
+
+# start unbound in the background
+if test $do_valgrind = "yes"; then
+valgrind $VALGRIND_FLAGS $PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+else
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+fi
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_nsd_up nsd.log
+wait_unbound_up unbound.log
@@ -0,0 +1,108 @@
+# #-- auth_tsig.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.4" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# update the zonefile.
+echo "www2.example.com. IN A 1.2.3.5" >> example.com.zone
+mv example.com.zone tmp.zone
+sed -e 's/2024082400/2024082401/' <tmp.zone >example.com.zone
+echo ""
+echo "new example.com.zone:"
+cat example.com.zone
+echo ""
+
+# NSD reloads the zone file,
+# sends notify to unbound, with TSIG.
+# unbound replies to the notify, with TSIG.
+# unbound fetches SOA record, with TSIG.
+# unbound fetches zone transfer, with TSIG.
+kill -1 `cat nsd.pid`
+
+# test if the zone has updated.
+dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.5" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo ""
+echo "zonefile: unbound-example.com.zone"
+cat unbound-example.com.zone
+echo ""
+
+exit 0
@@ -0,0 +1,26 @@
+server:
+	verbosity: 7
+	num-threads: 1
+	interface: 127.0.0.1
+	port: @UNBOUND_PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	log-queries: yes
+
+# This tsig key is used for testing.
+tsig-key:
+	name: "test.key"
+	algorithm: sha256
+	secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
+
+auth-zone:
+	name: "example.com"
+	zonefile: "unbound-example.com.zone"
+	for-upstream: yes
+	for-downstream: yes
+	primary-tsig: "127.0.0.1@@NSD_PORT@" test.key
+	allow-notify-tsig: "127.0.0.2@@NSD_PORT@" test.key
@@ -0,0 +1,4 @@
+example.com.		240	IN	SOA	ns.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2024082400 28800 7200 604800 240
+example.com. NS ns.example.com.
+ns.example.com. IN A 192.0.2.1
+www.example.com. A 1.2.3.4
@@ -5,6 +5,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -5,6 +5,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -5,6 +5,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -5,6 +5,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -8,6 +8,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -8,6 +8,7 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -5,7 +5,10 @@ server:
 	minimal-responses: no
 	serve-expired: yes
 	serve-expired-client-timeout: 0
+	serve-expired-reply-ttl: 123
 	module-config: "cachedb iterator"
+	ede: yes
+	ede-serve-expired: yes

 cachedb:
 	backend: "testframe"
@@ -82,7 +85,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ENTRY_BEGIN
@@ -91,7 +94,8 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+; TTL lower than serve-expired-reply-ttl on purpose
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 RANGE_END

@@ -111,7 +115,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; Get another query in cache to make it expired.
@@ -130,46 +134,46 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END

 ; it is now expired
-STEP 40 TIME_PASSES ELAPSE 20
+STEP 40 TIME_PASSES ELAPSE 200

 ; cache is expired, and cachedb is expired.
 STEP 50 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www2.example.com. IN A
 ENTRY_END

 STEP 60 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 30 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END

 ; cache is expired, cachedb has no answer
 STEP 70 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END

 STEP 80 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END

 STEP 90 TRAFFIC
@@ -189,7 +193,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; flush the entry from cache
@@ -210,30 +214,30 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; it is now expired
-STEP 150 TIME_PASSES ELAPSE 20
+STEP 150 TIME_PASSES ELAPSE 200
 ; flush the entry from cache
 STEP 160 FLUSH_MESSAGE www.example.com. IN A

 ; cache has no answer, cachedb is expired
 STEP 170 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END

 STEP 180 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END

 STEP 190 TRAFFIC
@@ -254,7 +258,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; expire the entry in cache
@@ -275,30 +279,30 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; it is now expired
-STEP 250 TIME_PASSES ELAPSE 20
+STEP 250 TIME_PASSES ELAPSE 200
 ; expire the entry in cache
 STEP 260 EXPIRE_MESSAGE www.example.com. IN A

