From e7eb1a03796baa5ebd020b9d97cc5024718fa88f Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 27 Jul 2017 21:10:24 +0000
Subject: [PATCH 01/22] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index 9c167d9..5d359ee 100644
--- a/validns.spec
+++ b/validns.spec
@@ -1,7 +1,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 6%{?dist}
+Release: 7%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -32,6 +32,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
 * Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
 

From 45323068fbec724d791ed162eff2c9555a834e8b Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 3 Aug 2017 09:57:41 +0000
Subject: [PATCH 02/22] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index 5d359ee..99a3d8c 100644
--- a/validns.spec
+++ b/validns.spec
@@ -1,7 +1,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 7%{?dist}
+Release: 8%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -32,6 +32,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
 * Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
 

From 19b378535b8a599ad5147dee444d4fdf5d77f724 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 9 Feb 2018 20:18:18 +0000
Subject: [PATCH 03/22] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index 99a3d8c..419b2b2 100644
--- a/validns.spec
+++ b/validns.spec
@@ -1,7 +1,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 8%{?dist}
+Release: 9%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -32,6 +32,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
 * Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
 

From c865902185927bb365fd13fc6fe6f5a951811a1f Mon Sep 17 00:00:00 2001
From: Filipe Rosset <rosset.filipe@gmail.com>
Date: Sun, 11 Feb 2018 05:00:35 -0200
Subject: [PATCH 04/22] - Fix FTBFS on rawhide, use compat-openssl10-devel
 until upstream port to 1.1

---
 validns-0.8-Wformat-truncation.patch | 24 ++++++++++++++++++++++++
 validns.spec                         | 18 +++++++++++++-----
 2 files changed, 37 insertions(+), 5 deletions(-)
 create mode 100644 validns-0.8-Wformat-truncation.patch

diff --git a/validns-0.8-Wformat-truncation.patch b/validns-0.8-Wformat-truncation.patch
new file mode 100644
index 0000000..e674992
--- /dev/null
+++ b/validns-0.8-Wformat-truncation.patch
@@ -0,0 +1,24 @@
+--- validns-0.8-orig/ipseckey.c	2014-02-11 18:46:25.000000000 -0200
++++ validns-0.8/ipseckey.c	2018-02-11 04:54:42.167467112 -0200
+@@ -100,10 +100,10 @@
+ 		strcpy(gw, rr->gateway.gateway_none);
+ 		break;
+ 	case 1:
+-		inet_ntop(AF_INET, &rr->gateway.gateway_ipv4, gw, 1024);
++		inet_ntop(AF_INET, &rr->gateway.gateway_ipv4, gw, 2048);
+ 		break;
+ 	case 2:
+-		inet_ntop(AF_INET6, &rr->gateway.gateway_ipv6, gw, 1024);
++		inet_ntop(AF_INET6, &rr->gateway.gateway_ipv6, gw, 2048);
+ 		break;
+ 	case 3:
+ 		strcpy(gw, rr->gateway.gateway_name);
+@@ -111,7 +111,7 @@
+ 	default:
+ 		strcpy(gw, "??");
+ 	}
+-    snprintf(s, 1024, "( %d %d %d %s ... )",
++    snprintf(s, 2048, "( %d %d %d %s ... )",
+ 	     rr->precedence, rr->gateway_type, rr->algorithm, gw);
+     return quickstrdup_temp(s);
+ }
diff --git a/validns.spec b/validns.spec
index 419b2b2..2040f68 100644
--- a/validns.spec
+++ b/validns.spec
@@ -1,24 +1,29 @@
+%global _hardened_build 1
+
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 9%{?dist}
+Release: 10%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
 Patch1: validns-0.8-timing.patch
+Patch2: validns-0.8-Wformat-truncation.patch
 Group: Applications/Internet
-BuildRequires: Judy-devel, openssl-devel
+BuildRequires: Judy-devel, compat-openssl10-devel
 
 %description
 DNS and DNSSEC zone file validator. It comes with no man page and no
 useful README or information, but it's a nice tool anyway :)
 
 %prep
-%setup -q 
-%patch1 -p1 -b .timing
+%autosetup -p1
+#%setup -q 
+#%patch1 -p1 -b .timing
+#%patch2 -p1 -b .Wformat-truncation.patch
 
 %build
-make %{?_smp_mflags}
+%make_build
 gzip validns.1
 
 %install
@@ -32,6 +37,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Sun Feb 11 2018 Filipe Rosset <rosset.filipe@gmail.com> - 0.8-10
+- Fix FTBFS on rawhide, use compat-openssl10-devel until upstream port to 1.1
+
 * Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-9
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
 

From a099e1a7655998832a634d9898d1028f73412a86 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 14 Jul 2018 08:24:32 +0000
Subject: [PATCH 05/22] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index 2040f68..fdd41b4 100644
--- a/validns.spec
+++ b/validns.spec
@@ -3,7 +3,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 10%{?dist}
+Release: 11%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -37,6 +37,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
 * Sun Feb 11 2018 Filipe Rosset <rosset.filipe@gmail.com> - 0.8-10
 - Fix FTBFS on rawhide, use compat-openssl10-devel until upstream port to 1.1
 

From cef0bf1209f519722bb26724d7fd78209ead65f8 Mon Sep 17 00:00:00 2001
From: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
Date: Tue, 24 Jul 2018 16:58:43 +0200
Subject: [PATCH 06/22] Add missing BuildRequires on gcc

make: cc: Command not found

References: https://bugzilla.redhat.com/show_bug.cgi?id=1606634
Signed-off-by: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
---
 validns.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/validns.spec b/validns.spec
index fdd41b4..2a7a003 100644
--- a/validns.spec
+++ b/validns.spec
@@ -10,6 +10,7 @@ Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
 Patch1: validns-0.8-timing.patch
 Patch2: validns-0.8-Wformat-truncation.patch
 Group: Applications/Internet
+BuildRequires:  gcc
 BuildRequires: Judy-devel, compat-openssl10-devel
 
 %description

From 87998cffa45efdd2c36141440646c286155b43c8 Mon Sep 17 00:00:00 2001
From: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
Date: Mon, 28 Jan 2019 20:18:29 +0100
Subject: [PATCH 07/22] Remove obsolete Group tag

References: https://fedoraproject.org/wiki/Changes/Remove_Group_Tag
---
 validns.spec | 1 -
 1 file changed, 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index 2a7a003..bc14020 100644
--- a/validns.spec
+++ b/validns.spec
@@ -9,7 +9,6 @@ Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
 Patch1: validns-0.8-timing.patch
 Patch2: validns-0.8-Wformat-truncation.patch
-Group: Applications/Internet
 BuildRequires:  gcc
 BuildRequires: Judy-devel, compat-openssl10-devel
 

From 8c358648ea0c58703c17f55f035265606ce7528e Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sun, 3 Feb 2019 11:05:01 +0000
Subject: [PATCH 08/22] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index bc14020..c844a95 100644
--- a/validns.spec
+++ b/validns.spec
@@ -3,7 +3,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 11%{?dist}
+Release: 12%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -37,6 +37,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
 * Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-11
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 

From b90fa1018dff76501a89639d303e8c1a5e3e7c77 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 27 Jul 2019 02:46:36 +0000
Subject: [PATCH 09/22] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index c844a95..a485a26 100644
--- a/validns.spec
+++ b/validns.spec
@@ -3,7 +3,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 12%{?dist}
+Release: 13%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -37,6 +37,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
 * Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-12
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 

From debb2743bf997ecf76e63e3c61cd7d947296b68a Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 31 Jan 2020 02:54:56 +0000
Subject: [PATCH 10/22] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index a485a26..9965821 100644
--- a/validns.spec
+++ b/validns.spec
@@ -3,7 +3,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 13%{?dist}
+Release: 14%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -37,6 +37,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-14
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
 * Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-13
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 

From c875f6d1dab042aca5c68351770fc5ee64967684 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 29 Jul 2020 13:32:06 +0000
Subject: [PATCH 11/22] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index 9965821..12b1a99 100644
--- a/validns.spec
+++ b/validns.spec
@@ -3,7 +3,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 14%{?dist}
+Release: 15%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -37,6 +37,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
 * Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-14
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 

From a915e8c437e79921add474db7a07878705842768 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 1 Aug 2020 09:34:39 +0000
Subject: [PATCH 12/22] - Second attempt - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 validns.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index 12b1a99..c8ae205 100644
--- a/validns.spec
+++ b/validns.spec
@@ -3,7 +3,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 15%{?dist}
+Release: 16%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -37,6 +37,10 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-16
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
 * Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-15
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 

From 398c8183543af8f5df770f08bad84bb48f830a15 Mon Sep 17 00:00:00 2001
From: Paul Wouters <pwouters@redhat.com>
Date: Mon, 5 Oct 2020 17:35:21 -0400
Subject: [PATCH 13/22] * Mon Oct  5 17:30:51 EDT 2020 Paul Wouters
 <pwouters@redhat.com> - 0.8-18 - Resolves: rhbz#1879707 FTBFS: Remove
 compat-openssl10 requirement - Resolves: rhbz#1865601 validns: FTBFS in
 Fedora rawhide/f33 - Resolves: rhbz#1880829 F34FailsToInstall: validns -
 Updated notiming patch (-x) notiming patch (-x) - Pulled in git20160720
 updates

---
 validns-0.8-Makefile.patch    |   250 +
 validns-0.8-git20160720.patch |  1719 +++
 validns-0.8-githead.patch     | 21091 ++++++++++++++++++++++++++++++++
 validns-0.8-openssl-1.1.patch |   248 +
 validns-0.8-timing.patch      |    36 +-
 validns.spec                  |    26 +-
 6 files changed, 23344 insertions(+), 26 deletions(-)
 create mode 100644 validns-0.8-Makefile.patch
 create mode 100644 validns-0.8-git20160720.patch
 create mode 100644 validns-0.8-githead.patch
 create mode 100644 validns-0.8-openssl-1.1.patch

