Fix function signature for compiling test

distribute can send out responses tsig signed
Forgot to include util/allow_response_list.[ch]
2026-08-17 21:25:50 +02:00 · 2025-11-03 11:15:11 +01:00 · 2025-11-01 14:32:09 +01:00 · 2025-11-01 13:12:35 +01:00 · 2025-11-01 12:52:48 +01:00 · 2025-10-31 15:45:34 +01:00
123 changed files with 63002 additions and 2674 deletions
@@ -175,38 +175,8 @@ jobs:
    steps:
      - uses: actions/checkout@v4
        with:
-          submodules: recursive
+          submodules: false
          persist-credentials: false
-      - name: test_windows_configure
-        if: ${{ matrix.test_windows == 'yes' }}
-        shell: bash
-        run: |
-          # The run starts with mount points for /c, /d, and
-          # C:/Program Files/Git on /
-          # C:/Program Files/Git/usr/bin on /bin
-          # C:/Users/RUNNER~1/AppData/Local/Temp on /tmp
-          echo "mount"
-          mount || echo "ignored"
-          echo "mount -o bind /c/msys64/usr /usr"
-          mount -o bind /c/msys64/usr /usr || echo "ignored"
-          # Now there is:
-          # C:/msys64 on /
-          # C:/msys64/usr/bin on /bin
-          # And those mount points should go away for the next 'run:' shell.
-          echo "mount"
-          mount || echo "ignored"
-          # probably installs to C:\msys64\usr\bin\bash.exe
-          echo "pacman -S --noconfirm autotools"
-          C:/msys64/usr/bin/pacman -S --noconfirm autotools
-          echo "rm -f aclocal.m4"
-          rm -f aclocal.m4
-          # The paths are mounted, so that /c/msys64/usr/share/autoconf-..,
-          # /c/msys64/usr/share/aclocal-.., /c/msys64/usr/share/automake-..
-          # are in /usr. Also for /usr/bin, autoreconf is from
-          # /c/msys64/usr/bin.
-          echo "autoreconf -fi"
-          #PATH="/c/msys64/usr/bin:$PATH" autoreconf -fi || echo "ignored"
-          autoreconf -fi
      - name: test_windows
        if: ${{ matrix.test_windows == 'yes' }}
        env:
@@ -219,9 +189,6 @@ jobs:
          cd ..
          export prepath=`pwd`
          echo prepath=${prepath}
-          # The mount should have the git directories.
-          echo "mount"
-          mount || echo "ignored"
          echo "choco install winflexbison3"
          choco install winflexbison3
          echo 'LEX="win_flex"'
@@ -239,7 +206,7 @@ jobs:
          #sed -e 's/use Pod::Usage//' < Configure > Configure.fix
          # ./Configure.fix no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl"
          # pacman is used to install for msys2, with
-          # C:/msys64/usr/bin/pacman -S --noconfirm perl
+          # C:/msys64/usr/bin/pacman -S perl
          echo "C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix=\""$prepath/openssl"\" PERL=\"C:/msys64/usr/bin/perl\""
          C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl" PERL="C:/msys64/usr/bin/perl"
          # make the libs only, build faster
@@ -328,8 +295,6 @@ jobs:
          ./contrib/android/install_expat.sh
          echo "::endgroup::"
          echo "::group::configure"
-          echo "autoreconf -fi"
-          autoreconf -fi
          echo "./configure ${CONFIG_OPTS}"
          ./configure ${CONFIG_OPTS}
          echo "::endgroup::"
@@ -349,7 +314,6 @@ jobs:
          IOS_CPU: ${{ matrix.IOS_CPU }}
        run: |
          #(already installed) ./contrib/ios/install_tools.sh
-          brew install autoconf automake libtool make
          export AUTOTOOLS_BUILD="$(./config.guess)"
          echo AUTOTOOLS_BUILD=${AUTOTOOLS_BUILD}
          export IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
@@ -371,8 +335,6 @@ jobs:
          ./contrib/ios/install_expat.sh
          echo "::endgroup::"
          echo "::group::configure"
-          echo "autoreconf -fi"
-          autoreconf -fi
          echo "./configure ${CONFIG_OPTS}"
          ./configure ${CONFIG_OPTS}
          echo "::endgroup::"
@@ -398,12 +360,10 @@ jobs:
          cpu_count: 2
          run: |
            set -e -x
-            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y autoconf automake libtool pkgconf openssl libevent expat; fi
-            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add autoconf-2.71 automake-1.16.5 libtool pkgconf libevent; export AUTOCONF_VERSION="2.71"; export AUTOMAKE_VERSION="1.16"; fi
-            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install autoconf automake libtool pkgconf libevent; export LDFLAGS="-Wl,--rpath=/usr/pkg/lib"; fi
+            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y openssl libevent expat; fi
+            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add libevent; fi
+            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install libevent; fi
            echo "::group::configure"
-            rm -f aclocal.m4
-            autoreconf -fi
            ./configure ${{ matrix.cross_platform_config }}
            echo "::endgroup::"
            echo "::group::make"
@@ -417,15 +377,10 @@ jobs:
        run: sudo apt-get install libevent-dev
      - name: install expat
        if: ${{ matrix.install_expat == 'yes' }}
-        run: |
-          brew install expat
-          brew install autoconf automake libtool make
+        run: brew install expat
      - name: configure
        if: ${{ matrix.config != 'no' }}
-        run: |
-          if test `uname` = "Linux"; then sudo apt-get install autoconf automake libtool make; fi
-          autoreconf -fi
-          ./configure ${{ matrix.config }}
+        run: ./configure ${{ matrix.config }}
      - name: make
        if: ${{ matrix.make != 'no' }}
        run: make
@@ -14,14 +14,9 @@ jobs:
    steps:
    - uses: actions/checkout@v4
      with:
-        submodules: recursive
        persist-credentials: false
-    - name: install packages
-      run: sudo apt-get install autoconf automake libtool make
    - name: configure
-      run: |
-        autoreconf -fi
-        ./configure --enable-debug
+      run: ./configure --enable-debug
    - name: make
      run: make
    - name: make test
@@ -3,17 +3,11 @@
 /.libs/
 /.source
 /Makefile
-/aclocal.m4
 /autom4te.cache/
-/config.guess
 /config.h
-/config.h.in
 /config.h.in~
 /config.log
 /config.status
-/config.sub
-/configure
-/configure~
 /dnstap/dnstap_config.h
 /dnscrypt/dnscrypt_config.h
 /util/configlexer.c
@@ -28,10 +22,8 @@
 /doc/unbound-host.1
 /doc/unbound.8
 /doc/unbound.conf.5
-/install-sh
 /libtool
 /libunbound.la
-/ltmain.sh
 /_unbound.la
 /smallapp/unbound-control-setup.sh
 /unbound
@@ -1,3 +0,0 @@
-[submodule "simdzone"]
-	path = simdzone
-	url = https://github.com/NLnetLabs/simdzone.git
@@ -1,5 +1,4 @@
 Unbound README
-* From source repository: git submodule update --init && autoreconf -fi
 * ./configure && make && make install
 * You can use libevent if you want. libevent is useful when using 
  many (10000) outgoing ports. By default max 256 ports are opened at
@@ -19,14 +19,6 @@ You can learn more about Unbound by reading our
 Make sure you have the C toolchain, OpenSSL and its include files, and libexpat
 installed.
 If building from the repository source you also need flex and bison installed.
-If building from the repository source, also init the git submodule and
-create the configure script with:
-
-```
-git submodule update --init
-autoreconf -fi
-```
-
 Unbound can be compiled and installed using:

 ```
@@ -2,9 +2,7 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 51
-# 2025-11-06 Fix ACX_CHECK_NONSTRING_ATTRIBUTE to reject clang, that prints
-#	     a warning for 'unknown attribute' when nonstring is used.
+# Version 50
 # 2025-09-29 add ac_cv_func_malloc_0_nonnull as a cache value for the malloc(0)
 #            check by ACX_FUNC_MALLOC.
 # 2025-09-29 add ACX_CHECK_NONSTRING_ATTRIBUTE, AHX_CONFIG_NONSTRING_ATTRIBUTE.
@@ -537,9 +535,6 @@ dnl result in HAVE_ATTR_NONSTRING.
 dnl Make sure you include AHX_CONFIG_NONSTRING_ATTRIBUTE also.
 AC_DEFUN([ACX_CHECK_NONSTRING_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
-AC_REQUIRE([ACX_CHECK_ERROR_FLAGS])
-BAKCFLAGS="$CFLAGS"
-CFLAGS="$CFLAGS $ERRFLAG"
 AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "nonstring" attribute)
 AC_CACHE_VAL(ac_cv_c_nonstring_attribute,
 [ac_cv_c_nonstring_attribute=no
@@ -551,7 +546,6 @@ struct test {
   struct test t = { "1" };
   (void) t;
 ]])],[ac_cv_c_nonstring_attribute="yes"],[ac_cv_c_nonstring_attribute="no"])
-CFLAGS="$BAKCFLAGS"
 ])

 dnl Setup ATTR_NONSTRING config.h parts.
@@ -38,9 +38,6 @@
 #ifndef UB_ON_WINDOWS
 #include <sys/mman.h>
 #endif
-#ifdef __QNX__
-#include "util/log.h"
-#endif /* __QNX__ */

 #define KEYSTREAM_ONLY
 #include "chacha_private.h"
@@ -190,11 +187,7 @@ _rs_stir(void)
 		if(errno != ENOSYS ||
 			fallback_getentropy_urandom(rnd, sizeof rnd) == -1) {
 #ifdef SIGKILL
-#ifndef __QNX__
 			raise(SIGKILL);
-#else /* !__QNX__ */
-			fatal_exit("failed to getentropy");
-#endif /* __QNX__ */
 #else
 			exit(9); /* windows */
 #endif
@@ -29,9 +29,7 @@
 #include <sys/param.h>
 #include <sys/ioctl.h>
 #include <sys/resource.h>
-#ifndef __QNX__
 #include <sys/syscall.h>
-#endif /* !__QNX__ */
 #ifdef SYS__sysctl
 #include <linux/sysctl.h>
 #endif
@@ -44,9 +42,7 @@
 #include <stdlib.h>
 #include <stdint.h>
 #include <stdio.h>
-#ifndef __QNX__
 #include <link.h>
-#endif /* __QNX__ */
 #include <termios.h>
 #include <fcntl.h>
 #include <signal.h>
@@ -64,14 +60,12 @@
 #define SHA512_Final(r, c)	sha512_digest(c, SHA512_DIGEST_SIZE, r)
 #endif

-#ifndef __QNX__
 #include <linux/types.h>
 #include <linux/random.h>
 #ifdef HAVE_GETAUXVAL
 #include <sys/auxv.h>
 #endif
 #include <sys/vfs.h>
-#endif /* !__QNX__ */
 #ifndef MAP_ANON
 #define MAP_ANON MAP_ANONYMOUS
 #endif
@@ -100,10 +94,8 @@ static int getentropy_urandom(void *buf, size_t len);
 #ifdef SYS__sysctl
 static int getentropy_sysctl(void *buf, size_t len);
 #endif
-#ifndef __QNX__
 static int getentropy_fallback(void *buf, size_t len);
 static int getentropy_phdr(struct dl_phdr_info *info, size_t size, void *data);
-#endif /* !__QNX__ */

 int
 getentropy(void *buf, size_t len)
@@ -186,7 +178,6 @@ getentropy(void *buf, size_t len)
 	 * sysctl ABI, or consider providing a new failsafe API which
 	 * works in a chroot or when file descriptors are exhausted.
 	 */
-#ifndef __QNX__
 #undef FAIL_INSTEAD_OF_TRYING_FALLBACK
 #ifdef FAIL_INSTEAD_OF_TRYING_FALLBACK
 	raise(SIGKILL);
@@ -194,9 +185,6 @@ getentropy(void *buf, size_t len)
 	ret = getentropy_fallback(buf, len);
 	if (ret != -1)
 		return (ret);
-#else /* !__QNX__ */
-	fatal_exit("failed to read from /dev/urandom");
-#endif /* __QNX__ */

 	errno = EIO;
 	return (ret);
@@ -226,11 +214,7 @@ getentropy_urandom(void *buf, size_t len)
 {
 	struct stat st;
 	size_t i;
-#ifndef __QNX__
 	int fd, cnt, flags;
-#else /* !__QNX__ */
-	int fd, flags;
-#endif /* __QNX__ */
 	int save_errno = errno;

 start:
@@ -257,12 +241,10 @@ start:
 		close(fd);
 		goto nodevrandom;
 	}
-#ifndef __QNX__
 	if (ioctl(fd, RNDGETENTCNT, &cnt) == -1) {
 		close(fd);
 		goto nodevrandom;
 	}
-#endif /* !__QNX__ */
 	for (i = 0; i < len; ) {
 		size_t wanted = len - i;
 		ssize_t ret = read(fd, (char *)buf + i, wanted);
@@ -283,7 +265,6 @@ nodevrandom:
 	return (-1);
 }

-#ifndef __QNX__
 #ifdef SYS__sysctl
 static int
 getentropy_sysctl(void *buf, size_t len)
@@ -556,4 +537,3 @@ getentropy_fallback(void *buf, size_t len)
 	errno = save_errno;
 	return (0);		/* satisfied */
 }
-#endif /* !__QNX__ */
@@ -12,14 +12,14 @@ sinclude(dnscrypt/dnscrypt.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[24])
-m4_define([VERSION_MICRO],[3])
+m4_define([VERSION_MICRO],[2])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=36
+LIBUNBOUND_REVISION=35
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -122,7 +122,6 @@ LIBUNBOUND_AGE=1
 # 1.24.0 had 9:33:1
 # 1.24.1 had 9:34:1
 # 1.24.2 had 9:35:1
-# 1.24.3 had 9:36:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -177,12 +176,6 @@ else
 	else on_mingw="no"; fi
 fi

-dnl install the install-sh file with libtoolize -ci, and autoreconf -fi.
-AC_REQUIRE_AUX_FILE([install-sh])
-if test ! -f install-sh; then
-    AC_MSG_WARN([./install-sh is missing, use `libtoolize -ci` or `autoreconf -fi` to add it])
-fi
-
 #
 # Determine configuration file
 # the eval is to evaluate shell expansion twice
@@ -368,14 +361,7 @@ AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "noreturn" attribu
 AC_CACHE_VAL(ac_cv_c_noreturn_attribute,
 [ac_cv_c_noreturn_attribute=no
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h>
-#ifdef STDC_HEADERS
-# include <stdlib.h>
-#else
-# ifdef HAVE_STDLIB_H
-#  include <stdlib.h>
-# endif
-#endif
-__attribute__((noreturn)) void f(int x) { printf("%d", x); exit(1); }
+__attribute__((noreturn)) void f(int x) { printf("%d", x); }
 ]], [[
   f(1);
 ]])],[ac_cv_c_noreturn_attribute="yes"],[ac_cv_c_noreturn_attribute="no"])
@@ -1014,7 +1000,7 @@ else
 	AC_MSG_RESULT([no])
 fi
 AC_CHECK_HEADERS([openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h openssl/core_names.h openssl/param_build.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex])
+AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex SSL_CTX_set_tmp_ecdh HMAC_CTX_new EVP_MAC_CTX_new])

 # these check_funcs need -lssl
 BAKLIBS="$LIBS"
@@ -2042,9 +2028,6 @@ dt_DNSTAP([$UNBOUND_RUN_DIR/dnstap.sock],
        AC_SUBST([ENABLE_DNSTAP], [0])
    ]
 )
-dnstap_config="dnstap/dnstap_config.h.tmp:dnstap/dnstap_config.h.in"
-dnstap_config_tmp="dnstap/dnstap_config.h.tmp"
-dnstap_config_out="dnstap/dnstap_config.h"

 # check for dnscrypt if requested
 dnsc_DNSCRYPT([
@@ -2499,34 +2482,6 @@ AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
 AX_BUILD_DATE_EPOCH(date, [[%b %e, %Y]])
 AC_SUBST(date)

-AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh $dnstap_config dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
+AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
 AC_CONFIG_HEADERS([config.h])
-
-# Arguments introduced specifically for simdzone.
-AC_ARG_ENABLE(westmere, AS_HELP_STRING([--disable-westmere], [Disable Westmere (SSE4.2) parser kernel]))
-AC_ARG_ENABLE(haswell, AS_HELP_STRING([--disable-haswell], [Disable Haswell (AVX2) parser kernel]))
-if test ! -f simdzone/configure.ac; then AC_MSG_ERROR([There is no "simdzone/configure.ac" file. The simdzone directory has not been fetched, perhaps get it with 'git submodule update --init'.]); fi
-if test ! -f simdzone/configure; then AC_MSG_ERROR([There is no "simdzone/configure" file. The simdzone directory has no configure script file, perhaps run 'autoreconf -fi'.]); fi
-AC_CONFIG_SUBDIRS([simdzone])
-
 AC_OUTPUT
-# Pick up the objects for simdzone.
-SIMDZONE_OBJ=`(cd simdzone; make list_objs) | sed -e 's?src?simdzone/src?g'`
-AC_SUBST(SIMDZONE_OBJ)
-sed -e 's?^SIMDZONE_OBJ=.*$?SIMDZONE_OBJ='"$SIMDZONE_OBJ"'?' < Makefile > Makefile.tmp.$$
-mv -f Makefile.tmp.$$ Makefile
-# If dnstap config has changed, overwrite it.
-if test -n "$dnstap_config"; then
-	if test ! -f "$dnstap_config_out"; then
-		mv "$dnstap_config_tmp" "$dnstap_config_out" || AC_MSG_ERROR([Could not create $dnstap_config_out])
-	else if diff "$dnstap_config_out" "$dnstap_config_tmp" >/dev/null 2>&1; then
-		if test "x$opt_dnstap" != "xno"; then
-		  AC_MSG_NOTICE([In $srcdir: $dnstap_config_out is unchanged])
-		fi
-		rm -f "$dnstap_config_tmp"
-	else
-		rm -f "$dnstap_config_out"
-		mv "$dnstap_config_tmp" "$dnstap_config_out" || AC_MSG_ERROR([Could not create $dnstap_config_out])
-	  fi
-	fi
-fi
@@ -77,6 +77,7 @@
 #include "util/storage/lookup3.h"
 #include "util/storage/slabhash.h"
 #include "util/tcp_conn_limit.h"
+#include "util/allow_response_list.h"
 #include "util/edns.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/rrset.h"
@@ -89,6 +90,7 @@
 #include "util/random.h"
 #include "util/tube.h"
 #include "util/net_help.h"
+#include "util/tsig.h"
 #include "sldns/keyraw.h"
 #include "respip/respip.h"
 #include "iterator/iter_fwd.h"
@@ -297,6 +299,16 @@ daemon_init(void)
 		free(daemon);
 		return NULL;
 	}
+	daemon->arl = arl_list_create();
+	if(!daemon->arl) {
+		acl_list_delete(daemon->acl_interface);
+		acl_list_delete(daemon->acl);
+		tcl_list_delete(daemon->tcl);
+		edns_known_options_delete(daemon->env);
+		free(daemon->env);
+		free(daemon);
+		return NULL;
+	}
 	listen_setup_locks();
 	if(gettimeofday(&daemon->time_boot, NULL) < 0)
 		log_err("gettimeofday: %s", strerror(errno));
@@ -305,6 +317,7 @@ daemon_init(void)
 		acl_list_delete(daemon->acl_interface);
 		acl_list_delete(daemon->acl);
 		tcl_list_delete(daemon->tcl);
+		arl_list_delete(daemon->arl);
 		edns_known_options_delete(daemon->env);
 		free(daemon->env);
 		free(daemon);
@@ -315,11 +328,24 @@ daemon_init(void)
 		acl_list_delete(daemon->acl_interface);
 		acl_list_delete(daemon->acl);
 		tcl_list_delete(daemon->tcl);
+		arl_list_delete(daemon->arl);
 		edns_known_options_delete(daemon->env);
 		free(daemon->env);
 		free(daemon);
 		return NULL;
 	}
+	if(!(daemon->env->tsig_key_table = tsig_key_table_create())) {
+		auth_zones_delete(daemon->env->auth_zones);
+		acl_list_delete(daemon->acl_interface);
+		acl_list_delete(daemon->acl);
+		tcl_list_delete(daemon->tcl);
+		arl_list_delete(daemon->arl);
+		edns_known_options_delete(daemon->env);
+		edns_strings_delete(daemon->env->edns_strings);
+		free(daemon->env);
+		free(daemon);
+		return NULL;
+	}
 	return daemon;	
 }

@@ -558,11 +584,9 @@ daemon_create_workers(struct daemon* daemon)
 	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);

 #ifdef HAVE_NGTCP2
-	if (cfg_has_quic(daemon->cfg)) {
-		daemon->doq_table = doq_table_create(daemon->cfg, daemon->rand);
-		if(!daemon->doq_table)
-			fatal_exit("could not create doq_table: out of memory");
-	}
+	daemon->doq_table = doq_table_create(daemon->cfg, daemon->rand);
+	if(!daemon->doq_table)
+		fatal_exit("could not create doq_table: out of memory");
 #endif
 	
 	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
@@ -633,25 +657,6 @@ static void close_other_pipes(struct daemon* daemon, int thr)
 }
 #endif /* THREADS_DISABLED */

-/**
- * Function to set the thread local log ID.
- * Either the internal thread number, or the LWP ID on Linux based on
- * configuration.
- */
-static void
-set_log_thread_id(struct worker* worker, struct config_file* cfg)
-{
-	(void)cfg;
-	log_assert(worker);
-#if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
-	worker->thread_tid = gettid();
-	if(cfg->log_thread_id)
-		log_thread_set(&worker->thread_tid);
-	else
-#endif
-		log_thread_set(&worker->thread_num);
-}
-
 /**
 * Function to start one thread. 
 * @param arg: user argument.
@@ -662,7 +667,7 @@ thread_start(void* arg)
 {
 	struct worker* worker = (struct worker*)arg;
 	int port_num = 0;
-	set_log_thread_id(worker, worker->daemon->cfg);
+	log_thread_set(&worker->thread_num);
 	ub_thread_blocksigs();
 #ifdef THREADS_DISABLED
 	/* close pipe ends used by main */
@@ -750,6 +755,8 @@ daemon_fork(struct daemon* daemon)
 		fatal_exit("Could not setup interface control list");
 	if(!tcl_list_apply_cfg(daemon->tcl, daemon->cfg))
 		fatal_exit("Could not setup TCP connection limits");
+	if(!arl_list_apply_cfg(daemon->arl, daemon->cfg))
+		fatal_exit("Could not setup allow response list");
 	if(daemon->cfg->dnscrypt) {
 #ifdef USE_DNSCRYPT
 		daemon->dnscenv = dnsc_create();
@@ -792,12 +799,17 @@ daemon_fork(struct daemon* daemon)
 	daemon->use_response_ip = !respip_set_is_empty(
 		daemon->env->respip_set) || have_view_respip_cfg;

+	/* setup tsig keys */
+	if(!tsig_key_table_apply_cfg(daemon->env->tsig_key_table, daemon->cfg))
+		fatal_exit("Could not set up TSIG keys");
+
 	/* setup modules */
 	daemon_setup_modules(daemon);

 	/* read auth zonefiles */
 	if(!auth_zones_apply_cfg(daemon->env->auth_zones, daemon->cfg, 1,
-		&daemon->use_rpz, daemon->env, &daemon->mods))
+		&daemon->use_rpz, daemon->env, &daemon->mods,
+		daemon->env->tsig_key_table))
 		fatal_exit("auth_zones could not be setup");

 	/* Set-up EDNS strings */
@@ -822,13 +834,9 @@ daemon_fork(struct daemon* daemon)
 		fatal_exit("RPZ requires the respip module");

 	/* first create all the worker structures, so we can pass
-	 * them to the newly created threads.
+	 * them to the newly created threads. 
 	 */
 	daemon_create_workers(daemon);
-	/* Set it for the first (main) worker since it does not take part in
-	 * the thread_start() procedure.
