Merge branch 'master' into xfr-tsig

- xfr-tsig, flip buffer after tsig_sign_reply, but not for error_encode.
- xfr-tsig, note tsig-key support for fast_reload.
2026-08-17 21:25:50 +02:00 · 2025-10-01 15:52:40 +02:00 · 2025-10-01 15:52:15 +02:00 · 2025-09-12 16:38:09 +02:00 · 2025-09-12 15:43:45 +02:00 · 2025-09-12 15:38:39 +02:00
262 changed files with 61798 additions and 3453 deletions
@@ -12,7 +12,6 @@ jobs:
  build:
    runs-on: ${{ matrix.os }}
    strategy:
-      fail-fast: false
      matrix:
        include:
          - name: GCC on Linux
@@ -49,6 +48,15 @@ jobs:
            os: ubuntu-latest
            config: 'CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=address" --disable-flto --disable-static'
            make_test: "yes"
+          - name: Apple iPhone on iOS, armv7
+            os: macos-latest
+            AUTOTOOLS_HOST: armv7-apple-ios
+            OPENSSL_HOST: ios-cross
+            IOS_SDK: iPhoneOS
+            IOS_CPU: armv7s
+            test_ios: "yes"
+            config: "no"
+            make: "no"
          - name: Apple iPhone on iOS, arm64
            os: macos-latest
            AUTOTOOLS_HOST: aarch64-apple-ios
@@ -76,6 +84,15 @@ jobs:
            test_ios: "yes"
            config: "no"
            make: "no"
+          - name: iPhoneSimulator on OS X, i386
+            os: macos-latest
+            AUTOTOOLS_HOST: i386-apple-ios
+            OPENSSL_HOST: iphoneos-cross
+            IOS_SDK: iPhoneSimulator
+            IOS_CPU: i386
+            test_ios: "yes"
+            config: "no"
+            make: "no"
          - name: iPhoneSimulator on OS X, x86_64
            os: macos-latest
            AUTOTOOLS_HOST: x86_64-apple-ios
@@ -175,38 +192,8 @@ jobs:
    steps:
      - uses: actions/checkout@v4
        with:
-          submodules: recursive
+          submodules: false
          persist-credentials: false
-      - name: test_windows_configure
-        if: ${{ matrix.test_windows == 'yes' }}
-        shell: bash
-        run: |
-          # The run starts with mount points for /c, /d, and
-          # C:/Program Files/Git on /
-          # C:/Program Files/Git/usr/bin on /bin
-          # C:/Users/RUNNER~1/AppData/Local/Temp on /tmp
-          echo "mount"
-          mount || echo "ignored"
-          echo "mount -o bind /c/msys64/usr /usr"
-          mount -o bind /c/msys64/usr /usr || echo "ignored"
-          # Now there is:
-          # C:/msys64 on /
-          # C:/msys64/usr/bin on /bin
-          # And those mount points should go away for the next 'run:' shell.
-          echo "mount"
-          mount || echo "ignored"
-          # probably installs to C:\msys64\usr\bin\bash.exe
-          echo "pacman -S --noconfirm autotools"
-          C:/msys64/usr/bin/pacman -S --noconfirm autotools
-          echo "rm -f aclocal.m4"
-          rm -f aclocal.m4
-          # The paths are mounted, so that /c/msys64/usr/share/autoconf-..,
-          # /c/msys64/usr/share/aclocal-.., /c/msys64/usr/share/automake-..
-          # are in /usr. Also for /usr/bin, autoreconf is from
-          # /c/msys64/usr/bin.
-          echo "autoreconf -fi"
-          #PATH="/c/msys64/usr/bin:$PATH" autoreconf -fi || echo "ignored"
-          autoreconf -fi
      - name: test_windows
        if: ${{ matrix.test_windows == 'yes' }}
        env:
@@ -219,9 +206,6 @@ jobs:
          cd ..
          export prepath=`pwd`
          echo prepath=${prepath}
-          # The mount should have the git directories.
-          echo "mount"
-          mount || echo "ignored"
          echo "choco install winflexbison3"
          choco install winflexbison3
          echo 'LEX="win_flex"'
@@ -239,7 +223,7 @@ jobs:
          #sed -e 's/use Pod::Usage//' < Configure > Configure.fix
          # ./Configure.fix no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl"
          # pacman is used to install for msys2, with
-          # C:/msys64/usr/bin/pacman -S --noconfirm perl
+          # C:/msys64/usr/bin/pacman -S perl
          echo "C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix=\""$prepath/openssl"\" PERL=\"C:/msys64/usr/bin/perl\""
          C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl" PERL="C:/msys64/usr/bin/perl"
          # make the libs only, build faster
@@ -328,8 +312,6 @@ jobs:
          ./contrib/android/install_expat.sh
          echo "::endgroup::"
          echo "::group::configure"
-          echo "autoreconf -fi"
-          autoreconf -fi
          echo "./configure ${CONFIG_OPTS}"
          ./configure ${CONFIG_OPTS}
          echo "::endgroup::"
@@ -349,7 +331,6 @@ jobs:
          IOS_CPU: ${{ matrix.IOS_CPU }}
        run: |
          #(already installed) ./contrib/ios/install_tools.sh
-          brew install autoconf automake libtool make
          export AUTOTOOLS_BUILD="$(./config.guess)"
          echo AUTOTOOLS_BUILD=${AUTOTOOLS_BUILD}
          export IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
@@ -371,8 +352,6 @@ jobs:
          ./contrib/ios/install_expat.sh
          echo "::endgroup::"
          echo "::group::configure"
-          echo "autoreconf -fi"
-          autoreconf -fi
          echo "./configure ${CONFIG_OPTS}"
          ./configure ${CONFIG_OPTS}
          echo "::endgroup::"
@@ -398,12 +377,10 @@ jobs:
          cpu_count: 2
          run: |
            set -e -x
-            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y autoconf automake libtool pkgconf openssl libevent expat; fi
-            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add autoconf-2.71 automake-1.16.5 libtool pkgconf libevent; export AUTOCONF_VERSION="2.71"; export AUTOMAKE_VERSION="1.16"; fi
-            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install autoconf automake libtool pkgconf libevent; export LDFLAGS="-Wl,--rpath=/usr/pkg/lib"; fi
+            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y openssl libevent expat; fi
+            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add libevent; fi
+            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install libevent; fi
            echo "::group::configure"
-            rm -f aclocal.m4
-            autoreconf -fi
            ./configure ${{ matrix.cross_platform_config }}
            echo "::endgroup::"
            echo "::group::make"
@@ -417,15 +394,10 @@ jobs:
        run: sudo apt-get install libevent-dev
      - name: install expat
        if: ${{ matrix.install_expat == 'yes' }}
-        run: |
-          brew install expat
-          brew install autoconf automake libtool make
+        run: brew install expat
      - name: configure
        if: ${{ matrix.config != 'no' }}
-        run: |
-          if test `uname` = "Linux"; then sudo apt-get install autoconf automake libtool make; fi
-          autoreconf -fi
-          ./configure ${{ matrix.config }}
+        run: ./configure ${{ matrix.config }}
      - name: make
        if: ${{ matrix.make != 'no' }}
        run: make
@@ -14,14 +14,9 @@ jobs:
    steps:
    - uses: actions/checkout@v4
      with:
-        submodules: recursive
        persist-credentials: false
-    - name: install packages
-      run: sudo apt-get install autoconf automake libtool make
    - name: configure
-      run: |
-        autoreconf -fi
-        ./configure --enable-debug
+      run: ./configure --enable-debug
    - name: make
      run: make
    - name: make test
@@ -3,17 +3,11 @@
 /.libs/
 /.source
 /Makefile
-/aclocal.m4
 /autom4te.cache/
-/config.guess
 /config.h
-/config.h.in
 /config.h.in~
 /config.log
 /config.status
-/config.sub
-/configure
-/configure~
 /dnstap/dnstap_config.h
 /dnscrypt/dnscrypt_config.h
 /util/configlexer.c
@@ -28,10 +22,8 @@
 /doc/unbound-host.1
 /doc/unbound.8
 /doc/unbound.conf.5
-/install-sh
 /libtool
 /libunbound.la
-/ltmain.sh
 /_unbound.la
 /smallapp/unbound-control-setup.sh
 /unbound
@@ -1,3 +0,0 @@
-[submodule "simdzone"]
-	path = simdzone
-	url = https://github.com/NLnetLabs/simdzone.git
@@ -56,7 +56,7 @@ YACC=@YACC@
 LEX=@LEX@
 STRIP=@STRIP@
 CC=@CC@
-CPPFLAGS=-I. @CPPFLAGS@ -Isimdzone/include -I@srcdir@/simdzone/include
+CPPFLAGS=-I. @CPPFLAGS@
 PYTHON_CPPFLAGS=-I. -I$(srcdir) @PYTHON_CPPFLAGS@
 CFLAGS=-DSRCDIR=$(srcdir) @CFLAGS@
 LDFLAGS=@LDFLAGS@
@@ -130,7 +130,7 @@ util/fptr_wlist.c util/locks.c util/log.c util/mini_event.c util/module.c \
 util/netevent.c util/net_help.c util/random.c util/rbtree.c util/regional.c \
 util/rtt.c util/siphash.c util/edns.c util/storage/dnstree.c util/storage/lookup3.c \
 util/storage/lruhash.c util/storage/slabhash.c util/tcp_conn_limit.c \
-util/timehist.c util/tube.c util/proxy_protocol.c util/timeval_func.c \
+util/timehist.c util/tsig.c util/tube.c util/proxy_protocol.c util/timeval_func.c \
 util/ub_event.c util/ub_event_pluggable.c util/winsock_event.c \
 validator/autotrust.c validator/val_anchor.c validator/validator.c \
 validator/val_kcache.c validator/val_kentry.c validator/val_neg.c \
@@ -147,7 +147,7 @@ iter_scrub.lo iter_utils.lo localzone.lo mesh.lo modstack.lo view.lo \
 outbound_list.lo alloc.lo config_file.lo configlexer.lo configparser.lo \
 fptr_wlist.lo siphash.lo edns.lo locks.lo log.lo mini_event.lo module.lo net_help.lo \
 random.lo rbtree.lo regional.lo rtt.lo dnstree.lo lookup3.lo lruhash.lo \
-slabhash.lo tcp_conn_limit.lo timehist.lo tube.lo winsock_event.lo \
+slabhash.lo tcp_conn_limit.lo timehist.lo tsig.lo tube.lo winsock_event.lo \
 autotrust.lo val_anchor.lo rpz.lo rfc_1982.lo proxy_protocol.lo \
 validator.lo val_kcache.lo val_kentry.lo val_neg.lo val_nsec3.lo val_nsec.lo \
 val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo $(CACHEDB_OBJ) authzone.lo \
@@ -179,11 +179,12 @@ testcode/unitlruhash.c testcode/unitmain.c testcode/unitmsgparse.c \
 testcode/unitneg.c testcode/unitregional.c testcode/unitslabhash.c \
 testcode/unitverify.c testcode/readhex.c testcode/testpkts.c testcode/unitldns.c \
 testcode/unitecs.c testcode/unitauth.c testcode/unitzonemd.c \
-testcode/unittcpreuse.c testcode/unitdoq.c testcode/unitinfra.c
+testcode/unittcpreuse.c testcode/unitdoq.c testcode/unitinfra.c \
+testcode/unittsig.c
 UNITTEST_OBJ=unitanchor.lo unitdname.lo unitlruhash.lo unitmain.lo \
 unitmsgparse.lo unitneg.lo unitregional.lo unitslabhash.lo unitverify.lo \
 readhex.lo testpkts.lo unitldns.lo unitecs.lo unitauth.lo unitzonemd.lo \
-unittcpreuse.lo unitdoq.lo unitinfra.lo
+unittcpreuse.lo unitdoq.lo unitinfra.lo unittsig.lo
 UNITTEST_OBJ_LINK=$(UNITTEST_OBJ) worker_cb.lo $(COMMON_OBJ) $(SLDNS_OBJ) \
 $(COMPAT_OBJ)
 DAEMON_SRC=daemon/acl_list.c daemon/cachedump.c daemon/daemon.c \
@@ -267,7 +268,6 @@ LIBUNBOUND_SRC=libunbound/context.c libunbound/libunbound.c \
 libunbound/libworker.c
 LIBUNBOUND_OBJ=context.lo libunbound.lo libworker.lo ub_event_pluggable.lo
 LIBUNBOUND_OBJ_LINK=$(LIBUNBOUND_OBJ) $(COMMON_OBJ_WITHOUT_UB_EVENT) $(SLDNS_OBJ) $(COMPAT_OBJ)
-SIMDZONE_OBJ=@SIMDZONE_OBJ@

 # win apps or "" if not on windows
 WINAPPS=@WINAPPS@
@@ -365,24 +365,19 @@ longtest:	tests
 	if test ! $(srcdir)/testdata -ef ./testdata; then rm -rf testcode testdata; mkdir testcode testdata; cp -R $(srcdir)/testdata/*.sh $(srcdir)/testdata/*.tdir $(srcdir)/testdata/*.rpl $(srcdir)/testdata/*.crpl testdata; cp $(srcdir)/testcode/*.sh testcode; if test ! -d util; then mkdir util; fi; cp $(srcdir)/util/iana_ports.inc util; fi
 	if test -x "`which bash`"; then bash testcode/do-tests.sh; else sh testcode/do-tests.sh; fi

-simdzone/libzone.la:
-	$(MAKE) -C simdzone
-
-simdzone/include/zone/export.h: simdzone/libzone.la
-
 lib:	libunbound.la unbound.h

-libunbound.la:	simdzone/libzone.la $(LIBUNBOUND_OBJ_LINK)
-	$(LINK_LIB) $(UBSYMS) -o $@ $(LIBUNBOUND_OBJ_LINK) $(SIMDZONE_OBJ) -rpath $(libdir) $(SSLLIB) $(LIBS)
+libunbound.la:	$(LIBUNBOUND_OBJ_LINK)
+	$(LINK_LIB) $(UBSYMS) -o $@ $(LIBUNBOUND_OBJ_LINK) -rpath $(libdir) $(SSLLIB) $(LIBS)

 unbound$(EXEEXT):	$(DAEMON_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)

 unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)

 unbound-control$(EXEEXT):	$(CONTROL_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)

 unbound-host$(EXEEXT):	$(HOST_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(HOST_OBJ_LINK) libunbound.la $(SSLLIB) $(LIBS)
@@ -400,43 +395,43 @@ anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(ANCHORUPD_OBJ_LINK) libunbound.la $(LIBS)

 unittest$(EXEEXT):	$(UNITTEST_OBJ_LINK)
-	$(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SSLLIB) $(LIBS)

 testbound$(EXEEXT):	$(TESTBOUND_OBJ_LINK)
-	$(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SSLLIB) $(LIBS)

 lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ_LINK)
-	$(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SSLLIB) $(LIBS)

 petal$(EXEEXT):	$(PETAL_OBJ_LINK)
 	$(LINK) -o $@ $(PETAL_OBJ_LINK) $(SSLLIB) $(LIBS)

 pktview$(EXEEXT):	$(PKTVIEW_OBJ_LINK)
-	$(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SSLLIB) $(LIBS)

 memstats$(EXEEXT):	$(MEMSTATS_OBJ_LINK)
-	$(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SSLLIB) $(LIBS)

 asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(ASYNCLOOK_OBJ_LINK) libunbound.la $(SSLLIB) $(LIBS)

 streamtcp$(EXEEXT):	$(STREAMTCP_OBJ_LINK)
-	$(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SSLLIB) $(LIBS)

 dohclient$(EXEEXT):	$(DOHCLIENT_OBJ_LINK)
-	$(LINK) -o $@ $(DOHCLIENT_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DOHCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS)

 doqclient$(EXEEXT):	$(DOQCLIENT_OBJ_LINK)
-	$(LINK) -o $@ $(DOQCLIENT_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DOQCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS)

 perf$(EXEEXT):	$(PERF_OBJ_LINK)
-	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SSLLIB) $(LIBS)

 delayer$(EXEEXT):	$(DELAYER_OBJ_LINK)
-	$(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SSLLIB) $(LIBS)

 readzone$(EXEEXT):	$(READZONE_OBJ_LINK)
-	$(LINK) -o $@ $(READZONE_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(READZONE_OBJ_LINK) $(SSLLIB) $(LIBS)

 signit$(EXEEXT):	testcode/signit.c
 	$(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@ -o $@ testcode/signit.c $(LDFLAGS) -lldns $(SSLLIB) $(LIBS)
@@ -464,7 +459,7 @@ dnstap/dnstap.pb-c.h: dnstap/dnstap.pb-c.c
 	touch $@

 unbound-dnstap-socket$(EXEEXT):	$(DNSTAP_SOCKET_OBJ_LINK)
-	$(LINK) -o $@ $(DNSTAP_SOCKET_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DNSTAP_SOCKET_OBJ_LINK) $(SSLLIB) $(LIBS)

 dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h
 dtstream.lo dtstream.o: $(srcdir)/dnstap/dtstream.c config.h $(srcdir)/dnstap/dtstream.h
@@ -528,9 +523,7 @@ util/configparser.c:  $(srcdir)/util/configparser.y
 util/configparser.h: util/configparser.c
 	touch $@

-.PHONY: .clean .distclean .maintainer-clean .realclean .devclean
-
-.clean:
+clean:
 	rm -f *.o *.d *.lo *~ tags
 	rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup libunbound.la unbound.h
 	rm -f $(ALL_SRC:.c=.lint)
@@ -538,37 +531,19 @@ util/configparser.h: util/configparser.c
 	rm -f libunbound.a
 	rm -rf autom4te.cache .libs build doc/html doc/xml

-.distclean: .clean
+distclean: clean
 	rm -f config.status config.log config.h
 	rm -f doc/example.conf doc/libunbound.3 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound-control.8 doc/unbound.8 doc/unbound.conf.5 doc/unbound-host.1
 	rm -f smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service
 	rm -f $(TEST_BIN)
 	rm -f Makefile

-.maintainer-clean: .distclean
+maintainer-clean: distclean
 	rm -f util/configlexer.c util/configparser.c util/configparser.h

-.realclean: .maintainer-clean
+realclean: maintainer-clean
 	rm -f configure config.h.in config.sub config.guess ltmain.sh aclocal.m4 libtool

-.devclean: .realclean
-	rm -f config.h.in configure
-
-clean: .clean
-	$(MAKE) -C simdzone clean
-
-distclean: .distclean
-	$(MAKE) -C simdzone distclean
-
-realclean: .realclean
-	$(MAKE) -C simdzone realclean
-
-maintainer-clean: .maintainer-clean
-	$(MAKE) -C simdzone maintainer-clean
-
-devclean: .devclean
-	$(MAKE) -C simdzone devclean
-
 .SUFFIXES: .lint
 .c.lint:
 	$(LINT) $(LINTFLAGS) -I. -I$(srcdir) $<
@@ -729,7 +704,6 @@ depend:
 			-e 's?$$(srcdir)/edns-subnet/subnetmod.h $$(srcdir)/edns-subnet/subnet-whitelist.h $$(srcdir)/edns-subnet/edns-subnet.h $$(srcdir)/edns-subnet/addrtree.h?$$(SUBNET_HEADER)?g' \
 			-e 's?$$(srcdir)/ipsecmod/ipsecmod.h $$(srcdir)/ipsecmod/ipsecmod-whitelist.h?$$(IPSECMOD_HEADER)?g' \
 			-e 's?$$(srcdir)/dynlibmod/dynlibmod.h?$$(DYNLIBMOD_HEADER)?g' \
-			-e 's?$$(srcdir)/simdzone/include/zone/export.h?simdzone/include/zone/export.h?g' \
 			-e 's!\(.*\)\.o[ :]*!\1.lo \1.o: !g' \
 			> $(DEPEND_TMP)
 	cp $(DEPEND_TARGET) $(DEPEND_TMP2)
@@ -746,6 +720,7 @@ depend:

 # build rules
 ipset.lo ipset.o: $(srcdir)/ipset/ipset.c
+tsig.lo tsig.o: $(srcdir)/util/tsig.c config.h $(srcdir)/util/tsig.h
 doqclient.lo doqclient.o: $(srcdir)/testcode/doqclient.c
 unitdoq.lo unitdoq.o: $(srcdir)/testcode/unitdoq.c

@@ -998,7 +973,8 @@ configlexer.lo configlexer.o: util/configlexer.c config.h $(srcdir)/util/configy
 $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h util/configparser.h
 configparser.lo configparser.o: util/configparser.c config.h $(srcdir)/util/configyyrename.h \
 $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \
- $(srcdir)/util/random.h $(srcdir)/sldns/str2wire.h util/configparser.h
+ $(srcdir)/util/random.h $(srcdir)/util/tsig.h $(srcdir)/util/locks.h $(srcdir)/util/rbtree.h $(srcdir)/sldns/str2wire.h \
+ $(srcdir)/sldns/parseutil.h util/configparser.h
 shm_main.lo shm_main.o: $(srcdir)/util/shm_side/shm_main.c config.h $(srcdir)/util/shm_side/shm_main.h \
 $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
 $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h  \
@@ -1022,14 +998,12 @@ authzone.lo authzone.o: $(srcdir)/services/authzone.c config.h $(srcdir)/service
 $(srcdir)/util/storage/dnstree.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h \
 $(srcdir)/util/config_file.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \
 $(srcdir)/respip/respip.h $(srcdir)/util/data/dname.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/regional.h \
- $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/services/cache/dns.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/util/tsig.h $(srcdir)/services/cache/dns.h \
 $(srcdir)/services/outside_network.h $(srcdir)/util/alloc.h  \
 $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
 $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/keyraw.h \
 $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_secalgo.h \
- $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_utils.h \
- $(srcdir)/simdzone/include/zone.h $(srcdir)/simdzone/include/zone/attributes.h \
- simdzone/include/zone/export.h
+ $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_utils.h
 fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/fptr_wlist.h \
 $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
@@ -1048,7 +1022,8 @@ fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/
 $(srcdir)/validator/val_utils.h $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_anchor.h \
 $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_kentry.h $(srcdir)/validator/val_neg.h \
 $(srcdir)/validator/autotrust.h $(srcdir)/libunbound/libworker.h $(srcdir)/libunbound/context.h \
- $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/worker.h $(srcdir)/daemon/remote.h \
+ $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/worker.h $(srcdir)/util/tsig.h \
+ $(srcdir)/daemon/remote.h \
 $(PYTHONMOD_HEADER) $(DYNLIBMOD_HEADER) $(srcdir)/cachedb/cachedb.h \
 $(srcdir)/ipsecmod/ipsecmod.h $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/util/net_help.h \
 $(srcdir)/util/random.h $(srcdir)/util/data/dname.h $(srcdir)/edns-subnet/addrtree.h \
@@ -1128,6 +1103,12 @@ tcp_conn_limit.lo tcp_conn_limit.o: $(srcdir)/util/tcp_conn_limit.c config.h $(s
 $(srcdir)/sldns/pkthdr.h $(srcdir)/services/view.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h
 timehist.lo timehist.o: $(srcdir)/util/timehist.c config.h $(srcdir)/util/timehist.h $(srcdir)/util/log.h \
 $(srcdir)/util/timeval_func.h
+tsig.lo tsig.o: $(srcdir)/util/tsig.c config.h $(srcdir)/util/tsig.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
+ $(srcdir)/util/rbtree.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/net_help.h \
+ $(srcdir)/util/random.h $(srcdir)/util/regional.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/pkthdr.h \
+ $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/util/data/msgparse.h \
+ $(srcdir)/util/storage/lruhash.h $(srcdir)/util/data/dname.h \
+ 
 tube.lo tube.o: $(srcdir)/util/tube.c config.h $(srcdir)/util/tube.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \
 $(srcdir)/util/random.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \
  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h \
@@ -1460,6 +1441,10 @@ unitinfra.lo unitinfra.o: $(srcdir)/testcode/unitinfra.c config.h $(srcdir)/test
 $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
 $(srcdir)/dnscrypt/cert.h \
 $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h
+unittsig.lo unittsig.o: $(srcdir)/testcode/unittsig.c config.h $(srcdir)/util/tsig.h $(srcdir)/util/locks.h \
+ $(srcdir)/util/log.h $(srcdir)/util/rbtree.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h \
+ $(srcdir)/util/net_help.h $(srcdir)/util/random.h $(srcdir)/testcode/unitmain.h $(srcdir)/sldns/parseutil.h \
+ $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/sbuffer.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h
 acl_list.lo acl_list.o: $(srcdir)/daemon/acl_list.c config.h $(srcdir)/daemon/acl_list.h \
 $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/services/view.h $(srcdir)/util/locks.h \
 $(srcdir)/util/log.h $(srcdir)/util/regional.h $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h \
@@ -1499,8 +1484,9 @@ daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
 $(srcdir)/services/listen_dnsport.h \
 $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
 $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
- $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/cachedb/cachedb.h
+ $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/util/tsig.h \
+ $(srcdir)/sldns/keyraw.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/cachedb/cachedb.h
 remote.lo remote.o: $(srcdir)/daemon/remote.c config.h \
 $(srcdir)/daemon/remote.h \
 $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h \
@@ -1523,7 +1509,7 @@ remote.lo remote.o: $(srcdir)/daemon/remote.c config.h \
 $(srcdir)/iterator/iter_delegpt.h $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h \
 $(srcdir)/iterator/iter_donotq.h $(srcdir)/iterator/iter_priv.h $(srcdir)/services/outside_network.h \
 $(srcdir)/util/regional.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/wire2str.h \
- $(srcdir)/util/timeval_func.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/edns.h $(srcdir)/cachedb/cachedb.h \
+ $(srcdir)/util/timeval_func.h $(srcdir)/util/tcp_conn_limit.h $(srcdir)/util/edns.h $(srcdir)/util/tsig.h $(srcdir)/cachedb/cachedb.h \
 $(srcdir)/edns-subnet/subnetmod.h $(srcdir)/edns-subnet/addrtree.h $(srcdir)/edns-subnet/edns-subnet.h
 stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
 $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
@@ -1574,7 +1560,7 @@ worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(sr
 $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
 $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h $(srcdir)/util/data/msgencode.h \
 $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/proxy_protocol.h \
- $(srcdir)/util/edns.h $(srcdir)/util/timeval_func.h $(srcdir)/iterator/iter_fwd.h \
+ $(srcdir)/util/tsig.h $(srcdir)/util/edns.h $(srcdir)/util/timeval_func.h $(srcdir)/iterator/iter_fwd.h \
 $(srcdir)/iterator/iter_hints.h $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h \
 $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h \
 $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h \
@@ -1615,7 +1601,7 @@ worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(sr
 $(srcdir)/services/cache/dns.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
 $(srcdir)/services/localzone.h $(srcdir)/respip/respip.h $(srcdir)/util/data/msgencode.h \
 $(srcdir)/util/data/dname.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/tube.h $(srcdir)/util/proxy_protocol.h \
- $(srcdir)/util/edns.h $(srcdir)/util/timeval_func.h $(srcdir)/iterator/iter_fwd.h \
+ $(srcdir)/util/tsig.h $(srcdir)/util/edns.h $(srcdir)/util/timeval_func.h $(srcdir)/iterator/iter_fwd.h \
 $(srcdir)/iterator/iter_hints.h $(srcdir)/iterator/iter_utils.h $(srcdir)/iterator/iter_resptype.h \
 $(srcdir)/validator/autotrust.h $(srcdir)/validator/val_anchor.h $(srcdir)/libunbound/context.h \
 $(srcdir)/libunbound/unbound-event.h $(srcdir)/libunbound/libworker.h $(srcdir)/sldns/wire2str.h \
@@ -1644,8 +1630,9 @@ daemon.lo daemon.o: $(srcdir)/daemon/daemon.c config.h \
 $(srcdir)/services/listen_dnsport.h \
 $(srcdir)/services/cache/rrset.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \
 $(srcdir)/services/localzone.h $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h \
- $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/sldns/keyraw.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h $(srcdir)/cachedb/cachedb.h
+ $(srcdir)/respip/respip.h $(srcdir)/util/random.h $(srcdir)/util/tube.h $(srcdir)/util/net_help.h $(srcdir)/util/tsig.h \
+ $(srcdir)/sldns/keyraw.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/cachedb/cachedb.h
 stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h \
 $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \
 $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \
@@ -1716,8 +1703,8 @@ unbound-checkconf.lo unbound-checkconf.o: $(srcdir)/smallapp/unbound-checkconf.c
 $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/storage/lruhash.h \
 $(srcdir)/util/locks.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/packed_rrset.h \
 $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/net_help.h $(srcdir)/util/random.h \
- $(srcdir)/util/regional.h $(srcdir)/iterator/iterator.h $(srcdir)/services/outbound_list.h \
- $(srcdir)/iterator/iter_fwd.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iter_hints.h \
+ $(srcdir)/util/regional.h $(srcdir)/util/tsig.h $(srcdir)/util/rbtree.h $(srcdir)/iterator/iterator.h \
+ $(srcdir)/services/outbound_list.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h \
 $(srcdir)/util/storage/dnstree.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h \
 $(srcdir)/validator/val_nsec3.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
 $(srcdir)/sldns/sbuffer.h $(srcdir)/services/listen_dnsport.h $(srcdir)/util/netevent.h \
@@ -1750,7 +1737,7 @@ context.lo context.o: $(srcdir)/libunbound/context.c config.h $(srcdir)/libunbou
 $(srcdir)/services/authzone.h $(srcdir)/services/mesh.h $(srcdir)/services/rpz.h $(srcdir)/daemon/stats.h \
 $(srcdir)/util/timehist.h $(srcdir)/respip/respip.h $(srcdir)/services/listen_dnsport.h \
 $(srcdir)/daemon/acl_list.h \
- $(srcdir)/util/edns.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h
+ $(srcdir)/util/edns.h $(srcdir)/util/tsig.h $(srcdir)/iterator/iter_fwd.h $(srcdir)/iterator/iter_hints.h
 libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbound/unbound.h \
 $(srcdir)/libunbound/unbound-event.h config.h $(srcdir)/libunbound/context.h $(srcdir)/util/locks.h \
 $(srcdir)/util/log.h $(srcdir)/util/alloc.h $(srcdir)/util/rbtree.h $(srcdir)/services/modstack.h \
@@ -1758,7 +1745,7 @@ libunbound.lo libunbound.o: $(srcdir)/libunbound/libunbound.c $(srcdir)/libunbou
 $(srcdir)/util/config_file.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/module.h $(srcdir)/util/data/msgreply.h \
 $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/util/regional.h $(srcdir)/util/random.h \
 $(srcdir)/util/net_help.h $(srcdir)/util/tube.h $(srcdir)/util/ub_event.h $(srcdir)/util/edns.h \
- $(srcdir)/util/storage/dnstree.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
+ $(srcdir)/util/storage/dnstree.h $(srcdir)/util/tsig.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \
 $(srcdir)/sldns/sbuffer.h $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h $(srcdir)/util/netevent.h \
 $(srcdir)/dnscrypt/dnscrypt.h  $(srcdir)/dnscrypt/cert.h \
 $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/authzone.h \
@@ -1,5 +1,4 @@
 Unbound README
-* From source repository: git submodule update --init && autoreconf -fi
 * ./configure && make && make install
 * You can use libevent if you want. libevent is useful when using 
  many (10000) outgoing ports. By default max 256 ports are opened at
@@ -19,35 +19,24 @@ You can learn more about Unbound by reading our
 Make sure you have the C toolchain, OpenSSL and its include files, and libexpat
 installed.
 If building from the repository source you also need flex and bison installed.
-If building from the repository source, also init the git submodule and
-create the configure script with:
-
-```
-git submodule update --init
-autoreconf -fi
-```
-
 Unbound can be compiled and installed using:

 ```
 ./configure && make && make install
 ```

-You can use libevent if you want. libevent is useful when using many (e.g.,
-10000) outgoing ports.
+You can use libevent if you want. libevent is useful when using many (10000)
+outgoing ports. By default max 256 ports are opened at the same time and the
+builtin alternative is equally capable and a little faster.
+
 Use the `--with-libevent` configure option to compile Unbound with libevent
 support.

-If not, the default builtin alternative opens max 256 ports at the same time
-and is equally capable and a little faster.
-
-
 ## Unbound configuration

-All of Unbound's configuration options are described in the `unbound.conf(5)`
-man page, which will be installed and is also available on the Unbound
-[documentation page](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html)
-for the latest version.
+All of Unbound's configuration options are described in the man pages, which
+will be installed and are available on the Unbound
+[documentation page](https://unbound.docs.nlnetlabs.nl/).

