diff --git a/.gitignore b/.gitignore
index 07695aa..3274242 100644
--- a/.gitignore
+++ b/.gitignore
@@ -148,3 +148,19 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.15.tar.xz.asc
 /bind-9.16.16.tar.xz
 /bind-9.16.16.tar.xz.asc
+/bind-9.16.18.tar.xz
+/bind-9.16.18.tar.xz.asc
+/bind-9.16.19.tar.xz
+/bind-9.16.19.tar.xz.asc
+/bind-9.16.20.tar.xz
+/bind-9.16.20.tar.xz.asc
+/bind-9.16.21.tar.xz
+/bind-9.16.21.tar.xz.asc
+/bind-9.16.22.tar.xz
+/bind-9.16.22.tar.xz.asc
+/bind-9.16.23.tar.xz
+/bind-9.16.23.tar.xz.asc
+/bind-9.16.24.tar.xz
+/bind-9.16.24.tar.xz.asc
+/bind-9.16.27.tar.xz
+/bind-9.16.27.tar.xz.asc
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 85ece30..e4f1ebd 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -1,4 +1,4 @@
-From 040227009453b3f0aa7914c7a6a94dc57ad5269b Mon Sep 17 00:00:00 2001
+From 1cbffe7e8b5bced9134abbae23a2a20c83d39a6a Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Thu, 21 Jan 2021 10:46:20 +0100
 Subject: [PATCH] Enable custom pkcs11 native build
@@ -9,7 +9,7 @@ pkcs11 libraries as a new copy of libdns and libns.
  bin/Makefile.in                  |  2 +-
  bin/confgen/Makefile.in          |  2 +-
  bin/dnssec-pkcs11/Makefile.in    | 39 +++++++++++++++++---------------
- bin/named-pkcs11/Makefile.in     | 33 ++++++++++++++-------------
+ bin/named-pkcs11/Makefile.in     | 31 +++++++++++++------------
  configure.ac                     | 19 ++++++++++++++++
  lib/Makefile.in                  |  2 +-
  lib/dns-pkcs11/Makefile.in       | 22 +++++++++---------
@@ -17,7 +17,7 @@ pkcs11 libraries as a new copy of libdns and libns.
  lib/ns-pkcs11/Makefile.in        | 26 ++++++++++-----------
  lib/ns-pkcs11/tests/Makefile.in  | 12 +++++-----
  make/includes.in                 |  7 ++++++
- 11 files changed, 101 insertions(+), 71 deletions(-)
+ 11 files changed, 100 insertions(+), 70 deletions(-)
 
 diff --git a/bin/Makefile.in b/bin/Makefile.in
 index 9ad7f62..094775a 100644
@@ -151,7 +151,7 @@ index ace0e5a..e0f6a00 100644
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 98125dd..518a75f 100644
+index debb906..ecfdb6c 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
 @@ -37,13 +37,14 @@ DBDRIVER_LIBS =
@@ -208,8 +208,8 @@ index 98125dd..518a75f 100644
  
  SUBDIRS =	unix
  
--TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
-+TARGETS =	named-pkcs11@EXEEXT@ feature-test-pkcs11@EXEEXT@
+-TARGETS =	named@EXEEXT@
++TARGETS =	named-pkcs11@EXEEXT@
  
  GEOIP2LINKOBJS = geoip.@O@
  
@@ -222,16 +222,7 @@ index 98125dd..518a75f 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -161,7 +162,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
- 		-c ${top_srcdir}/bin/tests/system/feature-test.c
- 
--feature-test@EXEEXT@: feature-test.@O@
-+feature-test-pkcs11@EXEEXT@: feature-test.@O@
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
- 		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
- 
-@@ -180,11 +181,11 @@ statschannel.@O@: bind9.xsl.h
+@@ -170,11 +171,11 @@ statschannel.@O@: bind9.xsl.h
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
  
@@ -247,10 +238,10 @@ index 98125dd..518a75f 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/configure.ac b/configure.ac
-index 032228b..64e3da0 100644
+index e405eaf..efaa5a7 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1251,12 +1251,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1269,12 +1269,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
@@ -265,7 +256,7 @@ index 032228b..64e3da0 100644
  
  #
  # was --with-lmdb specified?
-@@ -2327,6 +2329,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+@@ -2345,6 +2347,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
  AC_SUBST(BIND9_NS_BUILDINCLUDE)
  AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
  AC_SUBST(BIND9_IRS_BUILDINCLUDE)
@@ -274,7 +265,7 @@ index 032228b..64e3da0 100644
  if test "X$srcdir" != "X"; then
  	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
  	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2335,6 +2339,8 @@ if test "X$srcdir" != "X"; then
+@@ -2353,6 +2357,8 @@ if test "X$srcdir" != "X"; then
  	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
  	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
  	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
@@ -283,7 +274,7 @@ index 032228b..64e3da0 100644
  else
  	BIND9_ISC_BUILDINCLUDE=""
  	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2343,6 +2349,8 @@ else
+@@ -2361,6 +2367,8 @@ else
  	BIND9_NS_BUILDINCLUDE=""
  	BIND9_BIND9_BUILDINCLUDE=""
  	BIND9_IRS_BUILDINCLUDE=""
@@ -292,7 +283,7 @@ index 032228b..64e3da0 100644
  fi
  
  AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -2798,8 +2806,11 @@ AC_CONFIG_FILES([
+@@ -2816,8 +2824,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -304,7 +295,7 @@ index 032228b..64e3da0 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/plugins/Makefile
-@@ -2861,6 +2872,10 @@ AC_CONFIG_FILES([
+@@ -2879,6 +2890,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -315,7 +306,7 @@ index 032228b..64e3da0 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -2893,6 +2908,10 @@ AC_CONFIG_FILES([
+@@ -2911,6 +2926,10 @@ AC_CONFIG_FILES([
  	lib/ns/include/Makefile
  	lib/ns/include/ns/Makefile
  	lib/ns/tests/Makefile
@@ -410,7 +401,7 @@ index 58bda3c..d6a45df 100644
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 3bb5e01..c96fe7d 100644
+index da91394..aadb73f 100644
 --- a/lib/dns-pkcs11/tests/Makefile.in
 +++ b/lib/dns-pkcs11/tests/Makefile.in
 @@ -15,15 +15,15 @@ VERSION=@BIND9_VERSION@
@@ -546,5 +537,5 @@ index b8317d3..b73b0c4 100644
 +	-I${top_srcdir}/lib/ns-pkcs11/include
 +
 -- 
-2.26.3
+2.31.1
 
diff --git a/bind-9.11-feature-test-named.patch b/bind-9.11-feature-test-named.patch
deleted file mode 100644
index 9af8d73..0000000
--- a/bind-9.11-feature-test-named.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From e645046202006750f87531e21e3ff7c26fba3466 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 30 Jan 2019 14:37:17 +0100
-Subject: [PATCH] Create feature-test in source directory
-
-Feature-test tool is used in system tests to test compiled in changes.
-Because we build more variants of named with different configuration,
-compile feature-test for each of them this way.
----
- bin/named/Makefile.in       | 12 +++++++++++-
- bin/tests/system/conf.sh.in |  2 +-
- 2 files changed, 12 insertions(+), 2 deletions(-)
-
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 37053a7..ed9add2 100644
---- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -91,7 +91,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 
- SUBDIRS =	unix
- 
--TARGETS =	named@EXEEXT@
-+TARGETS =	named@EXEEXT@ feature-test@EXEEXT@
- 
- GEOIP2LINKOBJS = geoip.@O@
- 
-@@ -154,6 +154,16 @@ named@EXEEXT@: ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="${OBJS} ${UOBJS}"; \
- 	${FINALBUILDCMD}
- 
-+# Bit of hack, do not produce intermediate .o object for featuretest
-+feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
-+	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
-+		-c ${top_srcdir}/bin/tests/system/feature-test.c
-+
-+feature-test@EXEEXT@: feature-test.@O@
-+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
-+		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
-+
-+
- clean distclean maintainer-clean::
- 	rm -f ${TARGETS} ${OBJS}
- 
-diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 7934930..e84fde2 100644
---- a/bin/tests/system/conf.sh.in
-+++ b/bin/tests/system/conf.sh.in
-@@ -37,7 +37,7 @@ DELV=$TOP/bin/delv/delv
- DIG=$TOP/bin/dig/dig
- DNSTAPREAD=$TOP/bin/tools/dnstap-read
- DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
--FEATURETEST=$TOP/bin/tests/system/feature-test
-+FEATURETEST=$TOP/bin/named/feature-test
- FSTRM_CAPTURE=@FSTRM_CAPTURE@
- HOST=$TOP/bin/dig/host
- IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
--- 
-2.26.2
-
diff --git a/bind-9.11-fips-disable.patch b/bind-9.11-fips-disable.patch
deleted file mode 100644
index c01d914..0000000
--- a/bind-9.11-fips-disable.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 2b0dce163a119f5f62eb4428b485f7575f321d6f Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Mon, 5 Aug 2019 11:54:03 +0200
-Subject: [PATCH] Allow explicit disabling of autodisabled MD5
-
-Default security policy might include explicitly disabled RSAMD5
-algorithm. Current FIPS code automatically disables in FIPS mode. But if
-RSAMD5 is included in security policy, it fails to start, because that
-algorithm is not recognized. Allow it disabled, but fail on any
-other usage.
----
- bin/named/server.c | 4 ++--
- lib/bind9/check.c  | 4 ++++
- lib/dns/rcode.c    | 1 +
- 3 files changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/bin/named/server.c b/bin/named/server.c
-index ee23f10..22a5c01 100644
---- a/bin/named/server.c
-+++ b/bin/named/server.c
-@@ -1689,12 +1689,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
- 		r.length = strlen(r.base);
- 
- 		result = dns_secalg_fromtext(&alg, &r);
--		if (result != ISC_R_SUCCESS) {
-+		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
- 			uint8_t ui;
- 			result = isc_parse_uint8(&ui, r.base, 10);
- 			alg = ui;
- 		}
--		if (result != ISC_R_SUCCESS) {
-+		if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
- 			cfg_obj_log(cfg_listelt_value(element), named_g_lctx,
- 				    ISC_LOG_ERROR, "invalid algorithm");
- 			CHECK(result);
-diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index f49a346..dbf9ddb 100644
---- a/lib/bind9/check.c
-+++ b/lib/bind9/check.c
-@@ -317,6 +317,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
- 		r.length = strlen(r.base);
- 
- 		tresult = dns_secalg_fromtext(&alg, &r);
-+		if (tresult == ISC_R_DISABLED) {
-+			// Recognize disabled algorithms, disable it explicitly
-+			tresult = ISC_R_SUCCESS;
-+		}
- 		if (tresult != ISC_R_SUCCESS) {
- 			cfg_obj_log(cfg_listelt_value(element), logctx,
- 				    ISC_LOG_ERROR, "invalid algorithm '%s'",
-diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
-index 327248e..78adf63 100644
---- a/lib/dns/rcode.c
-+++ b/lib/dns/rcode.c
-@@ -152,6 +152,7 @@ static struct tbl rcodes[] = { RCODENAMES ERCODENAMES };
- static struct tbl tsigrcodes[] = { RCODENAMES TSIGRCODENAMES };
- static struct tbl certs[] = { CERTNAMES };
- static struct tbl secalgs[] = { SECALGNAMES };
-+static struct tbl md5_secalgs[] = { MD5_SECALGNAMES };
- static struct tbl secprotos[] = { SECPROTONAMES };
- static struct tbl hashalgs[] = { HASHALGNAMES };
- static struct tbl dsdigests[] = { DSDIGESTNAMES };
--- 
-2.21.1
-
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 51927a4..651db2a 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 3f04cf343dbeb8819197702ce1be737e26e0638a Mon Sep 17 00:00:00 2001
+From 9575852be2344244ac182d7d019869406d3bd963 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -73,7 +73,8 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  .../system/allow-query/ns2/named40.conf.in    |  4 +-
  bin/tests/system/allow-query/tests.sh         | 18 ++---
  bin/tests/system/catz/ns1/named.conf.in       |  2 +-
- bin/tests/system/catz/ns2/named.conf.in       |  2 +-
+ bin/tests/system/catz/ns2/named1.conf.in      |  2 +-
+ bin/tests/system/catz/ns2/named2.conf.in      |  2 +-
  bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
  bin/tests/system/checkconf/good.conf          |  2 +-
  bin/tests/system/feature-test.c               | 14 ++++
@@ -91,7 +92,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/tsig/tests.sh                | 65 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 33 files changed, 162 insertions(+), 108 deletions(-)
+ 34 files changed, 163 insertions(+), 109 deletions(-)
  create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
@@ -526,15 +527,26 @@ index 1218669..e62715e 100644
 -	algorithm hmac-md5;
 +	algorithm hmac-sha256;
  };
-diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in
+diff --git a/bin/tests/system/catz/ns2/named1.conf.in b/bin/tests/system/catz/ns2/named1.conf.in
 index 30333e6..4005152 100644
---- a/bin/tests/system/catz/ns2/named.conf.in
-+++ b/bin/tests/system/catz/ns2/named.conf.in
+--- a/bin/tests/system/catz/ns2/named1.conf.in
++++ b/bin/tests/system/catz/ns2/named1.conf.in
 @@ -70,5 +70,5 @@ zone "catalog4.example" {
  