diff --git a/validns-0.8-Makefile.patch b/validns-0.8-Makefile.patch
new file mode 100644
index 0000000..b7fc38b
--- /dev/null
+++ b/validns-0.8-Makefile.patch
@@ -0,0 +1,250 @@
+Don't override CFLAGS and CPPFLAGS from the environment (needed for http://wiki.debian.org/Hardening).
+Also respect LDFLAGS.
+
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # The following options seem to work fine on Linux, FreeBSD, and Darwin
+-OPTIMIZE=-O2 -g
+-CFLAGS=-Wall -Werror -pthread -fno-strict-aliasing
+-INCPATH=-I/usr/local/include -I/opt/local/include -I/usr/local/ssl/include
++OPTIMIZE+=-O2 -g
++CFLAGS+=-Wall -Werror -pthread -fno-strict-aliasing
++INCPATH+=-I/usr/local/include -I/opt/local/include -I/usr/local/ssl/include
+ CC?=cc
+ 
+ # These additional options work on Solaris/gcc to which I have an access
+@@ -28,7 +28,7 @@
+ 	ipseckey.o cbtree.o mb.o mg.o mr.o minfo.o \
+ 	afsdb.o x25.o isdn.o rt.o px.o kx.o \
+ 	dlv.o dhcid.o nsap.o
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -o validns \
++	$(CC) $(LDFLAGS) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -o validns \
+ 	    main.o carp.o mempool.o textparse.o base64.o base32hex.o \
+ 	    rr.o soa.o a.o cname.o mx.o ns.o \
+ 	    rrsig.o nsec.o dnskey.o txt.o aaaa.o \
+@@ -58,160 +58,160 @@
+ 	@echo ':-)'
+ 
+ main.o: main.c common.h carp.h mempool.h textparse.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o main.o main.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o main.o main.c $(INCPATH)
+ 
+ carp.o: carp.c carp.h common.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o carp.o carp.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o carp.o carp.c $(INCPATH)
+ 
+ mempool.o: mempool.c mempool.h carp.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o mempool.o mempool.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mempool.o mempool.c $(INCPATH)
+ 
+ textparse.o: textparse.c common.h carp.h mempool.h textparse.h base64.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o textparse.o textparse.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o textparse.o textparse.c $(INCPATH)
+ 
+ base64.o: base64.c base64.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o base64.o base64.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o base64.o base64.c $(INCPATH)
+ 
+ base32hex.o: base32hex.c base32hex.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o base32hex.o base32hex.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o base32hex.o base32hex.c $(INCPATH)
+ 
+ rr.o: rr.c common.h mempool.h carp.h textparse.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o rr.o rr.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o rr.o rr.c $(INCPATH)
+ 
+ soa.o: soa.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o soa.o soa.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o soa.o soa.c $(INCPATH)
+ 
+ a.o: a.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o a.o a.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o a.o a.c $(INCPATH)
+ 
+ cname.o: cname.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o cname.o cname.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o cname.o cname.c $(INCPATH)
+ 
+ mb.o: mb.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o mb.o mb.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mb.o mb.c $(INCPATH)
+ 
+ mg.o: mg.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o mg.o mg.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mg.o mg.c $(INCPATH)
+ 
+ minfo.o: minfo.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o minfo.o minfo.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o minfo.o minfo.c $(INCPATH)
+ 
+ mr.o: mr.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o mr.o mr.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mr.o mr.c $(INCPATH)
+ 
+ mx.o: mx.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o mx.o mx.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mx.o mx.c $(INCPATH)
+ 
+ afsdb.o: afsdb.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o afsdb.o afsdb.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o afsdb.o afsdb.c $(INCPATH)
+ 
+ x25.o: x25.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o x25.o x25.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o x25.o x25.c $(INCPATH)
+ 
+ isdn.o: isdn.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o isdn.o isdn.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o isdn.o isdn.c $(INCPATH)
+ 
+ rt.o: rt.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o rt.o rt.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o rt.o rt.c $(INCPATH)
+ 
+ px.o: px.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o px.o px.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o px.o px.c $(INCPATH)
+ 
+ kx.o: kx.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o kx.o kx.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o kx.o kx.c $(INCPATH)
+ 
+ dlv.o: dlv.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o dlv.o dlv.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o dlv.o dlv.c $(INCPATH)
+ 
+ dhcid.o: dhcid.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o dhcid.o dhcid.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o dhcid.o dhcid.c $(INCPATH)
+ 
+ nsap.o: nsap.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsap.o nsap.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsap.o nsap.c $(INCPATH)
+ 
+ ns.o: ns.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o ns.o ns.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o ns.o ns.c $(INCPATH)
+ 
+ rrsig.o: rrsig.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o rrsig.o rrsig.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o rrsig.o rrsig.c $(INCPATH)
+ 
+ nsec.o: nsec.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsec.o nsec.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsec.o nsec.c $(INCPATH)
+ 
+ dnskey.o: dnskey.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o dnskey.o dnskey.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o dnskey.o dnskey.c $(INCPATH)
+ 
+ txt.o: txt.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o txt.o txt.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o txt.o txt.c $(INCPATH)
+ 
+ aaaa.o: aaaa.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o aaaa.o aaaa.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o aaaa.o aaaa.c $(INCPATH)
+ 
+ naptr.o: naptr.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o naptr.o naptr.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o naptr.o naptr.c $(INCPATH)
+ 
+ srv.o: srv.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o srv.o srv.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o srv.o srv.c $(INCPATH)
+ 
+ nsec3param.o: nsec3param.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsec3param.o nsec3param.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsec3param.o nsec3param.c $(INCPATH)
+ 
+ nsec3.o: nsec3.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsec3.o nsec3.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsec3.o nsec3.c $(INCPATH)
+ 
+ ds.o: ds.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o ds.o ds.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o ds.o ds.c $(INCPATH)
+ 
+ hinfo.o: hinfo.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o hinfo.o hinfo.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o hinfo.o hinfo.c $(INCPATH)
+ 
+ loc.o: loc.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o loc.o loc.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o loc.o loc.c $(INCPATH)
+ 
+ nsec3checks.o: nsec3checks.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsec3checks.o nsec3checks.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsec3checks.o nsec3checks.c $(INCPATH)
+ 
+ ptr.o: ptr.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o ptr.o ptr.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o ptr.o ptr.c $(INCPATH)
+ 
+ sshfp.o: sshfp.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o sshfp.o sshfp.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o sshfp.o sshfp.c $(INCPATH)
+ 
+ rp.o: rp.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o rp.o rp.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o rp.o rp.c $(INCPATH)
+ 
+ spf.o: spf.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o spf.o spf.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o spf.o spf.c $(INCPATH)
+ 
+ cert.o: cert.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o cert.o cert.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o cert.o cert.c $(INCPATH)
+ 
+ dname.o: dname.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o dname.o dname.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o dname.o dname.c $(INCPATH)
+ 
+ tlsa.o: tlsa.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o tlsa.o tlsa.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o tlsa.o tlsa.c $(INCPATH)
+ 
+ nid.o: nid.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o nid.o nid.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nid.o nid.c $(INCPATH)
+ 
+ l32.o: l32.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o l32.o l32.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o l32.o l32.c $(INCPATH)
+ 
+ l64.o: l64.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o l64.o l64.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o l64.o l64.c $(INCPATH)
+ 
+ lp.o: lp.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o lp.o lp.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o lp.o lp.c $(INCPATH)
+ 
+ ipseckey.o: ipseckey.c common.h textparse.h mempool.h carp.h rr.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o ipseckey.o ipseckey.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o ipseckey.o ipseckey.c $(INCPATH)
+ 
+ cbtree.o: cbtree.c cbtree.h
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o cbtree.o cbtree.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o cbtree.o cbtree.c $(INCPATH)
+ 
+ threads.o: threads.c
+-	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o threads.o threads.c $(INCPATH)
++	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o threads.o threads.c $(INCPATH)
+ 
+ test: validns
+ 	perl -MTest::Harness -e 'runtests("t/test.pl")'
+@@ -220,9 +220,9 @@
+ 	perl t/test.pl
+ 
+ test64:
+-	$(CC) -Wall -O2 -o base64-test base64.c -DTEST_PROGRAM
++	$(CC) $(LDFLAGS) $(CPPFLAGS) $(CFLAGS)  -Wall -O2 -o base64-test base64.c -DTEST_PROGRAM
+ 	./base64-test
+ 
+ test32hex:
+-	$(CC) -Wall -O2 -o base32hex-test base32hex.c -DTEST_PROGRAM
++	$(CC) $(LDFLAGS) $(CPPFLAGS) $(CFLAGS) -Wall -O2 -o base32hex-test base32hex.c -DTEST_PROGRAM
+ 	./base32hex-test
diff --git a/validns-0.8-git20160720.patch b/validns-0.8-git20160720.patch
new file mode 100644
index 0000000..20e3415
--- /dev/null
+++ b/validns-0.8-git20160720.patch
@@ -0,0 +1,1719 @@
+diff -Naur validns-0.8/afsdb.c validns-0.8_git20160720/afsdb.c
+--- validns-0.8/afsdb.c	2014-02-11 15:46:27.000000000 -0500
++++ validns-0.8_git20160720/afsdb.c	2016-02-04 09:14:15.000000000 -0500
+@@ -21,7 +21,7 @@
+ {
+ 	struct rr_afsdb *rr = getmem(sizeof(*rr));
+ 
+-	rr->subtype = extract_integer(&s, "AFSDB subtype");
++	rr->subtype = extract_integer(&s, "AFSDB subtype", NULL);
+ 	if (rr->subtype < 0)
+ 		return NULL;
+ 
+diff -Naur validns-0.8/cert.c validns-0.8_git20160720/cert.c
+--- validns-0.8/cert.c	2014-02-11 15:46:12.000000000 -0500
++++ validns-0.8_git20160720/cert.c	2016-02-04 09:14:15.000000000 -0500
+@@ -30,7 +30,7 @@
+ 	char *str_type;
+ 
+ 	if (isdigit(**s)) {
+-		type = extract_integer(s, what);
++		type = extract_integer(s, what, NULL);
+ 		if (type >= 1 && type <= 8)
+ 			return type;
+ 		if (type == 253 || type == 254)
+@@ -84,14 +84,14 @@
+ 	if (cert_type < 0)	return NULL;
+ 	rr->type = cert_type;
+ 
+-	key_tag = extract_integer(&s, "key tag");
++	key_tag = extract_integer(&s, "key tag", NULL);
+ 	if (key_tag < 0)	return NULL;
+ 	if (key_tag > 65535)
+ 		return bitch("bad key tag");
+ 	rr->key_tag = key_tag;
+ 
+ 	if (isdigit(*s)) {
+-		alg = extract_integer(&s, "algorithm");
++		alg = extract_integer(&s, "algorithm", NULL);
+ 		if (alg < 0)	return NULL;
+ 		if (alg > 255)	return bitch("bad algorithm");
+ 		if (alg != 0) {  /* 0 is just fine */
+diff -Naur validns-0.8/common.h validns-0.8_git20160720/common.h
+--- validns-0.8/common.h	2014-02-11 15:45:02.000000000 -0500
++++ validns-0.8_git20160720/common.h	2016-02-04 09:14:15.000000000 -0500
+@@ -9,19 +9,37 @@
+ #ifndef _COMMON_H_
+ #define _COMMON_H_ 1
+ 
++struct generate_template_piece;
++struct generate_template_piece
++{
++	char *constant_string;
++	struct generate_template_piece *next;
++};
++
++#define LINEBUFSZ 2048
++
+ struct file_info
+ {
+ 	struct file_info *next;
+ 	FILE *file;
+ 	int  line;
+ 	int  paren_mode;
+-	char buf[2048];
++	char buf[LINEBUFSZ];
++	char *current_origin;
++
++	int generate_cur;
++	int generate_lim;
++	char *generate_type;
++	struct generate_template_piece *generate_lhs;
++	struct generate_template_piece *generate_rhs;
++
++	/* must be last struct member */
+ 	char name[0];
+ };
+ 
+ extern struct file_info *file_info;
+ 
+-#define N_POLICY_CHECKS 9
++#define N_POLICY_CHECKS 10
+ 
+ #define POLICY_SINGLE_NS 0
+ #define POLICY_CNAME_OTHER_DATA 1
+@@ -32,6 +50,7 @@
+ #define POLICY_DNAME 6
+ #define POLICY_DNSKEY 7
+ #define POLICY_TLSA_HOST 8
++#define POLICY_KSK_EXISTS 9
+ 
+ #define MAX_TIMES_TO_CHECK 32
+ 
+@@ -55,11 +74,13 @@
+ 		int summary;
+ 		int verbose;
+ 		char *include_path;
+-		char *current_origin;
++		int include_path_specified;
++		char *first_origin;
+ 		int n_times_to_check;
+ 		uint32_t times_to_check[MAX_TIMES_TO_CHECK];
+ 		char policy_checks[N_POLICY_CHECKS];
+ 		int n_threads;
++		int soa_minttl_as_default_ttl;
+ 	} opt;
+ 	int exit_code;
+ 	long default_ttl;
+diff -Naur validns-0.8/dlv.c validns-0.8_git20160720/dlv.c
+--- validns-0.8/dlv.c	2014-02-11 15:46:32.000000000 -0500
++++ validns-0.8_git20160720/dlv.c	2016-02-04 09:14:15.000000000 -0500
+@@ -22,7 +22,7 @@
+ 	struct rr_dlv *rr = getmem(sizeof(*rr));
+ 	int key_tag, algorithm, digest_type;
+ 
+-	key_tag = extract_integer(&s, "key tag");
++	key_tag = extract_integer(&s, "key tag", NULL);
+ 	if (key_tag < 0)	return NULL;
+ 	rr->key_tag = key_tag;
+ 
+@@ -30,7 +30,7 @@
+ 	if (algorithm == ALG_UNSUPPORTED)	return NULL;
+ 	rr->algorithm = algorithm;
+ 
+-	digest_type = extract_integer(&s, "digest type");
++	digest_type = extract_integer(&s, "digest type", NULL);
+ 	if (digest_type < 0)	return NULL;
+ 	rr->digest_type = digest_type;
+ 
+diff -Naur validns-0.8/dnskey.c validns-0.8_git20160720/dnskey.c
+--- validns-0.8/dnskey.c	2014-02-11 15:45:11.000000000 -0500
++++ validns-0.8_git20160720/dnskey.c	2016-02-04 09:14:15.000000000 -0500
+@@ -20,6 +20,8 @@
+ #include "carp.h"
+ #include "rr.h"
+ 
++static struct rr_dnskey *all_dns_keys = NULL;
++
+ static struct rr* dnskey_parse(char *name, long ttl, int type, char *s)
+ {
+ 	struct rr_dnskey *rr = getmem(sizeof(*rr));
+@@ -27,10 +29,11 @@
+ 	int flags, proto, algorithm;
+ 	unsigned int ac;
+ 	int i;
++	static struct rr *result;
+ 
+-	flags = extract_integer(&s, "flags");
++	flags = extract_integer(&s, "flags", NULL);
+ 	if (flags < 0) return NULL;
+-	if (flags & 0xfefe)
++	if (flags & 0xfe7e)
+ 		return bitch("reserved flags bits are set");
+ 	if (flags & 0x0001 && !(flags & 0x0100))
+ 		return bitch("SEP bit is set but Zone Key bit is unset");
+@@ -38,7 +41,7 @@
+ 
+ 	/* TODO validate that `name` is the name of the zone if flags have Zone Key bit set */
+ 
+-	proto = extract_integer(&s, "protocol");
++	proto = extract_integer(&s, "protocol", NULL);
+ 	if (proto < 0) return NULL;
+ 	if (proto != 3)
+ 		return bitch("bad protocol value");
+@@ -68,11 +71,17 @@
+ 
+ 	rr->pkey_built = 0;
+ 	rr->pkey = NULL;
++	rr->key_type = KEY_TYPE_UNUSED;
+ 
+ 	if (*s) {
+ 		return bitch("garbage after valid DNSKEY data");
+ 	}
+-	return store_record(type, name, ttl, rr);
++	result = store_record(type, name, ttl, rr);
++	if (result) {
++		rr->next_key = all_dns_keys;
++		all_dns_keys = rr;
++	}
++	return result;
+ }
+ 
+ static char* dnskey_human(struct rr *rrv)
+@@ -187,3 +196,18 @@
+ 	return rr->pkey ? 1 : 0;
+ }
+ 
++void
++dnskey_ksk_policy_check(void)
++{
++	struct rr_dnskey *rr = all_dns_keys;
++	int ksk_found = 0;
++
++	while (rr) {
++		if (rr->key_type == KEY_TYPE_KSK)
++			ksk_found = 1;
++		rr = rr->next_key;
++	}
++	if (!ksk_found)
++		moan(all_dns_keys->rr.file_name, all_dns_keys->rr.line, "No KSK found");
++}
++
+diff -Naur validns-0.8/ds.c validns-0.8_git20160720/ds.c
+--- validns-0.8/ds.c	2014-02-11 15:44:59.000000000 -0500
++++ validns-0.8_git20160720/ds.c	2016-02-04 09:14:15.000000000 -0500
+@@ -22,7 +22,7 @@
+ 	struct rr_ds *rr = getmem(sizeof(*rr));
+ 	int key_tag, algorithm, digest_type;
+ 
+-	key_tag = extract_integer(&s, "key tag");
++	key_tag = extract_integer(&s, "key tag", NULL);
+ 	if (key_tag < 0)	return NULL;
+ 	rr->key_tag = key_tag;
+ 
+@@ -30,7 +30,7 @@
+ 	if (algorithm == ALG_UNSUPPORTED)	return NULL;
+ 	rr->algorithm = algorithm;
+ 
+-	digest_type = extract_integer(&s, "digest type");
++	digest_type = extract_integer(&s, "digest type", NULL);
+ 	if (digest_type < 0)	return NULL;
+ 	rr->digest_type = digest_type;
+ 
+diff -Naur validns-0.8/ipseckey.c validns-0.8_git20160720/ipseckey.c
+--- validns-0.8/ipseckey.c	2014-02-11 15:46:25.000000000 -0500
++++ validns-0.8_git20160720/ipseckey.c	2016-02-04 09:14:15.000000000 -0500
+@@ -24,15 +24,15 @@
+ 	struct rr_ipseckey *rr = getmem(sizeof(*rr));
+ 	int i;
+ 
+-	rr->precedence = i = extract_integer(&s, "precedence");
++	rr->precedence = i = extract_integer(&s, "precedence", NULL);
+ 	if (i < 0)    return NULL;
+ 	if (i >= 256) return bitch("precedence range is not valid");
+ 
+-	rr->gateway_type = i = extract_integer(&s, "gateway type");
++	rr->gateway_type = i = extract_integer(&s, "gateway type", NULL);
+ 	if (i < 0) return NULL;
+ 	if (i > 3) return bitch("gateway type is not valid");
+ 
+-	rr->algorithm = i = extract_integer(&s, "algorithm");
++	rr->algorithm = i = extract_integer(&s, "algorithm", NULL);
+ 	if (i < 0) return NULL;
+ 	if (i > 2) return bitch("algorithm is not valid");
+ 
+diff -Naur validns-0.8/kx.c validns-0.8_git20160720/kx.c
+--- validns-0.8/kx.c	2014-02-11 15:46:36.000000000 -0500
++++ validns-0.8_git20160720/kx.c	2016-02-04 09:14:15.000000000 -0500
+@@ -21,7 +21,7 @@
+ {
+ 	struct rr_kx *rr = getmem(sizeof(*rr));
+ 
+-	rr->preference = extract_integer(&s, "KX preference");
++	rr->preference = extract_integer(&s, "KX preference", NULL);
+ 	if (rr->preference < 0)
+ 		return NULL;
+ 
+diff -Naur validns-0.8/l32.c validns-0.8_git20160720/l32.c
+--- validns-0.8/l32.c	2014-02-11 15:46:17.000000000 -0500
++++ validns-0.8_git20160720/l32.c	2016-02-04 09:14:15.000000000 -0500
+@@ -23,7 +23,7 @@
+ 	struct in_addr ipv4_like;
+ 	int preference;
+ 
+-	rr->preference = preference = extract_integer(&s, "L32 preference");
++	rr->preference = preference = extract_integer(&s, "L32 preference", NULL);
+ 	if (preference < 0)
+ 		return NULL;
+ 	if (extract_ipv4(&s, "Locator32", &ipv4_like) <= 0)
+diff -Naur validns-0.8/l64.c validns-0.8_git20160720/l64.c
+--- validns-0.8/l64.c	2014-02-11 15:46:18.000000000 -0500
++++ validns-0.8_git20160720/l64.c	2016-02-04 09:14:15.000000000 -0500
+@@ -22,7 +22,7 @@
+ 	struct rr_l64 *rr = getmem(sizeof(*rr));
+ 	int preference;
+ 
+-	rr->preference = preference = extract_integer(&s, "L64 preference");
++	rr->preference = preference = extract_integer(&s, "L64 preference", NULL);
+ 	if (preference < 0)
+ 		return NULL;
+ 	if (extract_u64(&s, "Locator64", &rr->locator64) < 0)
+diff -Naur validns-0.8/loc.c validns-0.8_git20160720/loc.c
+--- validns-0.8/loc.c	2014-02-11 15:45:16.000000000 -0500
++++ validns-0.8_git20160720/loc.c	2016-02-04 09:14:15.000000000 -0500
+@@ -56,7 +56,7 @@
+ 	rr->version = 0;
+ 
+ 	/* latitude block */
+-	i = extract_integer(&s, "degrees latitude");
++	i = extract_integer(&s, "degrees latitude", NULL);
+ 	if (i < 0)
+ 		return NULL;
+ 	if (i > 90)
+@@ -65,7 +65,7 @@
+ 	min = 0;
+ 	sec = 0;
+ 	if (isdigit(*s)) {
+-		i = extract_integer(&s, "minutes latitude");
++		i = extract_integer(&s, "minutes latitude", NULL);
+ 		if (i < 0)
+ 			return NULL;
+ 		if (i > 59)
+@@ -96,7 +96,7 @@
+ 	if (!s) return NULL;
+ 
+ 	/* longitude block */
+-	i = extract_integer(&s, "degrees longitude");
++	i = extract_integer(&s, "degrees longitude", NULL);
+ 	if (i < 0)
+ 		return NULL;
+ 	if (i > 180)
+@@ -105,7 +105,7 @@
+ 	min = 0;
+ 	sec = 0;
+ 	if (isdigit(*s)) {
+-		i = extract_integer(&s, "minutes longitude");
++		i = extract_integer(&s, "minutes longitude", NULL);
+ 		if (i < 0)
+ 			return NULL;
+ 		if (i > 59)
+diff -Naur validns-0.8/lp.c validns-0.8_git20160720/lp.c
+--- validns-0.8/lp.c	2014-02-11 15:45:55.000000000 -0500
++++ validns-0.8_git20160720/lp.c	2016-02-04 09:14:15.000000000 -0500
+@@ -23,7 +23,7 @@
+ 	struct rr_lp *rr = getmem(sizeof(*rr));
+ 	int preference;
+ 
+-	rr->preference = preference = extract_integer(&s, "LP preference");
++	rr->preference = preference = extract_integer(&s, "LP preference", NULL);
+ 	if (preference < 0)
+ 		return NULL;
+ 	rr->fqdn = extract_name(&s, "LP fqdn", 0);
+diff -Naur validns-0.8/main.c validns-0.8_git20160720/main.c
+--- validns-0.8/main.c	2014-02-11 15:47:10.000000000 -0500
++++ validns-0.8_git20160720/main.c	2016-02-04 09:14:15.000000000 -0500
+@@ -17,6 +17,7 @@
+ #include <time.h>
+ #include <netinet/in.h>
+ #include <arpa/inet.h>
++#include <libgen.h>
+ 
+ #include "common.h"
+ #include "carp.h"
+@@ -27,8 +28,80 @@
+ struct globals G;
+ struct file_info *file_info = NULL;
+ 
+-int
+-read_zone_file(void);
++int read_zone_file(void);
++void open_zone_file(char *fname);
++
++static void
++concat_generate_template(char *buf, int bufsz, int val, struct generate_template_piece *t)
++{
++	char sval[40];
++
++	while (t) {
++		if (t->constant_string) {
++			mystrlcat(buf, t->constant_string, bufsz);
++		} else {
++			snprintf(sval, 40, "%d", val);
++			mystrlcat(buf, sval, bufsz);
++		}
++		t = t->next;
++	}
++}
++
++static struct generate_template_piece *
++free_generate_template(struct generate_template_piece *t)
++{
++	struct generate_template_piece *n;
++	while (t) {
++		n = t->next;
++		free(t);
++		t = n;
++	}
++	return NULL;
++}
++
++static void
++create_generate_template_piece(struct generate_template_piece **generate_template, char *s)
++{
++	if (s && *s == 0)
++		return;
++
++	struct generate_template_piece *p = malloc(sizeof(struct generate_template_piece));
++
++	p->constant_string = s;
++	p->next = NULL;
++
++	if (*generate_template) {
++		struct generate_template_piece *t = *generate_template;
++		while (t->next)
++			t = t->next;
++		t->next = p;
++	} else {
++		*generate_template = p;
++	}
++}
++
++static struct generate_template_piece *
++prepare_generate_template(char *t)
++{
++	char *s = t;
++	struct generate_template_piece *r = NULL;
++
++	while (1) {
++		while (*t && *t != '$') t++;
++		if (!*t) {
++			create_generate_template_piece(&r, s);
++			break;
++		} else {
++			*t = 0;
++			create_generate_template_piece(&r, s);
++			create_generate_template_piece(&r, NULL);
++			t++;
++			s = t;
++		}
++	}
++
++	return r;
++}
+ 
+ static char *process_directive(char *s)
+ {
+@@ -48,7 +121,7 @@
+ 		if (*s) {
+ 			return bitch("garbage after valid $ORIGIN directive");
+ 		}
+-		G.opt.current_origin = o;
++		file_info->current_origin = o;
+ 		if (G.opt.verbose) {
+ 			fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
+ 			fprintf(stderr, "origin is now %s\n", o);
+@@ -71,14 +144,80 @@
+ 			fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
+ 			fprintf(stderr, "default ttl is now %ld\n", G.default_ttl);
+ 		}
++	} else if (*(s+1) == 'G' && strncmp(s, "$GENERATE", 9) == 0) {
++		int from, to;
++		char *lhs, *rdtype;
++
++		s += 9;
++		if (!isspace(*s)) {
++			if (isalnum(*s)) goto unrecognized_directive;
++			return bitch("bad $GENERATE format");
++		}
++		s = skip_white_space(s);
++
++		from = extract_integer(&s, "generate-from", "-");
++		if (from < 0)
++			return NULL;
++		if (*s != '-')
++			return bitch("'-' between generate-from and generate-to is expected");
++		s++;
++		to = extract_integer(&s, "generate-to", "-");
++		if (to < 0)
++			return NULL;
++
++		if (*s == '/')
++			return bitch("generate-step is unsupported for now");
++
++		lhs = extract_name(&s, "generate-lhs", KEEP_CAPITALIZATION | DOLLAR_OK_IN_NAMES);
++		if (!lhs)
++			return NULL;
++
++		if (*s == '{')
++			return bitch("{offset,width,type} is unsupported for now");
++
++		rdtype = extract_label(&s, "type", NULL);
++		if (!rdtype)
++			return NULL;
++
++		file_info->generate_cur  = from;
++		file_info->generate_lim  = to;
++		file_info->generate_type = rdtype;
++		file_info->generate_lhs = prepare_generate_template(lhs);
++		file_info->generate_rhs = prepare_generate_template(quickstrdup(s));
++
++		return s;
+ 	} else if (*(s+1) == 'I' && strncmp(s, "$INCLUDE", 8) == 0) {
++		char *p, *f;
++		char c;
+ 		s += 8;
+ 		if (!isspace(*s)) {
+ 			if (isalnum(*s)) goto unrecognized_directive;
+ 			return bitch("bad $INCLUDE format");
+ 		}
+ 		s = skip_white_space(s);
+-		return bitch("XXX include support is not implemented");
++		p = s;
++		while (*s && !isspace(*s) && *s != ';')
++			s++;
++		c = *s;
++		*s = '\0';
++		if (!*p) {
++			return bitch("$INCLUDE directive with empty file name");
++		}
++		f = quickstrdup_temp(p);
++		*s = c;
++		s = skip_white_space(s);
++
++		if (*s) {
++			return bitch("garbage after valid $INCLUDE directive");
++		}
++		if (*f == '/') {
++			open_zone_file(f);
++		} else {
++			char buf[1024];
++
++			snprintf(buf, 1024, "%s/%s", G.opt.include_path, f);
++			open_zone_file(buf);
++		}
+ 	} else {
+ unrecognized_directive:
+ 		s = d-1;
+@@ -89,6 +228,39 @@
+ 	return s;
+ }
+ 
++char *
++read_zone_line(void)
++{
++	char *r;
++
++	if (file_info->generate_lhs) {
++		if (file_info->generate_cur <= file_info->generate_lim) {
++			file_info->buf[0] = 0;
++			concat_generate_template(file_info->buf, LINEBUFSZ, file_info->generate_cur, file_info->generate_lhs);
++			mystrlcat(file_info->buf, " ", LINEBUFSZ);
++			mystrlcat(file_info->buf, file_info->generate_type, LINEBUFSZ);
++			mystrlcat(file_info->buf, " ", LINEBUFSZ);
++			concat_generate_template(file_info->buf, LINEBUFSZ, file_info->generate_cur, file_info->generate_rhs);
++			file_info->generate_cur++;
++			return file_info->buf;
++		} else {
++			/* Done with this $GENERATE */
++			file_info->generate_cur = 0;
++			file_info->generate_lim = 0;
++			file_info->generate_type = NULL;
++			file_info->generate_lhs = NULL;
++			free_generate_template(file_info->generate_lhs);
++			free_generate_template(file_info->generate_rhs);
++			file_info->generate_rhs = NULL;
++		}
++	}
++
++	r = fgets(file_info->buf, LINEBUFSZ, file_info->file);
++	if (r)
++		file_info->line++;
++	return r;
++}
++
+ int
+ read_zone_file(void)
+ {
+@@ -96,9 +268,8 @@
+ 	char *name = NULL, *class, *rdtype;
+ 	long ttl = -1;
+ 	while (file_info) {
+-		while (fgets(file_info->buf, 2048, file_info->file)) {
++		while (read_zone_line()) {
+ 			freeall_temp();
+-			file_info->line++;
+ 			file_info->paren_mode = 0;
+ 			rdtype = NULL;
+ 			if (empty_line_or_comment(file_info->buf))
+@@ -179,23 +350,36 @@
+ 			if (ttl < 0) {
+ 				ttl = G.default_ttl;
+ 			}
+-			if (ttl < 0) {
+-				bitch("ttl not specified and default is not known");
+-				continue;
+-			}
+ 
+ 			{
+ 				int is_generic;
+ 				int type = str2rdtype(rdtype, &is_generic);
++				struct rr *rr;
++
+ 				if (type <= 0) continue;
++
++				if (ttl < 0 && !(G.opt.soa_minttl_as_default_ttl && type == T_SOA)) {
++					bitch("ttl not specified and default is not known");
++					continue;
++				}
++
+ 				if (is_generic)
+-					rr_parse_any(name, ttl, type, s);
++					rr = rr_parse_any(name, ttl, type, s);
+ 				else if (type > T_MAX)
+-					rr_parse_any(name, ttl, type, s);
++					rr = rr_parse_any(name, ttl, type, s);
+ 				else if (rr_methods[type].rr_parse)
+-					rr_methods[type].rr_parse(name, ttl, type, s);
++					rr = rr_methods[type].rr_parse(name, ttl, type, s);
+ 				else
+-					rr_parse_any(name, ttl, type, s);
++					rr = rr_parse_any(name, ttl, type, s);
++
++				if (type == T_SOA && ttl < 0 && rr) {
++					struct rr_soa *soa = (struct rr_soa *) rr;
++					soa->rr.ttl = G.default_ttl = soa->minimum;
++					if (G.opt.verbose) {
++						fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
++						fprintf(stderr, "no ttl specified; using SOA MINTTL (%ld) instead\n", G.default_ttl);
++					}
++				}
+ 			}
+ 		}
+ 		if (ferror(file_info->file))
+@@ -216,6 +400,9 @@
+ 		fname = "stdin";
+ 	} else {
+ 		f = fopen(fname, "r");
++		if (!file_info && !G.opt.include_path_specified) {
++			G.opt.include_path = quickstrdup(dirname(quickstrdup_temp(fname)));
++		}
+ 	}
+ 	if (!f)
+ 		croak(1, "open %s", fname);
+@@ -226,6 +413,11 @@
+ 	new_file_info->file = f;
+ 	new_file_info->line = 0;
+ 	strcpy(new_file_info->name, fname);
++	if (file_info) {
++		new_file_info->current_origin = file_info->current_origin;
++	} else {
++		new_file_info->current_origin = G.opt.first_origin;
++	}
+ 	file_info = new_file_info;
+ }
+ 
+@@ -248,6 +440,8 @@
+ 	fprintf(stderr, "\t\t\tmx-alias\n");
+ 	fprintf(stderr, "\t\t\tns-alias\n");
+ 	fprintf(stderr, "\t\t\trp-txt-exists\n");
++	fprintf(stderr, "\t\t\ttlsa-host\n");
++	fprintf(stderr, "\t\t\tksk-exists\n");
+ 	fprintf(stderr, "\t\t\tall\n");
+ 
+ 	fprintf(stderr, "\t-n N\t\tuse N worker threads\n");
+@@ -273,6 +467,7 @@
+ 	G.default_ttl = -1; /* XXX orly? */
+ 	G.opt.times_to_check[0] = time(NULL);
+ 	G.opt.n_times_to_check = 0;
++	G.opt.include_path = ".";
+ 
+ 	for (i = 0; i <= T_MAX; i++) {
+ 		rr_methods[i] = unknown_methods;
+@@ -328,7 +523,7 @@
+ 	struct timeval start, stop;
+ 
+ 	initialize_globals();
+-	while ((o = getopt(argc, argv, "fhqsvI:z:t:p:n:")) != -1) {
++	while ((o = getopt(argc, argv, "fhMqsvI:z:t:p:n:")) != -1) {
+ 		switch(o) {
+ 		case 'h':
+ 			usage(NULL);
+@@ -336,6 +531,9 @@
+ 		case 'f':
+ 			G.opt.die_on_first_error = 1;
+ 			break;
++		case 'M':
++			G.opt.soa_minttl_as_default_ttl = 1;
++			break;
+ 		case 'q':
+ 			G.opt.no_output = 1;
+ 			break;
+@@ -369,19 +567,22 @@
+ 				G.opt.policy_checks[POLICY_RP_TXT_EXISTS] = 1;
+ 			} else if (strcmp(optarg, "tlsa-host") == 0) {
+ 				G.opt.policy_checks[POLICY_TLSA_HOST] = 1;
++			} else if (strcmp(optarg, "ksk-exists") == 0) {
++				G.opt.policy_checks[POLICY_KSK_EXISTS] = 1;
+ 			} else {
+ 				usage("unknown policy name");
+ 			}
+ 			break;
+ 		case 'I':
+ 			G.opt.include_path = optarg;
++			G.opt.include_path_specified = 1;
+ 			break;
+ 		case 'z':
+ 			if (strlen(optarg) && *(optarg+strlen(optarg)-1) == '.') {
+-				G.opt.current_origin = optarg;
++				G.opt.first_origin = optarg;
+ 			} else if (strlen(optarg)) {
+-				G.opt.current_origin = getmem(strlen(optarg)+2);
+-				strcpy(mystpcpy(G.opt.current_origin, optarg), ".");
++				G.opt.first_origin = getmem(strlen(optarg)+2);
++				strcpy(mystpcpy(G.opt.first_origin, optarg), ".");
+ 			} else {
+ 				usage("origin must not be empty");
+ 			}
+@@ -417,6 +618,9 @@
+ 		if (first_nsec3) nsec3_validate(&first_nsec3->rr);
+ 		perform_remaining_nsec3checks();
+ 	}
++	if (G.dnssec_active && G.opt.policy_checks[POLICY_KSK_EXISTS]) {
++		dnskey_ksk_policy_check();
++	}
+ 	gettimeofday(&stop, NULL);
+ 	if (G.opt.summary) {
+ 		printf("records found:       %d\n", G.stats.rr_count);
+diff -Naur validns-0.8/mx.c validns-0.8_git20160720/mx.c
+--- validns-0.8/mx.c	2014-02-11 15:45:19.000000000 -0500
++++ validns-0.8_git20160720/mx.c	2016-02-04 09:14:15.000000000 -0500
+@@ -21,7 +21,7 @@
+ {
+ 	struct rr_mx *rr = getmem(sizeof(*rr));
+ 
+-	rr->preference = extract_integer(&s, "MX preference");
