Merge ~lvoytek/ubuntu/+source/bind9:MRE-lunar-9.18.18 into ubuntu/+source/bind9:ubuntu/lunar-devel

[Lena Voytek]

MRE update for lunar to 9.18.18

PPA: https://launchpad.net/~lvoytek/+archive/ubuntu/bind9-mre

local autopkgtest results:

autopkgtest [13:03:19]: @@@@@@@@@@@@@@@@@@@@ summary
simpletest PASS
validation FLAKY non-zero exit status 1
zonetest PASS
qemu-system-x86_64: terminating on signal 15 from pid 91464 (/usr/bin/python3)

validation is still broken as expected.

This will also require a bind-dyndb-ldap update with a patch once this gets to proposed.

[Andreas Hasenack (ahasenack)]

Grabbing this

[Andreas Hasenack (ahasenack)]

> bind9 (1:9.18.18-0ubuntu0.23.04.1) lunar; urgency=medium
>
> * New upstream release 9.18.18 (LP: #2028413)
> - Updates:

In d/changelog, indentation of the "New upstream release" line is starting on column 1.

Even though #2015176 is being fixed as part of the MRE, and does not *necessarily* require the SRU template, I think it's worth it filling it out here because of the test case. Mostly you can refer to the MRE bug, but the test plan should be easy to write and follow.

+1 with the changelog update

review: Approve

[Andreas Hasenack (ahasenack)]

Uhoh https://ubuntu.com/security/notices/USN-6390-1

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, lvoytek
Uploaders: ahasenack
MP auto-approved

review: Approve

[Lena Voytek (lvoytek)]

Alright, updated and rebased both the lunar and jammy mps and wrote out the SRU template for the HMAC-MD5 key bug. Changes are publishing in my PPA now

[Andreas Hasenack (ahasenack)]

+1, a final DEP8 check can be done in the ppa once everything is rebuilt.

Security published bind-dyndb-ldap to the security pocket already.

review: Approve

[Lena Voytek (lvoytek)]

local autopkgtest run complete:

autopkgtest [11:26:25]: @@@@@@@@@@@@@@@@@@@@ summary
simpletest PASS
validation FLAKY non-zero exit status 1
zonetest PASS
dyndb-ldap PASS
qemu-system-x86_64: terminating on signal 15 from pid 30674 (/usr/bin/python3)

[Andreas Hasenack (ahasenack)]

+1

review: Approve

[Lena Voytek (lvoytek)]

Thanks for all the help! Would you be willing to sponsor these uploads for me?

[Andreas Hasenack (ahasenack)]

Of course, I'm just checking lunar now

[Andreas Hasenack (ahasenack)]

Uploaded with rich history:

Uploading bind9_9.18.18-0ubuntu0.23.04.1.dsc
Uploading bind9_9.18.18.orig.tar.xz
Uploading bind9_9.18.18.orig.tar.xz.asc
Uploading bind9_9.18.18-0ubuntu0.23.04.1.debian.tar.xz
Uploading bind9_9.18.18-0ubuntu0.23.04.1_source.buildinfo
Uploading bind9_9.18.18-0ubuntu0.23.04.1_source.changes

diff --git a/CHANGES b/CHANGES
index e46a324..3f4e364 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,261 @@
+	--- 9.18.18 released ---
+
+6220.	[func]		Deprecate the 'dialup' and 'heartbeat-interval'
+			options. [GL #3700]
+
+6219.	[bug]		Ignore 'max-zone-ttl' on 'dnssec-policy insecure'.
+			[GL #4032]
+
+6215.	[protocol]	Return REFUSED to GSS-API TKEY requests if GSS-API
+			support is not configured. [GL #4225]
+
+6213.	[bug]		Mark a primary server as temporarily unreachable if the
+			TCP connection attempt times out. [GL #4215]
+
+6212.	[bug]		Don't process detach and close netmgr events when
+			the netmgr has been paused. [GL #4200]
+
+	--- 9.18.17 released ---
+
+6206.	[bug]		Add shutdown checks in dns_catz_dbupdate_callback() to
+			avoid a race with dns_catz_shutdown_catzs(). [GL #4171]
+
+6205.	[bug]		Restore support to read legacy HMAC-MD5 K file pairs.
+			[GL #4154]
+
+6204.	[bug]		Use NS records for relaxed QNAME-minimization mode.
+			This reduces the number of queries named makes when
+			resolving, as it allows the non-existence of NS RRsets
+			at non-referral nodes to be cached in addition to the
+			referrals that are normally cached. [GL #3325]
+
+6200.	[bug]		Fix nslookup erroneously reporting a timeout when the
+			input is delayed. [GL #4044]
+
+6199.	[bug]		Improve HTTP Connection: header protocol conformance
+			in the statistics channel. [GL #4126]
+
+6198.	[func]		Remove the holes in the isc_result_t enum to compact
+			the isc_result tables. [GL #4149]
+
+6197.	[bug]		Fix a data race between the dns_zone and dns_catz
+			modules when registering/unregistering a database
+			update notification callback for a catalog zone.
+			[GL #4132]
+
+6196.	[cleanup]	Report "permission denied" instead of "unexpected error"
+			when trying to update a zone file on a read-only file
+			system. Thanks to Midnight Veil. [GL #4134]
+
+6193.	[bug]		Fix a catz db update notification callback registration
+			logic error, which could crash named when receiving an
+			AXFR update for a catalog zone while the previous update
+			process of the catalog zone was already running.
+			[GL #4136]
+
+6166.	[func]		Retry without DNS COOKIE on FORMERR if it appears that
+			the FORMERR was due to the presence of a DNS COOKIE
+			option. [GL #4049]
+
+	--- 9.18.16 released ---
+
+6192.	[security]	A query that prioritizes stale data over lookup
+			triggers a fetch to refresh the stale data in cache.
+			If the fetch is aborted for exceeding the recursion
+			quota, it was possible for 'named' to enter an infinite
+			callback loop and crash due to stack overflow. This has
+			been fixed. (CVE-2023-2911) [GL #4089]
+
+6190.	[security]	Improve the overmem cleaning process to prevent the
+			cache going over the configured limit. (CVE-2023-2828)
+			[GL #4055]
+
+6188.	[performance]	Reduce memory consumption by allocating properly
+			sized send buffers for stream-based transports.
+			[GL #4038]
+
+6186.	[bug]		Fix a 'clients-per-query' miscalculation bug. When the
+			'stale-answer-enable' options was enabled and the
+			'stale-answer-client-timeout' option was enabled and
+			larger than 0, named was taking two places from the
+			'clients-per-query' limit for each client and was
+			failing to gradually auto-tune its value, as configured.
+			[GL #4074]
+
+6185.	[func]		Add "ClientQuota" statistics channel counter, which
+			indicates the number of the resolver's spilled queries
+			due to reaching the clients per query quota. [GL !7978]
+
+6183.	[bug]		Fix a serve-stale bug where a delegation from cache
+			could be returned to the client. [GL #3950]
+
+6182.	[cleanup]	Remove configure checks for epoll, kqueue and
+			/dev/poll. [GL #4098]
+
+6181.	[func]		The "tkey-dhkey" option has been deprecated; a
+			warning will be logged when it is used. In a future
+			release, Diffie-Hellman TKEY mode will be removed.
+			[GL #3905]
+
+6180.	[bug]		The session key object could be incorrectly added
+			to multiple different views' keyrings. [GL #4079]
+
+6179.	[bug]		Fix an interfacemgr use-after-free error in
+			zoneconf.c:isself(). [GL #3765]
+
+6176.	[test]		Add support for using pytest & pytest-xdist to
+			execute the system test suite. [GL #3978]
+
+6174.	[bug]		BIND could get stuck on reconfiguration when a
+			'listen' statement for HTTP is removed from the
+			configuration. That has been fixed. [GL #4071]
+
+6173.	[bug]		Properly process extra "nameserver" lines in
+			resolv.conf otherwise the next line is not properly
+			processed. [GL #4066]
+
+6169.	[bug]		named could crash when deleting inline-signing zones
+			with "rndc delzone". [GL #4054]
+
+6165.	[bug]		Fix a logic error in dighost.c which could call the
+			dighost_shutdown() callback twice and cause problems
+			if the callback function was not idempotent. [GL #4039]
+
+	--- 9.18.15 released ---
+
+6164.	[bug]		Set the rndc idle read timeout back to 60 seconds,
+			from the netmgr default of 30 seconds, in order to
+			match the behavior of 9.16 and earlier. [GL #4046]
+
+6161.	[bug]		Fix log file rotation when using absolute path as
+			file. [GL #3991]
+
+6157.	[bug]		When removing delegations in an OPTOUT range
+			empty-non-terminal NSEC3 records generated by
+			those delegations were not removed. [GL #4027]
+
+6156.	[bug]		Reimplement the maximum and idle timeouts for incoming
+			zone tranfers. [GL #4004]
+
+6155.	[bug]		Treat ISC_R_INVALIDPROTO as a networking error
+			in the dispatch code to avoid retrying with the
+			same server. [GL #4005]
+
+6152.	[bug]		In dispatch, honour the configured source-port
+			selection when UDP connection fails with address
+			in use error.
+
+			Also treat ISC_R_NOPERM same as ISC_R_ADDRINUSE.
+			[GL #3986]
+
+6149.	[test]		As a workaround, include an OpenSSL header file before
+			including cmocka.h in the unit tests, because OpenSSL
+			3.1.0 uses __attribute__(malloc), conflicting with a
+			redefined malloc in cmocka.h. [GL #4000]
+
+	--- 9.18.14 released ---
+
+6145.	[bug]		Fix a possible use-after-free bug in the
+			dns__catz_done_cb() function. [GL #3997]
+
+6143.	[bug]		A reference counting problem on the error path in
+			the xfrin_connect_done() might cause an assertion
+			failure on shutdown.  [GL #3989]
+
+6142.	[bug]		Reduce the number of dns_dnssec_verify calls made
+			determining if revoked keys needs to be removed from
+			the trust anchors. [GL #3981]
+
+6141.	[bug]		Fix several issues in nsupdate timeout handling and
+			update the -t option's documentation. [GL #3674]
+
+6138.	[doc]		Fix the DF-flag documentation on the outgoing
+			UDP packets. [GL #3710]
+
+6136.	[cleanup]	Remove the isc_fsaccess API in favor of creating
+			temporary file first and atomically replace the key
+			with non-truncated content. [GL #3982]
+
+6132.	[doc]		Remove a dead link in the DNSSEC guide. [GL #3967]
+
+6129.	[cleanup]	Value stored to 'source' during its initialization is
+			never read. [GL #3965]
+
+6128.	[bug]		Fix an omission in an earlier commit to avoid a race
+			between the 'dns__catz_update_cb()' and
+			'dns_catz_dbupdate_callback()' functions. [GL #3968]
+
+6126.	[cleanup]	Deprecate zone type "delegation-only" and the
+			"delegation-only" and "root-delegation-only"
+			options. [GL #3953]
+
+6125.	[bug]		Hold a catz reference while the update process is
+			running, so that the catalog zone is not destroyed
+			during shutdown until the update process is finished or
+			properly canceled by the activated 'shuttingdown' flag.
+			[GL #3955]
+
+6124.	[bug]		When changing from a NSEC3 capable DNSSEC algorithm to
+			an NSEC3 incapable DNSSEC algorithm using KASP the zone
+			could sometimes be incompletely signed. [GL #3937]
+
+6121.	[bug]		Fix BIND and dig zone transfer hanging when
+			downloading large zones over TLS from a primary server,
+			especially over unstable connections. [GL #3867]
+
+	--- 9.18.13 released ---
+
+6120.	[bug]		Use two pairs of dns_db_t and dns_dbversion_t in a
+			catalog zone structure to avoid a race between the
+			dns__catz_update_cb() and dns_catz_dbupdate_callback()
+			functions. [GL #3907]
+
+6119.	[bug]		Make sure to revert the reconfigured zones to the
+			previous version of the view, when the new view
+			reconfiguration fails during the configuration of
+			one of the configured zones. [GL #3911]
+
+6116.	[bug]		Fix error path cleanup issues in dns_catz_new_zones()
+			and dns_catz_new_zone() functions. [GL #3900]
+
+6115.	[bug]		Unregister db update notify callback before detaching
+			from the previous db inside the catz update notify
+			callback. [GL #3777]
+
+6114.	[func]		Run the catalog zone update process on the offload
+			threads. [GL #3881]
+
+6113.	[func]		Add shutdown signaling for catalog zones. [GL !7571]
+
+6112.	[func]		Add reference count tracing for dns_catz_zone_t and
+			dns_catz_zones_t. [GL !7570]
+
+6105.	[bug]		Detach 'rpzs' and 'catzs' from the previous view in
+			configure_rpz() and configure_catz(), respectively,
+			just after attaching it to the new view. [GL #3880]
+
+6098.	[test]		Don't test HMAC-MD5 when not supported by libcrypto.
+			[GL #3871]
+
+6096.	[bug]		Fix RPZ reference counting error on shutdown in
+			dns__rpz_timer_cb(). [GL #3866]
+
+6095.	[test]		Test various 'islands of trust' configurations when
+			using managed keys. [GL #3662]
+
+6094.	[bug]		Building against (or running with) libuv versions
+			1.35.0 and 1.36.0 is now a fatal error.  The rules for
+			mixing and matching compile-time and run-time libuv
+			versions have been tightened for libuv versions between
+			1.35.0 and 1.40.0. [GL #3840]
+
+6092.	[bug]		dnssec-cds failed to cleanup properly. [GL #3831]
+
+6089.	[bug]		Source ports configured for query-source,
+			transfer-source, etc, were being ignored. (This
+			feature is deprecated, but it is not yet removed,
+			so the bug still needed fixing.) [GL #3790]
+
 	--- 9.18.12 released ---
 
 6083.	[bug]		Fix DNSRPS-enabled builds as they were inadvertently
@@ -45,6 +303,12 @@
 			not negotiate "dot" ALPN token could crash BIND
 			on shutdown. That has been fixed. [GL #3767]
 
+6057.	[bug]		Fix shutdown and error path bugs in the rpz unit.
+			[GL #3735]
+
+5850.	[func]		Run the RPZ update process on the offload threads.
+			[GL #3190]
+
 	--- 9.18.11 released ---
 
 6067.	[security]	Fix serve-stale crash when recursive clients soft quota
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 0b7661b..4b3db89 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -71,14 +71,14 @@ To clone the repository, use:
 
 >       $ git clone https://gitlab.isc.org/isc-projects/bind9.git
 
-Release branch names are of the form `v9_X`, where X represents the second
-number in the BIND 9 version number.  So, to check out the BIND 9.12
+Release branch names are of the form `bind-9.X`, where X represents the second
+number in the BIND 9 version number.  So, to check out the BIND 9.18
 branch, use:
 
->       $ git checkout v9_12
+>       $ git checkout bind-9.18
 
 Whenever a branch is ready for publication, a tag is placed of the
-form `v9_X_Y`.  The 9.12.0 release, for instance, is tagged as `v9_12_0`.
+form `v9.X.Y`.  The 9.18.0 release, for instance, is tagged as `v9.18.0`.
 
 The branch in which the next major release is being developed is called
 `main`.
diff --git a/COPYRIGHT b/COPYRIGHT
index f9413d0..12f7917 100644
--- a/COPYRIGHT
+++ b/COPYRIGHT
@@ -133,7 +133,7 @@ modification, are permitted provided that the following conditions are met:
 3. Neither the name of the University nor the names of its contributors may
    be used to endorse or promote products derived from this software
    without specific prior written permission.
- 
+
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -149,35 +149,35 @@ POSSIBILITY OF SUCH DAMAGE.
  -----------------------------------------------------------------------------
 
 Copyright (c) 1997 - 2003 Kungliga Tekniska H�gskolan
-(Royal Institute of Technology, Stockholm, Sweden). 
-All rights reserved. 
-
-Redistribution and use in source and binary forms, with or without 
-modification, are permitted provided that the following conditions 
-are met: 
-
-1. Redistributions of source code must retain the above copyright 
-   notice, this list of conditions and the following disclaimer. 
-
-2. Redistributions in binary form must reproduce the above copyright 
-   notice, this list of conditions and the following disclaimer in the 
-   documentation and/or other materials provided with the distribution. 
-
-3. Neither the name of the Institute nor the names of its contributors 
-   may be used to endorse or promote products derived from this software 
-   without specific prior written permission. 
-
-THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
-ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
-SUCH DAMAGE. 
+(Royal Institute of Technology, Stockholm, Sweden).
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the Institute nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
 