-An example configuration file, with minimal documentation, is located in
+An example configuration file is located in
 [doc/example.conf](https://github.com/NLnetLabs/unbound/blob/master/doc/example.conf.in).
@@ -2,9 +2,7 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 51
-# 2025-11-06 Fix ACX_CHECK_NONSTRING_ATTRIBUTE to reject clang, that prints
-#	     a warning for 'unknown attribute' when nonstring is used.
+# Version 50
 # 2025-09-29 add ac_cv_func_malloc_0_nonnull as a cache value for the malloc(0)
 #            check by ACX_FUNC_MALLOC.
 # 2025-09-29 add ACX_CHECK_NONSTRING_ATTRIBUTE, AHX_CONFIG_NONSTRING_ATTRIBUTE.
@@ -537,9 +535,6 @@ dnl result in HAVE_ATTR_NONSTRING.
 dnl Make sure you include AHX_CONFIG_NONSTRING_ATTRIBUTE also.
 AC_DEFUN([ACX_CHECK_NONSTRING_ATTRIBUTE],
 [AC_REQUIRE([AC_PROG_CC])
-AC_REQUIRE([ACX_CHECK_ERROR_FLAGS])
-BAKCFLAGS="$CFLAGS"
-CFLAGS="$CFLAGS $ERRFLAG"
 AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "nonstring" attribute)
 AC_CACHE_VAL(ac_cv_c_nonstring_attribute,
 [ac_cv_c_nonstring_attribute=no
@@ -551,7 +546,6 @@ struct test {
   struct test t = { "1" };
   (void) t;
 ]])],[ac_cv_c_nonstring_attribute="yes"],[ac_cv_c_nonstring_attribute="no"])
-CFLAGS="$BAKCFLAGS"
 ])

 dnl Setup ATTR_NONSTRING config.h parts.
@@ -143,12 +143,6 @@ redis_connect(const char* host, int port, const char* path,
 {
 	struct timeval now_val;
 	redisContext* ctx;
-#ifdef THREADS_DISABLED
-	/* Fix attribute unused warning.
-	 * wait_lock is only used with lock_basic_* functions that are nop'ed
-	 * when compiled without thread support. */
-	(void)wait_lock;
-#endif /* THREADS_DISABLED */

 	/* See if the redis server is down, and reconnect has to wait. */
 	if(*reconnect_attempts > REDIS_RECONNECT_ATTEMPT_LIMIT) {
@@ -38,9 +38,6 @@
 #ifndef UB_ON_WINDOWS
 #include <sys/mman.h>
 #endif
-#ifdef __QNX__
-#include "util/log.h"
-#endif /* __QNX__ */

 #define KEYSTREAM_ONLY
 #include "chacha_private.h"
@@ -190,11 +187,7 @@ _rs_stir(void)
 		if(errno != ENOSYS ||
 			fallback_getentropy_urandom(rnd, sizeof rnd) == -1) {
 #ifdef SIGKILL
-#ifndef __QNX__
 			raise(SIGKILL);
-#else /* !__QNX__ */
-			fatal_exit("failed to getentropy");
-#endif /* __QNX__ */
 #else
 			exit(9); /* windows */
 #endif
@@ -29,9 +29,7 @@
 #include <sys/param.h>
 #include <sys/ioctl.h>
 #include <sys/resource.h>
-#ifndef __QNX__
 #include <sys/syscall.h>
-#endif /* !__QNX__ */
 #ifdef SYS__sysctl
 #include <linux/sysctl.h>
 #endif
@@ -44,9 +42,7 @@
 #include <stdlib.h>
 #include <stdint.h>
 #include <stdio.h>
-#ifndef __QNX__
 #include <link.h>
-#endif /* __QNX__ */
 #include <termios.h>
 #include <fcntl.h>
 #include <signal.h>
@@ -64,14 +60,12 @@
 #define SHA512_Final(r, c)	sha512_digest(c, SHA512_DIGEST_SIZE, r)
 #endif

-#ifndef __QNX__
 #include <linux/types.h>
 #include <linux/random.h>
 #ifdef HAVE_GETAUXVAL
 #include <sys/auxv.h>
 #endif
 #include <sys/vfs.h>
-#endif /* !__QNX__ */
 #ifndef MAP_ANON
 #define MAP_ANON MAP_ANONYMOUS
 #endif
@@ -100,10 +94,8 @@ static int getentropy_urandom(void *buf, size_t len);
 #ifdef SYS__sysctl
 static int getentropy_sysctl(void *buf, size_t len);
 #endif
-#ifndef __QNX__
 static int getentropy_fallback(void *buf, size_t len);
 static int getentropy_phdr(struct dl_phdr_info *info, size_t size, void *data);
-#endif /* !__QNX__ */

 int
 getentropy(void *buf, size_t len)
@@ -186,7 +178,6 @@ getentropy(void *buf, size_t len)
 	 * sysctl ABI, or consider providing a new failsafe API which
 	 * works in a chroot or when file descriptors are exhausted.
 	 */
-#ifndef __QNX__
 #undef FAIL_INSTEAD_OF_TRYING_FALLBACK
 #ifdef FAIL_INSTEAD_OF_TRYING_FALLBACK
 	raise(SIGKILL);
@@ -194,9 +185,6 @@ getentropy(void *buf, size_t len)
 	ret = getentropy_fallback(buf, len);
 	if (ret != -1)
 		return (ret);
-#else /* !__QNX__ */
-	fatal_exit("failed to read from /dev/urandom");
-#endif /* __QNX__ */

 	errno = EIO;
 	return (ret);
@@ -226,11 +214,7 @@ getentropy_urandom(void *buf, size_t len)
 {
 	struct stat st;
 	size_t i;
-#ifndef __QNX__
 	int fd, cnt, flags;
-#else /* !__QNX__ */
-	int fd, flags;
-#endif /* __QNX__ */
 	int save_errno = errno;

 start:
@@ -257,12 +241,10 @@ start:
 		close(fd);
 		goto nodevrandom;
 	}
-#ifndef __QNX__
 	if (ioctl(fd, RNDGETENTCNT, &cnt) == -1) {
 		close(fd);
 		goto nodevrandom;
 	}
-#endif /* !__QNX__ */
 	for (i = 0; i < len; ) {
 		size_t wanted = len - i;
 		ssize_t ret = read(fd, (char *)buf + i, wanted);
@@ -283,7 +265,6 @@ nodevrandom:
 	return (-1);
 }

-#ifndef __QNX__
 #ifdef SYS__sysctl
 static int
 getentropy_sysctl(void *buf, size_t len)
@@ -556,4 +537,3 @@ getentropy_fallback(void *buf, size_t len)
 	errno = save_errno;
 	return (0);		/* satisfied */
 }
-#endif /* !__QNX__ */
@@ -12,14 +12,14 @@ sinclude(dnscrypt/dnscrypt.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[24])
-m4_define([VERSION_MICRO],[3])
+m4_define([VERSION_MICRO],[1])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=36
+LIBUNBOUND_REVISION=34
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -121,8 +121,6 @@ LIBUNBOUND_AGE=1
 # 1.23.1 had 9:32:1
 # 1.24.0 had 9:33:1
 # 1.24.1 had 9:34:1
-# 1.24.2 had 9:35:1
-# 1.24.3 had 9:36:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -177,12 +175,6 @@ else
 	else on_mingw="no"; fi
 fi

-dnl install the install-sh file with libtoolize -ci, and autoreconf -fi.
-AC_REQUIRE_AUX_FILE([install-sh])
-if test ! -f install-sh; then
-    AC_MSG_WARN([./install-sh is missing, use `libtoolize -ci` or `autoreconf -fi` to add it])
-fi
-
 #
 # Determine configuration file
 # the eval is to evaluate shell expansion twice
@@ -368,14 +360,7 @@ AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "noreturn" attribu
 AC_CACHE_VAL(ac_cv_c_noreturn_attribute,
 [ac_cv_c_noreturn_attribute=no
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h>
-#ifdef STDC_HEADERS
-# include <stdlib.h>
-#else
-# ifdef HAVE_STDLIB_H
-#  include <stdlib.h>
-# endif
-#endif
-__attribute__((noreturn)) void f(int x) { printf("%d", x); exit(1); }
+__attribute__((noreturn)) void f(int x) { printf("%d", x); }
 ]], [[
   f(1);
 ]])],[ac_cv_c_noreturn_attribute="yes"],[ac_cv_c_noreturn_attribute="no"])
@@ -1014,7 +999,7 @@ else
 	AC_MSG_RESULT([no])
 fi
 AC_CHECK_HEADERS([openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h openssl/core_names.h openssl/param_build.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex])
+AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex SSL_CTX_set_tmp_ecdh HMAC_CTX_new EVP_MAC_CTX_new])

 # these check_funcs need -lssl
 BAKLIBS="$LIBS"
@@ -1268,7 +1253,7 @@ case "$enable_ecdsa" in
 	      # see if OPENSSL 1.0.0 or later (has EVP MD and Verify independency)
 	      AC_MSG_CHECKING([if openssl supports SHA2 and ECDSA with EVP])
 	      if grep OPENSSL_VERSION_TEXT $ssldir_include/openssl/opensslv.h | grep "OpenSSL" >/dev/null; then
-		if grep OPENSSL_VERSION_TEXT $ssldir_include/openssl/opensslv.h | grep "OpenSSL 0\." >/dev/null; then
+		if grep OPENSSL_VERSION_NUMBER $ssldir_include/openssl/opensslv.h | grep 0x0 >/dev/null; then
 		  AC_MSG_RESULT([no])
 		  AC_DEFINE_UNQUOTED([USE_ECDSA_EVP_WORKAROUND], [1], [Define this to enable an EVP workaround for older openssl])
 		else
@@ -1688,12 +1673,10 @@ if test x_$enable_static_exe = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$host" | $GREP -i -e linux >/dev/null; then
-			if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-				:
-			else
-				LIBS="$LIBS -l:libssp.a"
-			fi
+		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
+			:
+		else
+			LIBS="$LIBS -l:libssp.a"
 		fi
 	fi
 fi
@@ -1711,12 +1694,10 @@ if test x_$enable_fully_static = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$host" | $GREP -i -e linux >/dev/null; then
-			if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-				:
-			else
-				LIBS="$LIBS -l:libssp.a"
-			fi
+		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
+			:
+		else
+			LIBS="$LIBS -l:libssp.a"
 		fi
 	fi
 fi
@@ -2042,9 +2023,6 @@ dt_DNSTAP([$UNBOUND_RUN_DIR/dnstap.sock],
        AC_SUBST([ENABLE_DNSTAP], [0])
    ]
 )
-dnstap_config="dnstap/dnstap_config.h.tmp:dnstap/dnstap_config.h.in"
-dnstap_config_tmp="dnstap/dnstap_config.h.tmp"
-dnstap_config_out="dnstap/dnstap_config.h"

 # check for dnscrypt if requested
 dnsc_DNSCRYPT([
@@ -2499,34 +2477,6 @@ AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
 AX_BUILD_DATE_EPOCH(date, [[%b %e, %Y]])
 AC_SUBST(date)

-AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh $dnstap_config dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
+AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
 AC_CONFIG_HEADERS([config.h])
-
-# Arguments introduced specifically for simdzone.
-AC_ARG_ENABLE(westmere, AS_HELP_STRING([--disable-westmere], [Disable Westmere (SSE4.2) parser kernel]))
-AC_ARG_ENABLE(haswell, AS_HELP_STRING([--disable-haswell], [Disable Haswell (AVX2) parser kernel]))
-if test ! -f simdzone/configure.ac; then AC_MSG_ERROR([There is no "simdzone/configure.ac" file. The simdzone directory has not been fetched, perhaps get it with 'git submodule update --init'.]); fi
-if test ! -f simdzone/configure; then AC_MSG_ERROR([There is no "simdzone/configure" file. The simdzone directory has no configure script file, perhaps run 'autoreconf -fi'.]); fi
-AC_CONFIG_SUBDIRS([simdzone])
-
 AC_OUTPUT
-# Pick up the objects for simdzone.
-SIMDZONE_OBJ=`(cd simdzone; make list_objs) | sed -e 's?src?simdzone/src?g'`
-AC_SUBST(SIMDZONE_OBJ)
-sed -e 's?^SIMDZONE_OBJ=.*$?SIMDZONE_OBJ='"$SIMDZONE_OBJ"'?' < Makefile > Makefile.tmp.$$
-mv -f Makefile.tmp.$$ Makefile
-# If dnstap config has changed, overwrite it.
-if test -n "$dnstap_config"; then
-	if test ! -f "$dnstap_config_out"; then
-		mv "$dnstap_config_tmp" "$dnstap_config_out" || AC_MSG_ERROR([Could not create $dnstap_config_out])
-	else if diff "$dnstap_config_out" "$dnstap_config_tmp" >/dev/null 2>&1; then
-		if test "x$opt_dnstap" != "xno"; then
-		  AC_MSG_NOTICE([In $srcdir: $dnstap_config_out is unchanged])
-		fi
-		rm -f "$dnstap_config_tmp"
-	else
-		rm -f "$dnstap_config_out"
-		mv "$dnstap_config_tmp" "$dnstap_config_out" || AC_MSG_ERROR([Could not create $dnstap_config_out])
-	  fi
-	fi
-fi
@@ -1,22 +1,21 @@
 #!/usr/bin/env bash
-OPENSSL_VERSION=1.1.1d

 echo "Downloading OpenSSL"
-if ! curl -L -k -s -o openssl-$OPENSSL_VERSION.tar.gz https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz;
+if ! curl -L -k -s -o openssl-1.1.1d.tar.gz https://www.openssl.org/source/openssl-1.1.1d.tar.gz;
 then
    echo "Failed to download OpenSSL"
    exit 1
 fi

 echo "Unpacking OpenSSL"
-rm -rf ./openssl-$OPENSSL_VERSION
-if ! tar -xf openssl-$OPENSSL_VERSION.tar.gz;
+rm -rf ./openssl-1.1.1d
+if ! tar -xf openssl-1.1.1d.tar.gz;
 then
    echo "Failed to unpack OpenSSL"
    exit 1
 fi

-cd openssl-$OPENSSL_VERSION || exit 1
+cd openssl-1.1.1d || exit 1

 if ! cp ../contrib/ios/15-ios.conf Configurations/; then
    echo "Failed to copy OpenSSL ios config"
@@ -28,8 +27,7 @@ fi
 # Also see https://github.com/openssl/openssl/issues/7607.
 if ! patch -u -p0 < ../contrib/ios/openssl.patch; then
    echo "Failed to patch OpenSSL"
-    # the partial patch may be useful.
-    #exit 1
+    exit 1
 fi

 echo "Configuring OpenSSL"
@@ -175,7 +175,6 @@ fi
 # For example, remove 4.3, 6.2, and 6.1 if they are not installed. We go back to
 # the 1.0 SDKs because Apple WatchOS uses low numbers, like 2.0 and 2.1.
 XCODE_SDK=
-if test -z "$SDK_VERSION"; then
 for i in $(seq -f "%.1f" 30.0 -0.1 1.0)
 do
    if [ -d "$XCODE_DEVELOPER_SDK/Developer/SDKs/$IOS_SDK$i.sdk" ]; then
@@ -183,10 +182,6 @@ do
        break
    fi
 done
-else
-    i="$SDK_VERSION"
-    XCODE_SDK="$IOS_SDK$i.sdk"
-fi

 # Error checking
 if [ -z "$XCODE_SDK" ]; then
@@ -89,6 +89,7 @@
 #include "util/random.h"
 #include "util/tube.h"
 #include "util/net_help.h"
+#include "util/tsig.h"
 #include "sldns/keyraw.h"
 #include "respip/respip.h"
 #include "iterator/iter_fwd.h"
@@ -320,6 +321,17 @@ daemon_init(void)
 		free(daemon);
 		return NULL;
 	}
+	if(!(daemon->env->tsig_key_table = tsig_key_table_create())) {
+		auth_zones_delete(daemon->env->auth_zones);
+		acl_list_delete(daemon->acl_interface);
+		acl_list_delete(daemon->acl);
+		tcl_list_delete(daemon->tcl);
+		edns_known_options_delete(daemon->env);
+		edns_strings_delete(daemon->env->edns_strings);
+		free(daemon->env);
+		free(daemon);
+		return NULL;
+	}
 	return daemon;	
 }

@@ -558,11 +570,9 @@ daemon_create_workers(struct daemon* daemon)
 	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);

 #ifdef HAVE_NGTCP2
-	if (cfg_has_quic(daemon->cfg)) {
-		daemon->doq_table = doq_table_create(daemon->cfg, daemon->rand);
-		if(!daemon->doq_table)
-			fatal_exit("could not create doq_table: out of memory");
-	}
+	daemon->doq_table = doq_table_create(daemon->cfg, daemon->rand);
+	if(!daemon->doq_table)
+		fatal_exit("could not create doq_table: out of memory");
 #endif
 	
 	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
@@ -633,25 +643,6 @@ static void close_other_pipes(struct daemon* daemon, int thr)
 }
 #endif /* THREADS_DISABLED */

-/**
- * Function to set the thread local log ID.
- * Either the internal thread number, or the LWP ID on Linux based on
- * configuration.
- */
-static void
-set_log_thread_id(struct worker* worker, struct config_file* cfg)
-{
-	(void)cfg;
-	log_assert(worker);
-#if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
-	worker->thread_tid = gettid();
-	if(cfg->log_thread_id)
-		log_thread_set(&worker->thread_tid);
-	else
-#endif
-		log_thread_set(&worker->thread_num);
-}
-
 /**
 * Function to start one thread. 
 * @param arg: user argument.
@@ -662,7 +653,7 @@ thread_start(void* arg)
 {
 	struct worker* worker = (struct worker*)arg;
 	int port_num = 0;
-	set_log_thread_id(worker, worker->daemon->cfg);
+	log_thread_set(&worker->thread_num);
 	ub_thread_blocksigs();
 #ifdef THREADS_DISABLED
 	/* close pipe ends used by main */
@@ -792,12 +783,17 @@ daemon_fork(struct daemon* daemon)
 	daemon->use_response_ip = !respip_set_is_empty(
 		daemon->env->respip_set) || have_view_respip_cfg;

+	/* setup tsig keys */
+	if(!tsig_key_table_apply_cfg(daemon->env->tsig_key_table, daemon->cfg))
+		fatal_exit("Could not set up TSIG keys");
+
 	/* setup modules */
 	daemon_setup_modules(daemon);

 	/* read auth zonefiles */
 	if(!auth_zones_apply_cfg(daemon->env->auth_zones, daemon->cfg, 1,
-		&daemon->use_rpz, daemon->env, &daemon->mods))
+		&daemon->use_rpz, daemon->env, &daemon->mods,
+		daemon->env->tsig_key_table))
 		fatal_exit("auth_zones could not be setup");

 	/* Set-up EDNS strings */
@@ -822,13 +818,9 @@ daemon_fork(struct daemon* daemon)
 		fatal_exit("RPZ requires the respip module");

 	/* first create all the worker structures, so we can pass
-	 * them to the newly created threads.
+	 * them to the newly created threads. 
 	 */
 	daemon_create_workers(daemon);
-	/* Set it for the first (main) worker since it does not take part in
-	 * the thread_start() procedure.
-	 */
-	set_log_thread_id(daemon->workers[0], daemon->cfg);

 #if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
 	/* in libev the first inited base gets signals */
@@ -942,10 +934,8 @@ daemon_cleanup(struct daemon* daemon)
 	daemon->dnscenv = NULL;
 #endif
 #ifdef HAVE_NGTCP2
-	if (daemon->doq_table) {
-		doq_table_delete(daemon->doq_table);
-		daemon->doq_table = NULL;
-	}
+	doq_table_delete(daemon->doq_table);
+	daemon->doq_table = NULL;
 #endif
 	daemon->cfg = NULL;
 }
@@ -971,6 +961,7 @@ daemon_delete(struct daemon* daemon)
 		edns_known_options_delete(daemon->env);
 		edns_strings_delete(daemon->env->edns_strings);
 		auth_zones_delete(daemon->env->auth_zones);
+		tsig_key_table_delete(daemon->env->tsig_key_table);
 	}
 	ub_randfree(daemon->rand);
 	alloc_clear(&daemon->superalloc);
@@ -98,6 +98,7 @@
 #include "util/timeval_func.h"
 #include "util/tcp_conn_limit.h"
 #include "util/edns.h"
+#include "util/tsig.h"
 #ifdef USE_CACHEDB
 #include "cachedb/cachedb.h"
 #endif
@@ -801,8 +802,6 @@ print_stats(RES* ssl, const char* nm, struct ub_stats_info* s)
 		(unsigned long)s->svr.num_queries_cookie_invalid)) return 0;
 	if(!ssl_printf(ssl, "%s.num.queries_discard_timeout"SQ"%lu\n", nm,
 		(unsigned long)s->svr.num_queries_discard_timeout)) return 0;
-	if(!ssl_printf(ssl, "%s.num.queries_replyaddr_limit"SQ"%lu\n", nm,
-		(unsigned long)s->svr.num_queries_replyaddr_limit)) return 0;
 	if(!ssl_printf(ssl, "%s.num.queries_wait_limit"SQ"%lu\n", nm,
 		(unsigned long)s->svr.num_queries_wait_limit)) return 0;
 	if(!ssl_printf(ssl, "%s.num.cachehits"SQ"%lu\n", nm,
@@ -847,8 +846,6 @@ print_stats(RES* ssl, const char* nm, struct ub_stats_info* s)
 		(unsigned long)s->mesh_num_states)) return 0;
 	if(!ssl_printf(ssl, "%s.requestlist.current.user"SQ"%lu\n", nm,
 		(unsigned long)s->mesh_num_reply_states)) return 0;
-	if(!ssl_printf(ssl, "%s.requestlist.current.replies"SQ"%lu\n", nm,
-		(unsigned long)s->mesh_num_reply_addrs)) return 0;
 #ifndef S_SPLINT_S
 	sumwait.tv_sec = s->mesh_replies_sum_wait_sec;
 	sumwait.tv_usec = s->mesh_replies_sum_wait_usec;
@@ -4649,6 +4646,8 @@ struct fast_reload_construct {
 	struct acl_list* acl_interface;
 	/** construct for tcp connection limit */
 	struct tcl_list* tcl;
+	/** tsig key table */
+	struct tsig_key_table* tsig_key_table;
 	/** construct for local zones */
 	struct local_zones* local_zones;
 	/** if there is response ip configuration in use */
@@ -5035,6 +5034,7 @@ fr_construct_clear(struct fast_reload_construct* ct)
 	acl_list_delete(ct->acl);
 	acl_list_delete(ct->acl_interface);
 	tcl_list_delete(ct->tcl);
+	tsig_key_table_delete(ct->tsig_key_table);
 	edns_strings_delete(ct->edns_strings);
 	anchors_delete(ct->anchors);
 	views_delete(ct->views);
@@ -5137,6 +5137,8 @@ getmem_config_auth(struct config_auth* p)
 			+ getmem_config_strlist(s->masters)
 			+ getmem_config_strlist(s->urls)
 			+ getmem_config_strlist(s->allow_notify)
+			+ getmem_config_str2list(s->masters_tsig)
+			+ getmem_config_str2list(s->allow_notify_tsig)
 			+ getmem_str(s->zonefile)
 			+ s->rpz_taglistlen
 			+ getmem_str(s->rpz_action_override)
@@ -5300,6 +5302,7 @@ fr_printmem(struct fast_reload_thread* fr,
 	mem += auth_zones_get_mem(ct->auth_zones);
 	mem += forwards_get_mem(ct->fwds);
 	mem += hints_get_mem(ct->hints);
+	mem += tsig_key_table_get_mem(ct->tsig_key_table);
 	mem += local_zones_get_mem(ct->local_zones);
 	mem += acl_list_get_mem(ct->acl);
 	mem += acl_list_get_mem(ct->acl_interface);
@@ -5388,6 +5391,12 @@ xfr_auth_master_equal(struct auth_master* m1, struct auth_master* m2)
 		return 0;
 	if(m1->port != m2->port)
 		return 0;
+
+	if((m1->tsig_key_name && !m2->tsig_key_name) || (!m1->tsig_key_name && m2->tsig_key_name))
+		return 0;
+	if(m1->tsig_key_name && m2->tsig_key_name && strcmp(m1->tsig_key_name, m2->tsig_key_name) != 0)
+		return 0;
+
 	return 1;
 }

@@ -5587,12 +5596,24 @@ fr_construct_from_config(struct fast_reload_thread* fr,
 	if(fr_poll_for_quit(fr))
 		return 1;

+	if(!(ct->tsig_key_table = tsig_key_table_create())) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(!tsig_key_table_apply_cfg(ct->tsig_key_table, newcfg)) {
+		fr_construct_clear(ct);
+		return 0;
+	}
+	if(fr_poll_for_quit(fr))
+		return 1;
+
 	if(!(ct->auth_zones = auth_zones_create())) {
 		fr_construct_clear(ct);
 		return 0;
 	}
 	if(!auth_zones_apply_cfg(ct->auth_zones, newcfg, 1, &ct->use_rpz,
-		fr->worker->daemon->env, &fr->worker->daemon->mods)) {
+		fr->worker->daemon->env, &fr->worker->daemon->mods,
+		ct->tsig_key_table)) {
 		fr_construct_clear(ct);
 		return 0;
 	}
@@ -5922,6 +5943,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(forwards);
 	COPY_VAR_ptr(auths);
 	COPY_VAR_ptr(views);
+	COPY_VAR_ptr(tsig_keys);
 	COPY_VAR_ptr(donotqueryaddrs);
 #ifdef CLIENT_SUBNET
 	COPY_VAR_ptr(client_subnet);
@@ -5972,7 +5994,6 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_int(log_servfail);
 	COPY_VAR_ptr(log_identity);
 	COPY_VAR_int(log_destaddr);
-	COPY_VAR_int(log_thread_id);
 	COPY_VAR_int(hide_identity);
 	COPY_VAR_int(hide_version);
 	COPY_VAR_int(hide_trustanchor);
@@ -6182,10 +6203,6 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(ipset_name_v6);
 #endif
 	COPY_VAR_int(ede);
-	COPY_VAR_int(iter_scrub_ns);
-	COPY_VAR_int(iter_scrub_cname);
-	COPY_VAR_int(max_global_quota);
-	COPY_VAR_int(iter_scrub_promiscuous);
 }
 #endif /* ATOMIC_POINTER_LOCK_FREE && HAVE_LINK_ATOMIC_STORE */

@@ -6364,6 +6381,7 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 		lock_basic_lock(&ct->anchors->lock);
 		lock_basic_lock(&env->anchors->lock);
 	}
+	lock_rw_wrlock(&env->tsig_key_table->lock);

 #if defined(ATOMIC_POINTER_LOCK_FREE) && defined(HAVE_LINK_ATOMIC_STORE)
 	if(fr->fr_nopause) {
@@ -6400,6 +6418,8 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 	acl_list_swap_tree(daemon->acl, ct->acl);
 	acl_list_swap_tree(daemon->acl_interface, ct->acl_interface);
 	tcl_list_swap_tree(daemon->tcl, ct->tcl);
+	tsig_key_table_swap_tree(daemon->env->tsig_key_table,
+		ct->tsig_key_table);
 	local_zones_swap_tree(daemon->local_zones, ct->local_zones);
 	respip_set_swap_tree(env->respip_set, ct->respip_set);
 	daemon->use_response_ip = ct->use_response_ip;
@@ -6446,6 +6466,7 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 		lock_basic_unlock(&ct->anchors->lock);
 		lock_basic_unlock(&env->anchors->lock);
 	}
+	lock_rw_unlock(&env->tsig_key_table->lock);

 	return 1;
 }
@@ -6635,14 +6656,7 @@ static void* fast_reload_thread_main(void* arg)
 	struct fast_reload_thread* fast_reload_thread = (struct fast_reload_thread*)arg;
 	struct timeval time_start, time_read, time_construct, time_reload,
 		time_end;
-
-#if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
-	fast_reload_thread->thread_tid = gettid();
-	if(fast_reload_thread->thread_tid_log)
-		log_thread_set(&fast_reload_thread->thread_tid);
-	else
-#endif
-		log_thread_set(&fast_reload_thread->threadnum);
+	log_thread_set(&fast_reload_thread->threadnum);

 	verbose(VERB_ALGO, "start fast reload thread");
 	if(fast_reload_thread->fr_verb >= 1) {
@@ -7030,9 +7044,6 @@ fast_reload_thread_setup(struct worker* worker, int fr_verb, int fr_nopause,
 	lock_basic_init(&fr->fr_output_lock);
 	lock_protect(&fr->fr_output_lock, fr->fr_output,
 		sizeof(*fr->fr_output));
-#ifdef HAVE_GETTID
-	fr->thread_tid_log = worker->env.cfg->log_thread_id;
-#endif
 	return 1;
 }

@@ -7630,41 +7641,6 @@ fr_worker_pickup_outside_network(struct worker* worker)
 	}
 }

-#ifdef USE_DNSTAP
-/** Fast reload, the worker picks up changes to DNSTAP configuration. */
-static void
-fr_worker_pickup_dnstap_changes(struct worker* worker)
-{
-	struct dt_env* w_dtenv = &worker->dtenv;
-	struct dt_env* d_dtenv = worker->daemon->dtenv;
-	log_assert(d_dtenv != NULL || !worker->daemon->cfg->dnstap);
-	if(d_dtenv == NULL) {
-		/* There is no environment when DNSTAP was not enabled
-		 * in the configuration. */
-		return;
-	}
-	w_dtenv->identity = d_dtenv->identity;
-	w_dtenv->len_identity = d_dtenv->len_identity;
-	w_dtenv->version = d_dtenv->version;
-	w_dtenv->len_version = d_dtenv->len_version;
-	w_dtenv->log_resolver_query_messages =
-		d_dtenv->log_resolver_query_messages;
-	w_dtenv->log_resolver_response_messages =
-		d_dtenv->log_resolver_response_messages;
-	w_dtenv->log_client_query_messages =
-		d_dtenv->log_client_query_messages;
-	w_dtenv->log_client_response_messages =
-		d_dtenv->log_client_response_messages;
-	w_dtenv->log_forwarder_query_messages =
-		d_dtenv->log_forwarder_query_messages;
-	w_dtenv->log_forwarder_response_messages =
-		d_dtenv->log_forwarder_response_messages;
-	lock_basic_lock(&d_dtenv->sample_lock);
-	w_dtenv->sample_rate = d_dtenv->sample_rate;
-	lock_basic_unlock(&d_dtenv->sample_lock);
-}
-#endif /* USE_DNSTAP */
-
 void
 fast_reload_worker_pickup_changes(struct worker* worker)
 {
@@ -7693,9 +7669,6 @@ fast_reload_worker_pickup_changes(struct worker* worker)
 	worker->env.cachedb_enabled = worker->daemon->env->cachedb_enabled;
 #endif
 	fr_worker_pickup_outside_network(worker);
-#ifdef USE_DNSTAP
-	fr_worker_pickup_dnstap_changes(worker);
-#endif
 }