-	 */
-	set_log_thread_id(daemon->workers[0], daemon->cfg);

 #if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
 	/* in libev the first inited base gets signals */
@@ -942,10 +950,8 @@ daemon_cleanup(struct daemon* daemon)
 	daemon->dnscenv = NULL;
 #endif
 #ifdef HAVE_NGTCP2
-	if (daemon->doq_table) {
-		doq_table_delete(daemon->doq_table);
-		daemon->doq_table = NULL;
-	}
+	doq_table_delete(daemon->doq_table);
+	daemon->doq_table = NULL;
 #endif
 	daemon->cfg = NULL;
 }
@@ -971,12 +977,14 @@ daemon_delete(struct daemon* daemon)
 		edns_known_options_delete(daemon->env);
 		edns_strings_delete(daemon->env->edns_strings);
 		auth_zones_delete(daemon->env->auth_zones);
+		tsig_key_table_delete(daemon->env->tsig_key_table);
 	}
 	ub_randfree(daemon->rand);
 	alloc_clear(&daemon->superalloc);
 	acl_list_delete(daemon->acl);
 	acl_list_delete(daemon->acl_interface);
 	tcl_list_delete(daemon->tcl);
+	arl_list_delete(daemon->arl);
 	cookie_secrets_delete(daemon->cookie_secrets);
 	listen_desetup_locks();
 	free(daemon->chroot);
@@ -133,6 +133,8 @@ struct daemon {
 	struct acl_list* acl_interface;
 	/** TCP connection limit, limit connections from client IPs */
 	struct tcl_list* tcl;
+	/** allow response list, to cache responses send by client IPs */
+	struct arl_list* arl;
 	/** local authority zones */
 	struct local_zones* local_zones;
 	/** last time of statistics printout */
@@ -97,7 +97,9 @@
 #include "sldns/sbuffer.h"
 #include "util/timeval_func.h"
 #include "util/tcp_conn_limit.h"
+#include "util/allow_response_list.h"
 #include "util/edns.h"
+#include "util/tsig.h"
 #ifdef USE_CACHEDB
 #include "cachedb/cachedb.h"
 #endif
@@ -801,8 +803,6 @@ print_stats(RES* ssl, const char* nm, struct ub_stats_info* s)
 		(unsigned long)s->svr.num_queries_cookie_invalid)) return 0;
 	if(!ssl_printf(ssl, "%s.num.queries_discard_timeout"SQ"%lu\n", nm,
 		(unsigned long)s->svr.num_queries_discard_timeout)) return 0;
-	if(!ssl_printf(ssl, "%s.num.queries_replyaddr_limit"SQ"%lu\n", nm,
-		(unsigned long)s->svr.num_queries_replyaddr_limit)) return 0;
 	if(!ssl_printf(ssl, "%s.num.queries_wait_limit"SQ"%lu\n", nm,
 		(unsigned long)s->svr.num_queries_wait_limit)) return 0;
 	if(!ssl_printf(ssl, "%s.num.cachehits"SQ"%lu\n", nm,
@@ -847,8 +847,6 @@ print_stats(RES* ssl, const char* nm, struct ub_stats_info* s)
 		(unsigned long)s->mesh_num_states)) return 0;
 	if(!ssl_printf(ssl, "%s.requestlist.current.user"SQ"%lu\n", nm,
 		(unsigned long)s->mesh_num_reply_states)) return 0;
-	if(!ssl_printf(ssl, "%s.requestlist.current.replies"SQ"%lu\n", nm,
-		(unsigned long)s->mesh_num_reply_addrs)) return 0;
 #ifndef S_SPLINT_S
 	sumwait.tv_sec = s->mesh_replies_sum_wait_sec;
 	sumwait.tv_usec = s->mesh_replies_sum_wait_usec;
@@ -4649,6 +4647,10 @@ struct fast_reload_construct {
 	struct acl_list* acl_interface;
 	/** construct for tcp connection limit */
 	struct tcl_list* tcl;
+	/** construct for allow response list */
+	struct arl_list* arl;
+	/** tsig key table */
+	struct tsig_key_table* tsig_key_table;
 	/** construct for local zones */
 	struct local_zones* local_zones;
 	/** if there is response ip configuration in use */
@@ -5035,6 +5037,8 @@ fr_construct_clear(struct fast_reload_construct* ct)
 	acl_list_delete(ct->acl);
 	acl_list_delete(ct->acl_interface);
 	tcl_list_delete(ct->tcl);
+	arl_list_delete(ct->arl);
+	tsig_key_table_delete(ct->tsig_key_table);
 	edns_strings_delete(ct->edns_strings);
 	anchors_delete(ct->anchors);
 	views_delete(ct->views);
@@ -5137,6 +5141,8 @@ getmem_config_auth(struct config_auth* p)
 			+ getmem_config_strlist(s->masters)
 			+ getmem_config_strlist(s->urls)
 			+ getmem_config_strlist(s->allow_notify)
+			+ getmem_config_str2list(s->masters_tsig)
+			+ getmem_config_str2list(s->allow_notify_tsig)
 			+ getmem_str(s->zonefile)
 			+ s->rpz_taglistlen
 			+ getmem_str(s->rpz_action_override)
@@ -5231,6 +5237,7 @@ config_file_getmem(struct config_file* cfg)
 	m += getmem_config_str3list(cfg->acl_tag_datas);
 	m += getmem_config_str2list(cfg->acl_view);
 	m += getmem_config_str2list(cfg->interface_actions);
+	m += getmem_config_str2list(cfg->allow_response_list);
 	m += getmem_config_strbytelist(cfg->interface_tags);
 	m += getmem_config_str3list(cfg->interface_tag_actions);
 	m += getmem_config_str3list(cfg->interface_tag_datas);
@@ -5300,10 +5307,12 @@ fr_printmem(struct fast_reload_thread* fr,
 	mem += auth_zones_get_mem(ct->auth_zones);
 	mem += forwards_get_mem(ct->fwds);
 	mem += hints_get_mem(ct->hints);
+	mem += tsig_key_table_get_mem(ct->tsig_key_table);
 	mem += local_zones_get_mem(ct->local_zones);
 	mem += acl_list_get_mem(ct->acl);
 	mem += acl_list_get_mem(ct->acl_interface);
 	mem += tcl_list_get_mem(ct->tcl);
+	mem += arl_list_get_mem(ct->arl);
 	mem += edns_strings_get_mem(ct->edns_strings);
 	mem += anchors_get_mem(ct->anchors);
 	mem += sizeof(*ct->oldcfg);
@@ -5388,6 +5397,12 @@ xfr_auth_master_equal(struct auth_master* m1, struct auth_master* m2)
 		return 0;
 	if(m1->port != m2->port)
 		return 0;
+
+	if((m1->tsig_key_name && !m2->tsig_key_name) || (!m1->tsig_key_name && m2->tsig_key_name))
+		return 0;
+	if(m1->tsig_key_name && m2->tsig_key_name && strcmp(m1->tsig_key_name, m2->tsig_key_name) != 0)
+		return 0;
+
 	return 1;
 }

@@ -5587,12 +5602,35 @@ fr_construct_from_config(struct fast_reload_thread* fr,
 	if(fr_poll_for_quit(fr))
 		return 1;

+	if(!(ct->arl = arl_list_create())) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(!arl_list_apply_cfg(ct->arl, newcfg)) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(fr_poll_for_quit(fr))
+		return 1;
+
+	if(!(ct->tsig_key_table = tsig_key_table_create())) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(!tsig_key_table_apply_cfg(ct->tsig_key_table, newcfg)) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(fr_poll_for_quit(fr))
+		return 1;
+
 	if(!(ct->auth_zones = auth_zones_create())) {
 		fr_construct_clear(ct);
 		return 0;
 	}
 	if(!auth_zones_apply_cfg(ct->auth_zones, newcfg, 1, &ct->use_rpz,
-		fr->worker->daemon->env, &fr->worker->daemon->mods)) {
+		fr->worker->daemon->env, &fr->worker->daemon->mods,
+		ct->tsig_key_table)) {
 		fr_construct_clear(ct);
 		return 0;
 	}
@@ -5922,6 +5960,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(forwards);
 	COPY_VAR_ptr(auths);
 	COPY_VAR_ptr(views);
+	COPY_VAR_ptr(tsig_keys);
 	COPY_VAR_ptr(donotqueryaddrs);
 #ifdef CLIENT_SUBNET
 	COPY_VAR_ptr(client_subnet);
@@ -5972,7 +6011,6 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_int(log_servfail);
 	COPY_VAR_ptr(log_identity);
 	COPY_VAR_int(log_destaddr);
-	COPY_VAR_int(log_thread_id);
 	COPY_VAR_int(hide_identity);
 	COPY_VAR_int(hide_version);
 	COPY_VAR_int(hide_trustanchor);
@@ -6040,6 +6078,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	*/
 	COPY_VAR_ptr(acl_view);
 	COPY_VAR_ptr(interface_actions);
+	COPY_VAR_ptr(allow_response_list);
 	/* These reference tags
 	COPY_VAR_ptr(interface_tags);
 	COPY_VAR_ptr(interface_tag_actions);
@@ -6182,9 +6221,6 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(ipset_name_v6);
 #endif
 	COPY_VAR_int(ede);
-	COPY_VAR_int(iter_scrub_ns);
-	COPY_VAR_int(iter_scrub_cname);
-	COPY_VAR_int(max_global_quota);
 	COPY_VAR_int(iter_scrub_promiscuous);
 }
 #endif /* ATOMIC_POINTER_LOCK_FREE && HAVE_LINK_ATOMIC_STORE */
@@ -6364,6 +6400,7 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 		lock_basic_lock(&ct->anchors->lock);
 		lock_basic_lock(&env->anchors->lock);
 	}
+	lock_rw_wrlock(&env->tsig_key_table->lock);

 #if defined(ATOMIC_POINTER_LOCK_FREE) && defined(HAVE_LINK_ATOMIC_STORE)
 	if(fr->fr_nopause) {
@@ -6400,6 +6437,9 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 	acl_list_swap_tree(daemon->acl, ct->acl);
 	acl_list_swap_tree(daemon->acl_interface, ct->acl_interface);
 	tcl_list_swap_tree(daemon->tcl, ct->tcl);
+	arl_list_swap_tree(daemon->arl, ct->arl);
+	tsig_key_table_swap_tree(daemon->env->tsig_key_table,
+		ct->tsig_key_table);
 	local_zones_swap_tree(daemon->local_zones, ct->local_zones);
 	respip_set_swap_tree(env->respip_set, ct->respip_set);
 	daemon->use_response_ip = ct->use_response_ip;
@@ -6446,6 +6486,7 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 		lock_basic_unlock(&ct->anchors->lock);
 		lock_basic_unlock(&env->anchors->lock);
 	}
+	lock_rw_unlock(&env->tsig_key_table->lock);

 	return 1;
 }
@@ -6635,14 +6676,7 @@ static void* fast_reload_thread_main(void* arg)
 	struct fast_reload_thread* fast_reload_thread = (struct fast_reload_thread*)arg;
 	struct timeval time_start, time_read, time_construct, time_reload,
 		time_end;
-
-#if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
-	fast_reload_thread->thread_tid = gettid();
-	if(fast_reload_thread->thread_tid_log)
-		log_thread_set(&fast_reload_thread->thread_tid);
-	else
-#endif
-		log_thread_set(&fast_reload_thread->threadnum);
+	log_thread_set(&fast_reload_thread->threadnum);

 	verbose(VERB_ALGO, "start fast reload thread");
 	if(fast_reload_thread->fr_verb >= 1) {
@@ -7030,9 +7064,6 @@ fast_reload_thread_setup(struct worker* worker, int fr_verb, int fr_nopause,
 	lock_basic_init(&fr->fr_output_lock);
 	lock_protect(&fr->fr_output_lock, fr->fr_output,
 		sizeof(*fr->fr_output));
-#ifdef HAVE_GETTID
-	fr->thread_tid_log = worker->env.cfg->log_thread_id;
-#endif
 	return 1;
 }

@@ -7630,41 +7661,6 @@ fr_worker_pickup_outside_network(struct worker* worker)
 	}
 }

-#ifdef USE_DNSTAP
-/** Fast reload, the worker picks up changes to DNSTAP configuration. */
-static void
-fr_worker_pickup_dnstap_changes(struct worker* worker)
-{
-	struct dt_env* w_dtenv = &worker->dtenv;
-	struct dt_env* d_dtenv = worker->daemon->dtenv;
-	log_assert(d_dtenv != NULL || !worker->daemon->cfg->dnstap);
-	if(d_dtenv == NULL) {
-		/* There is no environment when DNSTAP was not enabled
-		 * in the configuration. */
-		return;
-	}
-	w_dtenv->identity = d_dtenv->identity;
-	w_dtenv->len_identity = d_dtenv->len_identity;
-	w_dtenv->version = d_dtenv->version;
-	w_dtenv->len_version = d_dtenv->len_version;
-	w_dtenv->log_resolver_query_messages =
-		d_dtenv->log_resolver_query_messages;
-	w_dtenv->log_resolver_response_messages =
-		d_dtenv->log_resolver_response_messages;
-	w_dtenv->log_client_query_messages =
-		d_dtenv->log_client_query_messages;
-	w_dtenv->log_client_response_messages =
-		d_dtenv->log_client_response_messages;
-	w_dtenv->log_forwarder_query_messages =
-		d_dtenv->log_forwarder_query_messages;
-	w_dtenv->log_forwarder_response_messages =
-		d_dtenv->log_forwarder_response_messages;
-	lock_basic_lock(&d_dtenv->sample_lock);
-	w_dtenv->sample_rate = d_dtenv->sample_rate;
-	lock_basic_unlock(&d_dtenv->sample_lock);
-}
-#endif /* USE_DNSTAP */
-
 void
 fast_reload_worker_pickup_changes(struct worker* worker)
 {
@@ -7693,9 +7689,6 @@ fast_reload_worker_pickup_changes(struct worker* worker)
 	worker->env.cachedb_enabled = worker->daemon->env->cachedb_enabled;
 #endif
 	fr_worker_pickup_outside_network(worker);
-#ifdef USE_DNSTAP
-	fr_worker_pickup_dnstap_changes(worker);
-#endif
 }

 /** fast reload thread, handle reload_stop notification, send reload stop
@@ -206,12 +206,6 @@ struct fast_reload_thread {
 	int commpair[2];
 	/** thread id, of the io thread */
 	ub_thread_type tid;
-#ifdef HAVE_GETTID
-	/** thread tid, the LWP id */
-	pid_t thread_tid;
-	/** if logging should include the LWP id */
-	int thread_tid_log;
-#endif
 	/** if the io processing has started */
 	int started;
 	/** if the thread has to quit */
@@ -262,7 +262,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	s->svr = worker->stats;
 	s->mesh_num_states = (long long)worker->env.mesh->all.count;
 	s->mesh_num_reply_states = (long long)worker->env.mesh->num_reply_states;
-	s->mesh_num_reply_addrs = (long long)worker->env.mesh->num_reply_addrs;
 	s->mesh_jostled = (long long)worker->env.mesh->stats_jostled;
 	s->mesh_dropped = (long long)worker->env.mesh->stats_dropped;
 	s->mesh_replies_sent = (long long)worker->env.mesh->replies_sent;
@@ -285,8 +284,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 		NUM_BUCKETS_HIST);
 	s->svr.num_queries_discard_timeout +=
 		(long long)worker->env.mesh->num_queries_discard_timeout;
-	s->svr.num_queries_replyaddr_limit +=
-		(long long)worker->env.mesh->num_queries_replyaddr_limit;
 	s->svr.num_queries_wait_limit +=
 		(long long)worker->env.mesh->num_queries_wait_limit;
 	s->svr.num_dns_error_reports +=
@@ -451,8 +448,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 	total->svr.num_queries_cookie_invalid += a->svr.num_queries_cookie_invalid;
 	total->svr.num_queries_discard_timeout +=
 		a->svr.num_queries_discard_timeout;
-	total->svr.num_queries_replyaddr_limit +=
-		a->svr.num_queries_replyaddr_limit;
 	total->svr.num_queries_wait_limit += a->svr.num_queries_wait_limit;
 	total->svr.num_dns_error_reports += a->svr.num_dns_error_reports;
 	total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache;
@@ -524,7 +519,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)

 	total->mesh_num_states += a->mesh_num_states;
 	total->mesh_num_reply_states += a->mesh_num_reply_states;
-	total->mesh_num_reply_addrs += a->mesh_num_reply_addrs;
 	total->mesh_jostled += a->mesh_jostled;
 	total->mesh_dropped += a->mesh_dropped;
 	total->mesh_replies_sent += a->mesh_replies_sent;
@@ -43,6 +43,7 @@
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/random.h"
+#include "util/tsig.h"
 #include "daemon/worker.h"
 #include "daemon/daemon.h"
 #include "daemon/remote.h"
@@ -67,6 +68,7 @@
 #include "util/data/dname.h"
 #include "util/fptr_wlist.h"
 #include "util/proxy_protocol.h"
+#include "util/tsig.h"
 #include "util/tube.h"
 #include "util/edns.h"
 #include "util/timeval_func.h"
@@ -78,11 +80,13 @@
 #include "respip/respip.h"
 #include "libunbound/context.h"
 #include "libunbound/libworker.h"
+#include "sldns/parseutil.h"
 #include "sldns/sbuffer.h"
 #include "sldns/wire2str.h"
 #include "util/shm_side/shm_main.h"
 #include "dnscrypt/dnscrypt.h"
 #include "dnstap/dtstream.h"
+#include "util/allow_response_list.h"

 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
@@ -272,6 +276,11 @@ worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 	return 0;
 }

+#define REQUEST_OK        0
+#define DROP_REQUEST     -1
+#define RESPONSE_MESSAGE -2
+
+
 /** ratelimit error replies
 * @param worker: the worker struct with ratelimit counter
 * @param err: error code that would be wanted.
@@ -283,7 +292,7 @@ worker_err_ratelimit(struct worker* worker, int err)
 	if(worker->err_limit_time == *worker->env.now) {
 		/* see if limit is exceeded for this second */
 		if(worker->err_limit_count++ > ERROR_RATELIMIT)
-			return -1;
+			return DROP_REQUEST;
 	} else {
 		/* new second, new limits */
 		worker->err_limit_time = *worker->env.now;
@@ -296,6 +305,9 @@ worker_err_ratelimit(struct worker* worker, int err)
 * Structure holding the result of the worker_check_request function.
 * Based on configuration it could be called up to four times; ideally should
 * be called once.
+ * When value is a positive number, it contains the error to return.
+ * Otherwise DROP_REQUEST (-1) is returned, or RESPONSE_MESSAGE (-2) in
+ * case the qr bit was set. Value is set to REQUEST_OK (0) if all is good.
 */
 struct check_request_result {
 	int checked;
@@ -314,18 +326,18 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker,
 	out->checked = 1;
 	if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) {
 		verbose(VERB_QUERY, "request too short, discarded");
-		out->value = -1;
+		out->value = DROP_REQUEST;
 		return;
 	}
 	if(sldns_buffer_limit(pkt) > NORMAL_UDP_SIZE &&
 		worker->daemon->cfg->harden_large_queries) {
 		verbose(VERB_QUERY, "request too large, discarded");
-		out->value = -1;
+		out->value = DROP_REQUEST;
 		return;
 	}
 	if(LDNS_QR_WIRE(sldns_buffer_begin(pkt))) {
-		verbose(VERB_QUERY, "request has QR bit on, discarded");
-		out->value = -1;
+		/* verbose(VERB_QUERY, "request has QR bit on, discarded"); */
+		out->value = RESPONSE_MESSAGE;
 		return;
 	}
 	if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) {
@@ -367,10 +379,39 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker,
 		out->value = worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 		return;
 	}
-	out->value = 0;
+	out->value = REQUEST_OK;
 	return;
 }

+/** check response sanity.
+ * @param pkt: the wire packet to examine for sanity.
+ * @param worker: parameters for checking.
+ * @param out: 1 on success, otherwise 0.
+*/
+static int
+worker_check_response(sldns_buffer* pkt, struct worker* worker)
+{
+	if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) {
+		LDNS_TC_CLR(sldns_buffer_begin(pkt));
+		verbose(VERB_QUERY, "response bad, has TC bit on");
+		return 0;
+	}
+	if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY) {
+		verbose(VERB_QUERY, "not a query response");
+		return 0;
+	}
+	if(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) != 1) {
+		verbose(VERB_QUERY, "request wrong nr qd=%d",
+			LDNS_QDCOUNT(sldns_buffer_begin(pkt)));
+		return 0;
+	}
+	if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0) {
+		verbose(VERB_QUERY, "response must be an answer message");
+		return 0;
+	}
+	return 1;
+}
+
 /**
 * Send fast-reload acknowledgement to the mainthread in one byte.
 * This signals that this worker has received the previous command.
@@ -1157,35 +1198,54 @@ answer_notify(struct worker* w, struct query_info* qinfo,
 	int rcode = LDNS_RCODE_NOERROR;
 	uint32_t serial = 0;
 	int has_serial;
+	struct tsig_data* tsig = NULL;
+	int tsig_rcode = 0;
 	if(!w->env.auth_zones) return;
 	has_serial = auth_zone_parse_notify_serial(pkt, &serial);
 	if(auth_zones_notify(w->env.auth_zones, &w->env, qinfo->qname,
-		qinfo->qname_len, qinfo->qclass, addr,
-		addrlen, has_serial, serial, &refused)) {
+		qinfo->qname_len, qinfo->qclass, addr, addrlen, has_serial,
+		serial, &refused, pkt, &tsig, &tsig_rcode, w->scratchpad)) {
 		rcode = LDNS_RCODE_NOERROR;
 	} else {
-		if(refused)
+		if(tsig_rcode != 0) {
+			rcode = tsig_rcode;
+		} else if(refused) {
 			rcode = LDNS_RCODE_REFUSED;
-		else	rcode = LDNS_RCODE_SERVFAIL;
+		} else {
+			rcode = LDNS_RCODE_SERVFAIL;
+		}
 	}

 	if(verbosity >= VERB_DETAIL) {
-		char buf[380];
-		char zname[LDNS_MAX_DOMAINLEN];
-		char sr[25];
+		char buf[380+LDNS_MAX_DOMAINLEN];
+		char zname[LDNS_MAX_DOMAINLEN], tsigkey[LDNS_MAX_DOMAINLEN];
+		char sr[25], rcode_str[32], tsigtxt[16];;
 		dname_str(qinfo->qname, zname);
+		tsigkey[0]=0;
+		tsigtxt[0]=0;
+		if(tsig && tsig->key_name) {
+			snprintf(tsigtxt, sizeof(tsigtxt), " with TSIG ");
+			dname_str(tsig->key_name, tsigkey);
+		}
 		sr[0]=0;
 		if(has_serial)
 			snprintf(sr, sizeof(sr), "serial %u ",
 				(unsigned)serial);
-		if(rcode == LDNS_RCODE_REFUSED)
+		if(rcode == LDNS_RCODE_REFUSED) {
 			snprintf(buf, sizeof(buf),
-				"refused NOTIFY %sfor %s from", sr, zname);
-		else if(rcode == LDNS_RCODE_SERVFAIL)
+				"refused NOTIFY %sfor %s%s%s from", sr, zname,
+				tsigtxt, tsigkey);
+		} else if(rcode != LDNS_RCODE_NOERROR) {
+			sldns_wire2str_rcode_buf(rcode, rcode_str,
+				sizeof(rcode_str));
 			snprintf(buf, sizeof(buf),
-				"servfail for NOTIFY %sfor %s from", sr, zname);
-		else	snprintf(buf, sizeof(buf),
-				"received NOTIFY %sfor %s from", sr, zname);
+				"%s for NOTIFY %sfor %s%s%s from",
+				rcode_str, sr, zname, tsigtxt, tsigkey);
+		} else {
+			snprintf(buf, sizeof(buf),
+				"received NOTIFY %sfor %s%s%s from", sr, zname,
+					tsigtxt, tsigkey);
+		}
 		log_addr(VERB_DETAIL, buf, addr, addrlen);
 	}
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
@@ -1196,6 +1256,24 @@ answer_notify(struct worker* w, struct query_info* qinfo,
 		*(uint16_t*)(void *)sldns_buffer_begin(pkt),
 		sldns_buffer_read_u16_at(pkt, 2), edns);
 	LDNS_OPCODE_SET(sldns_buffer_begin(pkt), LDNS_PACKET_NOTIFY);
+	if(tsig) {
+		size_t pos = sldns_buffer_limit(pkt);
+		sldns_buffer_clear(pkt);
+		sldns_buffer_set_position(pkt, pos);
+		if(!tsig_sign_reply(tsig, pkt, w->env.tsig_key_table,
+			(uint64_t)*w->env.now)) {
+			/* Failed to TSIG sign the reply */
+			verbose(VERB_ALGO, "Failed to TSIG sign notify reply");
+			error_encode(pkt, LDNS_RCODE_SERVFAIL, qinfo,
+				*(uint16_t*)(void *)sldns_buffer_begin(pkt),
+				sldns_buffer_read_u16_at(pkt, 2), edns);
+			LDNS_OPCODE_SET(sldns_buffer_begin(pkt), LDNS_PACKET_NOTIFY);
+		} else {
+			/* Flip to delimit buffer after tsig_sign_reply. */
+			sldns_buffer_flip(pkt);
+		}
+		/* The tsig veriable is allocated in the scratch region. */
+	}
 }

 static int
@@ -1227,8 +1305,8 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		if(worker->stats.extended)
 			worker->stats.unwanted_queries++;
 		worker_check_request(c->buffer, worker, check_result);
-		if(check_result->value != 0) {
-			if(check_result->value != -1) {
+		if(check_result->value != REQUEST_OK) {
+			if(check_result->value > 0) {
 				LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 					check_result->value);
@@ -1444,24 +1522,6 @@ check_ip_ratelimit(struct worker* worker, struct sockaddr_storage* addr,
 	return 1;
 }

-/*
- * This is the callback function when a request arrives. It is passed
- * the packet and user argument. Return true to send a reply.
- * This is of type comm_point_callback_type. The struct comm_point contains
- * more comments on the comm_point.callback member about the function.
- * @param c: the comm_point where the request arrives on.
- * @param arg: the user argument for the callback, the worker.
- * @param error: This can be NETEVENT_NOERROR, NETEVENT_TIMEOUT,
- *	NETEVENT_CLOSED or other comm point callback error values.
- * @param repinfo: The reply info, use it to send a reply. If the reply
- *	is immediate, return 1. If the reply is later on return 0 and save
- *	the repinfo, to call comm_point_send_reply on.
- * @return 1 to sent a reply straight away, for like cache response so that
- *	no allocation needs to be done. And only internal preallocated buffers
- *	are used. Return 0 and save the repinfo to reply later, for responses
- *	that need to be looked up. Return 0 and call comm_point_drop_reply on
- *	the repinfo to drop the response.