  key tsig_key. {
  	secret "LSAnCU+Z";
 -	algorithm hmac-md5;
++	algorithm hmac-sha256;
+ };
+diff --git a/bin/tests/system/catz/ns2/named2.conf.in b/bin/tests/system/catz/ns2/named2.conf.in
+index fcd99ca..84c97ca 100644
+--- a/bin/tests/system/catz/ns2/named2.conf.in
++++ b/bin/tests/system/catz/ns2/named2.conf.in
+@@ -56,5 +56,5 @@ zone "catalog4.example" {
+ 
+ key tsig_key. {
+ 	secret "LSAnCU+Z";
+-	algorithm hmac-md5;
 +	algorithm hmac-sha256;
  };
 diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
@@ -551,10 +563,10 @@ index 21be03e..e57c308 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index e09b9e8..2e824b3 100644
+index 616a544..e3a59a5 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -210,6 +210,6 @@ dyndb "name" "library.so" {
+@@ -268,6 +268,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -670,10 +682,10 @@ index da6b3b4..c547e47 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index c055da3..4e1242b 100644
+index 5593a2e..7cd1a74 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -56,7 +56,11 @@ EOF
+@@ -71,7 +71,11 @@ EOF
  
  $DDNSCONFGEN -q -z example.nil > ns1/ddns.key
  
@@ -687,10 +699,10 @@ index c055da3..4e1242b 100644
  $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index b35d797..41c128e 100755
+index 8839131..fde6135 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -797,7 +797,14 @@ fi
+@@ -824,7 +824,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
@@ -706,7 +718,7 @@ index b35d797..41c128e 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -805,7 +812,7 @@ send
+@@ -832,7 +839,7 @@ send
  END
  done
  sleep 2
@@ -715,7 +727,7 @@ index b35d797..41c128e 100755
      $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
  done
  if [ $ret -ne 0 ]; then
-@@ -816,7 +823,7 @@ fi
+@@ -843,7 +850,7 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms (nsupdate -y) ($n)"
@@ -724,7 +736,7 @@ index b35d797..41c128e 100755
      secret=$(sed -n 's/.*secret "\(.*\)";.*/\1/p' ns1/${alg}.key)
      $NSUPDATE -y "hmac-${alg}:${alg}-key:$secret" <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
-@@ -825,7 +832,7 @@ send
+@@ -852,7 +859,7 @@ send
  END
  done
  sleep 2
@@ -734,10 +746,10 @@ index b35d797..41c128e 100755
  done
  if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index b59e7a7..04d5f5a 100644
+index 225722f..63ac938 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
-@@ -33,7 +33,7 @@ make_key () {
+@@ -38,7 +38,7 @@ make_key () {
              sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
  }
  
