diff --git a/.gitignore b/.gitignore
index b3da71f..7a4faa9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -136,3 +136,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.33.tar.gz.asc
 /bind-9.11.35.tar.gz
 /bind-9.11.35.tar.gz.asc
+/bind-9.11.36.tar.gz
+/bind-9.11.36.tar.gz.asc
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index eb0a72c..86cc909 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -302,10 +302,10 @@ index 2c19e7e..8223d5e 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index ab92837..be23d99 100644
+index 83cad4a..e1e1a32 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1176,12 +1176,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1178,12 +1178,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -320,7 +320,7 @@ index ab92837..be23d99 100644
  
  #
  # was --with-randomdev specified?
-@@ -1554,12 +1556,12 @@ AC_ARG_ENABLE(openssl-hash,
+@@ -1556,12 +1558,12 @@ AC_ARG_ENABLE(openssl-hash,
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
@@ -339,7 +339,7 @@ index ab92837..be23d99 100644
  
  if test "auto" = "$use_openssl"
  then
-@@ -1572,6 +1574,7 @@ then
+@@ -1574,6 +1576,7 @@ then
  		fi
  	done
  fi
@@ -347,7 +347,7 @@ index ab92837..be23d99 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1593,11 +1596,10 @@ case "$with_gost" in
+@@ -1595,11 +1598,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -362,7 +362,7 @@ index ab92837..be23d99 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1607,7 +1609,9 @@ case "$use_openssl" in
+@@ -1609,7 +1611,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -373,7 +373,7 @@ index ab92837..be23d99 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1639,7 +1643,7 @@ case "$use_openssl" in
+@@ -1641,7 +1645,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -382,7 +382,7 @@ index ab92837..be23d99 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -2075,6 +2079,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -2077,6 +2081,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -390,7 +390,7 @@ index ab92837..be23d99 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2361,6 +2366,7 @@ esac
+@@ -2363,6 +2368,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -398,7 +398,7 @@ index ab92837..be23d99 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5489,8 +5495,11 @@ AC_CONFIG_FILES([
+@@ -5491,8 +5497,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -410,7 +410,7 @@ index ab92837..be23d99 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5563,6 +5572,10 @@ AC_CONFIG_FILES([
+@@ -5565,6 +5574,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -421,7 +421,7 @@ index ab92837..be23d99 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5587,6 +5600,24 @@ AC_CONFIG_FILES([
+@@ -5589,6 +5602,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -460,7 +460,7 @@ index f089bea..3ed939b 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 1d0f5df..0ec7eeb 100644
+index 1d0f5df..98c9ba0 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
 @@ -24,17 +24,17 @@ VERSION=@BIND9_VERSION@
@@ -468,8 +468,9 @@ index 1d0f5df..0ec7eeb 100644
  @BIND9_MAKE_INCLUDES@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
+-		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
- 		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
++		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} \
  		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
  