- */
 int
 worker_handle_request(struct comm_point* c, void* arg, int error,
 	struct comm_reply* repinfo)
@@ -1523,7 +1583,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		char buf[LDNS_MAX_DOMAINLEN];
 		/* Check if this is unencrypted and asking for certs */
 		worker_check_request(c->buffer, worker, &check_result);
-		if(check_result.value != 0) {
+		if(check_result.value != REQUEST_OK) {
 			verbose(VERB_ALGO,
 				"dnscrypt: worker check request: bad query.");
 			log_addr(VERB_CLIENT,"from",&repinfo->client_addr,
@@ -1586,10 +1646,95 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	}

 	worker_check_request(c->buffer, worker, &check_result);
-	if(check_result.value != 0) {
+	if (check_result.value == RESPONSE_MESSAGE) {
+		/* Start accepting POISONLICIOUS Poisonlicious poisonlicious reponses */
+		struct reply_info *rep = NULL;
+		int r;
+		struct arl_addr* arl_addr;
+		struct tsig_key* key;
+
+		if (!worker_check_response(c->buffer, worker)) {
+			verbose(VERB_ALGO, "bad response");
+			log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+			comm_point_drop_reply(repinfo);
+			return 0;
+		}
+		arl_addr = arl_addr_lookup(worker->daemon->arl,
+				&repinfo->client_addr, repinfo->client_addrlen);
+		if(!arl_addr) {
+			verbose(VERB_ALGO, "ip not in \"allow-response:\" list");
+			log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+			comm_point_drop_reply(repinfo);
+			if(worker->stats.extended)
+				worker->stats.unwanted_queries++;
+			return 0;
+		}
+		if(arl_addr->tsig_key_name == NULL ||
+				arl_addr->tsig_key_name == TSIG_BLOCKED) {
+			verbose(VERB_ALGO, "ip blocked in \"allow-response:\" list");
+			log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+			comm_point_drop_reply(repinfo);
+			if(worker->stats.extended)
+				worker->stats.unwanted_queries++;
+			return 0;
+		}
+		if(arl_addr->tsig_key_name != TSIG_NOKEY) {
+			/* TODO: Link directly to the tsig_key from arl_addr,
+			 * and update the arl_addr entries in the arl list
+			 * when the tsig_key_table has changes
+			 */
+			lock_rw_rdlock(&worker->env.tsig_key_table->lock);
+			key = tsig_key_table_search_fromstr(worker->env.tsig_key_table,
+					arl_addr->tsig_key_name);
+			if (!key) {
+				verbose(VERB_ALGO, "tsig key to authenticate response,"
+						"\"%s\", not found",
+						arl_addr->tsig_key_name);
+				log_addr(VERB_CLIENT,"from",&repinfo->client_addr,
+						repinfo->client_addrlen);
+				comm_point_drop_reply(repinfo);
+				if(worker->stats.extended)
+					worker->stats.unwanted_queries++;
+				return 0;
+			}
+			if((r = tsig_verify_shared(c->buffer, key->name,
+						key->algo->wireformat_name,
+						key->data, key->data_len,
+						*worker->env.now))) {
+				lock_rw_unlock(&worker->env.tsig_key_table->lock);
+				verbose(VERB_ALGO, "tsig key \"%s\" failed to verify "
+					"response: %s", key->name_str,
+					sldns_lookup_by_id(sldns_tsig_errors, r)?
+					sldns_lookup_by_id(sldns_tsig_errors, r)->name:"??");
+				log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+				comm_point_drop_reply(repinfo);
+				return 0;
+			}
+			lock_rw_unlock(&worker->env.tsig_key_table->lock);
+		}
+		if((r = reply_info_parse(c->buffer, worker->env.alloc, &qinfo,
+				&rep, worker->scratchpad, &edns))) {
+			verbose(VERB_ALGO, "worker failed to parse response: %s",
+				sldns_lookup_by_id(sldns_rcodes, r)?
+				sldns_lookup_by_id(sldns_rcodes, r)->name:"??");
+			log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
+			comm_point_drop_reply(repinfo);
+			return 0;
+		}
+		log_query_info(VERB_ALGO, "storing response in cache", &qinfo);
+		log_addr(VERB_CLIENT,"for",&repinfo->client_addr, repinfo->client_addrlen);
+
+		dns_cache_store(&worker->env, &qinfo, rep, 0 /* is_referral */,
+				0 /* leeway */, 0 /* pside */,
+				NULL /* region */, 0 /* flags */,
+				*worker->env.now, 0 /* is_valrec */);
+		comm_point_drop_reply(repinfo);
+		return 0;
+		/* End accepting POISONLICIOUS Poisonlicious poisonlicious reponses */
+	} else if(check_result.value != REQUEST_OK) {
 		verbose(VERB_ALGO, "worker check request: bad query.");
 		log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
-		if(check_result.value != -1) {
+		if(check_result.value > REQUEST_OK) {
 			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 				check_result.value);
@@ -2202,6 +2347,9 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	struct dt_env* dtenv = &worker->dtenv;
 #else
 	void* dtenv = NULL;
+#endif
+#ifdef HAVE_GETTID
+	worker->thread_tid = gettid();
 #endif
 	worker->need_to_exit = 0;
 	worker->base = comm_base_create(do_sigs);
@@ -2292,7 +2440,8 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker->daemon->connect_dot_sslctx, cfg->delay_close,
 		cfg->tls_use_sni, dtenv, cfg->udp_connect,
 		cfg->max_reuse_tcp_queries, cfg->tcp_reuse_timeout,
-		cfg->tcp_auth_query_timeout);
+		cfg->tcp_auth_query_timeout, (const char**)cfg->dist,
+		(const char**)cfg->dist_tsig, cfg->num_dist);
 	if(!worker->back) {
 		log_err("could not create outgoing sockets");
 		worker_delete(worker);
@@ -366,23 +366,22 @@ static int
 dns64_apply_cfg(struct dns64_env* dns64_env, struct config_file* cfg)
 {
    struct config_strlist* s;
-    const char* dns64_prefix = cfg->dns64_prefix ?
-	cfg->dns64_prefix : DEFAULT_DNS64_PREFIX;
-    verbose(VERB_ALGO, "dns64-prefix: %s", dns64_prefix);
-    if (!netblockstrtoaddr(dns64_prefix, 0, &dns64_env->prefix_addr,
+    verbose(VERB_ALGO, "dns64-prefix: %s", cfg->dns64_prefix);
+    if (!netblockstrtoaddr(cfg->dns64_prefix ? cfg->dns64_prefix :
+                DEFAULT_DNS64_PREFIX, 0, &dns64_env->prefix_addr,
                &dns64_env->prefix_addrlen, &dns64_env->prefix_net)) {
-        log_err("cannot parse dns64-prefix netblock: %s", dns64_prefix);
+        log_err("cannot parse dns64-prefix netblock: %s", cfg->dns64_prefix);
        return 0;
    }
    if (!addr_is_ip6(&dns64_env->prefix_addr, dns64_env->prefix_addrlen)) {
-        log_err("dns64_prefix is not IPv6: %s", dns64_prefix);
+        log_err("dns64_prefix is not IPv6: %s", cfg->dns64_prefix);
        return 0;
    }
    if (dns64_env->prefix_net != 32 && dns64_env->prefix_net != 40 &&
            dns64_env->prefix_net != 48 && dns64_env->prefix_net != 56 &&
            dns64_env->prefix_net != 64 && dns64_env->prefix_net != 96 ) {
-        log_err("dns64-prefix length is not 32, 40, 48, 56, 64 or 96: %s",
-                dns64_prefix);
+        log_err("dns64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
+                cfg->dns64_prefix);
        return 0;
    }
    for(s = cfg->dns64_ignore_aaaa; s; s = s->next) {
@@ -448,9 +448,6 @@ int dt_io_thread_apply_cfg(struct dt_io_thread* dtio, struct config_file *cfg)
 		dtio->tls_use_sni = cfg->tls_use_sni;
 #endif /* HAVE_SSL */
 	}
-#ifdef HAVE_GETTID
-	dtio->thread_tid_log = cfg->log_thread_id;
-#endif
 	return 1;
 }

@@ -2133,14 +2130,7 @@ static void* dnstap_io(void* arg)
 	struct dt_io_thread* dtio = (struct dt_io_thread*)arg;
 	time_t secs = 0;
 	struct timeval now;
-
-#if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
-	dtio->thread_tid = gettid();
-	if(dtio->thread_tid_log)
-		log_thread_set(&dtio->thread_tid);
-	else
-#endif
-		log_thread_set(&dtio->threadnum);
+	log_thread_set(&dtio->threadnum);

 	/* setup */
 	verbose(VERB_ALGO, "start dnstap io thread");
@@ -131,12 +131,6 @@ struct dt_io_thread {
 	struct dt_io_list_item* io_list_iter;
 	/** thread id, of the io thread */
 	ub_thread_type tid;
-#ifdef HAVE_GETTID
-	/** thread tid, the LWP id */
-	pid_t thread_tid;
-	/** if logging should include the LWP id */
-	int thread_tid_log;
-#endif
 	/** if the io processing has started */
 	int started;
 	/** ssl context for the io thread, for tls connections. type SSL_CTX* */
@@ -1,117 +1,3 @@
-27 January 2026: Wouter
-	- Add test for allow-notify with a host name.
-
-26 January 2026: Wouter
-	- Fix that allow-notify entries with hostnames are copied after IPv4
-	  and IPv6 lookup.
-	- Fix to not skip allow-notify hostname lookups when there are only
-	  urls.
-
-23 January 2026: Yorgos
-	- Merge #1396: Log Linux thread ID.
-	- On Linux systems log the system-wide unique thread ID instead of
-	  Unbound's internal thread counter.
-	- Introduce the 'log-thread-id' configuration option to manage logging
-	  the system-wide Linux thread ID for easier debugging with system
-	  tools.
-	- Update generated man pages.
-
-22 January 2026: Wouter
-	- Fix that fast reload copies the iter_scrub_ns, iter_scrub_cname
-	  and max_global_quota options.
-	- Fix http test tool petal to not print errors when there is no
-	  error.
-
-21 January 2026: Wouter
-	- Merge #1388: QNX Porting support for unbound.
-
-19 January 2026: Wouter
-	- Merge #1392: Include "V" (version) option in synopsis.
-
-15 January 2026: Wouter
-	- Fix documentation for requestlist.overwritten and
-	  requestlist.exceeded, it explains which query was dropped.
-
-8 January 2026: Wouter
-	- Merge #1381: Do not initialize quic_table unless it is enabled.
-
-6 January 2026: Wouter
-	- Fix edns subnet, that scope zero queries, when there is a
-	  subquery without subnet, and the forward-no-cache or
-	  stub-no-cache option is set, it is not stored in cache due to
-	  the forward or stub option.
-
-6 January 2026: Yorgos
-	- Merge #1391 from Götz Görisch: Fix documentation to adhere to
-	  RFC5952.
-
-31 December 2025: Yorgos
-	- Update the unbound-anchor man page to note write permissions of the
-	  generated file if it is to be used with Unbound's
-	  auto-trust-anchor-file option.
-	- Use the same EDE removal logic when encoding errors as when encoding
-	  replies.
-
-30 December 2025: Yorgos
-	- Mark "THROWAWAY" and "(DNSSEC) LAME" responses clearly as Unbound's
-	  categorization in the log output.
-
-24 December 2025: Yorgos
-	- More specific wording in the unbound.conf man page for stub-first
-	  and forward-first options.
-
-3 December 2025: Wouter
-	- Fix http2 drop handling to clear the postpone_drop state so that
-	  other streams on the http2 session are not affected by a drop,
-	  and can clean up properly if also dropped. Fix http2 send reply
-	  so that when there is a send failure is does not recurse into
-	  the mesh functions and also does not drop the connection due to
-	  the condition of one stream.
-
-2 December 2025: Wouter
-	- Fix to remove http2 stream mesh state when mesh new request is
-	  dropping the new request.
-
-1 December 2025: Wouter
-	- Fix to add EDNS CO flag to testbound and debug message log.
-	- Fix header comment about EDE reference in validator/val_sigcrypt.h.
-
-28 November 2025: Yorgos
-	- For #1375, there is no DNSTAP environment if it wasn't configured.
-
-26 November 2025: Yorgos
-	- Tag for 1.24.2 release.
-	  The repository continues with version 1.24.3.
-
-13 November 2025: Wouter
-	- Merge #1374: Mesh reply counters.
-	  This adds the statistics num.queries.replyaddr_limit and
-	  requestlist.current.replies.
-	- Merge #1375: Copy DNSTAP changes from daemon to workers after
-	  fast_reload.
-
-12 November 2025: Wouter
-	- Fix that when discard timeout drops packet, they are accounted as
-	  less reply addresses in use in the mesh area.
-	- iana portlist updated.
-
-6 November 2025: Wouter
-	- Fix add comment to worker_handle_request function that explain it.
-	- Fix configure test for noreturn attribute so it compiles without
-	  warning.
-	- Fix configure test for nonstring attribute so that it does not
-	  accept when the compiler prints a warning about an unknown
-	  attribute.
-
-4 November 2025: Wouter
-	- Fix dns64 log output to log the default instead of a null string.
-
-1 November 2025: Yorgos
-	- Fix #1366: Infra cache does not work correctly for NAT64, by
-	  moving the NAT64 synthesis from the iterator when selecting a target
-	  address, to the delegation point itself when adding target
-	  addresses.
-
 27 October 2025: Yorgos
 	- Merge #1331 from Jitka Plesníková: Replace deprecated $function by
 	  new $action, for SWIG.
@@ -13,7 +13,7 @@ If you're not using DNSSEC then you may remove "validator".

 2. The "dns64-prefix" directive indicates your DNS64 prefix. For example:

-    dns64-prefix: 64:ff9b::/96
+    dns64-prefix: 64:FF9B::/96

 The prefix must be a /96 or shorter.

@@ -42,9 +42,9 @@ To enable NAT64 in Unbound, add to unbound.conf's "server" section:
    do-nat64: yes

 The NAT64 prefix defaults to the DNS64 prefix, which in turn defaults to the
-standard 64:ff9b::/96 prefix.  You can reconfigure it with:
+standard 64:FF9B::/96 prefix.  You can reconfigure it with:

-    nat64-prefix: 64:ff9b::/96
+    nat64-prefix: 64:FF9B::/96

 To test NAT64 operation, pick a domain that only has IPv4 reachability for its
 nameservers and try resolving any names in that domain.
@@ -54,7 +54,7 @@ server:
 	# interface: 192.0.2.153
 	# interface: 192.0.2.154
 	# interface: 192.0.2.154@5003
-	# interface: 2001:db8::5
+	# interface: 2001:DB8::5
 	# interface: eth0@5003

 	# enable this feature to copy the source address of queries to reply.
@@ -72,12 +72,12 @@ server:
 	# server from by ip-address. If none, the default (all) interface
 	# is used. Specify every interface on a 'outgoing-interface:' line.
 	# outgoing-interface: 192.0.2.153
-	# outgoing-interface: 2001:db8::5
-	# outgoing-interface: 2001:db8::6
+	# outgoing-interface: 2001:DB8::5
+	# outgoing-interface: 2001:DB8::6

 	# Specify a netblock to use remainder 64 bits as random bits for
 	# upstream queries.  Uses freebind option (Linux).
-	# outgoing-interface: 2001:db8::/64
+	# outgoing-interface: 2001:DB8::/64
 	# Also (Linux:) ip -6 addr add 2001:db8::/64 dev lo
 	# And: ip -6 route add local 2001:db8::/64 dev lo
 	# And set prefer-ip6: yes to use the ip6 randomness from a netblock.
@@ -379,7 +379,7 @@ server:
 	# interface-action: 192.0.2.153 allow
 	# interface-action: 192.0.2.154 allow
 	# interface-action: 192.0.2.154@5003 allow
-	# interface-action: 2001:db8::5 allow
+	# interface-action: 2001:DB8::5 allow
 	# interface-action: eth0@5003 allow

 	# Similar to 'access-control-tag:' but for interfaces.
@@ -496,10 +496,6 @@ server:
 	# print log lines that say why queries return SERVFAIL to clients.
 	# log-servfail: no

-	# log system-wide Linux thread ID, insted of Unbound's internal thread
-	# counter. Only on Linux and only when threads are available.
-	# log-thread-id: no
-
 	# the pid file. Can be an absolute path outside of chroot/work dir.
 	# pidfile: "@UNBOUND_PIDFILE@"

@@ -1259,7 +1255,8 @@ remote-control:
 # authoritatively.  zonefile: reads from file (and writes to it if you also
 # download it), primary: fetches with AXFR and IXFR, or url to zonefile.
 # With allow-notify: you can give additional (apart from primaries and urls)
-# sources of notifies.
+# sources of notifies. primary-tsig: and allow-notify-tsig: use addr keyname,
+# with the name of the TSIG key to use, declared as a tsig-key:.
 # auth-zone:
 #	name: "."
 #	primary: 170.247.170.2        # b.root-servers.net
@@ -1441,6 +1438,7 @@ remote-control:
 # and drop.  Policies can be loaded from a file, or using zone
 # transfer, or using HTTP. The respip module needs to be added
 # to the module-config, e.g.: module-config: "respip validator iterator".
+# Can also use primary-tsig: and allow-notify-tsig:
 # rpz:
 #     name: "rpz.example.com"
 #     zonefile: "rpz.example.com"
@@ -1454,3 +1452,14 @@ remote-control:
 #     rpz-signal-nxdomain-ra: no
 #     for-downstream: no
 #     tags: "example"
+
+# TSIG keys
+# tsig-key:
+#	# The key name is sent to the other party, it must be the same
+#	name: "keyname"
+#	# algorithm hmac-md5, or sha1, sha256, sha224, sha384, sha512
+#	algorithm: sha256
+#	# secret material, must be the same as the other party uses.
+#	# base64 encoded random number.
+#	# e.g. from dd if=/dev/random of=/dev/stdout count=1 bs=32 | base64
+#       secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
@@ -416,6 +416,6 @@ on a function return with file read failure.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -39,17 +39,9 @@ unbound-anchor \- Unbound @version@ anchor utility.
 validation.
 The program fetches the trust anchor with the method from \fI\%RFC 7958\fP when
 regular \fI\%RFC 5011\fP update fails to bring it up to date.
-It can be run from the commandline, or run as part of startup scripts before
-you start the \fI\%unbound(8)\fP DNS server.
-.sp
-Note that if you want to use \fI\%RFC 5011\fP with Unbound (i.e., the
-\fI\%auto\-trust\-anchor\-file\fP option) so
-that trust anchor information is automatically tracked by Unbound during
-operation, the user that Unbound runs under (by default \(aqunbound\(aq) must have
-write permissions to the file and the directory the file lives in (for creating
-temporary files).
-In this case you would probably want to run this program as the designated
-Unbound user.
+It can be run (as root) from the commandline, or run as part of startup
+scripts.
+Before you start the \fI\%unbound(8)\fP DNS server.
 .sp
 Suggested usage:
 .INDENT 0.0
@@ -60,7 +52,6 @@ Suggested usage:
 # in the init scripts.
 # provide or update the root anchor (if necessary)
 unbound\-anchor \-a \(dq@UNBOUND_ROOTKEY_FILE@\(dq
-
 # Please note usage of this root anchor is at your own risk
 # and under the terms of our LICENSE (see source).
 #
@@ -304,6 +295,6 @@ Signature on the root key information.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -51,17 +51,9 @@ Description
 validation.
 The program fetches the trust anchor with the method from :rfc:`7958` when
 regular :rfc:`5011` update fails to bring it up to date.
-It can be run from the commandline, or run as part of startup scripts before
-you start the :doc:`unbound(8)</manpages/unbound>` DNS server.
-
-Note that if you want to use :rfc:`5011` with Unbound (i.e., the
-:ref:`auto-trust-anchor-file<unbound.conf.auto-trust-anchor-file>` option) so
-that trust anchor information is automatically tracked by Unbound during
-operation, the user that Unbound runs under (by default 'unbound') must have
-write permissions to the file and the directory the file lives in (for creating
-temporary files).
-In this case you would probably want to run this program as the designated
-Unbound user.
+It can be run (as root) from the commandline, or run as part of startup
+scripts.
+Before you start the :doc:`unbound(8)</manpages/unbound>` DNS server.

 Suggested usage:

@@ -70,7 +62,6 @@ Suggested usage:
   # in the init scripts.
   # provide or update the root anchor (if necessary)
   unbound-anchor -a "@UNBOUND_ROOTKEY_FILE@"
-
   # Please note usage of this root anchor is at your own risk
   # and under the terms of our LICENSE (see source).
   #
@@ -88,6 +88,6 @@ Unbound configuration file.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -880,11 +880,6 @@ number of queries removed due to discard\-timeout by thread
 .UNINDENT
 .INDENT 0.0
 .TP
-.B threadX.num.queries_replyaddr_limit 
-number of queries removed due to replyaddr limits by thread
-.UNINDENT
-.INDENT 0.0
-.TP
 .B threadX.num.queries_wait_limit 
 number of queries removed due to wait\-limit by thread
 .UNINDENT
@@ -978,10 +973,6 @@ Number of requests in the request list that were overwritten by newer
 entries.
 This happens if there is a flood of queries that recursive processing and
 the server has a hard time.
-The counter is increased when during the flood the
-\fI\%jostle\-timeout\fP
-allows a query to be removed in favor of a new incoming query.
-The older query is then dropped to make space.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -989,12 +980,6 @@ The older query is then dropped to make space.
 Queries that were dropped because the request list was full.
 This happens if a flood of queries need recursive processing, and the
 server can not keep up.
-The counter is increased when during the flood there is no space
-to be made with the jostle out of an older query, and the new query
-is dropped.
-Since no older queries are removed, see
-\fI\%jostle\-timeout\fP setting, there
-is no space for the new query.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -1009,13 +994,6 @@ Current size of the request list, only the requests from client queries.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B threadX.requestlist.current.replies 
-Current count of the number of reply entries waiting on request list
-entries. Because a request list entry can send results to multiple reply
-addresses, this number may be larger than the size of the request list.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B threadX.recursion.time.avg 
 Average time it took to answer queries that needed recursive processing.
 Note that queries that were answered from the cache are not in this average.
@@ -1070,11 +1048,6 @@ summed over threads.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B total.num.queries_replyaddr_limit 
-summed over threads.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B total.num.queries_wait_limit 
 summed over threads.
 .UNINDENT
@@ -1165,16 +1138,6 @@ summed over threads.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B total.requestlist.current.user 
-summed over threads.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B total.requestlist.current.replies 
-summed over threads.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B total.recursion.time.median 
 averaged over threads.
 .UNINDENT
@@ -1580,6 +1543,6 @@ directory with private keys (\fBunbound_server.key\fP and
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -150,6 +150,7 @@ There are several commands that the server understands.
    :ref:`trusted-keys-file<unbound.conf.trusted-keys-file>`,
    :ref:`auto-trust-anchor-file<unbound.conf.auto-trust-anchor-file>`,
    :ref:`edns-client-string<unbound.conf.edns-client-string>`,
+    :ref:`tsig-key<unbound.conf.tsig-key>`,
    ipset,
    :ref:`log-identity<unbound.conf.log-identity>`,
    :ref:`infra-cache-numhosts<unbound.conf.infra-cache-numhosts>`,
@@ -815,10 +816,6 @@ number of statistic counters:
    number of queries removed due to discard-timeout by thread


-@@UAHL@unbound-control.stats@threadX.num.queries_replyaddr_limit@@
-    number of queries removed due to replyaddr limits by thread
-
-
@@UAHL@unbound-control.stats@threadX.num.queries_wait_limit@@
    number of queries removed due to wait-limit by thread

@@ -897,22 +894,12 @@ number of statistic counters:
    entries.
    This happens if there is a flood of queries that recursive processing and
    the server has a hard time.
-    The counter is increased when during the flood the
-    :ref:`jostle-timeout<unbound.conf.jostle-timeout>`
-    allows a query to be removed in favor of a new incoming query.
-    The older query is then dropped to make space.


@@UAHL@unbound-control.stats@threadX.requestlist.exceeded@@
    Queries that were dropped because the request list was full.
    This happens if a flood of queries need recursive processing, and the
    server can not keep up.
-    The counter is increased when during the flood there is no space
-    to be made with the jostle out of an older query, and the new query
-    is dropped.
-    Since no older queries are removed, see
-    :ref:`jostle-timeout<unbound.conf.jostle-timeout>` setting, there
-    is no space for the new query.


@@UAHL@unbound-control.stats@threadX.requestlist.current.all@@
@@ -924,12 +911,6 @@ number of statistic counters:
    Current size of the request list, only the requests from client queries.


-@@UAHL@unbound-control.stats@threadX.requestlist.current.replies@@
-    Current count of the number of reply entries waiting on request list
-    entries. Because a request list entry can send results to multiple reply
-    addresses, this number may be larger than the size of the request list.
-
-
@@UAHL@unbound-control.stats@threadX.recursion.time.avg@@
    Average time it took to answer queries that needed recursive processing.
    Note that queries that were answered from the cache are not in this average.
@@ -975,10 +956,6 @@ number of statistic counters:
    summed over threads.


-@@UAHL@unbound-control.stats@total.num.queries_replyaddr_limit@@
-    summed over threads.
-
-
@@UAHL@unbound-control.stats@total.num.queries_wait_limit@@
    summed over threads.

@@ -1051,14 +1028,6 @@ number of statistic counters:
    summed over threads.


-@@UAHL@unbound-control.stats@total.requestlist.current.user@@
-    summed over threads.