++	rr->preference = extract_integer(&s, "MX preference", NULL);
+ 	if (rr->preference < 0)
+ 		return NULL;
+ 	/* XXX preference range check */
+diff -Naur validns-0.8/naptr.c validns-0.8_git20160720/naptr.c
+--- validns-0.8/naptr.c	2014-02-11 15:45:22.000000000 -0500
++++ validns-0.8_git20160720/naptr.c	2016-02-04 09:14:15.000000000 -0500
+@@ -24,14 +24,14 @@
+ 	int i;
+ 	struct binary_data text;
+ 
+-	i = extract_integer(&s, "order");
++	i = extract_integer(&s, "order", NULL);
+ 	if (i < 0)
+ 		return NULL;
+ 	if (i >= 65536)
+ 		return bitch("order range is not valid");
+ 	rr->order = i;
+ 
+-	i = extract_integer(&s, "preference");
++	i = extract_integer(&s, "preference", NULL);
+ 	if (i < 0)
+ 		return NULL;
+ 	if (i >= 65536)
+diff -Naur validns-0.8/nid.c validns-0.8_git20160720/nid.c
+--- validns-0.8/nid.c	2014-02-11 15:46:20.000000000 -0500
++++ validns-0.8_git20160720/nid.c	2016-02-04 09:14:15.000000000 -0500
+@@ -22,7 +22,7 @@
+ 	struct rr_nid *rr = getmem(sizeof(*rr));
+ 	int preference;
+ 
+-	rr->preference = preference = extract_integer(&s, "NID preference");
++	rr->preference = preference = extract_integer(&s, "NID preference", NULL);
+ 	if (preference < 0)
+ 		return NULL;
+ 	if (extract_u64(&s, "NodeID", &rr->node_id) < 0)
+diff -Naur validns-0.8/nsec3.c validns-0.8_git20160720/nsec3.c
+--- validns-0.8/nsec3.c	2014-02-11 15:45:31.000000000 -0500
++++ validns-0.8_git20160720/nsec3.c	2016-02-04 09:14:15.000000000 -0500
+@@ -31,7 +31,7 @@
+ 	char *str_type = NULL;
+ 	int ltype;
+ 
+-	i = extract_integer(&s, "hash algorithm");
++	i = extract_integer(&s, "hash algorithm", NULL);
+ 	if (i < 0)
+ 		return NULL;
+ 	if (i > 255)
+@@ -40,7 +40,7 @@
+ 		return bitch("unrecognized or unsupported hash algorithm");
+ 	rr->hash_algorithm = i;
+ 
+-	i = extract_integer(&s, "flags");
++	i = extract_integer(&s, "flags", NULL);
+ 	if (i < 0)
+ 		return NULL;
+ 	if (i > 255)
+@@ -52,7 +52,7 @@
+ 		opt_out = 1;
+ 	rr->flags = i;
+ 
+-	i = extract_integer(&s, "iterations");
++	i = extract_integer(&s, "iterations", NULL);
+ 	if (i < 0)
+ 		return NULL;
+ 	if (i > 2500)
+diff -Naur validns-0.8/nsec3param.c validns-0.8_git20160720/nsec3param.c
+--- validns-0.8/nsec3param.c	2014-02-11 15:45:41.000000000 -0500
++++ validns-0.8_git20160720/nsec3param.c	2016-02-04 09:14:15.000000000 -0500
+@@ -27,7 +27,7 @@
+ 	struct rr *ret_rr;
+ 	int i;
+ 
+-	i = extract_integer(&s, "hash algorithm");
++	i = extract_integer(&s, "hash algorithm", NULL);
+ 	if (i < 0)
+ 		return NULL;
+ 	if (i > 255)
+@@ -36,7 +36,7 @@
+ 		return bitch("unrecognized or unsupported hash algorithm");
+ 	rr->hash_algorithm = i;
+ 
+-	i = extract_integer(&s, "flags");
++	i = extract_integer(&s, "flags", NULL);
+ 	if (i < 0)
+ 		return NULL;
+ 	if (i > 255)
+@@ -45,7 +45,7 @@
+ 		return bitch("flags is supposed to be 0 for NSEC3PARAM");
+ 	rr->flags = i;
+ 
+-	i = extract_integer(&s, "iterations");
++	i = extract_integer(&s, "iterations", NULL);
+ 	if (i < 0)
+ 		return NULL;
+ 	if (i > 2500)
+diff -Naur validns-0.8/px.c validns-0.8_git20160720/px.c
+--- validns-0.8/px.c	2014-02-11 15:46:50.000000000 -0500
++++ validns-0.8_git20160720/px.c	2016-02-04 09:14:15.000000000 -0500
+@@ -21,7 +21,7 @@
+ {
+ 	struct rr_px *rr = getmem(sizeof(*rr));
+ 
+-	rr->preference = extract_integer(&s, "PX preference");
++	rr->preference = extract_integer(&s, "PX preference", NULL);
+ 	if (rr->preference < 0)
+ 		return NULL;
+ 
+diff -Naur validns-0.8/rr.c validns-0.8_git20160720/rr.c
+--- validns-0.8/rr.c	2014-02-11 15:45:34.000000000 -0500
++++ validns-0.8_git20160720/rr.c	2016-02-04 09:14:15.000000000 -0500
+@@ -432,7 +432,7 @@
+ 	s = skip_white_space(s);
+ 	if (!s)	return NULL;
+ 
+-	len = extract_integer(&s, "custom data size");
++	len = extract_integer(&s, "custom data size", NULL);
+ 	if (len < 0) return NULL;
+ 	if (len > 65535) goto invalid;
+ 
+@@ -810,7 +810,7 @@
+ 	char *str_alg;
+ 
+ 	if (isdigit(**s)) {
+-		alg = extract_integer(s, what);
++		alg = extract_integer(s, what, NULL);
+ 		if (algorithm_type(alg) == ALG_UNSUPPORTED) {
+ 			bitch("bad or unsupported algorithm %d", alg);
+ 			return ALG_UNSUPPORTED;
+diff -Naur validns-0.8/rr.h validns-0.8_git20160720/rr.h
+--- validns-0.8/rr.h	2014-02-11 15:46:57.000000000 -0500
++++ validns-0.8_git20160720/rr.h	2016-02-04 09:14:15.000000000 -0500
+@@ -201,11 +201,15 @@
+ };
+ extern struct rr_methods dhcid_methods;
+ 
++struct rr_txt_segment {
++	struct binary_data txt;
++	struct rr_txt_segment *next;
++};
+ struct rr_txt
+ {
+     struct rr rr;
+     int count;
+-    struct binary_data txt[1];
++	struct rr_txt_segment *txt;
+ };
+ extern struct rr_methods txt_methods;
+ 
+@@ -458,10 +462,18 @@
+ 	uint16_t key_tag;
+ 	int pkey_built;
+ 	void *pkey;
++	/* extras */
++	int key_type;
++	struct rr_dnskey *next_key;
+ };
+ extern struct rr_methods dnskey_methods;
+ 
++#define KEY_TYPE_UNUSED 0
++#define KEY_TYPE_KSK    1
++#define KEY_TYPE_ZSK    2
++
+ int dnskey_build_pkey(struct rr_dnskey *rr);
++void dnskey_ksk_policy_check(void);
+ 
+ struct rr_ds
+ {
+diff -Naur validns-0.8/rrsig.c validns-0.8_git20160720/rrsig.c
+--- validns-0.8/rrsig.c	2014-02-11 15:45:39.000000000 -0500
++++ validns-0.8_git20160720/rrsig.c	2016-02-04 09:14:15.000000000 -0500
+@@ -64,7 +64,7 @@
+ 		return bitch("private algorithms are not supported in RRSIG");
+ 	}
+ 
+-	rr->labels = extract_integer(&s, "labels");
++	rr->labels = extract_integer(&s, "labels", NULL);
+ 	if (rr->labels < 0)	return NULL;
+ 	/* TODO validate labels, see http://tools.ietf.org/html/rfc4034#section-3.1.3 */
+ 
+@@ -79,7 +79,7 @@
+ 	if (ts < 0) return NULL;
+ 	rr->sig_inception = ts;
+ 
+-	key_tag = extract_integer(&s, "key tag");
++	key_tag = extract_integer(&s, "key tag", NULL);
+ 	if (key_tag < 0)	return NULL;
+ 	rr->key_tag = key_tag;
+ 
+@@ -434,6 +434,12 @@
+ 		unsigned long e = 0;
+ 		for (i = 0; i < k->n_keys; i++) {
+ 			if (k->to_verify[i].ok) {
++				if (k->to_verify[i].rr->rr.rr_set->named_rr->flags & NAME_FLAG_APEX) {
++					if (k->to_verify[i].key->key_type == KEY_TYPE_UNUSED)
++						k->to_verify[i].key->key_type = KEY_TYPE_KSK;
++				} else {
++					k->to_verify[i].key->key_type = KEY_TYPE_ZSK;
++				}
+ 				ok = 1;
+ 				break;
+ 			} else {
+diff -Naur validns-0.8/rt.c validns-0.8_git20160720/rt.c
+--- validns-0.8/rt.c	2014-02-11 15:46:53.000000000 -0500
++++ validns-0.8_git20160720/rt.c	2016-02-04 09:14:15.000000000 -0500
+@@ -21,7 +21,7 @@
+ {
+ 	struct rr_rt *rr = getmem(sizeof(*rr));
+ 
+-	rr->preference = extract_integer(&s, "RT preference");
++	rr->preference = extract_integer(&s, "RT preference", NULL);
+ 	if (rr->preference < 0)
+ 		return NULL;
+ 
+diff -Naur validns-0.8/soa.c validns-0.8_git20160720/soa.c
+--- validns-0.8/soa.c	2014-02-11 15:45:26.000000000 -0500
++++ validns-0.8_git20160720/soa.c	2016-02-04 09:14:15.000000000 -0500
+@@ -27,7 +27,7 @@
+ 	if (!rr->mname) return NULL;
+ 	rr->rname = extract_name(&s, "rname", 0);
+ 	if (!rr->rname) return NULL;
+-	i = extract_integer(&s, "serial");
++	i = extract_integer(&s, "serial", NULL);
+ 	if (i < 0) return NULL;
+ 	if (i > 4294967295UL) return bitch("serial is out of range");
+ 	rr->serial = i;
+@@ -39,6 +39,9 @@
+ 	if (rr->expire < 0) return NULL;
+ 	rr->minimum = extract_timevalue(&s, "minimum");
+ 	if (rr->minimum < 0) return NULL;
++	if (ttl < 0 && G.opt.soa_minttl_as_default_ttl) {
++		ttl = rr->minimum;
++	}
+ 	if (*s) {
+ 		return bitch("garbage after valid SOA data");
+ 	}
+diff -Naur validns-0.8/srv.c validns-0.8_git20160720/srv.c
+--- validns-0.8/srv.c	2014-02-11 15:45:48.000000000 -0500
++++ validns-0.8_git20160720/srv.c	2016-02-04 09:14:15.000000000 -0500
+@@ -24,21 +24,21 @@
+ 
+ 	/* TODO validate `name` (underscores etc) http://tools.ietf.org/html/rfc2782 */
+ 
+-	i = extract_integer(&s, "priority");
++	i = extract_integer(&s, "priority", NULL);
+ 	if (i < 0)
+ 		return NULL;
+ 	if (i >= 65536)
+ 		return bitch("priority range is not valid");
+ 	rr->priority = i;
+ 
+-	i = extract_integer(&s, "weight");
++	i = extract_integer(&s, "weight", NULL);
+ 	if (i < 0)
+ 		return NULL;
+ 	if (i >= 65536)
+ 		return bitch("weight range is not valid");
+ 	rr->weight = i;
+ 
+-	i = extract_integer(&s, "port");
++	i = extract_integer(&s, "port", NULL);
+ 	if (i < 0)
+ 		return NULL;
+ 	if (i >= 65536)
+diff -Naur validns-0.8/sshfp.c validns-0.8_git20160720/sshfp.c
+--- validns-0.8/sshfp.c	2014-02-11 15:45:51.000000000 -0500
++++ validns-0.8_git20160720/sshfp.c	2016-02-04 09:14:15.000000000 -0500
+@@ -22,13 +22,13 @@
+ 	struct rr_sshfp *rr = getmem(sizeof(*rr));
+ 	int algorithm, fp_type;
+ 
+-	algorithm = extract_integer(&s, "algorithm");
++	algorithm = extract_integer(&s, "algorithm", NULL);
+ 	if (algorithm < 0)	return NULL;
+-	if (algorithm != 1 && algorithm != 2 && algorithm != 3)
++	if (algorithm != 1 && algorithm != 2 && algorithm != 3 && algorithm != 4)
+ 		return bitch("unsupported algorithm");
+ 	rr->algorithm = algorithm;
+ 
+-	fp_type = extract_integer(&s, "fp type");
++	fp_type = extract_integer(&s, "fp type", NULL);
+ 	if (fp_type < 0)	return NULL;
+ 	if (fp_type != 1 && fp_type != 2)
+ 		return bitch("unsupported fp_type");
+diff -Naur validns-0.8/t/issues/36-include/empty-include.zone validns-0.8_git20160720/t/issues/36-include/empty-include.zone
+--- validns-0.8/t/issues/36-include/empty-include.zone	1969-12-31 19:00:00.000000000 -0500
++++ validns-0.8_git20160720/t/issues/36-include/empty-include.zone	2016-02-04 09:14:15.000000000 -0500
+@@ -0,0 +1,4 @@
++$ORIGIN example.com.
++@       IN  200    SOA     ns hostmaster 1 10800 3600 2592000 1200
++        IN      NS      ns
++$INCLUDE ; there is no include, and it is wrong
+diff -Naur validns-0.8/t/issues/36-include/inc2.inc validns-0.8_git20160720/t/issues/36-include/inc2.inc
+--- validns-0.8/t/issues/36-include/inc2.inc	1969-12-31 19:00:00.000000000 -0500
++++ validns-0.8_git20160720/t/issues/36-include/inc2.inc	2016-02-04 09:14:15.000000000 -0500
+@@ -0,0 +1,2 @@
++$ORIGIN inc2 ; i.e., inc2.inc1.example.com.
++@ A 55.55.55.55
+diff -Naur validns-0.8/t/issues/36-include/include.zone validns-0.8_git20160720/t/issues/36-include/include.zone
+--- validns-0.8/t/issues/36-include/include.zone	1969-12-31 19:00:00.000000000 -0500
++++ validns-0.8_git20160720/t/issues/36-include/include.zone	2016-02-04 09:14:15.000000000 -0500
+@@ -0,0 +1,6 @@
++$ORIGIN example.com.
++@       IN  200    SOA     ns hostmaster 1 10800 3600 2592000 1200
++        IN      NS      ns
++$INCLUDE reldir/inc1.inc ; relative to the zone file
++; here we should be back to our origin
++@ IN A 99.99.99.99
+diff -Naur validns-0.8/t/issues/36-include/missing-include.zone validns-0.8_git20160720/t/issues/36-include/missing-include.zone
+--- validns-0.8/t/issues/36-include/missing-include.zone	1969-12-31 19:00:00.000000000 -0500
++++ validns-0.8_git20160720/t/issues/36-include/missing-include.zone	2016-02-04 09:14:15.000000000 -0500
+@@ -0,0 +1,4 @@
++$ORIGIN example.com.
++@       IN  200    SOA     ns hostmaster 1 10800 3600 2592000 1200
++        IN      NS      ns
++$INCLUDE nosuch.inc
+diff -Naur validns-0.8/t/issues/36-include/reldir/inc1.inc validns-0.8_git20160720/t/issues/36-include/reldir/inc1.inc
+--- validns-0.8/t/issues/36-include/reldir/inc1.inc	1969-12-31 19:00:00.000000000 -0500
++++ validns-0.8_git20160720/t/issues/36-include/reldir/inc1.inc	2016-02-04 09:14:15.000000000 -0500
+@@ -0,0 +1,5 @@
++$ORIGIN inc1 ; i.e., inc1.example.com.
++@ A 11.11.11.11
++$INCLUDE inc2.inc ; still relative to the zone file, not to this dir
++; should be back to this origin
++@ AAAA 1111::1111
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/dsset-example.sec. validns-0.8_git20160720/t/issues/41-ksk-policy-check/dsset-example.sec.
+--- validns-0.8/t/issues/41-ksk-policy-check/dsset-example.sec.	1969-12-31 19:00:00.000000000 -0500
++++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/dsset-example.sec.	2016-02-04 09:14:15.000000000 -0500
+@@ -0,0 +1,2 @@
++example.sec.		IN DS 7686 7 1 51B9CD8F901235705C6D353ADA23736AE954B4DE
++example.sec.		IN DS 7686 7 2 9EC80B8BAD67C66954B8FE726E06CA7840282C7F444BE51A916ED11C 36908A3F
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/example.sec validns-0.8_git20160720/t/issues/41-ksk-policy-check/example.sec
+--- validns-0.8/t/issues/41-ksk-policy-check/example.sec	1969-12-31 19:00:00.000000000 -0500
++++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/example.sec	2016-02-04 09:14:15.000000000 -0500
+@@ -0,0 +1,12 @@
++$TTL    1d
++@       IN      SOA     ns.example.sec. hostmaster.example.sec. (
++                              1         ; Serial
++                         604800         ; Refresh
++                          86400         ; Retry
++                        2419200         ; Expire
++                         604800 )       ; Negative Cache TTL
++                IN      NS      ns1.example.net.
++subA            IN      NS      ns1.example.net.
++subb            IN      NS      ns1.example.net.
++subC            IN      NS      ns1.example.net.
++myMX	IN	MX 5 mx.example.net.
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/example.sec.signed validns-0.8_git20160720/t/issues/41-ksk-policy-check/example.sec.signed
+--- validns-0.8/t/issues/41-ksk-policy-check/example.sec.signed	1969-12-31 19:00:00.000000000 -0500
++++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/example.sec.signed	2016-02-04 09:14:15.000000000 -0500
+@@ -0,0 +1,131 @@
++; File written on Tue Jun 30 15:31:27 2015
++; dnssec_signzone version 9.9.7
++example.sec.		86400	IN SOA	ns.example.sec. hostmaster.example.sec. (
++					1          ; serial
++					604800     ; refresh (1 week)
++					86400      ; retry (1 day)
++					2419200    ; expire (4 weeks)
++					604800     ; minimum (1 week)
++					)
++			86400	RRSIG	SOA 7 2 86400 (
++					20150730123127 20150630123127 64232 example.sec.
++					b1Qs5d/0a4IDAvFPVvDKqWpir4189XoPOD4E
++					804eiNXRLP2ShkEUBPil44+6Ikwup5Im24XU
++					PLnmStjUFHVniicvwbwT/IY4etXR4xNoBHUc
++					BU8LiADPpZGfJ1tC/s/IHLcPbX21OltyYzi0
++					++z9gxZGy4vCG5gYCH0vm+Q96fY= )
++			86400	NS	ns1.example.net.
++			86400	RRSIG	NS 7 2 86400 (
++					20150730123127 20150630123127 64232 example.sec.
++					gyqsk3xSnKefnjTOVzJS4sdDFiJ5cPEupSkP
++					+LGXGRDGrclY6V9mkfddQz3MkeCCjujvQNAi
++					NpZllyzFj221se5bHLAVydkT0jhl2jgp8bsL
++					DBk15FGa7SXcwtpXn5rkDvR1/wmS7M/aYnrY
++					3j5dTSSsOlZQLENWBEtct9QSNbU= )
++			86400	DNSKEY	256 3 7 (
++					AwEAAaMBYu1QXBi6AII33FKwWpHhOkGMhcVc
++					IWJ73npEFjvDe0jJfLjkghnij4tMfDI8MPIZ
++					6xwVLYsEshxsDNEJJGdZ1dUvfJDxSCv8Wp0a
++					2IffxQ5NDRHSpUw27yJoQfI5gUqvor+wGTNC
++					UWx2OU0Y1BOy1whHtVbDl1gt1R6/8mOZ
++					) ; ZSK; alg = NSEC3RSASHA1; key id = 64232
++			86400	DNSKEY	257 3 7 (
++					AwEAAciLWglw17dt8EDAN88BrQYCIaGPifC4
++					pxrizfz3S1cC4XbSyRW5loj5SSHVveUmmIV9
++					0MTEOhGCDUVq/qiYG7NgTNHn3YiqyRU3sirw
++					4SACFiwln/ejxFDpQkeAbZMCzU8FQhTIB1K9
++					y7QRiLacI6naULzgP3h4PsdQSQmw3/TWy973
++					M+lHzwkgVq6ML42L18rGG0sn1KQDNSs/6sd9
++					dcRjPo7uJ2OuUsnbu/5N3vWYLciSBUnY27FU
++					vbFLkVIq072wjUMIb0Xc2EgYGRFKyV2MMckL
++					voD7vPclBE0Krv9fO/B2/KXsbObTgz4m5iQN
++					F45QLU02kmvwB4iyIzIk9O0=
++					) ; KSK; alg = NSEC3RSASHA1; key id = 7686
++			86400	RRSIG	DNSKEY 7 2 86400 (
++					20150730123127 20150630123127 7686 example.sec.
++					YQ42WBCr7e4MR51W+d6Awkxdff7tTNiA1qfJ
++					wsst0UiNXKAv504YRcS6B34u4CfG59lWWtcd
++					+xBHU7Zuox5nehsLEkFAneD1YrJLkgVw03nZ
++					NzDNWFvlxfQ2/tJ7vGbjKG2cEwUnbJKl+Kcl
++					JTAc5JzZegfM75M0Z4Yi9NiDjicpHbaICtKJ
++					5WZ6T5nVFo1nl2xCq2CiXiR1+jGKARUW+btO
++					NzHMApLQszDo7CMgvYJoHy0CHAV1Uc7Ka4zO
++					P3dVYkwu1Puk+gixhNUqo+UhKgLB2JUYdci7
++					cQ1JR9RzqEXzyZgGpLmXCOEOc8KD2c2dDN5L
++					uvOV40OrWhST/bAQ+Q== )
++			86400	RRSIG	DNSKEY 7 2 86400 (
++					20150730123127 20150630123127 64232 example.sec.
++					lKX35bocQ1iR4VTW0Es+2bZ2qX1ON7OGU1fO
++					Pb0ZqueG2GYgI63VE4Jv3WeOmGg/Tkjvsdb6
++					bMHVuVpxHvQKRqqzfaQmY7nzoDe53LfSJewj
++					p2TvdhvpPRroEZGXXPmVl46R/p+jlYMJd47T
++					o0oqB/BvQPUS61a5NThagGq6vJM= )
++			0	NSEC3PARAM 1 0 10 -
++			0	RRSIG	NSEC3PARAM 7 2 0 (
++					20150730123127 20150630123127 64232 example.sec.
++					hNJlc3JuGYBpnYEZQrhqNwrIL2fBegnnR4ii
++					TOW+0Km2maqF5ZZMxBZ7x54gW4T0amXXz89+
++					uE+l02eknf/FgM81FFOrQvJul0toOzKW9g67
++					e2VwQAwcw7g6H06cSsypXM/h9wvsNQpoSdx0
++					rq6qU2ruYM9NmJf+xUzUk38AFUw= )
++subA.example.sec.	86400	IN NS	ns1.example.net.
++subb.example.sec.	86400	IN NS	ns1.example.net.
++subC.example.sec.	86400	IN NS	ns1.example.net.
++93GL7KF6D2G7J2PSLEO2CIA70A3MM4KQ.example.sec. 604800 IN	NSEC3 1 0 10 - (
++					CSLD6RFNKVSKA73DGNI0EOM95Q8DKGBQ
++					NS )
++			604800	RRSIG	NSEC3 7 3 604800 (
++					20150730123127 20150630123127 64232 example.sec.
++					JRhyC3PbmnvYBkXzV5GmIBnj5LJTnrVeC1t3
++					v6t6o+3udfPZRecHw2cApf/Oed8H9jCeox77
++					vA13/fLXui635CYAcqXYxVgO4g0au1d1S6lo
++					N2Pw96JXDNhIqyVBVj1Ii2ZOQLWXZ8YgZRQ6
++					lxgww8m0QGC8FjEnzR8z2liSG88= )
++3ED4GMVJJ0FT4TCFDKNFQ5EPEFSDBPNM.example.sec. 604800 IN	NSEC3 1 0 10 - (
++					93GL7KF6D2G7J2PSLEO2CIA70A3MM4KQ
++					NS )
++			604800	RRSIG	NSEC3 7 3 604800 (
++					20150730123127 20150630123127 64232 example.sec.
++					B9L5NrHjO/J6FDmv7DjT1xq/f8jiB2WTEXSl
++					bFeUVcTivoyvdyfNNTH+YlzJesqTtQ9GaEPQ
++					ouzw7XbdyvtJ//GD+vrO/7XwfrVmkckQgEVl
++					zPm70TksAkwLzj0uY6WBIGIPq/KJMM14f6El
++					ct5w2KtgvF9sazFP+KMchU5Be3Q= )
++myMX.example.sec.	86400	IN MX	5 mx.example.net.
++			86400	RRSIG	MX 7 3 86400 (
++					20150730123127 20150630123127 64232 example.sec.
++					lh8vFwFg77gLtLyXbzqzYSlebkzn3yAlXHU2
++					/hgiyUWYcuZa5E33Ul+ZrUJPCGLaUQs3X+yL
++					p/uk6LP2dnMaf/X1mow/tyYNtIdn0MhTYNqs
++					WmYV1Ga/NSoErtoHYoNgeqV1w0Q/nfhipMdX
++					RekpxVR6RUUt2d3LS8UIH+pEYd8= )
++CSLD6RFNKVSKA73DGNI0EOM95Q8DKGBQ.example.sec. 604800 IN	NSEC3 1 0 10 - (
++					JC1M8I9IPBEENK9RDGMN9LQKAMMSQEVV
++					MX RRSIG )
++			604800	RRSIG	NSEC3 7 3 604800 (
++					20150730123127 20150630123127 64232 example.sec.
++					menCNV7RkbVWmfhuPfoYHfHCEtvQmVb3+p/x
++					WYVymu5hXUPQ2+K4Ns0jQ+om4GuTmXmm1DYY
++					IjIXv4jthJoD6jydqN6Hr+tr0ewxr6mHXj3I
++					RizTBuw4zcgPUrIRVQStkMtwyjN4Nlznhg7I
++					txZ14uH1G4U1DgkR2oC6YZsSqi8= )
++JC1M8I9IPBEENK9RDGMN9LQKAMMSQEVV.example.sec. 604800 IN	NSEC3 1 0 10 - (
++					NLF2NKFTCGVVRC4C941FOOCD00TPI9DV
++					NS SOA RRSIG DNSKEY NSEC3PARAM )
++			604800	RRSIG	NSEC3 7 3 604800 (
++					20150730123127 20150630123127 64232 example.sec.
++					ggLIoKQYmI9GeBkSccVdE87G1QQwGGO0HlrN
++					dg9Ah5QiWWjZ5icSOU4vyEm0XiqkFCrGEAq0
++					9L4HMOFuELMa28dAhVxOvZldbXizXUSCbWCS
++					miYFLOIKcQ9IcmzeEgg+uJzHdAyYSSK2Jb+0
++					YYuoXOhiZwzluj+u2i6kbf6wDY4= )
++NLF2NKFTCGVVRC4C941FOOCD00TPI9DV.example.sec. 604800 IN	NSEC3 1 0 10 - (
++					3ED4GMVJJ0FT4TCFDKNFQ5EPEFSDBPNM
++					NS )
++			604800	RRSIG	NSEC3 7 3 604800 (
++					20150730123127 20150630123127 64232 example.sec.
++					buRQJjfJDIbRFZFr8s7odGSxqnrSHXXN/AAu
++					tbG1k2L7WD+DGYFiRnR5Uia/C2oL186PqBtT
++					R8oDKf/4zr5qOsZz9xYabaBqG98JVXwPTiFk
++					JBoc7sFcwGJ16hj9Zey05aNs1h5RZm6BL8W0
++					9bRF3qIezckG0VA+U7ASTLNH4ME= )
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key
+--- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key	1969-12-31 19:00:00.000000000 -0500
++++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key	2016-02-04 09:14:15.000000000 -0500
+@@ -0,0 +1,5 @@
++; This is a key-signing key, keyid 7686, for example.sec.
++; Created: 20150630133112 (Tue Jun 30 15:31:12 2015)
++; Publish: 20150630133112 (Tue Jun 30 15:31:12 2015)
++; Activate: 20150630133112 (Tue Jun 30 15:31:12 2015)
++example.sec. IN DNSKEY 257 3 7 AwEAAciLWglw17dt8EDAN88BrQYCIaGPifC4pxrizfz3S1cC4XbSyRW5 loj5SSHVveUmmIV90MTEOhGCDUVq/qiYG7NgTNHn3YiqyRU3sirw4SAC Fiwln/ejxFDpQkeAbZMCzU8FQhTIB1K9y7QRiLacI6naULzgP3h4PsdQ SQmw3/TWy973M+lHzwkgVq6ML42L18rGG0sn1KQDNSs/6sd9dcRjPo7u J2OuUsnbu/5N3vWYLciSBUnY27FUvbFLkVIq072wjUMIb0Xc2EgYGRFK yV2MMckLvoD7vPclBE0Krv9fO/B2/KXsbObTgz4m5iQNF45QLU02kmvw B4iyIzIk9O0=
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private
+--- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private	1969-12-31 19:00:00.000000000 -0500
++++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private	2016-02-04 09:14:15.000000000 -0500
+@@ -0,0 +1,13 @@
++Private-key-format: v1.3
++Algorithm: 7 (NSEC3RSASHA1)
++Modulus: yItaCXDXt23wQMA3zwGtBgIhoY+J8LinGuLN/PdLVwLhdtLJFbmWiPlJIdW95SaYhX3QxMQ6EYINRWr+qJgbs2BM0efdiKrJFTeyKvDhIAIWLCWf96PEUOlCR4BtkwLNTwVCFMgHUr3LtBGItpwjqdpQvOA/eHg+x1BJCbDf9NbL3vcz6UfPCSBWrowvjYvXysYbSyfUpAM1Kz/qx311xGM+ju4nY65Sydu7/k3e9ZgtyJIFSdjbsVS9sUuRUirTvbCNQwhvRdzYSBgZEUrJXYwxyQu+gPu89yUETQqu/1878Hb8pexs5tODPibmJA0XjlAtTTaSa/AHiLIjMiT07Q==
++PublicExponent: AQAB
++PrivateExponent: d5kDfRXaz/20hikcH0v0j9y9icg8j17P6WzRQ8eHGsERDPfwDBC+AboJLzB1Ky+1TgcWdgJATyisGXYRoSH1gygvKA+LQnH3sbuheZJl79zOtE1L9TepYEd7y4B/2GiXYETWf+Y619Fwpla+nYjIjAcylzF1KLctWVg79peROEXC0zb+IxWQFIBpe7OzTZ1qxG8ymm6uiu9KXH6qQi3BLSarxj5rY+tO8oj0qQNOGkbSVsXFax0arZ0qMRFT5UooOm+2Yl8Q9Z/PC52qwNqkSDZ2QeoYTJx5tDFhuVJxXhioxGIueA4QuCRA4cRL2U5ZnCYcQa10JFE2O4N990eLUQ==
++Prime1: 5LW1fl8ky4bBaIPg48Cq8bXQIvaK5syFTvzzMopuTeD6PGwOByuzc4u9KLVrDRebjeYfNVkqXIJAHMjolOr4jURWp2Q3FUrewqdgyY2ULSLMmQo0+dHkvjJIs2A/6vNme+MtFms6msJjyzj3EhLf32djvCH+jWStP3Vb/jopYWs=
++Prime2: 4HlJJB25JSLygHd0GWi8yu0z3FaYhWXnIs8bwpT8er1lH+tsBeYI8ughuX9h19STMRnBhAh0ZlQaKHOrPTsdVOFQJWr6aUbWIAhv5m+ij1IFsQ58DKnsYP0DXiNkR7K4pXO8yzPTo9UfaMCJAKYipENTgpfb43sVBQnDIGr9oQc=
++Exponent1: aJpK9g9h7swlLT4T31bBWGeFWFhWUxT7a5L5UAZMSMY67OOmztTH8HLbAwFmgshnVtEHOQkc/M59sCybY3DMWSAGWezV3KEvnOucstJUEQi3ds9aR2AeNHcfFRtSYI0ONF9EwdotJZb+uXXGWrfTOIQ681LA7746FqoAdxf20R0=
++Exponent2: QlFS3Iqzglc60d14vXEGJeXCZpxm3zJmARCzIN+nYBPIZo/FEFEP38PZAtaxb3RsMBtt4rYkvX6nY8AYnTRzy/ntFcDvTl8RL9GOTcQ5gKI48EBZQdyJ63WUoyFNpSkWCDuTUW10X3i9mNMZJsnufh0t9O0sl55rbVue/Frfp80=
++Coefficient: aLnGdfeRJ3nSjmbby8IDkJ+W+gFGOHd3XAMDSNP9D8kn6B3JyAfY6FDSg0+Bh+F80PFNGsESkYimXlWr3B6NlC0Gq99hPSV8yU2pYHq3TPVB0tWOAkNVIXM9icEH9wshCQH7wD7cPDWvhhgcgo64nYOGYeK6sjTL7XDtRanvbP8=
++Created: 20150630133112
++Publish: 20150630133112
++Activate: 20150630133112
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key
+--- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key	1969-12-31 19:00:00.000000000 -0500
++++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key	2016-02-04 09:14:15.000000000 -0500
+@@ -0,0 +1,5 @@
++; This is a zone-signing key, keyid 64232, for example.sec.
++; Created: 20150630133105 (Tue Jun 30 15:31:05 2015)
++; Publish: 20150630133105 (Tue Jun 30 15:31:05 2015)
++; Activate: 20150630133105 (Tue Jun 30 15:31:05 2015)
++example.sec. IN DNSKEY 256 3 7 AwEAAaMBYu1QXBi6AII33FKwWpHhOkGMhcVcIWJ73npEFjvDe0jJfLjk ghnij4tMfDI8MPIZ6xwVLYsEshxsDNEJJGdZ1dUvfJDxSCv8Wp0a2Iff xQ5NDRHSpUw27yJoQfI5gUqvor+wGTNCUWx2OU0Y1BOy1whHtVbDl1gt 1R6/8mOZ
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private
+--- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private	1969-12-31 19:00:00.000000000 -0500
++++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private	2016-02-04 09:14:15.000000000 -0500
+@@ -0,0 +1,13 @@
++Private-key-format: v1.3
++Algorithm: 7 (NSEC3RSASHA1)
++Modulus: owFi7VBcGLoAgjfcUrBakeE6QYyFxVwhYnveekQWO8N7SMl8uOSCGeKPi0x8Mjww8hnrHBUtiwSyHGwM0QkkZ1nV1S98kPFIK/xanRrYh9/FDk0NEdKlTDbvImhB8jmBSq+iv7AZM0JRbHY5TRjUE7LXCEe1VsOXWC3VHr/yY5k=
++PublicExponent: AQAB
++PrivateExponent: ATf/b1rMdXreihq00QF0i+atMtREI8eekEfwz+U2bVf20gJ/pjo/JsZk4FvACfgdPZIoCdu2rXVph4DfT6jL1t7sDY/9mfcMd2Zge6eB8Kat3QpdDu4qClgkXFTYFLj2lQ5Bm/b+YbQ8fiPlZovp7YGFodmsjfnNvbT7UiOiSKE=
++Prime1: 1wNWdr5FIrew1NTzpbeClZr5NIIoRBpEPsSDCBZpbRDZ944LcjWgrJpVlG1klkp/cR/zcSzrq+637rva30jglQ==
++Prime2: whQSB4wqB87wyYrewJLU5qFY5Up/YiZ0iyD4m4OIQMk/K7eXtuqFuSOP4xTR4WAWHIyRixa1F85/eh7y6+9h9Q==
++Exponent1: XjHZJEYw9Yex0VvFrdjaPX5aJJXM3CEButnOabGf2Cckxl4VR6CU1mj6iv7trSXP9RhBR1idmoIHVHA57832jQ==
++Exponent2: dtzn9etoSoP5gNYmevbyoZWr5jJsNeardhJpcIVsS5F1uQamSob0A2G+XCuCJ3A72pxU/0SXAM+dz2NpEAr6iQ==
++Coefficient: egVfeiBCmggrVDolCSvAIg+XEb+YmLcD1SLT5qFLuqCtPKWGDx9lGMbqbx5s2gzeeoAPL1r34pohHNLMCqCNdw==
++Created: 20150630133105
++Publish: 20150630133105
++Activate: 20150630133105
+diff -Naur validns-0.8/t/test.pl validns-0.8_git20160720/t/test.pl
+--- validns-0.8/t/test.pl	2014-02-11 15:08:39.000000000 -0500
++++ validns-0.8_git20160720/t/test.pl	2016-02-04 09:14:15.000000000 -0500
+@@ -215,6 +215,35 @@
+ like(shift @e, qr/leading zero octets in public key exponent/, "leading zeroes in exponent 2");
+ is(+@e, 0, "no unaccounted errors for DNSKEY policy checks");
+ 
++# issue 36: https://github.com/tobez/validns/issues/36 - $include implementation
++run('./validns', @threads, 't/issues/36-include/empty-include.zone');
++isnt(rc, 0, 'empty include detected');
++@e = split /\n/, stderr;
++like(shift @e, qr/\bINCLUDE directive with empty file name\b/, "Expected error with empty INCLUDE");
++is(+@e, 0, "no unaccounted errors for empty include");
++
++run('./validns', @threads, 't/issues/36-include/missing-include.zone');
++isnt(rc, 0, 'missing include detected');
++@e = split /\n/, stderr;
++like(shift @e, qr/\bNo such file or directory\b/, "Expected error with missing INCLUDE file");
++is(+@e, 0, "no unaccounted errors for missing include");
++
++run('./validns', @threads, '-v', 't/issues/36-include/include.zone');
++is(rc, 0, 'zone with nested includes parses ok');
++@e = split /\n/, stderr;
++for my $rx ((qr/\d:\s+example\.com\.\s+IN\s+\d+\s+NS\s+ns\.example\.com\./,
++			 qr/\d:\s+inc1\.example\.com\.\s+IN\s+\d+\s+A\s+11\.11\.11\.11/,
++			 qr/\d:\s+inc2\.inc1\.example\.com\.\s+IN\s+\d+\s+A\s+55\.55\.55\.55/,
++			 qr/\d:\s+inc1\.example\.com\.\s+IN\s+\d+\s+AAAA\s+1111::1111/,
++			 qr/\d:\s+example\.com\.\s+IN\s+\d+\s+A\s+99\.99\.99\.99/))
++{
++	my $ok = 0;
++	for my $e (@e) {
++		$ok = 1 if $e =~ $rx;
++	}
++	is($ok, 1, "found expected record with correct ORIGIN tracked across INCLUDEs");
++}
++
+ # issue 21: https://github.com/tobez/validns/issues/21
+ run('./validns', @threads, '-t1345815800', 't/issues/21-nsec3-without-corresponding/example.sec.signed');
+ is(rc, 0, 'issue 21 did not come back');
+@@ -227,6 +256,19 @@
+ run('./validns', @threads, '-t1345815800', 't/issues/25-nsec/example.sec.signed');
+ is(rc, 0, 'issue 25 did not come back');
+ 
++# issue 41: https://github.com/tobez/validns/issues/41
++run('./validns', @threads, '-t1345815800', '-pksk-exists', 't/issues/25-nsec/example.sec.signed');
++isnt(rc, 0, 'KSK policy check fails');
++@e = split /\n/, stderr;
++like(shift @e, qr/\bNo KSK found\b/, "KSK policy check produces expected error output");
++is(+@e, 0, "no unaccounted errors for KSK policy check");
++
++run('./validns', @threads, '-t1435671103', '-pksk-exists', 't/issues/41-ksk-policy-check/example.sec.signed');
++is(rc, 0, 'signed zone with KSK parses ok when KSK policy check is active');
++
++run('./validns', @threads, '-pksk-exists', 't/zones/galaxyplus.org');
++is(rc, 0, 'unsigned zone ignores KSK policy checks');
++
+ # issue 26: https://github.com/tobez/validns/issues/26
+ run('./validns', @threads, '-t1349357570', 't/issues/26-spurios-glue/example.sec.signed.no-optout');
+ is(rc, 0, 'issue 26 did not come back (NSEC3 NO optout)');
+diff -Naur validns-0.8/t/zones/galaxyplus.org validns-0.8_git20160720/t/zones/galaxyplus.org
+--- validns-0.8/t/zones/galaxyplus.org	2011-05-16 15:42:03.000000000 -0400
++++ validns-0.8_git20160720/t/zones/galaxyplus.org	2016-02-04 09:14:15.000000000 -0500
+@@ -18,4 +18,5 @@
+ cvs     A 194.28.255.11
+ v6		AAAA 2001:2010:1::feef
+ text	TXT	"text1" "Another text" "One more"
++bigtext	TXT	"1" "2" "3" "4" "5" "6" "7" "8" "9" "10" "11" "12" "13" "14" "15" "16" "17" "18" "19" "20" "21" "22" "what is the meaning of this"
+ *.meow	CNAME www
+diff -Naur validns-0.8/textparse.c validns-0.8_git20160720/textparse.c
+--- validns-0.8/textparse.c	2014-02-11 15:44:53.000000000 -0500
++++ validns-0.8_git20160720/textparse.c	2016-02-04 09:14:15.000000000 -0500
+@@ -40,8 +40,7 @@
+ 	}
+ 	if (*s == 0) {
+ 		if (file_info->paren_mode) {
+-			if (fgets(file_info->buf, 2048, file_info->file)) {
+-				file_info->line++;
++			if (read_zone_line()) {
+ 				return skip_white_space(file_info->buf);
+ 			} else {
+ 				return bitch("unexpected end of file");
+@@ -77,7 +76,7 @@
+ 	int d, l, ol;
+ 
+ 	while (1) {
+-		if (isalnum(*s) || *s == '_' || *s == '.' || *s == '-' || *s == '/') {
++		if (isalnum(*s) || *s == '_' || *s == '.' || *s == '-' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$')) {
+ 			if (t-buf >= 1022)
+ 				return bitch("name too long");
+ 			*t++ = *s++;
+@@ -125,19 +124,19 @@
+ 		return bitch("%s should not be empty", what);
+ 
+ 	if (buf[l-1] != '.') {
+-		if (!G.opt.current_origin) {
++		if (!file_info->current_origin) {
+ 			return bitch("do not know origin to determine %s", what);
+ 		}
+-		ol = strlen(G.opt.current_origin);
+-		if (G.opt.current_origin[0] == '.') {
++		ol = strlen(file_info->current_origin);
++		if (file_info->current_origin[0] == '.') {
+ 			if (l + ol >= 1023)
+ 				return bitch("name too long");
+-			strcat(buf, G.opt.current_origin);
++			strcat(buf, file_info->current_origin);
+ 		} else {
+ 			if (l + ol >= 1022)
+ 				return bitch("name too long");
+ 			strcat(buf, ".");
+-			strcat(buf, G.opt.current_origin);
++			strcat(buf, file_info->current_origin);
+ 		}
+ 	}
+ 
+@@ -177,12 +176,12 @@
+ 		if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+ 			return bitch("literal @ in %s is not all by itself", what);
+ 		}
+-		if (!G.opt.current_origin) {
++		if (!file_info->current_origin) {
+ 			return bitch("do not know origin to expand @ in %s", what);
+ 		}
+-		r = quickstrdup(G.opt.current_origin);
++		r = quickstrdup(file_info->current_origin);
+ 	} else {
+-		if (!(isalnum(*s) || *s == '_' || *s == '.' || *s == '/')) {
++		if (!(isalnum(*s) || *s == '_' || *s == '.' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$'))) {
+ 			if (*s == '*') {
+ 				wildcard = 1;
+ 			} else {
+@@ -192,7 +191,7 @@
+ 			}
+ 		}
+ 		s++;
+-		while (isalnum(*s) || *s == '.' || *s == '-' || *s == '_' || *s == '/')
++		while (isalnum(*s) || *s == '.' || *s == '-' || *s == '_' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$'))
+ 			s++;
+ 		if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+ 			if (*s == '\\')
+@@ -205,14 +204,14 @@
+ 		if (*(s-1) == '.') {
+ 			r = quickstrdup(*input);
+ 		} else {
+-			if (!G.opt.current_origin) {
++			if (!file_info->current_origin) {
+ 				return bitch("do not know origin to determine %s", what);
+ 			}
+-			r = getmem(strlen(*input) + 1 + strlen(G.opt.current_origin) + 1);
+-			if (G.opt.current_origin[0] == '.') {
+-				strcpy(mystpcpy(r, *input), G.opt.current_origin);
++			r = getmem(strlen(*input) + 1 + strlen(file_info->current_origin) + 1);
++			if (file_info->current_origin[0] == '.') {
++				strcpy(mystpcpy(r, *input), file_info->current_origin);
+ 			} else {
+-				strcpy(mystpcpy(mystpcpy(r, *input), "."), G.opt.current_origin);
++				strcpy(mystpcpy(mystpcpy(r, *input), "."), file_info->current_origin);
+ 			}
+ 		}
+ 		*s = c;
+@@ -277,7 +276,7 @@
+ 	return r;
+ }
+ 
+-long long extract_integer(char **input, char *what)
++long long extract_integer(char **input, char *what, const char *extra_delimiters)
+ {
+ 	char *s = *input;
+ 	long long r = -1;
+@@ -292,8 +291,10 @@
+ 	while (isdigit(*s))
+ 		s++;
+ 	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-		bitch("%s is not valid", what);
+-		return -1;
++		if (!extra_delimiters || strchr(extra_delimiters, *s) == NULL) {
++			bitch("%s is not valid", what);
++			return -1;
++		}
+ 	}
+ 	if (!*s)	end = s;
+ 	c = *s;
+@@ -708,7 +709,17 @@
+ 	int c;
+ 
+ 	if (*s != '"') {
+-		bitch("for now, %s must be put in double quotes", what);
++		while (*s && !isspace(*s)) {
++			o[l++] = *s++;
++		}
++		*input = skip_white_space(s);
++		if (!*input)