 /** fast reload thread, handle reload_stop notification, send reload stop
@@ -206,12 +206,6 @@ struct fast_reload_thread {
 	int commpair[2];
 	/** thread id, of the io thread */
 	ub_thread_type tid;
-#ifdef HAVE_GETTID
-	/** thread tid, the LWP id */
-	pid_t thread_tid;
-	/** if logging should include the LWP id */
-	int thread_tid_log;
-#endif
 	/** if the io processing has started */
 	int started;
 	/** if the thread has to quit */
@@ -262,7 +262,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 	s->svr = worker->stats;
 	s->mesh_num_states = (long long)worker->env.mesh->all.count;
 	s->mesh_num_reply_states = (long long)worker->env.mesh->num_reply_states;
-	s->mesh_num_reply_addrs = (long long)worker->env.mesh->num_reply_addrs;
 	s->mesh_jostled = (long long)worker->env.mesh->stats_jostled;
 	s->mesh_dropped = (long long)worker->env.mesh->stats_dropped;
 	s->mesh_replies_sent = (long long)worker->env.mesh->replies_sent;
@@ -285,8 +284,6 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset)
 		NUM_BUCKETS_HIST);
 	s->svr.num_queries_discard_timeout +=
 		(long long)worker->env.mesh->num_queries_discard_timeout;
-	s->svr.num_queries_replyaddr_limit +=
-		(long long)worker->env.mesh->num_queries_replyaddr_limit;
 	s->svr.num_queries_wait_limit +=
 		(long long)worker->env.mesh->num_queries_wait_limit;
 	s->svr.num_dns_error_reports +=
@@ -451,8 +448,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)
 	total->svr.num_queries_cookie_invalid += a->svr.num_queries_cookie_invalid;
 	total->svr.num_queries_discard_timeout +=
 		a->svr.num_queries_discard_timeout;
-	total->svr.num_queries_replyaddr_limit +=
-		a->svr.num_queries_replyaddr_limit;
 	total->svr.num_queries_wait_limit += a->svr.num_queries_wait_limit;
 	total->svr.num_dns_error_reports += a->svr.num_dns_error_reports;
 	total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache;
@@ -524,7 +519,6 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a)

 	total->mesh_num_states += a->mesh_num_states;
 	total->mesh_num_reply_states += a->mesh_num_reply_states;
-	total->mesh_num_reply_addrs += a->mesh_num_reply_addrs;
 	total->mesh_jostled += a->mesh_jostled;
 	total->mesh_dropped += a->mesh_dropped;
 	total->mesh_replies_sent += a->mesh_replies_sent;
@@ -67,6 +67,7 @@
 #include "util/data/dname.h"
 #include "util/fptr_wlist.h"
 #include "util/proxy_protocol.h"
+#include "util/tsig.h"
 #include "util/tube.h"
 #include "util/edns.h"
 #include "util/timeval_func.h"
@@ -1157,35 +1158,54 @@ answer_notify(struct worker* w, struct query_info* qinfo,
 	int rcode = LDNS_RCODE_NOERROR;
 	uint32_t serial = 0;
 	int has_serial;
+	struct tsig_data* tsig = NULL;
+	int tsig_rcode = 0;
 	if(!w->env.auth_zones) return;
 	has_serial = auth_zone_parse_notify_serial(pkt, &serial);
 	if(auth_zones_notify(w->env.auth_zones, &w->env, qinfo->qname,
-		qinfo->qname_len, qinfo->qclass, addr,
-		addrlen, has_serial, serial, &refused)) {
+		qinfo->qname_len, qinfo->qclass, addr, addrlen, has_serial,
+		serial, &refused, pkt, &tsig, &tsig_rcode, w->scratchpad)) {
 		rcode = LDNS_RCODE_NOERROR;
 	} else {
-		if(refused)
+		if(tsig_rcode != 0) {
+			rcode = tsig_rcode;
+		} else if(refused) {
 			rcode = LDNS_RCODE_REFUSED;
-		else	rcode = LDNS_RCODE_SERVFAIL;
+		} else {
+			rcode = LDNS_RCODE_SERVFAIL;
+		}
 	}

 	if(verbosity >= VERB_DETAIL) {
-		char buf[380];
-		char zname[LDNS_MAX_DOMAINLEN];
-		char sr[25];
+		char buf[380+LDNS_MAX_DOMAINLEN];
+		char zname[LDNS_MAX_DOMAINLEN], tsigkey[LDNS_MAX_DOMAINLEN];
+		char sr[25], rcode_str[32], tsigtxt[16];;
 		dname_str(qinfo->qname, zname);
+		tsigkey[0]=0;
+		tsigtxt[0]=0;
+		if(tsig && tsig->key_name) {
+			snprintf(tsigtxt, sizeof(tsigtxt), " with TSIG ");
+			dname_str(tsig->key_name, tsigkey);
+		}
 		sr[0]=0;
 		if(has_serial)
 			snprintf(sr, sizeof(sr), "serial %u ",
 				(unsigned)serial);
-		if(rcode == LDNS_RCODE_REFUSED)
+		if(rcode == LDNS_RCODE_REFUSED) {
 			snprintf(buf, sizeof(buf),
-				"refused NOTIFY %sfor %s from", sr, zname);
-		else if(rcode == LDNS_RCODE_SERVFAIL)
+				"refused NOTIFY %sfor %s%s%s from", sr, zname,
+				tsigtxt, tsigkey);
+		} else if(rcode != LDNS_RCODE_NOERROR) {
+			sldns_wire2str_rcode_buf(rcode, rcode_str,
+				sizeof(rcode_str));
 			snprintf(buf, sizeof(buf),
-				"servfail for NOTIFY %sfor %s from", sr, zname);
-		else	snprintf(buf, sizeof(buf),
-				"received NOTIFY %sfor %s from", sr, zname);
+				"%s for NOTIFY %sfor %s%s%s from",
+				rcode_str, sr, zname, tsigtxt, tsigkey);
+		} else {
+			snprintf(buf, sizeof(buf),
+				"received NOTIFY %sfor %s%s%s from", sr, zname,
+					tsigtxt, tsigkey);
+		}
 		log_addr(VERB_DETAIL, buf, addr, addrlen);
 	}
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
@@ -1196,6 +1216,24 @@ answer_notify(struct worker* w, struct query_info* qinfo,
 		*(uint16_t*)(void *)sldns_buffer_begin(pkt),
 		sldns_buffer_read_u16_at(pkt, 2), edns);
 	LDNS_OPCODE_SET(sldns_buffer_begin(pkt), LDNS_PACKET_NOTIFY);
+	if(tsig) {
+		size_t pos = sldns_buffer_limit(pkt);
+		sldns_buffer_clear(pkt);
+		sldns_buffer_set_position(pkt, pos);
+		if(!tsig_sign_reply(tsig, pkt, w->env.tsig_key_table,
+			(uint64_t)*w->env.now)) {
+			/* Failed to TSIG sign the reply */
+			verbose(VERB_ALGO, "Failed to TSIG sign notify reply");
+			error_encode(pkt, LDNS_RCODE_SERVFAIL, qinfo,
+				*(uint16_t*)(void *)sldns_buffer_begin(pkt),
+				sldns_buffer_read_u16_at(pkt, 2), edns);
+			LDNS_OPCODE_SET(sldns_buffer_begin(pkt), LDNS_PACKET_NOTIFY);
+		} else {
+			/* Flip to delimit buffer after tsig_sign_reply. */
+			sldns_buffer_flip(pkt);
+		}
+		/* The tsig veriable is allocated in the scratch region. */
+	}
 }

 static int
@@ -1444,24 +1482,6 @@ check_ip_ratelimit(struct worker* worker, struct sockaddr_storage* addr,
 	return 1;
 }

-/*
- * This is the callback function when a request arrives. It is passed
- * the packet and user argument. Return true to send a reply.
- * This is of type comm_point_callback_type. The struct comm_point contains
- * more comments on the comm_point.callback member about the function.
- * @param c: the comm_point where the request arrives on.
- * @param arg: the user argument for the callback, the worker.
- * @param error: This can be NETEVENT_NOERROR, NETEVENT_TIMEOUT,
- *	NETEVENT_CLOSED or other comm point callback error values.
- * @param repinfo: The reply info, use it to send a reply. If the reply
- *	is immediate, return 1. If the reply is later on return 0 and save
- *	the repinfo, to call comm_point_send_reply on.
- * @return 1 to sent a reply straight away, for like cache response so that
- *	no allocation needs to be done. And only internal preallocated buffers
- *	are used. Return 0 and save the repinfo to reply later, for responses
- *	that need to be looked up. Return 0 and call comm_point_drop_reply on
- *	the repinfo to drop the response.
- */
 int
 worker_handle_request(struct comm_point* c, void* arg, int error,
 	struct comm_reply* repinfo)
@@ -2202,6 +2222,9 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	struct dt_env* dtenv = &worker->dtenv;
 #else
 	void* dtenv = NULL;
+#endif
+#ifdef HAVE_GETTID
+	worker->thread_tid = gettid();
 #endif
 	worker->need_to_exit = 0;
 	worker->base = comm_base_create(do_sigs);
@@ -366,23 +366,22 @@ static int
 dns64_apply_cfg(struct dns64_env* dns64_env, struct config_file* cfg)
 {
    struct config_strlist* s;
-    const char* dns64_prefix = cfg->dns64_prefix ?
-	cfg->dns64_prefix : DEFAULT_DNS64_PREFIX;
-    verbose(VERB_ALGO, "dns64-prefix: %s", dns64_prefix);
-    if (!netblockstrtoaddr(dns64_prefix, 0, &dns64_env->prefix_addr,
+    verbose(VERB_ALGO, "dns64-prefix: %s", cfg->dns64_prefix);
+    if (!netblockstrtoaddr(cfg->dns64_prefix ? cfg->dns64_prefix :
+                DEFAULT_DNS64_PREFIX, 0, &dns64_env->prefix_addr,
                &dns64_env->prefix_addrlen, &dns64_env->prefix_net)) {
-        log_err("cannot parse dns64-prefix netblock: %s", dns64_prefix);
+        log_err("cannot parse dns64-prefix netblock: %s", cfg->dns64_prefix);
        return 0;
    }
    if (!addr_is_ip6(&dns64_env->prefix_addr, dns64_env->prefix_addrlen)) {
-        log_err("dns64_prefix is not IPv6: %s", dns64_prefix);
+        log_err("dns64_prefix is not IPv6: %s", cfg->dns64_prefix);
        return 0;
    }
    if (dns64_env->prefix_net != 32 && dns64_env->prefix_net != 40 &&
            dns64_env->prefix_net != 48 && dns64_env->prefix_net != 56 &&
            dns64_env->prefix_net != 64 && dns64_env->prefix_net != 96 ) {
-        log_err("dns64-prefix length is not 32, 40, 48, 56, 64 or 96: %s",
-                dns64_prefix);
+        log_err("dns64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
+                cfg->dns64_prefix);
        return 0;
    }
    for(s = cfg->dns64_ignore_aaaa; s; s = s->next) {
@@ -448,9 +448,6 @@ int dt_io_thread_apply_cfg(struct dt_io_thread* dtio, struct config_file *cfg)
 		dtio->tls_use_sni = cfg->tls_use_sni;
 #endif /* HAVE_SSL */
 	}
-#ifdef HAVE_GETTID
-	dtio->thread_tid_log = cfg->log_thread_id;
-#endif
 	return 1;
 }

@@ -2133,14 +2130,7 @@ static void* dnstap_io(void* arg)
 	struct dt_io_thread* dtio = (struct dt_io_thread*)arg;
 	time_t secs = 0;
 	struct timeval now;
-
-#if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
-	dtio->thread_tid = gettid();
-	if(dtio->thread_tid_log)
-		log_thread_set(&dtio->thread_tid);
-	else
-#endif
-		log_thread_set(&dtio->threadnum);
+	log_thread_set(&dtio->threadnum);

 	/* setup */
 	verbose(VERB_ALGO, "start dnstap io thread");
@@ -131,12 +131,6 @@ struct dt_io_thread {
 	struct dt_io_list_item* io_list_iter;
 	/** thread id, of the io thread */
 	ub_thread_type tid;
-#ifdef HAVE_GETTID
-	/** thread tid, the LWP id */
-	pid_t thread_tid;
-	/** if logging should include the LWP id */
-	int thread_tid_log;
-#endif
 	/** if the io processing has started */
 	int started;
 	/** ssl context for the io thread, for tls connections. type SSL_CTX* */
@@ -1,166 +1,3 @@
-27 January 2026: Wouter
-	- Add test for allow-notify with a host name.
-
-26 January 2026: Wouter
-	- Fix that allow-notify entries with hostnames are copied after IPv4
-	  and IPv6 lookup.
-	- Fix to not skip allow-notify hostname lookups when there are only
-	  urls.
-
-23 January 2026: Yorgos
-	- Merge #1396: Log Linux thread ID.
-	- On Linux systems log the system-wide unique thread ID instead of
-	  Unbound's internal thread counter.
-	- Introduce the 'log-thread-id' configuration option to manage logging
-	  the system-wide Linux thread ID for easier debugging with system
-	  tools.
-	- Update generated man pages.
-
-22 January 2026: Wouter
-	- Fix that fast reload copies the iter_scrub_ns, iter_scrub_cname
-	  and max_global_quota options.
-	- Fix http test tool petal to not print errors when there is no
-	  error.
-
-21 January 2026: Wouter
-	- Merge #1388: QNX Porting support for unbound.
-
-19 January 2026: Wouter
-	- Merge #1392: Include "V" (version) option in synopsis.
-
-15 January 2026: Wouter
-	- Fix documentation for requestlist.overwritten and
-	  requestlist.exceeded, it explains which query was dropped.
-
-8 January 2026: Wouter
-	- Merge #1381: Do not initialize quic_table unless it is enabled.
-
-6 January 2026: Wouter
-	- Fix edns subnet, that scope zero queries, when there is a
-	  subquery without subnet, and the forward-no-cache or
-	  stub-no-cache option is set, it is not stored in cache due to
-	  the forward or stub option.
-
-6 January 2026: Yorgos
-	- Merge #1391 from Götz Görisch: Fix documentation to adhere to
-	  RFC5952.
-
-31 December 2025: Yorgos
-	- Update the unbound-anchor man page to note write permissions of the
-	  generated file if it is to be used with Unbound's
-	  auto-trust-anchor-file option.
-	- Use the same EDE removal logic when encoding errors as when encoding
-	  replies.
-
-30 December 2025: Yorgos
-	- Mark "THROWAWAY" and "(DNSSEC) LAME" responses clearly as Unbound's
-	  categorization in the log output.
-
-24 December 2025: Yorgos
-	- More specific wording in the unbound.conf man page for stub-first
-	  and forward-first options.
-
-3 December 2025: Wouter
-	- Fix http2 drop handling to clear the postpone_drop state so that
-	  other streams on the http2 session are not affected by a drop,
-	  and can clean up properly if also dropped. Fix http2 send reply
-	  so that when there is a send failure is does not recurse into
-	  the mesh functions and also does not drop the connection due to
-	  the condition of one stream.
-
-2 December 2025: Wouter
-	- Fix to remove http2 stream mesh state when mesh new request is
-	  dropping the new request.
-
-1 December 2025: Wouter
-	- Fix to add EDNS CO flag to testbound and debug message log.
-	- Fix header comment about EDE reference in validator/val_sigcrypt.h.
-
-28 November 2025: Yorgos
-	- For #1375, there is no DNSTAP environment if it wasn't configured.
-
-26 November 2025: Yorgos
-	- Tag for 1.24.2 release.
-	  The repository continues with version 1.24.3.
-
-13 November 2025: Wouter
-	- Merge #1374: Mesh reply counters.
-	  This adds the statistics num.queries.replyaddr_limit and
-	  requestlist.current.replies.
-	- Merge #1375: Copy DNSTAP changes from daemon to workers after
-	  fast_reload.
-
-12 November 2025: Wouter
-	- Fix that when discard timeout drops packet, they are accounted as
-	  less reply addresses in use in the mesh area.
-	- iana portlist updated.
-
-6 November 2025: Wouter
-	- Fix add comment to worker_handle_request function that explain it.
-	- Fix configure test for noreturn attribute so it compiles without
-	  warning.
-	- Fix configure test for nonstring attribute so that it does not
-	  accept when the compiler prints a warning about an unknown
-	  attribute.
-
-4 November 2025: Wouter
-	- Fix dns64 log output to log the default instead of a null string.
-
-1 November 2025: Yorgos
-	- Fix #1366: Infra cache does not work correctly for NAT64, by
-	  moving the NAT64 synthesis from the iterator when selecting a target
-	  address, to the delegation point itself when adding target
-	  addresses.
-
-27 October 2025: Yorgos
-	- Merge #1331 from Jitka Plesníková: Replace deprecated $function by
-	  new $action, for SWIG.
-	- Fix #1165, document the possible circular dependency when using
-	  host names instead of IP addresses for name servers in stub/forward
-	  zones and log a warning when spotted in the configuration.
-
-24 October 2025: Yorgos
-	- unbound.conf man page updates to include a preview of the section
-	  clauses and some reformatting around the use of "clause", "option"
-	  and "attributes". Based on Havard Eidnes' suggestions on the
-	  mailing list.
-	- Fix unused attribute warning in redis.c when threads are not
-	  supported.
-	- For #1364, use OPENSSL_VERSION_TEXT instead of OPENSSL_VERSION_NUMBER
-	  for part of the configure script. OPENSSL_VERSION_TEXT is more
-	  consistent across versions.
-
-22 October 2025: Yorgos
-	- Tag for 1.24.1 release.
-	  The repository continues with version 1.24.2.
-
-15 October 2025: Wouter
-	- Fix to drop UDP for discard-timeout, but not stream connections.
-	- Fix to reply with SERVFAIL when the wait-limit is exceeded.
-	- Add extended dns error code for invalid query type to definition
-	  list.
-	- Fix unbound.conf man page entry for root-hints to say it can
-	  be used without strongly recommending it.
-	- Remove iPhone armv7s, and iPhoneSimulator i386 from ios ci.
-	  The lib system does not provide symbols for it on the new macos
-	  runner.
-	- Fix to exclude libssp for windows compiles.
-
-10 October 2025: Wouter
-	- Fix #1358 Enabling FIPS in OpenSSL causes unit test to fail.
-
-3 October 2025: Yorgos
-	- Note 'respip' and 'dns64' module order in the unbound.conf
-	  man page.
-	- Note clearly that 'wait-limit: 0' disables all wait limits.
-	- 'wait-limit-cookie: 0' can now disable cookie validated wait
-	  limits.
-
-2 October 2025: Wouter
-	- Fix that https is set up as enabled when the port is listed in
-	  interface-automatic-ports. Also for the set up of quic it is
-	  enabled when listed there.
-
 30 September 2025: Wouter
 	- Fix for #1344: Fix that respip and dns64 can be enabled at the
 	  same time, the client info is copied for attach_sub and add_sub
@@ -13,7 +13,7 @@ If you're not using DNSSEC then you may remove "validator".

 2. The "dns64-prefix" directive indicates your DNS64 prefix. For example:

-    dns64-prefix: 64:ff9b::/96
+    dns64-prefix: 64:FF9B::/96

 The prefix must be a /96 or shorter.

@@ -42,9 +42,9 @@ To enable NAT64 in Unbound, add to unbound.conf's "server" section:
    do-nat64: yes

 The NAT64 prefix defaults to the DNS64 prefix, which in turn defaults to the
-standard 64:ff9b::/96 prefix.  You can reconfigure it with:
+standard 64:FF9B::/96 prefix.  You can reconfigure it with:

-    nat64-prefix: 64:ff9b::/96
+    nat64-prefix: 64:FF9B::/96

 To test NAT64 operation, pick a domain that only has IPv4 reachability for its
 nameservers and try resolving any names in that domain.
@@ -54,7 +54,7 @@ server:
 	# interface: 192.0.2.153
 	# interface: 192.0.2.154
 	# interface: 192.0.2.154@5003
-	# interface: 2001:db8::5
+	# interface: 2001:DB8::5
 	# interface: eth0@5003

 	# enable this feature to copy the source address of queries to reply.
@@ -72,12 +72,12 @@ server:
 	# server from by ip-address. If none, the default (all) interface
 	# is used. Specify every interface on a 'outgoing-interface:' line.
 	# outgoing-interface: 192.0.2.153
-	# outgoing-interface: 2001:db8::5
-	# outgoing-interface: 2001:db8::6
+	# outgoing-interface: 2001:DB8::5
+	# outgoing-interface: 2001:DB8::6

 	# Specify a netblock to use remainder 64 bits as random bits for
 	# upstream queries.  Uses freebind option (Linux).
-	# outgoing-interface: 2001:db8::/64
+	# outgoing-interface: 2001:DB8::/64
 	# Also (Linux:) ip -6 addr add 2001:db8::/64 dev lo
 	# And: ip -6 route add local 2001:db8::/64 dev lo
 	# And set prefer-ip6: yes to use the ip6 randomness from a netblock.
@@ -196,10 +196,6 @@ server:
 	# Limit on upstream queries for an incoming query and its recursion.
 	# max-global-quota: 200

-	# Should the scrubber remove promiscuous NS from positive answers,
-	# protects against poison attempts.
-	# iter-scrub-promiscuous: yes
-
 	# msec for waiting for an unknown server to reply.  Increase if you
 	# are behind a slow satellite link, to eg. 1128.
 	# unknown-server-time-limit: 376
@@ -379,7 +375,7 @@ server:
 	# interface-action: 192.0.2.153 allow
 	# interface-action: 192.0.2.154 allow
 	# interface-action: 192.0.2.154@5003 allow
-	# interface-action: 2001:db8::5 allow
+	# interface-action: 2001:DB8::5 allow
 	# interface-action: eth0@5003 allow

 	# Similar to 'access-control-tag:' but for interfaces.
@@ -496,10 +492,6 @@ server:
 	# print log lines that say why queries return SERVFAIL to clients.
 	# log-servfail: no

-	# log system-wide Linux thread ID, insted of Unbound's internal thread
-	# counter. Only on Linux and only when threads are available.
-	# log-thread-id: no
-
 	# the pid file. Can be an absolute path outside of chroot/work dir.
 	# pidfile: "@UNBOUND_PIDFILE@"

@@ -930,22 +922,6 @@ server:
 	# add a netblock specific override to a localzone, with zone type
 	# local-zone-override: "example.com" 192.0.2.0/24 refuse

-	# Action to apply when the IP address in an AAAA or A RR in the answer
-	# section of a response matches the specified IP netblock.
-	# Requires use of the respip module.
-	# response-ip: 192.0.2.0/24 redirect
-
-	# Redirect as specified by the "resource record string" when the IP
-	# address in an AAAA or A RR in the answer section of a response
-	# matches the specified IP netblock.
-	# Requires use of the respip module.
-	# response-ip-data: 192.0.2.0/24 "example. A 192.0.2.1"
-
-	# Apply tag(s) when the IP address in an AAAA or A RR in the answer
-	# section of a response matches the specified IP netblock.
-	# Requires use of the respip module.
-	# response-ip-tag: 192.0.2.0/24 "tag1 tag2"
-
 	# service clients over TLS (on the TCP sockets) with plain DNS inside
 	# the TLS stream, and over HTTPS using HTTP/2 as specified in RFC8484.
 	# Give the certificate to use and private key.
@@ -1259,7 +1235,8 @@ remote-control:
 # authoritatively.  zonefile: reads from file (and writes to it if you also
 # download it), primary: fetches with AXFR and IXFR, or url to zonefile.
 # With allow-notify: you can give additional (apart from primaries and urls)
-# sources of notifies.
+# sources of notifies. primary-tsig: and allow-notify-tsig: use addr keyname,
+# with the name of the TSIG key to use, declared as a tsig-key:.
 # auth-zone:
 #	name: "."
 #	primary: 170.247.170.2        # b.root-servers.net
@@ -1290,11 +1267,10 @@ remote-control:
 #	zonefile: "example.org.zone"

 # Views
-# Create named views. Name must be unique.
-# Map views to requests using the access-control-view/interface-view options.
-# Views can contain zero or more local-zone and local-data options.
-# Options from matching views will override global options.
-# Global options will be used if no matching view is found.
+# Create named views. Name must be unique. Map views to requests using
+# the access-control-view option. Views can contain zero or more local-zone
+# and local-data options. Options from matching views will override global
+# options. Global options will be used if no matching view is found.
 # With view-first yes, it will try to answer using the global local-zone and
 # local-data elements if there is no view specific match.
 # view:
@@ -1302,8 +1278,6 @@ remote-control:
 #	local-zone: "example.com" redirect
 #	local-data: "example.com A 192.0.2.3"
 #	local-data-ptr: "192.0.2.3 www.example.com"
-#	response-ip: 192.0.2.0/24 redirect
-#	response-ip-data: 192.0.2.0/24 "example. A 192.0.2.1"
 #	view-first: no
 # view:
 #	name: "anotherview"
@@ -1441,6 +1415,7 @@ remote-control:
 # and drop.  Policies can be loaded from a file, or using zone
 # transfer, or using HTTP. The respip module needs to be added
 # to the module-config, e.g.: module-config: "respip validator iterator".
+# Can also use primary-tsig: and allow-notify-tsig:
 # rpz:
 #     name: "rpz.example.com"
 #     zonefile: "rpz.example.com"
@@ -1454,3 +1429,14 @@ remote-control:
 #     rpz-signal-nxdomain-ra: no
 #     for-downstream: no
 #     tags: "example"
+
+# TSIG keys
+# tsig-key:
+#	# The key name is sent to the other party, it must be the same
+#	name: "keyname"
+#	# algorithm hmac-md5, or sha1, sha256, sha224, sha384, sha512
+#	algorithm: sha256
+#	# secret material, must be the same as the other party uses.
+#	# base64 encoded random number.
+#	# e.g. from dd if=/dev/random of=/dev/stdout count=1 bs=32 | base64
+#       secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
@@ -416,6 +416,6 @@ on a function return with file read failure.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -39,17 +39,9 @@ unbound-anchor \- Unbound @version@ anchor utility.
 validation.
 The program fetches the trust anchor with the method from \fI\%RFC 7958\fP when
 regular \fI\%RFC 5011\fP update fails to bring it up to date.
-It can be run from the commandline, or run as part of startup scripts before
-you start the \fI\%unbound(8)\fP DNS server.
-.sp
-Note that if you want to use \fI\%RFC 5011\fP with Unbound (i.e., the
-\fI\%auto\-trust\-anchor\-file\fP option) so
-that trust anchor information is automatically tracked by Unbound during
-operation, the user that Unbound runs under (by default \(aqunbound\(aq) must have
-write permissions to the file and the directory the file lives in (for creating
-temporary files).
-In this case you would probably want to run this program as the designated
-Unbound user.
+It can be run (as root) from the commandline, or run as part of startup
+scripts.
+Before you start the \fI\%unbound(8)\fP DNS server.
 .sp
 Suggested usage:
 .INDENT 0.0
@@ -60,7 +52,6 @@ Suggested usage:
 # in the init scripts.
 # provide or update the root anchor (if necessary)
 unbound\-anchor \-a \(dq@UNBOUND_ROOTKEY_FILE@\(dq
-
 # Please note usage of this root anchor is at your own risk
 # and under the terms of our LICENSE (see source).
 #
@@ -304,6 +295,6 @@ Signature on the root key information.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -51,17 +51,9 @@ Description
 validation.
 The program fetches the trust anchor with the method from :rfc:`7958` when
 regular :rfc:`5011` update fails to bring it up to date.
-It can be run from the commandline, or run as part of startup scripts before
-you start the :doc:`unbound(8)</manpages/unbound>` DNS server.
-
-Note that if you want to use :rfc:`5011` with Unbound (i.e., the
-:ref:`auto-trust-anchor-file<unbound.conf.auto-trust-anchor-file>` option) so
-that trust anchor information is automatically tracked by Unbound during
-operation, the user that Unbound runs under (by default 'unbound') must have
-write permissions to the file and the directory the file lives in (for creating
-temporary files).
-In this case you would probably want to run this program as the designated
-Unbound user.
+It can be run (as root) from the commandline, or run as part of startup
+scripts.
+Before you start the :doc:`unbound(8)</manpages/unbound>` DNS server.

 Suggested usage:

@@ -70,7 +62,6 @@ Suggested usage:
   # in the init scripts.
   # provide or update the root anchor (if necessary)
   unbound-anchor -a "@UNBOUND_ROOTKEY_FILE@"
-
   # Please note usage of this root anchor is at your own risk
   # and under the terms of our LICENSE (see source).
   #
@@ -88,6 +88,6 @@ Unbound configuration file.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -167,7 +167,6 @@ ipset,
 \fI\%tcp\-reuse\-timeout\fP,
 \fI\%tcp\-auth\-query\-timeout\fP,
 \fI\%delay\-close\fP\&.
-\fI\%iter\-scrub\-promiscuous\fP\&.
 .sp
 It does not work with
 \fI\%interface\fP and
@@ -880,11 +879,6 @@ number of queries removed due to discard\-timeout by thread
 .UNINDENT
 .INDENT 0.0
 .TP
-.B threadX.num.queries_replyaddr_limit 
-number of queries removed due to replyaddr limits by thread
-.UNINDENT
-.INDENT 0.0
-.TP
 .B threadX.num.queries_wait_limit 
 number of queries removed due to wait\-limit by thread
 .UNINDENT
@@ -978,10 +972,6 @@ Number of requests in the request list that were overwritten by newer
 entries.
 This happens if there is a flood of queries that recursive processing and
 the server has a hard time.
-The counter is increased when during the flood the
-\fI\%jostle\-timeout\fP
-allows a query to be removed in favor of a new incoming query.
-The older query is then dropped to make space.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -989,12 +979,6 @@ The older query is then dropped to make space.
 Queries that were dropped because the request list was full.
 This happens if a flood of queries need recursive processing, and the
 server can not keep up.
-The counter is increased when during the flood there is no space
-to be made with the jostle out of an older query, and the new query
-is dropped.
-Since no older queries are removed, see
-\fI\%jostle\-timeout\fP setting, there
-is no space for the new query.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -1009,13 +993,6 @@ Current size of the request list, only the requests from client queries.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B threadX.requestlist.current.replies 
-Current count of the number of reply entries waiting on request list
-entries. Because a request list entry can send results to multiple reply
-addresses, this number may be larger than the size of the request list.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B threadX.recursion.time.avg 
 Average time it took to answer queries that needed recursive processing.
 Note that queries that were answered from the cache are not in this average.
@@ -1070,11 +1047,6 @@ summed over threads.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B total.num.queries_replyaddr_limit 
-summed over threads.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B total.num.queries_wait_limit 
 summed over threads.
 .UNINDENT
@@ -1165,16 +1137,6 @@ summed over threads.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B total.requestlist.current.user 
-summed over threads.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B total.requestlist.current.replies 
-summed over threads.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B total.recursion.time.median 
 averaged over threads.
 .UNINDENT
@@ -1580,6 +1542,6 @@ directory with private keys (\fBunbound_server.key\fP and
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -150,6 +150,7 @@ There are several commands that the server understands.
    :ref:`trusted-keys-file<unbound.conf.trusted-keys-file>`,
    :ref:`auto-trust-anchor-file<unbound.conf.auto-trust-anchor-file>`,
    :ref:`edns-client-string<unbound.conf.edns-client-string>`,
+    :ref:`tsig-key<unbound.conf.tsig-key>`,
    ipset,
    :ref:`log-identity<unbound.conf.log-identity>`,
    :ref:`infra-cache-numhosts<unbound.conf.infra-cache-numhosts>`,
@@ -169,7 +170,6 @@ There are several commands that the server understands.
    :ref:`tcp-reuse-timeout<unbound.conf.tcp-reuse-timeout>`,
    :ref:`tcp-auth-query-timeout<unbound.conf.tcp-auth-query-timeout>`,
    :ref:`delay-close<unbound.conf.delay-close>`.
-    :ref:`iter-scrub-promiscuous<unbound.conf.iter-scrub-promiscuous>`.

    It does not work with
    :ref:`interface<unbound.conf.interface>` and
@@ -815,10 +815,6 @@ number of statistic counters:
    number of queries removed due to discard-timeout by thread


-@@UAHL@unbound-control.stats@threadX.num.queries_replyaddr_limit@@
-    number of queries removed due to replyaddr limits by thread
-
-
@@UAHL@unbound-control.stats@threadX.num.queries_wait_limit@@
    number of queries removed due to wait-limit by thread

@@ -897,22 +893,12 @@ number of statistic counters:
    entries.
    This happens if there is a flood of queries that recursive processing and
    the server has a hard time.
-    The counter is increased when during the flood the
-    :ref:`jostle-timeout<unbound.conf.jostle-timeout>`
-    allows a query to be removed in favor of a new incoming query.
-    The older query is then dropped to make space.


@@UAHL@unbound-control.stats@threadX.requestlist.exceeded@@
    Queries that were dropped because the request list was full.
    This happens if a flood of queries need recursive processing, and the
    server can not keep up.
-    The counter is increased when during the flood there is no space
-    to be made with the jostle out of an older query, and the new query
-    is dropped.
-    Since no older queries are removed, see
-    :ref:`jostle-timeout<unbound.conf.jostle-timeout>` setting, there
-    is no space for the new query.


@@UAHL@unbound-control.stats@threadX.requestlist.current.all@@
@@ -924,12 +910,6 @@ number of statistic counters:
    Current size of the request list, only the requests from client queries.


-@@UAHL@unbound-control.stats@threadX.requestlist.current.replies@@
-    Current count of the number of reply entries waiting on request list
-    entries. Because a request list entry can send results to multiple reply
-    addresses, this number may be larger than the size of the request list.
-
-
@@UAHL@unbound-control.stats@threadX.recursion.time.avg@@
    Average time it took to answer queries that needed recursive processing.
    Note that queries that were answered from the cache are not in this average.
@@ -975,10 +955,6 @@ number of statistic counters:
    summed over threads.


-@@UAHL@unbound-control.stats@total.num.queries_replyaddr_limit@@
-    summed over threads.
-
-
@@UAHL@unbound-control.stats@total.num.queries_wait_limit@@
    summed over threads.

@@ -1051,14 +1027,6 @@ number of statistic counters:
    summed over threads.


-@@UAHL@unbound-control.stats@total.requestlist.current.user@@
-    summed over threads.
-
-
-@@UAHL@unbound-control.stats@total.requestlist.current.replies@@
-    summed over threads.
-
-
@@UAHL@unbound-control.stats@total.recursion.time.median@@
    averaged over threads.