@@ -747,10 +759,10 @@ index b59e7a7..04d5f5a 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 9fd84ed..d0b188f 100644
+index 9bf86c6..b8a7a1f 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
-@@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
+@@ -349,15 +349,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
  status=`expr $status + $ret`
  
  n=`expr $n + 1`
@@ -955,5 +967,5 @@ index a50c896..8062d68 100644
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
 -- 
-2.26.2
+2.31.1
 
diff --git a/bind-9.11-rh1410433.patch b/bind-9.11-rh1410433.patch
deleted file mode 100644
index 10f1dd2..0000000
--- a/bind-9.11-rh1410433.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
-index fdc8ea5..d638777 100644
---- a/lib/dns/dyndb.c
-+++ b/lib/dns/dyndb.c
-@@ -131,7 +131,7 @@ load_library(isc_mem_t *mctx, const char *filename, const char *instname,
- 		      instname, filename);
- 
- 	flags = RTLD_NOW | RTLD_LOCAL;
--#if defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__
-+#if 0 && defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__
- 	flags |= RTLD_DEEPBIND;
- #endif /* if defined(RTLD_DEEPBIND) && !__SANITIZE_ADDRESS__ */
- 
diff --git a/bind-9.11-rh1666814.patch b/bind-9.11-rh1666814.patch
index e66a5ab..533781d 100644
--- a/bind-9.11-rh1666814.patch
+++ b/bind-9.11-rh1666814.patch
@@ -1,4 +1,4 @@
-From a1a4730c1f02cd85680cf7608ac81e0db59ee522 Mon Sep 17 00:00:00 2001
+From d05d116da39c0a5c580ceaac6ba069899b82c5a0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Wed, 16 Jan 2019 16:27:33 +0100
 Subject: [PATCH] Fix possible crash when loading corrupted file
@@ -6,23 +6,14 @@ Subject: [PATCH] Fix possible crash when loading corrupted file
 Some values passes internal triggers by coincidence. Fix the check and
 check also first_node_offset before even passing it further.
 ---
- lib/dns/rbt.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
+ lib/dns/rbt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
-index ef6441b..404fd6d 100644
+index 5aee5f6..7f2c2d2 100644
 --- a/lib/dns/rbt.c
 +++ b/lib/dns/rbt.c
-@@ -754,7 +754,7 @@ treefix(dns_rbt_t *rbt, void *base, size_t filesize, dns_rbtnode_t *n,
- 	}
- 
- 	CONFIRM((void *)n >= base);
--	CONFIRM((char *)n - (char *)base <= (int)nodemax);
-+	CONFIRM((size_t)((char *)n - (char *)base) <= (int)nodemax);
- 	CONFIRM(DNS_RBTNODE_VALID(n));
- 
- 	dns_name_init(&nodename, NULL);
-@@ -911,7 +911,9 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
+@@ -945,7 +945,9 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
  	rbt->root = (dns_rbtnode_t *)((char *)base_address + header_offset +
  				      header->first_node_offset);
  
@@ -34,5 +25,5 @@ index ef6441b..404fd6d 100644
  		goto cleanup;
  	}
 -- 
-2.21.1
+2.31.1
 