++			return r;  /* bitching's done elsewhere */
++
++		o[l] = 0;
++		r.data = getmem(l+1);
++		r.length = l;
++		memcpy(r.data, o, l+1);
+ 		return r;
+ 	}
+ 	s++;
+@@ -742,8 +753,7 @@
+ 		}
+ 	}
+ 	if (!*s) {
+-		if (fgets(file_info->buf, 2048, file_info->file)) {
+-			file_info->line++;
++		if (read_zone_line()) {
+ 			s = file_info->buf;
+ 			goto more_text;
+ 		} else {
+@@ -998,3 +1008,32 @@
+ 	for (; (*to = *from); ++from, ++to);
+ 	return(to);
+ }
++
++size_t
++mystrlcat(char *dst, const char *src, size_t siz)
++{
++	char *d = dst;
++	const char *s = src;
++	size_t n = siz;
++	size_t dlen;
++
++	/* Find the end of dst and adjust bytes left but don't go past end */
++	while (n-- != 0 && *d != '\0')
++		d++;
++	dlen = d - dst;
++	n = siz - dlen;
++
++	if (n == 0)
++		return(dlen + strlen(s));
++	while (*s != '\0') {
++		if (n != 1) {
++			*d++ = *s;
++			n--;
++		}
++		s++;
++	}
++	*d = '\0';
++
++	return(dlen + (s - src));       /* count does not include NUL */
++}
++
+diff -Naur validns-0.8/textparse.h validns-0.8_git20160720/textparse.h
+--- validns-0.8/textparse.h	2014-02-11 15:45:46.000000000 -0500
++++ validns-0.8_git20160720/textparse.h	2016-02-04 09:14:15.000000000 -0500
+@@ -33,12 +33,13 @@
+  */
+ 
+ #define KEEP_CAPITALIZATION 32
++#define DOLLAR_OK_IN_NAMES  64
+ 
+ int empty_line_or_comment(char *s);
+ char *skip_white_space(char *s);
+ char *extract_name(char **input, char *what, int options);
+ char *extract_label(char **input, char *what, void *is_temporary);
+-long long extract_integer(char **input, char *what);
++long long extract_integer(char **input, char *what, const char *extra_delimiters);
+ long extract_timevalue(char **input, char *what);
+ long long extract_timestamp(char **input, char *what);
+ int extract_ipv4(char **input, char *what, struct in_addr *addr);
+@@ -59,7 +60,9 @@
+ void add_bit_to_set(struct binary_data *set, int bit);
+ struct binary_data compressed_set(struct binary_data *set);
+ 
+-/* stpcpy(3) is not available everywhere */
+-char *mystpcpy(char *to, const char *from);
++char *mystpcpy(char *to, const char *from); /* stpcpy(3) is not available everywhere */
++size_t mystrlcat(char *dst, const char *src, size_t siz); /* so is strlcat */
++
++char *read_zone_line(void);
+ 
+ #endif
+diff -Naur validns-0.8/tlsa.c validns-0.8_git20160720/tlsa.c
+--- validns-0.8/tlsa.c	2014-02-11 15:46:23.000000000 -0500
++++ validns-0.8_git20160720/tlsa.c	2016-02-04 09:14:15.000000000 -0500
+@@ -28,19 +28,19 @@
+ 	struct rr_tlsa *rr = getmem(sizeof(*rr));
+ 	int cert_usage, selector, matching_type;
+ 
+-	cert_usage = extract_integer(&s, "certificate usage field");
++	cert_usage = extract_integer(&s, "certificate usage field", NULL);
+ 	if (cert_usage < 0)	return NULL;
+ 	if (cert_usage > 3)
+ 		return bitch("bad certificate usage field");
+ 	rr->cert_usage = cert_usage;
+ 
+-	selector = extract_integer(&s, "selector field");
++	selector = extract_integer(&s, "selector field", NULL);
+ 	if (selector < 0)	return NULL;
+ 	if (selector > 1)
+ 		return bitch("bad selector field");
+ 	rr->selector = selector;
+ 
+-	matching_type = extract_integer(&s, "matching type field");
++	matching_type = extract_integer(&s, "matching type field", NULL);
+ 	if (matching_type < 0)	return NULL;
+ 	if (matching_type > 2)
+ 		return bitch("bad matching type field");
+diff -Naur validns-0.8/txt.c validns-0.8_git20160720/txt.c
+--- validns-0.8/txt.c	2014-02-11 15:45:53.000000000 -0500
++++ validns-0.8_git20160720/txt.c	2016-02-04 09:14:15.000000000 -0500
+@@ -23,28 +23,36 @@
+ static struct rr *txt_parse(char *name, long ttl, int type, char *s)
+ {
+ 	struct rr_txt *rr;
+-	struct binary_data txt[20];
++	struct binary_data txt;
++	struct rr_txt_segment *first = NULL;
++	struct rr_txt_segment *last  = NULL;
++	struct rr_txt_segment *cur   = NULL;
+ 	int i;
+ 
+ 	i = 0;
+ 	while (*s) {
+-		if (i >= 20)
+-			return bitch("program limit: too many text segments");
+-		txt[i] = extract_text(&s, "text segment");
+-		if (txt[i].length < 0)
++		freeall_temp();
++		txt = extract_text(&s, "text segment");
++		if (txt.length < 0)
+ 			return NULL;
+-		if (txt[i].length > 255)
++		if (txt.length > 255)
+ 			return bitch("TXT segment too long");
+ 		i++;
++		cur = getmem(sizeof(*cur));
++		cur->txt = txt;
++		cur->next = NULL;
++		if (!first)
++			first = cur;
++		if (last)
++			last->next = cur;
++		last = cur;
+ 	}
+ 	if (i == 0)
+ 		return bitch("empty text record");
+ 
+-   	rr = getmem(sizeof(*rr) + sizeof(struct binary_data) * (i-1));
++   	rr = getmem(sizeof(*rr));
+ 	rr->count = i;
+-	for (i = 0; i < rr->count; i++) {
+-		rr->txt[i] = txt[i];
+-	}
++	rr->txt = first;
+ 
+ 	return store_record(type, name, ttl, rr);
+ }
+@@ -53,14 +61,15 @@
+ {
+ 	RRCAST(txt);
+     char ss[1024];
+-	int i;
+ 	char *s = ss;
+ 	int l;
++	struct rr_txt_segment *seg = rr->txt;
+ 
+-	for (i = 0; i < rr->count; i++) {
++	while (seg) {
+ 		/* XXX would be nice to escape " with \ in strings */
+-		l = snprintf(s, 1024-(s-ss), "\"%s\" ", rr->txt[i].data);
++		l = snprintf(s, 1024-(s-ss), "\"%s\" ", seg->txt.data);
+ 		s += l;
++		seg = seg->next;
+ 	}
+     return quickstrdup_temp(ss);
+ }
+@@ -69,14 +78,15 @@
+ {
+ 	RRCAST(txt);
+ 	struct binary_data r, t;
+-	int i;
++	struct rr_txt_segment *seg = rr->txt;
+ 
+ 	r = bad_binary_data();
+ 	t.length = 0;
+ 	t.data = NULL;
+-	for (i = 0; i < rr->count; i++) {
+-		r = compose_binary_data("db", 1, t, rr->txt[i]);
++	while (seg) {
++		r = compose_binary_data("db", 1, t, seg->txt);
+ 		t = r;
++		seg = seg->next;
+ 	}
+     return r;
+ }
+diff -Naur validns-0.8/usage.mdwn validns-0.8_git20160720/usage.mdwn
+--- validns-0.8/usage.mdwn	2014-02-11 15:42:32.000000000 -0500
++++ validns-0.8_git20160720/usage.mdwn	2016-02-04 09:14:15.000000000 -0500
+@@ -48,6 +48,7 @@
+ 	- ns-alias
+ 	- rp-txt-exists
+ 	- tlsa-host
++	- ksk-exists
+ 	- all
+ 
+ -n *N*
+@@ -64,6 +65,9 @@
+ -v
+ :   be extra verbose
+ 
++-M
++:   use SOA MINTTL as the default TTL when no TTL specified
++
+ -I *path*
+ :   use this path for $INCLUDE files
+ 
+@@ -130,12 +134,11 @@
+ - TXT domain name mentioned in RP record must have
+   a corresponding TXT record if it is within the zone
+ - domain name of a TLSA record must be a proper prefixed DNS name
++- a KSK key must exist in a signed zone
+ 
+ # BUGS
+ 
+ - textual segments in *TXT* and *HINFO* must be enclosed in double quotes;
+-- there cannot be more than 20 textual segments in a *TXT* record;
+-- *$INCLUDE* directive is not implemented;
+ - a dot within a label is not currently supported;
+ 
+ If at least one NSEC3 record uses opt-out flag,
+diff -Naur validns-0.8/validns.1 validns-0.8_git20160720/validns.1
+--- validns-0.8/validns.1	2014-02-11 15:43:21.000000000 -0500
++++ validns-0.8_git20160720/validns.1	2016-02-04 09:14:15.000000000 -0500
+@@ -1,4 +1,4 @@
+-.TH VALIDNS 1 "April 2011" 
++.TH "VALIDNS" "1" "April 2011" "" ""
+ .SH NAME
+ .PP
+ validns \- DNS and DSNSEC zone file validator
+@@ -53,6 +53,8 @@
+ .IP \[bu] 2
+ tlsa\-host
+ .IP \[bu] 2
++ksk\-exists
++.IP \[bu] 2
+ all
+ .RE
+ .TP
+@@ -78,6 +80,11 @@
+ .RS
+ .RE
+ .TP
++.B \-M
++use SOA MINTTL as the default TTL when no TTL specified
++.RS
++.RE
++.TP
+ .B \-I \f[I]path\f[]
+ use this path for $INCLUDE files
+ .RS
+@@ -178,15 +185,13 @@
+ record if it is within the zone
+ .IP \[bu] 2
+ domain name of a TLSA record must be a proper prefixed DNS name
++.IP \[bu] 2
++a KSK key must exist in a signed zone
+ .SH BUGS
+ .IP \[bu] 2
+ textual segments in \f[I]TXT\f[] and \f[I]HINFO\f[] must be enclosed in
+ double quotes;
+ .IP \[bu] 2
+-there cannot be more than 20 textual segments in a \f[I]TXT\f[] record;
+-.IP \[bu] 2
+-\f[I]$INCLUDE\f[] directive is not implemented;
+-.IP \[bu] 2
+ a dot within a label is not currently supported;
+ .PP
+ If at least one NSEC3 record uses opt\-out flag, \f[C]validns\f[]
diff --git a/validns-0.8-githead.patch b/validns-0.8-githead.patch
new file mode 100644
index 0000000..0947b9d
--- /dev/null
+++ b/validns-0.8-githead.patch
@@ -0,0 +1,21091 @@
+diff -Naur validns-0.8/aaaa.c validns/aaaa.c
+--- validns-0.8/aaaa.c	2014-02-11 15:47:05.000000000 -0500
++++ validns/aaaa.c	2020-10-05 16:59:29.353681351 -0400
+@@ -20,44 +20,44 @@
+ 
+ static struct rr *aaaa_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_aaaa *rr = getmem(sizeof(*rr));
++    struct rr_aaaa *rr = getmem(sizeof(*rr));
+ 
+-	if (extract_ipv6(&s, "IPv6 address", &rr->address) <= 0)
+-		return NULL;
+-	if (*s) {
+-		return bitch("garbage after valid AAAA data");
+-	}
++    if (extract_ipv6(&s, "IPv6 address", &rr->address) <= 0)
++        return NULL;
++    if (*s) {
++        return bitch("garbage after valid AAAA data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* aaaa_human(struct rr *rrv)
+ {
+-	RRCAST(aaaa);
++    RRCAST(aaaa);
+     char s[1024];
+ 
+-	if (inet_ntop(AF_INET6, &rr->address, s, 1024))
+-		return quickstrdup_temp(s);
+-	return "????";
++    if (inet_ntop(AF_INET6, &rr->address, s, 1024))
++        return quickstrdup_temp(s);
++    return "????";
+ }
+ 
+ static struct binary_data aaaa_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(aaaa);
+-	struct binary_data r;
++    RRCAST(aaaa);
++    struct binary_data r;
+ 
+-	r.length = sizeof(rr->address);
+-	r.data = (void *)&rr->address;
+-	return r;
++    r.length = sizeof(rr->address);
++    r.data = (void *)&rr->address;
++    return r;
+ }
+ 
+ static void* aaaa_validate_set(struct rr_set *rr_set)
+ {
+-	if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) {
+-		struct rr *rr = rr_set->tail;
+-		return moan(rr->file_name, rr->line, "host name contains '/'");
+-	}
+-	return NULL;
++    if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) {
++        struct rr *rr = rr_set->tail;
++        return moan(rr->file_name, rr->line, "host name contains '/'");
++    }
++    return NULL;
+ }
+ 
+ struct rr_methods aaaa_methods = { aaaa_parse, aaaa_human, aaaa_wirerdata, aaaa_validate_set, NULL };
+diff -Naur validns-0.8/a.c validns/a.c
+--- validns-0.8/a.c	2014-02-11 15:47:08.000000000 -0500
++++ validns/a.c	2020-10-05 16:59:29.353681351 -0400
+@@ -20,44 +20,44 @@
+ 
+ static struct rr *a_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_a *rr = getmem(sizeof(*rr));
++    struct rr_a *rr = getmem(sizeof(*rr));
+ 
+-	if (extract_ipv4(&s, "IPv4 address", &rr->address) <= 0)
+-		return NULL;
+-	if (*s) {
+-		return bitch("garbage after valid A data");
+-	}
++    if (extract_ipv4(&s, "IPv4 address", &rr->address) <= 0)
++        return NULL;
++    if (*s) {
++        return bitch("garbage after valid A data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* a_human(struct rr *rrv)
+ {
+-	RRCAST(a);
+-	char s[1024];
++    RRCAST(a);
++    char s[1024];
+ 
+-	if (inet_ntop(AF_INET, &rr->address, s, 1024))
+-		return quickstrdup_temp(s);
+-	return "????";
++    if (inet_ntop(AF_INET, &rr->address, s, 1024))
++        return quickstrdup_temp(s);
++    return "????";
+ }
+ 
+ static struct binary_data a_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(a);
+-	struct binary_data r;
++    RRCAST(a);
++    struct binary_data r;
+ 
+-	r.length = sizeof(rr->address);
+-	r.data = (void *)&rr->address;
+-	return r;
++    r.length = sizeof(rr->address);
++    r.data = (void *)&rr->address;
++    return r;
+ }
+ 
+ static void* a_validate_set(struct rr_set *rr_set)
+ {
+-	if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) {
+-		struct rr *rr = rr_set->tail;
+-		return moan(rr->file_name, rr->line, "host name contains '/'");
+-	}
+-	return NULL;
++    if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) {
++        struct rr *rr = rr_set->tail;
++        return moan(rr->file_name, rr->line, "host name contains '/'");
++    }
++    return NULL;
+ }
+ 
+ struct rr_methods a_methods = { a_parse, a_human, a_wirerdata, a_validate_set, NULL };
+diff -Naur validns-0.8/afsdb.c validns/afsdb.c
+--- validns-0.8/afsdb.c	2014-02-11 15:46:27.000000000 -0500
++++ validns/afsdb.c	2020-10-05 16:59:29.353681351 -0400
+@@ -19,42 +19,42 @@
+ 
+ static struct rr *afsdb_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_afsdb *rr = getmem(sizeof(*rr));
++    struct rr_afsdb *rr = getmem(sizeof(*rr));
+ 
+-	rr->subtype = extract_integer(&s, "AFSDB subtype");
+-	if (rr->subtype < 0)
+-		return NULL;
++    rr->subtype = extract_integer(&s, "AFSDB subtype", NULL);
++    if (rr->subtype < 0)
++        return NULL;
+ 
+-	if (rr->subtype != 1 && rr->subtype != 2)
+-		return bitch("unknown AFSDB subtype");
++    if (rr->subtype != 1 && rr->subtype != 2)
++        return bitch("unknown AFSDB subtype");
+ 
+-	rr->hostname = extract_name(&s, "AFSDB hostname", 0);
+-	if (!rr->hostname)
+-		return NULL;
++    rr->hostname = extract_name(&s, "AFSDB hostname", 0);
++    if (!rr->hostname)
++        return NULL;
+ 
+-	if (*s) {
+-		return bitch("garbage after valid AFSDB data");
+-	}
++    if (*s) {
++        return bitch("garbage after valid AFSDB data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* afsdb_human(struct rr *rrv)
+ {
+-	RRCAST(afsdb);
++    RRCAST(afsdb);
+     char s[1024];
+ 
+     snprintf(s, 1024, "%d %s",
+-	     rr->subtype, rr->hostname);
++         rr->subtype, rr->hostname);
+     return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data afsdb_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(afsdb);
++    RRCAST(afsdb);
+ 
+     return compose_binary_data("2d", 1,
+-		rr->subtype, name2wire_name(rr->hostname));
++        rr->subtype, name2wire_name(rr->hostname));
+ }
+ 
+ struct rr_methods afsdb_methods = { afsdb_parse, afsdb_human, afsdb_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/base32hex.c validns/base32hex.c
+--- validns-0.8/base32hex.c	2014-02-11 15:44:11.000000000 -0500
++++ validns/base32hex.c	2020-10-05 16:59:29.353681351 -0400
+@@ -36,319 +36,319 @@
+ int
+ decode_base32hex(void *dest, char *src, size_t dstsize)
+ {
+-	size_t processed = 0;
+-	int full_bytes = 0;
+-	unsigned char *dst = dest;
+-
+-	while (*src) {
+-		int v;
+-		if (*src >= 'A' && *src <= 'V')
+-			v = *src - 'A' + 10;
+-		else if (*src >= 'a' && *src <= 'v')
+-			v = *src - 'a' + 10;
+-		else if (*src >= '0' && *src <= '9')
+-			v = *src - '0';
+-		else if (isspace(*src) || *src == '=') {
+-			src++;
+-			continue;
+-		} else {
+-			/* any junk chars means input is corrupted */
+-			errno = EINVAL;
+-			return -1;
+-		}
+-		src++;
+-		if (processed % 8 == 0) {
+-			if (dstsize <= 0) {
+-				errno = EINVAL;
+-				return -1;
+-			}
+-			dst[0] &= 0x07;
+-			dst[0] |= (v << 3) & 0xF8;
+-			processed++;
+-		} else if (processed % 8 == 1) {
+-			if (dstsize < 1) {
+-				errno = EINVAL;
+-				return -1;
+-			}
+-			dst[0] &= 0xF8;
+-			dst[0] |= (v >> 2) & 0x07;
+-			if (dstsize >= 2) {
+-				dst[1] &= 0x3F;
+-				dst[1] |= (v << 6) & 0xC0;
+-			}
+-			processed++;
+-			full_bytes++;
+-		} else if (processed % 8 == 2) {
+-			if (dstsize < 2) {
+-				errno = EINVAL;
+-				return -1;
+-			}
+-			dst[1] &= 0xC1;
+-			dst[1] |= (v << 1) & 0x3E;
+-			processed++;
+-		} else if (processed % 8 == 3) {
+-			if (dstsize < 2) {
+-				errno = EINVAL;
+-				return -1;
+-			}
+-			dst[1] &= 0xFE;
+-			dst[1] |= (v >> 4) & 0x01;
+-			if (dstsize >= 3) {
+-				dst[2] &= 0x0F;
+-				dst[2] |= (v << 4) & 0xF0;
+-			}
+-			processed++;
+-			full_bytes++;
+-		} else if (processed % 8 == 4) {
+-			if (dstsize < 3) {
+-				errno = EINVAL;
+-				return -1;
+-			}
+-			dst[2] &= 0xF0;
+-			dst[2] |= (v >> 1) & 0x0F;
+-			if (dstsize >= 4) {
+-				dst[3] &= 0x7F;
+-				dst[3] |= (v << 7) & 0x80;
+-			}
+-			processed++;
+-			full_bytes++;
+-		} else if (processed % 8 == 5) {
+-			if (dstsize < 4) {
+-				errno = EINVAL;
+-				return -1;
+-			}
+-			dst[3] &= 0x83;
+-			dst[3] |= (v << 2) & 0x7C;
+-			processed++;
+-		} else if (processed % 8 == 6) {
+-			if (dstsize < 4) {
+-				errno = EINVAL;
+-				return -1;
+-			}
+-			dst[3] &= 0xFC;
+-			dst[3] |= (v >> 3) & 0x03;
+-			if (dstsize >= 5) {
+-				dst[4] &= 0x1F;
+-				dst[4] |= (v << 5) & 0xE0;
+-			}
+-			processed++;
+-			full_bytes++;
+-		} else {
+-			if (dstsize < 5) {
+-				errno = EINVAL;
+-				return -1;
+-			}
+-			dst[4] &= 0xE0;
+-			dst[4] |= v & 0x1F;
+-			processed++;
+-			dst += 5;
+-			dstsize -= 5;
+-			full_bytes++;
+-		}
+-	}
+-	return full_bytes;
++    size_t processed = 0;
++    int full_bytes = 0;
++    unsigned char *dst = dest;
++
++    while (*src) {
++        int v;
++        if (*src >= 'A' && *src <= 'V')
++            v = *src - 'A' + 10;
++        else if (*src >= 'a' && *src <= 'v')
++            v = *src - 'a' + 10;
++        else if (*src >= '0' && *src <= '9')
++            v = *src - '0';
++        else if (isspace(*src) || *src == '=') {
++            src++;
++            continue;
++        } else {
++            /* any junk chars means input is corrupted */
++            errno = EINVAL;
++            return -1;
++        }
++        src++;
++        if (processed % 8 == 0) {
++            if (dstsize <= 0) {
++                errno = EINVAL;
++                return -1;
++            }
++            dst[0] &= 0x07;
++            dst[0] |= (v << 3) & 0xF8;
++            processed++;
++        } else if (processed % 8 == 1) {
++            if (dstsize < 1) {
++                errno = EINVAL;
++                return -1;
++            }
++            dst[0] &= 0xF8;
++            dst[0] |= (v >> 2) & 0x07;
++            if (dstsize >= 2) {
++                dst[1] &= 0x3F;
++                dst[1] |= (v << 6) & 0xC0;
++            }
++            processed++;
++            full_bytes++;
++        } else if (processed % 8 == 2) {
++            if (dstsize < 2) {
++                errno = EINVAL;
++                return -1;
++            }
++            dst[1] &= 0xC1;
++            dst[1] |= (v << 1) & 0x3E;
++            processed++;
++        } else if (processed % 8 == 3) {
++            if (dstsize < 2) {
++                errno = EINVAL;
++                return -1;
++            }
++            dst[1] &= 0xFE;
++            dst[1] |= (v >> 4) & 0x01;
++            if (dstsize >= 3) {
++                dst[2] &= 0x0F;
++                dst[2] |= (v << 4) & 0xF0;
++            }
++            processed++;
++            full_bytes++;
++        } else if (processed % 8 == 4) {
++            if (dstsize < 3) {
++                errno = EINVAL;
++                return -1;
++            }
++            dst[2] &= 0xF0;
++            dst[2] |= (v >> 1) & 0x0F;
++            if (dstsize >= 4) {
++                dst[3] &= 0x7F;
++                dst[3] |= (v << 7) & 0x80;
++            }
++            processed++;
++            full_bytes++;
++        } else if (processed % 8 == 5) {
++            if (dstsize < 4) {
++                errno = EINVAL;
++                return -1;
++            }
++            dst[3] &= 0x83;
++            dst[3] |= (v << 2) & 0x7C;
++            processed++;
++        } else if (processed % 8 == 6) {
++            if (dstsize < 4) {
++                errno = EINVAL;
++                return -1;
++            }
++            dst[3] &= 0xFC;
++            dst[3] |= (v >> 3) & 0x03;
++            if (dstsize >= 5) {
++                dst[4] &= 0x1F;
++                dst[4] |= (v << 5) & 0xE0;
++            }
++            processed++;
++            full_bytes++;
++        } else {
++            if (dstsize < 5) {
++                errno = EINVAL;
++                return -1;
++            }
++            dst[4] &= 0xE0;
++            dst[4] |= v & 0x1F;
++            processed++;
++            dst += 5;
++            dstsize -= 5;
++            full_bytes++;
++        }
++    }
++    return full_bytes;
+ }
+ 
+ int
+ encode_base32hex(void *dest, size_t dstsize, void *source, size_t srclength)
+ {
+-	size_t need_dstsize;
+-	int byte = 0;
+-	unsigned char *dst = dest;
+-	unsigned char *src = source;
+-	int i;
+-
+-	need_dstsize = 8*(srclength / 5);
+-	switch (srclength % 5) {
+-	case 1: need_dstsize += 2; break;
+-	case 2: need_dstsize += 4; break;
+-	case 3: need_dstsize += 5; break;
+-	case 4: need_dstsize += 7; break;
+-	}
+-	if (dstsize < need_dstsize) {
+-		errno = EINVAL;
+-		return -1;
+-	}
+-	while (srclength) {
+-		switch (byte) {
+-		case 0:
+-			dst[0] = *src >> 3;
+-			dst[1] = (*src & 0x07) << 2;
+-			break;
+-		case 1:
+-			dst[1] |= (*src >> 6) & 0x03;
+-			dst[2] = (*src >> 1) & 0x1f;
+-			dst[3] = (*src & 0x01) << 4;
+-			break;
+-		case 2:
+-			dst[3] |= (*src >> 4) & 0x0f;
+-			dst[4] = (*src & 0x0f) << 1;
+-			break;
+-		case 3:
+-			dst[4] |= (*src >> 7) & 0x01;
+-			dst[5] = (*src >> 2) & 0x1f;
+-			dst[6] = (*src & 0x03) << 3;
+-			break;
+-		case 4:
+-			dst[6] |= (*src >> 5) & 0x07;
+-			dst[7] = *src & 0x1f;
+-			break;
+-		}
+-
+-		srclength--;
+-		src++;
+-		byte++;
+-		if (byte == 5) {
+-			dst += 8;
+-			byte = 0;
+-		}
+-	}
+-	dst = dest;
+-	for (i = 0; i < need_dstsize; i++) {
+-		if (*dst < 10)
+-			*dst = *dst +'0';
+-		else if (*dst < 32)
+-			*dst = *dst - 10 + 'a';
+-		else
+-			*dst = '?';
+-		dst++;
+-	}
+-	return need_dstsize;
++    size_t need_dstsize;
++    int byte = 0;
++    unsigned char *dst = dest;
++    unsigned char *src = source;
++    int i;
++
++    need_dstsize = 8*(srclength / 5);
++    switch (srclength % 5) {
++    case 1: need_dstsize += 2; break;
++    case 2: need_dstsize += 4; break;
++    case 3: need_dstsize += 5; break;
++    case 4: need_dstsize += 7; break;
++    }
++    if (dstsize < need_dstsize) {
++        errno = EINVAL;
++        return -1;
++    }
++    while (srclength) {
++        switch (byte) {
++        case 0:
++            dst[0] = *src >> 3;
++            dst[1] = (*src & 0x07) << 2;
++            break;
++        case 1:
++            dst[1] |= (*src >> 6) & 0x03;
++            dst[2] = (*src >> 1) & 0x1f;
++            dst[3] = (*src & 0x01) << 4;
++            break;
++        case 2:
++            dst[3] |= (*src >> 4) & 0x0f;
++            dst[4] = (*src & 0x0f) << 1;
++            break;
++        case 3:
++            dst[4] |= (*src >> 7) & 0x01;
++            dst[5] = (*src >> 2) & 0x1f;
++            dst[6] = (*src & 0x03) << 3;
++            break;
++        case 4:
++            dst[6] |= (*src >> 5) & 0x07;
++            dst[7] = *src & 0x1f;
++            break;
++        }
++
++        srclength--;
++        src++;
++        byte++;
++        if (byte == 5) {
++            dst += 8;
++            byte = 0;
++        }
++    }
++    dst = dest;
++    for (i = 0; i < need_dstsize; i++) {
++        if (*dst < 10)
++            *dst = *dst +'0';
++        else if (*dst < 32)
++            *dst = *dst - 10 + 'a';
++        else
++            *dst = '?';
++        dst++;
++    }
++    return need_dstsize;
+ }
+ 
+ #ifdef TEST_PROGRAM
+ 
+ static int ok_string_test(int testnum, char *src, char *expect)
+ {
+-	unsigned char dstbuf[512];
+-	unsigned char reverse_buf[1024];
+-	int r, r0, i;
+-	int expect_sz = strlen(expect);
+-	int expect_reverse;
+-	char *s, *d;
+-
+-	if (expect_sz >= 512) {
+-		printf("test %d: NOT OK: internal *test* error, buffer too small for proper testing, FIXME\n", testnum);
+-		return 1;
+-	}
+-	memset(dstbuf, 0xAA, 512);
+-	r = decode_base32hex(dstbuf, src, expect_sz);
+-	if (r != expect_sz) {
+-		printf("test %d: NOT OK: expect size %d, got %d\n", testnum, expect_sz, r);
+-		return 1;
+-	} else if (memcmp(dstbuf, expect, r) != 0) {
+-		printf("test %d: NOT OK: unexpected buffer content\n", testnum);
+-		return 1;
+-	}
+-	if (dstbuf[expect_sz] != 0xAA) {
+-		printf("test %d: NOT OK: corrupts memory with \"just enough\" bufsize\n", testnum);
+-		return 1;
+-	}
+-	r = encode_base32hex(reverse_buf, 1024, dstbuf, expect_sz);
+-	s = src;  d = (char*)dstbuf;
+-	expect_reverse = 0;
+-	while (*s) {
+-		if (*s != ' ' && *s != '=') {
+-			*d++ = tolower(*s);
+-			expect_reverse++;
+-		}
+-		s++;
+-	}
+-	if (r != expect_reverse) {
+-		printf("test %d: NOT OK: REVERSE: expect size %d, got %d\n", testnum, expect_reverse, r);
+-		return 1;
+-	} else if (memcmp(reverse_buf, dstbuf, r) != 0) {
+-		printf("test %d: NOT OK: REVERSE: unexpected buffer content\n", testnum);
+-		return 1;
+-	}
+-	memset(dstbuf, 0xAA, 512);
+-	for (i = 0; i < expect_sz; i++) {
+-		r0 = decode_base32hex(dstbuf, src, i);
+-		if (r0 > 0) {
+-			printf("test %d: NOT OK: buffer size %d should not be enough\n", testnum, i);
+-			return 1;
+-		}
+-		if (dstbuf[i] != 0xAA) {
+-			printf("test %d: NOT OK: corrupts memory with bufsize %d\n", testnum, i);
+-			return 1;
+-		}
+-	}
+-	printf("test %d: ok\n", testnum);
+-	return 0;
++    unsigned char dstbuf[512];
++    unsigned char reverse_buf[1024];
++    int r, r0, i;
++    int expect_sz = strlen(expect);
++    int expect_reverse;
++    char *s, *d;
++
++    if (expect_sz >= 512) {
++        printf("test %d: NOT OK: internal *test* error, buffer too small for proper testing, FIXME\n", testnum);
++        return 1;
++    }
++    memset(dstbuf, 0xAA, 512);
++    r = decode_base32hex(dstbuf, src, expect_sz);
++    if (r != expect_sz) {
++        printf("test %d: NOT OK: expect size %d, got %d\n", testnum, expect_sz, r);
++        return 1;
++    } else if (memcmp(dstbuf, expect, r) != 0) {
++        printf("test %d: NOT OK: unexpected buffer content\n", testnum);
++        return 1;
++    }
++    if (dstbuf[expect_sz] != 0xAA) {
++        printf("test %d: NOT OK: corrupts memory with \"just enough\" bufsize\n", testnum);
++        return 1;
++    }
++    r = encode_base32hex(reverse_buf, 1024, dstbuf, expect_sz);
++    s = src;  d = (char*)dstbuf;
++    expect_reverse = 0;
++    while (*s) {
++        if (*s != ' ' && *s != '=') {
++            *d++ = tolower(*s);
++            expect_reverse++;
++        }
++        s++;
++    }
++    if (r != expect_reverse) {
++        printf("test %d: NOT OK: REVERSE: expect size %d, got %d\n", testnum, expect_reverse, r);
++        return 1;
++    } else if (memcmp(reverse_buf, dstbuf, r) != 0) {
++        printf("test %d: NOT OK: REVERSE: unexpected buffer content\n", testnum);
++        return 1;
++    }
++    memset(dstbuf, 0xAA, 512);
++    for (i = 0; i < expect_sz; i++) {
++        r0 = decode_base32hex(dstbuf, src, i);
++        if (r0 > 0) {
++            printf("test %d: NOT OK: buffer size %d should not be enough\n", testnum, i);
++            return 1;
++        }
++        if (dstbuf[i] != 0xAA) {
++            printf("test %d: NOT OK: corrupts memory with bufsize %d\n", testnum, i);
++            return 1;
++        }
++    }
++    printf("test %d: ok\n", testnum);
++    return 0;
+ }
+ 
+ static int expect_junk_error(int testnum, char *src)
+ {
+-	char *buf[20];
+-	int r;
++    char *buf[20];
++    int r;
+ 
+-	r = decode_base32hex(buf, src, 20);
+-	if (r != -1) {
+-		printf("test %d: NOT OK: junk input not recognized\n", testnum);
+-		return 1;
+-	}
+-	printf("test %d: ok\n", testnum);
+-	return 0;
++    r = decode_base32hex(buf, src, 20);
++    if (r != -1) {
++        printf("test %d: NOT OK: junk input not recognized\n", testnum);
++        return 1;
++    }
++    printf("test %d: ok\n", testnum);
++    return 0;
+ }
+ 
+ int main(void)
+ {
+-	int ret = 0;
+-	int t = 1;
++    int ret = 0;
++    int t = 1;
+ 
+-	/* from http://tools.ietf.org/html/rfc4648#section-10 */
+-	ret |= ok_string_test(t++, "", "");
+-	ret |= ok_string_test(t++, "CO======", "f");
+-	ret |= ok_string_test(t++, "Co=====", "f");
+-	ret |= ok_string_test(t++, "cO====", "f");
+-	ret |= ok_string_test(t++, "co===", "f");
+-	ret |= ok_string_test(t++, "CO==", "f");
+-	ret |= ok_string_test(t++, "CO=", "f");
+-	ret |= ok_string_test(t++, "CO", "f");
+-
+-	ret |= ok_string_test(t++, "CPNG====", "fo");
+-	ret |= ok_string_test(t++, "cPNG===", "fo");
+-	ret |= ok_string_test(t++, "cpNG==", "fo");
+-	ret |= ok_string_test(t++, "cpnG=", "fo");
+-	ret |= ok_string_test(t++, "cpng", "fo");
+-
+-	ret |= ok_string_test(t++, "CPNMU===", "foo");
+-	ret |= ok_string_test(t++, "CPnMU==", "foo");
+-	ret |= ok_string_test(t++, "CPnmu=", "foo");
+-	ret |= ok_string_test(t++, "cpNMU", "foo");
+-
+-	ret |= ok_string_test(t++, "CPNMUOG=", "foob");
+-	ret |= ok_string_test(t++, "CPNMUoG", "foob");
+-
+-	ret |= ok_string_test(t++, "CPNMUOJ1", "fooba");
+-	ret |= ok_string_test(t++, "cPnMuOj1", "fooba");
+-	ret |= ok_string_test(t++, "CpNmUoJ1", "fooba");
+-	ret |= ok_string_test(t++, "CpNm   UoJ1", "fooba");
+-
+-	ret |= ok_string_test(t++, "CPNMUOJ1E8======", "foobar");
+-	ret |= ok_string_test(t++, "CPNMuOJ1E8=====", "foobar");
+-	ret |= ok_string_test(t++, "CpNMuOJ1E8====", "foobar");
+-	ret |= ok_string_test(t++, "CpNMuOJ1e8===", "foobar");
+-	ret |= ok_string_test(t++, "CpNmuOJ 1e8==", "foobar");
+-	ret |= ok_string_test(t++, "CpnmuOJ 1e8=", "foobar");
+-	ret |= ok_string_test(t++, "Cpn muOj 1e8", "foobar");
+-
+-	ret |= expect_junk_error(t++, "?m9vmF");
+-	ret |= expect_junk_error(t++, "%m9vmF");
+-	ret |= expect_junk_error(t++, "m&9vmF");
+-	ret |= expect_junk_error(t++, "m9-vmF");
+-	ret |= expect_junk_error(t++, "m9v*mF");
+-	ret |= expect_junk_error(t++, "m9v#mF");
+-	ret |= expect_junk_error(t++, "m9vm\x01F");
+-	ret |= expect_junk_error(t++, "m9vmF!");
+-	ret |= expect_junk_error(t++, "m9vmF.");
+-	ret |= expect_junk_error(t++, "CpnmuOj/1e8x");
+-	ret |= expect_junk_error(t++, "CpnYmuOj1e8");
+-	ret |= expect_junk_error(t++, "CZpnmuOj1e8");
+-	ret |= expect_junk_error(t++, "CzpnmuOj1e8");
++    /* from http://tools.ietf.org/html/rfc4648#section-10 */
++    ret |= ok_string_test(t++, "", "");
++    ret |= ok_string_test(t++, "CO======", "f");
++    ret |= ok_string_test(t++, "Co=====", "f");
++    ret |= ok_string_test(t++, "cO====", "f");
++    ret |= ok_string_test(t++, "co===", "f");
++    ret |= ok_string_test(t++, "CO==", "f");
++    ret |= ok_string_test(t++, "CO=", "f");
++    ret |= ok_string_test(t++, "CO", "f");
++
++    ret |= ok_string_test(t++, "CPNG====", "fo");
++    ret |= ok_string_test(t++, "cPNG===", "fo");
++    ret |= ok_string_test(t++, "cpNG==", "fo");
++    ret |= ok_string_test(t++, "cpnG=", "fo");
++    ret |= ok_string_test(t++, "cpng", "fo");
++
++    ret |= ok_string_test(t++, "CPNMU===", "foo");
++    ret |= ok_string_test(t++, "CPnMU==", "foo");
++    ret |= ok_string_test(t++, "CPnmu=", "foo");
++    ret |= ok_string_test(t++, "cpNMU", "foo");
++
++    ret |= ok_string_test(t++, "CPNMUOG=", "foob");
++    ret |= ok_string_test(t++, "CPNMUoG", "foob");
++
++    ret |= ok_string_test(t++, "CPNMUOJ1", "fooba");
++    ret |= ok_string_test(t++, "cPnMuOj1", "fooba");
++    ret |= ok_string_test(t++, "CpNmUoJ1", "fooba");
++    ret |= ok_string_test(t++, "CpNm   UoJ1", "fooba");
++
++    ret |= ok_string_test(t++, "CPNMUOJ1E8======", "foobar");
++    ret |= ok_string_test(t++, "CPNMuOJ1E8=====", "foobar");
++    ret |= ok_string_test(t++, "CpNMuOJ1E8====", "foobar");
++    ret |= ok_string_test(t++, "CpNMuOJ1e8===", "foobar");
++    ret |= ok_string_test(t++, "CpNmuOJ 1e8==", "foobar");
++    ret |= ok_string_test(t++, "CpnmuOJ 1e8=", "foobar");
++    ret |= ok_string_test(t++, "Cpn muOj 1e8", "foobar");
++
++    ret |= expect_junk_error(t++, "?m9vmF");
++    ret |= expect_junk_error(t++, "%m9vmF");
++    ret |= expect_junk_error(t++, "m&9vmF");
++    ret |= expect_junk_error(t++, "m9-vmF");
++    ret |= expect_junk_error(t++, "m9v*mF");
++    ret |= expect_junk_error(t++, "m9v#mF");
++    ret |= expect_junk_error(t++, "m9vm\x01F");
++    ret |= expect_junk_error(t++, "m9vmF!");
++    ret |= expect_junk_error(t++, "m9vmF.");
++    ret |= expect_junk_error(t++, "CpnmuOj/1e8x");
++    ret |= expect_junk_error(t++, "CpnYmuOj1e8");
++    ret |= expect_junk_error(t++, "CZpnmuOj1e8");
++    ret |= expect_junk_error(t++, "CzpnmuOj1e8");
+ 
+-	ret |= ok_string_test(t++, "MEQIMI6FJE5NI47PJAHV5QIGU1LV3JLJ", "\xb3\xb5\x2b\x48\xcf\x9b\x8b\x79\x10\xf9\x9a\xa3\xf2\xea\x50\xf0\x6b\xf1\xce\xb3");