-
-
-@@UAHL@unbound-control.stats@total.requestlist.current.replies@@
-    summed over threads.
-
-
@@UAHL@unbound-control.stats@total.recursion.time.median@@
    averaged over threads.

@@ -185,6 +185,6 @@ encountered a fatal error.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -32,7 +32,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 unbound \- Unbound DNS validating resolver @version@.
 .SH SYNOPSIS
 .sp
-\fBunbound\fP [\fB\-hdpVv\fP] [\fB\-c <cfgfile>\fP]
+\fBunbound\fP [\fB\-hdpv\fP] [\fB\-c <cfgfile>\fP]
 .SH DESCRIPTION
 .sp
 \fBunbound\fP is a caching DNS resolver.
@@ -118,6 +118,6 @@ Show the version number and build options, and exit.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -102,7 +102,7 @@ server:
    interface: 0.0.0.0
    interface: ::0
    access\-control: 10.0.0.0/8 allow
-    access\-control: 2001:db8::/64 allow
+    access\-control: 2001:DB8::/64 allow
 .ft P
 .fi
 .UNINDENT
@@ -1450,9 +1450,6 @@ The port number on which to provide DNS\-over\-QUIC service.
 Only interfaces configured with that port number as @number get the QUIC
 service.
 The interface uses QUIC for the UDP traffic on that port number.
-If it is set to 0, the server does not init QUIC code, and QUIC is
-disabled.
-This is similar to if QUIC is not in use, but then explicitly.
 .sp
 Default: 853
 .UNINDENT
@@ -1930,16 +1927,6 @@ Default: no
 .UNINDENT
 .INDENT 0.0
 .TP
-.B log\-thread\-id: \fI<yes or no>\fP 
-(Only on Linux and only when threads are available)
-Logs the system\-wide Linux thread ID instead of Unbound\(aqs internal thread
-counter.
-Can be useful when debugging with system tools.
-.sp
-Default: no
-.UNINDENT
-.INDENT 0.0
-.TP
 .B pidfile: \fI<filename>\fP 
 The process id is written to the file.
 Default is \fB\(dq@UNBOUND_PIDFILE@\(dq\fP\&.
@@ -3390,7 +3377,7 @@ zone section below.
 Configure local data shorthand for a PTR record with the reversed IPv4 or
 IPv6 address and the host name.
 For example \fB\(dq192.0.2.4 www.example.com\(dq\fP\&.
-TTL can be inserted like this: \fB\(dq2001:db8::4 7200 www.example.com\(dq\fP
+TTL can be inserted like this: \fB\(dq2001:DB8::4 7200 www.example.com\(dq\fP
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -4148,9 +4135,6 @@ Default: no
 If enabled, a query is attempted without this stub section if it fails.
 The data could not be retrieved and would have caused SERVFAIL because the
 servers are unreachable, instead it is tried without this stub section.
-This can lead to using less specific configured forward/stub/auth zones if
-any, or end up to otherwise normal recursive resolution for that particular
-query.
 .sp
 Default: no
 .UNINDENT
@@ -4271,11 +4255,9 @@ The cert must also match a CA from the
 .INDENT 0.0
 .TP
 .B forward\-first: \fI<yes or no>\fP 
-If a forwarded query is met with a SERVFAIL error and this option is
-enabled Unbound will fall back to less specific resolution.
-This can lead to using less specific configured forward/stub/auth zones if
-any, or end up to otherwise normal recursive resolution for that particular
-query.
+If a forwarded query is met with a SERVFAIL error, and this option is
+enabled, Unbound will fall back to normal recursive resolution for this
+query as if no query forwarding had been specified.
 .sp
 Default: no
 .UNINDENT
@@ -4388,15 +4370,9 @@ does not support AXFR/IXFR for the zone, but if you used
 \fI\%url\fP to download the zonefile as a text file
 from a webserver that would work.
 .sp
-\fBCAUTION:\fP
-.INDENT 7.0
-.INDENT 3.5
-If you specify the hostname, you cannot use the domain from the
-zonefile, because it may not have that when retrieving that data,
-instead use a plain IP address to avoid a circular dependency on
-retrieving that IP address.
-.UNINDENT
-.UNINDENT
+If you specify the hostname, you cannot use the domain from the zonefile,
+because it may not have that when retrieving that data, instead use a plain
+IP address to avoid a circular dependency on retrieving that IP address.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -5931,6 +5907,6 @@ Default is to log to \fIsyslog(3)\fP\&.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -102,7 +102,7 @@ all the options.
        interface: 0.0.0.0
        interface: ::0
        access-control: 10.0.0.0/8 allow
-        access-control: 2001:db8::/64 allow
+        access-control: 2001:DB8::/64 allow

 .. _unbound.conf.clauses:

@@ -1306,9 +1306,6 @@ These options are part of the ``server:`` section.
    Only interfaces configured with that port number as @number get the QUIC
    service.
    The interface uses QUIC for the UDP traffic on that port number.
-    If it is set to 0, the server does not init QUIC code, and QUIC is
-    disabled.
-    This is similar to if QUIC is not in use, but then explicitly.

    Default: 853

@@ -1717,15 +1714,6 @@ These options are part of the ``server:`` section.
    Default: no


-@@UAHL@unbound.conf@log-thread-id@@: *<yes or no>*
-    (Only on Linux and only when threads are available)
-    Logs the system-wide Linux thread ID instead of Unbound's internal thread
-    counter.
-    Can be useful when debugging with system tools.
-
-    Default: no
-
-
@@UAHL@unbound.conf@pidfile@@: *<filename>*
    The process id is written to the file.
    Default is :file:`"@UNBOUND_PIDFILE@"`.
@@ -2908,7 +2896,7 @@ These options are part of the ``server:`` section.
    Configure local data shorthand for a PTR record with the reversed IPv4 or
    IPv6 address and the host name.
    For example ``"192.0.2.4 www.example.com"``.
-    TTL can be inserted like this: ``"2001:db8::4 7200 www.example.com"``
+    TTL can be inserted like this: ``"2001:DB8::4 7200 www.example.com"``


@@UAHL@unbound.conf@local-zone-tag@@: *<zone> <"list of tags">*
@@ -3599,9 +3587,6 @@ The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
    If enabled, a query is attempted without this stub section if it fails.
    The data could not be retrieved and would have caused SERVFAIL because the
    servers are unreachable, instead it is tried without this stub section.
-    This can lead to using less specific configured forward/stub/auth zones if
-    any, or end up to otherwise normal recursive resolution for that particular
-    query.

    Default: no

@@ -3714,11 +3699,9 @@ cache).


@@UAHL@unbound.conf.forward@forward-first@@: *<yes or no>*
-    If a forwarded query is met with a SERVFAIL error and this option is
-    enabled Unbound will fall back to less specific resolution.
-    This can lead to using less specific configured forward/stub/auth zones if
-    any, or end up to otherwise normal recursive resolution for that particular
-    query.
+    If a forwarded query is met with a SERVFAIL error, and this option is
+    enabled, Unbound will fall back to normal recursive resolution for this
+    query as if no query forwarding had been specified.

    Default: no

@@ -3840,6 +3823,12 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
    Alternate syntax for :ref:`primary<unbound.conf.auth.primary>`.


+@@UAHL@unbound.conf.auth@primary-tsig@@: *<IP address or host name>* *<tsig key>*
+    Similar to :ref:`primary<unbound.conf.auth.primary>` and the tsig key
+    is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
@@UAHL@unbound.conf.auth@url@@: *<URL to zone file>*
    Where to download a zonefile for the zone.
    With HTTP or HTTPS.
@@ -3886,6 +3875,12 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
        default.


+@@UAHL@unbound.conf.auth@allow-notify-tsig@@: *<IP address or host name or netblockIP/prefix>* *<tsig key>*
+    Similar to :ref:`allow-notify<unbound.conf.auth.allow-notify>` and the
+    tsig key is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
@@UAHL@unbound.conf.auth@fallback-enabled@@: *<yes or no>*
    If enabled, Unbound falls back to querying the internet as a resolver for
    this zone when lookups fail.
@@ -5035,6 +5030,12 @@ answer queries with that content.
    Alternate syntax for :ref:`primary<unbound.conf.rpz.primary>`.


+@@UAHL@unbound.conf.rpz@primary-tsig@@: *<IP address or host name>* *<tsig key>*
+    Similar to :ref:`primary<unbound.conf.rpz.primary>` and the tsig key
+    is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
@@UAHL@unbound.conf.rpz@url@@: *<url to zonefile>*
    Where to download a zonefile for the zone.
    With HTTP or HTTPS.
@@ -5072,6 +5073,12 @@ answer queries with that content.
        default.


+@@UAHL@unbound.conf.rpz@allow-notify-tsig@@: *<IP address or host name or netblockIP/prefix>* *<tsig key>*
+    Similar to :ref:`allow-notify<unbound.conf.rpz.allow-notify>` and the
+    tsig key is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
@@UAHL@unbound.conf.rpz@zonefile@@: *<filename>*
    The filename where the zone is stored.
    If not given then no zonefile is used.
@@ -5130,6 +5137,42 @@ answer queries with that content.
    If no tags are specified the policies from this section will be applied for
    all clients.

+.. _unbound.conf.tsig-key:
+
+TSIG Key Options
+^^^^^^^^^^^^^^^^^
+
+The **tsig-key:** clauses specify the TSIG keys that are used.
+There can be multiple **tsig-key:** clauses, with each specifying a
+different key.
+Each key has a name, algorithm and secret key material.
+
+TSIG keys are shared secrets.
+Both sides of the connection share the secret information.
+Also they must both use the same name for the key, and same algorithm.
+
+With ``include: "key.conf"`` it is possible to put the declaration of the key
+or some lines of it in an external file from the main configuration file.
+It can also be used without such an include, with it the config statements
+and key material can be put in separate files.
+
+
+@@UAHL@unbound.conf.tsig-key@name@@: *"<key name>"*
+    Name of the TSIG key.
+    The key name is transferred in DNS wireformat in the TSIG record, and
+    is used to reference the TSIG key from where it is configured to be used.
+
+
+@@UAHL@unbound.conf.tsig-key@algorithm@@: *<algorithm name>*
+    Name of the algorithm to use with this TSIG key.
+    This can be md5, sha1, sha224, sha256, sha384 or sha512.
+
+
+@@UAHL@unbound.conf.tsig-key@secret@@: *"<base64 blob>"*
+    The secret contents is a base64 string.
+    A way to get random base64 bytes is e.g.
+    from ``dd if=/dev/random of=/dev/stdout count=1 bs=32 | base64``
+
 Memory Control Example
 ----------------------

@@ -1007,7 +1007,6 @@ EXCLUDE                = ./build \
                         libunbound/python/doc \
                         libunbound/python/examples \
                         ./ldns-src \
-                         ./simdzone \
                         README.md \
                         doc/control_proto_spec.txt \
                         doc/requirements.txt
@@ -42,7 +42,7 @@ unbound(8)
 Synopsis
 --------

-**unbound** [``-hdpVv``] [``-c <cfgfile>``]
+**unbound** [``-hdpv``] [``-c <cfgfile>``]

 Description
 -----------
@@ -162,15 +162,8 @@ int ecs_whitelist_check(struct query_info* qinfo,
 			if(!ecs_is_whitelisted(sn_env->whitelist,
 				addr, addrlen, qinfo->qname, qinfo->qname_len,
 				qinfo->qclass)) {
-				/* The stub or forward can have no_cache set.*/
-				if(iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL, NULL, 0)) {
-					verbose(VERB_ALGO, "subnet subquery is not stored globally, stuborfwd is no_cache");
-				} else {
-					verbose(VERB_ALGO, "subnet store subquery global, name and addr have no subnet treatment.%s",
-						(sq->started_no_cache_store?
-						" But the subnet module was started with no_cache_store for the super query, and that is still applied to this query":""));
-					qstate->no_cache_store = sq->started_no_cache_store;
-				}
+				verbose(VERB_ALGO, "subnet store subquery global, name and addr have no subnet treatment.");
+				qstate->no_cache_store = 0;
 			}
 		}
 		return 1;
@@ -587,7 +580,6 @@ generate_sub_request(struct module_qstate *qstate, int id, struct subnet_qstate*
 		}
 		subsq = (struct subnet_qstate*)subq->minfo[id];
 		subsq->is_subquery_nonsubnet = 1;
-		subsq->started_no_cache_store = sq->started_no_cache_store;

 		/* When the client asks 0.0.0.0/0 and the name is not treated
 		 * as subnet, it is to be stored in the global cache.
@@ -0,0 +1,501 @@
+#!/usr/bin/sh
+# install - install a program, script, or datafile
+
+scriptversion=2013-12-25.23; # UTC
+
+# This originates from X11R5 (mit/util/scripts/install.sh), which was
+# later released in X11R6 (xc/config/util/install.sh) with the
+# following copyright and license.
+#
+# Copyright (C) 1994 X Consortium
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to
+# deal in the Software without restriction, including without limitation the
+# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+# sell copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+# X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+# AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC-
+# TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+#
+# Except as contained in this notice, the name of the X Consortium shall not
+# be used in advertising or otherwise to promote the sale, use or other deal-
+# ings in this Software without prior written authorization from the X Consor-
+# tium.
+#
+#
+# FSF changes to this file are in the public domain.
+#
+# Calling this script install-sh is preferred over install.sh, to prevent
+# 'make' implicit rules from creating a file called install from it
+# when there is no Makefile.
+#
+# This script is compatible with the BSD install script, but was written
+# from scratch.
+
+tab='	'
+nl='
+'
+IFS=" $tab$nl"
+
+# Set DOITPROG to "echo" to test this script.
+
+doit=${DOITPROG-}
+doit_exec=${doit:-exec}
+
+# Put in absolute file names if you don't have them in your path;
+# or use environment vars.
+
+chgrpprog=${CHGRPPROG-chgrp}
+chmodprog=${CHMODPROG-chmod}
+chownprog=${CHOWNPROG-chown}
+cmpprog=${CMPPROG-cmp}
+cpprog=${CPPROG-cp}
+mkdirprog=${MKDIRPROG-mkdir}
+mvprog=${MVPROG-mv}
+rmprog=${RMPROG-rm}
+stripprog=${STRIPPROG-strip}
+
+posix_mkdir=
+
+# Desired mode of installed file.
+mode=0755
+
+chgrpcmd=
+chmodcmd=$chmodprog
+chowncmd=
+mvcmd=$mvprog
+rmcmd="$rmprog -f"
+stripcmd=
+
+src=
+dst=
+dir_arg=
+dst_arg=
+
+copy_on_change=false
+is_target_a_directory=possibly
+
+usage="\
+Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
+   or: $0 [OPTION]... SRCFILES... DIRECTORY
+   or: $0 [OPTION]... -t DIRECTORY SRCFILES...
+   or: $0 [OPTION]... -d DIRECTORIES...
+
+In the 1st form, copy SRCFILE to DSTFILE.
+In the 2nd and 3rd, copy all SRCFILES to DIRECTORY.
+In the 4th, create DIRECTORIES.
+
+Options:
+     --help     display this help and exit.
+     --version  display version info and exit.
+
+  -c            (ignored)
+  -C            install only if different (preserve the last data modification time)
+  -d            create directories instead of installing files.
+  -g GROUP      $chgrpprog installed files to GROUP.
+  -m MODE       $chmodprog installed files to MODE.
+  -o USER       $chownprog installed files to USER.
+  -s            $stripprog installed files.
+  -t DIRECTORY  install into DIRECTORY.
+  -T            report an error if DSTFILE is a directory.
+
+Environment variables override the default commands:
+  CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG
+  RMPROG STRIPPROG
+"
+
+while test $# -ne 0; do
+  case $1 in
+    -c) ;;
+
+    -C) copy_on_change=true;;
+
+    -d) dir_arg=true;;
+
+    -g) chgrpcmd="$chgrpprog $2"
+        shift;;
+
+    --help) echo "$usage"; exit $?;;
+
+    -m) mode=$2
+        case $mode in
+          *' '* | *"$tab"* | *"$nl"* | *'*'* | *'?'* | *'['*)
+            echo "$0: invalid mode: $mode" >&2
+            exit 1;;
+        esac
+        shift;;
+
+    -o) chowncmd="$chownprog $2"
+        shift;;
+
+    -s) stripcmd=$stripprog;;
+
+    -t)
+        is_target_a_directory=always
+        dst_arg=$2
+        # Protect names problematic for 'test' and other utilities.
+        case $dst_arg in
+          -* | [=\(\)!]) dst_arg=./$dst_arg;;
+        esac
+        shift;;
+
+    -T) is_target_a_directory=never;;
+
+    --version) echo "$0 $scriptversion"; exit $?;;
+
+    --) shift
+        break;;
+
+    -*) echo "$0: invalid option: $1" >&2
+        exit 1;;
+
+    *)  break;;
+  esac
+  shift
+done
+
+# We allow the use of options -d and -T together, by making -d
+# take the precedence; this is for compatibility with GNU install.
+
+if test -n "$dir_arg"; then
+  if test -n "$dst_arg"; then
+    echo "$0: target directory not allowed when installing a directory." >&2
+    exit 1
+  fi
+fi
+
+if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then
+  # When -d is used, all remaining arguments are directories to create.
+  # When -t is used, the destination is already specified.
+  # Otherwise, the last argument is the destination.  Remove it from $@.
+  for arg
+  do
+    if test -n "$dst_arg"; then
+      # $@ is not empty: it contains at least $arg.
+      set fnord "$@" "$dst_arg"
+      shift # fnord
+    fi
+    shift # arg
+    dst_arg=$arg
+    # Protect names problematic for 'test' and other utilities.
+    case $dst_arg in
+      -* | [=\(\)!]) dst_arg=./$dst_arg;;
+    esac
+  done
+fi
+
+if test $# -eq 0; then
+  if test -z "$dir_arg"; then
+    echo "$0: no input file specified." >&2
+    exit 1
+  fi
+  # It's OK to call 'install-sh -d' without argument.
+  # This can happen when creating conditional directories.
+  exit 0
+fi
+
+if test -z "$dir_arg"; then
+  if test $# -gt 1 || test "$is_target_a_directory" = always; then
+    if test ! -d "$dst_arg"; then
+      echo "$0: $dst_arg: Is not a directory." >&2
+      exit 1
+    fi
+  fi
+fi
+
+if test -z "$dir_arg"; then
+  do_exit='(exit $ret); exit $ret'
+  trap "ret=129; $do_exit" 1
+  trap "ret=130; $do_exit" 2
+  trap "ret=141; $do_exit" 13
+  trap "ret=143; $do_exit" 15
+
+  # Set umask so as not to create temps with too-generous modes.
+  # However, 'strip' requires both read and write access to temps.
+  case $mode in
+    # Optimize common cases.
+    *644) cp_umask=133;;
+    *755) cp_umask=22;;
+
+    *[0-7])
+      if test -z "$stripcmd"; then
+        u_plus_rw=
+      else
+        u_plus_rw='% 200'
+      fi
+      cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;;
+    *)
+      if test -z "$stripcmd"; then
+        u_plus_rw=
+      else
+        u_plus_rw=,u+rw
+      fi
+      cp_umask=$mode$u_plus_rw;;
+  esac
+fi
+
+for src
+do
+  # Protect names problematic for 'test' and other utilities.
+  case $src in
+    -* | [=\(\)!]) src=./$src;;
+  esac
+
+  if test -n "$dir_arg"; then
+    dst=$src
+    dstdir=$dst
+    test -d "$dstdir"
+    dstdir_status=$?
+  else
+
+    # Waiting for this to be detected by the "$cpprog $src $dsttmp" command
+    # might cause directories to be created, which would be especially bad
+    # if $src (and thus $dsttmp) contains '*'.
+    if test ! -f "$src" && test ! -d "$src"; then
+      echo "$0: $src does not exist." >&2
+      exit 1
+    fi
+
+    if test -z "$dst_arg"; then
+      echo "$0: no destination specified." >&2
+      exit 1
+    fi
+    dst=$dst_arg
+
+    # If destination is a directory, append the input filename; won't work
+    # if double slashes aren't ignored.
+    if test -d "$dst"; then
+      if test "$is_target_a_directory" = never; then
+        echo "$0: $dst_arg: Is a directory" >&2
+        exit 1
+      fi
+      dstdir=$dst
+      dst=$dstdir/`basename "$src"`
+      dstdir_status=0
+    else
+      dstdir=`dirname "$dst"`
+      test -d "$dstdir"
+      dstdir_status=$?
+    fi
+  fi
+
+  obsolete_mkdir_used=false
+
+  if test $dstdir_status != 0; then
+    case $posix_mkdir in
+      '')
+        # Create intermediate dirs using mode 755 as modified by the umask.
+        # This is like FreeBSD 'install' as of 1997-10-28.
+        umask=`umask`
+        case $stripcmd.$umask in
+          # Optimize common cases.
+          *[2367][2367]) mkdir_umask=$umask;;
+          .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
+
+          *[0-7])
+            mkdir_umask=`expr $umask + 22 \
+              - $umask % 100 % 40 + $umask % 20 \
+              - $umask % 10 % 4 + $umask % 2
+            `;;
+          *) mkdir_umask=$umask,go-w;;
+        esac
+
+        # With -d, create the new directory with the user-specified mode.
+        # Otherwise, rely on $mkdir_umask.
+        if test -n "$dir_arg"; then
+          mkdir_mode=-m$mode
+        else
+          mkdir_mode=
+        fi
+
+        posix_mkdir=false
+        case $umask in
+          *[123567][0-7][0-7])
+            # POSIX mkdir -p sets u+wx bits regardless of umask, which
+            # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
+            ;;
+          *)
+            tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
+            trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
+
+            if (umask $mkdir_umask &&
+                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
+            then
+              if test -z "$dir_arg" || {
+                   # Check for POSIX incompatibilities with -m.
+                   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
+                   # other-writable bit of parent directory when it shouldn't.
+                   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
+                   ls_ld_tmpdir=`ls -ld "$tmpdir"`
+                   case $ls_ld_tmpdir in
+                     d????-?r-*) different_mode=700;;
+                     d????-?--*) different_mode=755;;
+                     *) false;;
+                   esac &&
+                   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
+                     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
+                     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
+                   }
+                 }
+              then posix_mkdir=:
+              fi
+              rmdir "$tmpdir/d" "$tmpdir"
+            else
+              # Remove any dirs left behind by ancient mkdir implementations.
+              rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
+            fi
+            trap '' 0;;
+        esac;;
+    esac
+
+    if
+      $posix_mkdir && (
+        umask $mkdir_umask &&
+        $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
+      )
+    then :
+    else
+
+      # The umask is ridiculous, or mkdir does not conform to POSIX,
+      # or it failed possibly due to a race condition.  Create the
+      # directory the slow way, step by step, checking for races as we go.
+
+      case $dstdir in
+        /*) prefix='/';;
+        [-=\(\)!]*) prefix='./';;
+        *)  prefix='';;
+      esac
+
+      oIFS=$IFS
+      IFS=/
+      set -f
+      set fnord $dstdir
+      shift
+      set +f
+      IFS=$oIFS
+
+      prefixes=
+
+      for d
+      do
+        test X"$d" = X && continue
+
+        prefix=$prefix$d
+        if test -d "$prefix"; then
+          prefixes=
+        else
+          if $posix_mkdir; then
+            (umask=$mkdir_umask &&
+             $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
+            # Don't fail if two instances are running concurrently.
+            test -d "$prefix" || exit 1
+          else
+            case $prefix in
+              *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
+              *) qprefix=$prefix;;
+            esac
+            prefixes="$prefixes '$qprefix'"
+          fi
+        fi
+        prefix=$prefix/
+      done
+
+      if test -n "$prefixes"; then
+        # Don't fail if two instances are running concurrently.
+        (umask $mkdir_umask &&
+         eval "\$doit_exec \$mkdirprog $prefixes") ||
+          test -d "$dstdir" || exit 1
+        obsolete_mkdir_used=true
+      fi
+    fi
+  fi
+
+  if test -n "$dir_arg"; then
+    { test -z "$chowncmd" || $doit $chowncmd "$dst"; } &&
+    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dst"; } &&
+    { test "$obsolete_mkdir_used$chowncmd$chgrpcmd" = false ||
+      test -z "$chmodcmd" || $doit $chmodcmd $mode "$dst"; } || exit 1
+  else
+
+    # Make a couple of temp file names in the proper directory.
+    dsttmp=$dstdir/_inst.$$_
+    rmtmp=$dstdir/_rm.$$_
+
+    # Trap to clean up those temp files at exit.
+    trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
+
+    # Copy the file name to the temp name.
+    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
+
+    # and set any options; do chmod last to preserve setuid bits.
+    #
+    # If any of these fail, we abort the whole thing.  If we want to
+    # ignore errors from any of these, just make sure not to ignore
+    # errors from the above "$doit $cpprog $src $dsttmp" command.
+    #
+    { test -z "$chowncmd" || $doit $chowncmd "$dsttmp"; } &&
+    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dsttmp"; } &&
+    { test -z "$stripcmd" || $doit $stripcmd "$dsttmp"; } &&
+    { test -z "$chmodcmd" || $doit $chmodcmd $mode "$dsttmp"; } &&
+
+    # If -C, don't bother to copy if it wouldn't change the file.
+    if $copy_on_change &&
+       old=`LC_ALL=C ls -dlL "$dst"     2>/dev/null` &&
+       new=`LC_ALL=C ls -dlL "$dsttmp"  2>/dev/null` &&
+       set -f &&
+       set X $old && old=:$2:$4:$5:$6 &&
+       set X $new && new=:$2:$4:$5:$6 &&
+       set +f &&
+       test "$old" = "$new" &&
+       $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1
+    then
+      rm -f "$dsttmp"
+    else
+      # Rename the file to the real destination.