diff --git a/bind-9.11-tests-variants.patch b/bind-9.11-tests-variants.patch
deleted file mode 100644
index 807a4a0..0000000
--- a/bind-9.11-tests-variants.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 607cec78382b016aad0fe041f2e1895b6896c647 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 1 Mar 2019 15:48:20 +0100
-Subject: [PATCH] Make alternative named builds testable in system tests
-
-Red Hat has alternative variant builds of named, which are not ever
-tested by system tests. New variables make it relatively easy to test
-alternative variants.
-
-For sdb variant use:
-export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
-
-For pkcs variant use:
-export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
----
- bin/tests/system/conf.sh.in | 18 +++++++++---------
- 1 file changed, 9 insertions(+), 9 deletions(-)
-
-diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index d859909..9152f07 100644
---- a/bin/tests/system/conf.sh.in
-+++ b/bin/tests/system/conf.sh.in
-@@ -37,17 +37,17 @@ DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
- DELV=$TOP/bin/delv/delv
- DIG=$TOP/bin/dig/dig
- DNSTAPREAD=$TOP/bin/tools/dnstap-read
--DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
--FEATURETEST=$TOP/bin/named/feature-test
-+DSFROMKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-dsfromkey${DNSSEC_VARIANT}
-+FEATURETEST=$TOP/bin/named${NAMED_VARIANT}/feature-test${NAMED_VARIANT}
- FSTRM_CAPTURE=@FSTRM_CAPTURE@
- HOST=$TOP/bin/dig/host
--IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
-+IMPORTKEY=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-importkey${DNSSEC_VARIANT}
- JOURNALPRINT=$TOP/bin/tools/named-journalprint
--KEYFRLAB=$TOP/bin/dnssec/dnssec-keyfromlabel
--KEYGEN=$TOP/bin/dnssec/dnssec-keygen
-+KEYFRLAB=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keyfromlabel${DNSSEC_VARIANT}
-+KEYGEN=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-keygen${DNSSEC_VARIANT}
- KEYMGR=$TOP/bin/python/dnssec-keymgr
- MDIG=$TOP/bin/tools/mdig
--NAMED=$TOP/bin/named/named
-+NAMED=$TOP/bin/named${NAMED_VARIANT}/named${NAMED_VARIANT}
- NSEC3HASH=$TOP/bin/tools/nsec3hash
- NSLOOKUP=$TOP/bin/dig/nslookup
- NSUPDATE=$TOP/bin/nsupdate/nsupdate
-@@ -56,12 +56,12 @@ PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
- PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
- PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
- RESOLVE=$TOP/bin/tests/system/resolve
--REVOKE=$TOP/bin/dnssec/dnssec-revoke
-+REVOKE=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-revoke${DNSSEC_VARIANT}
- RNDC=$TOP/bin/rndc/rndc
- RNDCCONFGEN=$TOP/bin/confgen/rndc-confgen
- RRCHECKER=$TOP/bin/tools/named-rrchecker
--SETTIME=$TOP/bin/dnssec/dnssec-settime
--SIGNER=$TOP/bin/dnssec/dnssec-signzone
-+SETTIME=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-settime${DNSSEC_VARIANT}
-+SIGNER=$TOP/bin/dnssec${DNSSEC_VARIANT}/dnssec-signzone${DNSSEC_VARIANT}
- TSIGKEYGEN=$TOP/bin/confgen/tsig-keygen
- VERIFY=$TOP/bin/dnssec/dnssec-verify
- WIRETEST=$TOP/bin/tests/wire_test
--- 
-2.26.3
-
diff --git a/bind-9.14-json-c.patch b/bind-9.14-json-c.patch
deleted file mode 100644
index 870b46b..0000000
--- a/bind-9.14-json-c.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From 0698eb93f6e618d2882ae2c8758c5fa87524bea6 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 23 Jul 2019 12:10:39 +0200
-Subject: [PATCH] Allow explicitly using json-c but not libjson
-
-Separate detection of json support. Allows explicit use of json-c when
-jsoncpp package is found. Have to use --without-libjson --with-json-c.
----
- configure.ac | 52 +++++++++++++++++++++++++++++++++++++++++-----------
- 1 file changed, 41 insertions(+), 11 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index f7978e4..40b4f9f 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1331,7 +1331,6 @@ AC_ARG_WITH(libjson,
- 	    use_libjson="$withval", use_libjson="auto")
- 
- have_libjson=""
--have_libjson_c=""
- case "$use_libjson" in
- 	no)
- 		libjson_libs=""
-@@ -1347,7 +1346,43 @@ case "$use_libjson" in
- 					LIBS="$LIBS -L${d}/lib"
- 				fi
- 				have_libjson="yes"
--			elif test -f "${d}/include/json-c/json.h"
-+			fi
-+		done
-+		;;
-+	*)
-+		if test -f "${use_libjson}/include/json/json.h"
-+		then
-+			libjson_cflags="-I${use_libjson}/include"
-+			LIBS="$LIBS -L${use_libjson}/lib"
-+			have_libjson="yes"
-+		else
-+			AC_MSG_ERROR([$use_libjson/include/json/json.h not found.])
-+		fi
-+		;;
-+esac
-+
-+#
-+# was --with-json-c specified?
-+#
-+AC_ARG_WITH(json-c,
-+	    AS_HELP_STRING([--with-json-c[=PATH]],
-+			   [build with json-c library [yes|no|path]]),
-+	    use_json_c="$withval", use_json_c="$use_libjson")
-+
-+if test "X${have_libjson}" != "X"
-+then
-+	# Do not use if libjson were found
-+	use_json_c=no
-+fi
-+
-+have_libjson_c=""
-+case "$use_json_c" in
-+	no)
-+		;;
-+	auto|yes)
-+		for d in /usr /usr/local /opt/local
-+		do
-+			if test -f "${d}/include/json-c/json.h"
- 			then
- 				if test ${d} != /usr
- 				then
-@@ -1360,19 +1395,14 @@ case "$use_libjson" in
- 		done
- 		;;
- 	*)
--		if test -f "${use_libjson}/include/json/json.h"
--		then
--			libjson_cflags="-I${use_libjson}/include"
--			LIBS="$LIBS -L${use_libjson}/lib"
--			have_libjson="yes"
--		elif test -f "${use_libjson}/include/json-c/json.h"
-+		if test -f "${use_json_c}/include/json-c/json.h"
- 		then
--			libjson_cflags="-I${use_libjson}/include"
--			LIBS="$LIBS -L${use_libjson}/lib"
-+			libjson_cflags="-I${use_json_c}/include"
-+			LIBS="$LIBS -L${use_json_c}/lib"
- 			have_libjson="yes"
- 			have_libjson_c="yes"
- 		else
--			AC_MSG_ERROR([$use_libjson/include/json{,-c}/json.h not found.])
-+			AC_MSG_ERROR([$use_json_c/include/json-c/json.h not found.])
- 		fi
- 		;;
- esac
--- 
-2.20.1
-
diff --git a/bind-9.16-locked-isc-queue.patch b/bind-9.16-locked-isc-queue.patch
new file mode 100644
index 0000000..c2ebc24
--- /dev/null
+++ b/bind-9.16-locked-isc-queue.patch