  -----------------------------------------------------------------------------
 
diff --git a/ChangeLog b/ChangeLog
index e46a324..3f4e364 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,261 @@
+	--- 9.18.18 released ---
+
+6220.	[func]		Deprecate the 'dialup' and 'heartbeat-interval'
+			options. [GL #3700]
+
+6219.	[bug]		Ignore 'max-zone-ttl' on 'dnssec-policy insecure'.
+			[GL #4032]
+
+6215.	[protocol]	Return REFUSED to GSS-API TKEY requests if GSS-API
+			support is not configured. [GL #4225]
+
+6213.	[bug]		Mark a primary server as temporarily unreachable if the
+			TCP connection attempt times out. [GL #4215]
+
+6212.	[bug]		Don't process detach and close netmgr events when
+			the netmgr has been paused. [GL #4200]
+
+	--- 9.18.17 released ---
+
+6206.	[bug]		Add shutdown checks in dns_catz_dbupdate_callback() to
+			avoid a race with dns_catz_shutdown_catzs(). [GL #4171]
+
+6205.	[bug]		Restore support to read legacy HMAC-MD5 K file pairs.
+			[GL #4154]
+
+6204.	[bug]		Use NS records for relaxed QNAME-minimization mode.
+			This reduces the number of queries named makes when
+			resolving, as it allows the non-existence of NS RRsets
+			at non-referral nodes to be cached in addition to the
+			referrals that are normally cached. [GL #3325]
+
+6200.	[bug]		Fix nslookup erroneously reporting a timeout when the
+			input is delayed. [GL #4044]
+
+6199.	[bug]		Improve HTTP Connection: header protocol conformance
+			in the statistics channel. [GL #4126]
+
+6198.	[func]		Remove the holes in the isc_result_t enum to compact
+			the isc_result tables. [GL #4149]
+
+6197.	[bug]		Fix a data race between the dns_zone and dns_catz
+			modules when registering/unregistering a database
+			update notification callback for a catalog zone.
+			[GL #4132]
+
+6196.	[cleanup]	Report "permission denied" instead of "unexpected error"
+			when trying to update a zone file on a read-only file
+			system. Thanks to Midnight Veil. [GL #4134]
+
+6193.	[bug]		Fix a catz db update notification callback registration
+			logic error, which could crash named when receiving an
+			AXFR update for a catalog zone while the previous update
+			process of the catalog zone was already running.
+			[GL #4136]
+
+6166.	[func]		Retry without DNS COOKIE on FORMERR if it appears that
+			the FORMERR was due to the presence of a DNS COOKIE
+			option. [GL #4049]
+
+	--- 9.18.16 released ---
+
+6192.	[security]	A query that prioritizes stale data over lookup
+			triggers a fetch to refresh the stale data in cache.
+			If the fetch is aborted for exceeding the recursion
+			quota, it was possible for 'named' to enter an infinite
+			callback loop and crash due to stack overflow. This has
+			been fixed. (CVE-2023-2911) [GL #4089]
+
+6190.	[security]	Improve the overmem cleaning process to prevent the
+			cache going over the configured limit. (CVE-2023-2828)
+			[GL #4055]
+
+6188.	[performance]	Reduce memory consumption by allocating properly
+			sized send buffers for stream-based transports.
+			[GL #4038]
+
+6186.	[bug]		Fix a 'clients-per-query' miscalculation bug. When the
+			'stale-answer-enable' options was enabled and the
+			'stale-answer-client-timeout' option was enabled and
+			larger than 0, named was taking two places from the
+			'clients-per-query' limit for each client and was
+			failing to gradually auto-tune its value, as configured.
+			[GL #4074]
+
+6185.	[func]		Add "ClientQuota" statistics channel counter, which
+			indicates the number of the resolver's spilled queries
+			due to reaching the clients per query quota. [GL !7978]
+
+6183.	[bug]		Fix a serve-stale bug where a delegation from cache
+			could be returned to the client. [GL #3950]
+
+6182.	[cleanup]	Remove configure checks for epoll, kqueue and
+			/dev/poll. [GL #4098]
+
+6181.	[func]		The "tkey-dhkey" option has been deprecated; a
+			warning will be logged when it is used. In a future
+			release, Diffie-Hellman TKEY mode will be removed.
+			[GL #3905]
+
+6180.	[bug]		The session key object could be incorrectly added
+			to multiple different views' keyrings. [GL #4079]
+
+6179.	[bug]		Fix an interfacemgr use-after-free error in
+			zoneconf.c:isself(). [GL #3765]
+
+6176.	[test]		Add support for using pytest & pytest-xdist to
+			execute the system test suite. [GL #3978]
+
+6174.	[bug]		BIND could get stuck on reconfiguration when a
+			'listen' statement for HTTP is removed from the
+			configuration. That has been fixed. [GL #4071]
+
+6173.	[bug]		Properly process extra "nameserver" lines in
+			resolv.conf otherwise the next line is not properly
+			processed. [GL #4066]
+
+6169.	[bug]		named could crash when deleting inline-signing zones
+			with "rndc delzone". [GL #4054]
+
+6165.	[bug]		Fix a logic error in dighost.c which could call the
+			dighost_shutdown() callback twice and cause problems
+			if the callback function was not idempotent. [GL #4039]
+
+	--- 9.18.15 released ---
+
+6164.	[bug]		Set the rndc idle read timeout back to 60 seconds,
+			from the netmgr default of 30 seconds, in order to
+			match the behavior of 9.16 and earlier. [GL #4046]
+
+6161.	[bug]		Fix log file rotation when using absolute path as
+			file. [GL #3991]
+
+6157.	[bug]		When removing delegations in an OPTOUT range
+			empty-non-terminal NSEC3 records generated by
+			those delegations were not removed. [GL #4027]
+
+6156.	[bug]		Reimplement the maximum and idle timeouts for incoming
+			zone tranfers. [GL #4004]
+
+6155.	[bug]		Treat ISC_R_INVALIDPROTO as a networking error
+			in the dispatch code to avoid retrying with the
+			same server. [GL #4005]
+
+6152.	[bug]		In dispatch, honour the configured source-port
+			selection when UDP connection fails with address
+			in use error.
+
+			Also treat ISC_R_NOPERM same as ISC_R_ADDRINUSE.
+			[GL #3986]
+
+6149.	[test]		As a workaround, include an OpenSSL header file before
+			including cmocka.h in the unit tests, because OpenSSL
+			3.1.0 uses __attribute__(malloc), conflicting with a
+			redefined malloc in cmocka.h. [GL #4000]
+
+	--- 9.18.14 released ---
+
+6145.	[bug]		Fix a possible use-after-free bug in the
+			dns__catz_done_cb() function. [GL #3997]
+
+6143.	[bug]		A reference counting problem on the error path in
+			the xfrin_connect_done() might cause an assertion
+			failure on shutdown.  [GL #3989]
+
+6142.	[bug]		Reduce the number of dns_dnssec_verify calls made
+			determining if revoked keys needs to be removed from
+			the trust anchors. [GL #3981]
+
+6141.	[bug]		Fix several issues in nsupdate timeout handling and
+			update the -t option's documentation. [GL #3674]
+
+6138.	[doc]		Fix the DF-flag documentation on the outgoing
+			UDP packets. [GL #3710]
+
+6136.	[cleanup]	Remove the isc_fsaccess API in favor of creating
+			temporary file first and atomically replace the key
+			with non-truncated content. [GL #3982]
+
+6132.	[doc]		Remove a dead link in the DNSSEC guide. [GL #3967]
+
+6129.	[cleanup]	Value stored to 'source' during its initialization is
+			never read. [GL #3965]
+
+6128.	[bug]		Fix an omission in an earlier commit to avoid a race
+			between the 'dns__catz_update_cb()' and
+			'dns_catz_dbupdate_callback()' functions. [GL #3968]
+
+6126.	[cleanup]	Deprecate zone type "delegation-only" and the
+			"delegation-only" and "root-delegation-only"
+			options. [GL #3953]
+
+6125.	[bug]		Hold a catz reference while the update process is
+			running, so that the catalog zone is not destroyed
+			during shutdown until the update process is finished or
+			properly canceled by the activated 'shuttingdown' flag.
+			[GL #3955]
+
+6124.	[bug]		When changing from a NSEC3 capable DNSSEC algorithm to
+			an NSEC3 incapable DNSSEC algorithm using KASP the zone
+			could sometimes be incompletely signed. [GL #3937]
+
+6121.	[bug]		Fix BIND and dig zone transfer hanging when
+			downloading large zones over TLS from a primary server,
+			especially over unstable connections. [GL #3867]
+
+	--- 9.18.13 released ---
+
+6120.	[bug]		Use two pairs of dns_db_t and dns_dbversion_t in a
+			catalog zone structure to avoid a race between the
+			dns__catz_update_cb() and dns_catz_dbupdate_callback()
+			functions. [GL #3907]
+
+6119.	[bug]		Make sure to revert the reconfigured zones to the
+			previous version of the view, when the new view
+			reconfiguration fails during the configuration of
+			one of the configured zones. [GL #3911]
+
+6116.	[bug]		Fix error path cleanup issues in dns_catz_new_zones()
+			and dns_catz_new_zone() functions. [GL #3900]
+
+6115.	[bug]		Unregister db update notify callback before detaching
+			from the previous db inside the catz update notify
+			callback. [GL #3777]
+
+6114.	[func]		Run the catalog zone update process on the offload
+			threads. [GL #3881]
+
+6113.	[func]		Add shutdown signaling for catalog zones. [GL !7571]
+
+6112.	[func]		Add reference count tracing for dns_catz_zone_t and
+			dns_catz_zones_t. [GL !7570]
+
+6105.	[bug]		Detach 'rpzs' and 'catzs' from the previous view in
+			configure_rpz() and configure_catz(), respectively,
+			just after attaching it to the new view. [GL #3880]
+
+6098.	[test]		Don't test HMAC-MD5 when not supported by libcrypto.
+			[GL #3871]
+
+6096.	[bug]		Fix RPZ reference counting error on shutdown in
+			dns__rpz_timer_cb(). [GL #3866]
+
+6095.	[test]		Test various 'islands of trust' configurations when
+			using managed keys. [GL #3662]
+
+6094.	[bug]		Building against (or running with) libuv versions
+			1.35.0 and 1.36.0 is now a fatal error.  The rules for
+			mixing and matching compile-time and run-time libuv
+			versions have been tightened for libuv versions between
+			1.35.0 and 1.40.0. [GL #3840]
+
+6092.	[bug]		dnssec-cds failed to cleanup properly. [GL #3831]
+
+6089.	[bug]		Source ports configured for query-source,
+			transfer-source, etc, were being ignored. (This
+			feature is deprecated, but it is not yet removed,
+			so the bug still needed fixing.) [GL #3790]
+
 	--- 9.18.12 released ---
 
 6083.	[bug]		Fix DNSRPS-enabled builds as they were inadvertently
@@ -45,6 +303,12 @@
 			not negotiate "dot" ALPN token could crash BIND
 			on shutdown. That has been fixed. [GL #3767]
 
+6057.	[bug]		Fix shutdown and error path bugs in the rpz unit.
+			[GL #3735]
+
+5850.	[func]		Run the RPZ update process on the offload threads.
+			[GL #3190]
+
 	--- 9.18.11 released ---
 
 6067.	[security]	Fix serve-stale crash when recursive clients soft quota
diff --git a/NEWS b/NEWS
index e46a324..3f4e364 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,261 @@
+	--- 9.18.18 released ---
+
+6220.	[func]		Deprecate the 'dialup' and 'heartbeat-interval'
+			options. [GL #3700]
+
+6219.	[bug]		Ignore 'max-zone-ttl' on 'dnssec-policy insecure'.
+			[GL #4032]
+
+6215.	[protocol]	Return REFUSED to GSS-API TKEY requests if GSS-API
+			support is not configured. [GL #4225]
+
+6213.	[bug]		Mark a primary server as temporarily unreachable if the
+			TCP connection attempt times out. [GL #4215]
+
+6212.	[bug]		Don't process detach and close netmgr events when
+			the netmgr has been paused. [GL #4200]
+
+	--- 9.18.17 released ---
+
+6206.	[bug]		Add shutdown checks in dns_catz_dbupdate_callback() to
+			avoid a race with dns_catz_shutdown_catzs(). [GL #4171]
+
+6205.	[bug]		Restore support to read legacy HMAC-MD5 K file pairs.
+			[GL #4154]
+
+6204.	[bug]		Use NS records for relaxed QNAME-minimization mode.
+			This reduces the number of queries named makes when
+			resolving, as it allows the non-existence of NS RRsets
+			at non-referral nodes to be cached in addition to the
+			referrals that are normally cached. [GL #3325]
+
+6200.	[bug]		Fix nslookup erroneously reporting a timeout when the
+			input is delayed. [GL #4044]
+
+6199.	[bug]		Improve HTTP Connection: header protocol conformance
+			in the statistics channel. [GL #4126]
+
+6198.	[func]		Remove the holes in the isc_result_t enum to compact
+			the isc_result tables. [GL #4149]
+
+6197.	[bug]		Fix a data race between the dns_zone and dns_catz
+			modules when registering/unregistering a database
+			update notification callback for a catalog zone.
+			[GL #4132]
+
+6196.	[cleanup]	Report "permission denied" instead of "unexpected error"
+			when trying to update a zone file on a read-only file
+			system. Thanks to Midnight Veil. [GL #4134]
+
+6193.	[bug]		Fix a catz db update notification callback registration
+			logic error, which could crash named when receiving an
+			AXFR update for a catalog zone while the previous update
+			process of the catalog zone was already running.
+			[GL #4136]
+
+6166.	[func]		Retry without DNS COOKIE on FORMERR if it appears that
+			the FORMERR was due to the presence of a DNS COOKIE
+			option. [GL #4049]
+
+	--- 9.18.16 released ---
+
+6192.	[security]	A query that prioritizes stale data over lookup
+			triggers a fetch to refresh the stale data in cache.
+			If the fetch is aborted for exceeding the recursion
+			quota, it was possible for 'named' to enter an infinite
+			callback loop and crash due to stack overflow. This has
+			been fixed. (CVE-2023-2911) [GL #4089]
+
+6190.	[security]	Improve the overmem cleaning process to prevent the
+			cache going over the configured limit. (CVE-2023-2828)
+			[GL #4055]
+
+6188.	[performance]	Reduce memory consumption by allocating properly
+			sized send buffers for stream-based transports.
+			[GL #4038]
+
+6186.	[bug]		Fix a 'clients-per-query' miscalculation bug. When the
+			'stale-answer-enable' options was enabled and the
+			'stale-answer-client-timeout' option was enabled and
+			larger than 0, named was taking two places from the
+			'clients-per-query' limit for each client and was
+			failing to gradually auto-tune its value, as configured.
+			[GL #4074]
+
+6185.	[func]		Add "ClientQuota" statistics channel counter, which
+			indicates the number of the resolver's spilled queries
+			due to reaching the clients per query quota. [GL !7978]
+
+6183.	[bug]		Fix a serve-stale bug where a delegation from cache
+			could be returned to the client. [GL #3950]
+
+6182.	[cleanup]	Remove configure checks for epoll, kqueue and
+			/dev/poll. [GL #4098]
+
+6181.	[func]		The "tkey-dhkey" option has been deprecated; a
+			warning will be logged when it is used. In a future
+			release, Diffie-Hellman TKEY mode will be removed.
+			[GL #3905]
+
+6180.	[bug]		The session key object could be incorrectly added
+			to multiple different views' keyrings. [GL #4079]
+
+6179.	[bug]		Fix an interfacemgr use-after-free error in
+			zoneconf.c:isself(). [GL #3765]
+
+6176.	[test]		Add support for using pytest & pytest-xdist to
+			execute the system test suite. [GL #3978]
+
+6174.	[bug]		BIND could get stuck on reconfiguration when a
+			'listen' statement for HTTP is removed from the
+			configuration. That has been fixed. [GL #4071]
+
+6173.	[bug]		Properly process extra "nameserver" lines in
+			resolv.conf otherwise the next line is not properly
+			processed. [GL #4066]
+
+6169.	[bug]		named could crash when deleting inline-signing zones
+			with "rndc delzone". [GL #4054]
+
+6165.	[bug]		Fix a logic error in dighost.c which could call the
+			dighost_shutdown() callback twice and cause problems
+			if the callback function was not idempotent. [GL #4039]
+
+	--- 9.18.15 released ---
+
+6164.	[bug]		Set the rndc idle read timeout back to 60 seconds,
+			from the netmgr default of 30 seconds, in order to
+			match the behavior of 9.16 and earlier. [GL #4046]
+
+6161.	[bug]		Fix log file rotation when using absolute path as
+			file. [GL #3991]
+
+6157.	[bug]		When removing delegations in an OPTOUT range
+			empty-non-terminal NSEC3 records generated by
+			those delegations were not removed. [GL #4027]
+
+6156.	[bug]		Reimplement the maximum and idle timeouts for incoming
+			zone tranfers. [GL #4004]
+
+6155.	[bug]		Treat ISC_R_INVALIDPROTO as a networking error
+			in the dispatch code to avoid retrying with the
+			same server. [GL #4005]
+
+6152.	[bug]		In dispatch, honour the configured source-port
+			selection when UDP connection fails with address
+			in use error.
+
+			Also treat ISC_R_NOPERM same as ISC_R_ADDRINUSE.
+			[GL #3986]
+
+6149.	[test]		As a workaround, include an OpenSSL header file before
+			including cmocka.h in the unit tests, because OpenSSL
+			3.1.0 uses __attribute__(malloc), conflicting with a
+			redefined malloc in cmocka.h. [GL #4000]
+
+	--- 9.18.14 released ---
+
+6145.	[bug]		Fix a possible use-after-free bug in the
+			dns__catz_done_cb() function. [GL #3997]
+
+6143.	[bug]		A reference counting problem on the error path in
+			the xfrin_connect_done() might cause an assertion
+			failure on shutdown.  [GL #3989]
+
+6142.	[bug]		Reduce the number of dns_dnssec_verify calls made
+			determining if revoked keys needs to be removed from
+			the trust anchors. [GL #3981]
+
+6141.	[bug]		Fix several issues in nsupdate timeout handling and
+			update the -t option's documentation. [GL #3674]
+
+6138.	[doc]		Fix the DF-flag documentation on the outgoing
+			UDP packets. [GL #3710]
+
+6136.	[cleanup]	Remove the isc_fsaccess API in favor of creating
+			temporary file first and atomically replace the key
+			with non-truncated content. [GL #3982]
+
+6132.	[doc]		Remove a dead link in the DNSSEC guide. [GL #3967]
+
+6129.	[cleanup]	Value stored to 'source' during its initialization is
+			never read. [GL #3965]
+
+6128.	[bug]		Fix an omission in an earlier commit to avoid a race
+			between the 'dns__catz_update_cb()' and
+			'dns_catz_dbupdate_callback()' functions. [GL #3968]
+
+6126.	[cleanup]	Deprecate zone type "delegation-only" and the
+			"delegation-only" and "root-delegation-only"
+			options. [GL #3953]
+
+6125.	[bug]		Hold a catz reference while the update process is
+			running, so that the catalog zone is not destroyed
+			during shutdown until the update process is finished or
+			properly canceled by the activated 'shuttingdown' flag.
+			[GL #3955]
+
+6124.	[bug]		When changing from a NSEC3 capable DNSSEC algorithm to
+			an NSEC3 incapable DNSSEC algorithm using KASP the zone
+			could sometimes be incompletely signed. [GL #3937]
+
+6121.	[bug]		Fix BIND and dig zone transfer hanging when
+			downloading large zones over TLS from a primary server,
+			especially over unstable connections. [GL #3867]
+
+	--- 9.18.13 released ---
+
+6120.	[bug]		Use two pairs of dns_db_t and dns_dbversion_t in a
+			catalog zone structure to avoid a race between the
+			dns__catz_update_cb() and dns_catz_dbupdate_callback()
+			functions. [GL #3907]
+
+6119.	[bug]		Make sure to revert the reconfigured zones to the
+			previous version of the view, when the new view
+			reconfiguration fails during the configuration of
+			one of the configured zones. [GL #3911]
+
+6116.	[bug]		Fix error path cleanup issues in dns_catz_new_zones()
+			and dns_catz_new_zone() functions. [GL #3900]
+
+6115.	[bug]		Unregister db update notify callback before detaching
+			from the previous db inside the catz update notify
+			callback. [GL #3777]
+
+6114.	[func]		Run the catalog zone update process on the offload
+			threads. [GL #3881]
+
+6113.	[func]		Add shutdown signaling for catalog zones. [GL !7571]
+
+6112.	[func]		Add reference count tracing for dns_catz_zone_t and
+			dns_catz_zones_t. [GL !7570]
+
+6105.	[bug]		Detach 'rpzs' and 'catzs' from the previous view in
+			configure_rpz() and configure_catz(), respectively,
+			just after attaching it to the new view. [GL #3880]
+
+6098.	[test]		Don't test HMAC-MD5 when not supported by libcrypto.
+			[GL #3871]
+
+6096.	[bug]		Fix RPZ reference counting error on shutdown in
+			dns__rpz_timer_cb(). [GL #3866]
+
+6095.	[test]		Test various 'islands of trust' configurations when
+			using managed keys. [GL #3662]
+
+6094.	[bug]		Building against (or running with) libuv versions
+			1.35.0 and 1.36.0 is now a fatal error.  The rules for
+			mixing and matching compile-time and run-time libuv
+			versions have been tightened for libuv versions between
+			1.35.0 and 1.40.0. [GL #3840]
+
+6092.	[bug]		dnssec-cds failed to cleanup properly. [GL #3831]
+
+6089.	[bug]		Source ports configured for query-source,
+			transfer-source, etc, were being ignored. (This
+			feature is deprecated, but it is not yet removed,
+			so the bug still needed fixing.) [GL #3790]
+
 	--- 9.18.12 released ---
 
 6083.	[bug]		Fix DNSRPS-enabled builds as they were inadvertently
@@ -45,6 +303,12 @@
 			not negotiate "dot" ALPN token could crash BIND
 			on shutdown. That has been fixed. [GL #3767]
 
+6057.	[bug]		Fix shutdown and error path bugs in the rpz unit.
+			[GL #3735]
+
+5850.	[func]		Run the RPZ update process on the offload threads.
+			[GL #3190]
+
 	--- 9.18.11 released ---
 
 6067.	[security]	Fix serve-stale crash when recursive clients soft quota
diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index 6b3616c..fd7cfa5 100644
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -726,7 +726,8 @@ main(int argc, char **argv) {
 		exit(1);
 	}
 