 -CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@
diff --git a/bind-9.10-sdb.patch b/bind-9.10-sdb.patch
index 5c4987f..f2d7c44 100644
--- a/bind-9.10-sdb.patch
+++ b/bind-9.10-sdb.patch
@@ -1,5 +1,5 @@
 diff --git a/bin/Makefile.in b/bin/Makefile.in
-index ce7a2da..4e6a824 100644
+index 26a7e4e..a465e70 100644
 --- a/bin/Makefile.in
 +++ b/bin/Makefile.in
 @@ -11,8 +11,8 @@ srcdir =	@srcdir@
@@ -14,7 +14,7 @@ index ce7a2da..4e6a824 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/named-sdb/Makefile.in b/bin/named-sdb/Makefile.in
-index 4cfed4d..c6b42b2 100644
+index 3d8655f..9de4b1b 100644
 --- a/bin/named-sdb/Makefile.in
 +++ b/bin/named-sdb/Makefile.in
 @@ -30,10 +30,10 @@ VERSION=@BIND9_VERSION@
@@ -88,7 +88,7 @@ index 4cfed4d..c6b42b2 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named-sdb/main.c b/bin/named-sdb/main.c
-index c9fc3cc..148ebb3 100644
+index d9127cd..28c50d3 100644
 --- a/bin/named-sdb/main.c
 +++ b/bin/named-sdb/main.c
 @@ -97,6 +97,10 @@
@@ -203,7 +203,7 @@ index c9fc3cc..148ebb3 100644
  		      ISC_LOG_NOTICE, "exiting");
  	ns_log_shutdown();
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 4cfed4d..f4bce7b 100644
+index 3d8655f..836edf0 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
 @@ -45,10 +45,10 @@ DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
@@ -297,10 +297,10 @@ index c7e0868..95ab742 100644
 +	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} zone2sqlite@EXEEXT@ ${DESTDIR}${sbindir}
  	${INSTALL_DATA} ${srcdir}/zone2ldap.1 ${DESTDIR}${mandir}/man1/zone2ldap.1
 diff --git a/configure.ac b/configure.ac
-index f85f45f..7d28c52 100644
+index 980a04d..260502a 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -5400,6 +5400,8 @@ AC_CONFIG_FILES([
+@@ -5502,6 +5502,8 @@ AC_CONFIG_FILES([
  	bin/named/unix/Makefile
  	bin/named-pkcs11/Makefile
  	bin/named-pkcs11/unix/Makefile
@@ -309,7 +309,7 @@ index f85f45f..7d28c52 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5424,6 +5426,7 @@ AC_CONFIG_FILES([
+@@ -5526,6 +5528,7 @@ AC_CONFIG_FILES([
  	bin/python/isc/tests/policy_test.py
  	bin/python/isc/utils.py
  	bin/rndc/Makefile
diff --git a/bind-9.11-rt31459.patch b/bind-9.11-rt31459.patch
index 723d7a8..1891255 100644
--- a/bind-9.11-rt31459.patch
+++ b/bind-9.11-rt31459.patch
@@ -1,4 +1,4 @@
-From 08003079bbb017325bf7a52c2f902308a22dd0d7 Mon Sep 17 00:00:00 2001
+From 346683631ae0f83ad4f09a69cfa5e5c6ea49e5d9 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -199,10 +199,10 @@ index f017895..2c568fc 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index dde1b2f..7308fc6 100644
+index a097ac8..6567421 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
-@@ -3465,14 +3465,15 @@ main(int argc, char *argv[]) {
+@@ -3472,14 +3472,15 @@ main(int argc, char *argv[]) {
  	if (!pseudorandom)
  		eflags |= ISC_ENTROPY_GOODONLY;
  
@@ -222,7 +222,7 @@ index dde1b2f..7308fc6 100644
  	isc_stdtime_get(&now);
  
  	if (startstr != NULL) {
-@@ -3884,8 +3885,8 @@ main(int argc, char *argv[]) {
+@@ -3896,8 +3897,8 @@ main(int argc, char *argv[]) {
  	dns_master_styledestroy(&dsstyle, mctx);
  
  	cleanup_logging(&log);
@@ -293,7 +293,7 @@ index 7f045e8..2a0f9c6 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 30d38be..b2ae57c 100644
+index 9826588..b3e3fc3 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index 30d38be..b2ae57c 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8286,6 +8287,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8291,6 +8292,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,7 +315,7 @@ index 30d38be..b2ae57c 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8320,6 +8325,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8325,6 +8330,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -324,10 +324,10 @@ index 30d38be..b2ae57c 100644
  		}
  
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index c20c6e3..db47b3b 100644
+index 52b0274..23b69c9 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -278,7 +278,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -279,7 +279,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	if (*ectx == NULL) {
  		result = isc_entropy_create(mctx, ectx);
  		if (result != ISC_R_SUCCESS)
@@ -337,7 +337,7 @@ index c20c6e3..db47b3b 100644
  		ISC_LIST_INIT(sources);
  	}
  
-@@ -287,6 +288,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -288,6 +289,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  		randomfile = NULL;
  	}
  
@@ -351,7 +351,7 @@ index c20c6e3..db47b3b 100644
  	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
  					   usekeyboard);
  
-@@ -989,11 +997,11 @@ setup_system(void) {
+@@ -990,11 +998,11 @@ setup_system(void) {
  		}
  	}
  
@@ -561,10 +561,10 @@ index 34360aa..3236968 100644
  
  	isc_mem_destroy(&mctx);
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 4b5b901..43fb6b0 100644
+index a3dd450..350723f 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
-@@ -136,6 +136,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
+@@ -137,6 +137,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
  int
  main(int argc, char **argv) {
  	char *keyname;
@@ -572,7 +572,7 @@ index 4b5b901..43fb6b0 100644
  	isc_taskmgr_t *taskmgr;
  	isc_timermgr_t *timermgr;
  	isc_socketmgr_t *socketmgr;
-@@ -156,10 +157,21 @@ main(int argc, char **argv) {
+@@ -157,10 +158,21 @@ main(int argc, char **argv) {
  