@@ -185,6 +185,6 @@ encountered a fatal error.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -32,7 +32,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 unbound \- Unbound DNS validating resolver @version@.
 .SH SYNOPSIS
 .sp
-\fBunbound\fP [\fB\-hdpVv\fP] [\fB\-c <cfgfile>\fP]
+\fBunbound\fP [\fB\-hdpv\fP] [\fB\-c <cfgfile>\fP]
 .SH DESCRIPTION
 .sp
 \fBunbound\fP is a caching DNS resolver.
@@ -118,6 +118,6 @@ Show the version number and build options, and exit.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -36,49 +36,44 @@ unbound.conf \- Unbound @version@ configuration file.
 .SH DESCRIPTION
 .sp
 \fBunbound.conf\fP is used to configure \fI\%unbound(8)\fP\&.
+The file format has attributes and values.
+Some attributes have attributes inside them.
+The notation is: \fBattribute: value\fP\&.
+.sp
+Comments start with \fB#\fP and last to the end of line.
+Empty lines are ignored as is whitespace at the beginning of a line.
 .sp
 The utility \fI\%unbound\-checkconf(8)\fP can be
 used to check \fBunbound.conf\fP prior to usage.
-.SH FILE FORMAT
-.sp
-Whitespace is used to separate keywords.
-Whitespace indentation is insignificant, but is still recommended for visual
-clarity.
-Comments start with \fB#\fP and last to the end of line.
-Empty lines are ignored, as is whitespace at the beginning of a line.
-.sp
-Attribute keywords end with a colon (\fB:\fP) and they are either options or
-section clauses (group options together).
-.sp
-The configuration file is logically divided into \fBsections\fP where each section
-is introduced by a \fI\%section clause\fP\&.
 .SH EXAMPLE
 .sp
-An example minimal config file is shown below; most settings are the defaults.
-Copy this to \fB@ub_conf_file@\fP and start the server with:
+An example config file is shown below.
+Copy this to \fB/etc/unbound/unbound.conf\fP and start the server with:
 .INDENT 0.0
 .INDENT 3.5
 .sp
 .nf
 .ft C
-$ unbound \-c @ub_conf_file@
+$ unbound \-c /etc/unbound/unbound.conf
 .ft P
 .fi
 .UNINDENT
 .UNINDENT
 .sp
+Most settings are the defaults.
 Stop the server with:
 .INDENT 0.0
 .INDENT 3.5
 .sp
 .nf
 .ft C
-$ kill \(gacat @UNBOUND_PIDFILE@\(ga
+$ kill \(gacat /etc/unbound/unbound.pid\(ga
 .ft P
 .fi
 .UNINDENT
 .UNINDENT
 .sp
+Below is a minimal config file.
 The source distribution contains an extensive \fBexample.conf\fP file with
 all the options.
 .INDENT 0.0
@@ -88,87 +83,33 @@ all the options.
 .ft C
 # unbound.conf(5) config file for unbound(8).
 server:
-    directory: \(dq@UNBOUND_RUN_DIR@\(dq
+    directory: \(dq/etc/unbound\(dq
    username: unbound
    # make sure unbound can access entropy from inside the chroot.
    # e.g. on linux the use these commands (on BSD, devfs(8) is used):
-    #      mount \-\-bind \-n /dev/urandom @UNBOUND_RUN_DIR@/dev/urandom
-    # and  mount \-\-bind \-n /dev/log @UNBOUND_RUN_DIR@/dev/log
-    chroot: \(dq@UNBOUND_CHROOT_DIR@\(dq
-    # logfile: \(dq@UNBOUND_RUN_DIR@/unbound.log\(dq  #uncomment to use logfile.
-    pidfile: \(dq@UNBOUND_PIDFILE@\(dq
+    #      mount \-\-bind \-n /dev/urandom /etc/unbound/dev/urandom
+    # and  mount \-\-bind \-n /dev/log /etc/unbound/dev/log
+    chroot: \(dq/etc/unbound\(dq
+    # logfile: \(dq/etc/unbound/unbound.log\(dq  #uncomment to use logfile.
+    pidfile: \(dq/etc/unbound/unbound.pid\(dq
    # verbosity: 1      # uncomment and increase to get more logging.
    # listen on all interfaces, answer queries from the local subnet.
    interface: 0.0.0.0
    interface: ::0
    access\-control: 10.0.0.0/8 allow
-    access\-control: 2001:db8::/64 allow
+    access\-control: 2001:DB8::/64 allow
 .ft P
 .fi
 .UNINDENT
 .UNINDENT
-.SH SECTION CLAUSES
+.SH FILE FORMAT
 .sp
-The recognized section clauses are:
-.INDENT 0.0
-.INDENT 3.5
-.INDENT 0.0
-.TP
-.B \fI\%server:\fP
-Most of the configuration is found in this section.
-.TP
-.B \fI\%remote\-control:\fP
-Configuration for the facility used by
-\fI\%unbound\-control(8)\fP\&.
-.TP
-.B \fI\%stub\-zone:\fP
-Configuration for a zone that redirects to specific authoritative name
-servers, e.g. for zones not generally available on the greater
-Internet.
-.TP
-.B \fI\%forward\-zone:\fP
-Configuration for a zone that forwards to specific DNS resolvers.
-.TP
-.B \fI\%auth\-zone:\fP
-Configuration for local authoritative zones.
-.TP
-.B \fI\%view:\fP
-Overriding a small subset of configuration for incoming requests.
-Requests are mapped to views with
-\fI\%access\-control\-view\fP and
-\fI\%interface\-view\fP\&.
-.TP
-.B \fI\%python:\fP
-Configuration for the optional \fBpython\fP script module.
-.TP
-.B \fI\%dynlib:\fP
-Configuration for the optional \fBdynlib\fP module that loads dynamic
-libraries into Unbound.
-.TP
-.B \fI\%dnscrypt:\fP
-Configuration for the optional DNSCrypt feature.
-.TP
-.B \fI\%cachedb:\fP
-Configuration for the optional \fBcachedb\fP module that can interface
-with second level caches, currently Redis or Redis\-complatible
-databases.
-.TP
-.B \fI\%dnstap:\fP
-Configuration of the optional dnstap logging feature; a flexible,
-structured binary log format for DNS software.
-.TP
-.B \fI\%rpz:\fP
-Configuration for Response Policy Zones that allows for DNS filtering.
-Requires the \fBrespip\fP module.
-.UNINDENT
-.UNINDENT
-.UNINDENT
-.sp
-Section clauses can be repeated throughout the file (or included files) to
-logically group options in one visually cohesive group.
-This may be particularly useful for the \fBserver:\fP clause with its myriad of
-options.
-.SH INCLUDING FILES
+There must be whitespace between keywords.
+Attribute keywords end with a colon \fB\(aq:\(aq\fP\&.
+An attribute is followed by a value, or its containing attributes in which case
+it is referred to as a clause.
+Clauses can be repeated throughout the file (or included files) to group
+attributes under the same clause.
 .sp
 Files can be included using the \fBinclude:\fP directive.
 It can appear anywhere, it accepts a single file name as argument.
@@ -183,11 +124,11 @@ Wildcards can be used to include multiple files, see \fIglob(7)\fP\&.
 .sp
 For a more structural include option, the \fBinclude\-toplevel:\fP directive can
 be used.
-This closes whatever section clause is currently active (if any) and forces the
-use of section clauses in the included files and right after this directive.
-.SH SERVER OPTIONS
+This closes whatever clause is currently active (if any) and forces the use of
+clauses in the included files and right after this directive.
+.SS Server Options
 .sp
-These options are part of the \fBserver:\fP section.
+These options are part of the \fBserver:\fP clause.
 .INDENT 0.0
 .TP
 .B verbosity: \fI<number>\fP 
@@ -598,9 +539,6 @@ Default: 376
 The wait time in msec where recursion requests are dropped.
 This is to stop a large number of replies from accumulating.
 They receive no reply, the work item continues to recurse.
-For UDP the replies are dropped, for stream connections the reply
-is not dropped if the stream connection is still open ready to receive
-answers.
 It is nice to be a bit larger than
 \fI\%serve\-expired\-client\-timeout\fP
 if that is enabled.
@@ -616,7 +554,7 @@ The number of replies that can wait for recursion, for an IP address.
 This makes a ratelimit per IP address of waiting replies for recursion.
 It stops very large amounts of queries waiting to be returned to one
 destination.
-The value \fB0\fP disables all wait limits.
+The value \fB0\fP disables wait limits.
 .sp
 Default: 1000
 .UNINDENT
@@ -625,11 +563,7 @@ Default: 1000
 .B wait\-limit\-cookie: \fI<number>\fP 
 The number of replies that can wait for recursion, for an IP address
 that sent the query with a valid DNS Cookie.
-Since the cookie already validates the client address, this option allows
-to override a configured
-\fI\%wait\-limit\fP value usually with a higher one
-for cookie validated queries.
-The value \fB0\fP disables wait limits for cookie validated queries.
+Since the cookie validates the client address, this limit can be higher.
 .sp
 Default: 10000
 .UNINDENT
@@ -1219,8 +1153,8 @@ Default: no
 .INDENT 0.0
 .TP
 .B tls\-system\-cert: \fI<yes or no>\fP 
-This the same as the
-\fI\%tls\-win\-cert\fP option, under a
+This the same attribute as the
+\fI\%tls\-win\-cert\fP attribute, under a
 different name.
 Because it is not windows specific.
 .UNINDENT
@@ -1450,9 +1384,6 @@ The port number on which to provide DNS\-over\-QUIC service.
 Only interfaces configured with that port number as @number get the QUIC
 service.
 The interface uses QUIC for the UDP traffic on that port number.
-If it is set to 0, the server does not init QUIC code, and QUIC is
-disabled.
-This is similar to if QUIC is not in use, but then explicitly.
 .sp
 Default: 853
 .UNINDENT
@@ -1676,8 +1607,8 @@ implicit default \(dqaccess\-control: 127.0.0.0/8 allow\(dq option.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
-options for targeted clients.
+\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
+attributes for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1692,8 +1623,8 @@ for interfaces.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
-options for targeted clients.
+\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
+attributes for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1709,8 +1640,8 @@ but for interfaces.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
-options for targeted clients.
+\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
+attributes for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1726,8 +1657,8 @@ for interfaces.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
-options for targeted clients.
+\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
+attributes for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1742,8 +1673,8 @@ but for interfaces.
 .INDENT 3.5
 The interface needs to be already specified with
 \fI\%interface\fP and that any
-\fBaccess\-control*:\fP option overrides all \fBinterface\-*:\fP
-options for targeted clients.
+\fBaccess\-control*:\fP attribute overrides all \fBinterface\-*:\fP
+attributes for targeted clients.
 .UNINDENT
 .UNINDENT
 .UNINDENT
@@ -1820,7 +1751,7 @@ The logfile is appended to, in the following format:
 .UNINDENT
 .sp
 If this option is given, the \fI\%use\-syslog\fP
-option is internally set to \fBno\fP\&.
+attribute is internally set to \fBno\fP\&.
 .sp
 The logfile is reopened (for append) when the config file is reread, on
 SIGHUP.
@@ -1930,16 +1861,6 @@ Default: no
 .UNINDENT
 .INDENT 0.0
 .TP
-.B log\-thread\-id: \fI<yes or no>\fP 
-(Only on Linux and only when threads are available)
-Logs the system\-wide Linux thread ID instead of Unbound\(aqs internal thread
-counter.
-Can be useful when debugging with system tools.
-.sp
-Default: no
-.UNINDENT
-.INDENT 0.0
-.TP
 .B pidfile: \fI<filename>\fP 
 The process id is written to the file.
 Default is \fB\(dq@UNBOUND_PIDFILE@\(dq\fP\&.
@@ -1978,8 +1899,8 @@ Read the root hints from this file.
 Default is nothing, using builtin hints for the IN class.
 The file has the format of zone files, with root nameserver names and
 addresses only.
-The default may become outdated, when servers change, and then it is
-possible to use a root hints file with specific servers.
+The default may become outdated, when servers change, therefore it is good
+practice to use a root hints file.
 .sp
 Default: \(dq\(dq
 .UNINDENT
@@ -3390,7 +3311,7 @@ zone section below.
 Configure local data shorthand for a PTR record with the reversed IPv4 or
 IPv6 address and the host name.
 For example \fB\(dq192.0.2.4 www.example.com\(dq\fP\&.
-TTL can be inserted like this: \fB\(dq2001:db8::4 7200 www.example.com\(dq\fP
+TTL can be inserted like this: \fB\(dq2001:DB8::4 7200 www.example.com\(dq\fP
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -3447,7 +3368,7 @@ This specifies the action data for
 \fI\%response\-ip\fP with action being to redirect
 as specified by \fI<\(dqresource record string\(dq>\fP\&.
 \fI<\(dqResource record string\(dq>\fP is similar to that of
-\fI\%access\-control\-tag\-data\fP,
+\fI\%access\-control\-tag\-action\fP,
 but it must be of either AAAA, A or CNAME types.
 If the \fI<IP\-netblock>\fP is an IPv6/IPv4 prefix, the record must be AAAA/A
 respectively, unless it is a CNAME (which can be used for both versions of
@@ -3768,15 +3689,6 @@ Default: 200
 .UNINDENT
 .INDENT 0.0
 .TP
-.B iter\-scrub\-promiscuous: \fI<yes or no>\fP 
-Should the iterator scrubber remove promiscuous NS from positive answers.
-This protects against poisonous contents, that could affect names in the
-same zone as a spoofed packet.
-.sp
-Default: yes
-.UNINDENT
-.INDENT 0.0
-.TP
 .B fast\-server\-permil: \fI<number>\fP 
 Specify how many times out of 1000 to pick from the set of fastest servers.
 0 turns the feature off.
@@ -3917,18 +3829,17 @@ enabled to increase privacy on the outgoing reports.
 .sp
 Default: no
 .UNINDENT
-.SH REMOTE CONTROL OPTIONS
-.sp
-These options are part of the \fBremote\-control:\fP section and are the
-declarations for the remote control facility.
+.SS Remote Control Options
 .sp
+In the \fBremote\-control:\fP clause are the declarations for the remote control
+facility.
 If this is enabled, the \fI\%unbound\-control(8)\fP
 utility can be used to send commands to the running Unbound server.
-The server uses these options to setup TLS security for the connection.
-The \fI\%unbound\-control(8)\fP utility also reads
-this \fBremote\-control:\fP section for options.
+The server uses these clauses to setup TLSv1 security for the connection.
+The \fI\%unbound\-control(8)\fP utility also reads the
+\fBremote\-control:\fP section for options.
 To setup the correct self\-signed certificates use the
-\fBunbound\-control\-setup(8)\fP utility.
+\fIunbound\-control\-setup(8)\fP utility.
 .INDENT 0.0
 .TP
 .B control\-enable: \fI<yes or no>\fP 
@@ -4028,11 +3939,9 @@ This file is used by \fI\%unbound\-control(8)\fP\&.
 .sp
 Default: unbound_control.pem
 .UNINDENT
-.SH STUB ZONE OPTIONS
+.SS Stub Zone Options
 .sp
-These options are part of the \fBstub\-zone:\fP section.
-.sp
-There may be multiple \fBstub\-zone:\fP sections.
+There may be multiple \fBstub\-zone:\fP clauses.
 Each with a \fI\%name\fP and zero or more hostnames or
 IP addresses.
 For the stub zone this list of nameservers is used.
@@ -4071,10 +3980,9 @@ Consider adding \fI\%server\fP statements for
 \fI\%domain\-insecure\fP and for
 \fI\%local\-zone: <name> nodefault\fP
 for the zone if it is a locally served zone.
-The \fI\%domain\-insecure\fP option stops DNSSEC
-from invalidating the zone.
+The insecure clause stops DNSSEC from invalidating the zone.
 The \fI\%local\-zone: nodefault\fP (or
-\fI\%transparent\fP) option makes the
+\fI\%transparent\fP) clause makes the
 (reverse\-) zone bypass Unbound\(aqs filtering of \fI\%RFC 1918\fP zones.
 .INDENT 0.0
 .TP
@@ -4088,23 +3996,6 @@ This is the full domain name of the zone.
 Name of stub zone nameserver.
 Is itself resolved before it is used.
 .sp
-\fBCAUTION:\fP
-.INDENT 7.0
-.INDENT 3.5
-If the domain (or a subdomain) from this zone is used as the host, it
-will unavoidably introduce a circular dependency on retrieving the IP
-addresses of the name server.
-In that case, it is suggested to use
-\fI\%stub\-addr\fP instead.
-Alternatively,
-\fI\%stub\-first: yes\fP can also work
-around the circular dependency by trying resolution outside of this
-zone.
-However this has the caveat that it would allow escaping this zone when
-any resolution attempt fails within this zone.
-.UNINDENT
-.UNINDENT
-.sp
 To use a non\-default port for DNS communication append \fB\(aq@\(aq\fP with the
 port number.
 .sp
@@ -4145,12 +4036,9 @@ Default: no
 .INDENT 0.0
 .TP
 .B stub\-first: \fI<yes or no>\fP 
-If enabled, a query is attempted without this stub section if it fails.
+If enabled, a query is attempted without the stub clause if it fails.
 The data could not be retrieved and would have caused SERVFAIL because the
-servers are unreachable, instead it is tried without this stub section.
-This can lead to using less specific configured forward/stub/auth zones if
-any, or end up to otherwise normal recursive resolution for that particular
-query.
+servers are unreachable, instead it is tried without this clause.
 .sp
 Default: no
 .UNINDENT
@@ -4183,11 +4071,9 @@ This is useful when you want immediate changes to be visible.
 .sp
 Default: no
 .UNINDENT
-.SH FORWARD ZONE OPTIONS
+.SS Forward Zone Options
 .sp
-These options are part of the \fBforward\-zone:\fP section.
-.sp
-There may be multiple \fBforward\-zone:\fP sections.
+There may be multiple \fBforward\-zone:\fP clauses.
 Each with a \fI\%name\fP and zero or more hostnames
 or IP addresses.
 For the forward zone this list of nameservers is used to forward the queries
@@ -4218,23 +4104,6 @@ This is the full domain name of the zone.
 Name of server to forward to.
 Is itself resolved before it is used.
 .sp
-\fBCAUTION:\fP
-.INDENT 7.0
-.INDENT 3.5
-If the domain (or a subdomain) from this zone is used as the host, it
-will unavoidably introduce a circular dependency on retrieving the IP
-addresses of the name server.
-In that case, it is suggested to use
-\fI\%forward\-addr\fP instead.
-Alternatively,
-\fI\%forward\-first: yes\fP can also
-work around the circular dependency by trying resolution outside of
-this zone.
-However this has the caveat that it would allow escaping this zone when
-any resolution attempt fails within this zone.
-.UNINDENT
-.UNINDENT
-.sp
 To use a non\-default port for DNS communication append \fB\(aq@\(aq\fP with the
 port number.
 .sp
@@ -4271,11 +4140,9 @@ The cert must also match a CA from the
 .INDENT 0.0
 .TP
 .B forward\-first: \fI<yes or no>\fP 
-If a forwarded query is met with a SERVFAIL error and this option is
-enabled Unbound will fall back to less specific resolution.
-This can lead to using less specific configured forward/stub/auth zones if
-any, or end up to otherwise normal recursive resolution for that particular
-query.
+If a forwarded query is met with a SERVFAIL error, and this option is
+enabled, Unbound will fall back to normal recursive resolution for this
+query as if no query forwarding had been specified.
 .sp
 Default: no
 .UNINDENT
@@ -4313,14 +4180,12 @@ This is useful when you want immediate changes to be visible.
 .sp
 Default: no
 .UNINDENT
-.SH AUTHORITY ZONE OPTIONS
-.sp
-These options are part of the \fBauth\-zone:\fP section.
+.SS Authority Zone Options
 .sp
 Authority zones are configured with \fBauth\-zone:\fP, and each one must have a
 \fI\%name\fP\&.
-There can be multiple ones, by listing multiple \fBauth\-zone\fP section clauses,
-each with a different name, pertaining to that part of the namespace.
+There can be multiple ones, by listing multiple auth\-zone clauses, each with a
+different name, pertaining to that part of the namespace.
 The authority zone with the name closest to the name looked up is used.
 Authority zones can be processed on two distinct, non\-exclusive, configurable
 stages.
@@ -4351,7 +4216,7 @@ consult the local zone data while resolving.
 In this case, the aforementioned CNAME example will result in a thoroughly
 resolved answer.
 .sp
-Authority zones can be read from a zonefile.
+Authority zones can be read from zonefile.
 And can be kept updated via AXFR and IXFR.
 After update the zonefile is rewritten.
 The update mechanism uses the SOA timer values and performs SOA UDP queries to
@@ -4388,15 +4253,9 @@ does not support AXFR/IXFR for the zone, but if you used
 \fI\%url\fP to download the zonefile as a text file
 from a webserver that would work.
 .sp
-\fBCAUTION:\fP
-.INDENT 7.0
-.INDENT 3.5
-If you specify the hostname, you cannot use the domain from the
-zonefile, because it may not have that when retrieving that data,
-instead use a plain IP address to avoid a circular dependency on
-retrieving that IP address.
-.UNINDENT
-.UNINDENT
+If you specify the hostname, you cannot use the domain from the zonefile,
+because it may not have that when retrieving that data, instead use a plain
+IP address to avoid a circular dependency on retrieving that IP address.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -4542,20 +4401,18 @@ If not given then no zonefile is used.
 If the file does not exist or is empty, Unbound will attempt to fetch zone
 data (eg. from the primary servers).
 .UNINDENT
-.SH VIEW OPTIONS
+.SS View Options
 .sp
-These options are part of the \fBview:\fP section.
-.sp
-There may be multiple \fBview:\fP sections.
+There may be multiple \fBview:\fP clauses.
 Each with a \fI\%name\fP and zero or more
 \fI\%local\-zone\fP and
-\fI\%local\-data\fP options.
+\fI\%local\-data\fP attributes.
 Views can also contain \fI\%view\-first\fP,
 \fI\%response\-ip\fP,
 \fI\%response\-ip\-data\fP and
-\fI\%local\-data\-ptr\fP options.
+\fI\%local\-data\-ptr\fP attributes.
 View can be mapped to requests by specifying the view name in an
-\fI\%access\-control\-view\fP option.
+\fI\%access\-control\-view\fP attribute.
 Options from matching views will override global options.
 Global options will be used if no matching view is found, or when the matching
 view does not have the option specified.
@@ -4565,7 +4422,7 @@ view does not have the option specified.
 Name of the view.
 Must be unique.
 This name is used in the
-\fI\%access\-control\-view\fP option.
+\fI\%access\-control\-view\fP attribute.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -4598,22 +4455,6 @@ Has the same behaviour as the global
 .UNINDENT
 .INDENT 0.0
 .TP
-.B response\-ip: \fI<IP\-netblock> <action>\fP 
-This requires use of the \fBrespip\fP module.
-.sp
-Similar to \fI\%response\-ip\fP but
-only applies to this view.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B response\-ip\-data: \fI<IP\-netblock> <\(dqresource record string\(dq>\fP 
-This requires use of the \fBrespip\fP module.
-.sp
-Similar to \fI\%response\-ip\-data\fP but
-only applies to this view.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B view\-first: \fI<yes or no>\fP 
 If enabled, it attempts to use the global
 \fI\%local\-zone\fP and
@@ -4622,11 +4463,9 @@ view specific options.
 .sp
 Default: no
 .UNINDENT
-.SH PYTHON MODULE OPTIONS
+.SS Python Module Options
 .sp
-These options are part of the \fBpython:\fP section.
-.sp
-The \fBpython:\fP section gives the settings for the \fIpython(1)\fP script module.
+The \fBpython:\fP clause gives the settings for the \fIpython(1)\fP script module.
 This module acts like the iterator and validator modules do, on queries and
 answers.
 To enable the script module it has to be compiled into the daemon, and the word
@@ -4649,16 +4488,14 @@ The script file to load.
 Repeat this option for every python module instance added to the
 \fI\%module\-config\fP option.
 .UNINDENT
-.SH DYNAMIC LIBRARY MODULE OPTIONS
+.SS Dynamic Library Module Options
 .sp
-These options are part of the \fBdynlib:\fP section.
-.sp
-The \fBdynlib:\fP section gives the settings for the \fBdynlib\fP module.
+The \fBdynlib:\fP clause gives the settings for the \fBdynlib\fP module.
 This module is only a very small wrapper that allows dynamic modules to be
 loaded on runtime instead of being compiled into the application.
 To enable the dynlib module it has to be compiled into the daemon, and the word
 \fBdynlib\fP has to be put in the
-\fI\%module\-config\fP option.
+\fI\%module\-config\fP attribute.
 Multiple instances of dynamic libraries are supported by adding the word
 \fBdynlib\fP more than once.
 .sp
@@ -4673,9 +4510,7 @@ The dynamic library file to load.
 Repeat this option for every dynlib module instance added to the
 \fI\%module\-config\fP option.
 .UNINDENT
-.SH DNS64 MODULE OPTIONS
-.sp
-These options are part of the \fBserver:\fP section.
+.SS DNS64 Module Options
 .sp
 The \fBdns64\fP module must be configured in the
 \fI\%module\-config\fP directive, e.g.:
@@ -4695,11 +4530,7 @@ and be compiled into the daemon to be enabled.
 \fBNOTE:\fP
 .INDENT 0.0
 .INDENT 3.5
-If combining the \fBrespip\fP and \fBdns64\fP modules, the \fBrespip\fP module
-needs to appear before the \fBdns64\fP module in the
-\fI\%module\-config\fP
-configuration option so that response IP and/or RPZ feeds can properly
-filter responses regardless of DNS64 synthesis.
+These settings go in the \fI\%server:\fP section.
 .UNINDENT
 .UNINDENT
 .INDENT 0.0
@@ -4735,12 +4566,12 @@ Can be entered multiple times, list a new domain for which it applies, one
 per line.
 Applies also to names underneath the name given.
 .UNINDENT
-.SH NAT64 OPTIONS
-.sp
-These options are part of the \fBserver:\fP section.
+.SS NAT64 Operation
 .sp
 NAT64 operation allows using a NAT64 prefix for outbound requests to IPv4\-only
 servers.
+It is controlled by two options in the
+\fI\%server:\fP section:
 .INDENT 0.0
 .TP
 .B do\-nat64: \fI<yes or no>\fP 
@@ -4758,11 +4589,9 @@ The prefix length must be one of /32, /40, /48, /56, /64 or /96.
 .sp
 Default: 64:ff9b::/96 (same as \fI\%dns64\-prefix\fP)
 .UNINDENT
-.SH DNSCRYPT OPTIONS
+.SS DNSCrypt Options
 .sp
-These options are part of the \fBdnscrypt:\fP section.
-.sp
-The \fBdnscrypt:\fP section gives the settings of the dnscrypt channel.
+The \fBdnscrypt:\fP clause gives the settings of the dnscrypt channel.
 While those options are available, they are only meaningful if Unbound was
 compiled with \fB\-\-enable\-dnscrypt\fP\&.
 Currently certificate and secret/public keys cannot be generated by Unbound.
@@ -4892,9 +4721,7 @@ If left unconfigured, it will be configured automatically to be a power of
 .sp
 Default: (unconfigured)
 .UNINDENT
-.SH EDNS CLIENT SUBNET MODULE OPTIONS
-.sp
-These options are part of the \fBserver:\fP section.
+.SS EDNS Client Subnet Module Options
 .sp
 The ECS module must be configured in the
 \fI\%module\-config\fP directive, e.g.:
@@ -4911,6 +4738,13 @@ module\-config: \(dqsubnetcache validator iterator\(dq
 .sp
 and be compiled into the daemon to be enabled.
 .sp
+\fBNOTE:\fP
+.INDENT 0.0
+.INDENT 3.5
+These settings go in the \fI\%server:\fP section.
+.UNINDENT
+.UNINDENT
+.sp
 If the destination address is allowed in the configuration Unbound will add the
 EDNS0 option to the query containing the relevant part of the client\(aqs address.
 When an answer contains the ECS option the response and the option are placed
@@ -5032,9 +4866,7 @@ This number applies for each qname/qclass/qtype tuple.
 .sp
 Default: 100
 .UNINDENT
-.SH OPPORTUNISTIC IPSEC SUPPORT MODULE OPTIONS
-.sp
-These options are part of the \fBserver:\fP section.
+.SS Opportunistic IPsec Support Module Options
 .sp
 The IPsec module must be configured in the
 \fI\%module\-config\fP directive, e.g.:
@@ -5051,6 +4883,13 @@ module\-config: \(dqipsecmod validator iterator\(dq
 .sp
 and be compiled into Unbound by using \fB\-\-enable\-ipsecmod\fP to be enabled.
 .sp
+\fBNOTE:\fP
+.INDENT 0.0
+.INDENT 3.5
+These settings go in the \fI\%server:\fP section.
+.UNINDENT
+.UNINDENT
+.sp
 When Unbound receives an A/AAAA query that is not in the cache and finds a
 valid answer, it will withhold returning the answer and instead will generate
 an IPSECKEY subquery for the same domain name.
@@ -5148,9 +4987,7 @@ If the option is not specified, all domains are treated as being allowed
 .B ipsecmod\-whitelist: \fI<domain>\fP 
 Alternate syntax for \fI\%ipsecmod\-allow\fP\&.
 .UNINDENT
-.SH CACHE DB MODULE OPTIONS
-.sp
-These options are part of the \fBcachedb:\fP section.
+.SS Cache DB Module Options
 .sp
 The Cache DB module must be configured in the
 \fI\%module\-config\fP directive, e.g.:
@@ -5212,7 +5049,7 @@ If connection close or timeout happens too often, Unbound will be effectively
 unusable with this backend.
 It\(aqs the administrator\(aqs responsibility to make the assumption hold.
 .sp
-The \fBcachedb:\fP section gives custom settings of the cache DB module.
+The \fBcachedb:\fP clause gives custom settings of the cache DB module.
 .INDENT 0.0
 .TP
 .B backend: \fI<backend name>\fP 
@@ -5440,13 +5277,10 @@ for the Redis replica server.
 .sp
 Default: 0
 .UNINDENT
-.SH DNSTAP OPTIONS
+.SS DNSTAP Logging Options
 .sp
-These options are part of the \fBdnstap:\fP section.
-.sp
-DNSTAP is a flexible, structured binary log format for DNS software.
-When compiled in by using \fB\-\-enable\-dnstap\fP, it can be enabled in the
-\fBdnstap:\fP section.
+DNSTAP support, when compiled in by using \fB\-\-enable\-dnstap\fP, is enabled in
+the \fBdnstap:\fP section.
 This starts an extra thread (when compiled with threading) that writes the log
 information to the destination.
 If Unbound is compiled without threading it does not spawn a thread, but
@@ -5612,18 +5446,15 @@ Enable to log forwarder response messages.
 .sp
 Default: no
 .UNINDENT
-.SH RESPONSE POLICY ZONE OPTIONS
+.SS Response Policy Zone Options
 .sp
-These options are part of the \fBrpz:\fP section.
-.sp
-Response Policy Zones are configured with \fBrpz:\fP section clauses, and each
-one must have a \fI\%name\fP option.
-There can be multiple ones, by listing multiple \fBrpz:\fP section clauses, each
-with a different name.
-RPZ sections are applied in order of configuration and any match from an
-earlier RPZ zone will terminate the RPZ lookup.
+Response Policy Zones are configured with \fBrpz:\fP, and each one must have a
+\fI\%name\fP attribute.
+There can be multiple ones, by listing multiple RPZ clauses, each with a
+different name.
+RPZ clauses are applied in order of configuration and any match from an earlier
+RPZ zone will terminate the RPZ lookup.
 Note that a PASSTHRU action is still considered a match.
-.sp
 The respip module needs to be added to the
 \fI\%module\-config\fP, e.g.:
 .INDENT 0.0
@@ -5637,17 +5468,6 @@ module\-config: \(dqrespip validator iterator\(dq
 .UNINDENT
 .UNINDENT
 .sp
-\fBNOTE:\fP
-.INDENT 0.0
-.INDENT 3.5
-If combining the \fBrespip\fP and \fBdns64\fP modules, the \fBrespip\fP module
-needs to appear before the \fBdns64\fP module in the
-\fI\%module\-config\fP
-configuration option so that response IP and/or RPZ feeds can properly
-filter responses regardless of DNS64 synthesis.
-.UNINDENT
-.UNINDENT
-.sp
 QNAME, Response IP Address, nsdname, nsip and clientip triggers are supported.
 Supported actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp\-only
 and drop.
@@ -5716,6 +5536,9 @@ A 192.0.2.1                  answer with this IP address
 .sp
 Other records like AAAA, TXT and other CNAMEs (not rpz\-..) can also be used to
 answer queries with that content.
+.sp
+The RPZ zones can be configured in the config file with these settings in the
+\fBrpz:\fP block.
 .INDENT 0.0
 .TP
 .B name: \fI<zone name>\fP 
@@ -5854,7 +5677,7 @@ Default: no
 .INDENT 0.0
 .TP
 .B tags: \fI\(dq<list of tags>\(dq\fP 
-Limit the policies from this RPZ section to clients with a matching tag.
+Limit the policies from this RPZ clause to clients with a matching tag.
 .sp
 Tags need to be defined in \fI\%define\-tag\fP and
 can be assigned to client addresses using
@@ -5862,7 +5685,7 @@ can be assigned to client addresses using
 \fI\%interface\-tag\fP\&.
 Enclose list of tags in quotes (\fB\(dq\(dq\fP) and put spaces between tags.
 .sp
-If no tags are specified the policies from this section will be applied for
+If no tags are specified the policies from this clause will be applied for
 all clients.
 .UNINDENT
 .SH MEMORY CONTROL EXAMPLE
@@ -5931,6 +5754,6 @@ Default is to log to \fIsyslog(3)\fP\&.
 .SH AUTHOR
 Unbound developers are mentioned in the CREDITS file in the distribution.
 .SH COPYRIGHT
-1999-2026, NLnet Labs
+1999-2025, NLnet Labs
 .\" Generated by docutils manpage writer.
 .
@@ -46,41 +46,34 @@ Description
 -----------

 **unbound.conf** is used to configure :doc:`unbound(8)</manpages/unbound>`.
+The file format has attributes and values.
+Some attributes have attributes inside them.
+The notation is: ``attribute: value``.
+
+Comments start with ``#`` and last to the end of line.
+Empty lines are ignored as is whitespace at the beginning of a line.