@@ -0,0 +1,212 @@
+From 0df59049fe13ef89d362fa7f109f289b297441dc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 22 Feb 2022 23:40:39 +0100
+Subject: [PATCH] Provide alternative isc_queue implementation based on locked
+ list
+
+The current implementation of isc_queue uses Michael-Scott lock-free
+queue that in turn uses hazard pointers.  It was discovered that the way
+we use the isc_queue, such complicated mechanism isn't really needed,
+because most of the time, we either execute the work directly when on
+nmthread (in case of UDP) or schedule the work from the matching
+nmthreads.
+
+Provide alternative implementation for the isc_queue based on locked
+ISC_LIST.
+---
+ bin/named/main.c            |   1 -
+ configure.ac                |  12 ++++
+ lib/isc/include/isc/queue.h |   3 +-
+ lib/isc/queue.c             | 121 ++++++++++++++++++++++++++++++++++++
+ 4 files changed, 134 insertions(+), 3 deletions(-)
+
+diff --git a/bin/named/main.c b/bin/named/main.c
+index 9ad2d0e..8870933 100644
+--- a/bin/named/main.c
++++ b/bin/named/main.c
+@@ -34,7 +34,6 @@
+ #include <isc/dir.h>
+ #include <isc/file.h>
+ #include <isc/hash.h>
+-#include <isc/hp.h>
+ #include <isc/httpd.h>
+ #include <isc/managers.h>
+ #include <isc/netmgr.h>
+diff --git a/configure.ac b/configure.ac
+index 79d33d1..26241a0 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2263,8 +2263,20 @@ AS_CASE([$with_cmocka],
+ AC_SUBST([CMOCKA_CFLAGS])
+ AC_SUBST([CMOCKA_LIBS])
+ 
++#
++# Use lock-free Michael-Scott's queue implementation or locked-list queue
++#
++# [pairwise: --enable-lock-free-queue, --disable-lock-free-queue]
++AC_ARG_ENABLE([lock-free-queue],
++	    [AS_HELP_STRING([--enable-lock-free-queue],[enable lock-free queue implementation (default is enabled)])],
++	    [],[enable_lock_free_queue=yes])
++AS_CASE([$enable_lock_free_queue],
++	[no],[],
++	[yes],[AC_DEFINE([USE_LOCK_FREE_QUEUE],[1],[Define to 1 to enable lock-free queue])])
++
+ AC_DEFINE([SKIPPED_TEST_EXIT_CODE], [0], [Exit code for skipped tests])
+ 
++
+ #
+ # Check for kyua execution engine if CMocka was requested
+ # and bail out if execution engine was not found
+diff --git a/lib/isc/include/isc/queue.h b/lib/isc/include/isc/queue.h
+index 0927075..568bf18 100644
+--- a/lib/isc/include/isc/queue.h
++++ b/lib/isc/include/isc/queue.h
+@@ -39,8 +39,7 @@ uintptr_t
+ isc_queue_dequeue(isc_queue_t *queue);
+ /*%<
+  * Remove an object pointer from the head of the queue and return the
+- * pointer. If the queue is empty, return `nulluintptr` (the uintptr_t
+- * representation of NULL).
++ * pointer. If the queue is empty, return `NULL`.
+  *
+  * Requires:
+  * \li	'queue' is not null.
+diff --git a/lib/isc/queue.c b/lib/isc/queue.c
+index d7ea824..c4cb404 100644
+--- a/lib/isc/queue.c
++++ b/lib/isc/queue.c
+@@ -28,6 +28,10 @@
+ 
+ static uintptr_t nulluintptr = (uintptr_t)NULL;
+ 
++#if USE_LOCK_FREE_QUEUE
++
++#define BUFFER_SIZE 1024
++
+ typedef struct node {
+ 	atomic_uint_fast32_t deqidx;
+ 	atomic_uintptr_t items[BUFFER_SIZE];
+@@ -232,3 +236,120 @@ isc_queue_destroy(isc_queue_t *queue) {
+ 	alloced = queue->alloced_ptr;
+ 	isc_mem_putanddetach(&queue->mctx, alloced, sizeof(*queue) + ALIGNMENT);
+ }
++
++#else /* USE_LOCK_FREE_QUEUE */
++
++typedef struct node node_t;
++
++struct node {
++	uintptr_t item;
++	ISC_LINK(node_t) link;
++};
++
++struct isc_queue {
++	isc_mem_t *mctx;
++	isc_mutex_t lock;
++	int max_threads;
++	ISC_LIST(node_t) nodes;
++	void *alloced_ptr;
++};
++
++static node_t *
++node_new(isc_mem_t *mctx, uintptr_t item) {
++	node_t *node = isc_mem_get(mctx, sizeof(*node));
++	*node = (node_t){
++		.item = item,
++	};
++
++	ISC_LINK_INIT(node, link);
++
++	return (node);
++}
++
++static void
++node_destroy(isc_mem_t *mctx, node_t *node) {
++	isc_mem_put(mctx, node, sizeof(*node));
++}
++
++isc_queue_t *
++isc_queue_new(isc_mem_t *mctx, int max_threads) {
++	isc_queue_t *queue = NULL;
++	void *qbuf = NULL;
++	uintptr_t qptr;
++
++	qbuf = isc_mem_get(mctx, sizeof(*queue) + ALIGNMENT);
++	qptr = (uintptr_t)qbuf;
++	queue = (isc_queue_t *)(qptr + (ALIGNMENT - (qptr % ALIGNMENT)));
++
++	if (max_threads == 0) {
++		max_threads = MAX_THREADS;
++	}
++
++	*queue = (isc_queue_t){
++		.max_threads = max_threads,
++		.alloced_ptr = qbuf,
++	};
++
++	ISC_LIST_INIT(queue->nodes);
++
++	isc_mutex_init(&queue->lock);
++	isc_mem_attach(mctx, &queue->mctx);
++
++	return (queue);
++}
++
++void
++isc_queue_enqueue(isc_queue_t *queue, uintptr_t item) {
++	node_t *node = node_new(queue->mctx, item);
++	REQUIRE(item != nulluintptr);
++
++	LOCK(&queue->lock);
++	ISC_LIST_ENQUEUE(queue->nodes, node, link);
++	UNLOCK(&queue->lock);
++}
++
++uintptr_t
++isc_queue_dequeue(isc_queue_t *queue) {
++	node_t *node = NULL;
++	uintptr_t item = nulluintptr;
++	REQUIRE(queue != NULL);
++
++	LOCK(&queue->lock);
++	node = ISC_LIST_HEAD(queue->nodes);
++	if (node != NULL) {
++		ISC_LIST_DEQUEUE(queue->nodes, node, link);
++		item = node->item;
++	}
++	UNLOCK(&queue->lock);
++
++	if (node != NULL) {
++		node_destroy(queue->mctx, node);
++	}
++
++	return (item);
++}
++
++void
++isc_queue_destroy(isc_queue_t *queue) {
++	node_t *node = NULL;
++	void *alloced = NULL;
++
++	REQUIRE(queue != NULL);
++
++	LOCK(&queue->lock);
++	node = ISC_LIST_HEAD(queue->nodes);
++	while (node != NULL) {
++		node_t *next = ISC_LIST_NEXT(node, link);
++		ISC_LIST_DEQUEUE(queue->nodes, node, link);
++		node_destroy(queue->mctx, node);
++		node = next;
++	}
++	UNLOCK(&queue->lock);
++
++	isc_mutex_destroy(&queue->lock);
++
++	alloced = queue->alloced_ptr;
++	isc_mem_putanddetach(&queue->mctx, alloced, sizeof(*queue) + ALIGNMENT);
++}
++
++#endif /* USE_LOCK_FREE_QUEUE */
+-- 
+2.34.1
+
diff --git a/bind.spec b/bind.spec
index 8c4e836..c2e2099 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1,12 +1,8 @@
 #
-# Red Hat BIND package .spec file
+# Red Hat BIND9 package .spec file
 #
 # vim:expandtab ts=2:
 