-	result = bind9_check_namedconf(config, loadplugins, logc, mctx);
+	result = bind9_check_namedconf(config, loadplugins, nodeprecate, logc,
+				       mctx);
 	if (result != ISC_R_SUCCESS) {
 		exit_status = 1;
 	}
diff --git a/bin/check/named-compilezone.rst b/bin/check/named-compilezone.rst
index fa47f15..41ecff7 100644
--- a/bin/check/named-compilezone.rst
+++ b/bin/check/named-compilezone.rst
@@ -220,5 +220,5 @@ and 0 otherwise.
 See Also
 ~~~~~~~~
 
-:iscman:`named(8) <named>`, :iscman:`named-checkconf(8) <named-checkconf>`, :iscman:`named-checkzone(8) <named-checkzone>`, `:rfc:`1035`,
+:iscman:`named(8) <named>`, :iscman:`named-checkconf(8) <named-checkconf>`, :iscman:`named-checkzone(8) <named-checkzone>`, :rfc:`1035`,
 BIND 9 Administrator Reference Manual.
diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index 9ff8b42..87552be 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -233,7 +233,7 @@ help(void) {
 	       "                 +[no]http-plain[=###]    (DNS over plain HTTP "
 	       "mode) "
 	       "[/]\n"
-	       "                 +[no]https-plain-get      (Use GET instead of "
+	       "                 +[no]http-plain-get      (Use GET instead of "
 	       "default POST method while using plain HTTP)\n"
 	       "                 +[no]identify       (ID responders in short "
 	       "answers)\n"
@@ -2207,6 +2207,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 
 #if !TARGET_OS_IPHONE
 exit_or_usage:
+	cleanup_openssl_refs();
 	digexit();
 #endif /* if !TARGET_OS_IPHONE */
 }
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 84cdda9..55f7bf2 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -2361,6 +2361,7 @@ setup_lookup(dig_lookup_t *lookup) {
 			clear_current_lookup();
 			return (false);
 #else  /* if TARGET_OS_IPHONE */
+			cleanup_openssl_refs();
 			digexit();
 #endif /* if TARGET_OS_IPHONE */
 		}
@@ -3246,11 +3247,11 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 
 		if (next != NULL) {
 			start_udp(next);
+			check_if_done();
 		} else {
 			clear_current_lookup();
 		}
 
-		check_if_done();
 		UNLOCK_LOOKUP;
 		return;
 	}
@@ -3651,11 +3652,11 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 
 		if (next != NULL) {
 			start_tcp(next);
+			check_if_done();
 		} else {
 			clear_current_lookup();
 		}
 
-		check_if_done();
 		UNLOCK_LOOKUP;
 		return;
 	}
@@ -4708,6 +4709,25 @@ cancel_all(void) {
 	UNLOCK_LOOKUP;
 }
 
+void
+cleanup_openssl_refs(void) {
+	if (tsigkey != NULL) {
+		debug("freeing TSIG key %p", tsigkey);
+		dns_tsigkey_detach(&tsigkey);
+	}
+
+	if (sig0key != NULL) {
+		debug("freeing SIG(0) key %p", sig0key);
+		dst_key_free(&sig0key);
+	}
+
+	if (is_dst_up) {
+		debug("destroy DST lib");
+		dst_lib_destroy();
+		is_dst_up = false;
+	}
+}
+
 /*%
  * Destroy all of the libs we are using, and get everything ready for a
  * clean shutdown.
@@ -4739,29 +4759,16 @@ destroy_libs(void) {
 
 	clear_searchlist();
 
-	if (tsigkey != NULL) {
-		debug("freeing TSIG key %p", tsigkey);
-		dns_tsigkey_detach(&tsigkey);
-	}
-
-	if (sig0key != NULL) {
-		debug("freeing SIG(0) key %p", sig0key);
-		dst_key_free(&sig0key);
-	}
+	cleanup_openssl_refs();
 
 	if (namebuf != NULL) {
 		debug("freeing key %p", tsigkey);
 		isc_buffer_free(&namebuf);
 	}
 
-	if (is_dst_up) {
-		debug("destroy DST lib");
-		dst_lib_destroy();
-		is_dst_up = false;
-	}
-
 	UNLOCK_LOOKUP;
 	isc_mutex_destroy(&lookup_lock);
+
 	debug("Removing log context");
 	isc_log_destroy(&lctx);
 
diff --git a/bin/dig/dighost.h b/bin/dig/dighost.h
index 593468a..227c315 100644
--- a/bin/dig/dighost.h
+++ b/bin/dig/dighost.h
@@ -296,6 +296,9 @@ noreturn void
 digexit(void);
 
 void
+cleanup_openssl_refs(void);
+
+void
 debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 void
diff --git a/bin/dnssec/dnssec-cds.c b/bin/dnssec/dnssec-cds.c
index 9f6ea44..06b1f8c 100644
--- a/bin/dnssec/dnssec-cds.c
+++ b/bin/dnssec/dnssec-cds.c
@@ -125,15 +125,29 @@ typedef isc_result_t
 ds_maker_func_t(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,
 		dns_rdata_t *crdata);
 
-static dns_rdataset_t cdnskey_set, cdnskey_sig;
-static dns_rdataset_t cds_set, cds_sig;
-static dns_rdataset_t dnskey_set, dnskey_sig;
-static dns_rdataset_t old_ds_set, new_ds_set;
+static dns_rdataset_t cdnskey_set = DNS_RDATASET_INIT;
+static dns_rdataset_t cdnskey_sig = DNS_RDATASET_INIT;
+static dns_rdataset_t cds_set = DNS_RDATASET_INIT;
+static dns_rdataset_t cds_sig = DNS_RDATASET_INIT;
+static dns_rdataset_t dnskey_set = DNS_RDATASET_INIT;
+static dns_rdataset_t dnskey_sig = DNS_RDATASET_INIT;
+static dns_rdataset_t old_ds_set = DNS_RDATASET_INIT;
+static dns_rdataset_t new_ds_set = DNS_RDATASET_INIT;
 
-static keyinfo_t *old_key_tbl, *new_key_tbl;
+static keyinfo_t *old_key_tbl = NULL, *new_key_tbl = NULL;
 
 isc_buffer_t *new_ds_buf = NULL; /* backing store for new_ds_set */
 
+static dns_db_t *child_db = NULL;
+static dns_dbnode_t *child_node = NULL;
+static dns_db_t *parent_db = NULL;
+static dns_dbnode_t *parent_node = NULL;
+static dns_db_t *update_db = NULL;
+static dns_dbnode_t *update_node = NULL;
+static dns_dbversion_t *update_version = NULL;
+static bool cleanup_dst = false;
+static bool print_mem_stats = false;
+
 static void
 verbose_time(int level, const char *msg, isc_stdtime_t time) {
 	isc_result_t result;
@@ -251,21 +265,27 @@ load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 }
 
 static void
-free_db(dns_db_t **dbp, dns_dbnode_t **nodep) {
-	dns_db_detachnode(*dbp, nodep);
-	dns_db_detach(dbp);
+free_db(dns_db_t **dbp, dns_dbnode_t **nodep, dns_dbversion_t **versionp) {
+	if (*dbp != NULL) {
+		if (*nodep != NULL) {
+			dns_db_detachnode(*dbp, nodep);
+		}
+		if (versionp != NULL && *versionp != NULL) {
+			dns_db_closeversion(*dbp, versionp, false);
+		}
+		dns_db_detach(dbp);
+	}
 }
 
 static void
 load_child_sets(const char *file) {
-	dns_db_t *db = NULL;
-	dns_dbnode_t *node = NULL;
-
-	load_db(file, &db, &node);
-	findset(db, node, dns_rdatatype_dnskey, &dnskey_set, &dnskey_sig);
-	findset(db, node, dns_rdatatype_cdnskey, &cdnskey_set, &cdnskey_sig);
-	findset(db, node, dns_rdatatype_cds, &cds_set, &cds_sig);
-	free_db(&db, &node);
+	load_db(file, &child_db, &child_node);
+	findset(child_db, child_node, dns_rdatatype_dnskey, &dnskey_set,
+		&dnskey_sig);
+	findset(child_db, child_node, dns_rdatatype_cdnskey, &cdnskey_set,
+		&cdnskey_sig);
+	findset(child_db, child_node, dns_rdatatype_cds, &cds_set, &cds_sig);
+	free_db(&child_db, &child_node, NULL);
 }
 
 static void
@@ -314,8 +334,6 @@ get_dsset_name(char *filename, size_t size, const char *path,
 static void
 load_parent_set(const char *path) {
 	isc_result_t result;
-	dns_db_t *db = NULL;
-	dns_dbnode_t *node = NULL;
 	isc_time_t modtime;
 	char filename[PATH_MAX + 1];
 
@@ -334,15 +352,15 @@ load_parent_set(const char *path) {
 	}
 	verbose_time(1, "child records must not be signed before", notbefore);
 
-	load_db(filename, &db, &node);
-	findset(db, node, dns_rdatatype_ds, &old_ds_set, NULL);
+	load_db(filename, &parent_db, &parent_node);
+	findset(parent_db, parent_node, dns_rdatatype_ds, &old_ds_set, NULL);
 
 	if (!dns_rdataset_isassociated(&old_ds_set)) {
 		fatal("could not find DS records for %s in %s", namestr,
 		      filename);
 	}
 
-	free_db(&db, &node);
+	free_db(&parent_db, &parent_node, NULL);
 }
 
 #define MAX_CDS_RDATA_TEXT_SIZE DNS_RDATA_MAXLENGTH * 2
@@ -367,17 +385,18 @@ formatset(dns_rdataset_t *rdataset) {
 
 	isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
 	result = dns_master_rdatasettotext(name, rdataset, style, NULL, buf);
+	dns_master_styledestroy(&style, mctx);
 
 	if ((result == ISC_R_SUCCESS) && isc_buffer_availablelength(buf) < 1) {
 		result = ISC_R_NOSPACE;
 	}
 
-	check_result(result, "dns_rdataset_totext()");
+	if (result != ISC_R_SUCCESS) {
+		isc_buffer_free(&buf);
+		check_result(result, "dns_rdataset_totext()");
+	}
 
 	isc_buffer_putuint8(buf, 0);
-
-	dns_master_styledestroy(&style, mctx);
-
 	return (buf);
 }
 
@@ -420,6 +439,7 @@ write_parent_set(const char *path, const char *inplace, bool nsupdate,
 
 	result = isc_file_openunique(tmpname, &fp);
 	if (result != ISC_R_SUCCESS) {
+		isc_buffer_free(&buf);
 		fatal("open %s: %s", tmpname, isc_result_totext(result));
 	}
 	fprintf(fp, "%s", (char *)r.base);
@@ -514,23 +534,22 @@ static keyinfo_t *
 match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		   strictness_t strictness) {
 	isc_result_t result;
-	keyinfo_t *keytable;
+	keyinfo_t *keytable, *ki;
 	int i;
 
 	nkey = dns_rdataset_count(keyset);
 
 	keytable = isc_mem_get(mctx, sizeof(keyinfo_t) * nkey);
 
-	for (result = dns_rdataset_first(keyset), i = 0;
-	     result == ISC_R_SUCCESS; result = dns_rdataset_next(keyset), i++)
+	for (result = dns_rdataset_first(keyset), i = 0, ki = keytable;
+	     result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(keyset), i++, ki++)
 	{
-		keyinfo_t *ki;
 		dns_rdata_dnskey_t dnskey;
 		dns_rdata_t *keyrdata;
 		isc_region_t r;
 
 		INSIST(i < nkey);
-		ki = &keytable[i];
 		keyrdata = &ki->rdata;
 
 		dns_rdata_init(keyrdata);
@@ -568,8 +587,9 @@ free_keytable(keyinfo_t **keytable_p) {
 	keyinfo_t *ki;
 	int i;
 
-	for (i = 0; i < nkey; i++) {
-		ki = &keytable[i];
+	REQUIRE(keytable != NULL);
+
+	for (i = 0, ki = keytable; i < nkey; i++, ki++) {
 		if (ki->dst != NULL) {
 			dst_key_free(&ki->dst);
 		}
@@ -594,6 +614,8 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 	dns_secalg_t *algo;
 	int i;
 
+	REQUIRE(keytbl != NULL);
+
 	algo = isc_mem_get(mctx, nkey);
 	memset(algo, 0, nkey);
 
@@ -799,6 +821,7 @@ append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
 			isc_mem_put(mctx, ds, sizeof(*ds));
 			return (result);
 		default:
+			isc_mem_put(mctx, ds, sizeof(*ds));
 			check_result(result, "ds_from_rdata()");
 		}
 	}
@@ -956,32 +979,27 @@ static void
 update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
 	    dns_rdataset_t *delset) {
 	isc_result_t result;
-	dns_db_t *db;
-	dns_dbnode_t *node;
-	dns_dbversion_t *ver;
 	dns_rdataset_t diffset;
 	uint32_t save;
 
-	db = NULL;
 	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
-			       NULL, &db);
+			       NULL, &update_db);
 	check_result(result, "dns_db_create()");
 
-	ver = NULL;
-	result = dns_db_newversion(db, &ver);
+	result = dns_db_newversion(update_db, &update_version);
 	check_result(result, "dns_db_newversion()");
 
-	node = NULL;
-	result = dns_db_findnode(db, name, true, &node);
+	result = dns_db_findnode(update_db, name, true, &update_node);
 	check_result(result, "dns_db_findnode()");
 
 	dns_rdataset_init(&diffset);
 
-	result = dns_db_addrdataset(db, node, ver, 0, addset, DNS_DBADD_MERGE,
-				    NULL);
+	result = dns_db_addrdataset(update_db, update_node, update_version, 0,
+				    addset, DNS_DBADD_MERGE, NULL);
 	check_result(result, "dns_db_addrdataset()");
 
-	result = dns_db_subtractrdataset(db, node, ver, delset, 0, &diffset);
+	result = dns_db_subtractrdataset(update_db, update_node, update_version,
+					 delset, 0, &diffset);
 	if (result == DNS_R_UNCHANGED) {
 		save = addset->ttl;
 		addset->ttl = ttl;
@@ -994,9 +1012,7 @@ update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
 		dns_rdataset_disassociate(&diffset);
 	}
 
-	dns_db_detachnode(db, &node);
-	dns_db_closeversion(db, &ver, false);
-	dns_db_detach(&db);
+	free_db(&update_db, &update_node, &update_version);
 }
 
 static void
@@ -1046,6 +1062,32 @@ usage(void) {
 	exit(1);
 }
 
+static void
+cleanup(void) {
+	free_db(&child_db, &child_node, NULL);
+	free_db(&parent_db, &parent_node, NULL);
+	free_db(&update_db, &update_node, &update_version);
+	if (old_key_tbl != NULL) {
+		free_keytable(&old_key_tbl);
+	}
+	if (new_key_tbl != NULL) {
+		free_keytable(&new_key_tbl);
+	}
+	free_all_sets();
+	if (lctx != NULL) {
+		cleanup_logging(&lctx);
+	}
+	if (cleanup_dst) {
+		dst_lib_destroy();
+	}
+	if (mctx != NULL) {
+		if (print_mem_stats && verbose > 10) {
+			isc_mem_stats(mctx, stdout);
+		}
+		isc_mem_destroy(&mctx);
+	}
+}
+
 int
 main(int argc, char *argv[]) {
 	const char *child_path = NULL;
@@ -1058,6 +1100,8 @@ main(int argc, char *argv[]) {
 	int ch;
 	char *endp;
 
+	setfatalcallback(cleanup);
+
 	isc_mem_create(&mctx);
 
 	isc_commandline_errprint = false;
@@ -1144,6 +1188,7 @@ main(int argc, char *argv[]) {
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
 	}
+	cleanup_dst = true;
 
 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -1243,7 +1288,7 @@ main(int argc, char *argv[]) {
 		vbprintf(1, "%s has neither CDS nor CDNSKEY records\n",
 			 namestr);
 		write_parent_set(ds_path, inplace, nsupdate, &old_ds_set);
-		exit(0);
+		goto cleanup;
 	}
 
 	/*
@@ -1309,13 +1354,8 @@ main(int argc, char *argv[]) {
 
 	write_parent_set(ds_path, inplace, nsupdate, &new_ds_set);
 
-	free_all_sets();
-	cleanup_logging(&lctx);
-	dst_lib_destroy();
-	if (verbose > 10) {
-		isc_mem_stats(mctx, stdout);
-	}
-	isc_mem_destroy(&mctx);
-
+cleanup:
+	print_mem_stats = true;
+	cleanup();
 	exit(0);
 }
diff --git a/bin/dnssec/dnssec-settime.rst b/bin/dnssec/dnssec-settime.rst
index 7907756..5cb4ea8 100644
--- a/bin/dnssec/dnssec-settime.rst
+++ b/bin/dnssec/dnssec-settime.rst
@@ -148,7 +148,7 @@ All these formats are case-insensitive.
 .. option:: -A date/offset
 
    This option sets the date on which the key is to be activated. After that date,
-   the key is included in the zone and used to sign it. 
+   the key is included in the zone and used to sign it.
 
 .. option:: -R date/offset
 
diff --git a/bin/named/builtin.c b/bin/named/builtin.c
index cf18030..26348fd 100644
--- a/bin/named/builtin.c
+++ b/bin/named/builtin.c
@@ -380,9 +380,8 @@ do_hostname_lookup(dns_sdblookup_t *lookup) {
 		}
 	} else {
 		char buf[256];
-		isc_result_t result = named_os_gethostname(buf, sizeof(buf));
-		if (result != ISC_R_SUCCESS) {
-			return (result);
+		if (gethostname(buf, sizeof(buf)) != 0) {
+			return (ISC_R_FAILURE);
 		}
 		return (put_txt(lookup, buf));
 	}
@@ -420,13 +419,10 @@ do_authors_lookup(dns_sdblookup_t *lookup) {
 
 static isc_result_t
 do_id_lookup(dns_sdblookup_t *lookup) {
-	if (named_g_server->sctx->gethostname != NULL) {
+	if (named_g_server->sctx->usehostname) {
 		char buf[256];
-		isc_result_t result;
-
-		result = named_g_server->sctx->gethostname(buf, sizeof(buf));
-		if (result != ISC_R_SUCCESS) {
-			return (result);
+		if (gethostname(buf, sizeof(buf)) != 0) {
+			return (ISC_R_FAILURE);
 		}
 		return (put_txt(lookup, buf));
 	} else if (named_g_server->sctx->server_id != NULL) {
diff --git a/bin/named/config.c b/bin/named/config.c
index b2b8028..7f318a2 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -319,6 +319,7 @@ dnssec-policy \"default\" {\n\
 };\n\
 \n\
 dnssec-policy \"insecure\" {\n\
+	max-zone-ttl 0; \n\
 	keys { };\n\
 };\n\
 \n\
diff --git a/bin/named/include/named/os.h b/bin/named/include/named/os.h
index 4a3a5f2..0f7c1c5 100644
--- a/bin/named/include/named/os.h
+++ b/bin/named/include/named/os.h
@@ -62,9 +62,6 @@ named_os_issingleton(const char *filename);
 void
 named_os_shutdown(void);
 
-isc_result_t
-named_os_gethostname(char *buf, size_t len);
-
 void
 named_os_shutdownmsg(char *command, isc_buffer_t *text);
 
diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
index 1422e02..075e2ec 100644
--- a/bin/named/include/named/server.h
+++ b/bin/named/include/named/server.h
@@ -100,7 +100,7 @@ struct named_server {
 
 	named_statschannellist_t statschannels;
 
-	dns_tsigkey_t *sessionkey;
+	dst_key_t     *sessionkey;
 	char	      *session_keyfile;
 	dns_name_t    *session_keyname;
 	unsigned int   session_keyalg;
diff --git a/bin/named/main.c b/bin/named/main.c
index 8060333..154e17e 100644
--- a/bin/named/main.c
+++ b/bin/named/main.c
@@ -136,6 +136,9 @@ static bool nonearest = false;
 static bool nosoa = false;
 static bool notcp = false;
 static bool sigvalinsecs = false;
+static bool transferinsecs = false;
+static bool transferslowly = false;
+static bool transferstuck = false;
 
 /*
  * -4 and -6
@@ -495,6 +498,9 @@ list_hmac_algorithms(isc_buffer_t *b) {
 	for (dst_algorithm_t i = DST_ALG_HMAC_FIRST; i <= DST_ALG_HMAC_LAST;
 	     i++)
 	{
+		if (i == DST_ALG_GSSAPI) {
+			continue;
+		}
 		if (dst_algorithm_supported(i)) {
 			isc_buffer_putstr(b, " ");
 			isc_buffer_putstr(b, dst_hmac_algorithm_totext(i));
@@ -787,6 +793,12 @@ parse_T_opt(char *option) {
 		}
 	} else if (!strcmp(option, "sigvalinsecs")) {
 		sigvalinsecs = true;
+	} else if (!strcmp(option, "transferinsecs")) {
+		transferinsecs = true;
+	} else if (!strcmp(option, "transferslowly")) {
+		transferslowly = true;
+	} else if (!strcmp(option, "transferstuck")) {
+		transferstuck = true;
 	} else if (!strncmp(option, "tat=", 4)) {
 		named_g_tat_interval = atoi(option + 4);
 	} else {
@@ -1186,6 +1198,13 @@ setup(void) {
 		      "linked to OpenSSL version: %s",
 		      SSLeay_version(SSLEAY_VERSION));
 #endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with libuv version: %d.%d.%d", UV_VERSION_MAJOR,
+		      UV_VERSION_MINOR, UV_VERSION_PATCH);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to libuv version: %s", uv_version_string());
 #ifdef HAVE_LIBXML2
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -1364,6 +1383,15 @@ setup(void) {
 	if (sigvalinsecs) {
 		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, true);
 	}
+	if (transferinsecs) {
+		ns_server_setoption(sctx, NS_SERVER_TRANSFERINSECS, true);
+	}
+	if (transferslowly) {
+		ns_server_setoption(sctx, NS_SERVER_TRANSFERSLOWLY, true);
+	}
+	if (transferstuck) {
+		ns_server_setoption(sctx, NS_SERVER_TRANSFERSTUCK, true);
+	}
 }
 
 static void
diff --git a/bin/named/os.c b/bin/named/os.c
index e984b4b..7af4729 100644
--- a/bin/named/os.c
+++ b/bin/named/os.c
@@ -869,14 +869,6 @@ named_os_shutdown(void) {
 	cleanup_lockfile();
 }
 
-isc_result_t
-named_os_gethostname(char *buf, size_t len) {
-	int n;
-
-	n = gethostname(buf, len);
-	return ((n == 0) ? ISC_R_SUCCESS : ISC_R_FAILURE);
-}
-
 void
 named_os_shutdownmsg(char *command, isc_buffer_t *text) {
 	char *last, *ptr;
diff --git a/bin/named/server.c b/bin/named/server.c
index 1d74785..2f21fc5 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -2500,9 +2500,9 @@ configure_rpz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t **maps,
 	}
 #endif /* ifndef USE_DNSRPS */
 
-	result = dns_rpz_new_zones(&view->rpzs, rps_cstr, rps_cstr_size,
-				   view->mctx, named_g_taskmgr,
-				   named_g_timermgr);
+	result = dns_rpz_new_zones(view->mctx, named_g_taskmgr,
+				   named_g_timermgr, rps_cstr, rps_cstr_size,
+				   &view->rpzs);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -2638,8 +2638,10 @@ configure_rpz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t **maps,
 	}
 
 	if (*old_rpz_okp) {
+		dns_rpz_shutdown_rpzs(view->rpzs);
 		dns_rpz_detach_rpzs(&view->rpzs);
 		dns_rpz_attach_rpzs(pview->rpzs, &view->rpzs);
+		dns_rpz_detach_rpzs(&pview->rpzs);
 	} else if (old != NULL && pview != NULL) {
 		++pview->rpzs->rpz_ver;
 		view->rpzs->rpz_ver = pview->rpzs->rpz_ver;
@@ -2875,7 +2877,7 @@ cleanup:
 		cfg_obj_destroy(cfg->add_parser, &zoneconf);
 	}
 	dns_catz_entry_detach(ev->origin, &ev->entry);
-	dns_catz_zone_detach(&ev->origin);
+	dns_catz_detach_catz(&ev->origin);
 	dns_view_detach(&ev->view);
 	isc_event_free(ISC_EVENT_PTR(&ev));
 }
@@ -2950,7 +2952,7 @@ cleanup:
 		dns_zone_detach(&zone);
 	}
 	dns_catz_entry_detach(ev->origin, &ev->entry);
-	dns_catz_zone_detach(&ev->origin);
+	dns_catz_detach_catz(&ev->origin);
 	dns_view_detach(&ev->view);
 	isc_event_free(ISC_EVENT_PTR(&ev));
 }
@@ -2992,7 +2994,7 @@ catz_create_chg_task(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
 	event->mod = (type == DNS_EVENT_CATZMODZONE);
 
 	dns_catz_entry_attach(entry, &event->entry);
-	dns_catz_zone_attach(origin, &event->origin);
+	dns_catz_attach_catz(origin, &event->origin);
 	dns_view_attach(view, &event->view);
 
 	isc_task_send(task, ISC_EVENT_PTR(&event));
@@ -3159,7 +3161,7 @@ static dns_catz_zonemodmethods_t ns_catz_zonemodmethods = {
 static isc_result_t
 configure_catz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t *config,
 	       const cfg_obj_t *catz_obj) {
-	const cfg_listelt_t *zone_element;
+	const cfg_listelt_t *zone_element = NULL;