++    ret |= ok_string_test(t++, "MEQIMI6FJE5NI47PJAHV5QIGU1LV3JLJ", "\xb3\xb5\x2b\x48\xcf\x9b\x8b\x79\x10\xf9\x9a\xa3\xf2\xea\x50\xf0\x6b\xf1\xce\xb3");
+ 
+-	return ret;
++    return ret;
+ }
+ #endif
+diff -Naur validns-0.8/base64.c validns/base64.c
+--- validns-0.8/base64.c	2014-02-11 15:45:08.000000000 -0500
++++ validns/base64.c	2020-10-05 16:59:29.353681351 -0400
+@@ -23,180 +23,180 @@
+ int
+ decode_base64(void *dest, char *src, size_t dstsize)
+ {
+-	size_t processed = 0;
+-	int full_bytes = 0;
+-	unsigned char *dst = dest;
+-
+-	while (*src) {
+-		int v;
+-		if (*src >= 'A' && *src <= 'Z')
+-			v = *src - 'A';
+-		else if (*src >= 'a' && *src <= 'z')
+-			v = 26 + *src - 'a';
+-		else if (*src >= '0' && *src <= '9')
+-			v = 52 + *src - '0';
+-		else if (*src == '+')
+-			v = 62;
+-		else if (*src == '/')
+-			v = 63;
+-		else if (isspace(*src) || *src == '=') {
+-			src++;
+-			continue;
+-		} else {
+-			/* any junk chars means input is corrupted */
+-			errno = EINVAL;
+-			return -1;
+-		}
+-		src++;
+-		if (processed % 4 == 0) {
+-			if (dstsize <= 0) {
+-				errno = EINVAL;
+-				return -1;
+-			}
+-			dst[0] &= 0x03;
+-			dst[0] |= (v << 2) & 0xFC;
+-			processed++;
+-		} else if (processed % 4 == 1) {
+-			if (dstsize < 1) {
+-				errno = EINVAL;
+-				return -1;
+-			}
+-			dst[0] &= 0xFC;
+-			dst[0] |= (v >> 4) & 0x03;
+-			if (dstsize >= 2) {
+-				dst[1] &= 0x0F;
+-				dst[1] |= (v << 4) & 0xF0;
+-			}
+-			processed++;
+-			full_bytes++;
+-		} else if (processed % 4 == 2) {
+-			if (dstsize < 2) {
+-				errno = EINVAL;
+-				return -1;
+-			}
+-			dst[1] &= 0xF0;
+-			dst[1] |= (v >> 2) & 0x0F;
+-			if (dstsize >= 3) {
+-				dst[2] &= 0x3F;
+-				dst[2] |= (v << 6) & 0xC0;
+-			}
+-			processed++;
+-			full_bytes++;
+-		} else {
+-			if (dstsize <= 2) {
+-				errno = EINVAL;
+-				return -1;
+-			}
+-			dst[2] &= 0xC0;
+-			dst[2] |= v & 0x3F;
+-			processed++;
+-			dst += 3;
+-			dstsize -= 3;
+-			full_bytes++;
+-		}
+-	}
+-	return full_bytes;
++    size_t processed = 0;
++    int full_bytes = 0;
++    unsigned char *dst = dest;
++
++    while (*src) {
++        int v;
++        if (*src >= 'A' && *src <= 'Z')
++            v = *src - 'A';
++        else if (*src >= 'a' && *src <= 'z')
++            v = 26 + *src - 'a';
++        else if (*src >= '0' && *src <= '9')
++            v = 52 + *src - '0';
++        else if (*src == '+')
++            v = 62;
++        else if (*src == '/')
++            v = 63;
++        else if (isspace(*src) || *src == '=') {
++            src++;
++            continue;
++        } else {
++            /* any junk chars means input is corrupted */
++            errno = EINVAL;
++            return -1;
++        }
++        src++;
++        if (processed % 4 == 0) {
++            if (dstsize <= 0) {
++                errno = EINVAL;
++                return -1;
++            }
++            dst[0] &= 0x03;
++            dst[0] |= (v << 2) & 0xFC;
++            processed++;
++        } else if (processed % 4 == 1) {
++            if (dstsize < 1) {
++                errno = EINVAL;
++                return -1;
++            }
++            dst[0] &= 0xFC;
++            dst[0] |= (v >> 4) & 0x03;
++            if (dstsize >= 2) {
++                dst[1] &= 0x0F;
++                dst[1] |= (v << 4) & 0xF0;
++            }
++            processed++;
++            full_bytes++;
++        } else if (processed % 4 == 2) {
++            if (dstsize < 2) {
++                errno = EINVAL;
++                return -1;
++            }
++            dst[1] &= 0xF0;
++            dst[1] |= (v >> 2) & 0x0F;
++            if (dstsize >= 3) {
++                dst[2] &= 0x3F;
++                dst[2] |= (v << 6) & 0xC0;
++            }
++            processed++;
++            full_bytes++;
++        } else {
++            if (dstsize <= 2) {
++                errno = EINVAL;
++                return -1;
++            }
++            dst[2] &= 0xC0;
++            dst[2] |= v & 0x3F;
++            processed++;
++            dst += 3;
++            dstsize -= 3;
++            full_bytes++;
++        }
++    }
++    return full_bytes;
+ }
+ 
+ #ifdef TEST_PROGRAM
+ 
+ static int ok_string_test(int testnum, char *src, char *expect)
+ {
+-	unsigned char dstbuf[512];
+-	int r, r0, i;
+-	int expect_sz = strlen(expect);
+-
+-	if (expect_sz >= 512) {
+-		printf("test %d: NOT OK: internal *test* error, buffer too small for proper testing, FIXME\n", testnum);
+-		return 1;
+-	}
+-	memset(dstbuf, 0xAA, 512);
+-	r = decode_base64(dstbuf, src, expect_sz);
+-	if (r != expect_sz) {
+-		printf("test %d: NOT OK: expect size %d, got %d\n", testnum, expect_sz, r);
+-		return 1;
+-	} else if (memcmp(dstbuf, expect, r) != 0) {
+-		printf("test %d: NOT OK: unexpected buffer content\n", testnum);
+-		return 1;
+-	}
+-	if (dstbuf[expect_sz] != 0xAA) {
+-		printf("test %d: NOT OK: corrupts memory with \"just enough\" bufsize\n", testnum);
+-		return 1;
+-	}
+-	memset(dstbuf, 0xAA, 512);
+-	for (i = 0; i < expect_sz; i++) {
+-		r0 = decode_base64(dstbuf, src, i);
+-		if (r0 > 0) {
+-			printf("test %d: NOT OK: buffer size %d should not be enough\n", testnum, i);
+-			return 1;
+-		}
+-		if (dstbuf[i] != 0xAA) {
+-			printf("test %d: NOT OK: corrupts memory with bufsize %d\n", testnum, i);
+-			return 1;
+-		}
+-	}
+-	printf("test %d: ok\n", testnum);
+-	return 0;
++    unsigned char dstbuf[512];
++    int r, r0, i;
++    int expect_sz = strlen(expect);
++
++    if (expect_sz >= 512) {
++        printf("test %d: NOT OK: internal *test* error, buffer too small for proper testing, FIXME\n", testnum);
++        return 1;
++    }
++    memset(dstbuf, 0xAA, 512);
++    r = decode_base64(dstbuf, src, expect_sz);
++    if (r != expect_sz) {
++        printf("test %d: NOT OK: expect size %d, got %d\n", testnum, expect_sz, r);
++        return 1;
++    } else if (memcmp(dstbuf, expect, r) != 0) {
++        printf("test %d: NOT OK: unexpected buffer content\n", testnum);
++        return 1;
++    }
++    if (dstbuf[expect_sz] != 0xAA) {
++        printf("test %d: NOT OK: corrupts memory with \"just enough\" bufsize\n", testnum);
++        return 1;
++    }
++    memset(dstbuf, 0xAA, 512);
++    for (i = 0; i < expect_sz; i++) {
++        r0 = decode_base64(dstbuf, src, i);
++        if (r0 > 0) {
++            printf("test %d: NOT OK: buffer size %d should not be enough\n", testnum, i);
++            return 1;
++        }
++        if (dstbuf[i] != 0xAA) {
++            printf("test %d: NOT OK: corrupts memory with bufsize %d\n", testnum, i);
++            return 1;
++        }
++    }
++    printf("test %d: ok\n", testnum);
++    return 0;
+ }
+ 
+ static int expect_junk_error(int testnum, char *src)
+ {
+-	char *buf[20];
+-	int r;
++    char *buf[20];
++    int r;
+ 
+-	r = decode_base64(buf, src, 20);
+-	if (r != -1) {
+-		printf("test %d: NOT OK: junk input not recognized\n", testnum);
+-		return 1;
+-	}
+-	printf("test %d: ok\n", testnum);
+-	return 0;
++    r = decode_base64(buf, src, 20);
++    if (r != -1) {
++        printf("test %d: NOT OK: junk input not recognized\n", testnum);
++        return 1;
++    }
++    printf("test %d: ok\n", testnum);
++    return 0;
+ }
+ 
+ int main(void)
+ {
+-	int ret = 0;
++    int ret = 0;
+ 
+-	/* from http://en.wikipedia.org/wiki/Base64 */
+-	ret |= ok_string_test(1, "bGVhc3VyZS4=", "leasure.");
+-	ret |= ok_string_test(2, "bGVhc3VyZS4", "leasure.");
+-	ret |= ok_string_test(3, "ZWFzdXJlLg==", "easure.");
+-	ret |= ok_string_test(4, "ZWFzdXJlLg=", "easure.");
+-	ret |= ok_string_test(5, "ZWFzdXJlLg", "easure.");
+-	ret |= ok_string_test(6, "YXN1cmUu", "asure.");
+-	ret |= ok_string_test(7, "c3VyZS4=", "sure.");
+-	ret |= ok_string_test(8, "c3VyZS4", "sure.");
+-	ret |= ok_string_test(9, "TWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZWFzb24sIGJ1dCBieSB0aGlz\n"
+-		"IHNpbmd1bGFyIHBhc3Npb24gZnJvbSBvdGhlciBhbmltYWxzLCB3aGljaCBpcyBhIGx1c3Qgb2Yg\n"
+-		"dGhlIG1pbmQsIHRoYXQgYnkgYSBwZXJzZXZlcmFuY2Ugb2YgZGVsaWdodCBpbiB0aGUgY29udGlu\n"
+-		"dWVkIGFuZCBpbmRlZmF0aWdhYmxlIGdlbmVyYXRpb24gb2Yga25vd2xlZGdlLCBleGNlZWRzIHRo\n"
+-		"ZSBzaG9ydCB2ZWhlbWVuY2Ugb2YgYW55IGNhcm5hbCBwbGVhc3VyZS4=",
+-		"Man is distinguished, not only by his reason, but by this singular passion from other animals, which is a lust of the mind, that by a perseverance of delight in the continued and indefatigable generation of knowledge, exceeds the short vehemence of any carnal pleasure.");
+-	/* from http://tools.ietf.org/html/rfc4648#section-10 */
+-	ret |= ok_string_test(10, "", "");
+-	ret |= ok_string_test(11, "Zg==", "f");
+-	ret |= ok_string_test(12, "Zg=", "f");
+-	ret |= ok_string_test(13, "Zg", "f");
+-	ret |= ok_string_test(14, "Zm8=", "fo");
+-	ret |= ok_string_test(15, "Zm8", "fo");
+-	ret |= ok_string_test(16, "Zm9v", "foo");
+-	ret |= ok_string_test(17, "Zm9vYg==", "foob");
+-	ret |= ok_string_test(18, "Zm9vYg=", "foob");
+-	ret |= ok_string_test(19, "Zm9vYg", "foob");
+-	ret |= ok_string_test(20, "Zm9vYmE=", "fooba");
+-	ret |= ok_string_test(21, "Zm9vYmE", "fooba");
+-	ret |= ok_string_test(22, "Zm9vYmFy", "foobar");
+-
+-	ret |= expect_junk_error(23, "?Zm9vYmFy");
+-	ret |= expect_junk_error(24, "Z%m9vYmFy");
+-	ret |= expect_junk_error(25, "Zm&9vYmFy");
+-	ret |= expect_junk_error(26, "Zm9-vYmFy");
+-	ret |= expect_junk_error(27, "Zm9v*YmFy");
+-	ret |= expect_junk_error(28, "Zm9vY#mFy");
+-	ret |= expect_junk_error(29, "Zm9vYm\x01Fy");
+-	ret |= expect_junk_error(30, "Zm9vYmF!y");
+-	ret |= expect_junk_error(31, "Zm9vYmFy.");
++    /* from http://en.wikipedia.org/wiki/Base64 */
++    ret |= ok_string_test(1, "bGVhc3VyZS4=", "leasure.");
++    ret |= ok_string_test(2, "bGVhc3VyZS4", "leasure.");
++    ret |= ok_string_test(3, "ZWFzdXJlLg==", "easure.");
++    ret |= ok_string_test(4, "ZWFzdXJlLg=", "easure.");
++    ret |= ok_string_test(5, "ZWFzdXJlLg", "easure.");
++    ret |= ok_string_test(6, "YXN1cmUu", "asure.");
++    ret |= ok_string_test(7, "c3VyZS4=", "sure.");
++    ret |= ok_string_test(8, "c3VyZS4", "sure.");
++    ret |= ok_string_test(9, "TWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZWFzb24sIGJ1dCBieSB0aGlz\n"
++        "IHNpbmd1bGFyIHBhc3Npb24gZnJvbSBvdGhlciBhbmltYWxzLCB3aGljaCBpcyBhIGx1c3Qgb2Yg\n"
++        "dGhlIG1pbmQsIHRoYXQgYnkgYSBwZXJzZXZlcmFuY2Ugb2YgZGVsaWdodCBpbiB0aGUgY29udGlu\n"
++        "dWVkIGFuZCBpbmRlZmF0aWdhYmxlIGdlbmVyYXRpb24gb2Yga25vd2xlZGdlLCBleGNlZWRzIHRo\n"
++        "ZSBzaG9ydCB2ZWhlbWVuY2Ugb2YgYW55IGNhcm5hbCBwbGVhc3VyZS4=",
++        "Man is distinguished, not only by his reason, but by this singular passion from other animals, which is a lust of the mind, that by a perseverance of delight in the continued and indefatigable generation of knowledge, exceeds the short vehemence of any carnal pleasure.");
++    /* from http://tools.ietf.org/html/rfc4648#section-10 */
++    ret |= ok_string_test(10, "", "");
++    ret |= ok_string_test(11, "Zg==", "f");
++    ret |= ok_string_test(12, "Zg=", "f");
++    ret |= ok_string_test(13, "Zg", "f");
++    ret |= ok_string_test(14, "Zm8=", "fo");
++    ret |= ok_string_test(15, "Zm8", "fo");
++    ret |= ok_string_test(16, "Zm9v", "foo");
++    ret |= ok_string_test(17, "Zm9vYg==", "foob");
++    ret |= ok_string_test(18, "Zm9vYg=", "foob");
++    ret |= ok_string_test(19, "Zm9vYg", "foob");
++    ret |= ok_string_test(20, "Zm9vYmE=", "fooba");
++    ret |= ok_string_test(21, "Zm9vYmE", "fooba");
++    ret |= ok_string_test(22, "Zm9vYmFy", "foobar");
++
++    ret |= expect_junk_error(23, "?Zm9vYmFy");
++    ret |= expect_junk_error(24, "Z%m9vYmFy");
++    ret |= expect_junk_error(25, "Zm&9vYmFy");
++    ret |= expect_junk_error(26, "Zm9-vYmFy");
++    ret |= expect_junk_error(27, "Zm9v*YmFy");
++    ret |= expect_junk_error(28, "Zm9vY#mFy");
++    ret |= expect_junk_error(29, "Zm9vYm\x01Fy");
++    ret |= expect_junk_error(30, "Zm9vYmF!y");
++    ret |= expect_junk_error(31, "Zm9vYmFy.");
+ 
+-	return ret;
++    return ret;
+ }
+ #endif
+diff -Naur validns-0.8/caa.c validns/caa.c
+--- validns-0.8/caa.c	1969-12-31 19:00:00.000000000 -0500
++++ validns/caa.c	2020-10-05 16:59:29.353681351 -0400
+@@ -0,0 +1,90 @@
++/*
++ * Part of DNS zone file validator `validns`.
++ *
++ * Copyright 2011-2017 Anton Berezin <tobez@tobez.org>
++ * Modified BSD license.
++ * (See LICENSE file in the distribution.)
++ *
++ */
++#include <sys/types.h>
++#include <stdio.h>
++#include <netinet/in.h>
++#include <arpa/inet.h>
++#include <string.h>
++
++#include "common.h"
++#include "textparse.h"
++#include "mempool.h"
++#include "carp.h"
++#include "rr.h"
++
++static struct rr* caa_parse(char *name, long ttl, int type, char *s)
++{
++    struct rr_caa *rr = getmem(sizeof(*rr));
++    int flags;
++    char *str_tag;
++
++    flags = extract_integer(&s, "CAA flags", NULL);
++    if (flags < 0)  return NULL;
++    if (flags != 0 && flags != 128)
++        return bitch("CAA unrecognized flags value");
++    rr->flags = flags;
++
++    str_tag = extract_label(&s, "CAA tag", "temporary");
++    if (!str_tag) return NULL;
++
++    if (strcmp(str_tag, "issue") == 0) {
++        /* ok */
++    } else if (strcmp(str_tag, "issuewild") == 0) {
++        /* ok */
++    } else if (strcmp(str_tag, "iodef") == 0) {
++        /* ok */
++    } else if (strcmp(str_tag, "auth") == 0)
++        return bitch("CAA reserved tag name");
++    else if (strcmp(str_tag, "path") == 0)
++        return bitch("CAA reserved tag name");
++    else if (strcmp(str_tag, "policy") == 0)
++        return bitch("CAA reserved tag name");
++    else
++        return bitch("CAA unrecognized tag name");
++
++    rr->tag = compose_binary_data("s", 0, str_tag);
++    rr->value = extract_text(&s, "CAA tag value");
++    if (rr->value.length <= 0)
++        return bitch("CAA missing tag value");
++
++    if (*s) {
++        return bitch("garbage after valid CAA data");
++    }
++    return store_record(type, name, ttl, rr);
++}
++
++static char* caa_human(struct rr *rrv)
++{
++    RRCAST(caa);
++    char ss[4096];
++    char *s = ss;
++    int l;
++
++    /* incomplete */
++    l = snprintf(s, 4096, "%u", rr->flags);
++    s += l;
++    return quickstrdup_temp(ss);
++}
++
++static struct binary_data caa_wirerdata(struct rr *rrv)
++{
++    RRCAST(caa);
++
++    return compose_binary_data("1dd", 1, rr->flags, rr->tag, rr->value);
++}
++
++/*
++static void *caa_validate(struct rr *rrv)
++{
++    dump_binary_data(stderr, call_get_wired(rrv));
++    return NULL;
++}
++*/
++
++struct rr_methods caa_methods = { caa_parse, caa_human, caa_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/carp.c validns/carp.c
+--- validns-0.8/carp.c	2014-02-11 15:47:14.000000000 -0500
++++ validns/carp.c	2020-10-05 16:59:29.353681351 -0400
+@@ -23,77 +23,77 @@
+ void
+ croak(int exit_code, const char *fmt, ...)
+ {
+-	va_list ap;
+-	va_start(ap, fmt);
+-	v(1, errno, exit_code, fmt, ap);
+-	va_end(ap);
++    va_list ap;
++    va_start(ap, fmt);
++    v(1, errno, exit_code, fmt, ap);
++    va_end(ap);
+ }
+ 
+ void
+ croakx(int exit_code, const char *fmt, ...)
+ {
+-	va_list ap;
+-	va_start(ap, fmt);
+-	v(1, -1, exit_code, fmt, ap);
+-	va_end(ap);
++    va_list ap;
++    va_start(ap, fmt);
++    v(1, -1, exit_code, fmt, ap);
++    va_end(ap);
+ }
+ 
+ void *
+ bitch(const char *fmt, ...)
+ {
+-	va_list ap;
+-	va_start(ap, fmt);
+-	if (!G.opt.no_output) {
+-		fprintf(stderr, "%s:%d: ", file_info->name, file_info->line);
+-		if (fmt != NULL) {
+-			vfprintf(stderr, fmt, ap);
+-		}
+-		fprintf(stderr, "\n");
+-	}
+-	va_end(ap);
+-	G.exit_code = 1;
+-	G.stats.error_count++;
+-	file_info->paren_mode = 0;
+-	if (G.opt.die_on_first_error)
+-		exit(1);
+-	return NULL;
++    va_list ap;
++    va_start(ap, fmt);
++    if (!G.opt.no_output) {
++        fprintf(stderr, "%s:%d: ", file_info->name, file_info->line);
++        if (fmt != NULL) {
++            vfprintf(stderr, fmt, ap);
++        }
++        fprintf(stderr, "\n");
++    }
++    va_end(ap);
++    G.exit_code = 1;
++    G.stats.error_count++;
++    file_info->paren_mode = 0;
++    if (G.opt.die_on_first_error)
++        exit(1);
++    return NULL;
+ }
+ 
+ void *
+ moan(char *file_name, int line, const char *fmt, ...)
+ {
+-	va_list ap;
+-	va_start(ap, fmt);
+-	if (!G.opt.no_output) {
+-		fprintf(stderr, "%s:%d: ", file_name, line);
+-		if (fmt != NULL) {
+-			vfprintf(stderr, fmt, ap);
+-		}
+-		fprintf(stderr, "\n");
+-	}
+-	va_end(ap);
+-	G.exit_code = 1;
+-	G.stats.error_count++;
+-	if (G.opt.die_on_first_error)
+-		exit(1);
+-	return NULL;
++    va_list ap;
++    va_start(ap, fmt);
++    if (!G.opt.no_output) {
++        fprintf(stderr, "%s:%d: ", file_name, line);
++        if (fmt != NULL) {
++            vfprintf(stderr, fmt, ap);
++        }
++        fprintf(stderr, "\n");
++    }
++    va_end(ap);
++    G.exit_code = 1;
++    G.stats.error_count++;
++    if (G.opt.die_on_first_error)
++        exit(1);
++    return NULL;
+ }
+ 
+ void
+ v(int is_croak, int use_errno, int exit_code, const char *fmt, va_list ap)
+ {
+-	fprintf(stderr, "%s: ", thisprogname());
+-	if (fmt != NULL) {
+-		vfprintf(stderr, fmt, ap);
+-		if (use_errno >= 0)
+-			fprintf(stderr, ": ");
+-	}
+-	if (use_errno >= 0)
+-		fprintf(stderr, "%s\n", strerror(use_errno));
+-	else
+-		fprintf(stderr, "\n");
+-	if (is_croak)
+-		exit(exit_code);
++    fprintf(stderr, "%s: ", thisprogname());
++    if (fmt != NULL) {
++        vfprintf(stderr, fmt, ap);
++        if (use_errno >= 0)
++            fprintf(stderr, ": ");
++    }
++    if (use_errno >= 0)
++        fprintf(stderr, "%s\n", strerror(use_errno));
++    else
++        fprintf(stderr, "\n");
++    if (is_croak)
++        exit(exit_code);
+ }
+ 
+ #if defined(__linux__)
+@@ -103,15 +103,15 @@
+ const char *thisprogname(void)
+ {
+ #if defined(__FreeBSD__)
+-	return getprogname();
++    return getprogname();
+ #elif defined(__APPLE__)
+-	return getprogname();
++    return getprogname();
+ #elif defined(__sun__)
+-	return getexecname();
++    return getexecname();
+ #elif defined(__linux__)
+-	if (readlink("/proc/self/exe", proggy, MAXPATHLEN) != -1)
+-		return proggy;
+-	return "";
++    if (readlink("/proc/self/exe", proggy, MAXPATHLEN) != -1)
++        return proggy;
++    return "";
+ #else
+ #error "unsupported OS"
+ #endif
+diff -Naur validns-0.8/cbtree.c validns/cbtree.c
+--- validns-0.8/cbtree.c	2013-04-11 15:38:07.000000000 -0400
++++ validns/cbtree.c	2020-10-05 16:59:29.353681351 -0400
+@@ -24,10 +24,10 @@
+ 
+ struct pool
+ {
+-	struct pool *next;
+-	size_t pool_size;
+-	size_t free_index;
+-	char mem[0];
++    struct pool *next;
++    size_t pool_size;
++    size_t free_index;
++    char mem[0];
+ };
+ 
+ static struct pool *internal = NULL;
+@@ -35,35 +35,35 @@
+ 
+ static int new_pool(struct pool **root, size_t size)
+ {
+-	struct pool *pool;
++    struct pool *pool;
+ 
+-	size = (size + sizeof(void *) - 1) / sizeof(void *);
+-	size *= sizeof(void *);
+-	pool = malloc(size + sizeof(struct pool));
+-	if (!pool) {
+-		return 1;
+-	}
+-	pool->next = *root;
+-	pool->free_index = 0;
+-	pool->pool_size = size;
+-	*root = pool;
+-	return 0;
++    size = (size + sizeof(void *) - 1) / sizeof(void *);
++    size *= sizeof(void *);
++    pool = malloc(size + sizeof(struct pool));
++    if (!pool) {
++        return 1;
++    }
++    pool->next = *root;
++    pool->free_index = 0;
++    pool->pool_size = size;
++    *root = pool;
++    return 0;
+ }
+ 
+ static void *alloc(struct pool **root, size_t size)
+ {
+-	void *ret;
+-	size = (size + sizeof(void *) - 1) / sizeof(void *);
+-	size *= sizeof(void *);
+-	if (!*root)
+-		if (new_pool(root, size > 256000 ? size : 256000) != 0)
+-			return NULL;
+-	if ((*root)->pool_size - (*root)->free_index < size)
+-		if (new_pool(root, size > 256000 ? size : 256000) != 0)
+-			return NULL;
+-	ret = (*root)->mem + (*root)->free_index;
+-	(*root)->free_index += size;
+-	return ret;
++    void *ret;
++    size = (size + sizeof(void *) - 1) / sizeof(void *);
++    size *= sizeof(void *);
++    if (!*root)
++        if (new_pool(root, size > 256000 ? size : 256000) != 0)
++            return NULL;
++    if ((*root)->pool_size - (*root)->free_index < size)
++        if (new_pool(root, size > 256000 ? size : 256000) != 0)
++            return NULL;
++    ret = (*root)->mem + (*root)->free_index;
++    (*root)->free_index += size;
++    return ret;
+ }
+ 
+ /* main code */
+@@ -75,318 +75,318 @@
+     const size_t ulen = strlen(u);
+     uint8_t *p = t->root;
+ 
+-	/* Test for empty tree */
+-	if (!p) return NULL;
++    /* Test for empty tree */
++    if (!p) return NULL;
+ 
+     /* Walk tree for best member */
+-	while (1 & (intptr_t) p) {
+-		struct node *q = (void *)(p - 1);
+-		/* Calculate direction */
+-		int direction;
+-		uint8_t c = 0;
+-
+-		if (q->byte < ulen)
+-			c = ubytes[q->byte];
+-		direction = (1 + (q->otherbits | c)) >> 8;
+-
+-		p = q->child[direction];
+-	}
+-
+-	/* The leaves contain "[data ptr][string]" */
+-	if (strcmp(u, (const char *)(p + sizeof(intptr_t))) == 0)
+-		return (intptr_t *)p;
+-	return NULL;
++    while (1 & (intptr_t) p) {
++        struct node *q = (void *)(p - 1);
++        /* Calculate direction */
++        int direction;
++        uint8_t c = 0;
++
++        if (q->byte < ulen)
++            c = ubytes[q->byte];
++        direction = (1 + (q->otherbits | c)) >> 8;
++
++        p = q->child[direction];
++    }
++
++    /* The leaves contain "[data ptr][string]" */
++    if (strcmp(u, (const char *)(p + sizeof(intptr_t))) == 0)
++        return (intptr_t *)p;
++    return NULL;
+ }
+ 
+ intptr_t*
+ cbtree_insert(struct cbtree *t, const char *u)
+ {
+-	const uint8_t *const ubytes = (void *) u;
+-	const size_t ulen = strlen(u);
+-	uint8_t *p = t->root;
+-
+-	/* Deal with inserting into an empty tree */
+-	if (!p) {
+-		char *x = alloc(&external, ulen + 1 + sizeof(intptr_t));
+-		if (!x)
+-			return NULL;
+-		*((intptr_t *)x) = 0;
+-		memcpy(x + sizeof(intptr_t), u, ulen + 1);
+-		t->root = x;
+-		return (intptr_t *)x;
+-	}
++    const uint8_t *const ubytes = (void *) u;
++    const size_t ulen = strlen(u);
++    uint8_t *p = t->root;
++
++    /* Deal with inserting into an empty tree */
++    if (!p) {
++        char *x = alloc(&external, ulen + 1 + sizeof(intptr_t));
++        if (!x)
++            return NULL;
++        *((intptr_t *)x) = 0;
++        memcpy(x + sizeof(intptr_t), u, ulen + 1);
++        t->root = x;
++        return (intptr_t *)x;
++    }
+ 
+     /* Walk tree for best member */
+-	while (1 & (intptr_t) p) {
+-		struct node *q = (void *)(p - 1);
+-		/* Calculate direction */
+-		int direction;
+-		uint8_t c = 0;
+-
+-		if (q->byte < ulen)
+-			c = ubytes[q->byte];
+-		direction = (1 + (q->otherbits | c)) >> 8;
+-
+-		p = q->child[direction];
+-	}
+-
+-	/* Find the critical bit */
+-	/* 1: Find differing byte */
+-	uint32_t newbyte;
+-	uint32_t newotherbits;
+-
+-	for (newbyte = 0; newbyte < ulen; ++newbyte) {
+-		if (p[sizeof(intptr_t) + newbyte] != ubytes[newbyte]) {
+-			newotherbits = p[sizeof(intptr_t) + newbyte] ^ ubytes[newbyte];
+-			goto different_byte_found;
+-		}
+-	}
+-
+-	if (p[sizeof(intptr_t) + newbyte] != 0) {
+-		newotherbits = p[sizeof(intptr_t) + newbyte];
+-		goto different_byte_found;
+-	}
+-	return (intptr_t *)p;
++    while (1 & (intptr_t) p) {
++        struct node *q = (void *)(p - 1);
++        /* Calculate direction */
++        int direction;
++        uint8_t c = 0;
++
++        if (q->byte < ulen)
++            c = ubytes[q->byte];
++        direction = (1 + (q->otherbits | c)) >> 8;
++
++        p = q->child[direction];
++    }
++
++    /* Find the critical bit */
++    /* 1: Find differing byte */
++    uint32_t newbyte;
++    uint32_t newotherbits;
++
++    for (newbyte = 0; newbyte < ulen; ++newbyte) {
++        if (p[sizeof(intptr_t) + newbyte] != ubytes[newbyte]) {
++            newotherbits = p[sizeof(intptr_t) + newbyte] ^ ubytes[newbyte];
++            goto different_byte_found;
++        }
++    }
++
++    if (p[sizeof(intptr_t) + newbyte] != 0) {
++        newotherbits = p[sizeof(intptr_t) + newbyte];
++        goto different_byte_found;
++    }
++    return (intptr_t *)p;
+ 
+ different_byte_found:
+ 
+-	/* 2: Find differing bit */
+-	newotherbits |= newotherbits >> 1;
+-	newotherbits |= newotherbits >> 2;
+-	newotherbits |= newotherbits >> 4;
+-	newotherbits = (newotherbits & ~(newotherbits >> 1)) ^ 255;
+-	uint8_t c = p[sizeof(intptr_t) + newbyte];
+-	int newdirection = (1 + (newotherbits | c)) >> 8;
+-
+-	/* Insert new string */
+-
+-	/* 1: Allocate new node structure */
+-	struct node *newnode;
+-
+-	newnode = alloc(&internal, sizeof(struct node));
+-	if (!newnode)
+-		return NULL;
+-
+-	char *x = alloc(&external, ulen + 1 + sizeof(intptr_t));
+-	if (!x)
+-		return NULL;
+-	*((intptr_t *)x) = 0;
+-	memcpy(x + sizeof(intptr_t), ubytes, ulen + 1);
+-
+-	newnode->byte = newbyte;
+-	newnode->otherbits = newotherbits;
+-	newnode->child[1 - newdirection] = x;
+-
+-	/* 2: Insert new node */
+-	void **wherep = &t->root;
+-	for (;;) {
+-		uint8_t *p = *wherep;
+-		if (!(1 & (intptr_t) p)) break;
+-		struct node *q = (void *) (p - 1);
+-		if (q->byte > newbyte) break;
+-		if (q->byte == newbyte && q->otherbits > newotherbits) break;
+-		uint8_t c = 0;
+-		if (q->byte < ulen) c = ubytes[q->byte];
+-		const int direction = (1 + (q->otherbits | c)) >> 8;
+-		wherep = q->child + direction;
+-	}
++    /* 2: Find differing bit */
++    newotherbits |= newotherbits >> 1;
++    newotherbits |= newotherbits >> 2;
++    newotherbits |= newotherbits >> 4;
++    newotherbits = (newotherbits & ~(newotherbits >> 1)) ^ 255;
++    uint8_t c = p[sizeof(intptr_t) + newbyte];
++    int newdirection = (1 + (newotherbits | c)) >> 8;
++
++    /* Insert new string */
++
++    /* 1: Allocate new node structure */
++    struct node *newnode;
++
++    newnode = alloc(&internal, sizeof(struct node));
++    if (!newnode)
++        return NULL;
++
++    char *x = alloc(&external, ulen + 1 + sizeof(intptr_t));
++    if (!x)
++        return NULL;
++    *((intptr_t *)x) = 0;
++    memcpy(x + sizeof(intptr_t), ubytes, ulen + 1);
++
++    newnode->byte = newbyte;
++    newnode->otherbits = newotherbits;
++    newnode->child[1 - newdirection] = x;
++
++    /* 2: Insert new node */
++    void **wherep = &t->root;
++    for (;;) {
++        uint8_t *p = *wherep;
++        if (!(1 & (intptr_t) p)) break;
++        struct node *q = (void *) (p - 1);
++        if (q->byte > newbyte) break;
++        if (q->byte == newbyte && q->otherbits > newotherbits) break;
++        uint8_t c = 0;
++        if (q->byte < ulen) c = ubytes[q->byte];
++        const int direction = (1 + (q->otherbits | c)) >> 8;
++        wherep = q->child + direction;
++    }
+ 
+-	newnode->child[newdirection] = *wherep;
+-	*wherep = (void *) (1 + (char *) newnode);
++    newnode->child[newdirection] = *wherep;
++    *wherep = (void *) (1 + (char *) newnode);
+ 
+-	return (intptr_t *)x;
++    return (intptr_t *)x;
+ }
+ 
+ intptr_t
+ cbtree_delete(struct cbtree *t, const char *u)
+ {
+-	const uint8_t *ubytes = (void *) u;
+-	const size_t ulen = strlen(u);
+-	uint8_t *p = t->root;
+-	void **wherep = &t->root;
+-	void **whereq = 0;
+-	struct node *q = 0;
+-	int direction = 0;
+-	intptr_t ret;
+-
+-	/* Deal with deleting from an empty tree */
+-	if (!p) return 0;
+-
+-	/* Walk the tree for the best match */
+-	while (1 & (intptr_t) p) {
+-		whereq = wherep;
+-		q = (void *) (p - 1);
+-		uint8_t c = 0;
+-		if (q->byte < ulen) c = ubytes[q->byte];
+-		direction = (1 + (q->otherbits | c)) >> 8;
+-		wherep = q->child + direction;
+-		p = *wherep;
+-	}
+-
+-	/* Check the best match */
+-	if (0 != strcmp(u, (const char *)(p + sizeof(intptr_t))))
+-		return 0;
+-	ret = *((intptr_t *)p);
+-
+-	/* Remove the element and/or node */
+-	if (!whereq) {
+-		t->root = 0;
+-		return ret;
+-	}
++    const uint8_t *ubytes = (void *) u;
++    const size_t ulen = strlen(u);
++    uint8_t *p = t->root;
++    void **wherep = &t->root;
++    void **whereq = 0;
++    struct node *q = 0;
++    int direction = 0;
++    intptr_t ret;
++
++    /* Deal with deleting from an empty tree */
++    if (!p) return 0;
++
++    /* Walk the tree for the best match */
++    while (1 & (intptr_t) p) {
++        whereq = wherep;
++        q = (void *) (p - 1);
++        uint8_t c = 0;
++        if (q->byte < ulen) c = ubytes[q->byte];
++        direction = (1 + (q->otherbits | c)) >> 8;
++        wherep = q->child + direction;
++        p = *wherep;
++    }
++
++    /* Check the best match */
++    if (0 != strcmp(u, (const char *)(p + sizeof(intptr_t))))
++        return 0;
++    ret = *((intptr_t *)p);
++
++    /* Remove the element and/or node */
++    if (!whereq) {
++        t->root = 0;
++        return ret;
++    }
+ 
+-	*whereq = q->child[1 - direction];
+-	// free(q);
++    *whereq = q->child[1 - direction];
++    // free(q);
+ 
+-	return ret;
++    return ret;
+ }
+ 
+ static void
+ traverse(void *top) {
+-	uint8_t *p = top;
++    uint8_t *p = top;
+ 
+-	if (1 & (intptr_t) p) {
+-		struct node *q = (void *) (p - 1);
+-		traverse(q->child[0]);
+-		traverse(q->child[1]);
+-		// free(q);
+-	} else {
+-		// free(p);
+-	}
++    if (1 & (intptr_t) p) {
++        struct node *q = (void *) (p - 1);
++        traverse(q->child[0]);
++        traverse(q->child[1]);
++        // free(q);
++    } else {
++        // free(p);
++    }
+ }
+ 
+ void
+ cbtree_clear(struct cbtree *t)
+ {
+-	if (t->root) traverse(t->root);
+-	t->root = NULL;
++    if (t->root) traverse(t->root);
++    t->root = NULL;
+ }
+ 
+ static int
+ allprefixed_traverse(uint8_t *top, int (*handle)(const char *, intptr_t *, void *), void *arg)
+ {
+-	int direction;
++    int direction;
+ 
+-	/* Deal with an internal node */
+-	if (1 & (intptr_t) top) {
+-		struct node *q = (void *) (top - 1);
+-		for (direction = 0; direction < 2; ++direction)
+-			switch(allprefixed_traverse(q->child[direction], handle, arg)) {
+-			case 1: break;
+-			case 0: return 0;
+-			default: return -1;
+-			}
+-		return 1;
+-	}
++    /* Deal with an internal node */
++    if (1 & (intptr_t) top) {
++        struct node *q = (void *) (top - 1);
++        for (direction = 0; direction < 2; ++direction)
++            switch(allprefixed_traverse(q->child[direction], handle, arg)) {
++            case 1: break;
++            case 0: return 0;
++            default: return -1;
++            }
++        return 1;
++    }
+ 
+-	/* Deal with an external node */
+-	return handle((const char *)(top + sizeof(intptr_t)), (intptr_t *)top, arg);
++    /* Deal with an external node */
++    return handle((const char *)(top + sizeof(intptr_t)), (intptr_t *)top, arg);
+ }
+ 
+ int
+ cbtree_allprefixed(struct cbtree *t, const char *prefix,
+-				   int (*handle)(const char *, intptr_t *, void *),
+-				   void *arg)
++                   int (*handle)(const char *, intptr_t *, void *),
++                   void *arg)
+ {
+-	const uint8_t *ubytes = (void *) prefix;
+-	const size_t ulen = strlen(prefix);
+-	uint8_t *p = t->root;
+-	uint8_t *top = p;
+-	int i;
+-
+-	if (!p) return 1; /* S = $\emptyset$ */
+-
+-	/* Walk tree, maintaining top pointer */
+-	while (1 & (intptr_t) p) {
+-		struct node *q = (void *) (p - 1);
+-		uint8_t c = 0;
+-		if (q->byte < ulen) c = ubytes[q->byte];
+-		const int direction = (1 + (q->otherbits | c)) >> 8;
+-		p = q->child[direction];
+-		if (q->byte < ulen) top = p;
+-	}
+-
+-	/* Check prefix */
+-	for (i = 0; i < ulen; ++i) {
+-		if (p[i+sizeof(intptr_t)] != ubytes[i]) return 1;
+-	}
++    const uint8_t *ubytes = (void *) prefix;
++    const size_t ulen = strlen(prefix);
++    uint8_t *p = t->root;
++    uint8_t *top = p;