 ; cache is expired, cachedb is expired
 STEP 270 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END

 STEP 280 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END

 STEP 290 TRAFFIC
@@ -319,7 +323,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 SCENARIO_END
@@ -4,12 +4,14 @@ server:
 	qname-minimisation: no
 	minimal-responses: no
 	serve-expired: yes
-	serve-expired-reply-ttl: 30
+	serve-expired-reply-ttl: 123
 	; at least one second, so we can time skip past the timer in the
 	; testbound script steps, but also reply within the time.
 	serve-expired-client-timeout: 1200
 	module-config: "cachedb iterator"
 	discard-timeout: 3000
+	ede: yes
+	ede-serve-expired: yes

 cachedb:
 	backend: "testframe"
@@ -86,7 +88,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ENTRY_BEGIN
@@ -95,7 +97,8 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+; TTL lower than serve-expired-reply-ttl on purpose
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 RANGE_END

@@ -108,7 +111,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.6
+www.example.com. 200 IN A 1.2.3.6
 ENTRY_END

 ENTRY_BEGIN
@@ -117,7 +120,8 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.7
+; TTL lower than serve-expired-reply-ttl on purpose
+www2.example.com. 100 IN A 1.2.3.7
 ENTRY_END
 RANGE_END

@@ -132,7 +136,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.8
+www.example.com. 200 IN A 1.2.3.8
 ENTRY_END

 ENTRY_BEGIN
@@ -141,7 +145,8 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.9
+; TTL lower than serve-expired-reply-ttl on purpose
+www2.example.com. 100 IN A 1.2.3.9
 ENTRY_END
 RANGE_END

@@ -156,7 +161,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.10
+www.example.com. 200 IN A 1.2.3.10
 ENTRY_END

 ENTRY_BEGIN
@@ -165,7 +170,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.11
+www2.example.com. 100 IN A 1.2.3.11
 ENTRY_END
 RANGE_END

@@ -188,7 +193,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; Get another query in cache.
@@ -207,7 +212,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END

 ; www.example.com and www2.example.com are in cache, www2 in cachedb.
@@ -217,7 +222,7 @@ STEP 40 FLUSH_MESSAGE www2.example.com. IN A
 ; response from cachedb for www2.

 ; make 2 seconds pass to decrement the TTL on the response,
-; the upstream TTL would be 10, cachedb 8.
+; the upstream TTL would be 200, cachedb 198.
 STEP 48 TIME_PASSES ELAPSE 2

 STEP 50 QUERY
@@ -234,11 +239,11 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 8 IN A 1.2.3.5
+www2.example.com. 98 IN A 1.2.3.5
 ENTRY_END

 ; make both cache and cachedb expired
-STEP 70 TIME_PASSES ELAPSE 20
+STEP 70 TIME_PASSES ELAPSE 200

 ; www and www2 expired in cache, www2 expired in cachedb.
 ; the query should now try to resolve and complete within the
@@ -258,11 +263,11 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.7
+www2.example.com. 100 IN A 1.2.3.7
 ENTRY_END

 ; expire the data again
-STEP 100 TIME_PASSES ELAPSE 20
+STEP 100 TIME_PASSES ELAPSE 200

 ; the query should now try to resolve, but the upstream is not
 ; responsive for several testbound steps. When the timer expires,
@@ -271,7 +276,7 @@ STEP 100 TIME_PASSES ELAPSE 20
 ; www2 expired in cache and www2 expired in cachedb.
 STEP 110 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www2.example.com. IN A
 ENTRY_END
@@ -281,26 +286,26 @@ STEP 112 TIME_PASSES ELAPSE 2

 STEP 120 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 30 IN A 1.2.3.7
+www2.example.com. 100 IN A 1.2.3.7
 ENTRY_END