 	const dns_catz_zones_t *old = NULL;
 	bool pview_must_detach = false;
 	isc_result_t result;
@@ -3172,9 +3174,8 @@ configure_catz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t *config,
 		return (ISC_R_SUCCESS);
 	}
 
-	CHECK(dns_catz_new_zones(&view->catzs, &ns_catz_zonemodmethods,
-				 view->mctx, named_g_taskmgr,
-				 named_g_timermgr));
+	CHECK(dns_catz_new_zones(view->mctx, named_g_taskmgr, named_g_timermgr,
+				 &view->catzs, &ns_catz_zonemodmethods));
 
 	if (pview != NULL) {
 		old = pview->catzs;
@@ -3188,8 +3189,10 @@ configure_catz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t *config,
 	}
 
 	if (old != NULL) {
-		dns_catz_catzs_detach(&view->catzs);
-		dns_catz_catzs_attach(pview->catzs, &view->catzs);
+		dns_catz_shutdown_catzs(view->catzs);
+		dns_catz_detach_catzs(&view->catzs);
+		dns_catz_attach_catzs(pview->catzs, &view->catzs);
+		dns_catz_detach_catzs(&pview->catzs);
 		dns_catz_prereconfig(view->catzs);
 	}
 
@@ -3920,8 +3923,7 @@ configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
 	if (result == ISC_R_SUCCESS && cfg_obj_isboolean(obj)) {
 		/* "hostname" is interpreted as boolean true */
 		char buf[256];
-		result = named_os_gethostname(buf, sizeof(buf));
-		if (result == ISC_R_SUCCESS) {
+		if (gethostname(buf, sizeof(buf)) == 0) {
 			dns_dt_setidentity(named_g_server->dtenv, buf);
 		}
 	} else if (result == ISC_R_SUCCESS && !cfg_obj_isvoid(obj)) {
@@ -4042,6 +4044,28 @@ minimal_cache_allowed(const cfg_obj_t *maps[4],
 
 static const char *const response_synonyms[] = { "response", NULL };
 
+static const dns_name_t *
+algorithm_name(unsigned int alg) {
+	switch (alg) {
+	case DST_ALG_HMACMD5:
+		return (dns_tsig_hmacmd5_name);
+	case DST_ALG_HMACSHA1:
+		return (dns_tsig_hmacsha1_name);
+	case DST_ALG_HMACSHA224:
+		return (dns_tsig_hmacsha224_name);
+	case DST_ALG_HMACSHA256:
+		return (dns_tsig_hmacsha256_name);
+	case DST_ALG_HMACSHA384:
+		return (dns_tsig_hmacsha384_name);
+	case DST_ALG_HMACSHA512:
+		return (dns_tsig_hmacsha512_name);
+	case DST_ALG_GSSAPI:
+		return (dns_tsig_gssapi_name);
+	default:
+		UNREACHABLE();
+	}
+}
+
 /*
  * Configure 'view' according to 'vconfig', taking defaults from
  * 'config' where values are missing in 'vconfig'.
@@ -4072,7 +4096,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	const cfg_obj_t *dyndb_list, *plugin_list;
 	const cfg_obj_t *disabled;
 	const cfg_obj_t *obj, *obj2;
-	const cfg_listelt_t *element;
+	const cfg_listelt_t *element = NULL;
+	const cfg_listelt_t *zone_element_latest = NULL;
 	in_port_t port;
 	dns_cache_t *cache = NULL;
 	isc_result_t result;
@@ -4090,7 +4115,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	dns_dispatch_t *dispatch6 = NULL;
 	bool rpz_configured = false;
 	bool catz_configured = false;
-	bool zones_configured = false;
 	bool shared_cache = false;
 	int i = 0, j = 0, k = 0;
 	const char *str;
@@ -4201,8 +4225,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		CHECK(configure_zone(config, zconfig, vconfig, mctx, view,
 				     viewlist, kasplist, actx, false,
 				     old_rpz_ok, false));
+		zone_element_latest = element;
 	}
-	zones_configured = true;
 
 	/*
 	 * Check that a primary or secondary zone was found for each
@@ -5074,8 +5098,18 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	 */
 	CHECK(named_tsigkeyring_fromconfig(config, vconfig, view->mctx, &ring));
 	if (named_g_server->sessionkey != NULL) {
-		CHECK(dns_tsigkeyring_add(ring, named_g_server->session_keyname,
-					  named_g_server->sessionkey));
+		dns_tsigkey_t *tsigkey = NULL;
+		result = dns_tsigkey_createfromkey(
+			named_g_server->session_keyname,
+			algorithm_name(named_g_server->session_keyalg),
+			named_g_server->sessionkey, false, NULL, 0, 0, mctx,
+			NULL, &tsigkey);
+		if (result == ISC_R_SUCCESS) {
+			result = dns_tsigkeyring_add(
+				ring, named_g_server->session_keyname, tsigkey);
+			dns_tsigkey_detach(&tsigkey);
+		}
+		CHECK(result);
 	}
 	dns_view_setkeyring(view, ring);
 	dns_tsigkeyring_detach(&ring);
@@ -6046,9 +6080,6 @@ cleanup:
 			    named_config_get(maps, "catalog-zones", &obj) ==
 				    ISC_R_SUCCESS)
 			{
-				if (pview->catzs != NULL) {
-					dns_catz_catzs_detach(&pview->catzs);
-				}
 				/*
 				 * We are swapping the places of the `view` and
 				 * `pview` in the function's parameters list
@@ -6076,7 +6107,7 @@ cleanup:
 			dns_view_detach(&pview);
 		}
 
-		if (zones_configured) {
+		if (zone_element_latest != NULL) {
 			for (element = cfg_list_first(zonelist);
 			     element != NULL; element = cfg_list_next(element))
 			{
@@ -6084,6 +6115,13 @@ cleanup:
 					cfg_listelt_value(element);
 				configure_zone_setviewcommit(result, zconfig,
 							     view);
+				if (element == zone_element_latest) {
+					/*
+					 * This was the latest element that was
+					 * successfully configured earlier.
+					 */
+					break;
+				}
 			}
 		}
 	}
@@ -7529,7 +7567,7 @@ cleanup_session_key(named_server_t *server, isc_mem_t *mctx) {
 	}
 
 	if (server->sessionkey != NULL) {
-		dns_tsigkey_detach(&server->sessionkey);
+		dst_key_free(&server->sessionkey);
 	}
 
 	server->session_keyalg = DST_ALG_UNKNOWN;
@@ -7539,9 +7577,8 @@ cleanup_session_key(named_server_t *server, isc_mem_t *mctx) {
 static isc_result_t
 generate_session_key(const char *filename, const char *keynamestr,
 		     const dns_name_t *keyname, const char *algstr,
-		     const dns_name_t *algname, unsigned int algtype,
-		     uint16_t bits, isc_mem_t *mctx, bool first_time,
-		     dns_tsigkey_t **tsigkeyp) {
+		     unsigned int algtype, uint16_t bits, isc_mem_t *mctx,
+		     bool first_time, dst_key_t **keyp) {
 	isc_result_t result = ISC_R_SUCCESS;
 	dst_key_t *key = NULL;
 	isc_buffer_t key_txtbuffer;
@@ -7549,8 +7586,6 @@ generate_session_key(const char *filename, const char *keynamestr,
 	char key_txtsecret[256];
 	char key_rawsecret[64];
 	isc_region_t key_rawregion;
-	isc_stdtime_t now;
-	dns_tsigkey_t *tsigkey = NULL;
 	FILE *fp = NULL;
 
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -7566,8 +7601,7 @@ generate_session_key(const char *filename, const char *keynamestr,
 	}
 
 	/*
-	 * Dump the key to the buffer for later use.  Should be done before
-	 * we transfer the ownership of key to tsigkey.
+	 * Dump the key to the buffer for later use.
 	 */
 	isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));
 	CHECK(dst_key_tobuffer(key, &key_rawbuffer));
@@ -7576,11 +7610,6 @@ generate_session_key(const char *filename, const char *keynamestr,
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
 	CHECK(isc_base64_totext(&key_rawregion, -1, "", &key_txtbuffer));
 
-	/* Store the key in tsigkey. */
-	isc_stdtime_get(&now);
-	CHECK(dns_tsigkey_createfromkey(dst_key_name(key), algname, key, false,
-					NULL, now, now, mctx, NULL, &tsigkey));
-
 	/* Dump the key to the key file. */
 	fp = named_os_openfile(filename, S_IRUSR | S_IWUSR, first_time);
 	if (fp == NULL) {
@@ -7605,10 +7634,7 @@ generate_session_key(const char *filename, const char *keynamestr,
 		goto cleanup;
 	}
 
-	dst_key_free(&key);
-
-	*tsigkeyp = tsigkey;
-
+	*keyp = key;
 	return (ISC_R_SUCCESS);
 
 cleanup:
@@ -7621,9 +7647,6 @@ cleanup:
 		(void)isc_stdio_close(fp);
 		(void)isc_file_remove(filename);
 	}
-	if (tsigkey != NULL) {
-		dns_tsigkey_detach(&tsigkey);
-	}
 	if (key != NULL) {
 		dst_key_free(&key);
 	}
@@ -7728,8 +7751,8 @@ configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 		server->session_keybits = bits;
 
 		CHECK(generate_session_key(keyfile, keynamestr, keyname, algstr,
-					   algname, algtype, bits, mctx,
-					   first_time, &server->sessionkey));
+					   algtype, bits, mctx, first_time,
+					   &server->sessionkey));
 	}
 
 	return (result);
@@ -8546,7 +8569,8 @@ load_configuration(const char *filename, named_server_t *server,
 	 * checked later when the modules are actually loaded and
 	 * registered.)
 	 */
-	CHECK(bind9_check_namedconf(config, false, named_g_lctx, named_g_mctx));
+	CHECK(bind9_check_namedconf(config, false, false, named_g_lctx,
+				    named_g_mctx));
 
 	/* Let's recreate the TLS context cache */
 	if (server->tlsctx_server_cache != NULL) {
@@ -9604,10 +9628,10 @@ load_configuration(const char *filename, named_server_t *server,
 
 	obj = NULL;
 	result = named_config_get(maps, "server-id", &obj);
-	server->sctx->gethostname = NULL;
+	server->sctx->usehostname = false;
 	if (result == ISC_R_SUCCESS && cfg_obj_isboolean(obj)) {
 		/* The parser translates "hostname" to true */
-		server->sctx->gethostname = named_os_gethostname;
+		server->sctx->usehostname = true;
 		result = ns_server_setserverid(server->sctx, NULL);
 	} else if (result == ISC_R_SUCCESS && !cfg_obj_isvoid(obj)) {
 		/* Found a quoted string */
@@ -9851,6 +9875,7 @@ view_loaded(void *arg) {
 	if (isc_refcount_decrement(&zl->refs) == 1) {
 		named_server_t *server = zl->server;
 		bool reconfig = zl->reconfig;
+		dns_view_t *view = NULL;
 
 		isc_refcount_destroy(&zl->refs);
 		isc_mem_put(server->mctx, zl, sizeof(*zl));
@@ -9871,6 +9896,28 @@ view_loaded(void *arg) {
 				      "all zones loaded");
 		}
 
+		for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
+		     view = ISC_LIST_NEXT(view, link))
+		{
+			if (view->managed_keys != NULL) {
+				result = dns_zone_synckeyzone(
+					view->managed_keys);
+				if (result != ISC_R_SUCCESS) {
+					isc_log_write(
+						named_g_lctx,
+						DNS_LOGCATEGORY_DNSSEC,
+						DNS_LOGMODULE_DNSSEC,
+						ISC_LOG_ERROR,
+						"failed to initialize "
+						"managed-keys for view %s "
+						"(%s): DNSSEC validation is "
+						"at risk",
+						view->name,
+						isc_result_totext(result));
+				}
+			}
+		}
+
 		CHECKFATAL(dns_zonemgr_forcemaint(server->zonemgr),
 			   "forcing zone maintenance");
 
@@ -12307,8 +12354,7 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 		 cb);
 	CHECK(putstr(text, line));
 
-	result = named_os_gethostname(hostname, sizeof(hostname));
-	if (result != ISC_R_SUCCESS) {
+	if (gethostname(hostname, sizeof(hostname)) == 0) {
 		strlcpy(hostname, "localhost", sizeof(hostname));
 	}
 	snprintf(line, sizeof(line), "running on %s: %s\n", hostname,
diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
index f6ce425..2c4760c 100644
--- a/bin/named/statschannel.c
+++ b/bin/named/statschannel.c
@@ -441,6 +441,8 @@ init_desc(void) {
 	SET_RESSTATDESC(zonequota, "spilled due to zone quota", "ZoneQuota");
 	SET_RESSTATDESC(serverquota, "spilled due to server quota",
 			"ServerQuota");
+	SET_RESSTATDESC(clientquota, "spilled due to clients per query quota",
+			"ClientQuota");
 	SET_RESSTATDESC(nextitem, "waited for next item", "NextItem");
 	SET_RESSTATDESC(priming, "priming queries", "Priming");
 
diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index a94c3fa..44c2242 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -777,23 +777,27 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
 static bool
 isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
        const isc_sockaddr_t *dstaddr, dns_rdataclass_t rdclass, void *arg) {
-	ns_interfacemgr_t *interfacemgr = (ns_interfacemgr_t *)arg;
-	dns_aclenv_t *env = ns_interfacemgr_getaclenv(interfacemgr);
-	dns_view_t *view;
+	dns_aclenv_t *env = NULL;
+	dns_view_t *view = NULL;
 	dns_tsigkey_t *key = NULL;
 	isc_netaddr_t netsrc;
 	isc_netaddr_t netdst;
 
-	if (interfacemgr == NULL) {
+	UNUSED(arg);
+
+	/* interfacemgr can be destroyed only in exclusive mode. */
+	if (named_g_server->interfacemgr == NULL) {
 		return (true);
 	}
 
-	if (!ns_interfacemgr_listeningon(interfacemgr, dstaddr)) {
+	if (!ns_interfacemgr_listeningon(named_g_server->interfacemgr, dstaddr))
+	{
 		return (false);
 	}
 
 	isc_netaddr_fromsockaddr(&netsrc, srcaddr);
 	isc_netaddr_fromsockaddr(&netdst, dstaddr);
+	env = ns_interfacemgr_getaclenv(named_g_server->interfacemgr);
 
 	for (view = ISC_LIST_HEAD(named_g_server->viewlist); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
@@ -912,6 +916,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	int seconds;
 	dns_ttl_t maxttl = 0; /* unlimited */
 	dns_zone_t *mayberaw = (raw != NULL) ? raw : zone;
+	bool transferinsecs = ns_server_getoption(named_g_server->sctx,
+						  NS_SERVER_TRANSFERINSECS);
 
 	i = 0;
 	if (zconfig != NULL) {
@@ -935,8 +941,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	maps[i] = NULL;
 
 	if (vconfig != NULL) {
-		RETERR(named_config_getclass(cfg_tuple_get(vconfig, "class"),
-					     dns_rdataclass_in, &vclass));
+		CHECK(named_config_getclass(cfg_tuple_get(vconfig, "class"),
+					    dns_rdataclass_in, &vclass));
 	} else {
 		vclass = dns_rdataclass_in;
 	}
@@ -947,8 +953,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 
 	zname = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
 
-	RETERR(named_config_getclass(cfg_tuple_get(zconfig, "class"), vclass,
-				     &zclass));
+	CHECK(named_config_getclass(cfg_tuple_get(zconfig, "class"), vclass,
+				    &zclass));
 	dns_zone_setclass(zone, zclass);
 	if (raw != NULL) {
 		dns_zone_setclass(raw, zclass);
@@ -968,7 +974,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		cpval = isc_mem_strdup(mctx, cfg_obj_asstring(obj));
 	}
 	if (cpval == NULL) {
-		return (ISC_R_NOMEMORY);
+		CHECK(ISC_R_NOMEMORY);
 	}
 
 	obj = NULL;
@@ -983,7 +989,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				      "zone '%s': both 'database' and 'dlz' "
 				      "specified",
 				      zname);
-			return (ISC_R_FAILURE);
+			CHECK(ISC_R_FAILURE);
 		}
 
 		len = strlen(dlzname) + 5;
@@ -994,7 +1000,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	result = strtoargv(mctx, cpval, &dbargc, &dbargv);
 	if (result != ISC_R_SUCCESS && cpval != default_dbtype) {
 		isc_mem_free(mctx, cpval);
-		return (result);
+		CHECK(result);
 	}
 
 	/*
@@ -1024,7 +1030,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "zone '%s': 'file' not specified", zname);
-		return (ISC_R_FAILURE);
+		CHECK(ISC_R_FAILURE);
 	}
 
 	if (ztype == dns_zone_secondary || ztype == dns_zone_mirror) {
@@ -1057,7 +1063,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				    "can only be used with "
 				    "'masterfile-format text'",
 				    zname);
-			return (ISC_R_FAILURE);
+			CHECK(ISC_R_FAILURE);
 		}
 
 		if (strcasecmp(masterstylestr, "full") == 0) {
@@ -1082,47 +1088,45 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
 		char *signedname;
 
-		RETERR(dns_zone_setfile(raw, filename, masterformat,
-					masterstyle));
+		CHECK(dns_zone_setfile(raw, filename, masterformat,
+				       masterstyle));
 		signedname = isc_mem_get(mctx, signedlen);
 
 		(void)snprintf(signedname, signedlen, "%s" SIGNED, filename);
 		result = dns_zone_setfile(zone, signedname,
 					  dns_masterformat_raw, NULL);
 		isc_mem_put(mctx, signedname, signedlen);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
+		CHECK(result);
 	} else {
-		RETERR(dns_zone_setfile(zone, filename, masterformat,
-					masterstyle));
+		CHECK(dns_zone_setfile(zone, filename, masterformat,
+				       masterstyle));
 	}
 
 	obj = NULL;
 	result = cfg_map_get(zoptions, "journal", &obj);
 	if (result == ISC_R_SUCCESS) {
-		RETERR(dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj)));
+		CHECK(dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj)));
 	}
 
 	/*
 	 * Notify messages are processed by the raw zone if it exists.
 	 */
 	if (ztype == dns_zone_secondary || ztype == dns_zone_mirror) {
-		RETERR(configure_zone_acl(
-			zconfig, vconfig, config, allow_notify, ac, mayberaw,
-			dns_zone_setnotifyacl, dns_zone_clearnotifyacl));
+		CHECK(configure_zone_acl(zconfig, vconfig, config, allow_notify,
+					 ac, mayberaw, dns_zone_setnotifyacl,
+					 dns_zone_clearnotifyacl));
 	}
 
 	/*
 	 * XXXAG This probably does not make sense for stubs.
 	 */
-	RETERR(configure_zone_acl(zconfig, vconfig, config, allow_query, ac,
-				  zone, dns_zone_setqueryacl,
-				  dns_zone_clearqueryacl));
+	CHECK(configure_zone_acl(zconfig, vconfig, config, allow_query, ac,
+				 zone, dns_zone_setqueryacl,
+				 dns_zone_clearqueryacl));
 
-	RETERR(configure_zone_acl(zconfig, vconfig, config, allow_query_on, ac,
-				  zone, dns_zone_setqueryonacl,
-				  dns_zone_clearqueryonacl));
+	CHECK(configure_zone_acl(zconfig, vconfig, config, allow_query_on, ac,
+				 zone, dns_zone_setqueryonacl,
+				 dns_zone_clearqueryonacl));
 
 	obj = NULL;
 	result = named_config_get(maps, "dialup", &obj);
@@ -1179,10 +1183,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	rcvquerystats = NULL;
 	dnssecsignstats = NULL;
 	if (statlevel == dns_zonestat_full) {
-		RETERR(isc_stats_create(mctx, &zoneqrystats,
-					ns_statscounter_max));
-		RETERR(dns_rdatatypestats_create(mctx, &rcvquerystats));
-		RETERR(dns_dnssecsignstats_create(mctx, &dnssecsignstats));
+		CHECK(isc_stats_create(mctx, &zoneqrystats,
+				       ns_statscounter_max));
+		CHECK(dns_rdatatypestats_create(mctx, &rcvquerystats));
+		CHECK(dns_dnssecsignstats_create(mctx, &dnssecsignstats));
 	}
 	dns_zone_setrequeststats(zone, zoneqrystats);
 	dns_zone_setrcvquerystats(zone, rcvquerystats);
@@ -1221,7 +1225,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 						ISC_LOG_ERROR,
 						"dnssec-policy '%s' not found ",
 						kaspname);
-					RETERR(result);
+					CHECK(result);
 				}
 				dns_zone_setkasp(zone, kasp);
 				use_kasp = true;
@@ -1270,8 +1274,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
 
-			RETERR(named_config_getipandkeylist(config, "primaries",
-							    obj, mctx, &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setalsonotify(zone, ipkl.addrs, ipkl.keys,
 					       ipkl.tlss, ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
@@ -1282,28 +1286,30 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "parental-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj)));
+
+		CHECK(dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj)));
 		named_add_reserved_dispatch(named_g_server,
 					    cfg_obj_assockaddr(obj));
 
 		obj = NULL;
 		result = named_config_get(maps, "parental-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj)));
+
+		CHECK(dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj)));
 		named_add_reserved_dispatch(named_g_server,
 					    cfg_obj_assockaddr(obj));
 
 		obj = NULL;
 		result = named_config_get(maps, "notify-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
+		CHECK(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
 		named_add_reserved_dispatch(named_g_server,
 					    cfg_obj_assockaddr(obj));
 
 		obj = NULL;
 		result = named_config_get(maps, "notify-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
+		CHECK(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
 		named_add_reserved_dispatch(named_g_server,
 					    cfg_obj_assockaddr(obj));
 
@@ -1313,21 +1319,25 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFYTOSOA,
 				   cfg_obj_asboolean(obj));
 
-		dns_zone_setisself(zone, isself, named_g_server->interfacemgr);
+		dns_zone_setisself(zone, isself, NULL);
 
-		RETERR(configure_zone_acl(
+		CHECK(configure_zone_acl(
 			zconfig, vconfig, config, allow_transfer, ac, zone,
 			dns_zone_setxfracl, dns_zone_clearxfracl));
 
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-out", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setmaxxfrout(zone, cfg_obj_asuint32(obj) * 60);
+		dns_zone_setmaxxfrout(
+			zone, transferinsecs ? cfg_obj_asuint32(obj)
+					     : cfg_obj_asuint32(obj) * 60);
 
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-idle-out", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setidleout(zone, cfg_obj_asuint32(obj) * 60);
+		dns_zone_setidleout(zone, transferinsecs
+						  ? cfg_obj_asuint32(obj)
+						  : cfg_obj_asuint32(obj) * 60);
 
 		obj = NULL;
 		result = named_config_get(maps, "max-journal-size", &obj);
@@ -1353,7 +1363,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 					    "%" PRId64 "' "
 					    "is too large",
 					    value);
-				RETERR(ISC_R_RANGE);
+				CHECK(ISC_R_RANGE);
 			}
 			journal_size = (uint32_t)value;
 		}
@@ -1493,7 +1503,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 					    "%" PRId64 "' "
 					    "is too large",
 					    value);
-				RETERR(ISC_R_RANGE);
+				CHECK(ISC_R_RANGE);
 			}
 			journal_size = (uint32_t)value;
 		}