++    int i;
+ 
+-	return allprefixed_traverse(top, handle, arg);
++    if (!p) return 1; /* S = $\emptyset$ */
++
++    /* Walk tree, maintaining top pointer */
++    while (1 & (intptr_t) p) {
++        struct node *q = (void *) (p - 1);
++        uint8_t c = 0;
++        if (q->byte < ulen) c = ubytes[q->byte];
++        const int direction = (1 + (q->otherbits | c)) >> 8;
++        p = q->child[direction];
++        if (q->byte < ulen) top = p;
++    }
++
++    /* Check prefix */
++    for (i = 0; i < ulen; ++i) {
++        if (p[i+sizeof(intptr_t)] != ubytes[i]) return 1;
++    }
++
++    return allprefixed_traverse(top, handle, arg);
+ }
+ 
+ static const char *byte_to_binary(int x)
+ {
+-	static char b[9];
+-	int z;
++    static char b[9];
++    int z;
+ 
+-	b[0] = '\0';
+-	for (z = 128; z > 0; z >>= 1)
+-		strcat(b, ((x & z) == z) ? "1" : "0");
++    b[0] = '\0';
++    for (z = 128; z > 0; z >>= 1)
++        strcat(b, ((x & z) == z) ? "1" : "0");
+ 
+-	return b;
++    return b;
+ }
+ 
+ static void
+ traverse_dump(void *top, int level, int byte)
+ {
+-	uint8_t *p = top;
+-	int i;
++    uint8_t *p = top;
++    int i;
+ 
+-	for (i = 0; i < level; i++) printf(" ");
+-	if (1 & (intptr_t) p) {
+-		struct node *q = (void *) (p - 1);
+-		printf("[byte(%d),otherbits(%s)]\n", q->byte, byte_to_binary(q->otherbits));
+-		traverse_dump(q->child[0], level + 1, q->byte);
+-		traverse_dump(q->child[1], level + 1, q->byte);
+-	} else {
+-		const size_t ulen = strlen((char *)(p + sizeof(intptr_t)));
+-		int c = byte < ulen ? p[sizeof(intptr_t) + byte] : 0;
+-		printf("\"%s\" (%s)\n", p + sizeof(intptr_t), byte_to_binary(c));
+-	}
++    for (i = 0; i < level; i++) printf(" ");
++    if (1 & (intptr_t) p) {
++        struct node *q = (void *) (p - 1);
++        printf("[byte(%d),otherbits(%s)]\n", q->byte, byte_to_binary(q->otherbits));
++        traverse_dump(q->child[0], level + 1, q->byte);
++        traverse_dump(q->child[1], level + 1, q->byte);
++    } else {
++        const size_t ulen = strlen((char *)(p + sizeof(intptr_t)));
++        int c = byte < ulen ? p[sizeof(intptr_t) + byte] : 0;
++        printf("\"%s\" (%s)\n", p + sizeof(intptr_t), byte_to_binary(c));
++    }
+ }
+ 
+ void
+ cbtree_dump(struct cbtree *t)
+ {
+-	if (t->root)
+-		traverse_dump(t->root, 0, 0);
+-	printf("\n");
++    if (t->root)
++        traverse_dump(t->root, 0, 0);
++    printf("\n");
+ }
+ 
+ char*
+ cbtree_next(struct cbtree *t, const char *u, intptr_t *data)
+ {
+-	const uint8_t *ubytes = (void *) u;
+-	const size_t ulen = strlen(u);
+-	uint8_t *p = t->root;
+-	uint8_t *branch = NULL;
+-
+-	if (!p) return NULL;
+-
+-	/* Walk tree, maintaining top pointer */
+-	while (1 & (intptr_t) p) {
+-		struct node *q = (void *) (p - 1);
+-		uint8_t c = 0;
+-		if (q->byte < ulen) c = ubytes[q->byte];
+-		const int direction = (1 + (q->otherbits | c)) >> 8;
+-		if (direction == 0)
+-			branch = q->child[1];
+-		p = q->child[direction];
+-	}
+-
+-	/* check whether what we found is what we are looking for already */
+-	if (strcmp((char *)(p + sizeof(intptr_t)), u) > 0) {
+-		if (data) *data = *((intptr_t *)p);
+-		return (char *)(p + sizeof(intptr_t));
+-	}
+-
+-	if (!branch) return NULL;
+-
+-	/* select the lowest value on the branch */
+-	p = branch;
+-	while (1 & (intptr_t) p) {
+-		struct node *q = (void *) (p - 1);
+-		p = q->child[0];
+-	}
+-	if (data) *data = *((intptr_t *)p);
+-	return (char *)(p + sizeof(intptr_t));
++    const uint8_t *ubytes = (void *) u;
++    const size_t ulen = strlen(u);
++    uint8_t *p = t->root;
++    uint8_t *branch = NULL;
++
++    if (!p) return NULL;
++
++    /* Walk tree, maintaining top pointer */
++    while (1 & (intptr_t) p) {
++        struct node *q = (void *) (p - 1);
++        uint8_t c = 0;
++        if (q->byte < ulen) c = ubytes[q->byte];
++        const int direction = (1 + (q->otherbits | c)) >> 8;
++        if (direction == 0)
++            branch = q->child[1];
++        p = q->child[direction];
++    }
++
++    /* check whether what we found is what we are looking for already */
++    if (strcmp((char *)(p + sizeof(intptr_t)), u) > 0) {
++        if (data) *data = *((intptr_t *)p);
++        return (char *)(p + sizeof(intptr_t));
++    }
++
++    if (!branch) return NULL;
++
++    /* select the lowest value on the branch */
++    p = branch;
++    while (1 & (intptr_t) p) {
++        struct node *q = (void *) (p - 1);
++        p = q->child[0];
++    }
++    if (data) *data = *((intptr_t *)p);
++    return (char *)(p + sizeof(intptr_t));
+ }
+diff -Naur validns-0.8/cbtree.h validns/cbtree.h
+--- validns-0.8/cbtree.h	2013-04-11 15:38:07.000000000 -0400
++++ validns/cbtree.h	2020-10-05 16:59:29.353681351 -0400
+@@ -47,8 +47,8 @@
+ void cbtree_clear(struct cbtree *t);
+ 
+ int cbtree_allprefixed(struct cbtree *t, const char *prefix,
+-					   int (*handle)(const char *, intptr_t *, void *),
+-					   void *arg);
++                       int (*handle)(const char *, intptr_t *, void *),
++                       void *arg);
+ 
+ void cbtree_dump(struct cbtree *t);
+ 
+diff -Naur validns-0.8/cert.c validns/cert.c
+--- validns-0.8/cert.c	2014-02-11 15:46:12.000000000 -0500
++++ validns/cert.c	2020-10-05 16:59:29.353681351 -0400
+@@ -26,115 +26,115 @@
+ 
+ static int extract_certificate_type(char **s, char *what)
+ {
+-	int type;
+-	char *str_type;
++    int type;
++    char *str_type;
+ 
+-	if (isdigit(**s)) {
+-		type = extract_integer(s, what);
+-		if (type >= 1 && type <= 8)
+-			return type;
+-		if (type == 253 || type == 254)
+-			return type;
+-		if (type >= 65280 && type <= 65534)
+-			return type;
+-		if (type < 0 || type > 65535) {
+-			bitch("bad certificate type %d", type);
+-			return -1;
+-		}
+-		if (type == 0 || type == 255 || type == 65535) {
+-			bitch("certificate type %d is reserved by IANA", type);
+-			return -1;
+-		}
+-		bitch("certificate type %d is unassigned", type);
+-		return -1;
+-	} else {
+-		str_type = extract_label(s, what, "temporary");
+-		if (!str_type) return -1;
+-		if (strcmp(str_type, "pkix") == 0)
+-			return 1;
+-		if (strcmp(str_type, "spki") == 0)
+-			return 2;
+-		if (strcmp(str_type, "pgp") == 0)
+-			return 3;
+-		if (strcmp(str_type, "ipkix") == 0)
+-			return 4;
+-		if (strcmp(str_type, "ispki") == 0)
+-			return 5;
+-		if (strcmp(str_type, "ipgp") == 0)
+-			return 6;
+-		if (strcmp(str_type, "acpkix") == 0)
+-			return 7;
+-		if (strcmp(str_type, "iacpkix") == 0)
+-			return 8;
+-		if (strcmp(str_type, "uri") == 0)
+-			return 253;
+-		if (strcmp(str_type, "oid") == 0)
+-			return 254;
+-		bitch("bad certificate type %s", str_type);
+-		return -1;
+-	}
++    if (isdigit(**s)) {
++        type = extract_integer(s, what, NULL);
++        if (type >= 1 && type <= 8)
++            return type;
++        if (type == 253 || type == 254)
++            return type;
++        if (type >= 65280 && type <= 65534)
++            return type;
++        if (type < 0 || type > 65535) {
++            bitch("bad certificate type %d", type);
++            return -1;
++        }
++        if (type == 0 || type == 255 || type == 65535) {
++            bitch("certificate type %d is reserved by IANA", type);
++            return -1;
++        }
++        bitch("certificate type %d is unassigned", type);
++        return -1;
++    } else {
++        str_type = extract_label(s, what, "temporary");
++        if (!str_type) return -1;
++        if (strcmp(str_type, "pkix") == 0)
++            return 1;
++        if (strcmp(str_type, "spki") == 0)
++            return 2;
++        if (strcmp(str_type, "pgp") == 0)
++            return 3;
++        if (strcmp(str_type, "ipkix") == 0)
++            return 4;
++        if (strcmp(str_type, "ispki") == 0)
++            return 5;
++        if (strcmp(str_type, "ipgp") == 0)
++            return 6;
++        if (strcmp(str_type, "acpkix") == 0)
++            return 7;
++        if (strcmp(str_type, "iacpkix") == 0)
++            return 8;
++        if (strcmp(str_type, "uri") == 0)
++            return 253;
++        if (strcmp(str_type, "oid") == 0)
++            return 254;
++        bitch("bad certificate type %s", str_type);
++        return -1;
++    }
+ }
+ 
+ static struct rr* cert_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_cert *rr = getmem(sizeof(*rr));
+-	int cert_type, key_tag, alg;
++    struct rr_cert *rr = getmem(sizeof(*rr));
++    int cert_type, key_tag, alg;
+ 
+-	cert_type = extract_certificate_type(&s, "certificate type");
+-	if (cert_type < 0)	return NULL;
+-	rr->type = cert_type;
+-
+-	key_tag = extract_integer(&s, "key tag");
+-	if (key_tag < 0)	return NULL;
+-	if (key_tag > 65535)
+-		return bitch("bad key tag");
+-	rr->key_tag = key_tag;
+-
+-	if (isdigit(*s)) {
+-		alg = extract_integer(&s, "algorithm");
+-		if (alg < 0)	return NULL;
+-		if (alg > 255)	return bitch("bad algorithm");
+-		if (alg != 0) {  /* 0 is just fine */
+-			if (algorithm_type(alg) == ALG_UNSUPPORTED)
+-				return bitch("bad algorithm %d", alg);
+-		}
+-	} else {
+-		alg = extract_algorithm(&s, "algorithm");
+-		if (alg == ALG_UNSUPPORTED)	return NULL;
+-	}
+-	rr->algorithm = alg;
+-
+-	if (alg == 0 && key_tag != 0) {
+-		/* we might want to bitch here, but RFC says "SHOULD", so we don't */
+-	}
+-
+-	rr->certificate = extract_base64_binary_data(&s, "certificate");
+-	if (rr->certificate.length < 0)	return NULL;
+-	/* TODO validate cert length based on algorithm */
+-
+-	if (*s) {
+-		return bitch("garbage after valid CERT data");
+-	}
+-	return store_record(type, name, ttl, rr);
++    cert_type = extract_certificate_type(&s, "certificate type");
++    if (cert_type < 0)  return NULL;
++    rr->type = cert_type;
++
++    key_tag = extract_integer(&s, "key tag", NULL);
++    if (key_tag < 0)    return NULL;
++    if (key_tag > 65535)
++        return bitch("bad key tag");
++    rr->key_tag = key_tag;
++
++    if (isdigit(*s)) {
++        alg = extract_integer(&s, "algorithm", NULL);
++        if (alg < 0)    return NULL;
++        if (alg > 255)  return bitch("bad algorithm");
++        if (alg != 0) {  /* 0 is just fine */
++            if (algorithm_type(alg) == ALG_UNSUPPORTED)
++                return bitch("bad algorithm %d", alg);
++        }
++    } else {
++        alg = extract_algorithm(&s, "algorithm");
++        if (alg == ALG_UNSUPPORTED) return NULL;
++    }
++    rr->algorithm = alg;
++
++    if (alg == 0 && key_tag != 0) {
++        /* we might want to bitch here, but RFC says "SHOULD", so we don't */
++    }
++
++    rr->certificate = extract_base64_binary_data(&s, "certificate");
++    if (rr->certificate.length < 0) return NULL;
++    /* TODO validate cert length based on algorithm */
++
++    if (*s) {
++        return bitch("garbage after valid CERT data");
++    }
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* cert_human(struct rr *rrv)
+ {
+-	RRCAST(cert);
++    RRCAST(cert);
+     char s[1024];
+ 
+     snprintf(s, 1024, "%d %d %d ...",
+-		rr->type, rr->key_tag, rr->algorithm);
++        rr->type, rr->key_tag, rr->algorithm);
+     return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data cert_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(cert);
++    RRCAST(cert);
+ 
+-	return compose_binary_data("221d", 1,
+-		rr->type, rr->key_tag, rr->algorithm,
+-		rr->certificate);
++    return compose_binary_data("221d", 1,
++        rr->type, rr->key_tag, rr->algorithm,
++        rr->certificate);
+ }
+ 
+ struct rr_methods cert_methods = { cert_parse, cert_human, cert_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/cname.c validns/cname.c
+--- validns-0.8/cname.c	2014-02-11 15:46:59.000000000 -0500
++++ validns/cname.c	2020-10-05 16:59:29.353681351 -0400
+@@ -19,58 +19,58 @@
+ 
+ static struct rr *cname_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_cname *rr = getmem(sizeof(*rr));
++    struct rr_cname *rr = getmem(sizeof(*rr));
+ 
+-	rr->cname = extract_name(&s, "cname", 0);
+-	if (!rr->cname)
+-		return NULL;
+-	if (*s) {
+-		return bitch("garbage after valid CNAME data");
+-	}
++    rr->cname = extract_name(&s, "cname", 0);
++    if (!rr->cname)
++        return NULL;
++    if (*s) {
++        return bitch("garbage after valid CNAME data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* cname_human(struct rr *rrv)
+ {
+-	RRCAST(cname);
++    RRCAST(cname);
+     return rr->cname;
+ }
+ 
+ static struct binary_data cname_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(cname);
+-	return name2wire_name(rr->cname);
++    RRCAST(cname);
++    return name2wire_name(rr->cname);
+ }
+ 
+ static void* cname_validate_set(struct rr_set *rr_set)
+ {
+-	struct rr *rr;
+-	struct rr_set *another_set;
+-	struct named_rr *named_rr;
+-	int count;
+-
+-	if (G.opt.policy_checks[POLICY_CNAME_OTHER_DATA]) {
+-		if (rr_set->count > 1) {
+-			rr = rr_set->tail;
+-			return moan(rr->file_name, rr->line, "CNAME and other data");
+-		}
+-		named_rr = rr_set->named_rr;
+-		count = get_rr_set_count(named_rr);
+-		if (count > 1) {
+-			another_set = find_rr_set_in_named_rr(named_rr, T_RRSIG);
+-			if (another_set)
+-				count -= another_set->count;
+-			another_set = find_rr_set_in_named_rr(named_rr, T_NSEC);
+-			if (another_set)
+-				count -= another_set->count;
+-			if (count > 1) {
+-				rr = rr_set->tail;
+-				return moan(rr->file_name, rr->line, "CNAME and other data");
+-			}
+-		}
+-	}
+-	return NULL;
++    struct rr *rr;
++    struct rr_set *another_set;
++    struct named_rr *named_rr;
++    int count;
++
++    if (G.opt.policy_checks[POLICY_CNAME_OTHER_DATA]) {
++        if (rr_set->count > 1) {
++            rr = rr_set->tail;
++            return moan(rr->file_name, rr->line, "CNAME and other data");
++        }
++        named_rr = rr_set->named_rr;
++        count = get_rr_set_count(named_rr);
++        if (count > 1) {
++            another_set = find_rr_set_in_named_rr(named_rr, T_RRSIG);
++            if (another_set)
++                count -= another_set->count;
++            another_set = find_rr_set_in_named_rr(named_rr, T_NSEC);
++            if (another_set)
++                count -= another_set->count;
++            if (count > 1) {
++                rr = rr_set->tail;
++                return moan(rr->file_name, rr->line, "CNAME and other data");
++            }
++        }
++    }
++    return NULL;
+ }
+ 
+ struct rr_methods cname_methods = { cname_parse, cname_human, cname_wirerdata, cname_validate_set, NULL };
+diff -Naur validns-0.8/common.h validns/common.h
+--- validns-0.8/common.h	2020-10-05 16:54:14.346790446 -0400
++++ validns/common.h	2020-10-05 16:59:29.353681351 -0400
+@@ -9,19 +9,37 @@
+ #ifndef _COMMON_H_
+ #define _COMMON_H_ 1
+ 
++struct generate_template_piece;
++struct generate_template_piece
++{
++    char *constant_string;
++    struct generate_template_piece *next;
++};
++
++#define LINEBUFSZ 2048
++
+ struct file_info
+ {
+-	struct file_info *next;
+-	FILE *file;
+-	int  line;
+-	int  paren_mode;
+-	char buf[2048];
+-	char name[0];
++    struct file_info *next;
++    FILE *file;
++    int  line;
++    int  paren_mode;
++    char buf[LINEBUFSZ];
++    char *current_origin;
++
++    int generate_cur;
++    int generate_lim;
++    char *generate_type;
++    struct generate_template_piece *generate_lhs;
++    struct generate_template_piece *generate_rhs;
++
++    /* must be last struct member */
++    char name[0];
+ };
+ 
+ extern struct file_info *file_info;
+ 
+-#define N_POLICY_CHECKS 9
++#define N_POLICY_CHECKS 11
+ 
+ #define POLICY_SINGLE_NS 0
+ #define POLICY_CNAME_OTHER_DATA 1
+@@ -32,41 +50,44 @@
+ #define POLICY_DNAME 6
+ #define POLICY_DNSKEY 7
+ #define POLICY_TLSA_HOST 8
++#define POLICY_KSK_EXISTS 9
++#define POLICY_SMIMEA_HOST 10
+ 
+ #define MAX_TIMES_TO_CHECK 32
+ 
+ struct globals {
+-	struct stats {
+-		int names_count;
+-		int rr_count;
+-		int rrset_count;
+-		int error_count;
+-		int skipped_dup_rr_count;
+-		int soa_rr_count;
+-		int signatures_verified;
+-		int delegations;
+-		int not_authoritative;
+-		int nsec3_count;
+-	} stats;
+-	struct command_line_options
+-	{
+-		int die_on_first_error;
+-		int no_output;
+-		int summary;
+-		int notiming;
+-		int verbose;
+-		char *include_path;
+-		char *current_origin;
+-		int n_times_to_check;
+-		uint32_t times_to_check[MAX_TIMES_TO_CHECK];
+-		char policy_checks[N_POLICY_CHECKS];
+-		int n_threads;
+-	} opt;
+-	int exit_code;
+-	long default_ttl;
+-	int nsec3_present;
+-	int nsec3_opt_out_present;
+-	int dnssec_active;
++    struct stats {
++        int names_count;
++        int rr_count;
++        int rrset_count;
++        int error_count;
++        int skipped_dup_rr_count;
++        int soa_rr_count;
++        int signatures_verified;
++        int delegations;
++        int not_authoritative;
++        int nsec3_count;
++    } stats;
++    struct command_line_options
++    {
++        int die_on_first_error;
++        int no_output;
++        int summary;
++        int verbose;
++        char *include_path;
++        int include_path_specified;
++        char *first_origin;
++        int n_times_to_check;
++        uint32_t times_to_check[MAX_TIMES_TO_CHECK];
++        char policy_checks[N_POLICY_CHECKS];
++        int n_threads;
++        int soa_minttl_as_default_ttl;
++    } opt;
++    int exit_code;
++    long default_ttl;
++    int nsec3_present;
++    int nsec3_opt_out_present;
++    int dnssec_active;
+ };
+ 
+ extern struct globals G;
+diff -Naur validns-0.8/dhcid.c validns/dhcid.c
+--- validns-0.8/dhcid.c	2014-02-11 15:46:29.000000000 -0500
++++ validns/dhcid.c	2020-10-05 16:59:29.354681360 -0400
+@@ -21,35 +21,35 @@
+ 
+ static struct rr* dhcid_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_dhcid *rr = getmem(sizeof(*rr));
+-	struct binary_data data;
++    struct rr_dhcid *rr = getmem(sizeof(*rr));
++    struct binary_data data;
+ 
+-	data = extract_base64_binary_data(&s, "rdata");
+-	if (data.length < 0)	return NULL;
++    data = extract_base64_binary_data(&s, "rdata");
++    if (data.length < 0)    return NULL;
+ 
+-	if (data.length < 3)
+-		return bitch("rdata too short");
++    if (data.length < 3)
++        return bitch("rdata too short");
+ 
+-	rr->id_type = data.data[0]*256 + data.data[1];
+-	if (rr->id_type > 2)
+-		return bitch("unsupported identifier type %s", rr->id_type);
+-
+-	rr->digest_type = data.data[2];
+-	if (rr->digest_type != 1)
+-		return bitch("unsupported digest type %s", rr->digest_type);
+-
+-	if (data.length != 35)
+-		return bitch("wrong digest length, must be 32 for SHA-256");
+-
+-	/* let's cheat a bit */
+-	data.length -= 3;
+-	data.data += 3;
+-	rr->digest = data;
+-
+-	if (*s) {
+-		return bitch("garbage after valid DHCID data");
+-	}
+-	return store_record(type, name, ttl, rr);
++    rr->id_type = data.data[0]*256 + data.data[1];
++    if (rr->id_type > 2)
++        return bitch("unsupported identifier type %s", rr->id_type);
++
++    rr->digest_type = data.data[2];
++    if (rr->digest_type != 1)
++        return bitch("unsupported digest type %s", rr->digest_type);
++
++    if (data.length != 35)
++        return bitch("wrong digest length, must be 32 for SHA-256");
++
++    /* let's cheat a bit */
++    data.length -= 3;
++    data.data += 3;
++    rr->digest = data;
++
++    if (*s) {
++        return bitch("garbage after valid DHCID data");
++    }
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* dhcid_human(struct rr *rrv)
+@@ -59,10 +59,10 @@
+ 
+ static struct binary_data dhcid_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(dhcid);
++    RRCAST(dhcid);
+ 
+-	return compose_binary_data("21d", 1,
+-		rr->id_type, rr->digest_type, rr->digest);
++    return compose_binary_data("21d", 1,
++        rr->id_type, rr->digest_type, rr->digest);
+ }
+ 
+ struct rr_methods dhcid_methods = { dhcid_parse, dhcid_human, dhcid_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/dlv.c validns/dlv.c
+--- validns-0.8/dlv.c	2014-02-11 15:46:32.000000000 -0500
++++ validns/dlv.c	2020-10-05 16:59:29.354681360 -0400
+@@ -19,80 +19,80 @@
+ 
+ static struct rr* dlv_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_dlv *rr = getmem(sizeof(*rr));
+-	int key_tag, algorithm, digest_type;
++    struct rr_dlv *rr = getmem(sizeof(*rr));
++    int key_tag, algorithm, digest_type;
+ 
+-	key_tag = extract_integer(&s, "key tag");
+-	if (key_tag < 0)	return NULL;
+-	rr->key_tag = key_tag;
+-
+-	algorithm = extract_algorithm(&s, "algorithm");
+-	if (algorithm == ALG_UNSUPPORTED)	return NULL;
+-	rr->algorithm = algorithm;
+-
+-	digest_type = extract_integer(&s, "digest type");
+-	if (digest_type < 0)	return NULL;
+-	rr->digest_type = digest_type;
+-
+-	rr->digest = extract_hex_binary_data(&s, "digest", EXTRACT_EAT_WHITESPACE);
+-	if (rr->digest.length < 0)	return NULL;
+-
+-	switch (digest_type) {
+-	case 1:
+-		if (rr->digest.length != SHA1_BYTES) {
+-			return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES);
+-		}
+-		break;
+-	case 2:
+-		if (rr->digest.length != SHA256_BYTES) {
+-			return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES);
+-		}
+-		break;
+-	case 3:
+-		if (rr->digest.length != GOST_BYTES) {
+-			return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES);
+-		}
+-		break;
+-	case 4:
+-		if (rr->digest.length != SHA384_BYTES) {
+-			return bitch("wrong SHA-384 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA384_BYTES);
+-		}
+-		break;
+-	default:
+-		return bitch("bad or unsupported digest type %d", digest_type);
+-	}
+-
+-	if (*s) {
+-		return bitch("garbage after valid DLV data");
+-	}
+-	G.dnssec_active = 1;
+-	return store_record(type, name, ttl, rr);
++    key_tag = extract_integer(&s, "key tag", NULL);
++    if (key_tag < 0)    return NULL;
++    rr->key_tag = key_tag;
++
++    algorithm = extract_algorithm(&s, "algorithm");
++    if (algorithm == ALG_UNSUPPORTED)   return NULL;
++    rr->algorithm = algorithm;
++
++    digest_type = extract_integer(&s, "digest type", NULL);
++    if (digest_type < 0)    return NULL;
++    rr->digest_type = digest_type;
++
++    rr->digest = extract_hex_binary_data(&s, "digest", EXTRACT_EAT_WHITESPACE);
++    if (rr->digest.length < 0)  return NULL;
++
++    switch (digest_type) {
++    case 1:
++        if (rr->digest.length != SHA1_BYTES) {
++            return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES);
++        }
++        break;
++    case 2:
++        if (rr->digest.length != SHA256_BYTES) {
++            return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES);
++        }
++        break;
++    case 3:
++        if (rr->digest.length != GOST_BYTES) {
++            return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES);
++        }
++        break;
++    case 4:
++        if (rr->digest.length != SHA384_BYTES) {
++            return bitch("wrong SHA-384 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA384_BYTES);
++        }
++        break;
++    default:
++        return bitch("bad or unsupported digest type %d", digest_type);
++    }
++
++    if (*s) {
++        return bitch("garbage after valid DLV data");
++    }
++    G.dnssec_active = 1;
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* dlv_human(struct rr *rrv)
+ {
+-	RRCAST(dlv);
++    RRCAST(dlv);
+     char ss[4096];
+-	char *s = ss;
+-	int l;
+-	int i;
++    char *s = ss;
++    int l;
++    int i;
+ 
+     l = snprintf(s, 4096, "%u %u %u ", rr->key_tag, rr->algorithm, rr->digest_type);
+-	s += l;
+-	for (i = 0; i < rr->digest.length; i++) {
+-		l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->digest.data[i]);
+-		s += l;
+-	}
++    s += l;
++    for (i = 0; i < rr->digest.length; i++) {
++        l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->digest.data[i]);
++        s += l;
++    }
+     return quickstrdup_temp(ss);
+ }
+ 
+ static struct binary_data dlv_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(dlv);
++    RRCAST(dlv);
+ 
+-	return compose_binary_data("211d", 1,
+-		rr->key_tag, rr->algorithm, rr->digest_type,
+-		rr->digest);
++    return compose_binary_data("211d", 1,
++        rr->key_tag, rr->algorithm, rr->digest_type,
++        rr->digest);
+ }
+ 
+ struct rr_methods dlv_methods = { dlv_parse, dlv_human, dlv_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/dname.c validns/dname.c
+--- validns-0.8/dname.c	2014-02-11 15:46:14.000000000 -0500
++++ validns/dname.c	2020-10-05 16:59:29.354681360 -0400
+@@ -21,66 +21,66 @@
+ 
+ static struct rr *dname_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_dname *rr = getmem(sizeof(*rr));
++    struct rr_dname *rr = getmem(sizeof(*rr));
+ 
+-	rr->target = extract_name(&s, "dname target", 0);
+-	if (!rr->target)
+-		return NULL;
+-	if (*s) {
+-		return bitch("garbage after valid DNAME data");
+-	}
++    rr->target = extract_name(&s, "dname target", 0);
++    if (!rr->target)
++        return NULL;
++    if (*s) {
++        return bitch("garbage after valid DNAME data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* dname_human(struct rr *rrv)
+ {
+-	RRCAST(dname);
++    RRCAST(dname);
+     return rr->target;
+ }
+ 
+ static struct binary_data dname_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(dname);
+-	return name2wire_name(rr->target);
++    RRCAST(dname);
++    return name2wire_name(rr->target);
+ }
+ 
+ static void* dname_validate_set(struct rr_set *rr_set)
+ {
+-	struct rr *rr;
+-	struct rr_set *suspect;
+-	int count;
+-	struct named_rr *named_rr, *next_named_rr;
+-
+-	if (G.opt.policy_checks[POLICY_DNAME]) {
+-		named_rr = rr_set->named_rr;
+-		rr = rr_set->tail;
+-		if (rr_set->count > 1)
+-			return moan(rr->file_name, rr->line, "multiple DNAMEs");
+-		/* This check is already handled by "CNAME and other data" in cname.c *
+-		another_set = find_rr_set_in_named_rr(named_rr, T_CNAME);
+-		if (another_set)
+-			return moan(rr->file_name, rr->line, "DNAME cannot co-exist with a CNAME");
+-		*/
+-		next_named_rr = find_next_named_rr(named_rr);
+-		/* handle http://tools.ietf.org/html/rfc5155#section-10.2 case */
+-		if (next_named_rr && next_named_rr->parent == named_rr && (named_rr->flags & NAME_FLAG_APEX)) {
+-			count = get_rr_set_count(next_named_rr);
+-			if (count > 0) {
+-				suspect = find_rr_set_in_named_rr(next_named_rr, T_RRSIG);
+-				if (suspect)	count--;
+-				suspect = find_rr_set_in_named_rr(next_named_rr, T_NSEC3);
+-				if (suspect)	count--;
+-				if (count == 0)
+-					next_named_rr = find_next_named_rr(next_named_rr);
+-			}
+-		}
+-		if (next_named_rr && next_named_rr->parent == named_rr)
+-			return moan(rr->file_name, rr->line,
+-						"DNAME must not have any children (but %s exists)",
+-						next_named_rr->name);
+-	}
+-	return NULL;
++    struct rr *rr;
++    struct rr_set *suspect;
++    int count;
++    struct named_rr *named_rr, *next_named_rr;
++
++    if (G.opt.policy_checks[POLICY_DNAME]) {
++        named_rr = rr_set->named_rr;
++        rr = rr_set->tail;
++        if (rr_set->count > 1)
++            return moan(rr->file_name, rr->line, "multiple DNAMEs");
++        /* This check is already handled by "CNAME and other data" in cname.c *
++        another_set = find_rr_set_in_named_rr(named_rr, T_CNAME);
++        if (another_set)
++            return moan(rr->file_name, rr->line, "DNAME cannot co-exist with a CNAME");
++        */
++        next_named_rr = find_next_named_rr(named_rr);
++        /* handle http://tools.ietf.org/html/rfc5155#section-10.2 case */
++        if (next_named_rr && next_named_rr->parent == named_rr && (named_rr->flags & NAME_FLAG_APEX)) {
++            count = get_rr_set_count(next_named_rr);
++            if (count > 0) {
++                suspect = find_rr_set_in_named_rr(next_named_rr, T_RRSIG);
++                if (suspect)    count--;
++                suspect = find_rr_set_in_named_rr(next_named_rr, T_NSEC3);
++                if (suspect)    count--;
++                if (count == 0)
++                    next_named_rr = find_next_named_rr(next_named_rr);
++            }
++        }
++        if (next_named_rr && next_named_rr->parent == named_rr)
++            return moan(rr->file_name, rr->line,
++                        "DNAME must not have any children (but %s exists)",
++                        next_named_rr->name);
++    }
++    return NULL;
+ }
+ 
+ struct rr_methods dname_methods = { dname_parse, dname_human, dname_wirerdata, dname_validate_set, NULL };
+diff -Naur validns-0.8/dnskey.c validns/dnskey.c
+--- validns-0.8/dnskey.c	2020-10-05 16:57:07.219376944 -0400
++++ validns/dnskey.c	2020-10-05 16:59:48.870860473 -0400
+@@ -13,6 +13,8 @@
+ #include <openssl/bn.h>
+ #include <openssl/evp.h>
+ #include <openssl/rsa.h>
++#include <openssl/ec.h>
++#include <openssl/sha.h>
+ 
+ #include "common.h"
+ #include "textparse.h"
+@@ -20,172 +22,239 @@
+ #include "carp.h"
+ #include "rr.h"
+ 
+-static struct rr* dnskey_parse(char *name, long ttl, int type, char *s)
++static struct rr_dnskey *all_dns_keys = NULL;
++
++static struct rr* dnskey_cdnskey_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_dnskey *rr = getmem(sizeof(*rr));
+-	struct binary_data key;
+-	int flags, proto, algorithm;
+-	unsigned int ac;
+-	int i;
+-
+-	flags = extract_integer(&s, "flags");
+-	if (flags < 0) return NULL;
+-	if (flags & 0xfefe)
+-		return bitch("reserved flags bits are set");
+-	if (flags & 0x0001 && !(flags & 0x0100))
+-		return bitch("SEP bit is set but Zone Key bit is unset");
+-	rr->flags = flags;
+-
+-	/* TODO validate that `name` is the name of the zone if flags have Zone Key bit set */
+-
+-	proto = extract_integer(&s, "protocol");
+-	if (proto < 0) return NULL;
+-	if (proto != 3)
+-		return bitch("bad protocol value");
+-	rr->protocol = proto;
+-
+-	algorithm = extract_algorithm(&s, "algorithm");
+-	if (algorithm == ALG_UNSUPPORTED)	return NULL;
+-	if (algorithm == ALG_PRIVATEDNS || algorithm == ALG_PRIVATEOID) {
+-		return bitch("private algorithms are not supported in DNSKEY");
+-	}
+-	rr->algorithm = algorithm;
+-
+-	key = extract_base64_binary_data(&s, "public key");
+-	if (key.length < 0)	return NULL;
+-	/* TODO validate key length based on algorithm */
+-	rr->pubkey = key;
+-
+-	ac = 0;
+-	ac += rr->flags;
+-	ac += rr->protocol << 8;
+-	ac += rr->algorithm;
+-	for (i = 0; i < rr->pubkey.length; i++) {
+-		ac += (i & 1) ? (unsigned char)rr->pubkey.data[i] : ((unsigned char)rr->pubkey.data[i]) << 8;
+-	}
+-	ac += (ac >> 16) & 0xFFFF;
+-	rr->key_tag = ac & 0xFFFF;
+-
+-	rr->pkey_built = 0;
+-	rr->pkey = NULL;
+-
+-	if (*s) {
+-		return bitch("garbage after valid DNSKEY data");
+-	}
+-	return store_record(type, name, ttl, rr);
++    struct rr_dnskey *rr = getmem(sizeof(*rr));
++    struct binary_data key;
++    int flags, proto, algorithm;
++    unsigned int ac;
++    int i;
++    static struct rr *result;
++
++    flags = extract_integer(&s, "flags", NULL);
++    if (flags < 0) return NULL;
++    if (flags & 0xfe7e)
++        return bitch("reserved flags bits are set");
++    if (flags & 0x0001 && !(flags & 0x0100))
++        return bitch("SEP bit is set but Zone Key bit is unset");
++    rr->flags = flags;
++
++    /* TODO validate that `name` is the name of the zone if flags have Zone Key bit set */
++
++    proto = extract_integer(&s, "protocol", NULL);
++    if (proto < 0) return NULL;
++    if (proto != 3)
++        return bitch("bad protocol value");
++    rr->protocol = proto;
++
++    algorithm = extract_algorithm(&s, "algorithm");
++    if (algorithm == ALG_UNSUPPORTED)   return NULL;
++    if (algorithm == ALG_PRIVATEDNS || algorithm == ALG_PRIVATEOID) {
++        return bitch("private algorithms are not supported in %s", type == T_CDNSKEY ? "CDNSKEY" : "DNSKEY");
++    }
++    rr->algorithm = algorithm;
++
++    key = extract_base64_binary_data(&s, "public key");