  	RUNCHECK(isc_app_start());
  
@@ -594,7 +594,7 @@ index 4b5b901..43fb6b0 100644
  	keyname = argv[1];
  
  	dns_result_register();
-@@ -169,14 +181,22 @@ main(int argc, char **argv) {
+@@ -170,14 +182,22 @@ main(int argc, char **argv) {
  
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
@@ -619,7 +619,7 @@ index 4b5b901..43fb6b0 100644
  
  	taskmgr = NULL;
  	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
-@@ -264,8 +284,8 @@ main(int argc, char **argv) {
+@@ -265,8 +285,8 @@ main(int argc, char **argv) {
  
  	isc_log_destroy(&log);
  
@@ -688,7 +688,7 @@ index 26fa609..fb34aa0 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index 97e184f..36a6330 100755
+index 368112f..e060e9d 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -723,7 +723,7 @@ index 97e184f..36a6330 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -17202,6 +17206,7 @@ case "$use_openssl" in
+@@ -17204,6 +17208,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -731,7 +731,7 @@ index 97e184f..36a6330 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17216,6 +17221,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17218,6 +17223,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -739,7 +739,7 @@ index 97e184f..36a6330 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17228,6 +17234,7 @@ $as_echo "no" >&6; }
+@@ -17230,6 +17236,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -747,7 +747,7 @@ index 97e184f..36a6330 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17237,7 +17244,7 @@ $as_echo "no" >&6; }
+@@ -17239,7 +17246,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -756,7 +756,7 @@ index 97e184f..36a6330 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -17268,6 +17275,7 @@ $as_echo "not found" >&6; }
+@@ -17270,6 +17277,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -764,7 +764,7 @@ index 97e184f..36a6330 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17902,8 +17910,6 @@ fi
+@@ -17904,8 +17912,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -773,7 +773,7 @@ index 97e184f..36a6330 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -18278,6 +18284,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18280,6 +18286,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -860,7 +860,7 @@ index 97e184f..36a6330 100755
  #
  # was --with-lmdb specified?
  #
-@@ -20554,9 +20640,12 @@ _ACEOF
+@@ -20556,9 +20642,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -875,7 +875,7 @@ index 97e184f..36a6330 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21854,12 +21943,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21856,12 +21945,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -889,7 +889,7 @@ index 97e184f..36a6330 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21892,6 +21976,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21894,6 +21978,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -901,7 +901,7 @@ index 97e184f..36a6330 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21900,39 +21989,6 @@ _ACEOF
+@@ -21902,39 +21991,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -941,7 +941,7 @@ index 97e184f..36a6330 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21963,6 +22019,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21965,6 +22021,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -952,7 +952,7 @@ index 97e184f..36a6330 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24545,6 +24605,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24547,6 +24607,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -983,7 +983,7 @@ index 97e184f..36a6330 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24875,11 +24959,11 @@ $as_echo "no" >&6; }
+@@ -24877,11 +24961,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -998,7 +998,7 @@ index 97e184f..36a6330 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24964,7 +25048,7 @@ $as_echo "" >&6; }
+@@ -24966,7 +25050,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1007,7 +1007,7 @@ index 97e184f..36a6330 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24989,57 +25073,9 @@ $as_echo "" >&6; }
+@@ -24991,57 +25075,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1067,7 +1067,7 @@ index 97e184f..36a6330 100755
  					break
  				fi
  			done
-@@ -25198,10 +25234,10 @@ $as_echo "no" >&6; }
+@@ -25200,10 +25236,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1081,7 +1081,7 @@ index 97e184f..36a6330 100755
  	fi
  