 The utility :doc:`unbound-checkconf(8)</manpages/unbound-checkconf>` can be
 used to check ``unbound.conf`` prior to usage.

-File Format
-----------
-
-Whitespace is used to separate keywords.
-Whitespace indentation is insignificant, but is still recommended for visual
-clarity.
-Comments start with ``#`` and last to the end of line.
-Empty lines are ignored, as is whitespace at the beginning of a line.
-
-Attribute keywords end with a colon (``:``) and they are either options or
-section clauses (group options together).
-
-The configuration file is logically divided into **sections** where each section
-is introduced by a :ref:`section clause<unbound.conf.clauses>`.
-
 Example
 -------

-An example minimal config file is shown below; most settings are the defaults.
-Copy this to ``@ub_conf_file@`` and start the server with:
+An example config file is shown below.
+Copy this to :file:`/etc/unbound/unbound.conf` and start the server with:

 .. code-block:: text

-    $ unbound -c @ub_conf_file@
+    $ unbound -c /etc/unbound/unbound.conf

+Most settings are the defaults.
 Stop the server with:

 .. code-block:: text

-    $ kill `cat @UNBOUND_PIDFILE@`
+    $ kill `cat /etc/unbound/unbound.pid`

+Below is a minimal config file.
 The source distribution contains an extensive :file:`example.conf` file with
 all the options.

@@ -88,87 +81,35 @@ all the options.

    # unbound.conf(5) config file for unbound(8).
    server:
-        directory: "@UNBOUND_RUN_DIR@"
+        directory: "/etc/unbound"
        username: unbound
        # make sure unbound can access entropy from inside the chroot.
        # e.g. on linux the use these commands (on BSD, devfs(8) is used):
-        #      mount --bind -n /dev/urandom @UNBOUND_RUN_DIR@/dev/urandom
-        # and  mount --bind -n /dev/log @UNBOUND_RUN_DIR@/dev/log
-        chroot: "@UNBOUND_CHROOT_DIR@"
-        # logfile: "@UNBOUND_RUN_DIR@/unbound.log"  #uncomment to use logfile.
-        pidfile: "@UNBOUND_PIDFILE@"
+        #      mount --bind -n /dev/urandom /etc/unbound/dev/urandom
+        # and  mount --bind -n /dev/log /etc/unbound/dev/log
+        chroot: "/etc/unbound"
+        # logfile: "/etc/unbound/unbound.log"  #uncomment to use logfile.
+        pidfile: "/etc/unbound/unbound.pid"
        # verbosity: 1      # uncomment and increase to get more logging.
        # listen on all interfaces, answer queries from the local subnet.
        interface: 0.0.0.0
        interface: ::0
        access-control: 10.0.0.0/8 allow
-        access-control: 2001:db8::/64 allow
+        access-control: 2001:DB8::/64 allow

-.. _unbound.conf.clauses:
+File Format
+-----------

-Section Clauses
---------------
-
-The recognized section clauses are:
-
-    :ref:`server:<unbound.conf.server>`
-        Most of the configuration is found in this section.
-
-    :ref:`remote-control:<unbound.conf.remote>`
-        Configuration for the facility used by
-        :doc:`unbound-control(8)</manpages/unbound-control>`.
-
-    :ref:`stub-zone:<unbound.conf.stub>`
-        Configuration for a zone that redirects to specific authoritative name
-        servers, e.g. for zones not generally available on the greater
-        Internet.
-
-    :ref:`forward-zone:<unbound.conf.forward>`
-        Configuration for a zone that forwards to specific DNS resolvers.
-
-    :ref:`auth-zone:<unbound.conf.auth>`
-        Configuration for local authoritative zones.
-
-    :ref:`view:<unbound.conf.view>`
-        Overriding a small subset of configuration for incoming requests.
-        Requests are mapped to views with
-        :ref:`access-control-view<unbound.conf.access-control-view>` and
-        :ref:`interface-view<unbound.conf.interface-view>`.
-
-    :ref:`python:<unbound.conf.python>`
-        Configuration for the optional ``python`` script module.
-
-    :ref:`dynlib:<unbound.conf.dynlib>`
-        Configuration for the optional ``dynlib`` module that loads dynamic
-        libraries into Unbound.
-
-    :ref:`dnscrypt:<unbound.conf.dnscrypt>`
-        Configuration for the optional DNSCrypt feature.
-
-    :ref:`cachedb:<unbound.conf.cachedb>`
-        Configuration for the optional ``cachedb`` module that can interface
-        with second level caches, currently Redis or Redis-complatible
-        databases.
-
-    :ref:`dnstap:<unbound.conf.dnstap>`
-        Configuration of the optional dnstap logging feature; a flexible,
-        structured binary log format for DNS software.
-
-    :ref:`rpz:<unbound.conf.rpz>`
-        Configuration for Response Policy Zones that allows for DNS filtering.
-        Requires the ``respip`` module.
-
-Section clauses can be repeated throughout the file (or included files) to
-logically group options in one visually cohesive group.
-This may be particularly useful for the ``server:`` clause with its myriad of
-options.
+There must be whitespace between keywords.
+Attribute keywords end with a colon ``':'``.
+An attribute is followed by a value, or its containing attributes in which case
+it is referred to as a clause.
+Clauses can be repeated throughout the file (or included files) to group
+attributes under the same clause.

 .. _unbound.conf.include:

-Including Files
---------------
-
-Files can be included using the ``include:`` directive.
+Files can be included using the **include:** directive.
 It can appear anywhere, it accepts a single file name as argument.
 Processing continues as if the text from the included file was copied into the
 config file at that point.
@@ -181,17 +122,17 @@ Wildcards can be used to include multiple files, see *glob(7)*.

 .. _unbound.conf.include-toplevel:

-For a more structural include option, the ``include-toplevel:`` directive can
+For a more structural include option, the **include-toplevel:** directive can
 be used.
-This closes whatever section clause is currently active (if any) and forces the
-use of section clauses in the included files and right after this directive.
+This closes whatever clause is currently active (if any) and forces the use of
+clauses in the included files and right after this directive.

 .. _unbound.conf.server:

 Server Options
--------------
+^^^^^^^^^^^^^^

-These options are part of the ``server:`` section.
+These options are part of the **server:** clause.


@@UAHL@unbound.conf@verbosity@@: *<number>*
@@ -555,9 +496,6 @@ These options are part of the ``server:`` section.
    The wait time in msec where recursion requests are dropped.
    This is to stop a large number of replies from accumulating.
    They receive no reply, the work item continues to recurse.
-    For UDP the replies are dropped, for stream connections the reply
-    is not dropped if the stream connection is still open ready to receive
-    answers.
    It is nice to be a bit larger than
    :ref:`serve-expired-client-timeout<unbound.conf.serve-expired-client-timeout>`
    if that is enabled.
@@ -572,7 +510,7 @@ These options are part of the ``server:`` section.
    This makes a ratelimit per IP address of waiting replies for recursion.
    It stops very large amounts of queries waiting to be returned to one
    destination.
-    The value ``0`` disables all wait limits.
+    The value ``0`` disables wait limits.

    Default: 1000

@@ -580,11 +518,7 @@ These options are part of the ``server:`` section.
@@UAHL@unbound.conf@wait-limit-cookie@@: *<number>*
    The number of replies that can wait for recursion, for an IP address
    that sent the query with a valid DNS Cookie.
-    Since the cookie already validates the client address, this option allows
-    to override a configured
-    :ref:`wait-limit<unbound.conf.wait-limit>` value usually with a higher one
-    for cookie validated queries.
-    The value ``0`` disables wait limits for cookie validated queries.
+    Since the cookie validates the client address, this limit can be higher.

    Default: 10000

@@ -1115,8 +1049,8 @@ These options are part of the ``server:`` section.


@@UAHL@unbound.conf@tls-system-cert@@: *<yes or no>*
-    This the same as the
-    :ref:`tls-win-cert<unbound.conf.tls-win-cert>` option, under a
+    This the same attribute as the
+    :ref:`tls-win-cert<unbound.conf.tls-win-cert>` attribute, under a
    different name.
    Because it is not windows specific.

@@ -1306,9 +1240,6 @@ These options are part of the ``server:`` section.
    Only interfaces configured with that port number as @number get the QUIC
    service.
    The interface uses QUIC for the UDP traffic on that port number.
-    If it is set to 0, the server does not init QUIC code, and QUIC is
-    disabled.
-    This is similar to if QUIC is not in use, but then explicitly.

    Default: 853

@@ -1506,8 +1437,8 @@ These options are part of the ``server:`` section.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** option overrides all **interface-\*:**
-        options for targeted clients.
+        **access-control\*:** attribute overrides all **interface-\*:**
+        attributes for targeted clients.


@@UAHL@unbound.conf@interface-tag@@: *<ip address or interface name [@port]> <"list of tags">*
@@ -1517,8 +1448,8 @@ These options are part of the ``server:`` section.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** option overrides all **interface-\*:**
-        options for targeted clients.
+        **access-control\*:** attribute overrides all **interface-\*:**
+        attributes for targeted clients.


@@UAHL@unbound.conf@interface-tag-action@@: *<ip address or interface name [@port]> <tag> <action>*
@@ -1529,8 +1460,8 @@ These options are part of the ``server:`` section.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** option overrides all **interface-\*:**
-        options for targeted clients.
+        **access-control\*:** attribute overrides all **interface-\*:**
+        attributes for targeted clients.


@@UAHL@unbound.conf@interface-tag-data@@: *<ip address or interface name [@port]> <tag> <"resource record string">*
@@ -1541,8 +1472,8 @@ These options are part of the ``server:`` section.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** option overrides all **interface-\*:**
-        options for targeted clients.
+        **access-control\*:** attribute overrides all **interface-\*:**
+        attributes for targeted clients.


@@UAHL@unbound.conf@interface-view@@: *<ip address or interface name [@port]> <view name>*
@@ -1552,8 +1483,8 @@ These options are part of the ``server:`` section.
    .. note::
        The interface needs to be already specified with
        :ref:`interface<unbound.conf.interface>` and that any
-        **access-control\*:** option overrides all **interface-\*:**
-        options for targeted clients.
+        **access-control\*:** attribute overrides all **interface-\*:**
+        attributes for targeted clients.


@@UAHL@unbound.conf@chroot@@: *<directory>*
@@ -1618,7 +1549,7 @@ These options are part of the ``server:`` section.
        [seconds since 1970] unbound[pid:tid]: type: message.

    If this option is given, the :ref:`use-syslog<unbound.conf.use-syslog>`
-    option is internally set to ``no``.
+    attribute is internally set to ``no``.

    The logfile is reopened (for append) when the config file is reread, on
    SIGHUP.
@@ -1717,15 +1648,6 @@ These options are part of the ``server:`` section.
    Default: no


-@@UAHL@unbound.conf@log-thread-id@@: *<yes or no>*
-    (Only on Linux and only when threads are available)
-    Logs the system-wide Linux thread ID instead of Unbound's internal thread
-    counter.
-    Can be useful when debugging with system tools.
-
-    Default: no
-
-
@@UAHL@unbound.conf@pidfile@@: *<filename>*
    The process id is written to the file.
    Default is :file:`"@UNBOUND_PIDFILE@"`.
@@ -1751,8 +1673,8 @@ These options are part of the ``server:`` section.
    Default is nothing, using builtin hints for the IN class.
    The file has the format of zone files, with root nameserver names and
    addresses only.
-    The default may become outdated, when servers change, and then it is
-    possible to use a root hints file with specific servers.
+    The default may become outdated, when servers change, therefore it is good
+    practice to use a root hints file.

    Default: ""

@@ -2908,7 +2830,7 @@ These options are part of the ``server:`` section.
    Configure local data shorthand for a PTR record with the reversed IPv4 or
    IPv6 address and the host name.
    For example ``"192.0.2.4 www.example.com"``.
-    TTL can be inserted like this: ``"2001:db8::4 7200 www.example.com"``
+    TTL can be inserted like this: ``"2001:DB8::4 7200 www.example.com"``


@@UAHL@unbound.conf@local-zone-tag@@: *<zone> <"list of tags">*
@@ -2961,7 +2883,7 @@ These options are part of the ``server:`` section.
    :ref:`response-ip<unbound.conf.response-ip>` with action being to redirect
    as specified by *<"resource record string">*.
    *<"Resource record string">* is similar to that of
-    :ref:`access-control-tag-data<unbound.conf.access-control-tag-data>`,
+    :ref:`access-control-tag-action<unbound.conf.access-control-tag-action>`,
    but it must be of either AAAA, A or CNAME types.
    If the *<IP-netblock>* is an IPv6/IPv4 prefix, the record must be AAAA/A
    respectively, unless it is a CNAME (which can be used for both versions of
@@ -3256,14 +3178,6 @@ These options are part of the ``server:`` section.
    Default: 200


-@@UAHL@unbound.conf@iter-scrub-promiscuous@@: *<yes or no>*
-    Should the iterator scrubber remove promiscuous NS from positive answers.
-    This protects against poisonous contents, that could affect names in the
-    same zone as a spoofed packet.
-
-    Default: yes
-
-
@@UAHL@unbound.conf@fast-server-permil@@: *<number>*
    Specify how many times out of 1000 to pick from the set of fastest servers.
    0 turns the feature off.
@@ -3390,18 +3304,17 @@ These options are part of the ``server:`` section.
 .. _unbound.conf.remote:

 Remote Control Options
----------------------
-
-These options are part of the ``remote-control:`` section and are the
-declarations for the remote control facility.
+^^^^^^^^^^^^^^^^^^^^^^

+In the **remote-control:** clause are the declarations for the remote control
+facility.
 If this is enabled, the :doc:`unbound-control(8)</manpages/unbound-control>`
 utility can be used to send commands to the running Unbound server.
-The server uses these options to setup TLS security for the connection.
-The :doc:`unbound-control(8)</manpages/unbound-control>` utility also reads
-this ``remote-control:`` section for options.
+The server uses these clauses to setup TLSv1 security for the connection.
+The :doc:`unbound-control(8)</manpages/unbound-control>` utility also reads the
+**remote-control:** section for options.
 To setup the correct self-signed certificates use the
-``unbound-control-setup(8)`` utility.
+*unbound-control-setup(8)* utility.


@@UAHL@unbound.conf.remote@control-enable@@: *<yes or no>*
@@ -3493,11 +3406,9 @@ To setup the correct self-signed certificates use the
 .. _unbound.conf.stub:

 Stub Zone Options
-----------------
+^^^^^^^^^^^^^^^^^

-These options are part of the ``stub-zone:`` section.
-
-There may be multiple ``stub-zone:`` sections.
+There may be multiple **stub-zone:** clauses.
 Each with a :ref:`name<unbound.conf.stub.name>` and zero or more hostnames or
 IP addresses.
 For the stub zone this list of nameservers is used.
@@ -3530,10 +3441,9 @@ Consider adding :ref:`server<unbound.conf.server>` statements for
 :ref:`domain-insecure<unbound.conf.domain-insecure>` and for
 :ref:`local-zone: \<name\> nodefault<unbound.conf.local-zone.type.nodefault>`
 for the zone if it is a locally served zone.
-The :ref:`domain-insecure<unbound.conf.domain-insecure>` option stops DNSSEC
-from invalidating the zone.
+The insecure clause stops DNSSEC from invalidating the zone.
 The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
-:ref:`transparent<unbound.conf.local-zone.type.transparent>`) option makes the
+:ref:`transparent<unbound.conf.local-zone.type.transparent>`) clause makes the
 (reverse-) zone bypass Unbound's filtering of :rfc:`1918` zones.


@@ -3546,19 +3456,6 @@ The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
    Name of stub zone nameserver.
    Is itself resolved before it is used.

-    .. caution::
-        If the domain (or a subdomain) from this zone is used as the host, it
-        will unavoidably introduce a circular dependency on retrieving the IP
-        addresses of the name server.
-        In that case, it is suggested to use
-        :ref:`stub-addr<unbound.conf.stub.stub-addr>` instead.
-        Alternatively,
-        :ref:`stub-first: yes<unbound.conf.stub.stub-first>` can also work
-        around the circular dependency by trying resolution outside of this
-        zone.
-        However this has the caveat that it would allow escaping this zone when
-        any resolution attempt fails within this zone.
-
    To use a non-default port for DNS communication append ``'@'`` with the
    port number.

@@ -3596,12 +3493,9 @@ The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or


@@UAHL@unbound.conf.stub@stub-first@@: *<yes or no>*
-    If enabled, a query is attempted without this stub section if it fails.
+    If enabled, a query is attempted without the stub clause if it fails.
    The data could not be retrieved and would have caused SERVFAIL because the
-    servers are unreachable, instead it is tried without this stub section.
-    This can lead to using less specific configured forward/stub/auth zones if
-    any, or end up to otherwise normal recursive resolution for that particular
-    query.
+    servers are unreachable, instead it is tried without this clause.

    Default: no

@@ -3633,11 +3527,9 @@ The :ref:`local-zone: nodefault<unbound.conf.local-zone.type.nodefault>` (or
 .. _unbound.conf.forward:

 Forward Zone Options
--------------------
+^^^^^^^^^^^^^^^^^^^^

-These options are part of the ``forward-zone:`` section.
-
-There may be multiple ``forward-zone:`` sections.
+There may be multiple **forward-zone:** clauses.
 Each with a :ref:`name<unbound.conf.forward.name>` and zero or more hostnames
 or IP addresses.
 For the forward zone this list of nameservers is used to forward the queries
@@ -3667,19 +3559,6 @@ cache).
    Name of server to forward to.
    Is itself resolved before it is used.

-    .. caution::
-        If the domain (or a subdomain) from this zone is used as the host, it
-        will unavoidably introduce a circular dependency on retrieving the IP
-        addresses of the name server.
-        In that case, it is suggested to use
-        :ref:`forward-addr<unbound.conf.forward.forward-addr>` instead.
-        Alternatively,
-        :ref:`forward-first: yes<unbound.conf.forward.forward-first>` can also
-        work around the circular dependency by trying resolution outside of
-        this zone.
-        However this has the caveat that it would allow escaping this zone when
-        any resolution attempt fails within this zone.
-
    To use a non-default port for DNS communication append ``'@'`` with the
    port number.

@@ -3714,11 +3593,9 @@ cache).


@@UAHL@unbound.conf.forward@forward-first@@: *<yes or no>*
-    If a forwarded query is met with a SERVFAIL error and this option is
-    enabled Unbound will fall back to less specific resolution.
-    This can lead to using less specific configured forward/stub/auth zones if
-    any, or end up to otherwise normal recursive resolution for that particular
-    query.
+    If a forwarded query is met with a SERVFAIL error, and this option is
+    enabled, Unbound will fall back to normal recursive resolution for this
+    query as if no query forwarding had been specified.

    Default: no

@@ -3755,14 +3632,12 @@ cache).
 .. _unbound.conf.auth:

 Authority Zone Options
----------------------
+^^^^^^^^^^^^^^^^^^^^^^

-These options are part of the ``auth-zone:`` section.
-
-Authority zones are configured with ``auth-zone:``, and each one must have a
+Authority zones are configured with **auth-zone:**, and each one must have a
 :ref:`name<unbound.conf.auth.name>`.
-There can be multiple ones, by listing multiple ``auth-zone`` section clauses,
-each with a different name, pertaining to that part of the namespace.
+There can be multiple ones, by listing multiple auth-zone clauses, each with a
+different name, pertaining to that part of the namespace.
 The authority zone with the name closest to the name looked up is used.
 Authority zones can be processed on two distinct, non-exclusive, configurable
 stages.
@@ -3793,7 +3668,7 @@ consult the local zone data while resolving.
 In this case, the aforementioned CNAME example will result in a thoroughly
 resolved answer.

-Authority zones can be read from a zonefile.
+Authority zones can be read from zonefile.
 And can be kept updated via AXFR and IXFR.
 After update the zonefile is rewritten.
 The update mechanism uses the SOA timer values and performs SOA UDP queries to
@@ -3829,17 +3704,21 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
    :ref:`url<unbound.conf.auth.url>` to download the zonefile as a text file
    from a webserver that would work.

-    .. caution::
-        If you specify the hostname, you cannot use the domain from the
-        zonefile, because it may not have that when retrieving that data,
-        instead use a plain IP address to avoid a circular dependency on
-        retrieving that IP address.
+    If you specify the hostname, you cannot use the domain from the zonefile,
+    because it may not have that when retrieving that data, instead use a plain
+    IP address to avoid a circular dependency on retrieving that IP address.


@@UAHL@unbound.conf.auth@master@@: *<IP address or host name>*
    Alternate syntax for :ref:`primary<unbound.conf.auth.primary>`.


+@@UAHL@unbound.conf.auth@primary-tsig@@: *<IP address or host name>* *<tsig key>*
+    Similar to :ref:`primary<unbound.conf.auth.primary>` and the tsig key
+    is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
@@UAHL@unbound.conf.auth@url@@: *<URL to zone file>*
    Where to download a zonefile for the zone.
    With HTTP or HTTPS.
@@ -3886,6 +3765,12 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
        default.


+@@UAHL@unbound.conf.auth@allow-notify-tsig@@: *<IP address or host name or netblockIP/prefix>* *<tsig key>*
+    Similar to :ref:`allow-notify<unbound.conf.auth.allow-notify>` and the
+    tsig key is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
@@UAHL@unbound.conf.auth@fallback-enabled@@: *<yes or no>*
    If enabled, Unbound falls back to querying the internet as a resolver for
    this zone when lookups fail.
@@ -3964,20 +3849,18 @@ fallback activates to fetch from the upstream instead of the SERVFAIL.
 .. _unbound.conf.view:

 View Options
------------
+^^^^^^^^^^^^

-These options are part of the ``view:`` section.
-
-There may be multiple ``view:`` sections.
+There may be multiple **view:** clauses.
 Each with a :ref:`name<unbound.conf.view.name>` and zero or more
 :ref:`local-zone<unbound.conf.view.local-zone>` and
-:ref:`local-data<unbound.conf.view.local-data>` options.
+:ref:`local-data<unbound.conf.view.local-data>` attributes.
 Views can also contain :ref:`view-first<unbound.conf.view.view-first>`,
 :ref:`response-ip<unbound.conf.response-ip>`,
 :ref:`response-ip-data<unbound.conf.response-ip-data>` and
-:ref:`local-data-ptr<unbound.conf.view.local-data-ptr>` options.
+:ref:`local-data-ptr<unbound.conf.view.local-data-ptr>` attributes.
 View can be mapped to requests by specifying the view name in an
-:ref:`access-control-view<unbound.conf.access-control-view>` option.
+:ref:`access-control-view<unbound.conf.access-control-view>` attribute.
 Options from matching views will override global options.
 Global options will be used if no matching view is found, or when the matching
 view does not have the option specified.
@@ -3987,7 +3870,7 @@ view does not have the option specified.
    Name of the view.
    Must be unique.
    This name is used in the
-    :ref:`access-control-view<unbound.conf.access-control-view>` option.
+    :ref:`access-control-view<unbound.conf.access-control-view>` attribute.


@@UAHL@unbound.conf.view@local-zone@@: *<zone> <type>*
@@ -4016,20 +3899,6 @@ view does not have the option specified.
    :ref:`local-data-ptr<unbound.conf.local-data-ptr>` elements.


-@@UAHL@unbound.conf.view@response-ip@@: *<IP-netblock> <action>*
-    This requires use of the ``respip`` module.
-
-    Similar to :ref:`response-ip<unbound.conf.response-ip>` but
-    only applies to this view.
-
-
-@@UAHL@unbound.conf.view@response-ip-data@@: *<IP-netblock> <"resource record string">*
-    This requires use of the ``respip`` module.
-
-    Similar to :ref:`response-ip-data<unbound.conf.response-ip-data>` but
-    only applies to this view.
-
-
@@UAHL@unbound.conf.view@view-first@@: *<yes or no>*
    If enabled, it attempts to use the global
    :ref:`local-zone<unbound.conf.local-zone>` and
@@ -4038,14 +3907,10 @@ view does not have the option specified.

    Default: no

-.. _unbound.conf.python:
-
 Python Module Options
---------------------
+^^^^^^^^^^^^^^^^^^^^^

-These options are part of the ``python:`` section.
-
-The ``python:`` section gives the settings for the *python(1)* script module.
+The **python:** clause gives the settings for the *python(1)* script module.
 This module acts like the iterator and validator modules do, on queries and
 answers.
 To enable the script module it has to be compiled into the daemon, and the word
@@ -4068,19 +3933,15 @@ path to the working directory.
    Repeat this option for every python module instance added to the
    :ref:`module-config<unbound.conf.module-config>` option.

-.. _unbound.conf.dynlib:
-
 Dynamic Library Module Options
------------------------------
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

-These options are part of the ``dynlib:`` section.
-
-The ``dynlib:`` section gives the settings for the ``dynlib`` module.
+The **dynlib:** clause gives the settings for the ``dynlib`` module.
 This module is only a very small wrapper that allows dynamic modules to be
 loaded on runtime instead of being compiled into the application.
 To enable the dynlib module it has to be compiled into the daemon, and the word
 ``dynlib`` has to be put in the
-:ref:`module-config<unbound.conf.module-config>` option.
+:ref:`module-config<unbound.conf.module-config>` attribute.
 Multiple instances of dynamic libraries are supported by adding the word
 ``dynlib`` more than once.

@@ -4096,9 +3957,7 @@ directory.
    :ref:`module-config<unbound.conf.module-config>` option.

 DNS64 Module Options
--------------------
-
-These options are part of the ``server:`` section.
+^^^^^^^^^^^^^^^^^^^^

 The ``dns64`` module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -4110,11 +3969,7 @@ The ``dns64`` module must be configured in the
 and be compiled into the daemon to be enabled.

 .. note::
-    If combining the ``respip`` and ``dns64`` modules, the ``respip`` module
-    needs to appear before the ``dns64`` module in the
-    :ref:`module-config<unbound.conf.module-config>`
-    configuration option so that response IP and/or RPZ feeds can properly
-    filter responses regardless of DNS64 synthesis.
+    These settings go in the :ref:`server:<unbound.conf.server>` section.


@@UAHL@unbound.conf.dns64@dns64-prefix@@: *<IPv6 prefix>*
@@ -4140,13 +3995,13 @@ and be compiled into the daemon to be enabled.
    per line.
    Applies also to names underneath the name given.

-NAT64 Options
-------------
-
-These options are part of the ``server:`` section.
+NAT64 Operation
+^^^^^^^^^^^^^^^

 NAT64 operation allows using a NAT64 prefix for outbound requests to IPv4-only
 servers.
+It is controlled by two options in the
+:ref:`server:<unbound.conf.server>` section:


@@UAHL@unbound.conf.nat64@do-nat64@@: *<yes or no>*
@@ -4163,14 +4018,10 @@ servers.

    Default: 64:ff9b::/96 (same as :ref:`dns64-prefix<unbound.conf.dns64.dns64-prefix>`)

-.. _unbound.conf.dnscrypt:
-
 DNSCrypt Options
----------------
+^^^^^^^^^^^^^^^^

-These options are part of the ``dnscrypt:`` section.
-
-The ``dnscrypt:`` section gives the settings of the dnscrypt channel.
+The **dnscrypt:** clause gives the settings of the dnscrypt channel.
 While those options are available, they are only meaningful if Unbound was
 compiled with ``--enable-dnscrypt``.
 Currently certificate and secret/public keys cannot be generated by Unbound.
@@ -4277,9 +4128,7 @@ https://github.com/cofyc/dnscrypt-wrapper/blob/master/README.md#usage
    Default: (unconfigured)

 EDNS Client Subnet Module Options
---------------------------------
-
-These options are part of the ``server:`` section.
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

 The ECS module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -4290,6 +4139,9 @@ The ECS module must be configured in the

 and be compiled into the daemon to be enabled.

+.. note::
+    These settings go in the :ref:`server:<unbound.conf.server>` section.
+
 If the destination address is allowed in the configuration Unbound will add the
 EDNS0 option to the query containing the relevant part of the client's address.
 When an answer contains the ECS option the response and the option are placed
@@ -4404,9 +4256,7 @@ This module does not interact with the
    Default: 100

 Opportunistic IPsec Support Module Options
------------------------------------------
-
-These options are part of the ``server:`` section.
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

 The IPsec module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -4417,6 +4267,9 @@ The IPsec module must be configured in the

 and be compiled into Unbound by using ``--enable-ipsecmod`` to be enabled.

+.. note::
+    These settings go in the :ref:`server:<unbound.conf.server>` section.
+
 When Unbound receives an A/AAAA query that is not in the cache and finds a
 valid answer, it will withhold returning the answer and instead will generate
 an IPSECKEY subquery for the same domain name.
@@ -4506,12 +4359,8 @@ answer given from cache is still relevant for opportunistic IPsec.
@@UAHL@unbound.conf@ipsecmod-whitelist@@: *<domain>*
    Alternate syntax for :ref:`ipsecmod-allow<unbound.conf.ipsecmod-allow>`.

-.. _unbound.conf.cachedb:
-
 Cache DB Module Options
-----------------------
-
-These options are part of the ``cachedb:`` section.
+^^^^^^^^^^^^^^^^^^^^^^^

 The Cache DB module must be configured in the
 :ref:`module-config<unbound.conf.module-config>` directive, e.g.:
@@ -4563,7 +4412,7 @@ If connection close or timeout happens too often, Unbound will be effectively
 unusable with this backend.
 It's the administrator's responsibility to make the assumption hold.

-The ``cachedb:`` section gives custom settings of the cache DB module.
+The **cachedb:** clause gives custom settings of the cache DB module.


@@UAHL@unbound.conf.cachedb@backend@@: *<backend name>*
@@ -4611,7 +4460,7 @@ The ``cachedb:`` section gives custom settings of the cache DB module.

    Default: yes

-The following ``cachedb:`` options are specific to the ``redis`` backend.
+The following **cachedb:** options are specific to the ``redis`` backend.


@@UAHL@unbound.conf.cachedb@redis-server-host@@: *<server address or name>*
@@ -4770,14 +4619,11 @@ The following ``cachedb:`` options are specific to the ``redis`` backend.

 .. _unbound.conf.dnstap:

-DNSTAP Options
--------------
+DNSTAP Logging Options
+^^^^^^^^^^^^^^^^^^^^^^

-These options are part of the ``dnstap:`` section.
-
-DNSTAP is a flexible, structured binary log format for DNS software.
-When compiled in by using ``--enable-dnstap``, it can be enabled in the
-``dnstap:`` section.
+DNSTAP support, when compiled in by using ``--enable-dnstap``, is enabled in
+the **dnstap:** section.
 This starts an extra thread (when compiled with threading) that writes the log
 information to the destination.
 If Unbound is compiled without threading it does not spawn a thread, but
@@ -4927,18 +4773,15 @@ connects per-process to the destination.
 .. _unbound.conf.rpz:

 Response Policy Zone Options
----------------------------
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^

-These options are part of the ``rpz:`` section.
-
-Response Policy Zones are configured with ``rpz:`` section clauses, and each
-one must have a :ref:`name<unbound.conf.rpz.name>` option.
-There can be multiple ones, by listing multiple ``rpz:`` section clauses, each
-with a different name.
-RPZ sections are applied in order of configuration and any match from an
-earlier RPZ zone will terminate the RPZ lookup.
+Response Policy Zones are configured with **rpz:**, and each one must have a
+:ref:`name<unbound.conf.rpz.name>` attribute.
+There can be multiple ones, by listing multiple RPZ clauses, each with a
+different name.
+RPZ clauses are applied in order of configuration and any match from an earlier
+RPZ zone will terminate the RPZ lookup.
 Note that a PASSTHRU action is still considered a match.
-
 The respip module needs to be added to the
 :ref:`module-config<unbound.conf.module-config>`, e.g.:

@@ -4946,13 +4789,6 @@ The respip module needs to be added to the

    module-config: "respip validator iterator"

-.. note::
-    If combining the ``respip`` and ``dns64`` modules, the ``respip`` module
-    needs to appear before the ``dns64`` module in the
-    :ref:`module-config<unbound.conf.module-config>`
-    configuration option so that response IP and/or RPZ feeds can properly
-    filter responses regardless of DNS64 synthesis.
-
 QNAME, Response IP Address, nsdname, nsip and clientip triggers are supported.
 Supported actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp-only
 and drop.
@@ -5004,6 +4840,9 @@ The actions are specified with the record on the right
 Other records like AAAA, TXT and other CNAMEs (not rpz-..) can also be used to
 answer queries with that content.