++    if (key.length < 0) return NULL;
++    /* TODO validate key length based on algorithm */
++    rr->pubkey = key;
++
++    ac = 0;
++    ac += rr->flags;
++    ac += rr->protocol << 8;
++    ac += rr->algorithm;
++    for (i = 0; i < rr->pubkey.length; i++) {
++        ac += (i & 1) ? (unsigned char)rr->pubkey.data[i] : ((unsigned char)rr->pubkey.data[i]) << 8;
++    }
++    ac += (ac >> 16) & 0xFFFF;
++    rr->key_tag = ac & 0xFFFF;
++
++    rr->pkey_built = 0;
++    rr->pkey = NULL;
++    rr->key_type = KEY_TYPE_UNUSED;
++
++    if (*s) {
++        return bitch("garbage after valid %s data", type == T_CDNSKEY ? "CDNSKEY" : "DNSKEY");
++    }
++    result = store_record(type, name, ttl, rr);
++    if (result && type == T_DNSKEY) {
++        rr->next_key = all_dns_keys;
++        all_dns_keys = rr;
++    }
++    return result;
+ }
+ 
+-static char* dnskey_human(struct rr *rrv)
++static char* dnskey_cdnskey_human(struct rr *rrv)
+ {
+-	RRCAST(dnskey);
++    RRCAST(dnskey);
+     char s[1024];
+ 
+     snprintf(s, 1024, "%hu %d %d XXX ; key id = %hu",
+-			 rr->flags, rr->protocol, rr->algorithm, rr->key_tag);
++             rr->flags, rr->protocol, rr->algorithm, rr->key_tag);
+     return quickstrdup_temp(s);
+ }
+ 
+-static struct binary_data dnskey_wirerdata(struct rr *rrv)
++static struct binary_data dnskey_cdnskey_wirerdata(struct rr *rrv)
++{
++    RRCAST(dnskey);
++
++    return compose_binary_data("211d", 1,
++        rr->flags, rr->protocol, rr->algorithm,
++        rr->pubkey);
++}
++
++static void *dnskey_cdnskey_validate(struct rr *rrv)
+ {
+-	RRCAST(dnskey);
++    RRCAST(dnskey);
+ 
+-	return compose_binary_data("211d", 1,
+-		rr->flags, rr->protocol, rr->algorithm,
+-		rr->pubkey);
+-}
+-
+-static void *dnskey_validate(struct rr *rrv)
+-{
+-	RRCAST(dnskey);
+-
+-	if (G.opt.policy_checks[POLICY_DNSKEY]) {
+-		if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) {
+-			unsigned int e_bytes;
+-			unsigned char *pk;
+-			int l;
+-
+-			pk = (unsigned char *)rr->pubkey.data;
+-			l = rr->pubkey.length;
+-
+-			e_bytes = *pk++;
+-			l--;
+-			if (e_bytes == 0) {
+-				if (l < 2)
+-					return moan(rr->rr.file_name, rr->rr.line, "public key is too short");
+-				e_bytes = (*pk++)  << 8;
+-				e_bytes += *pk++;
+-				l -= 2;
+-			}
+-			if (l < e_bytes)
+-				return moan(rr->rr.file_name, rr->rr.line, "public key is too short");
+-
+-			if (*pk == 0)
+-				return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in public key exponent");
+-			pk += e_bytes;
+-			l -= e_bytes;
+-			if (l > 0 && *pk == 0)
+-				return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in key modulus");
+-		}
+-	}
+-	return NULL;
++    if (G.opt.policy_checks[POLICY_DNSKEY]) {
++        if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) {
++            unsigned int e_bytes;
++            unsigned char *pk;
++            int l;
++
++            pk = (unsigned char *)rr->pubkey.data;
++            l = rr->pubkey.length;
++
++            e_bytes = *pk++;
++            l--;
++            if (e_bytes == 0) {
++                if (l < 2)
++                    return moan(rr->rr.file_name, rr->rr.line, "public key is too short");
++                e_bytes = (*pk++)  << 8;
++                e_bytes += *pk++;
++                l -= 2;
++            }
++            if (l < e_bytes)
++                return moan(rr->rr.file_name, rr->rr.line, "public key is too short");
++
++            if (*pk == 0)
++                return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in public key exponent");
++            pk += e_bytes;
++            l -= e_bytes;
++            if (l > 0 && *pk == 0)
++                return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in key modulus");
++        }
++    }
++    return NULL;
+ }
+ 
+-struct rr_methods dnskey_methods = { dnskey_parse, dnskey_human, dnskey_wirerdata, NULL, dnskey_validate };
++struct rr_methods dnskey_methods = { dnskey_cdnskey_parse, dnskey_cdnskey_human, dnskey_cdnskey_wirerdata, NULL, dnskey_cdnskey_validate };
++struct rr_methods cdnskey_methods = { dnskey_cdnskey_parse, dnskey_cdnskey_human, dnskey_cdnskey_wirerdata, NULL, dnskey_cdnskey_validate };
+ 
+ int dnskey_build_pkey(struct rr_dnskey *rr)
+ {
+-	if (rr->pkey_built)
+-		return rr->pkey ? 1 : 0;
++    if (rr->pkey_built)
++        return rr->pkey ? 1 : 0;
+ 
+-	rr->pkey_built = 1;
++    rr->pkey_built = 1;
+ 
+-	if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) {
+-		RSA *rsa;
+-		EVP_PKEY *pkey;
+-		unsigned int e_bytes;
+-		unsigned char *pk;
+-		int l;
++    if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) {
++        RSA *rsa;
++        EVP_PKEY *pkey;
++        unsigned int e_bytes;
++        unsigned char *pk;
++        int l;
+ 	BIGNUM *n, *e;
+ 
+-		rsa = RSA_new();
+-		if (!rsa)
+-			goto done;
+-
+-		pk = (unsigned char *)rr->pubkey.data;
+-		l = rr->pubkey.length;
+-
+-		e_bytes = *pk++;
+-		l--;
+-		if (e_bytes == 0) {
+-			if (l < 2) /* public key is too short */
+-				goto done;
+-			e_bytes = (*pk++)  << 8;
+-			e_bytes += *pk++;
+-			l -= 2;
+-		}
+-		if (l < e_bytes) /* public key is too short */
+-			goto done;
++        rsa = RSA_new();
++        if (!rsa)
++            goto done;
++
++        pk = (unsigned char *)rr->pubkey.data;
++        l = rr->pubkey.length;
++
++        e_bytes = *pk++;
++        l--;
++        if (e_bytes == 0) {
++            if (l < 2) /* public key is too short */
++                goto done;
++            e_bytes = (*pk++)  << 8;
++            e_bytes += *pk++;
++            l -= 2;
++        }
++        if (l < e_bytes) /* public key is too short */
++            goto done;
+ 
+         e = BN_bin2bn(pk, e_bytes, NULL);
+-		pk += e_bytes;
+-		l -= e_bytes;
++        pk += e_bytes;
++        l -= e_bytes;
+ 
+ 	n = BN_bin2bn(pk, l, NULL);
+ 	RSA_set0_key(rsa, n, e, NULL);
+ 
+-		pkey = EVP_PKEY_new();
+-		if (!pkey)
+-			goto done;
++        pkey = EVP_PKEY_new();
++        if (!pkey)
++            goto done;
++
++        if (!EVP_PKEY_set1_RSA(pkey, rsa))
++            goto done;
++
++        rr->pkey = pkey;
++    } else if (algorithm_type(rr->algorithm) == ALG_ECC_FAMILY) {
++        EC_KEY *pubeckey;
++        EVP_PKEY *pkey;
++        unsigned char *pk;
++        int l;
++        BIGNUM *bn_x = NULL;
++        BIGNUM *bn_y = NULL;
++
++        if (rr->algorithm == ALG_ECDSAP256SHA256) {
++            l = SHA256_DIGEST_LENGTH;
++            pubeckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
++        } else if (rr->algorithm == ALG_ECDSAP384SHA384) {
++            l = SHA384_DIGEST_LENGTH;
++            pubeckey = EC_KEY_new_by_curve_name(NID_secp384r1);
++        } else {
++            goto done;
++        }
++
++        if (!pubeckey)
++            goto done;
++
++        if (rr->pubkey.length != 2*l) {
++            goto done;
++        }
++
++        pk = (unsigned char *)rr->pubkey.data;
++
++        bn_x = BN_bin2bn(pk, l, NULL);
++        bn_y = BN_bin2bn(&pk[l], l, NULL);
++
++        if (1 != EC_KEY_set_public_key_affine_coordinates(pubeckey, bn_x, bn_y)) {
++            goto done;
++        }
++
++        pkey = EVP_PKEY_new();
++        if (!pkey)
++            goto done;
+ 
+-		if (!EVP_PKEY_set1_RSA(pkey, rsa))
+-			goto done;
++        if (!EVP_PKEY_assign_EC_KEY(pkey, pubeckey))
++            goto done;
+ 
+-		rr->pkey = pkey;
+-	}
++        rr->pkey = pkey;
++    }
+ done:
+-	if (!rr->pkey) {
+-		moan(rr->rr.file_name, rr->rr.line, "error building pkey");
+-	}
+-	return rr->pkey ? 1 : 0;
++    if (!rr->pkey) {
++        moan(rr->rr.file_name, rr->rr.line, "error building pkey");
++    }
++    return rr->pkey ? 1 : 0;
++}
++
++void
++dnskey_ksk_policy_check(void)
++{
++    struct rr_dnskey *rr = all_dns_keys;
++    int ksk_found = 0;
++
++    while (rr) {
++        if (rr->key_type == KEY_TYPE_KSK)
++            ksk_found = 1;
++        rr = rr->next_key;
++    }
++    if (!ksk_found)
++        moan(all_dns_keys->rr.file_name, all_dns_keys->rr.line, "No KSK found");
+ }
+ 
+diff -Naur validns-0.8/dnskey.c.orig validns/dnskey.c.orig
+--- validns-0.8/dnskey.c.orig	2014-02-11 15:45:11.000000000 -0500
++++ validns/dnskey.c.orig	1969-12-31 19:00:00.000000000 -0500
+@@ -1,189 +0,0 @@
+-/*
+- * Part of DNS zone file validator `validns`.
+- *
+- * Copyright 2011-2014 Anton Berezin <tobez@tobez.org>
+- * Modified BSD license.
+- * (See LICENSE file in the distribution.)
+- *
+- */
+-#include <sys/types.h>
+-#include <stdio.h>
+-#include <netinet/in.h>
+-#include <arpa/inet.h>
+-#include <openssl/bn.h>
+-#include <openssl/evp.h>
+-#include <openssl/rsa.h>
+-
+-#include "common.h"
+-#include "textparse.h"
+-#include "mempool.h"
+-#include "carp.h"
+-#include "rr.h"
+-
+-static struct rr* dnskey_parse(char *name, long ttl, int type, char *s)
+-{
+-	struct rr_dnskey *rr = getmem(sizeof(*rr));
+-	struct binary_data key;
+-	int flags, proto, algorithm;
+-	unsigned int ac;
+-	int i;
+-
+-	flags = extract_integer(&s, "flags");
+-	if (flags < 0) return NULL;
+-	if (flags & 0xfefe)
+-		return bitch("reserved flags bits are set");
+-	if (flags & 0x0001 && !(flags & 0x0100))
+-		return bitch("SEP bit is set but Zone Key bit is unset");
+-	rr->flags = flags;
+-
+-	/* TODO validate that `name` is the name of the zone if flags have Zone Key bit set */
+-
+-	proto = extract_integer(&s, "protocol");
+-	if (proto < 0) return NULL;
+-	if (proto != 3)
+-		return bitch("bad protocol value");
+-	rr->protocol = proto;
+-
+-	algorithm = extract_algorithm(&s, "algorithm");
+-	if (algorithm == ALG_UNSUPPORTED)	return NULL;
+-	if (algorithm == ALG_PRIVATEDNS || algorithm == ALG_PRIVATEOID) {
+-		return bitch("private algorithms are not supported in DNSKEY");
+-	}
+-	rr->algorithm = algorithm;
+-
+-	key = extract_base64_binary_data(&s, "public key");
+-	if (key.length < 0)	return NULL;
+-	/* TODO validate key length based on algorithm */
+-	rr->pubkey = key;
+-
+-	ac = 0;
+-	ac += rr->flags;
+-	ac += rr->protocol << 8;
+-	ac += rr->algorithm;
+-	for (i = 0; i < rr->pubkey.length; i++) {
+-		ac += (i & 1) ? (unsigned char)rr->pubkey.data[i] : ((unsigned char)rr->pubkey.data[i]) << 8;
+-	}
+-	ac += (ac >> 16) & 0xFFFF;
+-	rr->key_tag = ac & 0xFFFF;
+-
+-	rr->pkey_built = 0;
+-	rr->pkey = NULL;
+-
+-	if (*s) {
+-		return bitch("garbage after valid DNSKEY data");
+-	}
+-	return store_record(type, name, ttl, rr);
+-}
+-
+-static char* dnskey_human(struct rr *rrv)
+-{
+-	RRCAST(dnskey);
+-    char s[1024];
+-
+-    snprintf(s, 1024, "%hu %d %d XXX ; key id = %hu",
+-			 rr->flags, rr->protocol, rr->algorithm, rr->key_tag);
+-    return quickstrdup_temp(s);
+-}
+-
+-static struct binary_data dnskey_wirerdata(struct rr *rrv)
+-{
+-	RRCAST(dnskey);
+-
+-	return compose_binary_data("211d", 1,
+-		rr->flags, rr->protocol, rr->algorithm,
+-		rr->pubkey);
+-}
+-
+-static void *dnskey_validate(struct rr *rrv)
+-{
+-	RRCAST(dnskey);
+-
+-	if (G.opt.policy_checks[POLICY_DNSKEY]) {
+-		if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) {
+-			unsigned int e_bytes;
+-			unsigned char *pk;
+-			int l;
+-
+-			pk = (unsigned char *)rr->pubkey.data;
+-			l = rr->pubkey.length;
+-
+-			e_bytes = *pk++;
+-			l--;
+-			if (e_bytes == 0) {
+-				if (l < 2)
+-					return moan(rr->rr.file_name, rr->rr.line, "public key is too short");
+-				e_bytes = (*pk++)  << 8;
+-				e_bytes += *pk++;
+-				l -= 2;
+-			}
+-			if (l < e_bytes)
+-				return moan(rr->rr.file_name, rr->rr.line, "public key is too short");
+-
+-			if (*pk == 0)
+-				return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in public key exponent");
+-			pk += e_bytes;
+-			l -= e_bytes;
+-			if (l > 0 && *pk == 0)
+-				return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in key modulus");
+-		}
+-	}
+-	return NULL;
+-}
+-
+-struct rr_methods dnskey_methods = { dnskey_parse, dnskey_human, dnskey_wirerdata, NULL, dnskey_validate };
+-
+-int dnskey_build_pkey(struct rr_dnskey *rr)
+-{
+-	if (rr->pkey_built)
+-		return rr->pkey ? 1 : 0;
+-
+-	rr->pkey_built = 1;
+-
+-	if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) {
+-		RSA *rsa;
+-		EVP_PKEY *pkey;
+-		unsigned int e_bytes;
+-		unsigned char *pk;
+-		int l;
+-
+-		rsa = RSA_new();
+-		if (!rsa)
+-			goto done;
+-
+-		pk = (unsigned char *)rr->pubkey.data;
+-		l = rr->pubkey.length;
+-
+-		e_bytes = *pk++;
+-		l--;
+-		if (e_bytes == 0) {
+-			if (l < 2) /* public key is too short */
+-				goto done;
+-			e_bytes = (*pk++)  << 8;
+-			e_bytes += *pk++;
+-			l -= 2;
+-		}
+-		if (l < e_bytes) /* public key is too short */
+-			goto done;
+-
+-		rsa->e = BN_bin2bn(pk, e_bytes, NULL);
+-		pk += e_bytes;
+-		l -= e_bytes;
+-
+-		rsa->n = BN_bin2bn(pk, l, NULL);
+-
+-		pkey = EVP_PKEY_new();
+-		if (!pkey)
+-			goto done;
+-
+-		if (!EVP_PKEY_set1_RSA(pkey, rsa))
+-			goto done;
+-
+-		rr->pkey = pkey;
+-	}
+-done:
+-	if (!rr->pkey) {
+-		moan(rr->rr.file_name, rr->rr.line, "error building pkey");
+-	}
+-	return rr->pkey ? 1 : 0;
+-}
+-
+diff -Naur validns-0.8/ds.c validns/ds.c
+--- validns-0.8/ds.c	2014-02-11 15:44:59.000000000 -0500
++++ validns/ds.c	2020-10-05 16:59:29.354681360 -0400
+@@ -17,83 +17,84 @@
+ #include "carp.h"
+ #include "rr.h"
+ 
+-static struct rr* ds_parse(char *name, long ttl, int type, char *s)
++static struct rr* ds_cds_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_ds *rr = getmem(sizeof(*rr));
+-	int key_tag, algorithm, digest_type;
++    struct rr_ds *rr = getmem(sizeof(*rr));
++    int key_tag, algorithm, digest_type;
+ 
+-	key_tag = extract_integer(&s, "key tag");
+-	if (key_tag < 0)	return NULL;
+-	rr->key_tag = key_tag;
+-
+-	algorithm = extract_algorithm(&s, "algorithm");
+-	if (algorithm == ALG_UNSUPPORTED)	return NULL;
+-	rr->algorithm = algorithm;
+-
+-	digest_type = extract_integer(&s, "digest type");
+-	if (digest_type < 0)	return NULL;
+-	rr->digest_type = digest_type;
+-
+-	rr->digest = extract_hex_binary_data(&s, "digest", EXTRACT_EAT_WHITESPACE);
+-	if (rr->digest.length < 0)	return NULL;
+-
+-	/* See http://www.iana.org/assignments/ds-rr-types/ds-rr-types.xml
+-	 * for valid digest types. */
+-	switch (digest_type) {
+-	case 1:
+-		if (rr->digest.length != SHA1_BYTES) {
+-			return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES);
+-		}
+-		break;
+-	case 2:
+-		if (rr->digest.length != SHA256_BYTES) {
+-			return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES);
+-		}
+-		break;
+-	case 3:
+-		if (rr->digest.length != GOST_BYTES) {
+-			return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES);
+-		}
+-		break;
+-	case 4:
+-		if (rr->digest.length != SHA384_BYTES) {
+-			return bitch("wrong SHA-384 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA384_BYTES);
+-		}
+-		break;
+-	default:
+-		return bitch("bad or unsupported digest type %d", digest_type);
+-	}
+-
+-	if (*s) {
+-		return bitch("garbage after valid DS data");
+-	}
+-	return store_record(type, name, ttl, rr);
++    key_tag = extract_integer(&s, "key tag", NULL);
++    if (key_tag < 0)    return NULL;
++    rr->key_tag = key_tag;
++
++    algorithm = extract_algorithm(&s, "algorithm");
++    if (algorithm == ALG_UNSUPPORTED)   return NULL;
++    rr->algorithm = algorithm;
++
++    digest_type = extract_integer(&s, "digest type", NULL);
++    if (digest_type < 0)    return NULL;
++    rr->digest_type = digest_type;
++
++    rr->digest = extract_hex_binary_data(&s, "digest", EXTRACT_EAT_WHITESPACE);
++    if (rr->digest.length < 0)  return NULL;
++
++    /* See http://www.iana.org/assignments/ds-rr-types/ds-rr-types.xml
++     * for valid digest types. */
++    switch (digest_type) {
++    case 1:
++        if (rr->digest.length != SHA1_BYTES) {
++            return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES);
++        }
++        break;
++    case 2:
++        if (rr->digest.length != SHA256_BYTES) {
++            return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES);
++        }
++        break;
++    case 3:
++        if (rr->digest.length != GOST_BYTES) {
++            return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES);
++        }
++        break;
++    case 4:
++        if (rr->digest.length != SHA384_BYTES) {
++            return bitch("wrong SHA-384 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA384_BYTES);
++        }
++        break;
++    default:
++        return bitch("bad or unsupported digest type %d", digest_type);
++    }
++
++    if (*s) {
++        return bitch("garbage after valid %s data", type == T_CDS ? "CDS" : "DS");
++    }
++    return store_record(type, name, ttl, rr);
+ }
+ 
+-static char* ds_human(struct rr *rrv)
++static char* ds_cds_human(struct rr *rrv)
+ {
+-	RRCAST(ds);
++    RRCAST(ds);
+     char ss[4096];
+-	char *s = ss;
+-	int l;
+-	int i;
++    char *s = ss;
++    int l;
++    int i;
+ 
+     l = snprintf(s, 4096, "%u %u %u ", rr->key_tag, rr->algorithm, rr->digest_type);
+-	s += l;
+-	for (i = 0; i < rr->digest.length; i++) {
+-		l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->digest.data[i]);
+-		s += l;
+-	}
++    s += l;
++    for (i = 0; i < rr->digest.length; i++) {
++        l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->digest.data[i]);
++        s += l;
++    }
+     return quickstrdup_temp(ss);
+ }
+ 
+-static struct binary_data ds_wirerdata(struct rr *rrv)
++static struct binary_data ds_cds_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(ds);
++    RRCAST(ds);
+ 
+-	return compose_binary_data("211d", 1,
+-		rr->key_tag, rr->algorithm, rr->digest_type,
+-		rr->digest);
++    return compose_binary_data("211d", 1,
++        rr->key_tag, rr->algorithm, rr->digest_type,
++        rr->digest);
+ }
+ 
+-struct rr_methods ds_methods = { ds_parse, ds_human, ds_wirerdata, NULL, NULL };
++struct rr_methods ds_methods = { ds_cds_parse, ds_cds_human, ds_cds_wirerdata, NULL, NULL };
++struct rr_methods cds_methods = { ds_cds_parse, ds_cds_human, ds_cds_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/hinfo.c validns/hinfo.c
+--- validns-0.8/hinfo.c	2014-02-11 15:45:14.000000000 -0500
++++ validns/hinfo.c	2020-10-05 16:59:29.354681360 -0400
+@@ -20,30 +20,30 @@
+ 
+ static struct rr *hinfo_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_hinfo *rr = getmem(sizeof(*rr));
++    struct rr_hinfo *rr = getmem(sizeof(*rr));
+ 
+-	rr->cpu = extract_text(&s, "CPU");
+-	if (rr->cpu.length < 0)
+-		return NULL;
+-	if (rr->cpu.length > 255)
+-		return bitch("CPU string is too long");
+-
+-	rr->os = extract_text(&s, "OS");
+-	if (rr->os.length < 0)
+-		return NULL;
+-	if (rr->os.length > 255)
+-		return bitch("OS string is too long");
+-
+-	if (*s) {
+-		return bitch("garbage after valid HINFO data");
+-	}
++    rr->cpu = extract_text(&s, "CPU");
++    if (rr->cpu.length < 0)
++        return NULL;
++    if (rr->cpu.length > 255)
++        return bitch("CPU string is too long");
++
++    rr->os = extract_text(&s, "OS");
++    if (rr->os.length < 0)
++        return NULL;
++    if (rr->os.length > 255)
++        return bitch("OS string is too long");
++
++    if (*s) {
++        return bitch("garbage after valid HINFO data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* hinfo_human(struct rr *rrv)
+ {
+-	RRCAST(hinfo);
++    RRCAST(hinfo);
+     char s[1024];
+ 
+     snprintf(s, 1024, "\"%s\" \"%s\"", rr->cpu.data, rr->os.data);
+@@ -52,7 +52,7 @@
+ 
+ static struct binary_data hinfo_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(hinfo);
++    RRCAST(hinfo);
+ 
+     return compose_binary_data("bb", 1, rr->cpu, rr->os);
+ }
+diff -Naur validns-0.8/ipseckey.c validns/ipseckey.c
+--- validns-0.8/ipseckey.c	2020-10-05 16:54:14.348790465 -0400
++++ validns/ipseckey.c	2020-10-05 16:59:29.354681360 -0400
+@@ -21,157 +21,157 @@
+ 
+ static struct rr *ipseckey_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_ipseckey *rr = getmem(sizeof(*rr));
+-	int i;
++    struct rr_ipseckey *rr = getmem(sizeof(*rr));
++    int i;
+ 
+-	rr->precedence = i = extract_integer(&s, "precedence");
+-	if (i < 0)    return NULL;
+-	if (i >= 256) return bitch("precedence range is not valid");
+-
+-	rr->gateway_type = i = extract_integer(&s, "gateway type");
+-	if (i < 0) return NULL;
+-	if (i > 3) return bitch("gateway type is not valid");
+-
+-	rr->algorithm = i = extract_integer(&s, "algorithm");
+-	if (i < 0) return NULL;
+-	if (i > 2) return bitch("algorithm is not valid");
+-
+-	switch (rr->gateway_type) {
+-	case 0:
+-		rr->gateway.gateway_none = extract_name(&s, "gateway/.", KEEP_CAPITALIZATION);
+-		if (!rr->gateway.gateway_none) return NULL;
+-		if (strcmp(rr->gateway.gateway_none, ".") != 0)
+-			return bitch("gateway must be \".\" for gateway type 0");
+-		break;
+-	case 1:
+-		if (extract_ipv4(&s, "gateway/IPv4", &rr->gateway.gateway_ipv4) <= 0)
+-			return NULL;
+-		break;
+-	case 2:
+-		if (extract_ipv6(&s, "gateway/IPv6", &rr->gateway.gateway_ipv6) <= 0)
+-			return NULL;
+-		break;
+-	case 3:
+-		rr->gateway.gateway_name = extract_name(&s, "gateway/name", KEEP_CAPITALIZATION);
+-		if (!rr->gateway.gateway_name) return NULL;
+-		break;
+-	default:
+-		croakx(7, "assertion failed: gateway type %d not within range", rr->gateway_type);
+-	}
+-
+-	/* My reading of http://tools.ietf.org/html/rfc4025 is fuzzy on:
+-	 *
+-	 * - whether it is possible to have algorithm 0 and non-empty key;
+-	 * - whether it is possible to have empty key and algorithm != 0.
+-	 *
+-	 * Here I assume "not possible" for both.
+-	 */
+-	switch (rr->algorithm) {
+-	case 0:
+-		break;
+-	case 1:
+-		/* DSA key */
+-		rr->public_key = extract_base64_binary_data(&s, "public key");
+-		if (rr->public_key.length < 0)     return NULL;
+-		break;
+-	case 2:
+-		/* RSA key */
+-		rr->public_key = extract_base64_binary_data(&s, "public key");
+-		if (rr->public_key.length < 0)     return NULL;
+-		break;
+-	default:
+-		croakx(7, "assertion failed: algorithm %d not within range", rr->algorithm);
+-	}
+-
+-	if (*s) {
+-		return bitch("garbage after valid IPSECKEY data");
+-	}
++    rr->precedence = i = extract_integer(&s, "precedence", NULL);
++    if (i < 0)    return NULL;
++    if (i >= 256) return bitch("precedence range is not valid");
++
++    rr->gateway_type = i = extract_integer(&s, "gateway type", NULL);
++    if (i < 0) return NULL;
++    if (i > 3) return bitch("gateway type is not valid");
++
++    rr->algorithm = i = extract_integer(&s, "algorithm", NULL);
++    if (i < 0) return NULL;
++    if (i > 2) return bitch("algorithm is not valid");
++
++    switch (rr->gateway_type) {
++    case 0:
++        rr->gateway.gateway_none = extract_name(&s, "gateway/.", KEEP_CAPITALIZATION);
++        if (!rr->gateway.gateway_none) return NULL;
++        if (strcmp(rr->gateway.gateway_none, ".") != 0)
++            return bitch("gateway must be \".\" for gateway type 0");
++        break;
++    case 1:
++        if (extract_ipv4(&s, "gateway/IPv4", &rr->gateway.gateway_ipv4) <= 0)
++            return NULL;
++        break;
++    case 2:
++        if (extract_ipv6(&s, "gateway/IPv6", &rr->gateway.gateway_ipv6) <= 0)
++            return NULL;
++        break;
++    case 3:
++        rr->gateway.gateway_name = extract_name(&s, "gateway/name", KEEP_CAPITALIZATION);
++        if (!rr->gateway.gateway_name) return NULL;
++        break;
++    default:
++        croakx(7, "assertion failed: gateway type %d not within range", rr->gateway_type);
++    }
++
++    /* My reading of http://tools.ietf.org/html/rfc4025 is fuzzy on:
++     *
++     * - whether it is possible to have algorithm 0 and non-empty key;
++     * - whether it is possible to have empty key and algorithm != 0.
++     *
++     * Here I assume "not possible" for both.
++     */
++    switch (rr->algorithm) {
++    case 0:
++        break;
++    case 1:
++        /* DSA key */
++        rr->public_key = extract_base64_binary_data(&s, "public key");
++        if (rr->public_key.length < 0)     return NULL;
++        break;
++    case 2:
++        /* RSA key */
++        rr->public_key = extract_base64_binary_data(&s, "public key");
++        if (rr->public_key.length < 0)     return NULL;
++        break;
++    default:
++        croakx(7, "assertion failed: algorithm %d not within range", rr->algorithm);
++    }
++
++    if (*s) {
++        return bitch("garbage after valid IPSECKEY data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* ipseckey_human(struct rr *rrv)
+ {
+-	RRCAST(ipseckey);
++    RRCAST(ipseckey);
+     char s[1024], gw[1024];
+ 
+-	switch (rr->gateway_type) {
+-	case 0:
+-		strcpy(gw, rr->gateway.gateway_none);
+-		break;
+-	case 1:
+-		inet_ntop(AF_INET, &rr->gateway.gateway_ipv4, gw, 2048);
+-		break;
+-	case 2:
+-		inet_ntop(AF_INET6, &rr->gateway.gateway_ipv6, gw, 2048);
+-		break;
+-	case 3:
+-		strcpy(gw, rr->gateway.gateway_name);
+-		break;
+-	default:
+-		strcpy(gw, "??");
+-	}
+-    snprintf(s, 2048, "( %d %d %d %s ... )",
+-	     rr->precedence, rr->gateway_type, rr->algorithm, gw);
++    switch (rr->gateway_type) {
++    case 0:
++        strcpy(gw, rr->gateway.gateway_none);
++        break;
++    case 1:
++        inet_ntop(AF_INET, &rr->gateway.gateway_ipv4, gw, 1024);
++        break;
++    case 2:
++        inet_ntop(AF_INET6, &rr->gateway.gateway_ipv6, gw, 1024);
++        break;
++    case 3:
++        strcpy(gw, rr->gateway.gateway_name);
++        break;
++    default:
++        strcpy(gw, "??");
++    }
++    snprintf(s, 1024, "( %d %d %d %s ... )",
++         rr->precedence, rr->gateway_type, rr->algorithm, gw);
+     return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data ipseckey_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(ipseckey);
+-	struct binary_data helper;
++    RRCAST(ipseckey);
++    struct binary_data helper;
+ 
+-	switch (rr->gateway_type) {
+-	case 0:
+-		if (rr->algorithm != 0)
+-			return compose_binary_data("111d", 1,
+-				rr->precedence, rr->gateway_type, rr->algorithm,
+-				rr->public_key);
+-		else
+-			return compose_binary_data("111", 1,
+-				rr->precedence, rr->gateway_type, rr->algorithm);
+-		break;
+-	case 1:
+-		helper.length = sizeof(rr->gateway.gateway_ipv4);
+-		helper.data = (void *)&rr->gateway.gateway_ipv4;
+-
+-		if (rr->algorithm != 0)
+-			return compose_binary_data("111dd", 1,
+-				rr->precedence, rr->gateway_type, rr->algorithm,
+-				helper,
+-				rr->public_key);
+-		else
+-			return compose_binary_data("111d", 1,
+-				rr->precedence, rr->gateway_type, rr->algorithm,
+-				helper);
+-		break;
+-	case 2:
+-
+-		helper.length = sizeof(rr->gateway.gateway_ipv6);
+-		helper.data = (void *)&rr->gateway.gateway_ipv6;
+-
+-		if (rr->algorithm != 0)
+-			return compose_binary_data("111dd", 1,
+-				rr->precedence, rr->gateway_type, rr->algorithm,
+-				helper,
+-				rr->public_key);
+-		else
+-			return compose_binary_data("111d", 1,
+-				rr->precedence, rr->gateway_type, rr->algorithm,
+-				helper);
+-		break;
+-	case 3:
+-		if (rr->algorithm != 0)
+-			return compose_binary_data("111dd", 1,
+-				rr->precedence, rr->gateway_type, rr->algorithm,
+-				name2wire_name(rr->gateway.gateway_name),
+-				rr->public_key);
+-		else
+-			return compose_binary_data("111d", 1,
+-				rr->precedence, rr->gateway_type, rr->algorithm,
+-				name2wire_name(rr->gateway.gateway_name));
+-		break;
+-	}
++    switch (rr->gateway_type) {
++    case 0:
++        if (rr->algorithm != 0)
++            return compose_binary_data("111d", 1,
++                rr->precedence, rr->gateway_type, rr->algorithm,
++                rr->public_key);
++        else
++            return compose_binary_data("111", 1,
++                rr->precedence, rr->gateway_type, rr->algorithm);
++        break;
++    case 1:
++        helper.length = sizeof(rr->gateway.gateway_ipv4);
++        helper.data = (void *)&rr->gateway.gateway_ipv4;
++
++        if (rr->algorithm != 0)
++            return compose_binary_data("111dd", 1,
++                rr->precedence, rr->gateway_type, rr->algorithm,
++                helper,
++                rr->public_key);
++        else
++            return compose_binary_data("111d", 1,
++                rr->precedence, rr->gateway_type, rr->algorithm,
++                helper);
++        break;
++    case 2:
++
++        helper.length = sizeof(rr->gateway.gateway_ipv6);
++        helper.data = (void *)&rr->gateway.gateway_ipv6;
++
++        if (rr->algorithm != 0)
++            return compose_binary_data("111dd", 1,
++                rr->precedence, rr->gateway_type, rr->algorithm,
++                helper,
++                rr->public_key);
++        else
++            return compose_binary_data("111d", 1,
++                rr->precedence, rr->gateway_type, rr->algorithm,
++                helper);
++        break;
++    case 3:
++        if (rr->algorithm != 0)
++            return compose_binary_data("111dd", 1,
++                rr->precedence, rr->gateway_type, rr->algorithm,
++                name2wire_name(rr->gateway.gateway_name),
++                rr->public_key);
++        else
++            return compose_binary_data("111d", 1,
++                rr->precedence, rr->gateway_type, rr->algorithm,
++                name2wire_name(rr->gateway.gateway_name));
++        break;
++    }
+     return bad_binary_data();
+ }
+ 
+diff -Naur validns-0.8/isdn.c validns/isdn.c
+--- validns-0.8/isdn.c	2014-02-11 15:46:34.000000000 -0500
++++ validns/isdn.c	2020-10-05 16:59:29.354681360 -0400
+@@ -23,52 +23,52 @@
+ 
+ static struct rr *isdn_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_isdn *rr = getmem(sizeof(*rr));
++    struct rr_isdn *rr = getmem(sizeof(*rr));
+ 
+-	rr->isdn_address = extract_text(&s, "ISDN-address");
+-	if (rr->isdn_address.length < 0)
+-		return NULL;
+-	if (rr->isdn_address.length > 255)
+-		return bitch("ISDN-address too long");
+-
+-	rr->sa_present = 0;
+-	if (*s) {
+-		rr->sa = extract_text(&s, "subaddress");
+-		if (rr->sa.length < 0)
+-			return NULL;
+-		if (rr->sa.length > 255)
+-			return bitch("subaddress too long");
+-		rr->sa_present = 1;
+-	}
+-
+-	if (*s) {
+-		return bitch("garbage after valid ISDN data");
+-	}
++    rr->isdn_address = extract_text(&s, "ISDN-address");
++    if (rr->isdn_address.length < 0)
++        return NULL;
++    if (rr->isdn_address.length > 255)
++        return bitch("ISDN-address too long");
++
++    rr->sa_present = 0;
++    if (*s) {
++        rr->sa = extract_text(&s, "subaddress");
++        if (rr->sa.length < 0)
++            return NULL;
++        if (rr->sa.length > 255)
++            return bitch("subaddress too long");
++        rr->sa_present = 1;
++    }
++
++    if (*s) {
++        return bitch("garbage after valid ISDN data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* isdn_human(struct rr *rrv)
+ {
+-	RRCAST(isdn);
++    RRCAST(isdn);
+ 
+     return rr->isdn_address.data;
+ }
+ 
+ static struct binary_data isdn_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(isdn);
+-	struct binary_data r, t;
++    RRCAST(isdn);
++    struct binary_data r, t;
+ 
+-	r = bad_binary_data();
+-	t.length = 0;
+-	t.data = NULL;
+-	r = compose_binary_data("db", 1, t, rr->isdn_address);
+-	t = r;
+-	if (rr->sa_present) {
+-		r = compose_binary_data("db", 1, t, rr->sa);
+-		t = r;
+-	}
++    r = bad_binary_data();
++    t.length = 0;
++    t.data = NULL;
++    r = compose_binary_data("db", 1, t, rr->isdn_address);
++    t = r;
++    if (rr->sa_present) {
++        r = compose_binary_data("db", 1, t, rr->sa);
++        t = r;
++    }
+     return r;
+ }
+ 
+diff -Naur validns-0.8/kx.c validns/kx.c
+--- validns-0.8/kx.c	2014-02-11 15:46:36.000000000 -0500
++++ validns/kx.c	2020-10-05 16:59:29.354681360 -0400
+@@ -19,40 +19,40 @@
+ 
+ static struct rr *kx_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_kx *rr = getmem(sizeof(*rr));