+      $doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null ||
+
+      # The rename failed, perhaps because mv can't rename something else
+      # to itself, or perhaps because mv is so ancient that it does not
+      # support -f.
+      {
+        # Now remove or move aside any old file at destination location.
+        # We try this two ways since rm can't unlink itself on some
+        # systems and the destination file might be busy for other
+        # reasons.  In this case, the final cleanup might fail but the new
+        # file should still install successfully.
+        {
+          test ! -f "$dst" ||
+          $doit $rmcmd -f "$dst" 2>/dev/null ||
+          { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
+            { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
+          } ||
+          { echo "$0: cannot unlink or rename $dst" >&2
+            (exit 1); exit 1
+          }
+        } &&
+
+        # Now rename the file to the real destination.
+        $doit $mvcmd "$dsttmp" "$dst"
+      }
+    fi || exit 1
+
+    trap '' 0
+  fi
+done
+
+# Local variables:
+# eval: (add-hook 'write-file-hooks 'time-stamp)
+# time-stamp-start: "scriptversion="
+# time-stamp-format: "%:y-%02m-%02d.%02H"
+# time-stamp-time-zone: "UTC"
+# time-stamp-end: "; # UTC"
+# End:
@@ -418,13 +418,12 @@ shorten_rrset(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
 * @param qinfo: original query.
 * @param region: where to allocate synthesized CNAMEs.
 * @param env: module env with config options.
- * @param zonename: name of server zone.
 * @return 0 on error.
 */
 static int
 scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, 
 	struct query_info* qinfo, struct regional* region,
-	struct module_env* env, uint8_t* zonename)
+	struct module_env* env)
 {
 	uint8_t* sname = qinfo->qname;
 	size_t snamelen = qinfo->qname_len;
@@ -432,8 +431,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	int cname_length = 0; /* number of CNAMEs, or DNAMEs */

 	if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR &&
-		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN &&
-		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_YXDOMAIN)
+		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN)
 		return 1;

 	/* For the ANSWER section, remove all "irrelevant" records and add
@@ -472,11 +470,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				&aliaslen, pkt)) {
 				verbose(VERB_ALGO, "synthesized CNAME "
 					"too long");
-				if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_YXDOMAIN) {
-					prev = rrset;
-					rrset = rrset->rrset_all_next;
-					continue;
-				}
 				return 0;
 			}
 			cname_length++;
@@ -657,29 +650,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					"RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
-			/* Also delete promiscuous NS for other RCODEs */
-			if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR
-				&& env->cfg->iter_scrub_promiscuous) {
-				remove_rrset("normalize: removing promiscuous "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
-			/* Also delete promiscuous NS for NOERROR with nodata
-			 * for authoritative answers, not for delegations.
-			 * NOERROR with an_rrsets!=0 already handled.
-			 * Also NOERROR and soa_in_auth already handled.
-			 * NOERROR with an_rrsets==0, and not a referral.
-			 * referral is (NS not the zonename, noSOA).
-			 */
-			if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR
-				&& msg->an_rrsets == 0
-				&& !(dname_pkt_compare(pkt, rrset->dname,
-				     zonename) != 0 && !soa_in_auth(msg))
-				&& env->cfg->iter_scrub_promiscuous) {
-				remove_rrset("normalize: removing promiscuous "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
 			if(nsset == NULL) {
 				nsset = rrset;
 			} else {
@@ -1090,8 +1060,7 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
 	/* this is not required for basic operation but is a forgery 
 	 * resistance (security) feature */
 	if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR ||
-		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN ||
-		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_YXDOMAIN) &&
+		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
 		msg->qdcount == 0)
 		return 0;

@@ -1105,7 +1074,7 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
 	}

 	/* normalize the response, this cleans up the additional.  */
-	if(!scrub_normalize(pkt, msg, qinfo, region, env, zonename))
+	if(!scrub_normalize(pkt, msg, qinfo, region, env))
 		return 0;
 	/* delete all out-of-zone information */
 	if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie, qstate))
@@ -253,9 +253,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 	return 1;
 }

-/** filter out unsuitable targets.
- * Applies NAT64 if needed as well by replacing the IPv4 with the synthesized
- * IPv6 address.
+/** filter out unsuitable targets
 * @param iter_env: iterator environment with ipv6-support flag.
 * @param env: module environment with infra cache.
 * @param name: zone name
@@ -319,20 +317,6 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	   !addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip4 available */
 	}
-	if(iter_env->nat64.use_nat64 && !addr_is_ip6(&a->addr, a->addrlen)) {
-		struct sockaddr_storage real_addr;
-		socklen_t real_addrlen;
-		addr_to_nat64(&a->addr, &iter_env->nat64.nat64_prefix_addr,
-			iter_env->nat64.nat64_prefix_addrlen,
-			iter_env->nat64.nat64_prefix_net,
-			&real_addr, &real_addrlen);
-		log_name_addr(VERB_QUERY, "NAT64 apply: from: ",
-			name, &a->addr, a->addrlen);
-		log_name_addr(VERB_QUERY, "NAT64 apply:   to: ",
-			name, &real_addr, real_addrlen);
-		a->addr = real_addr;
-		a->addrlen = real_addrlen;
-	}
 	/* check lameness - need zone , class info */
 	if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen,
 		name, namelen, qtype, &lame, &dnsseclame, &reclame,
@@ -84,7 +84,6 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
 /**
 * Select a valid, nice target to send query to.
 * Sorting and removing unsuitable targets is combined.
- * Adds records to the infra cache if not already there.
 *
 * @param iter_env: iterator module global state, with ip6 enabled and 
 *	do-not-query-addresses.
@@ -2436,6 +2436,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	int tf_policy;
 	struct delegpt_addr* target;
 	struct outbound_entry* outq;
+	struct sockaddr_storage real_addr;
+	socklen_t real_addrlen;
 	int auth_fallback = 0;
 	uint8_t* qout_orig = NULL;
 	size_t qout_orig_len = 0;
@@ -3058,6 +3060,17 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->dnssec_lame_query?" but lame_query anyway": "");
 	}

+	real_addr = target->addr;
+	real_addrlen = target->addrlen;
+
+	if(ie->nat64.use_nat64 && target->addr.ss_family == AF_INET) {
+		addr_to_nat64(&target->addr, &ie->nat64.nat64_prefix_addr,
+			ie->nat64.nat64_prefix_addrlen, ie->nat64.nat64_prefix_net,
+			&real_addr, &real_addrlen);
+		log_name_addr(VERB_QUERY, "applied NAT64:",
+			iq->dp->name, &real_addr, real_addrlen);
+	}
+
 	fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
 	outq = (*qstate->env->send_query)(&iq->qinfo_out,
 		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0),
@@ -3069,7 +3082,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		!qstate->blacklist&&(!iter_qname_indicates_dnssec(qstate->env,
 		&iq->qinfo_out)||target->attempts==1)?0:BIT_CD),
 		iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted(
-		ie, iq), sq_check_ratelimit, &target->addr, target->addrlen,
+		ie, iq), sq_check_ratelimit, &real_addr, real_addrlen,
 		iq->dp->name, iq->dp->namelen,
 		(iq->dp->tcp_upstream || qstate->env->cfg->tcp_upstream),
 		(iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream),
@@ -3086,7 +3099,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		log_addr(VERB_QUERY, "error sending query to auth server",
-			&target->addr, target->addrlen);
+			&real_addr, real_addrlen);
 		if(qstate->env->cfg->qname_minimisation)
 			iq->minimisation_state = SKIP_MINIMISE_STATE;
 		return next_state(iq, QUERYTARGETS_STATE);
@@ -3603,7 +3616,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		return next_state(iq, INIT_REQUEST_STATE);
 	} else if(type == RESPONSE_TYPE_LAME) {
 		/* Cache the LAMEness. */
-		verbose(VERB_DETAIL, "query response was categorized as %sLAME",
+		verbose(VERB_DETAIL, "query response was %sLAME",
 			dnsseclame?"DNSSEC ":"");
 		if(!dname_subdomain_c(iq->qchase.qname, iq->dp->name)) {
 			log_err("mark lame: mismatch in qname and dpname");
@@ -3642,7 +3655,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * In this case, the event is just sent directly back to 
 		 * the QUERYTARGETS_STATE without resetting anything, 
 		 * because, clearly, the next target must be tried. */
-		verbose(VERB_DETAIL, "query response was categorized as THROWAWAY");
+		verbose(VERB_DETAIL, "query response was THROWAWAY");
 	} else {
 		log_warn("A query response came back with an unknown type: %d",
 			(int)type);
@@ -52,6 +52,7 @@
 #include "util/data/msgreply.h"
 #include "util/storage/slabhash.h"
 #include "util/edns.h"
+#include "util/tsig.h"
 #include "sldns/sbuffer.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_hints.h"
@@ -81,13 +82,15 @@ context_finalize(struct ub_ctx* ctx)
 		return UB_INITFAIL;
 	listen_setup_locks();
 	log_edns_known_options(VERB_ALGO, ctx->env);
+	if(!tsig_key_table_apply_cfg(ctx->env->tsig_key_table, cfg))
+		return UB_INITFAIL;
 	ctx->local_zones = local_zones_create();
 	if(!ctx->local_zones)
 		return UB_NOMEM;
 	if(!local_zones_apply_cfg(ctx->local_zones, cfg))
 		return UB_INITFAIL;
 	if(!auth_zones_apply_cfg(ctx->env->auth_zones, cfg, 1, &is_rpz,
-		ctx->env, &ctx->mods))
+		ctx->env, &ctx->mods, ctx->env->tsig_key_table))
 		return UB_INITFAIL;
 	if(!(ctx->env->fwds = forwards_create()) ||
 		!forwards_apply_cfg(ctx->env->fwds, cfg))
@@ -59,6 +59,7 @@
 #include "util/tube.h"
 #include "util/ub_event.h"
 #include "util/edns.h"
+#include "util/tsig.h"
 #include "services/modstack.h"
 #include "services/localzone.h"
 #include "services/cache/infra.h"
@@ -168,6 +169,18 @@ static struct ub_ctx* ub_ctx_create_nopipe(void)
 		errno = ENOMEM;
 		return NULL;
 	}
+	ctx->env->tsig_key_table = tsig_key_table_create();
+	if(!ctx->env->tsig_key_table) {
+		auth_zones_delete(ctx->env->auth_zones);
+		edns_known_options_delete(ctx->env);
+		edns_strings_delete(ctx->env->edns_strings);
+		config_delete(ctx->env->cfg);
+		free(ctx->env);
+		ub_randfree(ctx->seed_rnd);
+		free(ctx);
+		errno = ENOMEM;
+		return NULL;
+	}

 	ctx->env->alloc = &ctx->superalloc;
 	ctx->env->worker = NULL;
@@ -388,6 +401,7 @@ ub_ctx_delete(struct ub_ctx* ctx)
 		config_delete(ctx->env->cfg);
 		edns_known_options_delete(ctx->env);
 		edns_strings_delete(ctx->env->edns_strings);
+		tsig_key_table_delete(ctx->env->tsig_key_table);
 		forwards_delete(ctx->env->fwds);
 		hints_delete(ctx->env->hints);
 		auth_zones_delete(ctx->env->auth_zones);
@@ -229,7 +229,9 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)
 		cfg->do_udp || cfg->udp_upstream_without_downstream, w->sslctx,
 		cfg->delay_close, cfg->tls_use_sni, NULL, cfg->udp_connect,
 		cfg->max_reuse_tcp_queries, cfg->tcp_reuse_timeout,
-		cfg->tcp_auth_query_timeout);
+		cfg->tcp_auth_query_timeout, (const char**)cfg->dist,
+		(const char**)cfg->dist_tsig,
+		cfg->num_dist);
 	w->env->outnet = w->back;
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_unlock(&ctx->cfglock);
@@ -853,8 +853,6 @@ struct ub_server_stats {
 	long long qquic;
 	/** number of queries removed due to discard-timeout */
 	long long num_queries_discard_timeout;
-	/** number of queries removed due to replyaddr limit */
-	long long num_queries_replyaddr_limit;
 	/** number of queries removed due to wait-limit */
 	long long num_queries_wait_limit;
 	/** number of dns error reports generated */
@@ -874,8 +872,6 @@ struct ub_stats_info {
 	long long mesh_num_states;
 	/** mesh stats: current number of reply (user) states */
 	long long mesh_num_reply_states;
-	/** mesh stats: current number of reply entries */
-	long long mesh_num_reply_addrs;
 	/** mesh stats: number of reply states overwritten with a new one */
 	long long mesh_jostled;
 	/** mesh stats: number of incoming queries dropped */
@@ -142,7 +142,7 @@ check_git_repo () {
 create_temp_dir () {
    # Creating temp directory
    info "Creating temporary working directory"
-    temp_dir=`mktemp -t -d unbound-dist-XXXXXX`
+    temp_dir=`mktemp -d unbound-dist-XXXXXX`
    info "Directory '$temp_dir' created."
    cd $temp_dir
 }
@@ -409,14 +409,7 @@ if [ "$DOWIN" = "yes" ]; then
 	info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 	git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"
 	cd unbound || error_cleanup "Unbound not exported correctly from git"
-	git submodule update --init || error_cleanup "Could not fetch submodule"
-	rm -rf .git .travis.yml .gitattributes .gitmodules .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
-	rm -rf simdzone/.git simdzone/.github simdzone/.gitignore \
-	       simdzone/configure~ simdzone/config.h.in~ simdzone/autom4te.cache \
-	       simdzone/cmake simdzone/CMakeLists.txt simdzone/simdzoneConfig.cmake.in \
-	       simdzone/conanfile.txt simdzone/tests simdzone/.readthedocs.yaml \
-	       simdzone/doc simdzone/scripts || \
-	       error_cleanup "Failed to remove simdzone .git tracking and ci information"
+	rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"

 	# on a re-configure the cache may no longer be valid...
 	if test -f mingw32-config.cache; then rm mingw32-config.cache; fi
@@ -443,14 +436,11 @@ if [ "$DOWIN" = "yes" ]; then
 	replace_version "configure.ac" "$version" "$version2"
    	version="$version2"
    	info "Rebuilding configure script (autoconf) snapshot."
-	autoreconf -fi || error_cleanup "Autoconf failed."
+	autoconf -f || error_cleanup "Autoconf failed."
 	autoheader -f || error_cleanup "Autoheader failed."
    	rm -r autom4te* || echo "ignored"
 	rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
 	rm -f configure~ || echo "ignore absence of configure~ file."
-	rm -r simdzone/autom4te* || echo "ignored"
-	rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
-	rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."
    fi

    if test "`uname`" = "Linux"; then 
@@ -608,15 +598,7 @@ info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"

 cd unbound || error_cleanup "Unbound not exported correctly from git"
-git submodule update --init || error_cleanup "Could not fetch submodule"
-rm -rf .git .travis.yml .gitattributes .gitmodules .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
-rm -rf simdzone/.git simdzone/.github simdzone/.gitignore \
-       simdzone/configure~ simdzone/config.h.in~ simdzone/autom4te.cache \
-       simdzone/cmake simdzone/CMakeLists.txt simdzone/simdzoneConfig.cmake.in \
-       simdzone/conanfile.txt simdzone/tests simdzone/.readthedocs.yaml \
-       simdzone/doc simdzone/scripts || \
-       error_cleanup "Failed to remove simdzone .git tracking and ci information"
-
+rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"

 info "Adding libtool utils (libtoolize)."
 libtoolize -c --install || libtoolize -c || error_cleanup "Libtoolize failed."
@@ -636,14 +618,11 @@ if [ `uname -s | grep -i -c darwin` -ne 0 ]; then
 fi

 info "Building configure script (autoreconf)."
-autoreconf -fi || error_cleanup "Autoconf failed."
+autoreconf -f || error_cleanup "Autoconf failed."

 rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
 rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
 rm -f configure~ || echo "ignore absence of configure~ file."
-rm -r simdzone/autom4te* || echo "ignored"
-rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
-rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."

 info "Building lexer and parser."
 echo "#include \"config.h\"" > util/configlexer.c || error_cleanup "Failed to create configlexer"
@@ -686,13 +665,10 @@ fi

 if [ "$RECONFIGURE" = "yes" ]; then
    info "Rebuilding configure script (autoconf) snapshot."
-    autoreconf -fi || error_cleanup "Autoconf failed."
+    autoreconf -f || error_cleanup "Autoconf failed."
    rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
    rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
    rm -f configure~ || echo "ignore absence of configure~ file."
-    rm -r simdzone/autom4te* || echo "ignored"
-    rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
-    rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."
 fi

 replace_all doc/README
@@ -709,7 +685,7 @@ info "Renaming Unbound directory to unbound-$version."
 cd ..
 mv unbound unbound-$version || error_cleanup "Failed to rename unbound directory."

-tarfile="$cwd/unbound-$version.tar.gz"
+tarfile="../unbound-$version.tar.gz"

 if [ -f $tarfile ]; then
    (question "The file $tarfile already exists.  Overwrite?" \
@@ -717,7 +693,7 @@ if [ -f $tarfile ]; then
 fi

 info "Creating tar unbound-$version.tar.gz"
-tar czf $tarfile unbound-$version || error_cleanup "Failed to create tar file."
+tar czf ../unbound-$version.tar.gz unbound-$version || error_cleanup "Failed to create tar file."

 cleanup

@@ -55,6 +55,8 @@ struct query_info;
 struct dns_msg;
 struct edns_data;
 struct module_env;
+struct tsig_data;
+struct tsig_key_table;
 struct worker;
 struct comm_point;
 struct comm_timer;
@@ -361,6 +363,8 @@ struct auth_probe {
 	struct comm_timer* timer;
 	/** timeout in msec */
 	int timeout;
+	/** the tsig data for the packet */
+	struct tsig_data* tsig;
 };

 /**
@@ -430,6 +434,8 @@ struct auth_transfer {
 	/** timeout for the transfer.
 	 * on the workers event base. */
 	struct comm_timer* timer;
+	/** the tsig data for the transfer */
+	struct tsig_data* tsig;
 };

 /** list of addresses */
@@ -461,6 +467,8 @@ struct auth_master {
 	int ssl;
 	/** the port number (for urls) */
 	int port;
+	/** the tsig key name (if any, or NULL) */
+	char* tsig_key_name;
 	/** if the host is a hostname, the list of resolved addrs, if any*/
 	struct auth_addr* list;
 };
@@ -490,11 +498,13 @@ struct auth_zones* auth_zones_create(void);
 * @param is_rpz: set to 1 if at least one RPZ zone is configured.
 * @param env: environment for offline verification.
 * @param mods: modules in environment.
+ * @param tsig_key_table: tsig key table to check if tsig keys exist.
+ *	If NULL, no check is performed.
 * @return false on failure.
 */
 int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
 	int setup, int* is_rpz, struct module_env* env,
-	struct module_stack* mods);
+	struct module_stack* mods, struct tsig_key_table* tsig_key_table);

 /** initial pick up of worker timeouts, ties events to worker event loop
 * @param az: auth zones structure
@@ -619,13 +629,19 @@ int auth_zones_can_fallback(struct auth_zones* az, uint8_t* nm, size_t nmlen,
 * @param has_serial: if true, the notify has a serial attached.
 * @param serial: the serial number, if has_serial is true.
 * @param refused: is set to true on failure to note refused access.
+ * @param pkt: the packet for TSIG verify.
+ * @param tsig: if TSIG, the structure is returned here, allocated in
+ *	the worker scratch region.
+ * @param tsig_rcode: if not NOERROR it is the TSIG error code, TSIG failed.
+ * @param scratchpad: region to allocate tsig in.
 * @return fail on failures (refused is false) and when access is
 * 	denied (refused is true).  True when processed.
 */
 int auth_zones_notify(struct auth_zones* az, struct module_env* env,
 	uint8_t* nm, size_t nmlen, uint16_t dclass,
 	struct sockaddr_storage* addr, socklen_t addrlen, int has_serial,
-	uint32_t serial, int* refused);
+	uint32_t serial, int* refused, struct sldns_buffer* pkt,
+	struct tsig_data** tsig, int* tsig_rcode, struct regional* scratchpad);

 /** process notify packet and read serial number from SOA.
 * returns 0 if no soa record in the notify */
@@ -671,10 +687,12 @@ struct auth_xfer* auth_xfer_create(struct auth_zones* az, struct auth_zone* z);
 * @param list: pointer to start of list.  The malloced list is returned here.
 * @param c: the config items to copy over.
 * @param with_http: if true, http urls are also included, before the masters.
+ * @param tsig_key_table: if nonNULL, used to check that tsig keys exist in
+ *	the key table.
 * @return false on failure.
 */
 int xfer_set_masters(struct auth_master** list, struct config_auth* c,
-	int with_http);
+	int with_http, struct tsig_key_table* tsig_key_table);

 /** xfer nextprobe timeout callback, this is part of task_nextprobe */
 void auth_xfer_timer(void* arg);
@@ -1564,7 +1564,7 @@ listen_create(struct comm_base* base, struct listen_port* ports,
 			cp = comm_point_create_udp(base, ports->fd,
 				front->udp_buff, ports->pp2_enabled, cb,
 				cb_arg, ports->socket);
-		} else if(ports->ftype == listen_type_doq && doq_table) {
+		} else if(ports->ftype == listen_type_doq) {
 #ifndef HAVE_NGTCP2
 			log_warn("Unbound is not compiled with "
 				"ngtcp2. This is required to use DNS "
@@ -2884,7 +2884,6 @@ submit_http_error:
 	sldns_buffer_flip(h2_stream->qbuffer);
 	h2_session->postpone_drop = 1;
 	query_read_done = http2_query_read_done(h2_session, h2_stream);
-	h2_session->postpone_drop = 0;
 	if(query_read_done < 0)
 		return NGHTTP2_ERR_CALLBACK_FAILURE;
 	else if(!query_read_done) {
@@ -2894,9 +2893,11 @@ submit_http_error:
 			 * failure will result in reclaiming (and closing)
 			 * of comm point. */
 			verbose(VERB_QUERY, "http2 query dropped in worker cb");
+			h2_session->postpone_drop = 0;
 			return NGHTTP2_ERR_CALLBACK_FAILURE;
 		}
 		/* nothing to submit right now, query added to mesh. */
+		h2_session->postpone_drop = 0;
 		return 0;
 	}
 	if(!http2_submit_dns_response(h2_session)) {
@@ -3274,18 +3275,14 @@ nghttp2_session_callbacks* http2_req_callbacks_create(void)
 struct doq_table*
 doq_table_create(struct config_file* cfg, struct ub_randstate* rnd)
 {
-	struct doq_table* table;
-
-	if (!cfg->quic_port)
-		return NULL;
-	table = calloc(1, sizeof(*table));
+	struct doq_table* table = calloc(1, sizeof(*table));
 	if(!table)
 		return NULL;
 #ifdef USE_NGTCP2_CRYPTO_OSSL
 	/* Initialize the ossl crypto, it is harmless to call twice,
 	 * and this is before use of doq connections. */
 	if(ngtcp2_crypto_ossl_init() != 0) {
-		log_err("ngtcp2_crypto_ossl_init failed");
+		log_err("ngtcp2_crypto_oss_init failed");
 		free(table);
 		return NULL;
 	}
@@ -3357,7 +3354,7 @@ conn_tree_del(rbnode_type* node, void* arg)
 {
 	struct doq_table* table = (struct doq_table*)arg;
 	struct doq_conn* conn;
-	if(!node || !table)
+	if(!node)
 		return;
 	conn = (struct doq_conn*)node->key;
 	if(conn->timer.timer_in_list) {
@@ -3416,7 +3413,6 @@ doq_timer_find_time(struct doq_table* table, struct timeval* tv)
 {
 	struct doq_timer key;
 	struct rbnode_type* node;
-	log_assert(table != NULL);
 	memset(&key, 0, sizeof(key));
 	key.time.tv_sec = tv->tv_sec;
 	key.time.tv_usec = tv->tv_usec;
@@ -4926,7 +4922,6 @@ doq_conid_find(struct doq_table* table, const uint8_t* data, size_t datalen)
 	key.node.key = &key;
 	key.cid = (void*)data;
 	key.cidlen = datalen;
-	log_assert(table != NULL);
 	node = rbtree_search(table->conid_tree, &key);
 	if(node)
 		return (struct doq_conid*)node->key;
@@ -5667,8 +5662,6 @@ doq_table_quic_size_available(struct doq_table* table,
 	struct config_file* cfg, size_t mem)
 {
 	size_t cur;
-	if (!table)
-		return 0;
 	lock_basic_lock(&table->size_lock);
 	cur = table->current_size;
 	lock_basic_unlock(&table->size_lock);
@@ -45,6 +45,7 @@
 #include "config.h"
 #include "services/mesh.h"
 #include "services/outbound_list.h"
+#include "services/outside_network.h"
 #include "services/cache/dns.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
@@ -58,6 +59,7 @@
 #include "util/alloc.h"
 #include "util/config_file.h"
 #include "util/edns.h"
+#include "sldns/parseutil.h"
 #include "sldns/sbuffer.h"
 #include "sldns/wire2str.h"
 #include "services/localzone.h"
@@ -65,6 +67,8 @@
 #include "respip/respip.h"
 #include "services/listen_dnsport.h"
 #include "util/timeval_func.h"
+#include "util/allow_response_list.h"
+#include "util/tsig.h"

 #ifdef CLIENT_SUBNET
 #include "edns-subnet/subnetmod.h"
@@ -231,7 +235,6 @@ mesh_create(struct module_stack* stack, struct module_env* env)
 	mesh->ans_expired = 0;
 	mesh->ans_cachedb = 0;
 	mesh->num_queries_discard_timeout = 0;
-	mesh->num_queries_replyaddr_limit = 0;
 	mesh->num_queries_wait_limit = 0;
 	mesh->num_dns_error_reports = 0;
 	mesh->max_reply_states = env->cfg->num_queries_per_thread;
@@ -463,8 +466,6 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		if(!mesh_make_new_space(mesh, rep->c->buffer)) {
 			verbose(VERB_ALGO, "Too many queries. dropping "
 				"incoming query.");
-			if(rep->c->use_h2)
-				http2_stream_remove_mesh_state(rep->c->h2_stream);
 			comm_point_drop_reply(rep);
 			mesh->stats_dropped++;
 			return;
@@ -476,10 +477,8 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		if(mesh->num_reply_addrs > mesh->max_reply_states*16) {
 			verbose(VERB_ALGO, "Too many requests queued. "
 				"dropping incoming query.");
-			if(rep->c->use_h2)
-				http2_stream_remove_mesh_state(rep->c->h2_stream);
 			comm_point_drop_reply(rep);
-			mesh->num_queries_replyaddr_limit++;
+			mesh->stats_dropped++;
 			return;
 		}
 	}
@@ -1741,6 +1740,69 @@ void mesh_query_done(struct mesh_state* mstate)
 	if(mstate->reply_list && mstate->s.env->cfg->dns_error_reporting)
 		dns_error_reporting(&mstate->s, rep);

+	if(mstate->reply_list && rep) {
+		uint8_t data[8192];
+		struct sldns_buffer dest;
+		int i;
+
+		sldns_buffer_init_frm_data(&dest, data, sizeof(data));
+		reply_info_answer_encode(&mstate->s.qinfo, rep, 0 /* id */,
+				0 /* qflags */, &dest, 0 /* current time */,
+				1 /* cached */, mstate->s.env->scratch,
+				sizeof(data) /* udpsize */, NULL /* edns */,
+				1 /* dnssec */, 0 /* secure */);
+		log_err("Answer to be send to %d other unbounds, size: %d",
+				mstate->s.env->outnet->num_dist,
+				(int)sldns_buffer_limit(&dest));
+		for(i = 0; i < mstate->s.env->outnet->num_dist; i++) {
+			struct tsig_key* key;
+			int r;
+			uint8_t data_signed[8192];
+			struct sldns_buffer dest_signed;
+
+			if(mstate->s.env->outnet->dist[i] == -1
+			|| mstate->s.env->outnet->dist_tsig[i] == NULL)
+				continue;
+			if(mstate->s.env->outnet->dist_tsig[i] == TSIG_NOKEY) {
+				send(mstate->s.env->outnet->dist[i],
+					data, sldns_buffer_limit(&dest), 0);
+				continue;
+			}
+			lock_rw_rdlock(&mstate->s.env->tsig_key_table->lock);
+			key = tsig_key_table_search_fromstr(
+					mstate->s.env->tsig_key_table,
+					mstate->s.env->outnet->dist_tsig[i]);
+			if(!key) {
+				lock_rw_unlock(
+					&mstate->s.env->tsig_key_table->lock);
+				log_err("tsig key \"%s\" not found when "
+					"distributing responses", 
+					mstate->s.env->outnet->dist_tsig[i]);
+				continue;
+			}
+			sldns_buffer_init_frm_data(&dest_signed,
+					data_signed, sizeof(data_signed));
+			sldns_buffer_write(&dest_signed,
+					data, sldns_buffer_limit(&dest));
+			if((r = tsig_sign_shared(&dest_signed, key->name,
+					key->algo->wireformat_name,
+					key->data, key->data_len,
+					*mstate->s.env->now))) {
+				lock_rw_unlock(
+					&mstate->s.env->tsig_key_table->lock);
+				log_err("tsig key \"%s\" failed to sign"
+					"distributing response: %s",
+					key->name_str,
+					sldns_lookup_by_id(sldns_tsig_errors, r)?