 ; make traffic flow to resolve the query, server responds.
 STEP 130 TRAFFIC

 ; expire the data again
-STEP 140 TIME_PASSES ELAPSE 20
+STEP 140 TIME_PASSES ELAPSE 200

 ; The client query tries to resolve, but gets no immediate answer,
 ; so the expired data is used. But the expired data is in cache and
 ; the query is not in cachedb.
 STEP 150 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
@@ -310,12 +315,12 @@ STEP 152 TIME_PASSES ELAPSE 2

 STEP 160 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END

 ; make traffic flow to resolve the query, server responds.
@@ -337,7 +342,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.11
+www2.example.com. 100 IN A 1.2.3.11
 ENTRY_END

 SCENARIO_END
@@ -5,8 +5,10 @@ server:
 	minimal-responses: no
 	serve-expired: yes
 	serve-expired-client-timeout: 0
-	serve-expired-reply-ttl: 30
+	serve-expired-reply-ttl: 123
 	module-config: "cachedb iterator"
+	ede: yes
+	ede-serve-expired: yes

 cachedb:
 	backend: "testframe"
@@ -83,7 +85,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ENTRY_BEGIN
@@ -92,7 +94,8 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+; TTL lower than serve-expired-reply-ttl on purpose
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 RANGE_END

@@ -115,7 +118,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; Get another query in cache to make it expired.
@@ -134,28 +137,28 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END

 ; it is now expired
-STEP 40 TIME_PASSES ELAPSE 20
+STEP 40 TIME_PASSES ELAPSE 200

 ; cache is expired, and cachedb is expired.
 STEP 50 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www2.example.com. IN A
 ENTRY_END

 STEP 60 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 30 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END

 ; got an answer from upstream
@@ -173,25 +176,25 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END

 ; cache is expired, cachedb has no answer
 STEP 70 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END

 STEP 80 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END

 STEP 90 TRAFFIC
@@ -211,29 +214,29 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; make both cache and cachedb expired.
-STEP 120 TIME_PASSES ELAPSE 20
+STEP 120 TIME_PASSES ELAPSE 200
 STEP 130 FLUSH_MESSAGE www.example.com. IN A

 ; cache has no entry and cachedb is expired.
 STEP 140 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END

 STEP 150 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END

 ; the name is resolved
@@ -254,7 +257,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 SCENARIO_END
@@ -4,7 +4,7 @@ server:
 	qname-minimisation: no
 	minimal-responses: no
 	serve-expired: yes
-	serve-expired-reply-ttl: 30
+	serve-expired-reply-ttl: 123

 	; disable the serve expired client timeout.
 	serve-expired-client-timeout: 0
@@ -14,6 +14,8 @@ server:
 	; store for edns subnet content for modules to the right of it.
 	; this keeps subnet content out of cachedb as global content.
 	module-config: "subnetcache cachedb iterator"
+	ede: yes
+	ede-serve-expired: yes

 cachedb:
 	backend: "testframe"
@@ -105,7 +107,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN CNAME www.initial.com.
+www.example.com. 200 IN CNAME www.initial.com.
 ENTRY_END
 RANGE_END

@@ -118,7 +120,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN CNAME example.foo.com.
+www.example.com. 200 IN CNAME example.foo.com.
 ENTRY_END
 RANGE_END

@@ -131,7 +133,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.initial.com. IN A
 SECTION ANSWER
-www.initial.com. 10 IN A 1.2.3.4
+www.initial.com. 200 IN A 1.2.3.4
 ENTRY_END
 RANGE_END

@@ -144,7 +146,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 example.foo.com. IN A
 SECTION ANSWER
-example.foo.com. 10 IN A 1.2.3.5
+example.foo.com. 200 IN A 1.2.3.5
 SECTION ADDITIONAL
 	HEX_EDNSDATA_BEGIN
 				; client is 127.0.0.1
@@ -166,7 +168,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN CNAME example.foo.com.
+www.example.com. 200 IN CNAME example.foo.com.
 ENTRY_END
 RANGE_END