+The RPZ zones can be configured in the config file with these settings in the
+**rpz:** block.
+

@@UAHL@unbound.conf.rpz@name@@: *<zone name>*
    Name of the authority zone.
@@ -5035,6 +4874,12 @@ answer queries with that content.
    Alternate syntax for :ref:`primary<unbound.conf.rpz.primary>`.


+@@UAHL@unbound.conf.rpz@primary-tsig@@: *<IP address or host name>* *<tsig key>*
+    Similar to :ref:`primary<unbound.conf.rpz.primary>` and the tsig key
+    is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
@@UAHL@unbound.conf.rpz@url@@: *<url to zonefile>*
    Where to download a zonefile for the zone.
    With HTTP or HTTPS.
@@ -5072,6 +4917,12 @@ answer queries with that content.
        default.


+@@UAHL@unbound.conf.rpz@allow-notify-tsig@@: *<IP address or host name or netblockIP/prefix>* *<tsig key>*
+    Similar to :ref:`allow-notify<unbound.conf.rpz.allow-notify>` and the
+    tsig key is used for TSIG.
+    The key name is from a :ref:`tsig-key<unbound.conf.tsig-key>` entry.
+
+
@@UAHL@unbound.conf.rpz@zonefile@@: *<filename>*
    The filename where the zone is stored.
    If not given then no zonefile is used.
@@ -5119,7 +4970,7 @@ answer queries with that content.


@@UAHL@unbound.conf.rpz@tags@@: *"<list of tags>"*
-    Limit the policies from this RPZ section to clients with a matching tag.
+    Limit the policies from this RPZ clause to clients with a matching tag.

    Tags need to be defined in :ref:`define-tag<unbound.conf.define-tag>` and
    can be assigned to client addresses using
@@ -5127,9 +4978,45 @@ answer queries with that content.
    :ref:`interface-tag<unbound.conf.interface-tag>`.
    Enclose list of tags in quotes (``""``) and put spaces between tags.

-    If no tags are specified the policies from this section will be applied for
+    If no tags are specified the policies from this clause will be applied for
    all clients.

+.. _unbound.conf.tsig-key:
+
+TSIG Key Options
+^^^^^^^^^^^^^^^^^
+
+The **tsig-key:** clauses specify the TSIG keys that are used.
+There can be multiple **tsig-key:** clauses, with each specifying a
+different key.
+Each key has a name, algorithm and secret key material.
+
+TSIG keys are shared secrets.
+Both sides of the connection share the secret information.
+Also they must both use the same name for the key, and same algorithm.
+
+With ``include: "key.conf"`` it is possible to put the declaration of the key
+or some lines of it in an external file from the main configuration file.
+It can also be used without such an include, with it the config statements
+and key material can be put in separate files.
+
+
+@@UAHL@unbound.conf.tsig-key@name@@: *"<key name>"*
+    Name of the TSIG key.
+    The key name is transferred in DNS wireformat in the TSIG record, and
+    is used to reference the TSIG key from where it is configured to be used.
+
+
+@@UAHL@unbound.conf.tsig-key@algorithm@@: *<algorithm name>*
+    Name of the algorithm to use with this TSIG key.
+    This can be md5, sha1, sha224, sha256, sha384 or sha512.
+
+
+@@UAHL@unbound.conf.tsig-key@secret@@: *"<base64 blob>"*
+    The secret contents is a base64 string.
+    A way to get random base64 bytes is e.g.
+    from ``dd if=/dev/random of=/dev/stdout count=1 bs=32 | base64``
+
 Memory Control Example
 ----------------------

@@ -1007,7 +1007,6 @@ EXCLUDE                = ./build \
                         libunbound/python/doc \
                         libunbound/python/examples \
                         ./ldns-src \
-                         ./simdzone \
                         README.md \
                         doc/control_proto_spec.txt \
                         doc/requirements.txt
@@ -42,7 +42,7 @@ unbound(8)
 Synopsis
 --------

-**unbound** [``-hdpVv``] [``-c <cfgfile>``]
+**unbound** [``-hdpv``] [``-c <cfgfile>``]

 Description
 -----------
@@ -162,15 +162,8 @@ int ecs_whitelist_check(struct query_info* qinfo,
 			if(!ecs_is_whitelisted(sn_env->whitelist,
 				addr, addrlen, qinfo->qname, qinfo->qname_len,
 				qinfo->qclass)) {
-				/* The stub or forward can have no_cache set.*/
-				if(iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL, NULL, 0)) {
-					verbose(VERB_ALGO, "subnet subquery is not stored globally, stuborfwd is no_cache");
-				} else {
-					verbose(VERB_ALGO, "subnet store subquery global, name and addr have no subnet treatment.%s",
-						(sq->started_no_cache_store?
-						" But the subnet module was started with no_cache_store for the super query, and that is still applied to this query":""));
-					qstate->no_cache_store = sq->started_no_cache_store;
-				}
+				verbose(VERB_ALGO, "subnet store subquery global, name and addr have no subnet treatment.");
+				qstate->no_cache_store = 0;
 			}
 		}
 		return 1;
@@ -587,7 +580,6 @@ generate_sub_request(struct module_qstate *qstate, int id, struct subnet_qstate*
 		}
 		subsq = (struct subnet_qstate*)subq->minfo[id];
 		subsq->is_subquery_nonsubnet = 1;
-		subsq->started_no_cache_store = sq->started_no_cache_store;

 		/* When the client asks 0.0.0.0/0 and the name is not treated
 		 * as subnet, it is to be stored in the global cache.
@@ -0,0 +1,501 @@
+#!/usr/bin/sh
+# install - install a program, script, or datafile
+
+scriptversion=2013-12-25.23; # UTC
+
+# This originates from X11R5 (mit/util/scripts/install.sh), which was
+# later released in X11R6 (xc/config/util/install.sh) with the
+# following copyright and license.
+#
+# Copyright (C) 1994 X Consortium
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to
+# deal in the Software without restriction, including without limitation the
+# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+# sell copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+# X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+# AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC-
+# TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+#
+# Except as contained in this notice, the name of the X Consortium shall not
+# be used in advertising or otherwise to promote the sale, use or other deal-
+# ings in this Software without prior written authorization from the X Consor-
+# tium.
+#
+#
+# FSF changes to this file are in the public domain.
+#
+# Calling this script install-sh is preferred over install.sh, to prevent
+# 'make' implicit rules from creating a file called install from it
+# when there is no Makefile.
+#
+# This script is compatible with the BSD install script, but was written
+# from scratch.
+
+tab='	'
+nl='
+'
+IFS=" $tab$nl"
+
+# Set DOITPROG to "echo" to test this script.
+
+doit=${DOITPROG-}
+doit_exec=${doit:-exec}
+
+# Put in absolute file names if you don't have them in your path;
+# or use environment vars.
+
+chgrpprog=${CHGRPPROG-chgrp}
+chmodprog=${CHMODPROG-chmod}
+chownprog=${CHOWNPROG-chown}
+cmpprog=${CMPPROG-cmp}
+cpprog=${CPPROG-cp}
+mkdirprog=${MKDIRPROG-mkdir}
+mvprog=${MVPROG-mv}
+rmprog=${RMPROG-rm}
+stripprog=${STRIPPROG-strip}
+
+posix_mkdir=
+
+# Desired mode of installed file.
+mode=0755
+
+chgrpcmd=
+chmodcmd=$chmodprog
+chowncmd=
+mvcmd=$mvprog
+rmcmd="$rmprog -f"
+stripcmd=
+
+src=
+dst=
+dir_arg=
+dst_arg=
+
+copy_on_change=false
+is_target_a_directory=possibly
+
+usage="\
+Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
+   or: $0 [OPTION]... SRCFILES... DIRECTORY
+   or: $0 [OPTION]... -t DIRECTORY SRCFILES...
+   or: $0 [OPTION]... -d DIRECTORIES...
+
+In the 1st form, copy SRCFILE to DSTFILE.
+In the 2nd and 3rd, copy all SRCFILES to DIRECTORY.
+In the 4th, create DIRECTORIES.
+
+Options:
+     --help     display this help and exit.
+     --version  display version info and exit.
+
+  -c            (ignored)
+  -C            install only if different (preserve the last data modification time)
+  -d            create directories instead of installing files.
+  -g GROUP      $chgrpprog installed files to GROUP.
+  -m MODE       $chmodprog installed files to MODE.
+  -o USER       $chownprog installed files to USER.
+  -s            $stripprog installed files.
+  -t DIRECTORY  install into DIRECTORY.
+  -T            report an error if DSTFILE is a directory.
+
+Environment variables override the default commands:
+  CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG
+  RMPROG STRIPPROG
+"
+
+while test $# -ne 0; do
+  case $1 in
+    -c) ;;
+
+    -C) copy_on_change=true;;
+
+    -d) dir_arg=true;;
+
+    -g) chgrpcmd="$chgrpprog $2"
+        shift;;
+
+    --help) echo "$usage"; exit $?;;
+
+    -m) mode=$2
+        case $mode in
+          *' '* | *"$tab"* | *"$nl"* | *'*'* | *'?'* | *'['*)
+            echo "$0: invalid mode: $mode" >&2
+            exit 1;;
+        esac
+        shift;;
+
+    -o) chowncmd="$chownprog $2"
+        shift;;
+
+    -s) stripcmd=$stripprog;;
+
+    -t)
+        is_target_a_directory=always
+        dst_arg=$2
+        # Protect names problematic for 'test' and other utilities.
+        case $dst_arg in
+          -* | [=\(\)!]) dst_arg=./$dst_arg;;
+        esac
+        shift;;
+
+    -T) is_target_a_directory=never;;
+
+    --version) echo "$0 $scriptversion"; exit $?;;
+
+    --) shift
+        break;;
+
+    -*) echo "$0: invalid option: $1" >&2
+        exit 1;;
+
+    *)  break;;
+  esac
+  shift
+done
+
+# We allow the use of options -d and -T together, by making -d
+# take the precedence; this is for compatibility with GNU install.
+
+if test -n "$dir_arg"; then
+  if test -n "$dst_arg"; then
+    echo "$0: target directory not allowed when installing a directory." >&2
+    exit 1
+  fi
+fi
+
+if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then
+  # When -d is used, all remaining arguments are directories to create.
+  # When -t is used, the destination is already specified.
+  # Otherwise, the last argument is the destination.  Remove it from $@.
+  for arg
+  do
+    if test -n "$dst_arg"; then
+      # $@ is not empty: it contains at least $arg.
+      set fnord "$@" "$dst_arg"
+      shift # fnord
+    fi
+    shift # arg
+    dst_arg=$arg
+    # Protect names problematic for 'test' and other utilities.
+    case $dst_arg in
+      -* | [=\(\)!]) dst_arg=./$dst_arg;;
+    esac
+  done
+fi
+
+if test $# -eq 0; then
+  if test -z "$dir_arg"; then
+    echo "$0: no input file specified." >&2
+    exit 1
+  fi
+  # It's OK to call 'install-sh -d' without argument.
+  # This can happen when creating conditional directories.
+  exit 0
+fi
+
+if test -z "$dir_arg"; then
+  if test $# -gt 1 || test "$is_target_a_directory" = always; then
+    if test ! -d "$dst_arg"; then
+      echo "$0: $dst_arg: Is not a directory." >&2
+      exit 1
+    fi
+  fi
+fi
+
+if test -z "$dir_arg"; then
+  do_exit='(exit $ret); exit $ret'
+  trap "ret=129; $do_exit" 1
+  trap "ret=130; $do_exit" 2
+  trap "ret=141; $do_exit" 13
+  trap "ret=143; $do_exit" 15
+
+  # Set umask so as not to create temps with too-generous modes.
+  # However, 'strip' requires both read and write access to temps.
+  case $mode in
+    # Optimize common cases.
+    *644) cp_umask=133;;
+    *755) cp_umask=22;;
+
+    *[0-7])
+      if test -z "$stripcmd"; then
+        u_plus_rw=
+      else
+        u_plus_rw='% 200'
+      fi
+      cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;;
+    *)
+      if test -z "$stripcmd"; then
+        u_plus_rw=
+      else
+        u_plus_rw=,u+rw
+      fi
+      cp_umask=$mode$u_plus_rw;;
+  esac
+fi
+
+for src
+do
+  # Protect names problematic for 'test' and other utilities.
+  case $src in
+    -* | [=\(\)!]) src=./$src;;
+  esac
+
+  if test -n "$dir_arg"; then
+    dst=$src
+    dstdir=$dst
+    test -d "$dstdir"
+    dstdir_status=$?
+  else
+
+    # Waiting for this to be detected by the "$cpprog $src $dsttmp" command
+    # might cause directories to be created, which would be especially bad
+    # if $src (and thus $dsttmp) contains '*'.
+    if test ! -f "$src" && test ! -d "$src"; then
+      echo "$0: $src does not exist." >&2
+      exit 1
+    fi
+
+    if test -z "$dst_arg"; then
+      echo "$0: no destination specified." >&2
+      exit 1
+    fi
+    dst=$dst_arg
+
+    # If destination is a directory, append the input filename; won't work
+    # if double slashes aren't ignored.
+    if test -d "$dst"; then
+      if test "$is_target_a_directory" = never; then
+        echo "$0: $dst_arg: Is a directory" >&2
+        exit 1
+      fi
+      dstdir=$dst
+      dst=$dstdir/`basename "$src"`
+      dstdir_status=0
+    else
+      dstdir=`dirname "$dst"`
+      test -d "$dstdir"
+      dstdir_status=$?
+    fi
+  fi
+
+  obsolete_mkdir_used=false
+
+  if test $dstdir_status != 0; then
+    case $posix_mkdir in
+      '')
+        # Create intermediate dirs using mode 755 as modified by the umask.
+        # This is like FreeBSD 'install' as of 1997-10-28.
+        umask=`umask`
+        case $stripcmd.$umask in
+          # Optimize common cases.
+          *[2367][2367]) mkdir_umask=$umask;;
+          .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
+
+          *[0-7])
+            mkdir_umask=`expr $umask + 22 \
+              - $umask % 100 % 40 + $umask % 20 \
+              - $umask % 10 % 4 + $umask % 2
+            `;;
+          *) mkdir_umask=$umask,go-w;;
+        esac
+
+        # With -d, create the new directory with the user-specified mode.
+        # Otherwise, rely on $mkdir_umask.
+        if test -n "$dir_arg"; then
+          mkdir_mode=-m$mode
+        else
+          mkdir_mode=
+        fi
+
+        posix_mkdir=false
+        case $umask in
+          *[123567][0-7][0-7])
+            # POSIX mkdir -p sets u+wx bits regardless of umask, which
+            # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
+            ;;
+          *)
+            tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
+            trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
+
+            if (umask $mkdir_umask &&
+                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
+            then
+              if test -z "$dir_arg" || {
+                   # Check for POSIX incompatibilities with -m.
+                   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
+                   # other-writable bit of parent directory when it shouldn't.
+                   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
+                   ls_ld_tmpdir=`ls -ld "$tmpdir"`
+                   case $ls_ld_tmpdir in
+                     d????-?r-*) different_mode=700;;
+                     d????-?--*) different_mode=755;;
+                     *) false;;
+                   esac &&
+                   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
+                     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
+                     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
+                   }
+                 }
+              then posix_mkdir=:
+              fi
+              rmdir "$tmpdir/d" "$tmpdir"
+            else
+              # Remove any dirs left behind by ancient mkdir implementations.
+              rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
+            fi
+            trap '' 0;;
+        esac;;
+    esac
+
+    if
+      $posix_mkdir && (
+        umask $mkdir_umask &&
+        $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
+      )
+    then :
+    else
+
+      # The umask is ridiculous, or mkdir does not conform to POSIX,
+      # or it failed possibly due to a race condition.  Create the
+      # directory the slow way, step by step, checking for races as we go.
+
+      case $dstdir in
+        /*) prefix='/';;
+        [-=\(\)!]*) prefix='./';;
+        *)  prefix='';;
+      esac
+
+      oIFS=$IFS
+      IFS=/
+      set -f
+      set fnord $dstdir
+      shift
+      set +f
+      IFS=$oIFS
+
+      prefixes=
+
+      for d
+      do
+        test X"$d" = X && continue
+
+        prefix=$prefix$d
+        if test -d "$prefix"; then
+          prefixes=
+        else
+          if $posix_mkdir; then
+            (umask=$mkdir_umask &&
+             $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
+            # Don't fail if two instances are running concurrently.
+            test -d "$prefix" || exit 1
+          else
+            case $prefix in
+              *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
+              *) qprefix=$prefix;;
+            esac
+            prefixes="$prefixes '$qprefix'"
+          fi
+        fi
+        prefix=$prefix/
+      done
+
+      if test -n "$prefixes"; then
+        # Don't fail if two instances are running concurrently.
+        (umask $mkdir_umask &&
+         eval "\$doit_exec \$mkdirprog $prefixes") ||
+          test -d "$dstdir" || exit 1
+        obsolete_mkdir_used=true
+      fi
+    fi
+  fi
+
+  if test -n "$dir_arg"; then
+    { test -z "$chowncmd" || $doit $chowncmd "$dst"; } &&
+    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dst"; } &&
+    { test "$obsolete_mkdir_used$chowncmd$chgrpcmd" = false ||
+      test -z "$chmodcmd" || $doit $chmodcmd $mode "$dst"; } || exit 1
+  else
+
+    # Make a couple of temp file names in the proper directory.
+    dsttmp=$dstdir/_inst.$$_
+    rmtmp=$dstdir/_rm.$$_
+
+    # Trap to clean up those temp files at exit.
+    trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
+
+    # Copy the file name to the temp name.
+    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
+
+    # and set any options; do chmod last to preserve setuid bits.
+    #
+    # If any of these fail, we abort the whole thing.  If we want to
+    # ignore errors from any of these, just make sure not to ignore
+    # errors from the above "$doit $cpprog $src $dsttmp" command.
+    #
+    { test -z "$chowncmd" || $doit $chowncmd "$dsttmp"; } &&
+    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dsttmp"; } &&
+    { test -z "$stripcmd" || $doit $stripcmd "$dsttmp"; } &&
+    { test -z "$chmodcmd" || $doit $chmodcmd $mode "$dsttmp"; } &&
+
+    # If -C, don't bother to copy if it wouldn't change the file.
+    if $copy_on_change &&
+       old=`LC_ALL=C ls -dlL "$dst"     2>/dev/null` &&
+       new=`LC_ALL=C ls -dlL "$dsttmp"  2>/dev/null` &&
+       set -f &&
+       set X $old && old=:$2:$4:$5:$6 &&
+       set X $new && new=:$2:$4:$5:$6 &&
+       set +f &&
+       test "$old" = "$new" &&
+       $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1
+    then
+      rm -f "$dsttmp"
+    else
+      # Rename the file to the real destination.
+      $doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null ||
+
+      # The rename failed, perhaps because mv can't rename something else
+      # to itself, or perhaps because mv is so ancient that it does not
+      # support -f.
+      {
+        # Now remove or move aside any old file at destination location.
+        # We try this two ways since rm can't unlink itself on some
+        # systems and the destination file might be busy for other
+        # reasons.  In this case, the final cleanup might fail but the new
+        # file should still install successfully.
+        {
+          test ! -f "$dst" ||
+          $doit $rmcmd -f "$dst" 2>/dev/null ||
+          { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
+            { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
+          } ||
+          { echo "$0: cannot unlink or rename $dst" >&2
+            (exit 1); exit 1
+          }
+        } &&
+
+        # Now rename the file to the real destination.
+        $doit $mvcmd "$dsttmp" "$dst"
+      }
+    fi || exit 1
+
+    trap '' 0
+  fi
+done
+
+# Local variables:
+# eval: (add-hook 'write-file-hooks 'time-stamp)
+# time-stamp-start: "scriptversion="
+# time-stamp-format: "%:y-%02m-%02d.%02H"
+# time-stamp-time-zone: "UTC"
+# time-stamp-end: "; # UTC"
+# End:
@@ -228,11 +228,6 @@ read_fwds_host(struct config_stub* s, struct delegpt* dp)
 				s->name, p->str);
 			return 0;
 		}
-		if(dname_subdomain_c(dname, dp->name)) {
-			log_warn("forward-host '%s' may have a circular "
-				"dependency on forward-zone '%s'",
-				p->str, s->name);
-		}
 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
 		if(tls_auth_name)
 			log_err("no name verification functionality in "
@@ -231,11 +231,6 @@ read_stubs_host(struct config_stub* s, struct delegpt* dp)
 				s->name, p->str);
 			return 0;
 		}
-		if(dname_subdomain_c(dname, dp->name)) {
-			log_warn("stub-host '%s' may have a circular "
-				"dependency on stub-zone '%s'",
-				p->str, s->name);
-		}
 #if ! defined(HAVE_SSL_SET1_HOST) && ! defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
 		if(tls_auth_name)
 			log_err("no name verification functionality in "
@@ -418,13 +418,12 @@ shorten_rrset(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
 * @param qinfo: original query.
 * @param region: where to allocate synthesized CNAMEs.
 * @param env: module env with config options.
- * @param zonename: name of server zone.
 * @return 0 on error.
 */
 static int
 scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, 
 	struct query_info* qinfo, struct regional* region,
-	struct module_env* env, uint8_t* zonename)
+	struct module_env* env)
 {
 	uint8_t* sname = qinfo->qname;
 	size_t snamelen = qinfo->qname_len;
@@ -432,8 +431,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	int cname_length = 0; /* number of CNAMEs, or DNAMEs */

 	if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR &&
-		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN &&
-		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_YXDOMAIN)
+		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN)
 		return 1;

 	/* For the ANSWER section, remove all "irrelevant" records and add
@@ -472,11 +470,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				&aliaslen, pkt)) {
 				verbose(VERB_ALGO, "synthesized CNAME "
 					"too long");
-				if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_YXDOMAIN) {
-					prev = rrset;
-					rrset = rrset->rrset_all_next;
-					continue;
-				}
 				return 0;
 			}
 			cname_length++;
@@ -641,45 +634,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 					"RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
-			/* If the NS set is a promiscuous NS set, scrub that
-			 * to remove potential for poisonous contents that
-			 * affects other names in the same zone. Remove
-			 * promiscuous NS sets in positive answers, that
-			 * thus have records in the answer section. Nodata
-			 * and nxdomain promiscuous NS sets have been removed
-			 * already. Since the NS rrset is scrubbed, its
-			 * address records are also not marked to be allowed
-			 * and are removed later. */
-			if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR &&
-				msg->an_rrsets != 0 &&
-				env->cfg->iter_scrub_promiscuous) {
-				remove_rrset("normalize: removing promiscuous "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
-			/* Also delete promiscuous NS for other RCODEs */
-			if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR
-				&& env->cfg->iter_scrub_promiscuous) {
-				remove_rrset("normalize: removing promiscuous "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
-			/* Also delete promiscuous NS for NOERROR with nodata
-			 * for authoritative answers, not for delegations.
-			 * NOERROR with an_rrsets!=0 already handled.
-			 * Also NOERROR and soa_in_auth already handled.
-			 * NOERROR with an_rrsets==0, and not a referral.
-			 * referral is (NS not the zonename, noSOA).
-			 */
-			if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR
-				&& msg->an_rrsets == 0
-				&& !(dname_pkt_compare(pkt, rrset->dname,
-				     zonename) != 0 && !soa_in_auth(msg))
-				&& env->cfg->iter_scrub_promiscuous) {
-				remove_rrset("normalize: removing promiscuous "
-					"RRset:", pkt, msg, prev, &rrset);
-				continue;
-			}
 			if(nsset == NULL) {
 				nsset = rrset;
 			} else {
@@ -1090,8 +1044,7 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
 	/* this is not required for basic operation but is a forgery 
 	 * resistance (security) feature */
 	if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR ||
-		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN ||
-		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_YXDOMAIN) &&
+		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
 		msg->qdcount == 0)
 		return 0;

@@ -1105,7 +1058,7 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
 	}

 	/* normalize the response, this cleans up the additional.  */
-	if(!scrub_normalize(pkt, msg, qinfo, region, env, zonename))
+	if(!scrub_normalize(pkt, msg, qinfo, region, env))
 		return 0;
 	/* delete all out-of-zone information */
 	if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie, qstate))
@@ -253,9 +253,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 	return 1;
 }

-/** filter out unsuitable targets.
- * Applies NAT64 if needed as well by replacing the IPv4 with the synthesized
- * IPv6 address.
+/** filter out unsuitable targets
 * @param iter_env: iterator environment with ipv6-support flag.
 * @param env: module environment with infra cache.
 * @param name: zone name
@@ -319,20 +317,6 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	   !addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip4 available */
 	}
-	if(iter_env->nat64.use_nat64 && !addr_is_ip6(&a->addr, a->addrlen)) {
-		struct sockaddr_storage real_addr;
-		socklen_t real_addrlen;
-		addr_to_nat64(&a->addr, &iter_env->nat64.nat64_prefix_addr,
-			iter_env->nat64.nat64_prefix_addrlen,
-			iter_env->nat64.nat64_prefix_net,
-			&real_addr, &real_addrlen);
-		log_name_addr(VERB_QUERY, "NAT64 apply: from: ",
-			name, &a->addr, a->addrlen);
-		log_name_addr(VERB_QUERY, "NAT64 apply:   to: ",
-			name, &real_addr, real_addrlen);
-		a->addr = real_addr;
-		a->addrlen = real_addrlen;
-	}
 	/* check lameness - need zone , class info */
 	if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen,
 		name, namelen, qtype, &lame, &dnsseclame, &reclame,
@@ -84,7 +84,6 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
 /**
 * Select a valid, nice target to send query to.
 * Sorting and removing unsuitable targets is combined.
- * Adds records to the infra cache if not already there.
 *
 * @param iter_env: iterator module global state, with ip6 enabled and 
 *	do-not-query-addresses.
@@ -2436,6 +2436,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	int tf_policy;
 	struct delegpt_addr* target;
 	struct outbound_entry* outq;
+	struct sockaddr_storage real_addr;
+	socklen_t real_addrlen;
 	int auth_fallback = 0;
 	uint8_t* qout_orig = NULL;
 	size_t qout_orig_len = 0;
@@ -3058,6 +3060,17 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->dnssec_lame_query?" but lame_query anyway": "");
 	}

+	real_addr = target->addr;
+	real_addrlen = target->addrlen;
+
+	if(ie->nat64.use_nat64 && target->addr.ss_family == AF_INET) {
+		addr_to_nat64(&target->addr, &ie->nat64.nat64_prefix_addr,
+			ie->nat64.nat64_prefix_addrlen, ie->nat64.nat64_prefix_net,
+			&real_addr, &real_addrlen);
+		log_name_addr(VERB_QUERY, "applied NAT64:",
+			iq->dp->name, &real_addr, real_addrlen);
+	}
+
 	fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
 	outq = (*qstate->env->send_query)(&iq->qinfo_out,
 		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0),
@@ -3069,7 +3082,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		!qstate->blacklist&&(!iter_qname_indicates_dnssec(qstate->env,
 		&iq->qinfo_out)||target->attempts==1)?0:BIT_CD),
 		iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted(
-		ie, iq), sq_check_ratelimit, &target->addr, target->addrlen,
+		ie, iq), sq_check_ratelimit, &real_addr, real_addrlen,
 		iq->dp->name, iq->dp->namelen,
 		(iq->dp->tcp_upstream || qstate->env->cfg->tcp_upstream),
 		(iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream),
@@ -3086,7 +3099,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		log_addr(VERB_QUERY, "error sending query to auth server",
-			&target->addr, target->addrlen);
+			&real_addr, real_addrlen);
 		if(qstate->env->cfg->qname_minimisation)
 			iq->minimisation_state = SKIP_MINIMISE_STATE;
 		return next_state(iq, QUERYTARGETS_STATE);
@@ -3603,7 +3616,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		return next_state(iq, INIT_REQUEST_STATE);
 	} else if(type == RESPONSE_TYPE_LAME) {
 		/* Cache the LAMEness. */
-		verbose(VERB_DETAIL, "query response was categorized as %sLAME",
+		verbose(VERB_DETAIL, "query response was %sLAME",
 			dnsseclame?"DNSSEC ":"");
 		if(!dname_subdomain_c(iq->qchase.qname, iq->dp->name)) {
 			log_err("mark lame: mismatch in qname and dpname");
@@ -3642,7 +3655,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * In this case, the event is just sent directly back to 
 		 * the QUERYTARGETS_STATE without resetting anything, 
 		 * because, clearly, the next target must be tried. */
-		verbose(VERB_DETAIL, "query response was categorized as THROWAWAY");
+		verbose(VERB_DETAIL, "query response was THROWAWAY");
 	} else {
 		log_warn("A query response came back with an unknown type: %d",
 			(int)type);
@@ -52,6 +52,7 @@
 #include "util/data/msgreply.h"
 #include "util/storage/slabhash.h"
 #include "util/edns.h"
+#include "util/tsig.h"
 #include "sldns/sbuffer.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_hints.h"
@@ -81,13 +82,15 @@ context_finalize(struct ub_ctx* ctx)
 		return UB_INITFAIL;
 	listen_setup_locks();
 	log_edns_known_options(VERB_ALGO, ctx->env);
+	if(!tsig_key_table_apply_cfg(ctx->env->tsig_key_table, cfg))
+		return UB_INITFAIL;
 	ctx->local_zones = local_zones_create();
 	if(!ctx->local_zones)
 		return UB_NOMEM;
 	if(!local_zones_apply_cfg(ctx->local_zones, cfg))
 		return UB_INITFAIL;
 	if(!auth_zones_apply_cfg(ctx->env->auth_zones, cfg, 1, &is_rpz,
-		ctx->env, &ctx->mods))
+		ctx->env, &ctx->mods, ctx->env->tsig_key_table))
 		return UB_INITFAIL;
 	if(!(ctx->env->fwds = forwards_create()) ||
 		!forwards_apply_cfg(ctx->env->fwds, cfg))
@@ -59,6 +59,7 @@
 #include "util/tube.h"
 #include "util/ub_event.h"
 #include "util/edns.h"
+#include "util/tsig.h"
 #include "services/modstack.h"
 #include "services/localzone.h"
 #include "services/cache/infra.h"
@@ -168,6 +169,18 @@ static struct ub_ctx* ub_ctx_create_nopipe(void)
 		errno = ENOMEM;
 		return NULL;
 	}
+	ctx->env->tsig_key_table = tsig_key_table_create();
+	if(!ctx->env->tsig_key_table) {
+		auth_zones_delete(ctx->env->auth_zones);
+		edns_known_options_delete(ctx->env);
+		edns_strings_delete(ctx->env->edns_strings);
+		config_delete(ctx->env->cfg);
+		free(ctx->env);
+		ub_randfree(ctx->seed_rnd);
+		free(ctx);
+		errno = ENOMEM;
+		return NULL;
+	}

 	ctx->env->alloc = &ctx->superalloc;
 	ctx->env->worker = NULL;
@@ -388,6 +401,7 @@ ub_ctx_delete(struct ub_ctx* ctx)
 		config_delete(ctx->env->cfg);
 		edns_known_options_delete(ctx->env);
 		edns_strings_delete(ctx->env->edns_strings);
+		tsig_key_table_delete(ctx->env->tsig_key_table);
 		forwards_delete(ctx->env->fwds);
 		hints_delete(ctx->env->hints);
 		auth_zones_delete(ctx->env->auth_zones);
@@ -853,7 +853,7 @@ Result: ['74.125.43.147', '74.125.43.99', '74.125.43.103', '74.125.43.104']
 %{ 
  //printf("resolve_start(%lX)\n",(long unsigned int)arg1);
  Py_BEGIN_ALLOW_THREADS 
-  $action
+  $function 
  Py_END_ALLOW_THREADS 
  //printf("resolve_stop()\n");
 %} 
@@ -853,8 +853,6 @@ struct ub_server_stats {
 	long long qquic;
 	/** number of queries removed due to discard-timeout */
 	long long num_queries_discard_timeout;
-	/** number of queries removed due to replyaddr limit */
-	long long num_queries_replyaddr_limit;
 	/** number of queries removed due to wait-limit */
 	long long num_queries_wait_limit;
 	/** number of dns error reports generated */
@@ -874,8 +872,6 @@ struct ub_stats_info {
 	long long mesh_num_states;
 	/** mesh stats: current number of reply (user) states */
 	long long mesh_num_reply_states;
-	/** mesh stats: current number of reply entries */
-	long long mesh_num_reply_addrs;
 	/** mesh stats: number of reply states overwritten with a new one */
 	long long mesh_jostled;
 	/** mesh stats: number of incoming queries dropped */
@@ -142,7 +142,7 @@ check_git_repo () {
 create_temp_dir () {
    # Creating temp directory
    info "Creating temporary working directory"
-    temp_dir=`mktemp -t -d unbound-dist-XXXXXX`
+    temp_dir=`mktemp -d unbound-dist-XXXXXX`
    info "Directory '$temp_dir' created."
    cd $temp_dir
 }
@@ -409,14 +409,7 @@ if [ "$DOWIN" = "yes" ]; then
 	info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 	git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"
 	cd unbound || error_cleanup "Unbound not exported correctly from git"
-	git submodule update --init || error_cleanup "Could not fetch submodule"
-	rm -rf .git .travis.yml .gitattributes .gitmodules .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
-	rm -rf simdzone/.git simdzone/.github simdzone/.gitignore \
-	       simdzone/configure~ simdzone/config.h.in~ simdzone/autom4te.cache \
-	       simdzone/cmake simdzone/CMakeLists.txt simdzone/simdzoneConfig.cmake.in \
-	       simdzone/conanfile.txt simdzone/tests simdzone/.readthedocs.yaml \
-	       simdzone/doc simdzone/scripts || \
-	       error_cleanup "Failed to remove simdzone .git tracking and ci information"
+	rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"

 	# on a re-configure the cache may no longer be valid...
 	if test -f mingw32-config.cache; then rm mingw32-config.cache; fi
@@ -443,14 +436,11 @@ if [ "$DOWIN" = "yes" ]; then
 	replace_version "configure.ac" "$version" "$version2"
    	version="$version2"
    	info "Rebuilding configure script (autoconf) snapshot."
-	autoreconf -fi || error_cleanup "Autoconf failed."
+	autoconf -f || error_cleanup "Autoconf failed."
 	autoheader -f || error_cleanup "Autoheader failed."
    	rm -r autom4te* || echo "ignored"
 	rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
 	rm -f configure~ || echo "ignore absence of configure~ file."
-	rm -r simdzone/autom4te* || echo "ignored"
-	rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
-	rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."
    fi

    if test "`uname`" = "Linux"; then 
@@ -608,15 +598,7 @@ info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"

 cd unbound || error_cleanup "Unbound not exported correctly from git"
-git submodule update --init || error_cleanup "Could not fetch submodule"
-rm -rf .git .travis.yml .gitattributes .gitmodules .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
-rm -rf simdzone/.git simdzone/.github simdzone/.gitignore \
-       simdzone/configure~ simdzone/config.h.in~ simdzone/autom4te.cache \
-       simdzone/cmake simdzone/CMakeLists.txt simdzone/simdzoneConfig.cmake.in \
-       simdzone/conanfile.txt simdzone/tests simdzone/.readthedocs.yaml \
-       simdzone/doc simdzone/scripts || \
-       error_cleanup "Failed to remove simdzone .git tracking and ci information"
-
+rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"

 info "Adding libtool utils (libtoolize)."
 libtoolize -c --install || libtoolize -c || error_cleanup "Libtoolize failed."
@@ -636,14 +618,11 @@ if [ `uname -s | grep -i -c darwin` -ne 0 ]; then
 fi

 info "Building configure script (autoreconf)."
-autoreconf -fi || error_cleanup "Autoconf failed."
+autoreconf -f || error_cleanup "Autoconf failed."

 rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
 rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
 rm -f configure~ || echo "ignore absence of configure~ file."
-rm -r simdzone/autom4te* || echo "ignored"
-rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
-rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."

 info "Building lexer and parser."
 echo "#include \"config.h\"" > util/configlexer.c || error_cleanup "Failed to create configlexer"
@@ -686,13 +665,10 @@ fi

 if [ "$RECONFIGURE" = "yes" ]; then
    info "Rebuilding configure script (autoconf) snapshot."
-    autoreconf -fi || error_cleanup "Autoconf failed."
+    autoreconf -f || error_cleanup "Autoconf failed."
    rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
    rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
    rm -f configure~ || echo "ignore absence of configure~ file."
-    rm -r simdzone/autom4te* || echo "ignored"
-    rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
-    rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."
 fi

 replace_all doc/README
@@ -709,7 +685,7 @@ info "Renaming Unbound directory to unbound-$version."
 cd ..
 mv unbound unbound-$version || error_cleanup "Failed to rename unbound directory."