+                                        sldns_lookup_by_id(sldns_tsig_errors, r)->name:"??");
+				continue;
+			}
+			lock_rw_unlock(&mstate->s.env->tsig_key_table->lock);
+			send(mstate->s.env->outnet->dist[i], data_signed,
+					sldns_buffer_position(&dest_signed), 0);
+		}
+	}
+
 	for(r = mstate->reply_list; r; r = r->next) {
 		if(mesh_is_udp(r)) {
 			/* For UDP queries, the old replies are discarded.
@@ -1770,8 +1832,6 @@ void mesh_query_done(struct mesh_state* mstate)
 					http2_stream_remove_mesh_state(r->h2_stream);
 				comm_point_drop_reply(&r->query_reply);
 				mstate->reply_list = reply_list;
-				log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
-				mstate->s.env->mesh->num_reply_addrs--;
 				mstate->s.env->mesh->num_queries_discard_timeout++;
 				continue;
 			}
@@ -1808,8 +1868,6 @@ void mesh_query_done(struct mesh_state* mstate)
 			}
 			comm_point_drop_reply(&r->query_reply);
 			mstate->reply_list = reply_list;
-			log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
-			mstate->s.env->mesh->num_reply_addrs--;
 		} else {
 			struct sldns_buffer* r_buffer = r->query_reply.c->buffer;
 			if(r->query_reply.c->tcp_req_info) {
@@ -2300,7 +2358,6 @@ mesh_stats_clear(struct mesh_area* mesh)
 	memset(&mesh->rpz_action[0], 0, sizeof(size_t)*UB_STATS_RPZ_ACTION_NUM);
 	mesh->ans_nodata = 0;
 	mesh->num_queries_discard_timeout = 0;
-	mesh->num_queries_replyaddr_limit = 0;
 	mesh->num_queries_wait_limit = 0;
 	mesh->num_dns_error_reports = 0;
 }
@@ -141,8 +141,6 @@ struct mesh_area {
 	size_t rpz_action[UB_STATS_RPZ_ACTION_NUM];
 	/** stats, number of queries removed due to discard-timeout */
 	size_t num_queries_discard_timeout;
-	/** stats, number of queries removed due to replyaddr limit */
-	size_t num_queries_replyaddr_limit;
 	/** stats, number of queries removed due to wait-limit */
 	size_t num_queries_wait_limit;
 	/** stats, number of dns error reports generated */
@@ -59,6 +59,7 @@
 #include "util/random.h"
 #include "util/fptr_wlist.h"
 #include "util/edns.h"
+#include "util/allow_response_list.h"
 #include "sldns/sbuffer.h"
 #include "dnstap/dnstap.h"
 #ifdef HAVE_OPENSSL_SSL_H
@@ -1678,7 +1679,8 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
 	void* sslctx, int delayclose, int tls_use_sni, struct dt_env* dtenv,
 	int udp_connect, int max_reuse_tcp_queries, int tcp_reuse_timeout,
-	int tcp_auth_query_timeout)
+	int tcp_auth_query_timeout, const char** dist, const char** dist_tsig,
+	int num_dist)
 {
 	struct outside_network* outnet = (struct outside_network*)
 		calloc(1, sizeof(struct outside_network));
@@ -1819,6 +1821,32 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 			}
 		}
 	}
+	if (!(outnet->num_dist = num_dist))
+		outnet->dist = NULL;
+	else if ((outnet->dist = calloc(num_dist, sizeof(int))) &&
+	         (outnet->dist_tsig = calloc(num_dist, sizeof(const char*)))) {
+		int i;
+
+		for(i = 0; i < num_dist; i++) {
+			struct sockaddr_storage addr;
+			socklen_t addrlen;
+			int s = -1;
+
+			if(!extstrtoaddr(dist[i], &addr, &addrlen, UNBOUND_DNS_PORT)
+			|| (s = socket(addr.ss_family, SOCK_DGRAM, 0)) == -1
+			|| !fd_set_nonblock(s)
+			|| connect(s, (struct sockaddr*)&addr, addrlen)) {
+				if(s != -1)
+					close(s);
+				s = -1;
+			}
+			outnet->dist[i] = s;
+			outnet->dist_tsig[i] = dist_tsig[i] == NULL ? NULL
+			                     : strcmp(dist_tsig[i], TSIG_NOKEY)
+			                     ? strdup(dist_tsig[i])
+			                     : TSIG_NOKEY;
+		}
+	}
 	return outnet;
 }

@@ -1949,6 +1977,8 @@ outside_network_delete(struct outside_network* outnet)
 			p = np;
 		}
 	}
+	if(outnet->num_dist > 0 && outnet->dist != NULL)
+		free(outnet->dist);
 	free(outnet);
 }

@@ -48,10 +48,6 @@
 #include "util/regional.h"
 #include "util/netevent.h"
 #include "dnstap/dnstap_config.h"
-#ifdef __QNX__
-/* For struct timeval */
-#include <sys/time.h>
-#endif /* __QNX__ */
 struct pending;
 struct pending_timeout;
 struct ub_randstate;
@@ -194,6 +190,12 @@ struct outside_network {
 	struct waiting_tcp* tcp_wait_first;
 	/** last of waiting query list */
 	struct waiting_tcp* tcp_wait_last;
+	/** number of IP addresses to send to be cached responses to */
+	int num_dist;
+	/** udp sockets to the addresses to send to be cached responses to */
+	int* dist;
+	/** names of TSIG keys with which to sign the outgoing responses */
+	const char** dist_tsig;
 };

 /**
@@ -574,7 +576,8 @@ struct outside_network* outside_network_create(struct comm_base* base,
 	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
 	void* sslctx, int delayclose, int tls_use_sni, struct dt_env *dtenv,
 	int udp_connect, int max_reuse_tcp_queries, int tcp_reuse_timeout,
-	int tcp_auth_query_timeout);
+	int tcp_auth_query_timeout, const char** dist, const char** dist_tsig,
+	int num_dist);

 /**
 * Delete outside_network structure.
@@ -486,7 +486,6 @@ enum sldns_enum_ede_code
 typedef enum sldns_enum_ede_code sldns_ede_code;

 #define LDNS_EDNS_MASK_DO_BIT 0x8000
-#define LDNS_EDNS_MASK_CO_BIT 0x4000

 /** TSIG and TKEY extended rcodes (16bit), 0-15 are the normal rcodes. */
 #define LDNS_TSIG_ERROR_NOERROR  0
@@ -496,6 +495,7 @@ typedef enum sldns_enum_ede_code sldns_ede_code;
 #define LDNS_TSIG_ERROR_BADMODE  19
 #define LDNS_TSIG_ERROR_BADNAME  20
 #define LDNS_TSIG_ERROR_BADALG   21
+#define LDNS_TSIG_ERROR_BADTRUNC 22

 /** DNS Cookie extended rcode */
 #define LDNS_EXT_RCODE_BADCOOKIE 23
@@ -56,6 +56,18 @@ sldns_read_uint32(const void *src)
 #endif
 }

+INLINE uint64_t
+sldns_read_uint48(const void *src)
+{
+        const uint8_t *p = (const uint8_t *) src;
+        return (  ((uint64_t) p[0] << 40)
+	        | ((uint64_t) p[1] << 32)
+	        | ((uint64_t) p[2] << 24)
+                | ((uint64_t) p[3] << 16)
+                | ((uint64_t) p[4] << 8)
+                |  (uint64_t) p[5]);
+}
+
 /*
 * Copy data allowing for unaligned accesses in network byte order
 * (big endian).
@@ -693,6 +705,32 @@ sldns_buffer_read_u32(sldns_buffer *buffer)
 	return result;
 }

+/**
+ * returns the 6-byte integer value at the given position in the buffer
+ * \param[in] buffer the buffer
+ * \param[in] at position in the buffer
+ * \return 6 byte integer
+ */
+INLINE uint64_t
+sldns_buffer_read_u48_at(sldns_buffer *buffer, size_t at)
+{
+	assert(sldns_buffer_available_at(buffer, at, 6));
+	return sldns_read_uint48(buffer->_data + at);
+}
+
+/**
+ * returns the 6-byte integer value at the current position in the buffer
+ * \param[in] buffer the buffer
+ * \return 6 byte integer
+ */
+INLINE uint64_t
+sldns_buffer_read_u48(sldns_buffer *buffer)
+{
+	uint64_t result = sldns_buffer_read_u48_at(buffer, buffer->_position);
+	buffer->_position += 6;
+	return result;
+}
+
 /**
 * returns the status of the buffer
 * \param[in] buffer
@@ -256,6 +256,7 @@ static sldns_lookup_table sldns_tsig_errors_data[] = {
 	{ LDNS_TSIG_ERROR_BADMODE, "BADMODE" },
 	{ LDNS_TSIG_ERROR_BADNAME, "BADNAME" },
 	{ LDNS_TSIG_ERROR_BADALG, "BADALG" },
+	{ LDNS_TSIG_ERROR_BADTRUNC, "BADTRUNC" },
 	{ 0, NULL }
 };
 sldns_lookup_table* sldns_tsig_errors = sldns_tsig_errors_data;
@@ -2486,8 +2487,6 @@ int sldns_wire2str_edns_scan(uint8_t** data, size_t* data_len, char** str,
 	w += sldns_str_print(str, str_len, " flags:");
 	if((edns_bits & LDNS_EDNS_MASK_DO_BIT))
 		w += sldns_str_print(str, str_len, " do");
-	if((edns_bits & LDNS_EDNS_MASK_CO_BIT))
-		w += sldns_str_print(str, str_len, " co");
 	/* the extended rcode is the value set, shifted four bits,
 	 * and or'd with the original rcode */
 	if(ext_rcode) {
@@ -49,6 +49,7 @@
 #include "util/module.h"
 #include "util/net_help.h"
 #include "util/regional.h"
+#include "util/tsig.h"
 #include "iterator/iterator.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_hints.h"
@@ -1003,13 +1004,23 @@ static void
 check_auth(struct config_file* cfg)
 {
 	int is_rpz = 0;
+	struct tsig_key_table* tsig_key_table;
 	struct auth_zones* az = auth_zones_create();
-	if(!az || !auth_zones_apply_cfg(az, cfg, 0, &is_rpz, NULL, NULL)) {
+
+	/* construct tsig key table for tsig key name checks, and it
+	 * also checks the TSIG key name and algorithm and base64 syntax. */
+	tsig_key_table = tsig_key_table_create();
+	if(!tsig_key_table || !tsig_key_table_apply_cfg(tsig_key_table, cfg))
+		fatal_exit("Could not set up TSIG keys");
+
+	if(!az || !auth_zones_apply_cfg(az, cfg, 0, &is_rpz, NULL, NULL,
+		tsig_key_table)) {
 		fatal_exit("Could not setup authority zones");
 	}
 	if(is_rpz && !strstr(cfg->module_conf, "respip"))
 		fatal_exit("RPZ requires the respip module");
 	auth_zones_delete(az);
+	tsig_key_table_delete(tsig_key_table);
 }

 /** check config file */
@@ -236,8 +236,6 @@ static void pr_stats(const char* nm, struct ub_stats_info* s)
 		s->svr.num_queries_cookie_invalid);
 	PR_UL_NM("num.queries_discard_timeout",
 		s->svr.num_queries_discard_timeout);
-	PR_UL_NM("num.queries_replyaddr_limit",
-		s->svr.num_queries_replyaddr_limit);
 	PR_UL_NM("num.queries_wait_limit", s->svr.num_queries_wait_limit);
 	PR_UL_NM("num.cachehits",
 		s->svr.num_queries - s->svr.num_queries_missed_cache);
@@ -265,7 +263,6 @@ static void pr_stats(const char* nm, struct ub_stats_info* s)
 	PR_UL_NM("requestlist.exceeded", s->mesh_dropped);
 	PR_UL_NM("requestlist.current.all", s->mesh_num_states);
 	PR_UL_NM("requestlist.current.user", s->mesh_num_reply_states);
-	PR_UL_NM("requestlist.current.replies", s->mesh_num_reply_addrs);
 #ifndef S_SPLINT_S
 	sumwait.tv_sec = s->mesh_replies_sum_wait_sec;
 	sumwait.tv_usec = s->mesh_replies_sum_wait_usec;
@@ -2255,7 +2255,7 @@ create_doq_client_data(const char* svr, int port, struct ub_event_base* base,
 	/* Initialize the ossl crypto, it is harmless to call twice,
 	 * and this is before use of doq connections. */
 	if(ngtcp2_crypto_ossl_init() != 0)
-		fatal_exit("ngtcp2_crypto_ossl_init failed");
+		fatal_exit("ngtcp2_crypto_oss_init failed");
 #elif defined(HAVE_NGTCP2_CRYPTO_QUICTLS_INIT)
 	if(ngtcp2_crypto_quictls_init() != 0)
 		fatal_exit("ngtcp2_crypto_quictls_init failed");
@@ -1134,7 +1134,8 @@ outside_network_create(struct comm_base* base, size_t bufsize,
 	int ATTR_UNUSED(delayclose), int ATTR_UNUSED(tls_use_sni),
 	struct dt_env* ATTR_UNUSED(dtenv), int ATTR_UNUSED(udp_connect),
 	int ATTR_UNUSED(max_reuse_tcp_queries), int ATTR_UNUSED(tcp_reuse_timeout),
-	int ATTR_UNUSED(tcp_auth_query_timeout))
+	int ATTR_UNUSED(tcp_auth_query_timeout), const char** ATTR_UNUSED(dist),
+	const char** ATTR_UNUSED(dist_tsig), int ATTR_UNUSED(num_dist))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)base;
 	struct outside_network* outnet =  calloc(1,
@@ -222,8 +222,7 @@ read_http_headers(SSL* ssl, char* file, size_t flen, char* host, size_t hlen,
 		if(verb>=2) printf("read: %s\n", buf);
 		if(buf[0] == 0) {
 			int e = ERR_peek_error();
-			if(e)
-				printf("error string: %s\n", ERR_reason_error_string(e));
+			printf("error string: %s\n", ERR_reason_error_string(e));
 			return 1;
 		}
 		if(!process_one_header(buf, file, flen, host, hlen, vs))
@@ -247,8 +246,7 @@ setup_ctx(char* key, char* cert)
 #endif
 	if(!SSL_CTX_use_certificate_chain_file(ctx, cert)) {
 		int e = ERR_peek_error();
-		if(e)
-			printf("error string: %s\n", ERR_reason_error_string(e));
+		printf("error string: %s\n", ERR_reason_error_string(e));
 		print_exit("cannot read cert");
 	}
 	if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM))
@@ -142,10 +142,6 @@
 #include "util/netevent.h"
 #include "testcode/testpkts.h"
 #include "util/rbtree.h"
-#ifdef __QNX__
-/* For struct timeval */
-#include <sys/time.h>
-#endif /* __QNX__ */
 struct replay_answer;
 struct replay_moment;
 struct replay_range;
@@ -135,8 +135,6 @@ static void matchline(char* line, struct entry* e)
 			e->match_ttl = 1;
 		} else if(str_keyword(&parse, "DO")) {
 			e->match_do = 1;
-		} else if(str_keyword(&parse, "CO")) {
-			e->match_co = 1;
 		} else if(str_keyword(&parse, "noedns")) {
 			e->match_noedns = 1;
 		} else if(str_keyword(&parse, "ednsdata")) {
@@ -180,7 +178,7 @@ static void matchline(char* line, struct entry* e)

 /** parse REPLY line */
 static void replyline(char* line, uint8_t* reply, size_t reply_len,
-	int* do_flag, int* co_flag)
+	int* do_flag)
 {
 	char* parse = line;
 	if(reply_len < LDNS_HEADER_SIZE) error("packet too short for header");
@@ -238,8 +236,6 @@ static void replyline(char* line, uint8_t* reply, size_t reply_len,
 			LDNS_AD_SET(reply);
 		} else if(str_keyword(&parse, "DO")) {
 			*do_flag = 1;
-		} else if(str_keyword(&parse, "CO")) {
-			*co_flag = 1;
 		} else {
 			error("could not parse REPLY: '%s'", parse);
 		}
@@ -293,7 +289,6 @@ static struct entry* new_entry(void)
 	e->match_all_noedns = 0;
 	e->match_ttl = 0;
 	e->match_do = 0;
-	e->match_co = 0;
 	e->match_noedns = 0;
 	e->match_serial = 0;
 	e->ixfr_soa_serial = 0;
@@ -526,17 +521,15 @@ static void add_rr(char* rrstr, uint8_t* pktbuf, size_t pktsize,

 /* add EDNS 4096 opt record */
 static void
-add_edns(uint8_t* pktbuf, size_t pktsize, int do_flag, int co_flag,
-	uint8_t *ednsdata, uint16_t ednslen, size_t* pktlen)
+add_edns(uint8_t* pktbuf, size_t pktsize, int do_flag, uint8_t *ednsdata,
+	uint16_t ednslen, size_t* pktlen)
 {
 	uint8_t edns[] = {0x00, /* root label */
 		0x00, LDNS_RR_TYPE_OPT, /* type */
 		0x04, 0xD0, /* class is UDPSIZE 1232 */
 		0x00, /* TTL[0] is ext rcode */
 		0x00, /* TTL[1] is edns version */
-		(uint8_t)(do_flag?0x80:0x00)
-		| (uint8_t)(co_flag?0x40:0x00)
-		, 0x00, /* TTL[2-3] is edns flags, DO */
+		(uint8_t)(do_flag?0x80:0x00), 0x00, /* TTL[2-3] is edns flags, DO */
 		(uint8_t)((ednslen >> 8) & 0xff),
 		(uint8_t)(ednslen  & 0xff), /* rdatalength */
 	};
@@ -568,7 +561,6 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 	uint8_t pktbuf[MAX_PACKETLEN];
 	size_t pktlen = LDNS_HEADER_SIZE;
 	int do_flag = 0; /* DO flag in EDNS */
-	int co_flag = 0; /* CO flag in EDNS */
 	memset(pktbuf, 0, pktlen); /* ID = 0, FLAGS="", and rr counts 0 */

 	while(fgets(line, (int)sizeof(line), in) != NULL) {
@@ -606,7 +598,7 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 		if(str_keyword(&parse, "MATCH")) {
 			matchline(parse, current);
 		} else if(str_keyword(&parse, "REPLY")) {
-			replyline(parse, pktbuf, pktlen, &do_flag, &co_flag);
+			replyline(parse, pktbuf, pktlen, &do_flag);
 		} else if(str_keyword(&parse, "ADJUST")) {
 			adjustline(parse, current, cur_reply);
 		} else if(str_keyword(&parse, "EXTRA_PACKET")) {
@@ -662,16 +654,15 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 			if(hex_ednsdata_buffer)
 				sldns_buffer_free(hex_ednsdata_buffer);
 			if(pktlen != 0) {
-				if(do_flag || co_flag
-					|| cur_reply->raw_ednsdata) {
+				if(do_flag || cur_reply->raw_ednsdata) {
 					if(cur_reply->raw_ednsdata &&
 						sldns_buffer_limit(cur_reply->raw_ednsdata))
-						add_edns(pktbuf, sizeof(pktbuf), do_flag, co_flag,
+						add_edns(pktbuf, sizeof(pktbuf), do_flag,
 							sldns_buffer_begin(cur_reply->raw_ednsdata),
 							(uint16_t)sldns_buffer_limit(cur_reply->raw_ednsdata),
 							&pktlen);
 					else
-						add_edns(pktbuf, sizeof(pktbuf), do_flag, co_flag,
+						add_edns(pktbuf, sizeof(pktbuf), do_flag,
 							NULL, 0, &pktlen);
 				}
 				cur_reply->reply_pkt = memdup(pktbuf, pktlen);
@@ -918,22 +909,6 @@ get_do_flag(uint8_t* pkt, size_t len)
 	return (int)(edns_bits&LDNS_EDNS_MASK_DO_BIT);
 }

-/** return true if the CO flag is set */
-static int
-get_co_flag(uint8_t* pkt, size_t len)
-{
-	uint16_t edns_bits;
-	uint8_t* walk = pkt;
-	size_t walk_len = len;
-	if(!pkt_find_edns_opt(&walk, &walk_len)) {
-		return 0;
-	}
-	if(walk_len < 6)
-		return 0; /* malformed */
-	edns_bits = sldns_read_uint16(walk+4);
-	return (int)(edns_bits&LDNS_EDNS_MASK_CO_BIT);
-}
-
 /** Snips the specified EDNS option out of the OPT record and puts it in the
 *  provided buffer. The buffer should be able to hold any opt data ie 65535.
 *  Returns the length of the option written,
@@ -1679,10 +1654,6 @@ find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
 			verbose(3, "no DO bit set\n");
 			continue;
 		}
-		if(p->match_co && !get_co_flag(query_pkt, len)) {
-			verbose(3, "no CO bit set\n");
-			continue;
-		}
 		if(p->match_noedns && get_has_edns(query_pkt, len)) {
 			verbose(3, "bad; EDNS OPT present\n");
 			continue;
@@ -218,8 +218,6 @@ struct entry {
 	uint8_t match_ttl;
 	/** match DO bit */
 	uint8_t match_do;
-	/** match CO bit */
-	uint8_t match_co;
 	/** match absence of EDNS OPT record in query */
 	uint8_t match_noedns;
 	/** match edns data field given in hex */
@@ -207,11 +207,7 @@ rr_test_file(const char* input, const char* check)
 #define xstr(s) str(s)
 #define str(s) #s

-#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
-#else /* !__QNX__ */
-#define SRCDIRSTR "."