@@ -179,7 +181,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 example.foo.com. IN A
 SECTION ANSWER
-example.foo.com. 10 IN A 1.2.3.6
+example.foo.com. 200 IN A 1.2.3.6
 SECTION ADDITIONAL
 	HEX_EDNSDATA_BEGIN
 				; client is 127.0.0.1
@@ -211,19 +213,19 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN CNAME www.initial.com.
-www.initial.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN CNAME www.initial.com.
+www.initial.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; now valid in cache and valid in cachedb, without subnet.
-STEP 30 TIME_PASSES ELAPSE 20
+STEP 30 TIME_PASSES ELAPSE 200

 ; now the cache and cachedb have an expired entry.
 ; the upstream is updated to CNAME to a subnet zone A record.

 STEP 40 QUERY ADDRESS 127.0.0.1
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
@@ -231,13 +233,13 @@ ENTRY_END
 ; the expired answer, while the ECS answer is looked up.
 STEP 50 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN CNAME www.initial.com.
-www.initial.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN CNAME www.initial.com.
+www.initial.com. 123 IN A 1.2.3.4
 ENTRY_END

 ; check that subnet has the query in cache.
@@ -256,12 +258,12 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 8 IN CNAME example.foo.com.
-example.foo.com. 8 IN A 1.2.3.5
+www.example.com. 198 IN CNAME example.foo.com.
+example.foo.com. 198 IN A 1.2.3.5
 ENTRY_END

 ; everything is expired, cache, subnetcache and cachedb.
-STEP 80 TIME_PASSES ELAPSE 20
+STEP 80 TIME_PASSES ELAPSE 200

 STEP 90 QUERY ADDRESS 127.0.0.1
 ENTRY_BEGIN
@@ -277,8 +279,8 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN CNAME example.foo.com.
-example.foo.com. 10 IN A 1.2.3.6
+www.example.com. 200 IN CNAME example.foo.com.
+example.foo.com. 200 IN A 1.2.3.6
 ENTRY_END

 ; see the entry now in cache, from the subnetcache.
@@ -297,8 +299,8 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 8 IN CNAME example.foo.com.
-example.foo.com. 8 IN A 1.2.3.6
+www.example.com. 198 IN CNAME example.foo.com.
+example.foo.com. 198 IN A 1.2.3.6
 ENTRY_END

 SCENARIO_END
@@ -5,8 +5,11 @@ server:
 	minimal-responses: yes
 	serve-expired: yes
 	serve-expired-client-timeout: 0
+	serve-expired-reply-ttl: 123
 	;module-config: "subnetcache validator cachedb iterator"
 	module-config: "validator cachedb iterator"
+	ede: yes
+	ede-serve-expired: yes

 cachedb:
 	backend: "testframe"
@@ -83,7 +86,7 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ENTRY_BEGIN
@@ -92,7 +95,8 @@ REPLY QR AA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+; TTL lower than serve-expired-reply-ttl on purpose
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END
 RANGE_END

@@ -112,7 +116,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; Get another query in cache to make it expired.
@@ -131,48 +135,48 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 10 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END

 ; it is now expired
-STEP 40 TIME_PASSES ELAPSE 20
+STEP 40 TIME_PASSES ELAPSE 200

 ; cache is expired, and cachedb is expired.
 ; The expired reply, from cachedb, needs a validation status,
 ; because the validator module set that validation is needed.
 STEP 50 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www2.example.com. IN A
 ENTRY_END

 STEP 60 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www2.example.com. IN A
 SECTION ANSWER
-www2.example.com. 30 IN A 1.2.3.5
+www2.example.com. 100 IN A 1.2.3.5
 ENTRY_END

 ; cache is expired, cachedb has no answer
 STEP 70 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END