-#%%global PATCHVER P1
-#%%global PREVER rc1
-%global BINDVERSION %{version}%{?PREVER}%{?PATCHVER:-%{PATCHVER}}
-
 # bcond_without is built by default, unless --without X is passed
 # bcond_with is built only when --with X is passed to build
 %bcond_with    SYSTEMTEST
@@ -61,14 +57,14 @@
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.16
-Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Version:  9.16.27
+Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
-Source0:  https://downloads.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz
+Source0:  https://downloads.isc.org/isc/bind9/%{version}/bind-%{version}.tar.xz
 Source1:  named.sysconfig
-Source2:  https://downloads.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz.asc
+Source2:  https://downloads.isc.org/isc/bind9/%{version}/bind-%{version}.tar.xz.asc
 Source3:  named.logrotate
 Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2021.txt
 Source16: named.conf
@@ -94,30 +90,29 @@ Source47: named-pkcs11.service
 Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
 
-# Common patches
-Patch10: bind-9.5-PIE.patch
-Patch16: bind-9.16-redhat_doc.patch
-Patch72: bind-9.5-dlz-64bit.patch
-Patch106:bind93-rh490837.patch
-Patch112:bind97-rh645544.patch
-Patch130:bind-9.9.1-P2-dlz-libdb.patch
-Patch133:bind99-rh640538.patch
 # Make PKCS11 used only for pkcs11 parts
-Patch135:bind-9.14-config-pkcs11.patch
+Patch1:  bind-9.14-config-pkcs11.patch
 # Fedora specific patch to distribute native-pkcs#11 functionality
-Patch136:bind-9.10-dist-native-pkcs11.patch
+Patch2:  bind-9.10-dist-native-pkcs11.patch
 # Do not use isc-pkcs11.
-Patch149:bind-9.11-kyua-pkcs11.patch
+Patch3:  bind-9.11-kyua-pkcs11.patch
 
-Patch140:bind-9.11-rh1410433.patch
-Patch157:bind-9.11-fips-tests.patch
-Patch164:bind-9.11-rh1666814.patch
-Patch170:bind-9.11-feature-test-named.patch
-Patch171:bind-9.11-tests-variants.patch
+# Common patches
+Patch18: bind-9.5-PIE.patch
+Patch19: bind-9.16-redhat_doc.patch
+Patch20: bind-9.5-dlz-64bit.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5601
+Patch21: bind93-rh490837.patch
+Patch22: bind-9.11-fips-tests.patch
+Patch23: bind97-rh645544.patch
+Patch24: bind-9.9.1-P2-dlz-libdb.patch
 
-Requires(post):   systemd
-Requires(preun):  systemd
-Requires(postun): systemd
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2689
+Patch25:bind-9.11-rh1666814.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5905
+Patch26: bind-9.16-locked-isc-queue.patch
+
+%{?systemd_ordering}
 Requires:       coreutils
 Requires(pre):  shadow-utils
 Requires(post): shadow-utils
@@ -132,7 +127,7 @@ Recommends:     bind-utils bind-dnssec-utils
 BuildRequires:  gcc, make
 BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
 BuildRequires:  libidn2-devel, libxml2-devel
-BuildRequires:  systemd
+BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
 # needed for %%{__python3} macro
 BuildRequires:  python3-devel
@@ -196,7 +191,6 @@ tools for verifying that the DNS server is operating properly.
 %if %{with PKCS11}
 %package pkcs11
 Summary: Bind with native PKCS#11 functionality for crypto
-Requires: systemd
 Requires: bind%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
@@ -314,12 +308,12 @@ Requires:  fstrm-devel%{?_isa} protobuf-c-devel%{?_isa}
 %endif
 %if %{with GEOIP2}
 Requires:  libmaxminddb-devel%{?_isa}
+%endif
 
 %description devel
 The bind-devel package contains full version of the header files and libraries
 required for building bind-dyndb-ldap. Upstream no longer supports nor recommends
 bind libraries for third party applications.
-%endif
 