@@ -1501,7 +1511,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}
 
 	if (use_kasp) {
-		maxttl = dns_kasp_zonemaxttl(dns_zone_getkasp(zone));
+		maxttl = dns_kasp_zonemaxttl(dns_zone_getkasp(zone), false);
 	} else {
 		obj = NULL;
 		result = named_config_get(maps, "max-zone-ttl", &obj);
@@ -1523,9 +1533,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype == dns_zone_primary) {
 		dns_acl_t *updateacl;
 
-		RETERR(configure_zone_acl(
-			zconfig, vconfig, config, allow_update, ac, mayberaw,
-			dns_zone_setupdateacl, dns_zone_clearupdateacl));
+		CHECK(configure_zone_acl(zconfig, vconfig, config, allow_update,
+					 ac, mayberaw, dns_zone_setupdateacl,
+					 dns_zone_clearupdateacl));
 
 		updateacl = dns_zone_getupdateacl(mayberaw);
 		if (updateacl != NULL && dns_acl_isinsecure(updateacl)) {
@@ -1536,7 +1546,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				      zname);
 		}
 
-		RETERR(configure_zone_ssutable(zoptions, mayberaw, zname));
+		CHECK(configure_zone_ssutable(zoptions, mayberaw, zname));
 	}
 
 	/*
@@ -1613,7 +1623,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "key-directory", &obj);
 		if (result == ISC_R_SUCCESS) {
 			filename = cfg_obj_asstring(obj);
-			RETERR(dns_zone_setkeydirectory(zone, filename));
+			CHECK(dns_zone_setkeydirectory(zone, filename));
 		}
 
 		obj = NULL;
@@ -1655,8 +1665,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "dnssec-loadkeys-interval",
 					  &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setrefreshkeyinterval(zone,
-						      cfg_obj_asuint32(obj)));
+		CHECK(dns_zone_setrefreshkeyinterval(zone,
+						     cfg_obj_asuint32(obj)));
 
 		obj = NULL;
 		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
@@ -1684,10 +1694,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}
 
 	if (ztype == dns_zone_secondary || ztype == dns_zone_mirror) {
-		RETERR(configure_zone_acl(zconfig, vconfig, config,
-					  allow_update_forwarding, ac, mayberaw,
-					  dns_zone_setforwardacl,
-					  dns_zone_clearforwardacl));
+		CHECK(configure_zone_acl(zconfig, vconfig, config,
+					 allow_update_forwarding, ac, mayberaw,
+					 dns_zone_setforwardacl,
+					 dns_zone_clearforwardacl));
 	}
 
 	/*%
@@ -1699,7 +1709,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		if (obj != NULL) {
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
-			RETERR(named_config_getipandkeylist(
+			CHECK(named_config_getipandkeylist(
 				config, "parental-agents", obj, mctx, &ipkl));
 			dns_zone_setparentals(zone, ipkl.addrs, ipkl.keys,
 					      ipkl.tlss, ipkl.count);
@@ -1843,7 +1853,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		(void)cfg_map_get(zoptions, "allow-transfer", &obj);
 		if (obj == NULL) {
 			dns_acl_t *none;
-			RETERR(dns_acl_none(mctx, &none));
+			CHECK(dns_acl_none(mctx, &none));
 			dns_zone_setxfracl(zone, none);
 			dns_acl_detach(&none);
 		}
@@ -1868,14 +1878,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			result = named_config_getremotesdef(
 				named_g_config, "primaries",
 				DEFAULT_IANA_ROOT_ZONE_PRIMARIES, &obj);
-			RETERR(result);
+			CHECK(result);
 		}
 		if (obj != NULL) {
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
 
-			RETERR(named_config_getipandkeylist(config, "primaries",
-							    obj, mctx, &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setprimaries(mayberaw, ipkl.addrs, ipkl.keys,
 					      ipkl.tlss, ipkl.count);
 			count = ipkl.count;
@@ -1896,12 +1906,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setmaxxfrin(mayberaw, cfg_obj_asuint32(obj) * 60);
+		dns_zone_setmaxxfrin(
+			mayberaw, transferinsecs ? cfg_obj_asuint32(obj)
+						 : cfg_obj_asuint32(obj) * 60);
 
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-idle-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setidlein(mayberaw, cfg_obj_asuint32(obj) * 60);
+		dns_zone_setidlein(mayberaw,
+				   transferinsecs ? cfg_obj_asuint32(obj)
+						  : cfg_obj_asuint32(obj) * 60);
 
 		obj = NULL;
 		result = named_config_get(maps, "max-refresh-time", &obj);
@@ -1926,29 +1940,29 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "transfer-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setxfrsource4(mayberaw,
-					      cfg_obj_assockaddr(obj)));
+		CHECK(dns_zone_setxfrsource4(mayberaw,
+					     cfg_obj_assockaddr(obj)));
 		named_add_reserved_dispatch(named_g_server,
 					    cfg_obj_assockaddr(obj));
 
 		obj = NULL;
 		result = named_config_get(maps, "transfer-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setxfrsource6(mayberaw,
-					      cfg_obj_assockaddr(obj)));
+		CHECK(dns_zone_setxfrsource6(mayberaw,
+					     cfg_obj_assockaddr(obj)));
 		named_add_reserved_dispatch(named_g_server,
 					    cfg_obj_assockaddr(obj));
 
 		obj = NULL;
 		result = named_config_get(maps, "alt-transfer-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setaltxfrsource4(mayberaw,
-						 cfg_obj_assockaddr(obj)));
+		CHECK(dns_zone_setaltxfrsource4(mayberaw,
+						cfg_obj_assockaddr(obj)));
 		obj = NULL;
 		result = named_config_get(maps, "alt-transfer-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setaltxfrsource6(mayberaw,
-						 cfg_obj_assockaddr(obj)));
+		CHECK(dns_zone_setaltxfrsource6(mayberaw,
+						cfg_obj_assockaddr(obj)));
 		obj = NULL;
 		(void)named_config_get(maps, "use-alt-transfer-source", &obj);
 		if (obj == NULL) {
@@ -1975,15 +1989,21 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		break;
 
 	case dns_zone_staticstub:
-		RETERR(configure_staticstub(zoptions, zone, zname,
-					    default_dbtype));
+		CHECK(configure_staticstub(zoptions, zone, zname,
+					   default_dbtype));
 		break;
 
 	default:
 		break;
 	}
 
-	return (ISC_R_SUCCESS);
+	result = ISC_R_SUCCESS;
+
+cleanup:
+	if (kasp != NULL) {
+		dns_kasp_detach(&kasp);
+	}
+	return (result);
 }
 
 /*
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 3dceff7..1f06dab 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -96,12 +96,11 @@
 
 #include "../dig/readline.h"
 
-#define MAXCMD	     (128 * 1024)
-#define MAXWIRE	     (64 * 1024)
-#define INITTEXT     (2 * 1024)
-#define MAXTEXT	     (128 * 1024)
-#define FIND_TIMEOUT 5
-#define TTL_MAX	     2147483647U /* Maximum signed 32 bit integer. */
+#define MAXCMD	 (128 * 1024)
+#define MAXWIRE	 (64 * 1024)
+#define INITTEXT (2 * 1024)
+#define MAXTEXT	 (128 * 1024)
+#define TTL_MAX	 2147483647U /* Maximum signed 32 bit integer. */
 
 #define DNSDEFAULTPORT 53
 
@@ -1177,9 +1176,6 @@ parse_args(int argc, char **argv) {
 					isc_commandline_argument);
 				exit(1);
 			}
-			if (udp_timeout == 0) {
-				udp_timeout = UINT_MAX;
-			}
 			break;
 		case 'r':
 			result = isc_parse_uint32(&udp_retries,
@@ -2614,9 +2610,9 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		}
 
 		result = dns_request_create(requestmgr, soaquery, srcaddr, addr,
-					    0, NULL, FIND_TIMEOUT * 20,
-					    FIND_TIMEOUT, 3, global_task,
-					    recvsoa, reqinfo, &request);
+					    0, NULL, timeout, udp_timeout,
+					    udp_retries, global_task, recvsoa,
+					    reqinfo, &request);
 		check_result(result, "dns_request_create");
 		requests++;
 		return;
@@ -2841,9 +2837,9 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 	}
 
 	result = dns_request_create(requestmgr, msg, srcaddr, destaddr, 0,
-				    default_servers ? NULL : tsigkey,
-				    FIND_TIMEOUT * 20, FIND_TIMEOUT, 3,
-				    global_task, recvsoa, reqinfo, request);
+				    default_servers ? NULL : tsigkey, timeout,
+				    udp_timeout, udp_retries, global_task,
+				    recvsoa, reqinfo, request);
 	check_result(result, "dns_request_create");
 	requests++;
 }
@@ -3043,7 +3039,7 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 	}
 
 	result = dns_request_create(requestmgr, msg, srcaddr, destaddr, options,
-				    tsigkey, FIND_TIMEOUT * 20, FIND_TIMEOUT, 3,
+				    tsigkey, timeout, udp_timeout, udp_retries,
 				    global_task, recvgss, reqinfo, request);
 	check_result(result, "dns_request_create");
 	if (debugging) {
@@ -3144,7 +3140,16 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 	if (rcvmsg->rcode != dns_rcode_noerror &&
 	    rcvmsg->rcode != dns_rcode_nxdomain)
 	{
-		fatal("response to GSS-TSIG query was unsuccessful");
+		char rcode[64];
+		isc_buffer_t b;
+
+		isc_buffer_init(&b, rcode, sizeof(rcode) - 1);
+		result = dns_rcode_totext(rcvmsg->rcode, &b);
+		check_result(result, "dns_rcode_totext");
+		rcode[isc_buffer_usedlength(&b)] = 0;
+
+		fatal("response to GSS-TSIG query was unsuccessful (%s)",
+		      rcode);
 	}
 
 	servname = dns_fixedname_initname(&fname);
@@ -3398,6 +3403,8 @@ getinput(isc_task_t *task, isc_event_t *event) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
+	uint32_t timeoutms;
+
 	style = &dns_master_style_debug;
 
 	input = stdin;
@@ -3424,6 +3431,10 @@ main(int argc, char **argv) {
 
 	setup_system();
 
+	/* Set the network manager timeouts in milliseconds. */
+	timeoutms = timeout * 1000;
+	isc_nm_settimeouts(netmgr, timeoutms, timeoutms, timeoutms, timeoutms);
+
 	result = isc_app_onrun(gmctx, global_task, getinput, NULL);
 	check_result(result, "isc_app_onrun");
 
diff --git a/bin/nsupdate/nsupdate.rst b/bin/nsupdate/nsupdate.rst
index b91a606..81bb481 100644
--- a/bin/nsupdate/nsupdate.rst
+++ b/bin/nsupdate/nsupdate.rst
@@ -141,7 +141,11 @@ Options
 .. option:: -t timeout
 
    This option sets the maximum time an update request can take before it is aborted. The
-   default is 300 seconds. If zero, the timeout is disabled.
+   default is 300 seconds. If zero, the timeout is disabled for TCP mode. For UDP mode,
+   the option :option:`-u` takes precedence over this option, unless the option :option:`-u`
+   is set to zero, in which case the interval is computed from the :option:`-t` timeout interval
+   and the number of UDP retries. For UDP mode, the timeout can not be disabled, and will
+   be rounded up to 1 second in case if both :option:`-t` and :option:`-u` are set to zero.
 
 .. option:: -T
 
diff --git a/bin/plugins/filter-a.c b/bin/plugins/filter-a.c
index 06cd3a7..8556cb7 100644
--- a/bin/plugins/filter-a.c
+++ b/bin/plugins/filter-a.c
@@ -358,7 +358,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 	*instp = inst;
 
 cleanup:
-	if (result != ISC_R_SUCCESS && inst != NULL) {
+	if (result != ISC_R_SUCCESS) {
 		plugin_destroy((void **)&inst);
 	}
 
diff --git a/bin/plugins/filter-aaaa.c b/bin/plugins/filter-aaaa.c
index 6a17f18..1ec1fd8 100644
--- a/bin/plugins/filter-aaaa.c
+++ b/bin/plugins/filter-aaaa.c
@@ -361,7 +361,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 	*instp = inst;
 
 cleanup:
-	if (result != ISC_R_SUCCESS && inst != NULL) {
+	if (result != ISC_R_SUCCESS) {
 		plugin_destroy((void **)&inst);
 	}
 
diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
index ebb7ade..87c36ba 100644
--- a/bin/rndc/rndc.c
+++ b/bin/rndc/rndc.c
@@ -54,7 +54,8 @@
 
 #include "util.h"
 
-#define SERVERADDRS 10
+#define SERVERADDRS  10
+#define RNDC_TIMEOUT 60 * 1000
 
 const char *progname = NULL;
 bool verbose;
@@ -125,7 +126,7 @@ command is one of the following:\n\
 		Requires the zone to have a dnssec-policy.\n\
   dnstap -reopen\n\
 		Close, truncate and re-open the DNSTAP output file.\n\
-  dnstap -roll count\n\
+  dnstap -roll [count]\n\
 		Close, rename and re-open the DNSTAP output file(s).\n\
   dumpdb [-all|-cache|-zones|-adb|-bad|-expired|-fail] [view ...]\n\
 		Dump cache(s) to the dump file (named_dump.db).\n\
@@ -599,7 +600,7 @@ rndc_startconnect(isc_sockaddr_t *addr) {
 
 	atomic_fetch_add_relaxed(&connects, 1);
 	isc_nm_tcpconnect(netmgr, local, addr, rndc_connected, &rndc_ccmsg,
-			  60000, 0);
+			  RNDC_TIMEOUT, 0);
 }
 
 static void
@@ -1035,6 +1036,9 @@ main(int argc, char **argv) {
 	isc_mem_create(&rndc_mctx);
 	isc_managers_create(rndc_mctx, 1, 0, &netmgr, &taskmgr, NULL);
 	DO("create task", isc_task_create(taskmgr, 0, &rndc_task));
+
+	isc_nm_settimeouts(netmgr, RNDC_TIMEOUT, RNDC_TIMEOUT, RNDC_TIMEOUT, 0);
+
 	isc_log_create(rndc_mctx, &log, &logconfig);
 	isc_log_setcontext(log);
 	isc_log_settag(logconfig, progname);
diff --git a/bin/rndc/rndc.rst b/bin/rndc/rndc.rst
index 6717e24..35a4f31 100644
--- a/bin/rndc/rndc.rst
+++ b/bin/rndc/rndc.rst
@@ -189,9 +189,13 @@ Currently supported commands are:
 
 .. option:: dnstap (-reopen | -roll [number])
 
-   This command closes and re-opens DNSTAP output files. ``rndc dnstap -reopen`` allows
+   This command closes and re-opens DNSTAP output files.
+
+   ``rndc dnstap -reopen`` allows
    the output file to be renamed externally, so that :iscman:`named` can
-   truncate and re-open it. ``rndc dnstap -roll`` causes the output file
+   truncate and re-open it.
+
+   ``rndc dnstap -roll`` causes the output file
    to be rolled automatically, similar to log files. The most recent
    output file has ".0" appended to its name; the previous most recent
    output file is moved to ".1", and so on. If ``number`` is specified, then
diff --git a/bin/tests/system/Makefile.am b/bin/tests/system/Makefile.am
index b26bcf0..f98be0b 100644
--- a/bin/tests/system/Makefile.am
+++ b/bin/tests/system/Makefile.am
@@ -57,6 +57,14 @@ resolve_CPPFLAGS =		\
 
 resolve_LDADD = $(LIBISC_LIBS) $(LIBIRS_LIBS) $(LIBDNS_LIBS)
 
+rpz_dnsrps_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(LIBDNS_CFLAGS)
+
+rpz_dnsrps_LDADD =		\
+	$(LDADD)		\
+	$(LIBDNS_LIBS)
+
 tkey_keycreate_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
 	$(LIBDNS_CFLAGS)
@@ -239,9 +247,9 @@ LOG_DRIVER_V_1 = --verbose yes
 LOG_DRIVER = $(srcdir)/custom-test-driver
 AM_LOG_DRIVER_FLAGS = $(LOG_DRIVER_V)
 
-LOG_COMPILER = $(builddir)/run.sh
+LOG_COMPILER = $(builddir)/legacy.run.sh
 AM_LOG_FLAGS = -r
 
-$(TESTS): run.sh
+$(TESTS): legacy.run.sh
 
 test-local: check
diff --git a/bin/tests/system/Makefile.in b/bin/tests/system/Makefile.in
index 9b253a2..ba4feab 100644
--- a/bin/tests/system/Makefile.in
+++ b/bin/tests/system/Makefile.in
@@ -150,7 +150,8 @@ am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h
-CONFIG_CLEAN_FILES = conf.sh ifconfig.sh run.sh start.sh stop.sh
+CONFIG_CLEAN_FILES = conf.sh ifconfig.sh legacy.run.sh start.sh \
+	stop.sh
 CONFIG_CLEAN_VPATH_FILES =
 feature_test_SOURCES = feature-test.c
 feature_test_OBJECTS = feature_test-feature-test.$(OBJEXT)
@@ -178,9 +179,8 @@ rndc_gencheck_OBJECTS = rndc/gencheck.$(OBJEXT)
 rndc_gencheck_LDADD = $(LDADD)
 rndc_gencheck_DEPENDENCIES = $(LIBISC_LIBS)
 rpz_dnsrps_SOURCES = rpz/dnsrps.c
-rpz_dnsrps_OBJECTS = rpz/dnsrps.$(OBJEXT)
-rpz_dnsrps_LDADD = $(LDADD)
-rpz_dnsrps_DEPENDENCIES = $(LIBISC_LIBS)
+rpz_dnsrps_OBJECTS = rpz/dnsrps-dnsrps.$(OBJEXT)
+@HAVE_PERL_TRUE@rpz_dnsrps_DEPENDENCIES = $(LDADD) $(LIBDNS_LIBS)
 tkey_keycreate_SOURCES = tkey/keycreate.c
 tkey_keycreate_OBJECTS = tkey/keycreate-keycreate.$(OBJEXT)
 @HAVE_PERL_TRUE@tkey_keycreate_DEPENDENCIES = $(LDADD) $(LIBDNS_LIBS)
@@ -206,7 +206,7 @@ am__depfiles_remade = ./$(DEPDIR)/feature_test-feature-test.Po \
 	./$(DEPDIR)/makejournal-makejournal.Po \
 	./$(DEPDIR)/resolve-resolve.Po \
 	pipelined/$(DEPDIR)/pipequeries-pipequeries.Po \
-	rndc/$(DEPDIR)/gencheck.Po rpz/$(DEPDIR)/dnsrps.Po \
+	rndc/$(DEPDIR)/gencheck.Po rpz/$(DEPDIR)/dnsrps-dnsrps.Po \
 	tkey/$(DEPDIR)/keycreate-keycreate.Po \
 	tkey/$(DEPDIR)/keydelete-keydelete.Po
 am__mv = mv -f
@@ -481,7 +481,7 @@ TEST_LOG_COMPILE = $(TEST_LOG_COMPILER) $(AM_TEST_LOG_FLAGS) \
 	$(TEST_LOG_FLAGS)
 DIST_SUBDIRS = $(SUBDIRS)
 am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/conf.sh.in \
-	$(srcdir)/ifconfig.sh.in $(srcdir)/run.sh.in \
+	$(srcdir)/ifconfig.sh.in $(srcdir)/legacy.run.sh.in \
 	$(srcdir)/start.sh.in $(srcdir)/stop.sh.in \
 	$(top_srcdir)/Makefile.top $(top_srcdir)/depcomp \
 	$(top_srcdir)/test-driver README
@@ -790,6 +790,14 @@ SUBDIRS = dyndb/driver dlzexternal/driver hooks/driver
 @HAVE_PERL_TRUE@	$(LIBIRS_CFLAGS)
 
 @HAVE_PERL_TRUE@resolve_LDADD = $(LIBISC_LIBS) $(LIBIRS_LIBS) $(LIBDNS_LIBS)
+@HAVE_PERL_TRUE@rpz_dnsrps_CPPFLAGS = \
+@HAVE_PERL_TRUE@	$(AM_CPPFLAGS)		\
+@HAVE_PERL_TRUE@	$(LIBDNS_CFLAGS)
+
+@HAVE_PERL_TRUE@rpz_dnsrps_LDADD = \
+@HAVE_PERL_TRUE@	$(LDADD)		\
+@HAVE_PERL_TRUE@	$(LIBDNS_LIBS)
+
 @HAVE_PERL_TRUE@tkey_keycreate_CPPFLAGS = \
 @HAVE_PERL_TRUE@	$(AM_CPPFLAGS)		\
 @HAVE_PERL_TRUE@	$(LIBDNS_CFLAGS)
@@ -835,7 +843,7 @@ LOG_DRIVER_V_0 = --verbose no
 LOG_DRIVER_V_1 = --verbose yes
 LOG_DRIVER = $(srcdir)/custom-test-driver
 AM_LOG_DRIVER_FLAGS = $(LOG_DRIVER_V)
-LOG_COMPILER = $(builddir)/run.sh
+LOG_COMPILER = $(builddir)/legacy.run.sh
 AM_LOG_FLAGS = -r
 all: all-recursive
 
@@ -875,7 +883,7 @@ conf.sh: $(top_builddir)/config.status $(srcdir)/conf.sh.in
 	cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
 ifconfig.sh: $(top_builddir)/config.status $(srcdir)/ifconfig.sh.in
 	cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
-run.sh: $(top_builddir)/config.status $(srcdir)/run.sh.in
+legacy.run.sh: $(top_builddir)/config.status $(srcdir)/legacy.run.sh.in
 	cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
 start.sh: $(top_builddir)/config.status $(srcdir)/start.sh.in
 	cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
@@ -932,7 +940,7 @@ rpz/$(am__dirstamp):
 rpz/$(DEPDIR)/$(am__dirstamp):
 	@$(MKDIR_P) rpz/$(DEPDIR)
 	@: > rpz/$(DEPDIR)/$(am__dirstamp)
-rpz/dnsrps.$(OBJEXT): rpz/$(am__dirstamp) \
+rpz/dnsrps-dnsrps.$(OBJEXT): rpz/$(am__dirstamp) \
 	rpz/$(DEPDIR)/$(am__dirstamp)
 
 rpz/dnsrps$(EXEEXT): $(rpz_dnsrps_OBJECTS) $(rpz_dnsrps_DEPENDENCIES) $(EXTRA_rpz_dnsrps_DEPENDENCIES) rpz/$(am__dirstamp)
@@ -972,7 +980,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/resolve-resolve.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@pipelined/$(DEPDIR)/pipequeries-pipequeries.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@rndc/$(DEPDIR)/gencheck.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@rpz/$(DEPDIR)/dnsrps.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@rpz/$(DEPDIR)/dnsrps-dnsrps.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@tkey/$(DEPDIR)/keycreate-keycreate.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@tkey/$(DEPDIR)/keydelete-keydelete.Po@am__quote@ # am--include-marker
 
@@ -1062,6 +1070,20 @@ resolve-resolve.obj: resolve.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(resolve_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o resolve-resolve.obj `if test -f 'resolve.c'; then $(CYGPATH_W) 'resolve.c'; else $(CYGPATH_W) '$(srcdir)/resolve.c'; fi`
 
+rpz/dnsrps-dnsrps.o: rpz/dnsrps.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(rpz_dnsrps_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT rpz/dnsrps-dnsrps.o -MD -MP -MF rpz/$(DEPDIR)/dnsrps-dnsrps.Tpo -c -o rpz/dnsrps-dnsrps.o `test -f 'rpz/dnsrps.c' || echo '$(srcdir)/'`rpz/dnsrps.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) rpz/$(DEPDIR)/dnsrps-dnsrps.Tpo rpz/$(DEPDIR)/dnsrps-dnsrps.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='rpz/dnsrps.c' object='rpz/dnsrps-dnsrps.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(rpz_dnsrps_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o rpz/dnsrps-dnsrps.o `test -f 'rpz/dnsrps.c' || echo '$(srcdir)/'`rpz/dnsrps.c
+
+rpz/dnsrps-dnsrps.obj: rpz/dnsrps.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(rpz_dnsrps_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT rpz/dnsrps-dnsrps.obj -MD -MP -MF rpz/$(DEPDIR)/dnsrps-dnsrps.Tpo -c -o rpz/dnsrps-dnsrps.obj `if test -f 'rpz/dnsrps.c'; then $(CYGPATH_W) 'rpz/dnsrps.c'; else $(CYGPATH_W) '$(srcdir)/rpz/dnsrps.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) rpz/$(DEPDIR)/dnsrps-dnsrps.Tpo rpz/$(DEPDIR)/dnsrps-dnsrps.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='rpz/dnsrps.c' object='rpz/dnsrps-dnsrps.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(rpz_dnsrps_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o rpz/dnsrps-dnsrps.obj `if test -f 'rpz/dnsrps.c'; then $(CYGPATH_W) 'rpz/dnsrps.c'; else $(CYGPATH_W) '$(srcdir)/rpz/dnsrps.c'; fi`
+
 tkey/keycreate-keycreate.o: tkey/keycreate.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(tkey_keycreate_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT tkey/keycreate-keycreate.o -MD -MP -MF tkey/$(DEPDIR)/keycreate-keycreate.Tpo -c -o tkey/keycreate-keycreate.o `test -f 'tkey/keycreate.c' || echo '$(srcdir)/'`tkey/keycreate.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) tkey/$(DEPDIR)/keycreate-keycreate.Tpo tkey/$(DEPDIR)/keycreate-keycreate.Po