 STEP 80 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END

 STEP 90 TRAFFIC
@@ -192,7 +196,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; flush the entry from cache
@@ -213,30 +217,30 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; it is now expired
-STEP 150 TIME_PASSES ELAPSE 20
+STEP 150 TIME_PASSES ELAPSE 200
 ; flush the entry from cache
 STEP 160 FLUSH_MESSAGE www.example.com. IN A

 ; cache has no answer, cachedb is expired
 STEP 170 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END

 STEP 180 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END

 STEP 190 TRAFFIC
@@ -257,7 +261,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; expire the entry in cache
@@ -278,30 +282,30 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 ; it is now expired
-STEP 250 TIME_PASSES ELAPSE 20
+STEP 250 TIME_PASSES ELAPSE 200
 ; expire the entry in cache
 STEP 260 EXPIRE_MESSAGE www.example.com. IN A

 ; cache is expired, cachedb is expired
 STEP 270 QUERY
 ENTRY_BEGIN
-REPLY RD
+REPLY RD DO
 SECTION QUESTION
 www.example.com. IN A
 ENTRY_END

 STEP 280 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA NOERROR
+MATCH all ttl ede=3
+REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 30 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END

 STEP 290 TRAFFIC
@@ -322,7 +326,7 @@ REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-www.example.com. 10 IN A 1.2.3.4
+www.example.com. 200 IN A 1.2.3.4
 ENTRY_END

 SCENARIO_END
@@ -5,6 +5,7 @@ server:
 	qname-minimisation: "no"
 	trust-anchor-signaling: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	disable-edns-do: yes

 stub-zone:
@@ -7,6 +7,7 @@ server:
 	dns64-ignore-aaaa: ip6ignore.example.com
 	dns64-ignore-aaaa: ip6only.example.com
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -5,6 +5,7 @@ server:
 	module-config: "dns64 iterator"
 	dns64-prefix: 64:ff9b::0/96
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	prefetch: yes

 stub-zone:
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -3,6 +3,7 @@ server:
 	target-fetch-policy: "0 0 0 0 0"
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
@@ -46,25 +46,10 @@ www.example.com. IN A
 SECTION ANSWER
 ENTRY_END

-; enough to pass by the TTL of the servfail answer in cache
+; enough to expire the servfail answer in cache
 STEP 50 TIME_PASSES ELAPSE 5

-; this query triggers a prefetch
-STEP 210 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-STEP 220 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA SERVFAIL
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-ENTRY_END
+; Expired SERVFAILS are no longer served from Unbound

 ; this query gets the 0ttl answer
 STEP 230 QUERY
@@ -76,7 +61,7 @@ ENTRY_END

 STEP 240 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all
+MATCH all ttl
 REPLY QR RD RA NOERROR
 SECTION QUESTION
 www.example.com. IN A
@@ -2,6 +2,7 @@
 ; config options go here.
 server:
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 forward-zone: name: "." forward-addr: 216.0.0.1
 CONFIG_END

@@ -10,6 +10,7 @@ server:
 	username: ""
 	do-not-query-localhost: no
 	minimal-responses: no
+	iter-scrub-promiscuous: no
 	rrset-roundrobin: no
 forward-zone:
 	name: "."
@@ -5,6 +5,7 @@ server:
 	; is fine for that, not removed by minimal-responses.
 	access-control: 127.0.0.1 allow_snoop
 	minimal-responses: yes
+	iter-scrub-promiscuous: no
 forward-zone: name: "." forward-addr: 216.0.0.1
 CONFIG_END

@@ -9,6 +9,7 @@ server:
 	qname-minimisation: "no"
 	# test that default value of harden-dnssec-stripped is still yes.
 	fake-sha1: yes
+	iter-scrub-promiscuous: no
 	trust-anchor-signaling: no
 	access-control: 127.0.0.1 allow_snoop
 	module-config: "ipsecmod validator iterator"
@@ -11,6 +11,7 @@ server:
 	ipsecmod-enabled: no
 	qname-minimisation: "no"
 	minimal-responses: no
+	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
--- a/Show More
+++ b/Show More