 %package chroot
 Summary:        A chroot runtime environment for the ISC BIND DNS server, named(8)
@@ -404,33 +398,17 @@ in HTML and PDF format.
 # RHEL does not yet support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
-%setup -q -n %{name}-%{BINDVERSION}
-
-# Common patches
-%patch10 -p1 -b .PIE
-%patch16 -p1 -b .redhat_doc
-%patch72 -p1 -b .64bit
-%patch106 -p1 -b .rh490837
-%patch112 -p1 -b .rh645544
-%patch130 -p1 -b .libdb
-%patch140 -p1 -b .rh1410433
-%patch157 -p1 -b .fips-tests
-%patch164 -p1 -b .rh1666814
-%patch170 -p1 -b .featuretest-named
-%patch171 -p1 -b .test-variant
-
+%autosetup -n %{name}-%{version} -N
+%autopatch -p1 -m 18
 %if %{with PKCS11}
-%patch135 -p1 -b .config-pkcs11
+%autopatch -p1 -m 1 -M 1
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
 cp -r lib/ns{,-pkcs11}
-%patch136 -p1 -b .dist_pkcs11
-%patch149 -p1 -b .kyua-pkcs11
+%autopatch -p1 -m 2 -M 17
 %endif
 
-%patch133 -p1 -b .rh640538
-
 # Sparc and s390 arches need to use -fPIE
 %ifarch sparcv9 sparc64 s390 s390x
 for i in bin/named/{,unix}/Makefile.in; do
@@ -492,6 +470,7 @@ export LIBDIR_SUFFIX
   --includedir=%{_includedir}/bind9 \
   --with-tuning=large \
   --with-libidn2 \
+  --disable-lock-free-queue \
 %if %{with GEOIP2}
   --with-maxminddb \
 %endif
@@ -743,6 +722,8 @@ popd
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
 cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
 rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
+# Backward compatible link to 9.11 documentation
+(cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
 # Share static data from original sphinx package
 for DIR in %{python3_sitelib}/sphinx_rtd_theme/static/*
 do
@@ -1131,6 +1112,7 @@ fi;
 %if %{with DOC}
 %files doc
 %dir %{_pkgdocdir}
+%doc %{_pkgdocdir}/Bv9ARM.html
 %doc %{_pkgdocdir}/html
 %endif
 %if %{with DOCPDF}
@@ -1138,6 +1120,50 @@ fi;
 %endif
 
 %changelog
+* Thu Mar 17 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.27-1
+- Upgrade to 9.16.27 (#2055120)
+
+* Tue Mar 01 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.24-2
+- Switch to locked queue (#2048235)
+
+* Wed Dec 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.24-1
+- Update to 9.16.24 (#2032934)
+
+* Fri Nov 26 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-2
+- Correct with GEOIP2 condition (#2026823)
+
+* Fri Nov 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-1
+- Update to 9.16.23 (#2024210)
+
+* Wed Oct 27 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.22-1
+- Update to 9.16.22
+
+* Wed Sep 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.21-1
+- Update to 9.16.21
+
+* Wed Aug 25 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-3
+- Increase map format version, lower memory consuption a bit (#1997504)
+- Remove unneeded test variants changes
+- Include documentation of dig return codes
+
+* Thu Aug 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-2
+- Fix map file format regression
+
+* Tue Aug 17 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-1
+- Update to 9.16.20
+
+* Thu Aug 05 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-3
+- Do not depend on systemd package
+
+* Fri Jul 23 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-2
+- Include backward compatible html symlink in doc subpackage
+
+* Wed Jul 21 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.19-1
+- Update to 9.16.19 (#1984627)
+
+* Fri Jun 18 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.18-1
+- Update to 9.16.18
+
 * Thu May 20 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.16-1
 - Update to 9.16.16 (#1954827)
 
diff --git a/bind99-rh640538.patch b/bind99-rh640538.patch
deleted file mode 100644
index 833c476..0000000
--- a/bind99-rh640538.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From d3c58d860737f0f70eff05edad77e0b2a90d4cb9 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 19 Jun 2020 18:48:23 +0200
-Subject: [PATCH] .rh640538
-
----
- bin/dig/dig.rst | 20 ++++++++++++++++++++
- 1 file changed, 20 insertions(+)
-
-diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
-index bef52ba..9f16607 100644
---- a/bin/dig/dig.rst
-+++ b/bin/dig/dig.rst
-@@ -615,6 +615,26 @@ To turn off IDN support, use the parameters
- ``+noidnin`` and ``+noidnout``, or define the ``IDN_DISABLE`` environment
- variable.
- 
-+Return Codes
-+~~~~~~~~~~~~
-+
-+``dig`` return codes are:
-+
-+``0``
-+   Response received, including NXDOMAIN status
-+
-+``1``
-+   Usage error
-+
-+``8``
-+   Couldn't open batch file
-+
-+``9``
-+   No reply from server
-+
-+``10``
-+   Internal error
-+
- Files
- ~~~~~
- 
--- 
-2.26.2
-
diff --git a/sources b/sources
index 2560b1f..7da9ce4 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.16.tar.xz) = 264aa70d0d111ddb2a62c65f57e3eeb7eb93afdebcc523166d236e8f23d61d1e4f91b5a2df8dffa49e6f8e3c7101a2689c38dd6d77ecdedb79e2b163990e6093
-SHA512 (bind-9.16.16.tar.xz.asc) = 60cd60267553a2cff2055c431d69d3d6a72bf31ee123ef1af82c000ed6732e34a8f552c5b0f15cf74294dea17e9a251684820a3889ecd8eaf51c77ddd8411203
+SHA512 (bind-9.16.27.tar.xz) = 5c71f228db83aa8cc9e65466d6e5afca4a9f80c693358111a003fe09e1a14522175eb2b6a0f11e2a2cd4fdba01f2ae315de52e394a441b3861ca2a011e02af62
+SHA512 (bind-9.16.27.tar.xz.asc) = 5df05d9a4f2425807e8f01c45fb707ddbaa3bcce76512dac87a681f8fd0dba96ad6346311984bfab1a45152cb47252219024d9fc58f85a2b2adf6ad9b0eab7f7