-tarfile="$cwd/unbound-$version.tar.gz"
+tarfile="../unbound-$version.tar.gz"

 if [ -f $tarfile ]; then
    (question "The file $tarfile already exists.  Overwrite?" \
@@ -717,12 +693,14 @@ if [ -f $tarfile ]; then
 fi

 info "Creating tar unbound-$version.tar.gz"
-tar czf $tarfile unbound-$version || error_cleanup "Failed to create tar file."
+tar czf ../unbound-$version.tar.gz unbound-$version || error_cleanup "Failed to create tar file."

 cleanup

 storehash unbound-$version.tar.gz
 echo "create unbound-$version.tar.gz.asc with:"
 echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound-$version.tar.gz"
+echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound-$version.zip"
+echo "  gpg --armor --detach-sign --digest-algo SHA256 unbound_setup_$version.exe"

 info "Unbound distribution created successfully."
@@ -55,6 +55,8 @@ struct query_info;
 struct dns_msg;
 struct edns_data;
 struct module_env;
+struct tsig_data;
+struct tsig_key_table;
 struct worker;
 struct comm_point;
 struct comm_timer;
@@ -361,6 +363,8 @@ struct auth_probe {
 	struct comm_timer* timer;
 	/** timeout in msec */
 	int timeout;
+	/** the tsig data for the packet */
+	struct tsig_data* tsig;
 };

 /**
@@ -430,6 +434,8 @@ struct auth_transfer {
 	/** timeout for the transfer.
 	 * on the workers event base. */
 	struct comm_timer* timer;
+	/** the tsig data for the transfer */
+	struct tsig_data* tsig;
 };

 /** list of addresses */
@@ -461,6 +467,8 @@ struct auth_master {
 	int ssl;
 	/** the port number (for urls) */
 	int port;
+	/** the tsig key name (if any, or NULL) */
+	char* tsig_key_name;
 	/** if the host is a hostname, the list of resolved addrs, if any*/
 	struct auth_addr* list;
 };
@@ -490,11 +498,13 @@ struct auth_zones* auth_zones_create(void);
 * @param is_rpz: set to 1 if at least one RPZ zone is configured.
 * @param env: environment for offline verification.
 * @param mods: modules in environment.
+ * @param tsig_key_table: tsig key table to check if tsig keys exist.
+ *	If NULL, no check is performed.
 * @return false on failure.
 */
 int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
 	int setup, int* is_rpz, struct module_env* env,
-	struct module_stack* mods);
+	struct module_stack* mods, struct tsig_key_table* tsig_key_table);

 /** initial pick up of worker timeouts, ties events to worker event loop
 * @param az: auth zones structure
@@ -619,13 +629,19 @@ int auth_zones_can_fallback(struct auth_zones* az, uint8_t* nm, size_t nmlen,
 * @param has_serial: if true, the notify has a serial attached.
 * @param serial: the serial number, if has_serial is true.
 * @param refused: is set to true on failure to note refused access.
+ * @param pkt: the packet for TSIG verify.
+ * @param tsig: if TSIG, the structure is returned here, allocated in
+ *	the worker scratch region.
+ * @param tsig_rcode: if not NOERROR it is the TSIG error code, TSIG failed.
+ * @param scratchpad: region to allocate tsig in.
 * @return fail on failures (refused is false) and when access is
 * 	denied (refused is true).  True when processed.
 */
 int auth_zones_notify(struct auth_zones* az, struct module_env* env,
 	uint8_t* nm, size_t nmlen, uint16_t dclass,
 	struct sockaddr_storage* addr, socklen_t addrlen, int has_serial,
-	uint32_t serial, int* refused);
+	uint32_t serial, int* refused, struct sldns_buffer* pkt,
+	struct tsig_data** tsig, int* tsig_rcode, struct regional* scratchpad);

 /** process notify packet and read serial number from SOA.
 * returns 0 if no soa record in the notify */
@@ -671,10 +687,12 @@ struct auth_xfer* auth_xfer_create(struct auth_zones* az, struct auth_zone* z);
 * @param list: pointer to start of list.  The malloced list is returned here.
 * @param c: the config items to copy over.
 * @param with_http: if true, http urls are also included, before the masters.
+ * @param tsig_key_table: if nonNULL, used to check that tsig keys exist in
+ *	the key table.
 * @return false on failure.
 */
 int xfer_set_masters(struct auth_master** list, struct config_auth* c,
-	int with_http);
+	int with_http, struct tsig_key_table* tsig_key_table);

 /** xfer nextprobe timeout callback, this is part of task_nextprobe */
 void auth_xfer_timer(void* arg);
@@ -1269,8 +1269,7 @@ int infra_wait_limit_allowed(struct infra_cache* infra, struct comm_reply* rep,
 	int cookie_valid, struct config_file* cfg)
 {
 	struct lruhash_entry* entry;
-	if(cfg->wait_limit == 0 ||
-		(cookie_valid && cfg->wait_limit_cookie == 0))
+	if(cfg->wait_limit == 0)
 		return 1;

 	entry = infra_find_ip_ratedata(infra, &rep->client_addr,
@@ -1564,7 +1564,7 @@ listen_create(struct comm_base* base, struct listen_port* ports,
 			cp = comm_point_create_udp(base, ports->fd,
 				front->udp_buff, ports->pp2_enabled, cb,
 				cb_arg, ports->socket);
-		} else if(ports->ftype == listen_type_doq && doq_table) {
+		} else if(ports->ftype == listen_type_doq) {
 #ifndef HAVE_NGTCP2
 			log_warn("Unbound is not compiled with "
 				"ngtcp2. This is required to use DNS "
@@ -2884,7 +2884,6 @@ submit_http_error:
 	sldns_buffer_flip(h2_stream->qbuffer);
 	h2_session->postpone_drop = 1;
 	query_read_done = http2_query_read_done(h2_session, h2_stream);
-	h2_session->postpone_drop = 0;
 	if(query_read_done < 0)
 		return NGHTTP2_ERR_CALLBACK_FAILURE;
 	else if(!query_read_done) {
@@ -2894,9 +2893,11 @@ submit_http_error:
 			 * failure will result in reclaiming (and closing)
 			 * of comm point. */
 			verbose(VERB_QUERY, "http2 query dropped in worker cb");
+			h2_session->postpone_drop = 0;
 			return NGHTTP2_ERR_CALLBACK_FAILURE;
 		}
 		/* nothing to submit right now, query added to mesh. */
+		h2_session->postpone_drop = 0;
 		return 0;
 	}
 	if(!http2_submit_dns_response(h2_session)) {
@@ -3274,18 +3275,14 @@ nghttp2_session_callbacks* http2_req_callbacks_create(void)
 struct doq_table*
 doq_table_create(struct config_file* cfg, struct ub_randstate* rnd)
 {
-	struct doq_table* table;
-
-	if (!cfg->quic_port)
-		return NULL;
-	table = calloc(1, sizeof(*table));
+	struct doq_table* table = calloc(1, sizeof(*table));
 	if(!table)
 		return NULL;
 #ifdef USE_NGTCP2_CRYPTO_OSSL
 	/* Initialize the ossl crypto, it is harmless to call twice,
 	 * and this is before use of doq connections. */
 	if(ngtcp2_crypto_ossl_init() != 0) {
-		log_err("ngtcp2_crypto_ossl_init failed");
+		log_err("ngtcp2_crypto_oss_init failed");
 		free(table);
 		return NULL;
 	}
@@ -3357,7 +3354,7 @@ conn_tree_del(rbnode_type* node, void* arg)
 {
 	struct doq_table* table = (struct doq_table*)arg;
 	struct doq_conn* conn;
-	if(!node || !table)
+	if(!node)
 		return;
 	conn = (struct doq_conn*)node->key;
 	if(conn->timer.timer_in_list) {
@@ -3416,7 +3413,6 @@ doq_timer_find_time(struct doq_table* table, struct timeval* tv)
 {
 	struct doq_timer key;
 	struct rbnode_type* node;
-	log_assert(table != NULL);
 	memset(&key, 0, sizeof(key));
 	key.time.tv_sec = tv->tv_sec;
 	key.time.tv_usec = tv->tv_usec;
@@ -4926,7 +4922,6 @@ doq_conid_find(struct doq_table* table, const uint8_t* data, size_t datalen)
 	key.node.key = &key;
 	key.cid = (void*)data;
 	key.cidlen = datalen;
-	log_assert(table != NULL);
 	node = rbtree_search(table->conid_tree, &key);
 	if(node)
 		return (struct doq_conid*)node->key;
@@ -5667,8 +5662,6 @@ doq_table_quic_size_available(struct doq_table* table,
 	struct config_file* cfg, size_t mem)
 {
 	size_t cur;
-	if (!table)
-		return 0;
 	lock_basic_lock(&table->size_lock);
 	cur = table->current_size;
 	lock_basic_unlock(&table->size_lock);
@@ -231,7 +231,6 @@ mesh_create(struct module_stack* stack, struct module_env* env)
 	mesh->ans_expired = 0;
 	mesh->ans_cachedb = 0;
 	mesh->num_queries_discard_timeout = 0;
-	mesh->num_queries_replyaddr_limit = 0;
 	mesh->num_queries_wait_limit = 0;
 	mesh->num_dns_error_reports = 0;
 	mesh->max_reply_states = env->cfg->num_queries_per_thread;
@@ -442,18 +441,9 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	if(!infra_wait_limit_allowed(mesh->env->infra_cache, rep,
 		edns->cookie_valid, mesh->env->cfg)) {
 		verbose(VERB_ALGO, "Too many queries waiting from the IP. "
-			"servfail incoming query.");
+			"dropping incoming query.");
+		comm_point_drop_reply(rep);
 		mesh->num_queries_wait_limit++;
-		edns_opt_list_append_ede(&edns->opt_list_out,
-			mesh->env->scratch, LDNS_EDE_OTHER,
-			"Too many queries queued up and waiting from the IP");
-		if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL,
-			LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
-				edns->opt_list_inplace_cb_out = NULL;
-		error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
-			qinfo, qid, qflags, edns);
-		regional_free_all(mesh->env->scratch);
-		comm_point_send_reply(rep);
 		return;
 	}
 	if(!unique)
@@ -463,8 +453,6 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		if(!mesh_make_new_space(mesh, rep->c->buffer)) {
 			verbose(VERB_ALGO, "Too many queries. dropping "
 				"incoming query.");
-			if(rep->c->use_h2)
-				http2_stream_remove_mesh_state(rep->c->h2_stream);
 			comm_point_drop_reply(rep);
 			mesh->stats_dropped++;
 			return;
@@ -476,10 +464,8 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		if(mesh->num_reply_addrs > mesh->max_reply_states*16) {
 			verbose(VERB_ALGO, "Too many requests queued. "
 				"dropping incoming query.");
-			if(rep->c->use_h2)
-				http2_stream_remove_mesh_state(rep->c->h2_stream);
 			comm_point_drop_reply(rep);
-			mesh->num_queries_replyaddr_limit++;
+			mesh->stats_dropped++;
 			return;
 		}
 	}
@@ -1742,39 +1728,28 @@ void mesh_query_done(struct mesh_state* mstate)
 		dns_error_reporting(&mstate->s, rep);

 	for(r = mstate->reply_list; r; r = r->next) {
-		if(mesh_is_udp(r)) {
-			/* For UDP queries, the old replies are discarded.
-			 * This stops a large volume of old replies from
-			 * building up.
-			 * The stream replies, are not discarded. The
-			 * stream is open, the other side is waiting.
-			 * Some answer is needed, even if servfail, but the
-			 * real reply is ready to go, so that is given. */
-			struct timeval old;
-			timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
-			if(mstate->s.env->cfg->discard_timeout != 0 &&
-				((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
-				mstate->s.env->cfg->discard_timeout) {
-				/* Drop the reply, it is too old */
-				/* briefly set the reply_list to NULL, so that the
-				 * tcp req info cleanup routine that calls the mesh
-				 * to deregister the meshstate for it is not done
-				 * because the list is NULL and also accounting is not
-				 * done there, but instead we do that here. */
-				struct mesh_reply* reply_list = mstate->reply_list;
-				verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
-				infra_wait_limit_dec(mstate->s.env->infra_cache,
-					&r->query_reply, mstate->s.env->cfg);
-				mstate->reply_list = NULL;
-				if(r->query_reply.c->use_h2)
-					http2_stream_remove_mesh_state(r->h2_stream);
-				comm_point_drop_reply(&r->query_reply);
-				mstate->reply_list = reply_list;
-				log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
-				mstate->s.env->mesh->num_reply_addrs--;
-				mstate->s.env->mesh->num_queries_discard_timeout++;
-				continue;
-			}
+		struct timeval old;
+		timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
+		if(mstate->s.env->cfg->discard_timeout != 0 &&
+			((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
+			mstate->s.env->cfg->discard_timeout) {
+			/* Drop the reply, it is too old */
+			/* briefly set the reply_list to NULL, so that the
+			 * tcp req info cleanup routine that calls the mesh
+			 * to deregister the meshstate for it is not done
+			 * because the list is NULL and also accounting is not
+			 * done there, but instead we do that here. */
+			struct mesh_reply* reply_list = mstate->reply_list;
+			verbose(VERB_ALGO, "drop reply, it is older than discard-timeout");
+			infra_wait_limit_dec(mstate->s.env->infra_cache,
+				&r->query_reply, mstate->s.env->cfg);
+			mstate->reply_list = NULL;
+			if(r->query_reply.c->use_h2)
+				http2_stream_remove_mesh_state(r->h2_stream);
+			comm_point_drop_reply(&r->query_reply);
+			mstate->reply_list = reply_list;
+			mstate->s.env->mesh->num_queries_discard_timeout++;
+			continue;
 		}

 		i++;
@@ -1808,8 +1783,6 @@ void mesh_query_done(struct mesh_state* mstate)
 			}
 			comm_point_drop_reply(&r->query_reply);
 			mstate->reply_list = reply_list;
-			log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
-			mstate->s.env->mesh->num_reply_addrs--;
 		} else {
 			struct sldns_buffer* r_buffer = r->query_reply.c->buffer;
 			if(r->query_reply.c->tcp_req_info) {
@@ -2300,7 +2273,6 @@ mesh_stats_clear(struct mesh_area* mesh)
 	memset(&mesh->rpz_action[0], 0, sizeof(size_t)*UB_STATS_RPZ_ACTION_NUM);
 	mesh->ans_nodata = 0;
 	mesh->num_queries_discard_timeout = 0;
-	mesh->num_queries_replyaddr_limit = 0;
 	mesh->num_queries_wait_limit = 0;
 	mesh->num_dns_error_reports = 0;
 }
@@ -141,8 +141,6 @@ struct mesh_area {
 	size_t rpz_action[UB_STATS_RPZ_ACTION_NUM];
 	/** stats, number of queries removed due to discard-timeout */
 	size_t num_queries_discard_timeout;
-	/** stats, number of queries removed due to replyaddr limit */
-	size_t num_queries_replyaddr_limit;
 	/** stats, number of queries removed due to wait-limit */
 	size_t num_queries_wait_limit;
 	/** stats, number of dns error reports generated */
@@ -48,10 +48,6 @@
 #include "util/regional.h"
 #include "util/netevent.h"
 #include "dnstap/dnstap_config.h"
-#ifdef __QNX__
-/* For struct timeval */
-#include <sys/time.h>
-#endif /* __QNX__ */
 struct pending;
 struct pending_timeout;
 struct ub_randstate;
@@ -480,13 +480,11 @@ enum sldns_enum_ede_code
 	LDNS_EDE_TOO_EARLY = 26,
 	LDNS_EDE_UNSUPPORTED_NSEC3_ITERATIONS = 27,
 	LDNS_EDE_BADPROXYPOLICY = 28,
-	LDNS_EDE_SYNTHESIZED = 29,
-	LDNS_EDE_INVALID_QUERY_TYPE = 30
+	LDNS_EDE_SYNTHESIZED = 29
 };
 typedef enum sldns_enum_ede_code sldns_ede_code;

 #define LDNS_EDNS_MASK_DO_BIT 0x8000
-#define LDNS_EDNS_MASK_CO_BIT 0x4000

 /** TSIG and TKEY extended rcodes (16bit), 0-15 are the normal rcodes. */
 #define LDNS_TSIG_ERROR_NOERROR  0
@@ -496,6 +494,7 @@ typedef enum sldns_enum_ede_code sldns_ede_code;
 #define LDNS_TSIG_ERROR_BADMODE  19
 #define LDNS_TSIG_ERROR_BADNAME  20
 #define LDNS_TSIG_ERROR_BADALG   21
+#define LDNS_TSIG_ERROR_BADTRUNC 22

 /** DNS Cookie extended rcode */
 #define LDNS_EXT_RCODE_BADCOOKIE 23
@@ -56,6 +56,18 @@ sldns_read_uint32(const void *src)
 #endif
 }

+INLINE uint64_t
+sldns_read_uint48(const void *src)
+{
+        const uint8_t *p = (const uint8_t *) src;
+        return (  ((uint64_t) p[0] << 40)
+	        | ((uint64_t) p[1] << 32)
+	        | ((uint64_t) p[2] << 24)
+                | ((uint64_t) p[3] << 16)
+                | ((uint64_t) p[4] << 8)
+                |  (uint64_t) p[5]);
+}
+
 /*
 * Copy data allowing for unaligned accesses in network byte order
 * (big endian).
@@ -693,6 +705,32 @@ sldns_buffer_read_u32(sldns_buffer *buffer)
 	return result;
 }

+/**
+ * returns the 6-byte integer value at the given position in the buffer
+ * \param[in] buffer the buffer
+ * \param[in] at position in the buffer
+ * \return 6 byte integer
+ */
+INLINE uint64_t
+sldns_buffer_read_u48_at(sldns_buffer *buffer, size_t at)
+{
+	assert(sldns_buffer_available_at(buffer, at, 6));
+	return sldns_read_uint48(buffer->_data + at);
+}
+
+/**
+ * returns the 6-byte integer value at the current position in the buffer
+ * \param[in] buffer the buffer
+ * \return 6 byte integer
+ */
+INLINE uint64_t
+sldns_buffer_read_u48(sldns_buffer *buffer)
+{
+	uint64_t result = sldns_buffer_read_u48_at(buffer, buffer->_position);
+	buffer->_position += 6;
+	return result;
+}
+
 /**
 * returns the status of the buffer
 * \param[in] buffer
@@ -233,7 +233,6 @@ static sldns_lookup_table sldns_edns_ede_codes_data[] = {
 	{ LDNS_EDE_UNSUPPORTED_NSEC3_ITERATIONS, "Unsupported NSEC3 Iterations Value" },
 	{ LDNS_EDE_BADPROXYPOLICY, "Unable to Conform to Policy" },
 	{ LDNS_EDE_SYNTHESIZED, "Synthesized Answer" },
-	{ LDNS_EDE_INVALID_QUERY_TYPE, "Invalid Query Type" },
 	{ 0, NULL}
 };
 sldns_lookup_table* sldns_edns_ede_codes = sldns_edns_ede_codes_data;
@@ -256,6 +255,7 @@ static sldns_lookup_table sldns_tsig_errors_data[] = {
 	{ LDNS_TSIG_ERROR_BADMODE, "BADMODE" },
 	{ LDNS_TSIG_ERROR_BADNAME, "BADNAME" },
 	{ LDNS_TSIG_ERROR_BADALG, "BADALG" },
+	{ LDNS_TSIG_ERROR_BADTRUNC, "BADTRUNC" },
 	{ 0, NULL }
 };
 sldns_lookup_table* sldns_tsig_errors = sldns_tsig_errors_data;
@@ -2486,8 +2486,6 @@ int sldns_wire2str_edns_scan(uint8_t** data, size_t* data_len, char** str,
 	w += sldns_str_print(str, str_len, " flags:");
 	if((edns_bits & LDNS_EDNS_MASK_DO_BIT))
 		w += sldns_str_print(str, str_len, " do");
-	if((edns_bits & LDNS_EDNS_MASK_CO_BIT))
-		w += sldns_str_print(str, str_len, " co");
 	/* the extended rcode is the value set, shifted four bits,
 	 * and or'd with the original rcode */
 	if(ext_rcode) {
@@ -49,6 +49,7 @@
 #include "util/module.h"
 #include "util/net_help.h"
 #include "util/regional.h"
+#include "util/tsig.h"
 #include "iterator/iterator.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_hints.h"
@@ -1003,13 +1004,23 @@ static void
 check_auth(struct config_file* cfg)
 {
 	int is_rpz = 0;
+	struct tsig_key_table* tsig_key_table;
 	struct auth_zones* az = auth_zones_create();
-	if(!az || !auth_zones_apply_cfg(az, cfg, 0, &is_rpz, NULL, NULL)) {
+
+	/* construct tsig key table for tsig key name checks, and it
+	 * also checks the TSIG key name and algorithm and base64 syntax. */
+	tsig_key_table = tsig_key_table_create();
+	if(!tsig_key_table || !tsig_key_table_apply_cfg(tsig_key_table, cfg))
+		fatal_exit("Could not set up TSIG keys");
+
+	if(!az || !auth_zones_apply_cfg(az, cfg, 0, &is_rpz, NULL, NULL,
+		tsig_key_table)) {
 		fatal_exit("Could not setup authority zones");
 	}
 	if(is_rpz && !strstr(cfg->module_conf, "respip"))
 		fatal_exit("RPZ requires the respip module");
 	auth_zones_delete(az);
+	tsig_key_table_delete(tsig_key_table);
 }

 /** check config file */
@@ -236,8 +236,6 @@ static void pr_stats(const char* nm, struct ub_stats_info* s)
 		s->svr.num_queries_cookie_invalid);
 	PR_UL_NM("num.queries_discard_timeout",
 		s->svr.num_queries_discard_timeout);
-	PR_UL_NM("num.queries_replyaddr_limit",
-		s->svr.num_queries_replyaddr_limit);
 	PR_UL_NM("num.queries_wait_limit", s->svr.num_queries_wait_limit);
 	PR_UL_NM("num.cachehits",
 		s->svr.num_queries - s->svr.num_queries_missed_cache);
@@ -265,7 +263,6 @@ static void pr_stats(const char* nm, struct ub_stats_info* s)
 	PR_UL_NM("requestlist.exceeded", s->mesh_dropped);
 	PR_UL_NM("requestlist.current.all", s->mesh_num_states);
 	PR_UL_NM("requestlist.current.user", s->mesh_num_reply_states);
-	PR_UL_NM("requestlist.current.replies", s->mesh_num_reply_addrs);
 #ifndef S_SPLINT_S
 	sumwait.tv_sec = s->mesh_replies_sum_wait_sec;
 	sumwait.tv_usec = s->mesh_replies_sum_wait_usec;
@@ -2255,7 +2255,7 @@ create_doq_client_data(const char* svr, int port, struct ub_event_base* base,
 	/* Initialize the ossl crypto, it is harmless to call twice,
 	 * and this is before use of doq connections. */
 	if(ngtcp2_crypto_ossl_init() != 0)
-		fatal_exit("ngtcp2_crypto_ossl_init failed");
+		fatal_exit("ngtcp2_crypto_oss_init failed");
 #elif defined(HAVE_NGTCP2_CRYPTO_QUICTLS_INIT)
 	if(ngtcp2_crypto_quictls_init() != 0)
 		fatal_exit("ngtcp2_crypto_quictls_init failed");
@@ -222,8 +222,7 @@ read_http_headers(SSL* ssl, char* file, size_t flen, char* host, size_t hlen,
 		if(verb>=2) printf("read: %s\n", buf);
 		if(buf[0] == 0) {
 			int e = ERR_peek_error();
-			if(e)
-				printf("error string: %s\n", ERR_reason_error_string(e));
+			printf("error string: %s\n", ERR_reason_error_string(e));
 			return 1;
 		}
 		if(!process_one_header(buf, file, flen, host, hlen, vs))
@@ -247,8 +246,7 @@ setup_ctx(char* key, char* cert)
 #endif
 	if(!SSL_CTX_use_certificate_chain_file(ctx, cert)) {
 		int e = ERR_peek_error();
-		if(e)
-			printf("error string: %s\n", ERR_reason_error_string(e));
+		printf("error string: %s\n", ERR_reason_error_string(e));
 		print_exit("cannot read cert");
 	}
 	if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM))
@@ -142,10 +142,6 @@
 #include "util/netevent.h"
 #include "testcode/testpkts.h"
 #include "util/rbtree.h"
-#ifdef __QNX__
-/* For struct timeval */
-#include <sys/time.h>
-#endif /* __QNX__ */
 struct replay_answer;
 struct replay_moment;
 struct replay_range;
@@ -135,8 +135,6 @@ static void matchline(char* line, struct entry* e)
 			e->match_ttl = 1;
 		} else if(str_keyword(&parse, "DO")) {
 			e->match_do = 1;
-		} else if(str_keyword(&parse, "CO")) {
-			e->match_co = 1;
 		} else if(str_keyword(&parse, "noedns")) {
 			e->match_noedns = 1;
 		} else if(str_keyword(&parse, "ednsdata")) {
@@ -180,7 +178,7 @@ static void matchline(char* line, struct entry* e)

 /** parse REPLY line */
 static void replyline(char* line, uint8_t* reply, size_t reply_len,
-	int* do_flag, int* co_flag)
+	int* do_flag)
 {
 	char* parse = line;
 	if(reply_len < LDNS_HEADER_SIZE) error("packet too short for header");
@@ -238,8 +236,6 @@ static void replyline(char* line, uint8_t* reply, size_t reply_len,
 			LDNS_AD_SET(reply);
 		} else if(str_keyword(&parse, "DO")) {
 			*do_flag = 1;
-		} else if(str_keyword(&parse, "CO")) {
-			*co_flag = 1;
 		} else {
 			error("could not parse REPLY: '%s'", parse);
 		}
@@ -293,7 +289,6 @@ static struct entry* new_entry(void)
 	e->match_all_noedns = 0;
 	e->match_ttl = 0;
 	e->match_do = 0;
-	e->match_co = 0;
 	e->match_noedns = 0;
 	e->match_serial = 0;
 	e->ixfr_soa_serial = 0;
@@ -526,17 +521,15 @@ static void add_rr(char* rrstr, uint8_t* pktbuf, size_t pktsize,

 /* add EDNS 4096 opt record */
 static void
-add_edns(uint8_t* pktbuf, size_t pktsize, int do_flag, int co_flag,
-	uint8_t *ednsdata, uint16_t ednslen, size_t* pktlen)
+add_edns(uint8_t* pktbuf, size_t pktsize, int do_flag, uint8_t *ednsdata,
+	uint16_t ednslen, size_t* pktlen)
 {
 	uint8_t edns[] = {0x00, /* root label */
 		0x00, LDNS_RR_TYPE_OPT, /* type */
 		0x04, 0xD0, /* class is UDPSIZE 1232 */
 		0x00, /* TTL[0] is ext rcode */
 		0x00, /* TTL[1] is edns version */
-		(uint8_t)(do_flag?0x80:0x00)
-		| (uint8_t)(co_flag?0x40:0x00)
-		, 0x00, /* TTL[2-3] is edns flags, DO */
+		(uint8_t)(do_flag?0x80:0x00), 0x00, /* TTL[2-3] is edns flags, DO */
 		(uint8_t)((ednslen >> 8) & 0xff),
 		(uint8_t)(ednslen  & 0xff), /* rdatalength */
 	};
@@ -568,7 +561,6 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 	uint8_t pktbuf[MAX_PACKETLEN];
 	size_t pktlen = LDNS_HEADER_SIZE;
 	int do_flag = 0; /* DO flag in EDNS */
-	int co_flag = 0; /* CO flag in EDNS */
 	memset(pktbuf, 0, pktlen); /* ID = 0, FLAGS="", and rr counts 0 */

 	while(fgets(line, (int)sizeof(line), in) != NULL) {
@@ -606,7 +598,7 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 		if(str_keyword(&parse, "MATCH")) {
 			matchline(parse, current);
 		} else if(str_keyword(&parse, "REPLY")) {
-			replyline(parse, pktbuf, pktlen, &do_flag, &co_flag);
+			replyline(parse, pktbuf, pktlen, &do_flag);
 		} else if(str_keyword(&parse, "ADJUST")) {
 			adjustline(parse, current, cur_reply);
 		} else if(str_keyword(&parse, "EXTRA_PACKET")) {
@@ -662,16 +654,15 @@ read_entry(FILE* in, const char* name, struct sldns_file_parse_state* pstate,
 			if(hex_ednsdata_buffer)
 				sldns_buffer_free(hex_ednsdata_buffer);
 			if(pktlen != 0) {
-				if(do_flag || co_flag
-					|| cur_reply->raw_ednsdata) {
+				if(do_flag || cur_reply->raw_ednsdata) {
 					if(cur_reply->raw_ednsdata &&
 						sldns_buffer_limit(cur_reply->raw_ednsdata))
-						add_edns(pktbuf, sizeof(pktbuf), do_flag, co_flag,
+						add_edns(pktbuf, sizeof(pktbuf), do_flag,
 							sldns_buffer_begin(cur_reply->raw_ednsdata),
 							(uint16_t)sldns_buffer_limit(cur_reply->raw_ednsdata),
 							&pktlen);
 					else
-						add_edns(pktbuf, sizeof(pktbuf), do_flag, co_flag,
+						add_edns(pktbuf, sizeof(pktbuf), do_flag,
 							NULL, 0, &pktlen);
 				}
 				cur_reply->reply_pkt = memdup(pktbuf, pktlen);
@@ -918,22 +909,6 @@ get_do_flag(uint8_t* pkt, size_t len)
 	return (int)(edns_bits&LDNS_EDNS_MASK_DO_BIT);
 }