@@ -2262,7 +2284,7 @@ distclean: distclean-recursive
 	-rm -f ./$(DEPDIR)/resolve-resolve.Po
 	-rm -f pipelined/$(DEPDIR)/pipequeries-pipequeries.Po
 	-rm -f rndc/$(DEPDIR)/gencheck.Po
-	-rm -f rpz/$(DEPDIR)/dnsrps.Po
+	-rm -f rpz/$(DEPDIR)/dnsrps-dnsrps.Po
 	-rm -f tkey/$(DEPDIR)/keycreate-keycreate.Po
 	-rm -f tkey/$(DEPDIR)/keydelete-keydelete.Po
 	-rm -f Makefile
@@ -2319,7 +2341,7 @@ maintainer-clean: maintainer-clean-recursive
 	-rm -f ./$(DEPDIR)/resolve-resolve.Po
 	-rm -f pipelined/$(DEPDIR)/pipequeries-pipequeries.Po
 	-rm -f rndc/$(DEPDIR)/gencheck.Po
-	-rm -f rpz/$(DEPDIR)/dnsrps.Po
+	-rm -f rpz/$(DEPDIR)/dnsrps-dnsrps.Po
 	-rm -f tkey/$(DEPDIR)/keycreate-keycreate.Po
 	-rm -f tkey/$(DEPDIR)/keydelete-keydelete.Po
 	-rm -f Makefile
@@ -2380,7 +2402,7 @@ dist-hook:
 @HAVE_PERL_FALSE@	echo Perl is not available, no tests were ran
 @HAVE_PERL_FALSE@	exit 1
 
-$(TESTS): run.sh
+$(TESTS): legacy.run.sh
 
 test-local: check
 
diff --git a/bin/tests/system/README b/bin/tests/system/README
index 5db29de..265a9ef 100644
--- a/bin/tests/system/README
+++ b/bin/tests/system/README
@@ -67,18 +67,58 @@ then run
 ... as root.
 
 
-Running the System Tests
+Running the System Tests with pytest
 ===
 
+The pytest system test runner is currently in development, but it is the
+recommended way to run tests. Please report issues to QA.
+
+Running an Individual Test
+---
+
+pytest -k <test-name>
+
+Note that in comparison to the legacy test runner, some additional tests might
+be picked up when specifying just the system test directory name. To check
+which tests will be executed, you can use the `--collect-only` option. You
+might also be able to find a more specific test name to provide to ensure only
+your desired test is executed. See help for `-k` option in `pytest --help` for
+more info.
+
+It is also possible to run a single individual pytest test case. For example,
+you can use the name test_sslyze_dot to execute just the test_sslyze_dot()
+function from doth/tests_sslyze.py. The entire needed setup and teardown will
+be handled by the framework.
+
+Running All the System Tests
+---
+
+Issuing plain `pytest` command without any argument will execute all tests
+sequenatially. To execute them in parallel, ensure you have pytest-xdist
+installed and run:
+
+pytest -n <number-of-workers>
+
+
+Running the System Tests Using the Legacy Runner
+===
+
+!!! WARNING !!!
+---
+The legacy way to run system tests is currently being reworked into a pytest
+system test runner described in the previous section. The contents of this
+section might be out of date and no longer applicable. Please try and use the
+pytest runner if possible and report issues and missing features.
+
 Running an Individual Test
 ---
 The tests can be run individually using the following command:
 
-    sh run.sh [flags] <test-name> [<test-arguments>]
+    sh legacy.run.sh [flags] <test-name> [<test-arguments>]
 
 e.g.
 
-    sh run.sh [flags] notify
+    sh legacy.run.sh [flags] notify
 
 Optional flags are:
 
@@ -120,10 +160,10 @@ To run all the system tests, enter the command:
     sh runall.sh [-c] [-n] [numproc]
 
 The optional flag "-c" forces colored output (by default system test output is
-not printed in color due to run.sh being piped through "tee").
+not printed in color due to legacy.run.sh being piped through "tee").
 
-The optional flag "-n" has the same effect as it does for "run.sh" - it causes
-the retention of all output files from all tests.
+The optional flag "-n" has the same effect as it does for "legacy.run.sh" - it
+causes the retention of all output files from all tests.
 
 The optional "numproc" argument specifies the maximum number of tests that can
 run in parallel.  The default is 1, which means that all of the tests run
@@ -243,9 +283,9 @@ Re-Running the Tests
 ---
 If there is a requirement to re-run a test (or the entire test suite), the
 files produced by the tests should be deleted first.  Normally, these files are
-deleted if the test succeeds but are retained on error.  The run.sh script
-automatically calls a given test's clean.sh script before invoking its setup.sh
-script.
+deleted if the test succeeds but are retained on error.  The legacy.run.sh
+script automatically calls a given test's clean.sh script before invoking its
+setup.sh script.
 
 Deletion of the files produced by the set of tests (e.g. after the execution
 of "runall.sh") can be carried out using the command:
@@ -285,8 +325,8 @@ tests.sh    Runs the actual tests.  This file is mandatory.
 
 clean.sh    Run at the end to clean up temporary files, but only if the test
             was completed successfully and its running was not inhibited by the
-	    "-n" switch being passed to "run.sh".  Otherwise the temporary
-	    files are left in place for inspection.
+            "-n" switch being passed to "legacy.run.sh".  Otherwise the
+            temporary files are left in place for inspection.
 
 ns<N>       These subdirectories contain test name servers that can be queried
 	    or can interact with each other.  The value of N indicates the
@@ -305,8 +345,8 @@ ans<N>      Like ns[X], but these are simple mock name servers implemented in
 Port Usage
 ---
 In order for the tests to run in parallel, each test requires a unique set of
-ports.  These are specified by the "-p" option passed to "run.sh", which sets
-environment variables that the scripts listed above can reference.
+ports.  These are specified by the "-p" option passed to "legacy.run.sh", which
+sets environment variables that the scripts listed above can reference.
 
 The convention used in the system tests is that the number passed is the start
 of a range of 100 ports.  The test is free to use the ports as required,
@@ -358,10 +398,10 @@ General
 directory.
 
 2. Arguments can be only passed to the script if the test is being run as a
-one-off with "run.sh".  In this case, everything on the command line after the
-name of the test is passed to each script.  For example, the command:
+one-off with "legacy.run.sh".  In this case, everything on the command line
+after the name of the test is passed to each script.  For example, the command:
 
-    sh run.sh -p 12300 mytest -D xyz
+    sh legacy.run.sh -p 12300 mytest -D xyz
 
 ... will run "mytest" with a port range of 12300 to 12399.  Each of the
 framework scripts provided by the test will be invoked using the remaining
@@ -448,14 +488,14 @@ This is the main test file and the contents depend on the test.  The contents
 are completely up to the developer, although most test scripts have a form
 similar to the following for each sub-test:
 
-    1. n=`expr $n + 1`
+    1. n=$((n + 1))
     2. echo_i "prime cache nodata.example ($n)"
     3. ret=0
     4. $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
     5. grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
     6. grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
     7. if [ $ret != 0 ]; then echo_i "failed"; fi
-    8. status=`expr $status + $ret`
+    8. status=$((status + ret))
 
 1.  Increment the test number "n" (initialized to zero at the start of the
     script).
@@ -532,8 +572,8 @@ Ideally, the directory numbers should start at 1 and work upwards.
 When running a test, the servers are started using "start.sh" (which is nothing
 more than a wrapper for start.pl).  The options for "start.pl" are documented
 in the header for that file, so will not be repeated here.  In summary, when
-invoked by "run.sh", start.pl looks for directories named "nsN" or "ansN" in
-the test directory and starts the servers it finds there.
+invoked by "legacy.run.sh", start.pl looks for directories named "nsN" or
+"ansN" in the test directory and starts the servers it finds there.
 
 
 "named" Command-Line Options
@@ -630,8 +670,8 @@ the options available are listed in the file's header and will not be repeated
 here.
 
 In summary though, the nameservers for a given test, if left running by
-specifying the "-k" flag to "run.sh" when the test is started, can be stopped
-by the command:
+specifying the "-k" flag to "legacy.run.sh" when the test is started, can be
+stopped by the command:
 
     sh stop.sh <test-name> [server]
 
@@ -663,17 +703,103 @@ completed.  To enable this, set the USE_VALGRIND environment variable to
 "helgrind" to run the Helgrind tool, or any other value to run the Memcheck
 tool.  To use "helgrind" effectively, build BIND with --disable-atomic.
 
+Developer Notes for pytest runner
+===
+
+Test discovery and collection
+---
+There are two distinct types of system tests. The first is a shell script
+tests.sh containing individual test cases executed sequentially and the
+success/failure is determined by return code. The second type is a regular
+pytest file which contains test functions.
+
+Dealing with the regular pytest files doesn't require any special consideration
+as long as the naming conventions are met. Discovering the tests.sh tests is
+more complicated.
+
+The chosen solution is to add a bit of glue for each system test. For every
+tests.sh, there is an accompanying tests_sh_*.py file that contains a test
+function which utilizes a custom run_tests_sh fixture to call the tests.sh
+script. Other solutions were tried and eventually rejected. While this
+introduces a bit of extra glue, it is the most portable, compatible and least
+complex solution.
+
+Module scope
+---
+Pytest fixtures can have a scope. The "module" scope is the most important for
+our use. A module is a python file which contains test functions. Every system
+test directory may contain multiple modules (i.e. tests_*.py files)!
+
+The server setup/teardown is done for a module. Bundling test cases together
+inside a single module may save some resources. However, test cases inside a
+single module can't be executed in parallel.
+
+It is possible to execute different modules defined within a single system test
+directory in parallel. This is possible thanks to executing the tests inside a
+temporary directory and proper port assignment to ensure there won't be any
+conflicts.
+
+Test logging
+---
+Each module has a separate log which will be saved as pytest.log.txt in the
+temporary directory in which the test is executed. This log includes messages
+for this module setup/teardown as well as any logging from the tests using the
+`logger` fixture. Logging level DEBUG and above will be present in this log.
+
+In general, any log messages using INFO or above will also be printed out
+during pytest execution. In CI, the pytest output is also saved to
+pytest.out.txt in the bin/tests/system directory.
+
+Parallel execution
+---
+As mentioned in the previous section, test cases inside a single module can't
+be executed in parallel. To put it differently, all tests cases inside the same
+module must be performed by the same worker/thread. Otherwise, server
+setup/teardown fixtures won't be shared and runtime issues due to port
+collisions are likely to occur.
+
+Pytest-xdist is used for executing pytest test cases in parallel using the `-n
+N_WORKERS` option. By default, xdist will distribute any test case to any
+worker, which would lead to the issue described above. Therefore, conftest.py
+enforces equivalent of `--dist loadscope` option which ensures that test cases
+within the same (module) scope will be handled by the same worker. Parallelism
+is automatically disabled when xdist.scheduler.loadscope library is not
+available.
+
+$ pytest -n auto
+
+Test selection
+---
+It is possible to run just a single pytest test case from any module. Use
+standard pytest facility to select the desired test case(s), i.e. pass a
+sufficiently unique identifier for `-k` parameter. You can also check which
+tests will be executed by using the `--collect-only` flag to debug your `-k`
+expression.
+
+Compatibility with older pytest version
+---
+Keep in mind that the pytest runner must work with ancient versions of pytest.
+When implementing new features, it is advisable to check feature support in
+pytest and pytest-xdist in older distributions first.
+
+As a general rule, any changes to the pytest runner need to keep working on all
+platforms in CI that use the pytest runner. As of 2023-01-13, the oldest
+supported version is whatever is available in EL8.
+
+We may need to add more compat code eventually to handle breaking upstream
+changes. For example, using request.fspath attribute is already deprecatred in
+latest pytest.
 
-Maintenance Notes
+Maintenance Notes for legacy runner
 ===
 This section is aimed at developers maintaining BIND's system test framework.
 
 Notes on Parallel Execution
 ---
-Although execution of an individual test is controlled by "run.sh", which
-executes the above shell scripts (and starts the relevant servers) for each
-test, the running of all tests in the test suite is controlled by the Makefile.
-("runall.sh" does little more than invoke "make" on the Makefile.)
+Although execution of an individual test is controlled by "legacy.run.sh",
+which executes the above shell scripts (and starts the relevant servers) for
+each test, the running of all tests in the test suite is controlled by the
+Makefile. ("runall.sh" does little more than invoke "make" on the Makefile.)
 
 All system tests are capable of being run in parallel.  For this to work, each
 test needs to use a unique set of ports.  To avoid the need to define which
@@ -683,7 +809,7 @@ the ports are assigned when the tests are run.  This is achieved by having the
 when "make check" is run, and contains a target for each test of the form:
 
     <test-name>:
-        @$(SHELL) run.sh -p <baseport> <test-name>
+        @$(SHELL) legacy.run.sh -p <baseport> <test-name>
 
 The <baseport> is unique and the values of <baseport> for each test are
 separated by at least 100 ports.
@@ -707,7 +833,7 @@ If the test fails, all these files are retained.  But if the test succeeds,
 they are cleaned up at different times:
 
 1. Files generated by the test itself are cleaned up by the test's own
-"clean.sh", which is called from "run.sh".
+"clean.sh", which is called from "legacy.run.sh".
 
 2. Files that may not be cleaned up if named exits abnormally can be removed
 using the "cleanall.sh" script.
diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
index 8787c6a..c3343a3 100644
--- a/bin/tests/system/acl/ns2/named1.conf.in
+++ b/bin/tests/system/acl/ns2/named1.conf.in
@@ -32,6 +32,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 key one {
diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
index a95b4c1..ac9ac84 100644
--- a/bin/tests/system/acl/ns2/named2.conf.in
+++ b/bin/tests/system/acl/ns2/named2.conf.in
@@ -32,6 +32,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 key one {
diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
index 14cc3fe..efa73fa 100644
--- a/bin/tests/system/acl/ns2/named3.conf.in
+++ b/bin/tests/system/acl/ns2/named3.conf.in
@@ -32,6 +32,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 key one {
diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
index 77cf110..54c0da3 100644
--- a/bin/tests/system/acl/ns2/named4.conf.in
+++ b/bin/tests/system/acl/ns2/named4.conf.in
@@ -32,6 +32,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 key one {
diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
index 5ccabf9..e5b57f0 100644
--- a/bin/tests/system/acl/ns2/named5.conf.in
+++ b/bin/tests/system/acl/ns2/named5.conf.in
@@ -32,6 +32,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 	allow-query-on { 10.53.0.2; };
 	blackhole { 10.53.0.8; };
 };
diff --git a/bin/tests/system/acl/ns3/named.conf.in b/bin/tests/system/acl/ns3/named.conf.in
index 396b1a9..31d3526 100644
--- a/bin/tests/system/acl/ns3/named.conf.in
+++ b/bin/tests/system/acl/ns3/named.conf.in
@@ -23,6 +23,7 @@ options {
 	notify no;
 	allow-new-zones yes;
 	allow-transfer { none; };
+	dnssec-validation no;
 };
 
 controls {
diff --git a/bin/tests/system/acl/ns4/named.conf.in b/bin/tests/system/acl/ns4/named.conf.in
index 951c61e..9b769d1 100644
--- a/bin/tests/system/acl/ns4/named.conf.in
+++ b/bin/tests/system/acl/ns4/named.conf.in
@@ -23,6 +23,7 @@ options {
 	notify no;
 	allow-new-zones yes;
 	allow-transfer { none; };
+	dnssec-validation no;
 };
 
 controls {
diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
index ad98fa1..48536da 100644
--- a/bin/tests/system/acl/tests.sh
+++ b/bin/tests/system/acl/tests.sh
@@ -11,6 +11,8 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
@@ -21,14 +23,14 @@ t=0
 
 echo_i "testing basic ACL processing"
 # key "one" should fail
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 
 # any other key should be fine
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
@@ -38,18 +40,18 @@ rndc_reload ns2 10.53.0.2
 sleep 5
 
 # prefix 10/8 should fail
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 # any other address should work, as long as it sends key "one"
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
@@ -61,44 +63,44 @@ rndc_reload ns2 10.53.0.2
 sleep 5
 
 # should succeed
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 # should succeed
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 # should succeed
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 # should succeed
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 # but only one or the other should fail
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.2 axfr > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1; }
 
 # and other values? right out
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:three:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
@@ -107,31 +109,31 @@ rndc_reload ns2 10.53.0.2
 sleep 5
 
 # should succeed
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 # should succeed
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 # should fail
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 # should fail
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 # should fail
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
@@ -140,31 +142,31 @@ echo_i "testing allow-query-on ACL processing"
 copy_setports ns2/named5.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 sleep 5
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG -p ${PORT} +tcp soa example. \
 	@10.53.0.2 -b 10.53.0.3 > dig.out.${t}
 grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 echo_i "testing blackhole ACL processing"
-t=`expr $t + 1`
+t=$((t + 1))
 ret=0
 $DIG -p ${PORT} +tcp soa example. \
 	@10.53.0.2 -b 10.53.0.3 > dig.out.1.${t}
 grep "status: NOERROR" dig.out.1.${t} > /dev/null 2>&1 || ret=1
 $DIG -p ${PORT} +tcp soa example. \
-	@10.53.0.2 -b 10.53.0.8 > dig.out.2.${t}
+	@10.53.0.2 -b 10.53.0.8 > dig.out.2.${t} && ret=1
 grep "status: NOERROR" dig.out.2.${t} > /dev/null 2>&1 && ret=1
 grep "communications error" dig.out.2.${t} > /dev/null 2>&1 || ret=1
 $DIG -p ${PORT} soa example. \
 	@10.53.0.2 -b 10.53.0.3 > dig.out.3.${t}
 grep "status: NOERROR" dig.out.3.${t} > /dev/null 2>&1 || ret=1
 $DIG -p ${PORT} soa example. \
-	@10.53.0.2 -b 10.53.0.8 > dig.out.4.${t}
+	@10.53.0.2 -b 10.53.0.8 > dig.out.4.${t} && ret=1
 grep "status: NOERROR" dig.out.4.${t} > /dev/null 2>&1 && ret=1
 grep "timed out" dig.out.4.${t} > /dev/null 2>&1 || ret=1
 grep ";; no servers could be reached" dig.out.4.${t} > /dev/null 2>&1 || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # AXFR tests against ns3
 
@@ -174,26 +176,26 @@ echo_i "calling addzone example.com on ns3"
 $RNDCCMD 10.53.0.3 addzone 'example.com {type primary; file "example.db"; }; '
 sleep 1
 
-t=`expr $t + 1`
+t=$((t + 1))
 ret=0
 echo_i "checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
 $DIG -p ${PORT} @10.53.0.3 example.com axfr > dig.out.${t} 2>&1
 grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "calling rndc reconfig"
 rndc_reconfig ns3 10.53.0.3
 
 sleep 1
 
-t=`expr $t + 1`
+t=$((t + 1))
 ret=0
 echo_i "re-checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
 $DIG -p ${PORT} @10.53.0.3 example.com axfr > dig.out.${t} 2>&1
 grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # AXFR tests against ns4
 