-#endif /* __QNX__ */

 /** read rrs to and from string, to and from wireformat */
 static void
@@ -283,7 +283,7 @@ net_test(void)
 		unit_assert(strcmp(astr, "1.2.3.0") == 0);
 		unit_assert(ntohs(((struct sockaddr_in*)&a)->sin_port)==53);

-		res = netblockstrtoaddr("2001:db8:33:44::/64", 53,
+		res = netblockstrtoaddr("2001:DB8:33:44::/64", 53,
 			&a, &alen, &net);
 		unit_assert(res!=0 && net == 64);
 		addr_to_str(&a, alen, astr, sizeof(astr));
@@ -1362,6 +1362,7 @@ main(int argc, char* argv[])
 #ifdef HAVE_NGTCP2
 	doq_test();
 #endif /* HAVE_NGTCP2 */
+	tsig_test();
 	if(log_get_lock()) {
 		lock_basic_destroy((lock_basic_type*)log_get_lock());
 	}
@@ -88,5 +88,7 @@ void tcpreuse_test(void);
 void doq_test(void);
 /** unit test for infra cache functions */
 void infra_test(void);
+/** unit test for tsig functions */
+void tsig_test(void);

 #endif /* TESTCODE_UNITMAIN_H */
@@ -498,11 +498,7 @@ testfromdrillfile(sldns_buffer* pkt, struct alloc_cache* alloc,
 #define xstr(s) str(s)
 #define str(s) #s

-#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
-#else /* !__QNX__ */
-#define SRCDIRSTR "."
-#endif /* __QNX__ */

 void msgparse_test(void)
 {
@@ -513,11 +513,8 @@ nsec3_hash_test(const char* fname)
 #define xstr(s) str(s)
 #define str(s) #s

-#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
-#else /* !__QNX__ */
-#define SRCDIRSTR "."
-#endif /* __QNX__ */
+
 #if defined(HAVE_SSL) && defined(USE_SHA1)
 /* Detect if openssl is configured to disable RSASHA1 signatures,
 * with the rh-allow-sha1-signatures disabled. */
@@ -50,11 +50,7 @@

 #define xstr(s) str(s)
 #define str(s) #s
-#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
-#else /* !__QNX__ */
-#define SRCDIRSTR "."
-#endif /* __QNX__ */

 /** Add zone from file for testing */
 struct auth_zone* authtest_addzone(struct auth_zones* az, const char* name,
@@ -40,8 +40,6 @@ grep -F -v -e "dnstap" hlist > ilist; mv ilist hlist
 grep -F -v -e "util/siphash.c" hlist > ilist; mv ilist hlist
 # filter out compat
 grep -F -v -e "compat/" hlist > ilist; mv ilist hlist
-# filter out simdzone
-grep -F -v -e "simdzone/" hlist > ilist; mv ilist hlist
 for h in `cat hlist`; do
 	if grep -F "`basename $h`" $PRE/doc/html/files.html >/dev/null; then
 		: # ok
@@ -24,7 +24,7 @@ server:
 	# specify every interface on a new 'interface:' labelled line.
 	interface: 192.0.2.153
 	interface: 192.0.2.154
-	interface: 2001:db8::5
+	interface: 2001:DB8::5

 	# port to answer queries from
 	port: 53
@@ -11,7 +11,7 @@ server:
 	# specify every interface on a new 'interface:' labelled line.
 	interface: 192.0.2.153
 	interface: 192.0.2.154
-	interface: 2001:db8::5
+	interface: 2001:DB8::5
 	interface: 0.0.0.0@5353

 	# config
@@ -1,341 +0,0 @@
-; config options
-server:
-	target-fetch-policy: "0 0 0 0 0"
-	access-control: 1.2.3.0/24 allow
-
-auth-zone:
-	name: "example.com."
-	## zonefile (or none).
-	## zonefile: "example.com.zone"
-	## master by IP address or hostname
-	## can list multiple masters, each on one line.
-	## master:
-	master: 1.2.3.44
-	## this is as a hostname, to test the hostname lookup.
-	allow-notify: svr.example.org
-	## url for http fetch
-	## url:
-	## queries from downstream clients get authoritative answers.
-	## for-downstream: yes
-	for-downstream: yes
-	## queries are used to fetch authoritative answers from this zone,
-	## instead of unbound itself sending queries there.
-	## for-upstream: yes
-	for-upstream: yes
-	## on failures with for-upstream, fallback to sending queries to
-	## the authority servers
-	## fallback-enabled: no
-
-	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
-	zonefile:
-TEMPFILE_NAME example.com
-	## this is the inline file /tmp/xxx.example.com
-	## the tempfiles are deleted when the testrun is over.
-TEMPFILE_CONTENTS example.com
-example.com. 3600 IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
-TEMPFILE_END
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test authority zone with lookup for a NOTIFY
-; The allow-notify is specified as a hostname.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-org. IN NS
-SECTION AUTHORITY
-org.	IN NS	ns.org.
-SECTION ADDITIONAL
-ns.org.	IN 	A	1.2.3.45
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com. IN A 1.2.3.44
-ENTRY_END
-RANGE_END
-
-; ns.org
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.45
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-org. IN NS
-SECTION ANSWER
-org.	IN NS	ns.org.
-SECTION ADDITIONAL
-ns.org. IN A 1.2.3.45
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.org. IN NS
-SECTION AUTHORITY
-example.org.	IN NS	ns.example.org.
-SECTION ADDITIONAL
-ns.example.org. IN A 1.2.3.46
-ENTRY_END
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.44
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.44
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-ns.example.net. IN A
-SECTION ANSWER
-ns.example.net. IN A	1.2.3.44
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-ns.example.net. IN AAAA
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-www.example.net. IN A	1.2.3.44
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.	IN NS	ns.example.net.
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN SOA
-SECTION ANSWER
-; serial, refresh, retry, expire, minimum
-example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOTIMPL
-SECTION QUESTION
-example.com. IN IXFR
-SECTION ANSWER
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-example.com. IN AXFR
-SECTION ANSWER
-example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
-example.com.	IN NS	ns.example.net.
-EXTRA_PACKET
-REPLY QR AA NOERROR
-SECTION QUESTION
-example.com. IN AXFR
-SECTION ANSWER
-www.example.com. IN A	1.2.3.4
-example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
-ENTRY_END
-RANGE_END
-
-; ns.example.org.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.46
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-example.org. IN NS
-SECTION ANSWER
-example.org.	IN NS	ns.example.org.
-SECTION ADDITIONAL
-ns.example.org.		IN 	A	1.2.3.46
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-svr.example.org. IN A
-SECTION ANSWER
-svr.example.org. IN A 1.2.3.47
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-svr.example.org. IN AAAA
-SECTION AUTHORITY
-example.org. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
-ENTRY_END
-RANGE_END
-
-; lookups for notify hostnames.
-STEP 1 TIME_PASSES ELAPSE 0
-
-; now the query
-STEP 2 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR AA RD RA NXDOMAIN
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-example.com. 3600 IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
-ENTRY_END
-
-; NOTIFY example.com
-STEP 30 QUERY ADDRESS 1.2.3.47
-ENTRY_BEGIN
-REPLY NOTIFY
-SECTION QUESTION
-example.com. IN SOA
-ENTRY_END
-; notify reply
-STEP 40 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RA NOTIFY NOERROR
-SECTION QUESTION
-example.com. IN SOA
-SECTION ANSWER
-ENTRY_END
-
-STEP 50 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 60 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR AA RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	1.2.3.4
-ENTRY_END
-
-; the zonefile was updated with new contents
-STEP 70 CHECK_TEMPFILE example.com
-FILE_BEGIN
-example.com.	3600	IN	SOA	ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
-example.com.	3600	IN	NS	ns.example.net.
-www.example.com.	3600	IN	A	1.2.3.4
-FILE_END
-
-SCENARIO_END
@@ -0,0 +1,16 @@
+BaseName: auth_tsig
+Version: 1.0
+Description: Perform AXFR with TSIG for authority zone.
+CreationDate: Fri 12 Sep 09:35:40 CEST 2025
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: auth_tsig.pre
+Post: auth_tsig.post
+Test: auth_tsig.test
+AuxFiles: 
+Passed:
+Failure:
@@ -0,0 +1,23 @@
+server:
+	logfile: "/dev/stderr"
+	xfrdfile: xfrd.state
+	username: ""
+	chroot: ""
+	zonesdir: ""
+	pidfile: "nsd.pid"
+	zonelistfile: "zone.list"
+	verbosity: 5
+	port: @NSD_PORT@
+	interface: 127.0.0.1@@NSD_PORT@
+
+key:
+	name: "test.key"
+	algorithm: sha256
+	secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
+
+zone:
+	name: "example.com"
+	zonefile: "example.com.zone"
+	provide-xfr: 0.0.0.0/0 test.key
+	provide-xfr: ::0/0 test.key
+	notify: 127.0.0.1@@UNBOUND_PORT@ test.key
@@ -0,0 +1,14 @@
+# #-- auth_tsig.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $NSD_PID
+kill_pid $UNBOUND_PID
+echo "nsd.log"
+cat nsd.log
+echo "unbound.log"
+cat unbound.log
@@ -0,0 +1,59 @@
+# #-- auth_tsig.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+#skip_test "Skip test due to no UDP service for SOA query"
+PRE="../.."
+if test -n "$NSD"; then
+	:
+else
+	if `which nsd >/dev/null 2>&1`; then
+		NSD="nsd"
+	else
+		if test -f $PRE/../nsd/nsd; then
+			NSD="$PRE/../nsd/nsd"
+		else
+			skip_test "need nsd"
+		fi
+	fi
+fi
+echo "NSD=$NSD"
+
+if test -f $PRE/unbound_do_valgrind_in_test; then
+	do_valgrind=yes
+else
+	do_valgrind=no
+fi
+VALGRIND_FLAGS="--leak-check=full --show-leak-kinds=all"
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+NSD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "NSD_PORT=$NSD_PORT" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@UNBOUND_PORT\@/'$UNBOUND_PORT'/' -e 's/@NSD_PORT\@/'$NSD_PORT'/' < auth_tsig.ub.conf > ub.conf
+sed -e 's/@UNBOUND_PORT\@/'$UNBOUND_PORT'/' -e 's/@NSD_PORT\@/'$NSD_PORT'/' < auth_tsig.nsd.conf > nsd.conf
+
+# start nsd
+$NSD -d -c nsd.conf >nsd.log 2>&1 &
+NSD_PID=$!
+echo "NSD_PID=$NSD_PID" >> .tpkg.var.test
+
+# start unbound in the background
+if test $do_valgrind = "yes"; then
+valgrind $VALGRIND_FLAGS $PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+else
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+fi
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_nsd_up nsd.log
+wait_unbound_up unbound.log
@@ -0,0 +1,108 @@
+# #-- auth_tsig.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.4" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# update the zonefile.
+echo "www2.example.com. IN A 1.2.3.5" >> example.com.zone
+mv example.com.zone tmp.zone
+sed -e 's/2024082400/2024082401/' <tmp.zone >example.com.zone
+echo ""
+echo "new example.com.zone:"
+cat example.com.zone
+echo ""
+
+# NSD reloads the zone file,
+# sends notify to unbound, with TSIG.
+# unbound replies to the notify, with TSIG.
+# unbound fetches SOA record, with TSIG.
+# unbound fetches zone transfer, with TSIG.
+kill -1 `cat nsd.pid`
+
+# test if the zone has updated.
+dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.5" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo ""
+echo "zonefile: unbound-example.com.zone"
+cat unbound-example.com.zone
+echo ""
+
+exit 0
@@ -0,0 +1,26 @@
+server:
+	verbosity: 7
+	num-threads: 1
+	interface: 127.0.0.1
+	port: @UNBOUND_PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	log-queries: yes
+
+# This tsig key is used for testing.
+tsig-key:
+	name: "test.key"
+	algorithm: sha256
+	secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
+
+auth-zone:
+	name: "example.com"
+	zonefile: "unbound-example.com.zone"
+	for-upstream: yes
+	for-downstream: yes
+	primary-tsig: "127.0.0.1@@NSD_PORT@" test.key
+	allow-notify-tsig: "127.0.0.2@@NSD_PORT@" test.key
@@ -0,0 +1,4 @@
+example.com.		240	IN	SOA	ns.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2024082400 28800 7200 604800 240
+example.com. NS ns.example.com.
+ns.example.com. IN A 192.0.2.1
+www.example.com. A 1.2.3.4
@@ -16,7 +16,6 @@ SCENARIO_BEGIN Test iterator with scrub of promiscuous records
 ; The spoofed contents are ns.attacker.mesa and its IPs 5.6.7.8 and 5.6.7.9.
 ; The pollute1.mesa NS, ns.pollute2.mesa A, and test3.atkr.pollute3.mesa NS
 ; with ns.pollute3.mesa A records are tested for cache placement.
-; pollute4.mesa uses YXDOMAIN.

 ; ns.root
 RANGE_BEGIN 0 400
@@ -85,18 +84,6 @@ SECTION ADDITIONAL
 ns.pollute3.mesa. IN A 1.2.4.3
 ENTRY_END

-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-pollute4.mesa. IN NS
-SECTION AUTHORITY
-pollute4.mesa. IN NS ns.pollute4.mesa.
-SECTION ADDITIONAL
-ns.pollute4.mesa. IN A 1.2.4.4
-ENTRY_END
-
 ENTRY_BEGIN
 MATCH opcode subdomain
 ADJUST copy_id copy_query
@@ -201,35 +188,6 @@ check.pollute3.mesa. IN A 1.8.9.3
 ENTRY_END
 RANGE_END

-; ns.pollute4.mesa
-RANGE_BEGIN 0 400
-	ADDRESS 1.2.4.4
-
-; This is the spoofed answer that is returned.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA YXDOMAIN
-SECTION QUESTION
-test4.atkr.pollute4.mesa. IN A
-SECTION ANSWER
-test4.atkr.pollute4.mesa. 86400 IN A 1.2.3.4
-SECTION AUTHORITY
-pollute4.mesa. 86400 IN NS ns.attacker.mesa.
-ENTRY_END
-
-; correct answer for the check query.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-check.pollute4.mesa. IN A
-SECTION ANSWER
-check.pollute4.mesa. IN A 1.8.9.4
-ENTRY_END
-RANGE_END
-
 ; ns.attacker.mesa
 RANGE_BEGIN 0 400
 	ADDRESS 5.6.7.8
@@ -412,46 +370,4 @@ check.pollute3.mesa. IN A 1.8.9.3
 ;check.pollute3.mesa. IN A 5.6.7.9
 ENTRY_END

-; Test query 4
-STEP 120 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-test4.atkr.pollute4.mesa. IN A
-ENTRY_END
-
-STEP 130 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA YXDOMAIN
-SECTION QUESTION
-test4.atkr.pollute4.mesa. IN A
-SECTION ANSWER
-test4.atkr.pollute4.mesa. 86400 IN A 1.2.3.4
-SECTION AUTHORITY
-; removed record
-;pollute4.mesa.       0       IN      NS      ns.attacker.mesa.
-ENTRY_END
-
-; Check the cache contents, for query 4.
-STEP 140 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-check.pollute4.mesa. IN A
-ENTRY_END
-
-STEP 150 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-check.pollute4.mesa. IN A
-SECTION ANSWER
-; good answer
-check.pollute4.mesa. IN A 1.8.9.4
-; bad answer
-;check.pollute4.mesa. IN A 5.6.7.9
-ENTRY_END
-
 SCENARIO_END
@@ -3,31 +3,13 @@ $ORIGIN example.com.
 $TTL 3600

 ENTRY_BEGIN
-MATCH opcode qname qtype
+MATCH opcode qtype
 REPLY QR AA NOERROR
-ADJUST copy_id
+ADJUST copy_id copy_query
 SECTION QUESTION
-www1	IN	A
+wild	IN	A
 SECTION ANSWER
-www1	IN	A	1.1.1.1
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qname qtype
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www2	IN	A
-SECTION ANSWER
-www2	IN	A	2.2.2.2
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qname qtype
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www3	IN	A
-SECTION ANSWER
-www3	IN	A	3.3.3.3
+wild	IN	A	10.20.30.40
+SECTION AUTHORITY
+example.com. IN NS ns.example.com.
 ENTRY_END
@@ -468,10 +468,8 @@ bring_up_alternate_configuration ub_discard_wait_limit.conf
 teststep "Check discard-timeout and wait-limit"
 echo "> dig www.unresponsive"
 dig @127.0.0.1 -p $UNBOUND_PORT +retry=2 +timeout=1 www.unresponsive. | tee outfile
-# Wait for nonresponse servfail, that causes discards.
-sleep 2
-if grep "no servers could be reached" outfile ||
-	grep "Too many queries queued up and waiting" outfile; then
+echo "> check answer"
+if grep "no servers could be reached" outfile; then
 	echo "OK"
 else
 	end 1
@@ -1,126 +0,0 @@
-; config options
-server:
-	target-fetch-policy: "0 0 0 0 0"
-	module-config: "subnetcache validator iterator"
-	verbosity: 4
-	qname-minimisation: no
-	; the domain is not configured for edns-subnet
-	;send-client-subnet: 1.2.3.4
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129
-
-stub-zone:
-	name: "example.com"
-	stub-addr: 1.2.3.4
-	stub-no-cache: yes
-CONFIG_END
-
-SCENARIO_BEGIN Test subnet cache with scope zero for global cache store.
-
-; the upstream server.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129
-
-ENTRY_BEGIN
-MATCH opcode qtype qname ednsdata
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	;; we expect to receive empty
-HEX_EDNSDATA_END
-K.ROOT-SERVERS.NET.     IN      A       193.0.14.129
-ENTRY_END
-RANGE_END
-
-RANGE_BEGIN 0 21
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A   10.20.30.40
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-RANGE_BEGIN 30 50
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A   10.20.30.1
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-; query for 0.0.0.0/0
-STEP 10 QUERY
-ENTRY_BEGIN
-HEX_ANSWER_BEGIN
-	00 00 01 00 00 01 00 00         ;ID 0
-	00 00 00 01 03 77 77 77         ; www.example.com A? (DO)
-	07 65 78 61 6d 70 6c 65
-	03 63 6f 6d 00 00 01 00
-	01 00 00 29 10 00 00 00
-	80 00 00 08
-
-	00 08 00 04                     ; OPC, optlen
-	00 01 00 00                     ; ip4, scope 0, source 0
-	                                ;0.0.0.0/0
-HEX_ANSWER_END
-ENTRY_END
-
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ednsdata
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A   10.20.30.40
-SECTION AUTHORITY
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08           ; OPC
-	00 04           ; option length
-	00 01           ; Family
-	00 00           ; source mask, scopemask
-	                ; address
-HEX_EDNSDATA_END
-ENTRY_END
-
-; It should not be in global cache.
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD NOERROR
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-STEP 40 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ednsdata
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A   10.20.30.1
-ENTRY_END
-
-SCENARIO_END
@@ -83,7 +83,7 @@ prev-nxt	IN	A	127.0.0.1

 host1.blaat.nl. IN NID 10 0014:4fff:ff20:ee64
 host1.blaat.nl. IN L32 10 10.1.2.0
-host1.blaat.nl. IN L64 10 2001:db8:1140:1000
+host1.blaat.nl. IN L64 10 2001:0DB8:1140:1000
 host1.blaat.nl. IN LP 10 l64-subnet1.blaat.nl.

 ;error1	IN	NID 1 00fg:4fff:ff20:ee64
@@ -0,0 +1,176 @@
+# Test with algorithm MD5
+file-algorithm md5
+
+tsig-key:
+	name: "test.key"
+	algorithm: md5
+	secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
+
+packet
+# www.example.net. IN TXT
+3a03010000010000000000000377777707657861
+6d706c65036e65740000100001
+endpacket
+
+# check with the same contents
+check-packet
+3a03010000010000000000000377777707657861
+6d706c65036e65740000100001
+endpacket
+
+# sign the query with <key> <timepoint> <expected function ret>
+tsig-sign-query test.key 1750411954 1
+
+check-packet
+3a03010000010000000000010377777707657861
+6d706c65036e657400001000010474657374036b
+65790000fa00ff00000000003a08686d61632d6d
+6435077369672d616c670372656703696e740000
+0068552ab2012c0010d4a4778ce91160dc5dfd85
+7e66f57bda3a0300000000
+endpacket
+
+# www.example.net A
+packet
+e707002000010000000000010377777707657861
+6d706c65036e6574000001000100002910000000
+00000000
+endpacket
+
+tsig-sign-query test.key 1750419725 1
+
+check-packet
+e707002000010000000000020377777707657861
+6d706c65036e6574000001000100002910000000
+000000000474657374036b65790000fa00ff0000
+0000003a08686d61632d6d6435077369672d616c
+670372656703696e740000006855490d012c0010
+c00e00f1bafa240f41ee9cbe507b9802e7070000
+0000
+endpacket
+
+tsig-verify-query test.key 1750419725 NOERROR NOERROR 0
+
+# add some fudge to the time
+packet
+e707002000010000000000020377777707657861
+6d706c65036e6574000001000100002910000000
+000000000474657374036b65790000fa00ff0000
+0000003a08686d61632d6d6435077369672d616c
+670372656703696e740000006855490d012c0010
+c00e00f1bafa240f41ee9cbe507b9802e7070000
+0000
+endpacket
+
+tsig-verify-query test.key 1750419730 NOERROR NOERROR 0
+
+# purposely make a bad digest
+# changed 'www' (0x777777) to 'aaa' (0x616161)
+packet
+e707002000010000000000020361616107657861
+6d706c65036e6574000001000100002910000000
+000000000474657374036b65790000fa00ff0000
+0000003a08686d61632d6d6435077369672d616c
+670372656703696e740000006855490d012c0010
+c00e00f1bafa240f41ee9cbe507b9802e7070000
+0000
+endpacket
+
+tsig-verify-query test.key 1750419725 NOTAUTH BADSIG 0
+
+# the wrong time is used, outside of the fudge region
+packet
+e707002000010000000000020377777707657861
+6d706c65036e6574000001000100002910000000
+000000000474657374036b65790000fa00ff0000
+0000003a08686d61632d6d6435077369672d616c
+670372656703696e740000006855490d012c0010
+c00e00f1bafa240f41ee9cbe507b9802e7070000
+0000
+endpacket
+
+tsig-verify-query test.key 1750819725 NOTAUTH BADTIME 1750819725
+
+# An unknown key is used, 2222.key
+packet
+e707002000010000000000020377777707657861
+6d706c65036e6574000001000100002910000000
+000000000432323232036b65790000fa00ff0000
+0000003a08686d61632d6d6435077369672d616c
+670372656703696e740000006855490d012c0010
+c00e00f1bafa240f41ee9cbe507b9802e7070000
+0000
+endpacket
+
+tsig-verify-query 2222.key 1750419725 NOTAUTH BADKEY 0
+
+# An unknown algorithm is used, hmac-UNK, 554e4b
+packet
+e707002000010000000000020377777707657861
+6d706c65036e6574000001000100002910000000
+000000000474657374036b65790000fa00ff0000
+0000003a08686d61632d554e4b077369672d616c
+670372656703696e740000006855490d012c0010
+c00e00f1bafa240f41ee9cbe507b9802e7070000
+0000
+endpacket
+
+tsig-verify-query test.key 1750419725 NOTAUTH BADKEY 0
+
+# truncated hash
+packet
+e707002000010000000000020377777707657861
+6d706c65036e6574000001000100002910000000
+000000000474657374036b65790000fa00ff0000
+0000003408686d61632d6d6435077369672d616c
+670372656703696e740000006855490d012c000a
+c00e00f1bafa240f41eee7070000
+0000
+endpacket
+
+tsig-verify-query test.key 1750419725 NOTAUTH BADTRUNC 0
+
+# TSIG does not parse, removed bytes from the end.