  
-@@ -25287,11 +25323,11 @@ fi
+@@ -25289,11 +25325,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1095,7 +1095,7 @@ index 97e184f..36a6330 100755
  				break
  			fi
  		done
-@@ -25566,6 +25602,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25568,6 +25604,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1104,7 +1104,7 @@ index 97e184f..36a6330 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27944,6 +27982,8 @@ report() {
+@@ -27946,6 +27984,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1113,7 +1113,7 @@ index 97e184f..36a6330 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27984,6 +28024,8 @@ report() {
+@@ -27986,6 +28026,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1122,7 +1122,7 @@ index 97e184f..36a6330 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -28031,6 +28073,8 @@ report() {
+@@ -28033,6 +28075,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1132,10 +1132,10 @@ index 97e184f..36a6330 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index 6ddbd7b..c312a9a 100644
+index 11f41e8..fdcfc62 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1598,6 +1598,7 @@ case "$use_openssl" in
+@@ -1600,6 +1600,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1143,7 +1143,7 @@ index 6ddbd7b..c312a9a 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1611,6 +1612,7 @@ case "$use_openssl" in
+@@ -1613,6 +1614,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1151,7 +1151,7 @@ index 6ddbd7b..c312a9a 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1623,6 +1625,7 @@ case "$use_openssl" in
+@@ -1625,6 +1627,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1159,7 +1159,7 @@ index 6ddbd7b..c312a9a 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1633,7 +1636,7 @@ case "$use_openssl" in
+@@ -1635,7 +1638,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1168,7 +1168,7 @@ index 6ddbd7b..c312a9a 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1663,6 +1666,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1665,6 +1668,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1176,7 +1176,7 @@ index 6ddbd7b..c312a9a 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2107,7 +2111,6 @@ fi
+@@ -2109,7 +2113,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1184,7 +1184,7 @@ index 6ddbd7b..c312a9a 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2379,6 +2382,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2381,6 +2384,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1252,7 +1252,7 @@ index 6ddbd7b..c312a9a 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4172,12 +4236,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4174,12 +4238,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1266,7 +1266,7 @@ index 6ddbd7b..c312a9a 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4186,7 +4250,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4188,7 +4252,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1274,7 +1274,7 @@ index 6ddbd7b..c312a9a 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5620,6 +5683,8 @@ report() {
+@@ -5622,6 +5685,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1283,7 +1283,7 @@ index 6ddbd7b..c312a9a 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5660,6 +5725,8 @@ report() {
+@@ -5662,6 +5727,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1292,7 +1292,7 @@ index 6ddbd7b..c312a9a 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5707,6 +5774,8 @@ report() {
+@@ -5709,6 +5776,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -2118,5 +2118,5 @@ index 7ac30fb..55b6c23 100644
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
 -- 
-2.26.3
+2.31.1
 
diff --git a/bind-95-rh452060.patch b/bind-95-rh452060.patch
index c57ccab..6f4a892 100644
--- a/bind-95-rh452060.patch
+++ b/bind-95-rh452060.patch
@@ -1,8 +1,8 @@
 diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index aa5315d..1fa711a 100644
+index c06c804..e75b8b7 100644
 --- a/bin/dig/dighost.c
 +++ b/bin/dig/dighost.c
-@@ -1814,6 +1814,13 @@ clear_query(dig_query_t *query) {
+@@ -1816,6 +1816,13 @@ clear_query(dig_query_t *query) {
  
  	if (query->timer != NULL)
  		isc_timer_detach(&query->timer);
@@ -16,7 +16,7 @@ index aa5315d..1fa711a 100644
  	lookup = query->lookup;
  
  	if (lookup->current_query == query)
-@@ -1839,10 +1846,7 @@ clear_query(dig_query_t *query) {
+@@ -1841,10 +1848,7 @@ clear_query(dig_query_t *query) {
  	isc_mempool_put(commctx, query->recvspace);
  	isc_buffer_invalidate(&query->recvbuf);
  	isc_buffer_invalidate(&query->lengthbuf);
@@ -28,7 +28,7 @@ index aa5315d..1fa711a 100644
  }
  
  /*%
-@@ -2892,9 +2896,9 @@ send_done(isc_task_t *_task, isc_event_t *event) {
+@@ -2895,9 +2899,9 @@ send_done(isc_task_t *_task, isc_event_t *event) {
  	isc_event_free(&event);
  
  	if (query->pending_free)
diff --git a/bind.spec b/bind.spec
index 2f305d9..ba309e1 100644
--- a/bind.spec
+++ b/bind.spec
@@ -66,14 +66,14 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.35
+Version:  9.11.36
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
-Source:   https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz
+Source:   https://downloads.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz
 Source1:  named.sysconfig
-Source2:  https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz.asc
+Source2:  https://downloads.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz.asc
 Source3:  named.logrotate
 Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2021.txt
 Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in
@@ -1626,6 +1626,9 @@ fi;
 %endif
 