@@ -203,26 +205,26 @@ echo_i "calling addzone example.com on ns4"
 $RNDCCMD 10.53.0.4 addzone 'example.com {type primary; file "example.db"; }; '
 sleep 1
 
-t=`expr $t + 1`
+t=$((t + 1))
 ret=0
 echo_i "checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
 $DIG -p ${PORT} @10.53.0.4 example.com axfr > dig.out.${t} 2>&1
 grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "calling rndc reconfig"
 rndc_reconfig ns4 10.53.0.4
 
 sleep 1
 
-t=`expr $t + 1`
+t=$((t + 1))
 ret=0
 echo_i "re-checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
 $DIG -p ${PORT} @10.53.0.4 example.com axfr > dig.out.${t} 2>&1
 grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/hooks/prereq.sh b/bin/tests/system/acl/tests_sh_acl.py
similarity index 68%
rename from bin/tests/system/hooks/prereq.sh
rename to bin/tests/system/acl/tests_sh_acl.py
index 665fdfe..2c98644 100644
--- a/bin/tests/system/hooks/prereq.sh
+++ b/bin/tests/system/acl/tests_sh_acl.py
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
@@ -11,11 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-. ../conf.sh
-
-$FEATURETEST --tsan && {
-	echo_i "TSAN - skipping hooks test"
-        exit 255
-}
 
-exit 0
+def test_acl(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/additional/ns2/named.conf.in b/bin/tests/system/additional/ns2/named.conf.in
index dae255d..ed43ca6 100644
--- a/bin/tests/system/additional/ns2/named.conf.in
+++ b/bin/tests/system/additional/ns2/named.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	notify no;
 	minimal-responses yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/additional/tests.sh b/bin/tests/system/additional/tests.sh
index 6cede72..a50004c 100644
--- a/bin/tests/system/additional/tests.sh
+++ b/bin/tests/system/additional/tests.sh
@@ -11,6 +11,8 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -20,7 +22,7 @@ status=0
 n=0
 
 dotests() {
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with RT, single zone (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t RT rt.rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -28,7 +30,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with RT, two zones (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t RT rt.rt2.example @10.53.0.1 > dig.out.$n || ret=1
@@ -36,7 +38,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NAPTR, single zone (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t NAPTR nap.naptr.example @10.53.0.1 > dig.out.$n || ret=1
@@ -44,7 +46,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NAPTR, two zones (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t NAPTR nap.hang3b.example @10.53.0.1 > dig.out.$n || ret=1
@@ -52,7 +54,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with LP (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t LP nid2.nid.example @10.53.0.1 > dig.out.$n || ret=1
@@ -82,7 +84,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NID (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t NID ns1.nid.example @10.53.0.1 > dig.out.$n || ret=1
@@ -98,7 +100,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NID + LP (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t NID nid2.nid.example @10.53.0.1 > dig.out.$n || ret=1
@@ -116,7 +118,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with RT, single zone (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t RT rt.rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -124,7 +126,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with RT, two zones (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t RT rt.rt2.example @10.53.0.1 > dig.out.$n || ret=1
@@ -132,7 +134,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NAPTR, single zone (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t NAPTR nap.naptr.example @10.53.0.1 > dig.out.$n || ret=1
@@ -140,7 +142,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NAPTR, two zones (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t NAPTR nap.hang3b.example @10.53.0.1 > dig.out.$n || ret=1
@@ -148,7 +150,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with LP (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t LP nid2.nid.example @10.53.0.1 > dig.out.$n || ret=1
@@ -178,7 +180,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NID (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t NID ns1.nid.example @10.53.0.1 > dig.out.$n || ret=1
@@ -194,7 +196,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NID + LP (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t NID nid2.nid.example @10.53.0.1 > dig.out.$n || ret=1
@@ -212,7 +214,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NS, root zone ($n)"
     ret=0
     $DIG $DIGOPTS -t NS . @10.53.0.1 > dig.out.$n || ret=1
@@ -222,7 +224,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NS, non-root zone ($n)"
     ret=0
     $DIG $DIGOPTS -t NS rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -257,7 +259,7 @@ echo_i "testing with 'minimal-responses no;'"
 minimal=no
 dotests
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing with 'minimal-any no;' ($n)"
 ret=0
 $DIG $DIGOPTS -t ANY www.rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -270,7 +272,7 @@ echo_i "reconfiguring server: minimal-any yes"
 copy_setports ns1/named3.conf.in ns1/named.conf
 rndc_reconfig ns1 10.53.0.1
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing with 'minimal-any yes;' over UDP ($n)"
 ret=0
 $DIG $DIGOPTS -t ANY +notcp www.rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -278,7 +280,7 @@ grep "ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1" dig.out.$n > /dev/null || ret=1
 if [ $ret -eq 1 ] ; then
     echo_i "failed"; status=$((status+1))
 fi
-n=`expr $n + 1`
+n=$((n + 1))
 
 echo_i "testing with 'minimal-any yes;' over TCP ($n)"
 ret=0
@@ -288,7 +290,7 @@ if [ $ret -eq 1 ] ; then
     echo_i "failed"; status=$((status+1))
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing with 'minimal-any yes;' over UDP ($n)"
 ret=0
 $DIG $DIGOPTS -t ANY +notcp www.rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -309,7 +311,7 @@ echo_i "testing with 'minimal-responses no-auth-recursive;'"
 minimal=no-auth-recursive
 dotests
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing returning TLSA records with MX query ($n)"
 ret=0
 $DIG $DIGOPTS -t mx mx.example @10.53.0.1 > dig.out.$n || ret=1
@@ -320,7 +322,7 @@ if [ $ret -eq 1 ] ; then
     echo_i "failed"; status=$((status+1))
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing returning TLSA records with SRV query ($n)"
 ret=0
 $DIG $DIGOPTS -t srv _xmpp-client._tcp.srv.example @10.53.0.1 > dig.out.$n || ret=1
@@ -335,7 +337,7 @@ echo_i "reconfiguring server: minimal-responses no"
 copy_setports ns1/named2.conf.in ns1/named.conf
 rndc_reconfig ns1 10.53.0.1
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing NS handling in ANY responses (authoritative) ($n)"
 ret=0
 $DIG $DIGOPTS -t ANY rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -345,7 +347,7 @@ if [ $ret -eq 1 ] ; then
     echo_i "failed"; status=$((status+1))
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing NS handling in ANY responses (recursive) ($n)"
 ret=0
 $DIG $DIGOPTS -t ANY rt.example @10.53.0.3 > dig.out.$n || ret=1
@@ -355,7 +357,7 @@ if [ $ret -eq 1 ] ; then
     echo_i "failed"; status=$((status+1))
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing out-of-zone additional data from auth zones (authoritative) ($n)"
 ret=0
 $DIG $DIGOPTS -t NS rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -364,7 +366,7 @@ if [ $ret -eq 1 ] ; then
     echo_i "failed"; status=$((status+1))
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing out-of-zone additional data from auth zones (recursive) ($n)"
 ret=0
 $DIG $DIGOPTS -t NS ex @10.53.0.3 > dig.out.$n || ret=1
diff --git a/bin/tests/system/hooks/tests.sh b/bin/tests/system/additional/tests_sh_additional.py
similarity index 51%
rename from bin/tests/system/hooks/tests.sh
rename to bin/tests/system/additional/tests_sh_additional.py
index 9ba0bd8..cdc38f4 100644
--- a/bin/tests/system/hooks/tests.sh
+++ b/bin/tests/system/additional/tests_sh_additional.py
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
@@ -11,26 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-. ../conf.sh
-
-status=0
-n=0
-
-rm -f dig.out.*
-
-DIGOPTS="+tcp +noadd +nosea +nostat +nocmd -p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
-
-n=$((n+1))
-echo_i "checking asynchronous hook action resumes correctly ($n)"
-ret=0
-$DIG $DIGOPTS example.com @10.53.0.1 > dig.out.ns1.test$n || ret=1
-# the test-async plugin changes the status of any postiive answer to NOTIMP
-grep -q "status: NOTIMP" dig.out.ns1.test$n || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-
 
-echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1
+def test_additional(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/addzone/ns1/named.conf.in b/bin/tests/system/addzone/ns1/named.conf.in
index b2d5e05..9015e1b 100644
--- a/bin/tests/system/addzone/ns1/named.conf.in
+++ b/bin/tests/system/addzone/ns1/named.conf.in
@@ -28,6 +28,7 @@ options {
 	allow-query { any; };
 	allow-new-zones yes;
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/addzone/ns2/named1.conf.in b/bin/tests/system/addzone/ns2/named1.conf.in
index eb8519a..23be60e 100644
--- a/bin/tests/system/addzone/ns2/named1.conf.in
+++ b/bin/tests/system/addzone/ns2/named1.conf.in
@@ -19,6 +19,7 @@ options {
 	allow-query { any; };
 	recursion no;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
 
 include "../../common/rndc.key";
diff --git a/bin/tests/system/addzone/ns2/named2.conf.in b/bin/tests/system/addzone/ns2/named2.conf.in
index 33e45b9..8b0f23d 100644
--- a/bin/tests/system/addzone/ns2/named2.conf.in
+++ b/bin/tests/system/addzone/ns2/named2.conf.in
@@ -24,6 +24,7 @@ options {
 	listen-on { 10.53.0.2; 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 view internal {
diff --git a/bin/tests/system/addzone/ns2/named3.conf.in b/bin/tests/system/addzone/ns2/named3.conf.in
index 697d279..7078ce9 100644
--- a/bin/tests/system/addzone/ns2/named3.conf.in
+++ b/bin/tests/system/addzone/ns2/named3.conf.in
@@ -24,6 +24,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	new-zones-directory "new-zones";
+	dnssec-validation no;
 };
 
 view internal {
diff --git a/bin/tests/system/addzone/ns3/named1.conf.in b/bin/tests/system/addzone/ns3/named1.conf.in
index f1488f4..6c512a6 100644
--- a/bin/tests/system/addzone/ns3/named1.conf.in
+++ b/bin/tests/system/addzone/ns3/named1.conf.in
@@ -25,6 +25,7 @@ options {
 	allow-query { any; };
 	recursion no;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/addzone/ns3/named2.conf.in b/bin/tests/system/addzone/ns3/named2.conf.in
index 3b56d64..6ca25f1 100644
--- a/bin/tests/system/addzone/ns3/named2.conf.in
+++ b/bin/tests/system/addzone/ns3/named2.conf.in
@@ -25,4 +25,5 @@ options {
 	allow-query { any; };
 	recursion no;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/addzone/tests.sh b/bin/tests/system/addzone/tests.sh
index 0f81eb7..2937e79 100755
--- a/bin/tests/system/addzone/tests.sh
+++ b/bin/tests/system/addzone/tests.sh
@@ -11,6 +11,8 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}"
@@ -30,9 +32,9 @@ ret=0
 $DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # When LMDB support is compiled in, this tests that migration from
 # NZF to NZD occurs during named startup
@@ -41,16 +43,16 @@ ret=0
 $DIG $DIGOPTS @10.53.0.2 a.previous.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.previous.example' dig.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if $FEATURETEST --with-lmdb; then
     echo_i "checking that existing NZF file was renamed after migration ($n)"
     [ -e ns2/3bf305731dd26307.nzf~ ] || ret=1
-    n=`expr $n + 1`
+    n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 echo_i "adding new zone ($n)"
@@ -62,27 +64,27 @@ _check_adding_new_zone () (
 	grep '^a.added.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_adding_new_zone || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 nextpart ns2/named.run >/dev/null
 echo_i "checking addzone errors are logged correctly"
 ret=0
 $RNDCCMD 10.53.0.2 addzone bad.example '{ type mister; };' 2>&1 | grep 'unexpected token' > /dev/null 2>&1 || ret=1
 wait_for_log_peek 20 "addzone: 'mister' unexpected" ns2/named.run || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 nextpart ns2/named.run >/dev/null
 echo_i "checking modzone errors are logged correctly"
 ret=0
 $RNDCCMD 10.53.0.2 modzone added.example '{ type mister; };' 2>&1 | grep 'unexpected token' > /dev/null 2>&1 || ret=1
 wait_for_log_peek 20 "modzone: 'mister' unexpected" ns2/named.run || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "adding a zone that requires quotes ($n)"
 ret=0
@@ -94,9 +96,9 @@ _check_zone_that_requires_quotes() (
 	grep '^a.32/1.0.0.127-in-addr.added.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_zone_that_requires_quotes || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "adding a zone with a quote in the name ($n)"
 ret=0
@@ -107,48 +109,48 @@ _check_zone_with_a_quote() (
 	grep '^a.foo\\"bar.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_zone_with_a_quote || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "adding new zone with missing file ($n)"
 ret=0
 $DIG $DIGOPTS +all @10.53.0.2 a.missing.example a > dig.out.ns2.pre.$n || ret=1
 grep "status: REFUSED" dig.out.ns2.pre.$n > /dev/null || ret=1
-$RNDCCMD 10.53.0.2 addzone 'missing.example { type primary; file "missing.db"; };' 2> rndc.out.ns2.$n
+$RNDCCMD 10.53.0.2 addzone 'missing.example { type primary; file "missing.db"; };' 2> rndc.out.ns2.$n && ret=1
 grep "file not found" rndc.out.ns2.$n > /dev/null || ret=1
 $DIG $DIGOPTS +all @10.53.0.2 a.missing.example a > dig.out.ns2.post.$n || ret=1
 grep "status: REFUSED" dig.out.ns2.post.$n > /dev/null || ret=1
 digcomp dig.out.ns2.pre.$n dig.out.ns2.post.$n || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if ! $FEATURETEST --with-lmdb; then
     echo_i "verifying no comments in NZF file ($n)"
     ret=0
-    hcount=`grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l`
+    hcount=$(grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l)
     [ $hcount -eq 0 ] || ret=1
-    n=`expr $n + 1`
+    n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 echo_i "checking rndc showzone with previously added zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 showzone previous.example > rndc.out.ns2.$n
 expected='zone "previous.example" { type primary; file "previous.db"; };'
-[ "`cat rndc.out.ns2.$n`" = "$expected" ] || ret=1
-n=`expr $n + 1`
+[ "$(cat rndc.out.ns2.$n)" = "$expected" ] || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if $FEATURETEST --with-lmdb; then
     echo_i "checking zone is present in NZD ($n)"
     ret=0
     $NZD2NZF ns2/_default.nzd | grep previous.example > /dev/null || ret=1
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 echo_i "deleting previously added zone ($n)"
@@ -160,9 +162,9 @@ _check_deleting_previously_added_zone() (
 	! grep '^a.previous.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_deleting_previously_added_zone || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 check_nzd2nzf() (
 	$NZD2NZF ns2/_default.nzd > nzd2nzf.out.$n &&
@@ -173,17 +175,17 @@ if $FEATURETEST --with-lmdb; then
     echo_i "checking zone was deleted from NZD ($n)"
     retry_quiet 10 check_nzd2nzf || ret=1
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 if ! $FEATURETEST --with-lmdb; then
     echo_i "checking NZF file now has comment ($n)"
     ret=0
-    hcount=`grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l`
+    hcount=$(grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l)
     [ $hcount -eq 1 ] || ret=1
-    n=`expr $n + 1`
+    n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 echo_i "deleting newly added zone added.example ($n)"
@@ -195,9 +197,9 @@ _check_deleting_newly_added_zone() (
 	! grep '^a.added.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_deleting_newly_added_zone || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "deleting newly added zone with escaped quote ($n)"
 ret=0
@@ -208,45 +210,45 @@ _check_deleting_newly_added_zone_quote() (
 	! grep "^a.foo\"bar.example" dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_deleting_newly_added_zone_quote || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking rndc showzone with a normally-loaded zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 showzone normal.example > rndc.out.ns2.$n
 expected='zone "normal.example" { type primary; file "normal.db"; };'
-[ "`cat rndc.out.ns2.$n`" = "$expected" ] || ret=1
-n=`expr $n + 1`
+[ "$(cat rndc.out.ns2.$n)" = "$expected" ] || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking rndc showzone with a normally-loaded zone with trailing dot ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 showzone finaldot.example > rndc.out.ns2.$n
 expected='zone "finaldot.example." { type primary; file "normal.db"; };'
-[ "`cat rndc.out.ns2.$n`" = "$expected" ] || ret=1
-n=`expr $n + 1`
+[ "$(cat rndc.out.ns2.$n)" = "$expected" ] || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking rndc showzone with a normally-loaded redirect zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 showzone -redirect > rndc.out.ns1.$n
 expected='zone "." { type redirect; file "redirect.db"; };'
-[ "`cat rndc.out.ns1.$n`" = "$expected" ] || ret=1
-n=`expr $n + 1`
+[ "$(cat rndc.out.ns1.$n)" = "$expected" ] || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking rndc zonestatus with a normally-loaded redirect zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 zonestatus -redirect > rndc.out.ns1.$n
 grep "type: redirect" rndc.out.ns1.$n > /dev/null || ret=1
 grep "serial: 0" rndc.out.ns1.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking rndc reload with a normally-loaded redirect zone ($n)"
 ret=0
@@ -254,9 +256,9 @@ sleep 1
 cp -f ns1/redirect.db.2 ns1/redirect.db
 $RNDCCMD 10.53.0.1 reload -redirect > rndc.out.ns1.$n
 retry_quiet 5 check_zonestatus 1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "delete a normally-loaded zone ($n)"
 ret=0
@@ -270,9 +272,9 @@ _check_delete_normally_loaded_zone() (
 )
 retry_quiet 5 _check_delete_normally_loaded_zone || ret=1
 
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "attempting to add primary zone with inline signing ($n)"
 $RNDCCMD 10.53.0.2 addzone 'inline.example { type primary; file "inline.db"; inline-signing yes; };' 2>&1 | sed 's/^/I:ns2 /'
@@ -282,17 +284,17 @@ _check_add_primary_zone_with_inline() (
 	grep '^a.inline.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 5 _check_add_primary_zone_with_inline || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "attempting to add primary zone with inline signing and missing file ($n)"
 ret=0
-$RNDCCMD 10.53.0.2 addzone 'inlinemissing.example { type primary; file "missing.db"; inline-signing yes; };' 2> rndc.out.ns2.$n
+$RNDCCMD 10.53.0.2 addzone 'inlinemissing.example { type primary; file "missing.db"; inline-signing yes; };' 2> rndc.out.ns2.$n && ret=1
 grep "file not found" rndc.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "attempting to add secondary zone with inline signing ($n)"
 $RNDCCMD 10.53.0.2 addzone 'inlinesec.example { type secondary; primaries { 10.53.0.1; }; file "inlinesec.bk"; inline-signing yes; };' 2>&1 | sed 's/^/I:ns2 /'
@@ -302,9 +304,9 @@ _check_add_secondary_with_inline() (
 	grep '^a.inlinesec.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 5 _check_add_secondary_with_inline || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "attempting to delete secondary zone with inline signing ($n)"
 ret=0
@@ -318,8 +320,8 @@ test ! -f inlinesec.bk.signed ||
 grep '^inlinesec.bk.signed$' rndc.out2.test$n > /dev/null || {
 	echo_i "failed to report inlinesec.bk.signed"; ret=1;
 }
-n=`expr $n + 1`
-status=`expr $status + $ret`
+n=$((n + 1))
+status=$((status + ret))
 
 echo_i "restoring secondary zone with inline signing ($n)"
 $RNDCCMD 10.53.0.2 addzone 'inlinesec.example { type secondary; primaries { 10.53.0.1; }; file "inlinesec.bk"; inline-signing yes; };' 2>&1 | sed 's/^/I:ns2 /'
@@ -329,17 +331,17 @@ _check_restoring_secondary_with_inline() (