+packet
+e707002000010000000000020377777707657861
+6d706c65036e6574000001000100002910000000
+000000000474657374036b65790000fa00ff0000
+0000003a08686d61632d6d6435077369672d616c
+670372656703696e740000006855490d012c0010
+c00e00f1bafa240f41ee9cbe507b9802
+endpacket
+
+tsig-verify-query . 1750419725 FORMERR NOERROR 0
+
+# www.example.net A
+packet
+e707002000010000000000020377777707657861
+6d706c65036e6574000001000100002910000000
+000000000474657374036b65790000fa00ff0000
+0000003a08686d61632d6d6435077369672d616c
+670372656703696e740000006855490d012c0010
+c00e00f1bafa240f41ee9cbe507b9802e7070000
+0000
+endpacket
+
+tsig-sign-reply 1750419725 NOERROR 1
+e707840000010001000000010377777707657861
+6d706c65036e65740000010001c00c0001000100
+000e1000040a141e2800002904d0000000000000
+endpacket
+
+# reply for www.example.net A
+check-packet
+e7078400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000003a08686d61632d6d6435077369672d616c670372656703696e740000006855490d012c0010dc3c138476fcb04cc138aa5c59647b86e70700000000
+endpacket
+
+# www.example.net A
+packet
+e707002000010000000000010377777707657861
+6d706c65036e6574000001000100002910000000
+00000000
+endpacket
+
+tsig-verify-reply test.key 1750419725 1 1
+e7078400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000003a08686d61632d6d6435077369672d616c670372656703696e740000006855490d012c0010dc3c138476fcb04cc138aa5c59647b86e70700000000
+endpacket
@@ -0,0 +1,57 @@
+# Test with algorithm
+file-algorithm sha1
+
+tsig-key:
+	name: "test.key"
+	algorithm: sha1
+	secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
+
+packet
+# www.example.net. IN TXT
+3a03010000010000000000000377777707657861
+6d706c65036e65740000100001
+endpacket
+
+# sign the query with <key> <timepoint> <expected function ret>
+tsig-sign-query test.key 1750411954 1
+
+check-packet
+3a030100000100000000000103777777076578616d706c65036e657400001000010474657374036b65790000fa00ff00000000002f09686d61632d7368613100000068552ab2012c0014ddea549c7a82a0c4309c0894f884adf9dcf7cd2c3a0300000000
+endpacket
+
+# www.example.net A
+packet
+092d0000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+tsig-sign-query test.key 1750420740 1
+
+check-packet
+092d0000000100000000000203777777076578616d706c65036e6574000001000100002910000000000000000474657374036b65790000fa00ff00000000002f09686d61632d7368613100000068554d04012c0014f493f53a80f43dbd81df4f2feb7064de8247ba0b092d00000000
+endpacket
+
+tsig-verify-query test.key 1750420740 NOERROR NOERROR 0
+
+packet
+092d0000000100000000000203777777076578616d706c65036e6574000001000100002910000000000000000474657374036b65790000fa00ff00000000002f09686d61632d7368613100000068554d04012c0014f493f53a80f43dbd81df4f2feb7064de8247ba0b092d00000000
+endpacket
+
+tsig-sign-reply 1750420740 NOERROR 1
+092d840000010001000000010377777707657861
+6d706c65036e65740000010001c00c0001000100
+000e1000040a141e2800002904d0000000000000
+endpacket
+
+# reply for www.example.net A
+check-packet
+092d8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000002f09686d61632d7368613100000068554d04012c001475eace537fd51a9fbf192a10b20bfe824dd20318092d00000000
+endpacket
+
+# www.example.net A
+packet
+092d0000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+tsig-verify-reply test.key 1750420740 1 1
+092d8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000002f09686d61632d7368613100000068554d04012c001475eace537fd51a9fbf192a10b20bfe824dd20318092d00000000
+endpacket
@@ -0,0 +1,57 @@
+# Test with algorithm
+file-algorithm sha224
+
+tsig-key:
+	name: "test.key"
+	algorithm: sha224
+	secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
+
+packet
+# www.example.net. IN TXT
+3a03010000010000000000000377777707657861
+6d706c65036e65740000100001
+endpacket
+
+# sign the query with <key> <timepoint> <expected function ret>
+tsig-sign-query test.key 1750411954 1
+
+check-packet
+3a030100000100000000000103777777076578616d706c65036e657400001000010474657374036b65790000fa00ff0000000000390b686d61632d73686132323400000068552ab2012c001c104d12e4ccab950cb7690233661549b027567ea0c8beb868a7c1c4f33a0300000000
+endpacket
+
+# www.example.net A
+packet
+7e7e0000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+tsig-sign-query test.key 1750421692 1
+
+check-packet
+7e7e0000000100000000000203777777076578616d706c65036e6574000001000100002910000000000000000474657374036b65790000fa00ff0000000000390b686d61632d736861323234000000685550bc012c001c03431f500872691d8780dafe326cdbe56ceaaca1d0ea3e3a262848e77e7e00000000
+endpacket
+
+tsig-verify-query test.key 1750421692 NOERROR NOERROR 0
+
+packet
+7e7e0000000100000000000203777777076578616d706c65036e6574000001000100002910000000000000000474657374036b65790000fa00ff0000000000390b686d61632d736861323234000000685550bc012c001c03431f500872691d8780dafe326cdbe56ceaaca1d0ea3e3a262848e77e7e00000000
+endpacket
+
+tsig-sign-reply 1750421692 NOERROR 1
+7e7e840000010001000000010377777707657861
+6d706c65036e65740000010001c00c0001000100
+000e1000040a141e2800002904d0000000000000
+endpacket
+
+# reply for www.example.net A
+check-packet
+7e7e8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff0000000000390b686d61632d736861323234000000685550bc012c001c0fa7ddec264122b5e0c3d1a64ed043c3d68582f0ae2ba2d5b3e186127e7e00000000
+endpacket
+
+# www.example.net A
+packet
+7e7e0000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+tsig-verify-reply test.key 1750421692 1 1
+7e7e8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff0000000000390b686d61632d736861323234000000685550bc012c001c0fa7ddec264122b5e0c3d1a64ed043c3d68582f0ae2ba2d5b3e186127e7e00000000
+endpacket
@@ -0,0 +1,57 @@
+# Test with algorithm
+file-algorithm sha384
+
+tsig-key:
+	name: "test.key"
+	algorithm: sha384
+	secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
+
+packet
+# www.example.net. IN TXT
+3a03010000010000000000000377777707657861
+6d706c65036e65740000100001
+endpacket
+
+# sign the query with <key> <timepoint> <expected function ret>
+tsig-sign-query test.key 1750411954 1
+
+check-packet
+3a030100000100000000000103777777076578616d706c65036e657400001000010474657374036b65790000fa00ff00000000004d0b686d61632d73686133383400000068552ab2012c00302416b7442f06e5ab2f9814d391c48b73384ab59cccc7de20ecad999a38de62aaa1b61ac0cd3df299bab30776c92322f03a0300000000
+endpacket
+
+# www.example.net A
+packet
+aafc0000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+tsig-sign-query test.key 1750421817 1
+
+check-packet
+aafc0000000100000000000203777777076578616d706c65036e6574000001000100002910000000000000000474657374036b65790000fa00ff00000000004d0b686d61632d73686133383400000068555139012c00300953f74bcc78dae61e9d93aad74e128dbc240a671de017efd3707235be7890cbf2a51255f5843438fbaa26d04caca506aafc00000000
+endpacket
+
+tsig-verify-query test.key 1750421817 NOERROR NOERROR 0
+
+packet
+aafc0000000100000000000203777777076578616d706c65036e6574000001000100002910000000000000000474657374036b65790000fa00ff00000000004d0b686d61632d73686133383400000068555139012c00300953f74bcc78dae61e9d93aad74e128dbc240a671de017efd3707235be7890cbf2a51255f5843438fbaa26d04caca506aafc00000000
+endpacket
+
+tsig-sign-reply 1750421817 NOERROR 1
+aafc840000010001000000010377777707657861
+6d706c65036e65740000010001c00c0001000100
+000e1000040a141e2800002904d0000000000000
+endpacket
+
+# reply for www.example.net A
+check-packet
+aafc8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000004d0b686d61632d73686133383400000068555139012c00301e895712f5633d84e82afd7b1dcdd792c5d51532c7a5f52701c9bd464f0d8f6cc735530d16417e8bf3cf104808554642aafc00000000
+endpacket
+
+# www.example.net A
+packet
+aafc0000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+tsig-verify-reply test.key 1750421817 1 1
+aafc8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000004d0b686d61632d73686133383400000068555139012c00301e895712f5633d84e82afd7b1dcdd792c5d51532c7a5f52701c9bd464f0d8f6cc735530d16417e8bf3cf104808554642aafc00000000
+endpacket
@@ -0,0 +1,57 @@
+# Test with algorithm
+file-algorithm sha512
+
+tsig-key:
+	name: "test.key"
+	algorithm: sha512
+	secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
+
+packet
+# www.example.net. IN TXT
+3a03010000010000000000000377777707657861
+6d706c65036e65740000100001
+endpacket
+
+# sign the query with <key> <timepoint> <expected function ret>
+tsig-sign-query test.key 1750411954 1
+
+check-packet
+3a030100000100000000000103777777076578616d706c65036e657400001000010474657374036b65790000fa00ff00000000005d0b686d61632d73686135313200000068552ab2012c00403cd816538bec85fea4ae45a6fb2e961622a4dfad2afa69da999c53133d02e9f2ba789a14b489678b83ab319662d2388fcc7286bfa11d88e71614c845e77584c43a0300000000
+endpacket
+
+# www.example.net A
+packet
+e74d0000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+tsig-sign-query test.key 1750421867 1
+
+check-packet
+e74d0000000100000000000203777777076578616d706c65036e6574000001000100002910000000000000000474657374036b65790000fa00ff00000000005d0b686d61632d7368613531320000006855516b012c0040bbc78c7a8019119b79f89f3ed66d874acb3a29bfcd3ac75fce3779d60d41080fe536c03de404a9143314eabce88a0c5eff6204d94d3225cf42327322c8a48acae74d00000000
+endpacket
+
+tsig-verify-query test.key 1750421867 NOERROR NOERROR 0
+
+packet
+e74d0000000100000000000203777777076578616d706c65036e6574000001000100002910000000000000000474657374036b65790000fa00ff00000000005d0b686d61632d7368613531320000006855516b012c0040bbc78c7a8019119b79f89f3ed66d874acb3a29bfcd3ac75fce3779d60d41080fe536c03de404a9143314eabce88a0c5eff6204d94d3225cf42327322c8a48acae74d00000000
+endpacket
+
+tsig-sign-reply 1750421867 NOERROR 1
+e74d840000010001000000010377777707657861
+6d706c65036e65740000010001c00c0001000100
+000e1000040a141e2800002904d0000000000000
+endpacket
+
+# reply for www.example.net A
+check-packet
+e74d8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000005d0b686d61632d7368613531320000006855516b012c0040690c00d5e01a382b7a4c07739e0faab1a3c98f5bae1b49213032b7da070c4b985056894e1ebc88468d5d070d0589ea8032fb88f3a1902fa91211d2b4989bbb93e74d00000000
+endpacket
+
+# www.example.net A
+packet
+e74d0000000100000000000103777777076578616d706c65036e657400000100010000291000000000000000
+endpacket
+
+tsig-verify-reply test.key 1750421867 1 1
+e74d8400000100010000000203777777076578616d706c65036e65740000010001c00c0001000100000e1000040a141e2800002904d00000000000000474657374036b65790000fa00ff00000000005d0b686d61632d7368613531320000006855516b012c0040690c00d5e01a382b7a4c07739e0faab1a3c98f5bae1b49213032b7da070c4b985056894e1ebc88468d5d070d0589ea8032fb88f3a1902fa91211d2b4989bbb93e74d00000000
+endpacket
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Willem Toorop	c834ee635c	Fix function signature for compiling test	2025-11-03 11:15:11 +01:00
Willem Toorop	7977ef28f5	distribute can send out responses tsig signed	2025-11-01 14:32:09 +01:00
Willem Toorop	c86c267b8b	Forgot to include util/allow_response_list.[ch]	2025-11-01 13:12:35 +01:00
Willem Toorop	3963af8d0b	configurable ranges and tsig to allow responses Configurable with the "allow-response:" option in the "server:" section. Usage: allow-response: <IP netblock> <tsig key-name \| NOKEY \| BLOCKED>	2025-11-01 12:52:48 +01:00
Willem Toorop	3d6a4c7d6e	Const string for tsig lookups	2025-10-31 15:45:34 +01:00
Willem Toorop	2217c9b96e	Merge branch 'master' into update-with-branches/poisonlicious	2025-10-30 09:48:57 +01:00
Willem Toorop	6592c73d56	Merge branch 'xfr-tsig' into update-with-branches/poisonlicious	2025-10-30 09:45:11 +01:00
W.C.A. Wijngaards	8687d69131	Merge branch 'master' into xfr-tsig	2025-10-01 15:52:40 +02:00
W.C.A. Wijngaards	c622a71a28	- xfr-tsig, flip buffer after tsig_sign_reply, but not for error_encode.	2025-10-01 15:52:15 +02:00
W.C.A. Wijngaards	ecfc6a70ce	- xfr-tsig, note tsig-key support for fast_reload.	2025-09-12 16:38:09 +02:00
W.C.A. Wijngaards	a23c5347a7	- xfr-tsig, unit test shows zonefile that is created.	2025-09-12 15:43:45 +02:00
W.C.A. Wijngaards	1ae8be6847	- xfr-tsig, fast reload support for tsig keys.	2025-09-12 15:38:39 +02:00
W.C.A. Wijngaards	f0268d3e83	- xfr-tsig, log TSIG key name with zone and notify information. Clear tsig data before making a new one.	2025-09-12 14:58:49 +02:00
W.C.A. Wijngaards	c904a3d375	- xfr-tsig, remove rpl unit test.	2025-09-12 11:23:29 +02:00
W.C.A. Wijngaards	b451cc4af7	- xfr-tsig, add tdir test that performs tsig signed zone transfer.	2025-09-12 10:40:23 +02:00
W.C.A. Wijngaards	f9713f9fe5	Merge branch 'master' into xfr-tsig	2025-09-12 09:27:23 +02:00
W.C.A. Wijngaards	dfac72edfc	- xfr-tsig, unit test use to make tsig for rpl.	2025-09-11 17:05:58 +02:00
W.C.A. Wijngaards	64e102aacb	- xfr-tsig, fix notify tsig answer, fix parse edns allows TSIG, unit test for auth zone with notify with tsig and notify answer with tsig.	2025-09-11 16:21:38 +02:00
W.C.A. Wijngaards	bebd6c0f96	- xfr-tsig, use tsig_parse_verify_reply_xfr for zone transfers with TSIG.	2025-09-10 15:45:37 +02:00
W.C.A. Wijngaards	63aa70ab32	- xfr-tsig, unit test for tsig sign every couple packets, and verify that.	2025-09-10 15:26:57 +02:00
W.C.A. Wijngaards	7b59014ba3	- xfr-tsig, unit test with another trace of tsig every couple packets.	2025-09-09 16:24:55 +02:00
W.C.A. Wijngaards	156846e6c4	- xfr-tsig, unit test to verify tsig every couple packets.	2025-09-09 15:50:14 +02:00
W.C.A. Wijngaards	aea2a821b9	- xfr-tsig, unit test for tsig-verify-reply-xfr, with output that works with dig and NSD.	2025-09-09 15:40:51 +02:00
W.C.A. Wijngaards	cacdfee755	Merge branch 'master' into xfr-tsig	2025-09-09 14:38:03 +02:00
W.C.A. Wijngaards	e3c1981a6a	- xfr-tsig, fix algorithm name write in xfr reply tsig and unit test that works with output that works with dig and NSD.	2025-09-09 14:36:33 +02:00
W.C.A. Wijngaards	e2efd17007	- xfr-tsig, unit test tsig-sign-reply-xfr implementation.	2025-09-05 16:45:15 +02:00
W.C.A. Wijngaards	4a2dc1df48	Merge branch 'master' into xfr-tsig	2025-09-05 15:00:31 +02:00
W.C.A. Wijngaards	5c79fd9a0b	- xfr-tsig, tsig_parse_verify_reply_xfr and tsig_sign_reply_xfr.	2025-09-05 14:55:36 +02:00
W.C.A. Wijngaards	4a3a4f474f	Merge branch 'master' into xfr-tsig	2025-08-27 16:30:03 +02:00
W.C.A. Wijngaards	708581579c	- xfr-tsig, add test case with AXFR packet with TSIG.	2025-08-27 15:52:08 +02:00
W.C.A. Wijngaards	af1d430759	- xfr-tsig, log rcode for received notifies.	2025-08-20 15:55:29 +02:00
W.C.A. Wijngaards	da72734240	- xfr-tsig, tsig_get_mem function.	2025-08-19 16:46:12 +02:00
W.C.A. Wijngaards	54175a4180	Merge branch 'master' into xfr-tsig	2025-08-19 15:27:43 +02:00
W.C.A. Wijngaards	888d5ce9f9	- xfr-tsig, TSIG for SOA probe, notify, and on xfr first packet.	2025-08-19 15:27:16 +02:00
W.C.A. Wijngaards	b1bb4a4592	- xfr-tsig, check that tsig keys exist at startup and in unbound-checkconf.	2025-07-31 17:02:55 +02:00
W.C.A. Wijngaards	3b88577dd1	Merge branch 'master' into xfr-tsig	2025-07-31 15:59:25 +02:00
W.C.A. Wijngaards	6634b8bcc5	- xfr-tsig, primary-tsig: addr tsig and allow-notify-tsig: addr tsig.	2025-07-31 14:43:43 +02:00
W.C.A. Wijngaards	3d7dfe2f36	- xfr-tsig, unit test for tsig_verify_reply for failed tsig.	2025-07-23 16:35:25 +02:00
W.C.A. Wijngaards	baee7885bd	Merge branch 'master' into xfr-tsig	2025-07-23 16:23:58 +02:00
W.C.A. Wijngaards	e55b3a2a4c	- xfr-tsig, unit test for tsig_verify_reply.	2025-07-23 16:16:41 +02:00
Willem Toorop	b5a2de1292	allow-response: config option	2025-07-20 13:30:29 +02:00
Willem Toorop	5ed0840dc2	Poisonlicious PoC with new tsig code	2025-07-19 15:19:00 +02:00
Willem Toorop	9bbb34fc38	Link tsig.lo only once	2025-07-19 15:11:15 +02:00
Willem Toorop	433bb1c7bc	Merge branch 'updated-with-master/xfr-tsig' into hackathon/poisonlicious-new-tsig-code	2025-07-19 15:02:30 +02:00
Willem Toorop	f3b960e72b	Merge branch 'master' into xfr-tsig-update	2025-07-19 14:42:44 +02:00
Willem Toorop	5bd31c9569	A typo and a reorder (without impact)	2025-07-19 14:35:38 +02:00
Willem Toorop	4f245e0e5b	Merge branch 'master' into hackathon/poisonlicious-update	2025-07-19 14:23:50 +02:00
W.C.A. Wijngaards	e4069e5619	Merge branch 'master' into xfr-tsig	2025-07-11 15:27:40 +02:00
W.C.A. Wijngaards	a3ec9a974f	- xfr-tsig, member comments for struct tsig_calc_state_crypto.	2025-07-11 15:18:11 +02:00
W.C.A. Wijngaards	479b954118	- xfr-tsig, implemented tsig_calc_state_crypto.	2025-07-11 10:08:48 +02:00
W.C.A. Wijngaards	0955238cd3	- xfr-tsig, tsig_verify_reply function.	2025-06-27 14:26:15 +02:00
W.C.A. Wijngaards	57dd6a971d	- xfr-tsig, extra unit tests for tsig_sign_reply.	2025-06-27 11:29:41 +02:00
W.C.A. Wijngaards	6a831e3063	- xfr-tsig, more explanation in testcode/unittsig.c.	2025-06-27 11:03:25 +02:00
W.C.A. Wijngaards	3807bf00da	- xfr-tsig, unit test for tsig_sign_reply.	2025-06-27 10:59:36 +02:00
W.C.A. Wijngaards	9022381be4	- xfr-tsig, more explanation in testcode/unittsig.c.	2025-06-27 09:29:57 +02:00
W.C.A. Wijngaards	ca147a147d	- xfr-tsig, unit test for tsig_sign_shared and tsig_verify_shared.	2025-06-27 09:24:51 +02:00
W.C.A. Wijngaards	5147e5aee9	- xfr-tsig, tsig_sign_shared function.	2025-06-27 08:52:32 +02:00
W.C.A. Wijngaards	6466513cc5	- xfr-tsig, unit test argument parse code.	2025-06-26 16:59:44 +02:00
W.C.A. Wijngaards	7a1a615fd3	- xfr-tsig, tsig_verify_shared function.	2025-06-26 15:11:25 +02:00
W.C.A. Wijngaards	81d774fb11	- xfr-tsig, tsig_sign_reply function.	2025-06-26 12:41:10 +02:00
W.C.A. Wijngaards	0254317e0d	- xfr-tsig, fix unit test parse of tsig error code.	2025-06-25 14:52:16 +02:00
W.C.A. Wijngaards	dc37849546	- xfr-tsig, test cases for BADTRUNC and not parseable.	2025-06-25 14:19:22 +02:00
W.C.A. Wijngaards	766666139b	Merge branch 'master' into xfr-tsig	2025-06-25 14:05:06 +02:00
W.C.A. Wijngaards	86e78fcacc	xfr-tsig, remove debug	2025-06-25 14:03:52 +02:00
W.C.A. Wijngaards	47a2d71fd3	- xfr-tsig, unit test cases for tsig errors.	2025-06-25 14:03:12 +02:00
W.C.A. Wijngaards	0719ef21fa	- xfr-tsig, unit test for tsig_verify_query.	2025-06-25 12:06:15 +02:00
W.C.A. Wijngaards	6d5f22b56d	- xfr-tsig, fix tsig_verify_query.	2025-06-25 10:21:42 +02:00
W.C.A. Wijngaards	b5beb800c8	- xfr-tsig, tsig_find_rr function.	2025-06-24 16:51:41 +02:00
W.C.A. Wijngaards	fe63b25441	- xfr-tsig, parse and verify query tsig.	2025-06-24 16:31:18 +02:00
W.C.A. Wijngaards	0afbb68b40	- xfr-tsig, other data content matches the other len when written.	2025-06-20 16:57:24 +02:00
W.C.A. Wijngaards	4562cd372c	- xfr-tsig, whitespace.	2025-06-20 14:43:19 +02:00
W.C.A. Wijngaards	418ef3765d	Merge branch 'master' into xfr-tsig	2025-06-20 14:33:02 +02:00
W.C.A. Wijngaards	29c8b3edba	- xfr-tsig, unit tests for md5, sha1, sha224, sha256, sha384 and sha512.	2025-06-20 14:31:44 +02:00
W.C.A. Wijngaards	5214912555	Merge branch 'master' into xfr-tsig	2025-06-20 12:14:13 +02:00
W.C.A. Wijngaards	f2c609b9a5	- xfr-tsig, unit test for tsig_sign_query.	2025-06-20 12:13:51 +02:00
W.C.A. Wijngaards	aa22fd936e	- xfr-tsig, test buffer size.	2025-06-18 17:01:35 +02:00
W.C.A. Wijngaards	4bbb74da39	- xfr-tsig, tsig test.	2025-06-18 16:41:10 +02:00
W.C.A. Wijngaards	dd4ee42eb6	- xfr-tsig, tsig_sign_query.	2025-06-18 15:00:18 +02:00
W.C.A. Wijngaards	8b95785b8c	- xfr-tsig, tsig functions.	2025-06-18 12:18:20 +02:00
W.C.A. Wijngaards	bb4ddab77a	Merge branch 'master' into xfr-tsig	2025-06-17 16:55:18 +02:00
W.C.A. Wijngaards	69354298fc	- xfr-tsig, tsig_create and tsig_delete.	2025-06-17 16:54:52 +02:00
W.C.A. Wijngaards	bbcf5d122a	Merge branch 'master' into xfr-tsig	2025-06-16 17:00:12 +02:00
W.C.A. Wijngaards	497161f72f	- xfr-tsig, tsig_verify return failure comment improved.	2025-06-16 16:59:53 +02:00
W.C.A. Wijngaards	31e8118b76	- xfr-tsig, man page and example config.	2025-06-13 16:32:36 +02:00
W.C.A. Wijngaards	8811bd4844	- xfr-tsig, tsig-key, with name, algorithm and secret options.	2025-06-13 12:12:49 +02:00
W.C.A. Wijngaards	0f02479dea	- xfr-tsig, fix algorithm lookup.	2025-06-13 10:17:47 +02:00
W.C.A. Wijngaards	364edccebc	- xfr-tsig, algorithm table.	2025-06-13 10:15:41 +02:00
W.C.A. Wijngaards	3d9242b3d3	- xfr-tsig, key table.	2025-06-12 16:05:10 +02:00
W.C.A. Wijngaards	3f378c962f	- xfr-tsig, check rdata length in tsig verify.	2025-06-12 14:34:56 +02:00
W.C.A. Wijngaards	4ca37bcadf	Merge branch 'master' into xfr-tsig	2025-06-12 12:17:13 +02:00
W.C.A. Wijngaards	19492da154	- xfr-tsig, check buffer remaining in tsig verify.	2025-06-12 11:50:11 +02:00
W.C.A. Wijngaards	182e580fe2	- xfr-tsig, fix warning in compile of declaration.	2025-06-12 09:57:23 +02:00
W.C.A. Wijngaards	eefb417c09	- xfr-tsig, const for dname compare and fix warnings in compile.	2025-06-12 09:53:56 +02:00
W.C.A. Wijngaards	4fd0d84e66	- xfr-tsig, update header comment.	2025-06-12 09:49:20 +02:00
W.C.A. Wijngaards	ea0973002f	- xfr-tsig, constant time memcmp is used.	2025-06-12 09:34:07 +02:00
W.C.A. Wijngaards	8fcc4c98b6	Merge branch 'master' into xfr-tsig	2025-06-12 09:29:28 +02:00
W.C.A. Wijngaards	7edc1e0fc4	- xfr-tsig, import the tsig verify code from hackathon/poisonlicious branch.	2025-06-12 09:25:54 +02:00
Willem Toorop	3674e4813c	A bit better TSIG handling	2025-03-25 16:46:42 +01:00
Willem Toorop	5d11af34dc	Verification of incoming responses with TSIG For now with a hardcoded TSIG key	2025-03-17 09:25:13 +01:00
Willem Toorop	e29ee129a3	Fix CI	2025-03-16 10:17:53 +01:00
Willem Toorop	86526c75a3	Send responses just before they enter the cache Configured with the `distribute:` option in the `server:` section in the config.	2025-03-16 09:21:11 +01:00
Willem Toorop	d9d6dd31dc	Store responses received on listen interface in cache	2025-03-15 16:22:29 +01:00
W.C.A. Wijngaards	e6573fc337	- xfr-tsig, create util/tsig.c and util/tsig.h.	2023-04-14 14:05:15 +02:00