 %changelog
+* Mon Nov 01 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-1
+- Update to 9.11.36
+
 * Thu Aug 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.35-1
 - Update to 9.11.35
 
diff --git a/bind99-rh640538.patch b/bind99-rh640538.patch
index e2c0de7..5066a14 100644
--- a/bind99-rh640538.patch
+++ b/bind99-rh640538.patch
@@ -1,58 +1,40 @@
-From a76716d5d039947d6fe2cd49a151b16a29e12d42 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Mon, 4 Jan 2021 12:55:49 +0100
-Subject: [PATCH] .rh640538
----
- bin/dig/dig.docbook | 43 +++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 43 insertions(+)
-
 diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook
-index 8ccf207..6d16d37 100644
+index 1079421..f11abd1 100644
 --- a/bin/dig/dig.docbook
 +++ b/bin/dig/dig.docbook
-@@ -1336,6 +1336,49 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
+@@ -1177,6 +1177,39 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
      </para>
    </refsection>
  
 +  <refsection><info><title>RETURN CODES</title></info>
-+
 +    <para>
 +      <command>Dig</command> return codes are:
-+
 +      <variablelist>
-+	<varlistentry>
-+	  <term>0</term>
-+	  <listitem>
-+	    <para>Everything went well, including things like NXDOMAIN.</para>
-+	  </listitem>
-+	</varlistentry>
-+	<varlistentry>
-+	  <term>1</term>
-+	  <listitem>
-+	    <para>Usage error.</para>
-+	  </listitem>
-+	</varlistentry>
-+
-+	<varlistentry>
-+	  <term>8</term>
-+	  <listitem>
-+	    <para>Could not open batch file.</para>
-+	  </listitem>
-+	</varlistentry>
-+	<varlistentry>
-+	  <term>9</term>
-+	  <listitem>
-+	    <para>No reply from server.
-+	    </para>
-+	  </listitem>
-+	</varlistentry>
-+	<varlistentry>
-+	  <term>10</term>
-+	  <listitem>
-+	    <para>Internal error.
-+	    </para>
-+	  </listitem>
-+	</varlistentry>
++        <varlistentry>
++          <listitem>
++            <para>0: Everything went well, including things like NXDOMAIN</para>
++          </listitem>
++        </varlistentry>
++        <varlistentry>
++          <listitem>
++            <para>1: Usage error</para>
++          </listitem>
++        </varlistentry>
++        <varlistentry>
++          <listitem>
++            <para>8: Couldn't open batch file</para>
++          </listitem>
++        </varlistentry>
++        <varlistentry>
++          <listitem>
++            <para>9: No reply from server</para>
++          </listitem>
++        </varlistentry>
++        <varlistentry>
++          <listitem>
++            <para>10: Internal error</para>
++          </listitem>
++        </varlistentry>
 +      </variablelist>
 +    </para>
 +  </refsection>
@@ -60,6 +42,3 @@ index 8ccf207..6d16d37 100644
    <refsection><info><title>FILES</title></info>
  
      <para><filename>/etc/resolv.conf</filename>
--- 
-2.26.2
-
diff --git a/sources b/sources
index 54e7692..6cba6d6 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.35.tar.gz) = 78cccabded12cbe3a53421ef4731ccc6ea150b9c36ca4d159b6eaaa9c0b199c907876e00e4f0fe11862b0cfc01049d48ffb126b8acd6230aa71d588b6fab169d
-SHA512 (bind-9.11.35.tar.gz.asc) = 9dc0c81cee3b07edad9dcd343d9ea74157ed19c9f79483f07b37ef8342746ed93fb4b978da1f19a6212705d61905e716e37be727a6b6946f9bd435299c51bc5c
+SHA512 (bind-9.11.36.tar.gz) = eafaf86095f5d4446b004ad7690a5c0b16a597c135a306881b7038d247b8975032fd43d087d7c3d296ba77969f3ac83081a9ed4cbc1d4c66b6a04f2b74a54cb2
+SHA512 (bind-9.11.36.tar.gz.asc) = a3dddb0d6de650a23830feaed6aad84c38e338ec945bf46aa1edda0d309c7a353a307b24dd80cbcc377c05baf10d768c9570beaf388accb2806f8c56e548a075