-/** return true if the CO flag is set */
-static int
-get_co_flag(uint8_t* pkt, size_t len)
-{
-	uint16_t edns_bits;
-	uint8_t* walk = pkt;
-	size_t walk_len = len;
-	if(!pkt_find_edns_opt(&walk, &walk_len)) {
-		return 0;
-	}
-	if(walk_len < 6)
-		return 0; /* malformed */
-	edns_bits = sldns_read_uint16(walk+4);
-	return (int)(edns_bits&LDNS_EDNS_MASK_CO_BIT);
-}
-
 /** Snips the specified EDNS option out of the OPT record and puts it in the
 *  provided buffer. The buffer should be able to hold any opt data ie 65535.
 *  Returns the length of the option written,
@@ -1679,10 +1654,6 @@ find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
 			verbose(3, "no DO bit set\n");
 			continue;
 		}
-		if(p->match_co && !get_co_flag(query_pkt, len)) {
-			verbose(3, "no CO bit set\n");
-			continue;
-		}
 		if(p->match_noedns && get_has_edns(query_pkt, len)) {
 			verbose(3, "bad; EDNS OPT present\n");
 			continue;
@@ -218,8 +218,6 @@ struct entry {
 	uint8_t match_ttl;
 	/** match DO bit */
 	uint8_t match_do;
-	/** match CO bit */
-	uint8_t match_co;
 	/** match absence of EDNS OPT record in query */
 	uint8_t match_noedns;
 	/** match edns data field given in hex */
@@ -207,11 +207,7 @@ rr_test_file(const char* input, const char* check)
 #define xstr(s) str(s)
 #define str(s) #s

-#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
-#else /* !__QNX__ */
-#define SRCDIRSTR "."
-#endif /* __QNX__ */

 /** read rrs to and from string, to and from wireformat */
 static void
@@ -283,7 +283,7 @@ net_test(void)
 		unit_assert(strcmp(astr, "1.2.3.0") == 0);
 		unit_assert(ntohs(((struct sockaddr_in*)&a)->sin_port)==53);

-		res = netblockstrtoaddr("2001:db8:33:44::/64", 53,
+		res = netblockstrtoaddr("2001:DB8:33:44::/64", 53,
 			&a, &alen, &net);
 		unit_assert(res!=0 && net == 64);
 		addr_to_str(&a, alen, astr, sizeof(astr));
@@ -1362,6 +1362,7 @@ main(int argc, char* argv[])
 #ifdef HAVE_NGTCP2
 	doq_test();
 #endif /* HAVE_NGTCP2 */
+	tsig_test();
 	if(log_get_lock()) {
 		lock_basic_destroy((lock_basic_type*)log_get_lock());
 	}
@@ -88,5 +88,7 @@ void tcpreuse_test(void);
 void doq_test(void);
 /** unit test for infra cache functions */
 void infra_test(void);
+/** unit test for tsig functions */
+void tsig_test(void);

 #endif /* TESTCODE_UNITMAIN_H */
@@ -498,11 +498,7 @@ testfromdrillfile(sldns_buffer* pkt, struct alloc_cache* alloc,
 #define xstr(s) str(s)
 #define str(s) #s

-#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
-#else /* !__QNX__ */
-#define SRCDIRSTR "."
-#endif /* __QNX__ */

 void msgparse_test(void)
 {
@@ -513,11 +513,8 @@ nsec3_hash_test(const char* fname)
 #define xstr(s) str(s)
 #define str(s) #s

-#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
-#else /* !__QNX__ */
-#define SRCDIRSTR "."
-#endif /* __QNX__ */
+
 #if defined(HAVE_SSL) && defined(USE_SHA1)
 /* Detect if openssl is configured to disable RSASHA1 signatures,
 * with the rh-allow-sha1-signatures disabled. */
@@ -634,7 +631,6 @@ rh_allow_sha1_signatures_disabled(void)
 void 
 verify_test(void)
 {
-	int do_sha1 = 1;
 	unit_show_feature("signature verify");

 #if defined(HAVE_SSL) && defined(USE_SHA1)
@@ -647,40 +643,27 @@ verify_test(void)
 #else
 		_putenv("OPENSSL_ENABLE_SHA1_SIGNATURES=1");
 #endif
-		do_sha1 = 1;
 	}
-#ifdef HAVE_EVP_DEFAULT_PROPERTIES_IS_FIPS_ENABLED
-	if (EVP_default_properties_is_fips_enabled(NULL))
-		do_sha1 = 0;
 #endif
-#endif /* HAVE_SSL and USE_SHA1 */

 #ifdef USE_SHA1
-	if(do_sha1) {
-		verifytest_file(SRCDIRSTR "/testdata/test_signatures.1", "20070818005004");
-	}
+	verifytest_file(SRCDIRSTR "/testdata/test_signatures.1", "20070818005004");
 #endif
 #if defined(USE_DSA) && defined(USE_SHA1)
-	if(do_sha1) {
-		verifytest_file(SRCDIRSTR "/testdata/test_signatures.2", "20080414005004");
-		verifytest_file(SRCDIRSTR "/testdata/test_signatures.3", "20080416005004");
-		verifytest_file(SRCDIRSTR "/testdata/test_signatures.4", "20080416005004");
-		verifytest_file(SRCDIRSTR "/testdata/test_signatures.5", "20080416005004");
-		verifytest_file(SRCDIRSTR "/testdata/test_signatures.6", "20080416005004");
-		verifytest_file(SRCDIRSTR "/testdata/test_signatures.7", "20070829144150");
-	}
+	verifytest_file(SRCDIRSTR "/testdata/test_signatures.2", "20080414005004");
+	verifytest_file(SRCDIRSTR "/testdata/test_signatures.3", "20080416005004");
+	verifytest_file(SRCDIRSTR "/testdata/test_signatures.4", "20080416005004");
+	verifytest_file(SRCDIRSTR "/testdata/test_signatures.5", "20080416005004");
+	verifytest_file(SRCDIRSTR "/testdata/test_signatures.6", "20080416005004");
+	verifytest_file(SRCDIRSTR "/testdata/test_signatures.7", "20070829144150");
 #endif /* USE_DSA */
 #ifdef USE_SHA1
-	if(do_sha1) {
-		verifytest_file(SRCDIRSTR "/testdata/test_signatures.8", "20070829144150");
-	}
+	verifytest_file(SRCDIRSTR "/testdata/test_signatures.8", "20070829144150");
 #endif
 #if (defined(HAVE_EVP_SHA256) || defined(HAVE_NSS) || defined(HAVE_NETTLE)) && defined(USE_SHA2)
 	verifytest_file(SRCDIRSTR "/testdata/test_sigs.rsasha256", "20070829144150");
 #  ifdef USE_SHA1
-	if(do_sha1) {
-		verifytest_file(SRCDIRSTR "/testdata/test_sigs.sha1_and_256", "20070829144150");
-	}
+	verifytest_file(SRCDIRSTR "/testdata/test_sigs.sha1_and_256", "20070829144150");
 #  endif
 	verifytest_file(SRCDIRSTR "/testdata/test_sigs.rsasha256_draft", "20090101000000");
 #endif
@@ -689,10 +672,8 @@ verify_test(void)
 	verifytest_file(SRCDIRSTR "/testdata/test_signatures.9", "20171215000000");
 #endif
 #ifdef USE_SHA1
-	if(do_sha1) {
-		verifytest_file(SRCDIRSTR "/testdata/test_sigs.hinfo", "20090107100022");
-		verifytest_file(SRCDIRSTR "/testdata/test_sigs.revoked", "20080414005004");
-	}
+	verifytest_file(SRCDIRSTR "/testdata/test_sigs.hinfo", "20090107100022");
+	verifytest_file(SRCDIRSTR "/testdata/test_sigs.revoked", "20080414005004");
 #endif
 #ifdef USE_GOST
 	if(sldns_key_EVP_load_gost_id())
@@ -718,9 +699,7 @@ verify_test(void)
 	}
 #endif
 #ifdef USE_SHA1
-	if(do_sha1) {
-		dstest_file(SRCDIRSTR "/testdata/test_ds.sha1");
-	}
+	dstest_file(SRCDIRSTR "/testdata/test_ds.sha1");
 #endif
 	nsectest();
 	nsec3_hash_test(SRCDIRSTR "/testdata/test_nsec3_hash.1");
@@ -50,11 +50,7 @@

 #define xstr(s) str(s)
 #define str(s) #s
-#ifndef __QNX__
 #define SRCDIRSTR xstr(SRCDIR)
-#else /* !__QNX__ */
-#define SRCDIRSTR "."
-#endif /* __QNX__ */

 /** Add zone from file for testing */
 struct auth_zone* authtest_addzone(struct auth_zones* az, const char* name,
@@ -40,8 +40,6 @@ grep -F -v -e "dnstap" hlist > ilist; mv ilist hlist
 grep -F -v -e "util/siphash.c" hlist > ilist; mv ilist hlist
 # filter out compat
 grep -F -v -e "compat/" hlist > ilist; mv ilist hlist
-# filter out simdzone
-grep -F -v -e "simdzone/" hlist > ilist; mv ilist hlist
 for h in `cat hlist`; do
 	if grep -F "`basename $h`" $PRE/doc/html/files.html >/dev/null; then
 		: # ok
@@ -24,7 +24,7 @@ server:
 	# specify every interface on a new 'interface:' labelled line.
 	interface: 192.0.2.153
 	interface: 192.0.2.154
-	interface: 2001:db8::5
+	interface: 2001:DB8::5

 	# port to answer queries from
 	port: 53
@@ -11,7 +11,7 @@ server:
 	# specify every interface on a new 'interface:' labelled line.
 	interface: 192.0.2.153
 	interface: 192.0.2.154
-	interface: 2001:db8::5
+	interface: 2001:DB8::5
 	interface: 0.0.0.0@5353

 	# config
@@ -1,341 +0,0 @@
-; config options
-server:
-	target-fetch-policy: "0 0 0 0 0"
-	access-control: 1.2.3.0/24 allow
-
-auth-zone:
-	name: "example.com."
-	## zonefile (or none).
-	## zonefile: "example.com.zone"
-	## master by IP address or hostname
-	## can list multiple masters, each on one line.
-	## master:
-	master: 1.2.3.44
-	## this is as a hostname, to test the hostname lookup.
-	allow-notify: svr.example.org
-	## url for http fetch
-	## url:
-	## queries from downstream clients get authoritative answers.
-	## for-downstream: yes
-	for-downstream: yes
-	## queries are used to fetch authoritative answers from this zone,
-	## instead of unbound itself sending queries there.
-	## for-upstream: yes
-	for-upstream: yes
-	## on failures with for-upstream, fallback to sending queries to
-	## the authority servers
-	## fallback-enabled: no
-
-	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
-	zonefile:
-TEMPFILE_NAME example.com
-	## this is the inline file /tmp/xxx.example.com
-	## the tempfiles are deleted when the testrun is over.
-TEMPFILE_CONTENTS example.com
-example.com. 3600 IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
-TEMPFILE_END
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test authority zone with lookup for a NOTIFY
-; The allow-notify is specified as a hostname.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-org. IN NS
-SECTION AUTHORITY
-org.	IN NS	ns.org.
-SECTION ADDITIONAL
-ns.org.	IN 	A	1.2.3.45
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com. IN A 1.2.3.44
-ENTRY_END
-RANGE_END
-
-; ns.org
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.45
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-org. IN NS
-SECTION ANSWER
-org.	IN NS	ns.org.
-SECTION ADDITIONAL
-ns.org. IN A 1.2.3.45
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.org. IN NS
-SECTION AUTHORITY
-example.org.	IN NS	ns.example.org.
-SECTION ADDITIONAL
-ns.example.org. IN A 1.2.3.46
-ENTRY_END
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.44
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.44
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-ns.example.net. IN A
-SECTION ANSWER
-ns.example.net. IN A	1.2.3.44
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-ns.example.net. IN AAAA
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-www.example.net. IN A	1.2.3.44
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.	IN NS	ns.example.net.
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN SOA
-SECTION ANSWER
-; serial, refresh, retry, expire, minimum
-example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOTIMPL
-SECTION QUESTION
-example.com. IN IXFR
-SECTION ANSWER
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-example.com. IN AXFR
-SECTION ANSWER
-example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
-example.com.	IN NS	ns.example.net.
-EXTRA_PACKET
-REPLY QR AA NOERROR
-SECTION QUESTION
-example.com. IN AXFR
-SECTION ANSWER
-www.example.com. IN A	1.2.3.4
-example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
-ENTRY_END
-RANGE_END
-
-; ns.example.org.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.46
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-example.org. IN NS
-SECTION ANSWER
-example.org.	IN NS	ns.example.org.
-SECTION ADDITIONAL
-ns.example.org.		IN 	A	1.2.3.46
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-svr.example.org. IN A
-SECTION ANSWER
-svr.example.org. IN A 1.2.3.47
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-svr.example.org. IN AAAA
-SECTION AUTHORITY
-example.org. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
-ENTRY_END
-RANGE_END
-
-; lookups for notify hostnames.
-STEP 1 TIME_PASSES ELAPSE 0
-
-; now the query
-STEP 2 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR AA RD RA NXDOMAIN
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-example.com. 3600 IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
-ENTRY_END
-
-; NOTIFY example.com
-STEP 30 QUERY ADDRESS 1.2.3.47
-ENTRY_BEGIN
-REPLY NOTIFY
-SECTION QUESTION
-example.com. IN SOA
-ENTRY_END
-; notify reply
-STEP 40 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RA NOTIFY NOERROR
-SECTION QUESTION
-example.com. IN SOA
-SECTION ANSWER
-ENTRY_END
-
-STEP 50 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 60 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR AA RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	1.2.3.4
-ENTRY_END
-
-; the zonefile was updated with new contents
-STEP 70 CHECK_TEMPFILE example.com
-FILE_BEGIN
-example.com.	3600	IN	SOA	ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
-example.com.	3600	IN	NS	ns.example.net.
-www.example.com.	3600	IN	A	1.2.3.4
-FILE_END
-
-SCENARIO_END
@@ -0,0 +1,16 @@
+BaseName: auth_tsig
+Version: 1.0
+Description: Perform AXFR with TSIG for authority zone.
+CreationDate: Fri 12 Sep 09:35:40 CEST 2025
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: auth_tsig.pre
+Post: auth_tsig.post
+Test: auth_tsig.test
+AuxFiles: 
+Passed:
+Failure:
@@ -0,0 +1,23 @@
+server:
+	logfile: "/dev/stderr"
+	xfrdfile: xfrd.state
+	username: ""
+	chroot: ""
+	zonesdir: ""
+	pidfile: "nsd.pid"
+	zonelistfile: "zone.list"
+	verbosity: 5
+	port: @NSD_PORT@
+	interface: 127.0.0.1@@NSD_PORT@
+
+key:
+	name: "test.key"
+	algorithm: sha256
+	secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
+
+zone:
+	name: "example.com"
+	zonefile: "example.com.zone"
+	provide-xfr: 0.0.0.0/0 test.key
+	provide-xfr: ::0/0 test.key
+	notify: 127.0.0.1@@UNBOUND_PORT@ test.key
@@ -0,0 +1,14 @@
+# #-- auth_tsig.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $NSD_PID
+kill_pid $UNBOUND_PID
+echo "nsd.log"
+cat nsd.log
+echo "unbound.log"
+cat unbound.log
@@ -0,0 +1,59 @@
+# #-- auth_tsig.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+#skip_test "Skip test due to no UDP service for SOA query"
+PRE="../.."
+if test -n "$NSD"; then
+	:
+else
+	if `which nsd >/dev/null 2>&1`; then
+		NSD="nsd"
+	else
+		if test -f $PRE/../nsd/nsd; then
+			NSD="$PRE/../nsd/nsd"
+		else
+			skip_test "need nsd"
+		fi
+	fi
+fi
+echo "NSD=$NSD"
+
+if test -f $PRE/unbound_do_valgrind_in_test; then
+	do_valgrind=yes
+else
+	do_valgrind=no
+fi
+VALGRIND_FLAGS="--leak-check=full --show-leak-kinds=all"
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+NSD_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "NSD_PORT=$NSD_PORT" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@UNBOUND_PORT\@/'$UNBOUND_PORT'/' -e 's/@NSD_PORT\@/'$NSD_PORT'/' < auth_tsig.ub.conf > ub.conf
+sed -e 's/@UNBOUND_PORT\@/'$UNBOUND_PORT'/' -e 's/@NSD_PORT\@/'$NSD_PORT'/' < auth_tsig.nsd.conf > nsd.conf
+
+# start nsd
+$NSD -d -c nsd.conf >nsd.log 2>&1 &
+NSD_PID=$!
+echo "NSD_PID=$NSD_PID" >> .tpkg.var.test
+
+# start unbound in the background
+if test $do_valgrind = "yes"; then
+valgrind $VALGRIND_FLAGS $PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+else
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+fi
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_nsd_up nsd.log
+wait_unbound_up unbound.log
@@ -0,0 +1,108 @@
+# #-- auth_tsig.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.4" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# update the zonefile.
+echo "www2.example.com. IN A 1.2.3.5" >> example.com.zone
+mv example.com.zone tmp.zone
+sed -e 's/2024082400/2024082401/' <tmp.zone >example.com.zone
+echo ""
+echo "new example.com.zone:"
+cat example.com.zone
+echo ""
+
+# NSD reloads the zone file,
+# sends notify to unbound, with TSIG.
+# unbound replies to the notify, with TSIG.
+# unbound fetches SOA record, with TSIG.
+# unbound fetches zone transfer, with TSIG.
+kill -1 `cat nsd.pid`
+
+# test if the zone has updated.
+dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 1
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+if grep NXDOMAIN outfile; then
+	echo "> try again"
+	sleep 10
+	dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.5" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+echo ""
+echo "zonefile: unbound-example.com.zone"
+cat unbound-example.com.zone
+echo ""
+
+exit 0
@@ -0,0 +1,26 @@
+server:
+	verbosity: 7
+	num-threads: 1
+	interface: 127.0.0.1
+	port: @UNBOUND_PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	log-queries: yes
+
+# This tsig key is used for testing.
+tsig-key:
+	name: "test.key"
+	algorithm: sha256
+	secret: "K2tf3TRjvQkVCmJF3/Z9vA=="
+
+auth-zone:
+	name: "example.com"
+	zonefile: "unbound-example.com.zone"
+	for-upstream: yes
+	for-downstream: yes
+	primary-tsig: "127.0.0.1@@NSD_PORT@" test.key
+	allow-notify-tsig: "127.0.0.2@@NSD_PORT@" test.key
@@ -0,0 +1,4 @@
+example.com.		240	IN	SOA	ns.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2024082400 28800 7200 604800 240
+example.com. NS ns.example.com.
+ns.example.com. IN A 192.0.2.1
+www.example.com. A 1.2.3.4
@@ -5,7 +5,6 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
-	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -5,7 +5,6 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
-	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -5,7 +5,6 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
-	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -5,7 +5,6 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
-	iter-scrub-promiscuous: no
 stub-zone:
 	name: "."
 	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
@@ -8,7 +8,6 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
-	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -8,7 +8,6 @@ server:
 	fake-sha1: yes
 	trust-anchor-signaling: no
 	minimal-responses: no
-	iter-scrub-promiscuous: no
 	rrset-roundrobin: no

 stub-zone:
@@ -5,7 +5,6 @@ server:
 	qname-minimisation: "no"
 	trust-anchor-signaling: no
 	minimal-responses: no
-	iter-scrub-promiscuous: no
 	disable-edns-do: yes

 stub-zone:
@@ -7,7 +7,6 @@ server:
 	dns64-ignore-aaaa: ip6ignore.example.com
 	dns64-ignore-aaaa: ip6only.example.com
 	minimal-responses: no
-	iter-scrub-promiscuous: no

 stub-zone:
 	name: "."
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
W.C.A. Wijngaards	8687d69131	Merge branch 'master' into xfr-tsig	2025-10-01 15:52:40 +02:00
W.C.A. Wijngaards	c622a71a28	- xfr-tsig, flip buffer after tsig_sign_reply, but not for error_encode.	2025-10-01 15:52:15 +02:00
W.C.A. Wijngaards	ecfc6a70ce	- xfr-tsig, note tsig-key support for fast_reload.	2025-09-12 16:38:09 +02:00
W.C.A. Wijngaards	a23c5347a7	- xfr-tsig, unit test shows zonefile that is created.	2025-09-12 15:43:45 +02:00
W.C.A. Wijngaards	1ae8be6847	- xfr-tsig, fast reload support for tsig keys.	2025-09-12 15:38:39 +02:00
W.C.A. Wijngaards	f0268d3e83	- xfr-tsig, log TSIG key name with zone and notify information. Clear tsig data before making a new one.	2025-09-12 14:58:49 +02:00
W.C.A. Wijngaards	c904a3d375	- xfr-tsig, remove rpl unit test.	2025-09-12 11:23:29 +02:00
W.C.A. Wijngaards	b451cc4af7	- xfr-tsig, add tdir test that performs tsig signed zone transfer.	2025-09-12 10:40:23 +02:00
W.C.A. Wijngaards	f9713f9fe5	Merge branch 'master' into xfr-tsig	2025-09-12 09:27:23 +02:00
W.C.A. Wijngaards	dfac72edfc	- xfr-tsig, unit test use to make tsig for rpl.	2025-09-11 17:05:58 +02:00
W.C.A. Wijngaards	64e102aacb	- xfr-tsig, fix notify tsig answer, fix parse edns allows TSIG, unit test for auth zone with notify with tsig and notify answer with tsig.	2025-09-11 16:21:38 +02:00
W.C.A. Wijngaards	bebd6c0f96	- xfr-tsig, use tsig_parse_verify_reply_xfr for zone transfers with TSIG.	2025-09-10 15:45:37 +02:00
W.C.A. Wijngaards	63aa70ab32	- xfr-tsig, unit test for tsig sign every couple packets, and verify that.	2025-09-10 15:26:57 +02:00
W.C.A. Wijngaards	7b59014ba3	- xfr-tsig, unit test with another trace of tsig every couple packets.	2025-09-09 16:24:55 +02:00
W.C.A. Wijngaards	156846e6c4	- xfr-tsig, unit test to verify tsig every couple packets.	2025-09-09 15:50:14 +02:00
W.C.A. Wijngaards	aea2a821b9	- xfr-tsig, unit test for tsig-verify-reply-xfr, with output that works with dig and NSD.	2025-09-09 15:40:51 +02:00
W.C.A. Wijngaards	cacdfee755	Merge branch 'master' into xfr-tsig	2025-09-09 14:38:03 +02:00
W.C.A. Wijngaards	e3c1981a6a	- xfr-tsig, fix algorithm name write in xfr reply tsig and unit test that works with output that works with dig and NSD.	2025-09-09 14:36:33 +02:00
W.C.A. Wijngaards	e2efd17007	- xfr-tsig, unit test tsig-sign-reply-xfr implementation.	2025-09-05 16:45:15 +02:00
W.C.A. Wijngaards	4a2dc1df48	Merge branch 'master' into xfr-tsig	2025-09-05 15:00:31 +02:00
W.C.A. Wijngaards	5c79fd9a0b	- xfr-tsig, tsig_parse_verify_reply_xfr and tsig_sign_reply_xfr.	2025-09-05 14:55:36 +02:00
W.C.A. Wijngaards	4a3a4f474f	Merge branch 'master' into xfr-tsig	2025-08-27 16:30:03 +02:00
W.C.A. Wijngaards	708581579c	- xfr-tsig, add test case with AXFR packet with TSIG.	2025-08-27 15:52:08 +02:00
W.C.A. Wijngaards	af1d430759	- xfr-tsig, log rcode for received notifies.	2025-08-20 15:55:29 +02:00
W.C.A. Wijngaards	da72734240	- xfr-tsig, tsig_get_mem function.	2025-08-19 16:46:12 +02:00
W.C.A. Wijngaards	54175a4180	Merge branch 'master' into xfr-tsig	2025-08-19 15:27:43 +02:00
W.C.A. Wijngaards	888d5ce9f9	- xfr-tsig, TSIG for SOA probe, notify, and on xfr first packet.	2025-08-19 15:27:16 +02:00
W.C.A. Wijngaards	b1bb4a4592	- xfr-tsig, check that tsig keys exist at startup and in unbound-checkconf.	2025-07-31 17:02:55 +02:00
W.C.A. Wijngaards	3b88577dd1	Merge branch 'master' into xfr-tsig	2025-07-31 15:59:25 +02:00
W.C.A. Wijngaards	6634b8bcc5	- xfr-tsig, primary-tsig: addr tsig and allow-notify-tsig: addr tsig.	2025-07-31 14:43:43 +02:00
W.C.A. Wijngaards	3d7dfe2f36	- xfr-tsig, unit test for tsig_verify_reply for failed tsig.	2025-07-23 16:35:25 +02:00
W.C.A. Wijngaards	baee7885bd	Merge branch 'master' into xfr-tsig	2025-07-23 16:23:58 +02:00
W.C.A. Wijngaards	e55b3a2a4c	- xfr-tsig, unit test for tsig_verify_reply.	2025-07-23 16:16:41 +02:00
W.C.A. Wijngaards	e4069e5619	Merge branch 'master' into xfr-tsig	2025-07-11 15:27:40 +02:00
W.C.A. Wijngaards	a3ec9a974f	- xfr-tsig, member comments for struct tsig_calc_state_crypto.	2025-07-11 15:18:11 +02:00
W.C.A. Wijngaards	479b954118	- xfr-tsig, implemented tsig_calc_state_crypto.	2025-07-11 10:08:48 +02:00
W.C.A. Wijngaards	0955238cd3	- xfr-tsig, tsig_verify_reply function.	2025-06-27 14:26:15 +02:00
W.C.A. Wijngaards	57dd6a971d	- xfr-tsig, extra unit tests for tsig_sign_reply.	2025-06-27 11:29:41 +02:00
W.C.A. Wijngaards	6a831e3063	- xfr-tsig, more explanation in testcode/unittsig.c.	2025-06-27 11:03:25 +02:00
W.C.A. Wijngaards	3807bf00da	- xfr-tsig, unit test for tsig_sign_reply.	2025-06-27 10:59:36 +02:00
W.C.A. Wijngaards	9022381be4	- xfr-tsig, more explanation in testcode/unittsig.c.	2025-06-27 09:29:57 +02:00
W.C.A. Wijngaards	ca147a147d	- xfr-tsig, unit test for tsig_sign_shared and tsig_verify_shared.	2025-06-27 09:24:51 +02:00
W.C.A. Wijngaards	5147e5aee9	- xfr-tsig, tsig_sign_shared function.	2025-06-27 08:52:32 +02:00
W.C.A. Wijngaards	6466513cc5	- xfr-tsig, unit test argument parse code.	2025-06-26 16:59:44 +02:00
W.C.A. Wijngaards	7a1a615fd3	- xfr-tsig, tsig_verify_shared function.	2025-06-26 15:11:25 +02:00
W.C.A. Wijngaards	81d774fb11	- xfr-tsig, tsig_sign_reply function.	2025-06-26 12:41:10 +02:00
W.C.A. Wijngaards	0254317e0d	- xfr-tsig, fix unit test parse of tsig error code.	2025-06-25 14:52:16 +02:00
W.C.A. Wijngaards	dc37849546	- xfr-tsig, test cases for BADTRUNC and not parseable.	2025-06-25 14:19:22 +02:00
W.C.A. Wijngaards	766666139b	Merge branch 'master' into xfr-tsig	2025-06-25 14:05:06 +02:00
W.C.A. Wijngaards	86e78fcacc	xfr-tsig, remove debug	2025-06-25 14:03:52 +02:00
W.C.A. Wijngaards	47a2d71fd3	- xfr-tsig, unit test cases for tsig errors.	2025-06-25 14:03:12 +02:00
W.C.A. Wijngaards	0719ef21fa	- xfr-tsig, unit test for tsig_verify_query.	2025-06-25 12:06:15 +02:00
W.C.A. Wijngaards	6d5f22b56d	- xfr-tsig, fix tsig_verify_query.	2025-06-25 10:21:42 +02:00
W.C.A. Wijngaards	b5beb800c8	- xfr-tsig, tsig_find_rr function.	2025-06-24 16:51:41 +02:00
W.C.A. Wijngaards	fe63b25441	- xfr-tsig, parse and verify query tsig.	2025-06-24 16:31:18 +02:00
W.C.A. Wijngaards	0afbb68b40	- xfr-tsig, other data content matches the other len when written.	2025-06-20 16:57:24 +02:00
W.C.A. Wijngaards	4562cd372c	- xfr-tsig, whitespace.	2025-06-20 14:43:19 +02:00
W.C.A. Wijngaards	418ef3765d	Merge branch 'master' into xfr-tsig	2025-06-20 14:33:02 +02:00
W.C.A. Wijngaards	29c8b3edba	- xfr-tsig, unit tests for md5, sha1, sha224, sha256, sha384 and sha512.	2025-06-20 14:31:44 +02:00
W.C.A. Wijngaards	5214912555	Merge branch 'master' into xfr-tsig	2025-06-20 12:14:13 +02:00
W.C.A. Wijngaards	f2c609b9a5	- xfr-tsig, unit test for tsig_sign_query.	2025-06-20 12:13:51 +02:00
W.C.A. Wijngaards	aa22fd936e	- xfr-tsig, test buffer size.	2025-06-18 17:01:35 +02:00
W.C.A. Wijngaards	4bbb74da39	- xfr-tsig, tsig test.	2025-06-18 16:41:10 +02:00
W.C.A. Wijngaards	dd4ee42eb6	- xfr-tsig, tsig_sign_query.	2025-06-18 15:00:18 +02:00
W.C.A. Wijngaards	8b95785b8c	- xfr-tsig, tsig functions.	2025-06-18 12:18:20 +02:00
W.C.A. Wijngaards	bb4ddab77a	Merge branch 'master' into xfr-tsig	2025-06-17 16:55:18 +02:00
W.C.A. Wijngaards	69354298fc	- xfr-tsig, tsig_create and tsig_delete.	2025-06-17 16:54:52 +02:00
W.C.A. Wijngaards	bbcf5d122a	Merge branch 'master' into xfr-tsig	2025-06-16 17:00:12 +02:00
W.C.A. Wijngaards	497161f72f	- xfr-tsig, tsig_verify return failure comment improved.	2025-06-16 16:59:53 +02:00
W.C.A. Wijngaards	31e8118b76	- xfr-tsig, man page and example config.	2025-06-13 16:32:36 +02:00
W.C.A. Wijngaards	8811bd4844	- xfr-tsig, tsig-key, with name, algorithm and secret options.	2025-06-13 12:12:49 +02:00
W.C.A. Wijngaards	0f02479dea	- xfr-tsig, fix algorithm lookup.	2025-06-13 10:17:47 +02:00
W.C.A. Wijngaards	364edccebc	- xfr-tsig, algorithm table.	2025-06-13 10:15:41 +02:00
W.C.A. Wijngaards	3d9242b3d3	- xfr-tsig, key table.	2025-06-12 16:05:10 +02:00
W.C.A. Wijngaards	3f378c962f	- xfr-tsig, check rdata length in tsig verify.	2025-06-12 14:34:56 +02:00
W.C.A. Wijngaards	4ca37bcadf	Merge branch 'master' into xfr-tsig	2025-06-12 12:17:13 +02:00
W.C.A. Wijngaards	19492da154	- xfr-tsig, check buffer remaining in tsig verify.	2025-06-12 11:50:11 +02:00
W.C.A. Wijngaards	182e580fe2	- xfr-tsig, fix warning in compile of declaration.	2025-06-12 09:57:23 +02:00
W.C.A. Wijngaards	eefb417c09	- xfr-tsig, const for dname compare and fix warnings in compile.	2025-06-12 09:53:56 +02:00
W.C.A. Wijngaards	4fd0d84e66	- xfr-tsig, update header comment.	2025-06-12 09:49:20 +02:00
W.C.A. Wijngaards	ea0973002f	- xfr-tsig, constant time memcmp is used.	2025-06-12 09:34:07 +02:00
W.C.A. Wijngaards	8fcc4c98b6	Merge branch 'master' into xfr-tsig	2025-06-12 09:29:28 +02:00
W.C.A. Wijngaards	7edc1e0fc4	- xfr-tsig, import the tsig verify code from hackathon/poisonlicious branch.	2025-06-12 09:25:54 +02:00
W.C.A. Wijngaards	e6573fc337	- xfr-tsig, create util/tsig.c and util/tsig.h.	2023-04-14 14:05:15 +02:00