 	grep '^a.inlinesec.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 5 _check_restoring_secondary_with_inline || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "deleting secondary zone with automatic zone file removal ($n)"
 ret=0
 retry_quiet 10 test -f ns2/inlinesec.bk.signed -a -f ns2/inlinesec.bk || ret=1
 $RNDCCMD 10.53.0.2 delzone -clean inlinesec.example > /dev/null 2>&1
 retry_quiet 10 test ! -f ns2/inlinesec.bk.signed -a ! -f ns2/inlinesec.bk
-n=`expr $n + 1`
-status=`expr $status + $ret`
+n=$((n + 1))
+status=$((status + ret))
 
 echo_i "modifying zone configuration ($n)"
 ret=0
@@ -349,23 +351,23 @@ grep 'status: NOERROR' dig.out.ns2.1.$n > /dev/null || ret=1
 $RNDCCMD 10.53.0.2 modzone 'mod.example { type primary; file "added.db"; allow-query { none; }; };' 2>&1 | sed 's/^/ns2 /' | cat_i
 $DIG +norec $DIGOPTS @10.53.0.2 mod.example ns > dig.out.ns2.2.$n || ret=1
 $RNDCCMD 10.53.0.2 showzone mod.example | grep 'allow-query { "none"; };' > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that adding a 'stub' zone works ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone 'stub.example { type stub; primaries { 1.2.3.4; }; file "stub.example.bk"; };' > rndc.out.ns2.$n 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that adding a 'static-stub' zone works ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone 'static-stub.example { type static-stub; server-addresses { 1.2.3.4; }; };' > rndc.out.ns2.$n 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that adding a 'primary redirect' zone works ($n)"
 ret=0
@@ -378,9 +380,9 @@ _check_add_primary_redirect() (
 	grep "serial: 0" zonestatus.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_add_primary_redirect || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that reloading a added 'primary redirect' zone works ($n)"
 ret=0
@@ -388,16 +390,16 @@ sleep 1
 cp -f ns2/redirect.db.2 ns2/redirect.db
 $RNDCCMD 10.53.0.2 reload -redirect > rndc.out.ns2.$n
 retry_quiet 10 check_zonestatus 2 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that retransfer of a added 'primary redirect' zone fails ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 retransfer -redirect > rndc.out.ns2.$n 2>&1 && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that deleting a 'primary redirect' zone works ($n)"
 ret=0
@@ -407,9 +409,9 @@ _check_deleting_primary_redirect() (
 	grep 'not found' showzone.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_deleting_primary_redirect || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that adding a 'secondary redirect' zone works ($n)"
 ret=0
@@ -422,9 +424,9 @@ _check_adding_secondary_redirect() (
 	grep "serial: 0" zonestatus.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_adding_secondary_redirect || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that retransfering a added 'secondary redirect' zone works ($n)"
 ret=0
@@ -437,9 +439,9 @@ _check_retransfering_secondary_redirect() (
 	grep "serial: 1" zonestatus.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_retransfering_secondary_redirect || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that deleting a 'secondary redirect' zone works ($n)"
 ret=0
@@ -449,41 +451,41 @@ _check_deleting_secondary_redirect() (
 	grep 'not found' showzone.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_deleting_secondary_redirect || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that zone type 'hint' is properly rejected ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone '"." { type hint; file "hints.db"; };' > rndc.out.ns2.$n 2>&1 && ret=1
 grep "zones not supported by addzone" rndc.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that zone type 'forward' is properly rejected ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone 'forward.example { type forward; forwarders { 1.2.3.4; }; forward only; };' > rndc.out.ns2.$n 2>&1 && ret=1
 grep "zones not supported by addzone" rndc.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that zone type 'delegation-only' is properly rejected ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone 'delegation-only.example { type delegation-only; };' > rndc.out.ns2.$n 2>&1 && ret=1
 grep "zones not supported by addzone" rndc.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that 'in-view' zones are properly rejected ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone 'in-view.example { in-view "_default"; };' > rndc.out.ns2.$n 2>&1 && ret=1
 grep "zones not supported by addzone" rndc.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "reconfiguring server with multiple views"
 rm -f ns2/named.conf
@@ -508,27 +510,27 @@ grep 'status: NOERROR' dig.out.ns2.int.$n > /dev/null || ret=1
 $DIG +norec $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.ext.$n > /dev/null || ret=1
 grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if ! $FEATURETEST --with-lmdb; then
     echo_i "checking new NZF file has comment ($n)"
     ret=0
-    hcount=`grep "^# New zone file for view: external" ns2/external.nzf | wc -l`
+    hcount=$(grep "^# New zone file for view: external" ns2/external.nzf | wc -l)
     [ $hcount -eq 1 ] || ret=1
-    n=`expr $n + 1`
+    n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 if $FEATURETEST --with-lmdb; then
     echo_i "verifying added.example in external view created an external.nzd DB ($n)"
     ret=0
     [ -e ns2/external.nzd ] || ret=1
-    n=`expr $n + 1`
+    n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 echo_i "checking rndc reload causes named to reload the external view's new zone config ($n)"
@@ -542,9 +544,9 @@ _check_rndc_reload_external_view_config() (
 	grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null
 )
 retry_quiet 10 _check_rndc_reload_external_view_config || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking rndc showzone with newly added zone ($n)"
 _check_rndc_showzone_newly_added() (
@@ -554,12 +556,12 @@ _check_rndc_showzone_newly_added() (
 		expected='zone "added.example" { type primary; file "added.db"; };'
 	fi
 	$RNDCCMD 10.53.0.2 showzone added.example in external > rndc.out.ns2.$n 2>/dev/null &&
-	[ "`cat rndc.out.ns2.$n`" = "$expected" ]
+	[ "$(cat rndc.out.ns2.$n)" = "$expected" ]
 )
 retry_quiet 10  _check_rndc_showzone_newly_added || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "deleting newly added zone ($n)"
 ret=0
@@ -570,31 +572,31 @@ _check_deleting_newly_added_zone() (
 	! grep '^a.added.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_deleting_newly_added_zone || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "attempting to add zone to internal view ($n)"
 ret=0
 $DIG +norec $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.added.example a > dig.out.ns2.pre.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.pre.$n > /dev/null || ret=1
-$RNDCCMD 10.53.0.2 addzone 'added.example in internal { type primary; file "added.db"; };' 2> rndc.out.ns2.$n
+$RNDCCMD 10.53.0.2 addzone 'added.example in internal { type primary; file "added.db"; };' 2> rndc.out.ns2.$n && ret=1
 grep "permission denied" rndc.out.ns2.$n > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.added.example a > dig.out.ns2.int.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.int.$n > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.ext.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "attempting to delete a policy zone ($n)"
 ret=0
-$RNDCCMD 10.53.0.2 delzone 'policy in internal' 2> rndc.out.ns2.$n >&1
+$RNDCCMD 10.53.0.2 delzone 'policy in internal' 2> rndc.out.ns2.$n >&1 && ret=1
 grep 'cannot be deleted' rndc.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "adding new zone again to external view ($n)"
 ret=0
@@ -607,9 +609,9 @@ _check_adding_new_zone_again_external() (
 	grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null
 )
 retry_quiet 10 _check_adding_new_zone_again_external || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "reconfiguring server with multiple views and new-zones-directory"
 rm -f ns2/named.conf
@@ -621,9 +623,9 @@ ret=0
 $DIG +norec $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.ext.$n > /dev/null || ret=1
 grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "deleting newly added zone from external ($n)"
 ret=0
@@ -631,9 +633,9 @@ $RNDCCMD 10.53.0.2 delzone 'added.example in external' 2>&1 | sed 's/^/I:ns2 /'
 $DIG $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.added.example' dig.out.ns2.$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "adding new zone to directory view ($n)"
 ret=0
@@ -651,9 +653,9 @@ grep 'status: REFUSED' dig.out.ns2.ext.$n > /dev/null || ret=1
 $DIG +norec $DIGOPTS @10.53.0.5 -b 10.53.0.5 a.added.example a > dig.out.ns2.dir.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.dir.$n > /dev/null || ret=1
 grep '^a.added.example' dig.out.ns2.dir.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if $FEATURETEST --with-lmdb; then
     echo_i "checking NZD file was created in new-zones-directory ($n)"
@@ -665,9 +667,9 @@ fi
 $RNDCCMD 10.53.0.2 sync 'added.example IN directory' 2>&1 | sed 's/^/I:ns2 /'
 sleep 2
 [ -e "$expect" ] || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "deleting newly added zone from directory ($n)"
 ret=0
@@ -675,17 +677,17 @@ $RNDCCMD 10.53.0.2 delzone 'added.example in directory' 2>&1 | sed 's/^/I:ns2 /'
 $DIG $DIGOPTS @10.53.0.5 -b 10.53.0.5 a.added.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.added.example' dig.out.ns2.$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "ensure the configuration context is cleaned up correctly ($n)"
 ret=0
 rndc_reconfig ns2 10.53.0.2
 $RNDCCMD 10.53.0.2 status > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check delzone after reconfig failure ($n)"
 ret=0
@@ -693,9 +695,9 @@ $RNDCCMD 10.53.0.3 addzone 'inlinesec.example. IN { type secondary; file "inline
 copy_setports ns3/named2.conf.in ns3/named.conf
 rndc_reconfig ns3 10.53.0.3
 $RNDCCMD 10.53.0.3 delzone inlinesec.example > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if ! $FEATURETEST --with-lmdb
 then
@@ -706,9 +708,9 @@ then
     $RNDCCMD 10.53.0.3 addzone "test3.baz" '{ type primary; file "e.db"; };' > /dev/null 2>&1 || ret=1
     $RNDCCMD 10.53.0.3 delzone "test3.baz" > /dev/null 2>&1 || ret=1
     grep test2.baz ns3/_default.nzf > /dev/null && ret=1
-    n=`expr $n + 1`
+    n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 _check_version_bind() (
@@ -747,8 +749,8 @@ $DIG $DIGOPTS @10.53.0.3 SOA  'test\010.baz' > dig.out.6.test$n || ret=1
 grep "status: NOERROR" dig.out.6.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.6.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/addzone/tests_sh_addzone.py b/bin/tests/system/addzone/tests_sh_addzone.py
new file mode 100644
index 0000000..dca8e74
--- /dev/null
+++ b/bin/tests/system/addzone/tests_sh_addzone.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_addzone(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/allow-query/ns1/named.conf.in b/bin/tests/system/allow-query/ns1/named.conf.in
index a72cc87..dd786e2 100644
--- a/bin/tests/system/allow-query/ns1/named.conf.in
+++ b/bin/tests/system/allow-query/ns1/named.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/allow-query/ns2/named01.conf.in b/bin/tests/system/allow-query/ns2/named01.conf.in
index 1f7ab40..3069010 100644
--- a/bin/tests/system/allow-query/ns2/named01.conf.in
+++ b/bin/tests/system/allow-query/ns2/named01.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named02.conf.in b/bin/tests/system/allow-query/ns2/named02.conf.in
index 3e24bdc..678c417 100644
--- a/bin/tests/system/allow-query/ns2/named02.conf.in
+++ b/bin/tests/system/allow-query/ns2/named02.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { any; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named03.conf.in b/bin/tests/system/allow-query/ns2/named03.conf.in
index dd5985b..cdc64ff 100644
--- a/bin/tests/system/allow-query/ns2/named03.conf.in
+++ b/bin/tests/system/allow-query/ns2/named03.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { none; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named04.conf.in b/bin/tests/system/allow-query/ns2/named04.conf.in
index f61447e..0544662 100644
--- a/bin/tests/system/allow-query/ns2/named04.conf.in
+++ b/bin/tests/system/allow-query/ns2/named04.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { 10.53.0.2; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named05.conf.in b/bin/tests/system/allow-query/ns2/named05.conf.in
index 53c31a3..6f92049 100644
--- a/bin/tests/system/allow-query/ns2/named05.conf.in
+++ b/bin/tests/system/allow-query/ns2/named05.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { 10.53.0.1; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named06.conf.in b/bin/tests/system/allow-query/ns2/named06.conf.in
index 49d9e42..261c75b 100644
--- a/bin/tests/system/allow-query/ns2/named06.conf.in
+++ b/bin/tests/system/allow-query/ns2/named06.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query {! 10.53.0.2; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named07.conf.in b/bin/tests/system/allow-query/ns2/named07.conf.in
index a40cade..8050fa2 100644
--- a/bin/tests/system/allow-query/ns2/named07.conf.in
+++ b/bin/tests/system/allow-query/ns2/named07.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { accept; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named08.conf.in b/bin/tests/system/allow-query/ns2/named08.conf.in
index 413878b..ffa4cdc 100644
--- a/bin/tests/system/allow-query/ns2/named08.conf.in
+++ b/bin/tests/system/allow-query/ns2/named08.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { accept; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named09.conf.in b/bin/tests/system/allow-query/ns2/named09.conf.in
index b2d900e..49166e6 100644
--- a/bin/tests/system/allow-query/ns2/named09.conf.in
+++ b/bin/tests/system/allow-query/ns2/named09.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query {! accept; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
index b91d19a..d684c2d 100644
--- a/bin/tests/system/allow-query/ns2/named10.conf.in
+++ b/bin/tests/system/allow-query/ns2/named10.conf.in
@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { key one; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
index 308c4ca..59b9e0e 100644
--- a/bin/tests/system/allow-query/ns2/named11.conf.in
+++ b/bin/tests/system/allow-query/ns2/named11.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { key one; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
index 6b0fe55..a8e9107 100644
--- a/bin/tests/system/allow-query/ns2/named12.conf.in
+++ b/bin/tests/system/allow-query/ns2/named12.conf.in
@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query {! key one; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named21.conf.in b/bin/tests/system/allow-query/ns2/named21.conf.in
index 311eaf7..c6204a3 100644
--- a/bin/tests/system/allow-query/ns2/named21.conf.in
+++ b/bin/tests/system/allow-query/ns2/named21.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named22.conf.in b/bin/tests/system/allow-query/ns2/named22.conf.in
index 1c191da..454f24a 100644
--- a/bin/tests/system/allow-query/ns2/named22.conf.in
+++ b/bin/tests/system/allow-query/ns2/named22.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named23.conf.in b/bin/tests/system/allow-query/ns2/named23.conf.in
index e0cd069..f62337b 100644
--- a/bin/tests/system/allow-query/ns2/named23.conf.in
+++ b/bin/tests/system/allow-query/ns2/named23.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named24.conf.in b/bin/tests/system/allow-query/ns2/named24.conf.in
index 33f03b0..1e277a9 100644
--- a/bin/tests/system/allow-query/ns2/named24.conf.in
+++ b/bin/tests/system/allow-query/ns2/named24.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named25.conf.in b/bin/tests/system/allow-query/ns2/named25.conf.in
index 28cadd0..0548af2 100644
--- a/bin/tests/system/allow-query/ns2/named25.conf.in
+++ b/bin/tests/system/allow-query/ns2/named25.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named26.conf.in b/bin/tests/system/allow-query/ns2/named26.conf.in
index 52b915d..40e5dfd 100644
--- a/bin/tests/system/allow-query/ns2/named26.conf.in
+++ b/bin/tests/system/allow-query/ns2/named26.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named27.conf.in b/bin/tests/system/allow-query/ns2/named27.conf.in
index c95838c..92fa1f8 100644
--- a/bin/tests/system/allow-query/ns2/named27.conf.in
+++ b/bin/tests/system/allow-query/ns2/named27.conf.in
@@ -19,6 +19,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named28.conf.in b/bin/tests/system/allow-query/ns2/named28.conf.in
index 06d9b91..2ecac7c 100644
--- a/bin/tests/system/allow-query/ns2/named28.conf.in
+++ b/bin/tests/system/allow-query/ns2/named28.conf.in
@@ -19,6 +19,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named29.conf.in b/bin/tests/system/allow-query/ns2/named29.conf.in
index acd1b41..9a6c9e5 100644
--- a/bin/tests/system/allow-query/ns2/named29.conf.in
+++ b/bin/tests/system/allow-query/ns2/named29.conf.in
@@ -19,6 +19,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
index aefc474..f7084c8 100644
--- a/bin/tests/system/allow-query/ns2/named30.conf.in
+++ b/bin/tests/system/allow-query/ns2/named30.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
index 27eccc2..d6a7af5 100644
--- a/bin/tests/system/allow-query/ns2/named31.conf.in
+++ b/bin/tests/system/allow-query/ns2/named31.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { key one; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
index adbb203..b7d7ee4 100644
--- a/bin/tests/system/allow-query/ns2/named32.conf.in
+++ b/bin/tests/system/allow-query/ns2/named32.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named33.conf.in b/bin/tests/system/allow-query/ns2/named33.conf.in
index be1e160..be31b72 100644
--- a/bin/tests/system/allow-query/ns2/named33.conf.in
+++ b/bin/tests/system/allow-query/ns2/named33.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { none; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named34.conf.in b/bin/tests/system/allow-query/ns2/named34.conf.in
index d35ac3e..165ff06 100644
--- a/bin/tests/system/allow-query/ns2/named34.conf.in
+++ b/bin/tests/system/allow-query/ns2/named34.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { any; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
index 364f94b..b7a8746 100644
--- a/bin/tests/system/allow-query/ns2/named40.conf.in
+++ b/bin/tests/system/allow-query/ns2/named40.conf.in
@@ -31,6 +31,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named53.conf.in b/bin/tests/system/allow-query/ns2/named53.conf.in
index 41ac6d3..bd0af28 100644
--- a/bin/tests/system/allow-query/ns2/named53.conf.in
+++ b/bin/tests/system/allow-query/ns2/named53.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { none; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named54.conf.in b/bin/tests/system/allow-query/ns2/named54.conf.in
index 64a3f69..a6ca424 100644
--- a/bin/tests/system/allow-query/ns2/named54.conf.in
+++ b/bin/tests/system/allow-query/ns2/named54.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { any; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named55.conf.in b/bin/tests/system/allow-query/ns2/named55.conf.in
index 642e4c9..6bcba07 100644
--- a/bin/tests/system/allow-query/ns2/named55.conf.in
+++ b/bin/tests/system/allow-query/ns2/named55.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named56.conf.in b/bin/tests/system/allow-query/ns2/named56.conf.in
index 187d697..d89a5fb 100644
--- a/bin/tests/system/allow-query/ns2/named56.conf.in
+++ b/bin/tests/system/allow-query/ns2/named56.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named57.conf.in b/bin/tests/system/allow-query/ns2/named57.conf.in
index 1502b12..bcc3a85 100644
--- a/bin/tests/system/allow-query/ns2/named57.conf.in
+++ b/bin/tests/system/allow-query/ns2/named57.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
index 01a13cf..3a1b8b4 100644
--- a/bin/tests/system/allow-query/tests.sh
+++ b/bin/tests/system/allow-query/tests.sh
@@ -52,6 +52,8 @@
 # and querying as necessary.
 #
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}"
@@ -62,17 +64,17 @@ n=0
 nextpart ns2/named.run > /dev/null
 
 # Test 1 - default, query allowed
-n=`expr $n + 1`
+n=$((n + 1))