++    struct rr_kx *rr = getmem(sizeof(*rr));
+ 
+-	rr->preference = extract_integer(&s, "KX preference");
+-	if (rr->preference < 0)
+-		return NULL;
++    rr->preference = extract_integer(&s, "KX preference", NULL);
++    if (rr->preference < 0)
++        return NULL;
+ 
+-	rr->exchanger = extract_name(&s, "KX exchanger", 0);
+-	if (!rr->exchanger)
+-		return NULL;
++    rr->exchanger = extract_name(&s, "KX exchanger", 0);
++    if (!rr->exchanger)
++        return NULL;
+ 
+-	if (*s) {
+-		return bitch("garbage after valid KX data");
+-	}
++    if (*s) {
++        return bitch("garbage after valid KX data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* kx_human(struct rr *rrv)
+ {
+-	RRCAST(kx);
++    RRCAST(kx);
+     char s[1024];
+ 
+     snprintf(s, 1024, "%d %s",
+-	     rr->preference, rr->exchanger);
++         rr->preference, rr->exchanger);
+     return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data kx_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(kx);
++    RRCAST(kx);
+ 
+     return compose_binary_data("2d", 1,
+-		rr->preference,
+-		name2wire_name(rr->exchanger));
++        rr->preference,
++        name2wire_name(rr->exchanger));
+ }
+ 
+ struct rr_methods kx_methods = { kx_parse, kx_human, kx_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/l32.c validns/l32.c
+--- validns-0.8/l32.c	2014-02-11 15:46:17.000000000 -0500
++++ validns/l32.c	2020-10-05 16:59:29.354681360 -0400
+@@ -19,41 +19,41 @@
+ 
+ static struct rr *l32_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_l32 *rr = getmem(sizeof(*rr));
+-	struct in_addr ipv4_like;
+-	int preference;
+-
+-	rr->preference = preference = extract_integer(&s, "L32 preference");
+-	if (preference < 0)
+-		return NULL;
+-	if (extract_ipv4(&s, "Locator32", &ipv4_like) <= 0)
+-		return NULL;
+-	rr->locator32 = ipv4_like.s_addr;
+-
+-	if (*s) {
+-		return bitch("garbage after valid L32 data");
+-	}
++    struct rr_l32 *rr = getmem(sizeof(*rr));
++    struct in_addr ipv4_like;
++    int preference;
++
++    rr->preference = preference = extract_integer(&s, "L32 preference", NULL);
++    if (preference < 0)
++        return NULL;
++    if (extract_ipv4(&s, "Locator32", &ipv4_like) <= 0)
++        return NULL;
++    rr->locator32 = ipv4_like.s_addr;
++
++    if (*s) {
++        return bitch("garbage after valid L32 data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* l32_human(struct rr *rrv)
+ {
+-	RRCAST(l32);
++    RRCAST(l32);
+     char s[1024];
+ 
+     snprintf(s, 1024, "%d %d.%d.%d.%d",
+-	     rr->preference,
+-		 (rr->locator32 >> 24) & 0xff,
+-		 (rr->locator32 >> 16) & 0xff,
+-		 (rr->locator32 >> 8) & 0xff,
+-		 (rr->locator32 >> 0) & 0xff);
++         rr->preference,
++         (rr->locator32 >> 24) & 0xff,
++         (rr->locator32 >> 16) & 0xff,
++         (rr->locator32 >> 8) & 0xff,
++         (rr->locator32 >> 0) & 0xff);
+     return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data l32_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(l32);
++    RRCAST(l32);
+     return compose_binary_data("24", 1, rr->preference, rr->locator32);
+ }
+ 
+diff -Naur validns-0.8/l64.c validns/l64.c
+--- validns-0.8/l64.c	2014-02-11 15:46:18.000000000 -0500
++++ validns/l64.c	2020-10-05 16:59:29.354681360 -0400
+@@ -19,39 +19,39 @@
+ 
+ static struct rr *l64_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_l64 *rr = getmem(sizeof(*rr));
+-	int preference;
++    struct rr_l64 *rr = getmem(sizeof(*rr));
++    int preference;
+ 
+-	rr->preference = preference = extract_integer(&s, "L64 preference");
+-	if (preference < 0)
+-		return NULL;
+-	if (extract_u64(&s, "Locator64", &rr->locator64) < 0)
+-		return NULL;
+-
+-	if (*s) {
+-		return bitch("garbage after valid L64 data");
+-	}
++    rr->preference = preference = extract_integer(&s, "L64 preference", NULL);
++    if (preference < 0)
++        return NULL;
++    if (extract_u64(&s, "Locator64", &rr->locator64) < 0)
++        return NULL;
++
++    if (*s) {
++        return bitch("garbage after valid L64 data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* l64_human(struct rr *rrv)
+ {
+-	RRCAST(l64);
++    RRCAST(l64);
+     char s[1024];
+ 
+     snprintf(s, 1024, "%d %x:%x:%x:%x",
+-	     rr->preference,
+-		 (unsigned)(rr->locator64 >> 48) & 0xffff,
+-		 (unsigned)(rr->locator64 >> 32) & 0xffff,
+-		 (unsigned)(rr->locator64 >> 16) & 0xffff,
+-		 (unsigned)(rr->locator64 >> 0) & 0xffff);
++         rr->preference,
++         (unsigned)(rr->locator64 >> 48) & 0xffff,
++         (unsigned)(rr->locator64 >> 32) & 0xffff,
++         (unsigned)(rr->locator64 >> 16) & 0xffff,
++         (unsigned)(rr->locator64 >> 0) & 0xffff);
+     return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data l64_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(l64);
++    RRCAST(l64);
+     return compose_binary_data("28", 1, rr->preference, rr->locator64);
+ }
+ 
+diff -Naur validns-0.8/loc.c validns/loc.c
+--- validns-0.8/loc.c	2014-02-11 15:45:16.000000000 -0500
++++ validns/loc.c	2020-10-05 16:59:29.354681360 -0400
+@@ -21,161 +21,161 @@
+ 
+ static uint8_t double2loc_format(double val)
+ {
+-	if (val > 1000000000) {
+-		return (((uint8_t)(val / 1000000000)) << 4) | 9;
+-	} else if (val > 100000000) {
+-		return (((uint8_t)(val / 100000000)) << 4) | 8;
+-	} else if (val > 10000000) {
+-		return (((uint8_t)(val / 10000000)) << 4) | 7;
+-	} else if (val > 1000000) {
+-		return (((uint8_t)(val / 1000000)) << 4) | 6;
+-	} else if (val > 100000) {
+-		return (((uint8_t)(val / 100000)) << 4) | 5;
+-	} else if (val > 10000) {
+-		return (((uint8_t)(val / 10000)) << 4) | 4;
+-	} else if (val > 1000) {
+-		return (((uint8_t)(val / 1000)) << 4) | 3;
+-	} else if (val > 100) {
+-		return (((uint8_t)(val / 100)) << 4) | 2;
+-	} else if (val > 10) {
+-		return (((uint8_t)(val / 10)) << 4) | 1;
+-	} else {
+-		return (((uint8_t)(val)) << 4);
+-	}
++    if (val > 1000000000) {
++        return (((uint8_t)(val / 1000000000)) << 4) | 9;
++    } else if (val > 100000000) {
++        return (((uint8_t)(val / 100000000)) << 4) | 8;
++    } else if (val > 10000000) {
++        return (((uint8_t)(val / 10000000)) << 4) | 7;
++    } else if (val > 1000000) {
++        return (((uint8_t)(val / 1000000)) << 4) | 6;
++    } else if (val > 100000) {
++        return (((uint8_t)(val / 100000)) << 4) | 5;
++    } else if (val > 10000) {
++        return (((uint8_t)(val / 10000)) << 4) | 4;
++    } else if (val > 1000) {
++        return (((uint8_t)(val / 1000)) << 4) | 3;
++    } else if (val > 100) {
++        return (((uint8_t)(val / 100)) << 4) | 2;
++    } else if (val > 10) {
++        return (((uint8_t)(val / 10)) << 4) | 1;
++    } else {
++        return (((uint8_t)(val)) << 4);
++    }
+ 
+ }
+ 
+ static struct rr *loc_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_loc *rr = getmem(sizeof(*rr));
+-	long long i;
+-	int deg;
+-	int min;
+-	double sec, val;
+-
+-	rr->version = 0;
+-
+-	/* latitude block */
+-	i = extract_integer(&s, "degrees latitude");
+-	if (i < 0)
+-		return NULL;
+-	if (i > 90)
+-		return bitch("degrees latitude not in the range 0..90");
+-	deg = i;
+-	min = 0;
+-	sec = 0;
+-	if (isdigit(*s)) {
+-		i = extract_integer(&s, "minutes latitude");
+-		if (i < 0)
+-			return NULL;
+-		if (i > 59)
+-			return bitch("minutes latitude not in the range 0..59");
+-		min = i;
+-
+-		if (isdigit(*s)) { /* restricted floating point, starting with a digit */
+-			if (extract_double(&s, "seconds latitude", &sec, 0) < 0)
+-				return NULL;
+-			if (sec < 0 || sec > 59.999)
+-				return bitch("seconds latitude not in the range 0..59.999");
+-		}
+-	}
+-	rr->latitude = sec*1000 + .5 + min*1000*60 + deg*1000*60*60;
+-	if (*s == 'n' || *s == 'N') {
+-		s++;
+-		rr->latitude = 2147483648u + rr->latitude;
+-	} else if (*s == 's' || *s == 'S') {
+-		s++;
+-		rr->latitude = 2147483648u - rr->latitude;
+-	} else {
+-		return bitch("latitude: N or S is expected");
+-	}
+-	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-		return bitch("latitude: N or S is expected");
+-	}
+-	s = skip_white_space(s);
+-	if (!s) return NULL;
+-
+-	/* longitude block */
+-	i = extract_integer(&s, "degrees longitude");
+-	if (i < 0)
+-		return NULL;
+-	if (i > 180)
+-		return bitch("degrees longitude not in the range 0..90");
+-	deg = i;
+-	min = 0;
+-	sec = 0;
+-	if (isdigit(*s)) {
+-		i = extract_integer(&s, "minutes longitude");
+-		if (i < 0)
+-			return NULL;
+-		if (i > 59)
+-			return bitch("minutes longitude not in the range 0..59");
+-		min = i;
+-
+-		if (isdigit(*s)) { /* restricted floating point, starting with a digit */
+-			if (extract_double(&s, "seconds longitude", &sec, 0) < 0)
+-				return NULL;
+-			if (sec < 0 || sec > 59.999)
+-				return bitch("seconds longitude not in the range 0..59.999");
+-		}
+-	}
+-	rr->longitude = sec*1000 + .5 + min*1000*60 + deg*1000*60*60;
+-	if (*s == 'e' || *s == 'E') {
+-		s++;
+-		rr->longitude = 2147483648u + rr->longitude;
+-	} else if (*s == 'w' || *s == 'W') {
+-		s++;
+-		rr->longitude = 2147483648u - rr->longitude;
+-	} else {
+-		return bitch("longitude: E or W is expected");
+-	}
+-	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-		return bitch("longitude: E or W is expected");
+-	}
+-	s = skip_white_space(s);
+-	if (!s) return NULL;
+-
+-	if (extract_double(&s, "altitude", &val, 1) < 0)
+-		return NULL;
+-	if (val < -100000.00 || val > 42849672.95)
+-		return bitch("altitude is out of supported range");
+-	rr->altitude = (val + 100000.00) * 100 + 0.5;
+-
+-	if (*s) {
+-		if (extract_double(&s, "sphere size", &val, 1) < 0)
+-			return NULL;
+-		if (val < 0 || val > 90000000.00)
+-			return bitch("sphere size is out of supported range");
+-		rr->size = double2loc_format(val * 100 + 0.5);
+-
+-		if (*s) {
+-			if (extract_double(&s, "horizontal precision", &val, 1) < 0)
+-				return NULL;
+-			if (val < 0 || val > 90000000.00)
+-				return bitch("horizontal precision is out of supported range");
+-			rr->horiz_pre = double2loc_format(val * 100 + 0.5);
+-
+-			if (*s) {
+-				if (extract_double(&s, "vertical precision", &val, 1) < 0)
+-					return NULL;
+-				if (val < 0 || val > 90000000.00)
+-					return bitch("vertical precision is out of supported range");
+-				rr->vert_pre = double2loc_format(val * 100 + 0.5);
+-			} else {
+-				rr->vert_pre = double2loc_format(10 * 100 + 0.5);
+-			}
+-		} else {
+-			rr->horiz_pre = double2loc_format(10000 * 100 + 0.5);
+-		}
+-	} else {
+-		rr->size = double2loc_format(1 * 100 + 0.5);
+-	}
+-
+-	if (*s) {
+-		return bitch("garbage after valid LOC data");
+-	}
++    struct rr_loc *rr = getmem(sizeof(*rr));
++    long long i;
++    int deg;
++    int min;
++    double sec, val;
++
++    rr->version = 0;
++
++    /* latitude block */
++    i = extract_integer(&s, "degrees latitude", NULL);
++    if (i < 0)
++        return NULL;
++    if (i > 90)
++        return bitch("degrees latitude not in the range 0..90");
++    deg = i;
++    min = 0;
++    sec = 0;
++    if (isdigit(*s)) {
++        i = extract_integer(&s, "minutes latitude", NULL);
++        if (i < 0)
++            return NULL;
++        if (i > 59)
++            return bitch("minutes latitude not in the range 0..59");
++        min = i;
++
++        if (isdigit(*s)) { /* restricted floating point, starting with a digit */
++            if (extract_double(&s, "seconds latitude", &sec, 0) < 0)
++                return NULL;
++            if (sec < 0 || sec > 59.999)
++                return bitch("seconds latitude not in the range 0..59.999");
++        }
++    }
++    rr->latitude = sec*1000 + .5 + min*1000*60 + deg*1000*60*60;
++    if (*s == 'n' || *s == 'N') {
++        s++;
++        rr->latitude = 2147483648u + rr->latitude;
++    } else if (*s == 's' || *s == 'S') {
++        s++;
++        rr->latitude = 2147483648u - rr->latitude;
++    } else {
++        return bitch("latitude: N or S is expected");
++    }
++    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++        return bitch("latitude: N or S is expected");
++    }
++    s = skip_white_space(s);
++    if (!s) return NULL;
++
++    /* longitude block */
++    i = extract_integer(&s, "degrees longitude", NULL);
++    if (i < 0)
++        return NULL;
++    if (i > 180)
++        return bitch("degrees longitude not in the range 0..90");
++    deg = i;
++    min = 0;
++    sec = 0;
++    if (isdigit(*s)) {
++        i = extract_integer(&s, "minutes longitude", NULL);
++        if (i < 0)
++            return NULL;
++        if (i > 59)
++            return bitch("minutes longitude not in the range 0..59");
++        min = i;
++
++        if (isdigit(*s)) { /* restricted floating point, starting with a digit */
++            if (extract_double(&s, "seconds longitude", &sec, 0) < 0)
++                return NULL;
++            if (sec < 0 || sec > 59.999)
++                return bitch("seconds longitude not in the range 0..59.999");
++        }
++    }
++    rr->longitude = sec*1000 + .5 + min*1000*60 + deg*1000*60*60;
++    if (*s == 'e' || *s == 'E') {
++        s++;
++        rr->longitude = 2147483648u + rr->longitude;
++    } else if (*s == 'w' || *s == 'W') {
++        s++;
++        rr->longitude = 2147483648u - rr->longitude;
++    } else {
++        return bitch("longitude: E or W is expected");
++    }
++    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++        return bitch("longitude: E or W is expected");
++    }
++    s = skip_white_space(s);
++    if (!s) return NULL;
++
++    if (extract_double(&s, "altitude", &val, 1) < 0)
++        return NULL;
++    if (val < -100000.00 || val > 42849672.95)
++        return bitch("altitude is out of supported range");
++    rr->altitude = (val + 100000.00) * 100 + 0.5;
++
++    if (*s) {
++        if (extract_double(&s, "sphere size", &val, 1) < 0)
++            return NULL;
++        if (val < 0 || val > 90000000.00)
++            return bitch("sphere size is out of supported range");
++        rr->size = double2loc_format(val * 100 + 0.5);
++
++        if (*s) {
++            if (extract_double(&s, "horizontal precision", &val, 1) < 0)
++                return NULL;
++            if (val < 0 || val > 90000000.00)
++                return bitch("horizontal precision is out of supported range");
++            rr->horiz_pre = double2loc_format(val * 100 + 0.5);
++
++            if (*s) {
++                if (extract_double(&s, "vertical precision", &val, 1) < 0)
++                    return NULL;
++                if (val < 0 || val > 90000000.00)
++                    return bitch("vertical precision is out of supported range");
++                rr->vert_pre = double2loc_format(val * 100 + 0.5);
++            } else {
++                rr->vert_pre = double2loc_format(10 * 100 + 0.5);
++            }
++        } else {
++            rr->horiz_pre = double2loc_format(10000 * 100 + 0.5);
++        }
++    } else {
++        rr->size = double2loc_format(1 * 100 + 0.5);
++    }
++
++    if (*s) {
++        return bitch("garbage after valid LOC data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* loc_human(struct rr *rrv)
+@@ -185,17 +185,17 @@
+ 
+     // snprintf(s, 1024, "\"%s\" \"%s\"", rr->cpu.data, rr->os.data);
+     // return quickstrdup_temp(s);
+-	return "meow";
++    return "meow";
+ }
+ 
+ static struct binary_data loc_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(loc);
++    RRCAST(loc);
+ 
+     return compose_binary_data("1111444", 1,
+-		rr->version, rr->size,
+-		rr->horiz_pre, rr->vert_pre,
+-		rr->latitude, rr->longitude, rr->altitude);
++        rr->version, rr->size,
++        rr->horiz_pre, rr->vert_pre,
++        rr->latitude, rr->longitude, rr->altitude);
+ }
+ 
+ struct rr_methods loc_methods = { loc_parse, loc_human, loc_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/lp.c validns/lp.c
+--- validns-0.8/lp.c	2014-02-11 15:45:55.000000000 -0500
++++ validns/lp.c	2020-10-05 16:59:29.354681360 -0400
+@@ -20,41 +20,41 @@
+ 
+ static struct rr *lp_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_lp *rr = getmem(sizeof(*rr));
+-	int preference;
++    struct rr_lp *rr = getmem(sizeof(*rr));
++    int preference;
+ 
+-	rr->preference = preference = extract_integer(&s, "LP preference");
+-	if (preference < 0)
+-		return NULL;
+-	rr->fqdn = extract_name(&s, "LP fqdn", 0);
+-	if (!rr->fqdn)
+-		return NULL;
+-	if (strcasecmp(name, rr->fqdn) == 0) {
+-		return bitch("LP points to itself");
+-	}
+-
+-	if (*s) {
+-		return bitch("garbage after valid LP data");
+-	}
++    rr->preference = preference = extract_integer(&s, "LP preference", NULL);
++    if (preference < 0)
++        return NULL;
++    rr->fqdn = extract_name(&s, "LP fqdn", 0);
++    if (!rr->fqdn)
++        return NULL;
++    if (strcasecmp(name, rr->fqdn) == 0) {
++        return bitch("LP points to itself");
++    }
++
++    if (*s) {
++        return bitch("garbage after valid LP data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* lp_human(struct rr *rrv)
+ {
+-	RRCAST(lp);
+-	char s[1024];
++    RRCAST(lp);
++    char s[1024];
+ 
+-	snprintf(s, 1024, "%d %s",
+-			 rr->preference, rr->fqdn);
+-	return quickstrdup_temp(s);
++    snprintf(s, 1024, "%d %s",
++             rr->preference, rr->fqdn);
++    return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data lp_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(lp);
++    RRCAST(lp);
+     return compose_binary_data("2d", 1,
+-		rr->preference, name2wire_name(rr->fqdn));
++        rr->preference, name2wire_name(rr->fqdn));
+ }
+ 
+ struct rr_methods lp_methods = { lp_parse, lp_human, lp_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/main.c validns/main.c
+--- validns-0.8/main.c	2020-10-05 16:54:14.347790456 -0400
++++ validns/main.c	2020-10-05 16:59:29.354681360 -0400
+@@ -17,6 +17,7 @@
+ #include <time.h>
+ #include <netinet/in.h>
+ #include <arpa/inet.h>
++#include <libgen.h>
+ 
+ #include "common.h"
+ #include "carp.h"
+@@ -27,418 +28,631 @@
+ struct globals G;
+ struct file_info *file_info = NULL;
+ 
+-int
+-read_zone_file(void);
++int read_zone_file(void);
++void open_zone_file(char *fname);
++
++static void
++concat_generate_template(char *buf, int bufsz, int val, struct generate_template_piece *t)
++{
++    char sval[40];
++
++    while (t) {
++        if (t->constant_string) {
++            mystrlcat(buf, t->constant_string, bufsz);
++        } else {
++            snprintf(sval, 40, "%d", val);
++            mystrlcat(buf, sval, bufsz);
++        }
++        t = t->next;
++    }
++}
++
++static struct generate_template_piece *
++free_generate_template(struct generate_template_piece *t)
++{
++    struct generate_template_piece *n;
++    while (t) {
++        n = t->next;
++        free(t);
++        t = n;
++    }
++    return NULL;
++}
++
++static void
++create_generate_template_piece(struct generate_template_piece **generate_template, char *s)
++{
++    if (s && *s == 0)
++        return;
++
++    struct generate_template_piece *p = malloc(sizeof(struct generate_template_piece));
++
++    p->constant_string = s;
++    p->next = NULL;
++
++    if (*generate_template) {
++        struct generate_template_piece *t = *generate_template;
++        while (t->next)
++            t = t->next;
++        t->next = p;
++    } else {
++        *generate_template = p;
++    }
++}
++
++static struct generate_template_piece *
++prepare_generate_template(char *t)
++{
++    char *s = t;
++    struct generate_template_piece *r = NULL;
++
++    while (1) {
++        while (*t && *t != '$') t++;
++        if (!*t) {
++            create_generate_template_piece(&r, s);
++            break;
++        } else {
++            *t = 0;
++            create_generate_template_piece(&r, s);
++            create_generate_template_piece(&r, NULL);
++            t++;
++            s = t;
++        }
++    }
++
++    return r;
++}
+ 
+ static char *process_directive(char *s)
+ {
+-	char *d = s+1;
+-	if (*(s+1) == 'O' && strncmp(s, "$ORIGIN", 7) == 0) {
+-		char *o;
+-		s += 7;
+-		if (!isspace(*s)) {
+-			if (isalnum(*s)) goto unrecognized_directive;
+-			return bitch("bad $ORIGIN format");
+-		}
+-		s = skip_white_space(s);
+-		o = extract_name(&s, "$ORIGIN value", 0);
+-		if (!o) {
+-			return NULL;
+-		}
+-		if (*s) {
+-			return bitch("garbage after valid $ORIGIN directive");
+-		}
+-		G.opt.current_origin = o;
+-		if (G.opt.verbose) {
+-			fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
+-			fprintf(stderr, "origin is now %s\n", o);
+-		}
+-	} else if (*(s+1) == 'T' && strncmp(s, "$TTL", 4) == 0) {
+-		s += 4;
+-		if (!isspace(*s)) {
+-			if (isalnum(*s)) goto unrecognized_directive;
+-			return bitch("bad $TTL format");
+-		}
+-		s = skip_white_space(s);
+-		G.default_ttl = extract_timevalue(&s, "$TTL value");
+-		if (G.default_ttl < 0) {
+-			return NULL;
+-		}
+-		if (*s) {
+-			return bitch("garbage after valid $TTL directive");
+-		}
+-		if (G.opt.verbose) {
+-			fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
+-			fprintf(stderr, "default ttl is now %ld\n", G.default_ttl);
+-		}
+-	} else if (*(s+1) == 'I' && strncmp(s, "$INCLUDE", 8) == 0) {
+-		s += 8;
+-		if (!isspace(*s)) {
+-			if (isalnum(*s)) goto unrecognized_directive;
+-			return bitch("bad $INCLUDE format");
+-		}
+-		s = skip_white_space(s);
+-		return bitch("XXX include support is not implemented");
+-	} else {
++    char *d = s+1;
++    if (*(s+1) == 'O' && strncmp(s, "$ORIGIN", 7) == 0) {
++        char *o;
++        s += 7;
++        if (!isspace(*s)) {
++            if (isalnum(*s)) goto unrecognized_directive;
++            return bitch("bad $ORIGIN format");
++        }
++        s = skip_white_space(s);
++        o = extract_name(&s, "$ORIGIN value", 0);
++        if (!o) {
++            return NULL;
++        }
++        if (*s) {
++            return bitch("garbage after valid $ORIGIN directive");
++        }
++        file_info->current_origin = o;
++        if (G.opt.verbose) {
++            fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
++            fprintf(stderr, "origin is now %s\n", o);
++        }
++    } else if (*(s+1) == 'T' && strncmp(s, "$TTL", 4) == 0) {
++        s += 4;
++        if (!isspace(*s)) {
++            if (isalnum(*s)) goto unrecognized_directive;
++            return bitch("bad $TTL format");
++        }
++        s = skip_white_space(s);
++        G.default_ttl = extract_timevalue(&s, "$TTL value");
++        if (G.default_ttl < 0) {
++            return NULL;
++        }
++        if (*s) {
++            return bitch("garbage after valid $TTL directive");
++        }
++        if (G.opt.verbose) {
++            fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
++            fprintf(stderr, "default ttl is now %ld\n", G.default_ttl);
++        }
++    } else if (*(s+1) == 'G' && strncmp(s, "$GENERATE", 9) == 0) {
++        int from, to;
++        char *lhs, *rdtype;
++
++        s += 9;
++        if (!isspace(*s)) {
++            if (isalnum(*s)) goto unrecognized_directive;
++            return bitch("bad $GENERATE format");
++        }
++        s = skip_white_space(s);
++
++        from = extract_integer(&s, "generate-from", "-");
++        if (from < 0)
++            return NULL;
++        if (*s != '-')
++            return bitch("'-' between generate-from and generate-to is expected");
++        s++;
++        to = extract_integer(&s, "generate-to", "-");
++        if (to < 0)
++            return NULL;
++
++        if (*s == '/')
++            return bitch("generate-step is unsupported for now");
++
++        lhs = extract_name(&s, "generate-lhs", KEEP_CAPITALIZATION | DOLLAR_OK_IN_NAMES);
++        if (!lhs)
++            return NULL;
++
++        if (*s == '{')
++            return bitch("{offset,width,type} is unsupported for now");
++
++        rdtype = extract_label(&s, "type", NULL);
++        if (!rdtype)
++            return NULL;
++
++        file_info->generate_cur  = from;
++        file_info->generate_lim  = to;
++        file_info->generate_type = rdtype;
++        file_info->generate_lhs = prepare_generate_template(lhs);
++        file_info->generate_rhs = prepare_generate_template(quickstrdup(s));
++
++        return s;
++    } else if (*(s+1) == 'I' && strncmp(s, "$INCLUDE", 8) == 0) {
++        char *p, *f;
++        char c;
++        s += 8;
++        if (!isspace(*s)) {
++            if (isalnum(*s)) goto unrecognized_directive;
++            return bitch("bad $INCLUDE format");
++        }
++        s = skip_white_space(s);
++        p = s;
++        while (*s && !isspace(*s) && *s != ';')
++            s++;
++        c = *s;
++        *s = '\0';
++        if (!*p) {
++            return bitch("$INCLUDE directive with empty file name");
++        }
++        f = quickstrdup_temp(p);
++        *s = c;
++        s = skip_white_space(s);
++
++        if (*s) {
++            return bitch("garbage after valid $INCLUDE directive");
++        }
++        if (*f == '/') {
++            open_zone_file(f);
++        } else {
++            char buf[1024];
++
++            snprintf(buf, 1024, "%s/%s", G.opt.include_path, f);
++            open_zone_file(buf);
++        }
++    } else {
+ unrecognized_directive:
+-		s = d-1;
+-		while (isalnum(*d))	d++;
+-		*d = '\0';
+-		return bitch("unrecognized directive: %s", s);
+-	}
+-	return s;
++        s = d-1;
++        while (isalnum(*d)) d++;
++        *d = '\0';
++        return bitch("unrecognized directive: %s", s);
++    }
++    return s;
++}
++
++char *
++read_zone_line(void)
++{
++    char *r;
++
++    if (file_info->generate_lhs) {
++        if (file_info->generate_cur <= file_info->generate_lim) {
++            file_info->buf[0] = 0;
++            concat_generate_template(file_info->buf, LINEBUFSZ, file_info->generate_cur, file_info->generate_lhs);
++            mystrlcat(file_info->buf, " ", LINEBUFSZ);
++            mystrlcat(file_info->buf, file_info->generate_type, LINEBUFSZ);
++            mystrlcat(file_info->buf, " ", LINEBUFSZ);
++            concat_generate_template(file_info->buf, LINEBUFSZ, file_info->generate_cur, file_info->generate_rhs);
++            file_info->generate_cur++;
++            return file_info->buf;
++        } else {
++            /* Done with this $GENERATE */
++            file_info->generate_cur = 0;
++            file_info->generate_lim = 0;
++            file_info->generate_type = NULL;
++            file_info->generate_lhs = NULL;
++            free_generate_template(file_info->generate_lhs);
++            free_generate_template(file_info->generate_rhs);
++            file_info->generate_rhs = NULL;
++        }
++    }
++
++    r = fgets(file_info->buf, LINEBUFSZ, file_info->file);
++    if (r)
++        file_info->line++;
++    return r;
+ }
+ 
+ int
+ read_zone_file(void)
+ {
+-	char *s;
+-	char *name = NULL, *class, *rdtype;
+-	long ttl = -1;
+-	while (file_info) {
+-		while (fgets(file_info->buf, 2048, file_info->file)) {
+-			freeall_temp();
+-			file_info->line++;
+-			file_info->paren_mode = 0;
+-			rdtype = NULL;
+-			if (empty_line_or_comment(file_info->buf))
+-				continue;
+-
+-			s = file_info->buf;
+-			if (!isspace(*s)) {
+-				/* <domain-name>, $INCLUDE, $ORIGIN */
+-				if (*s == '$') {
+-					process_directive(s);
+-					continue;
+-				} else {
+-					/* <domain-name> */
+-					name = extract_name(&s, "record name", 0);
+-					if (!name)
+-						continue;
+-				}
+-			} else {
+-				s = skip_white_space(s);
+-			}
+-			if (!s)
+-				continue;
+-			if (!name) {
+-				bitch("cannot assume previous name for it is not known");
+-				continue;
+-			}
+-			if (G.default_ttl >= 0)
+-				ttl = G.default_ttl;
+-			if (isdigit(*s)) {
+-				ttl = extract_timevalue(&s, "TTL");
+-				if (ttl < 0)
+-					continue;
+-				class = extract_label(&s, "class or type", "temporary");
+-				if (!class)
+-					continue;
+-				if (*class == 'i' && *(class+1) == 'n' && *(class+2) == 0) {
+-				} else if (*class == 'c' && *(class+1) == 's' && *(class+2) == 0) {
+-					bitch("CSNET class is not supported");
+-					continue;
+-				} else if (*class == 'c' && *(class+1) == 'h' && *(class+2) == 0) {
+-					bitch("CHAOS class is not supported");
+-					continue;
+-				} else if (*class == 'h' && *(class+1) == 's' && *(class+2) == 0) {
+-					bitch("HESIOD class is not supported");
+-					continue;
+-				} else {
+-					rdtype = class;
+-				}
+-			} else {
+-				class = extract_label(&s, "class or type", "temporary");
+-				if (!class)
+-					continue;
+-				if (*class == 'i' && *(class+1) == 'n' && *(class+2) == 0) {
+-					if (isdigit(*s)) {
+-						ttl = extract_timevalue(&s, "TTL");
+-						if (ttl < 0)
+-							continue;
+-					}
+-				} else if (*class == 'c' && *(class+1) == 's' && *(class+2) == 0) {
+-					bitch("CSNET class is not supported");
+-					continue;
+-				} else if (*class == 'c' && *(class+1) == 'h' && *(class+2) == 0) {
+-					bitch("CHAOS class is not supported");
+-					continue;
+-				} else if (*class == 'h' && *(class+1) == 's' && *(class+2) == 0) {
+-					bitch("HESIOD class is not supported");
+-					continue;
+-				} else {
+-					rdtype = class;
+-				}
+-			}
+-			if (!rdtype) {
+-				rdtype = extract_label(&s, "type", "temporary");
+-			}
+-			if (!rdtype) {
+-				continue;
+-			}
+-			if (ttl < 0) {
+-				ttl = G.default_ttl;
+-			}
+-			if (ttl < 0) {
+-				bitch("ttl not specified and default is not known");
+-				continue;
+-			}
+-
+-			{
+-				int is_generic;
+-				int type = str2rdtype(rdtype, &is_generic);
+-				if (type <= 0) continue;
+-				if (is_generic)
+-					rr_parse_any(name, ttl, type, s);
+-				else if (type > T_MAX)
+-					rr_parse_any(name, ttl, type, s);
+-				else if (rr_methods[type].rr_parse)
+-					rr_methods[type].rr_parse(name, ttl, type, s);
+-				else
+-					rr_parse_any(name, ttl, type, s);
+-			}
+-		}
+-		if (ferror(file_info->file))
+-			croak(1, "read error for %s", file_info->name);
+-		file_info = file_info->next;
+-	}
+-	return 0;
++    char *s;
++    char *name = NULL, *class, *rdtype;
++    long ttl = -1;
++    while (file_info) {
++        while (read_zone_line()) {
++            freeall_temp();
++            file_info->paren_mode = 0;
++            rdtype = NULL;
++            if (empty_line_or_comment(file_info->buf))
++                continue;
++
++            s = file_info->buf;
++            if (!isspace(*s)) {
++                /* <domain-name>, $INCLUDE, $ORIGIN */
++                if (*s == '$') {
++                    process_directive(s);
++                    continue;
++                } else {
++                    /* <domain-name> */
++                    name = extract_name(&s, "record name", 0);
++                    if (!name)
++                        continue;
++                }
++            } else {
++                s = skip_white_space(s);
++            }
++            if (!s)
++                continue;
++            if (!name) {
++                bitch("cannot assume previous name for it is not known");
++                continue;
++            }
++            if (G.default_ttl >= 0)
++                ttl = G.default_ttl;
++            if (isdigit(*s)) {
++                ttl = extract_timevalue(&s, "TTL");
++                if (ttl < 0)
++                    continue;
++                class = extract_label(&s, "class or type", "temporary");
++                if (!class)
++                    continue;
++                if (*class == 'i' && *(class+1) == 'n' && *(class+2) == 0) {
++                } else if (*class == 'c' && *(class+1) == 's' && *(class+2) == 0) {
++                    bitch("CSNET class is not supported");
++                    continue;
++                } else if (*class == 'c' && *(class+1) == 'h' && *(class+2) == 0) {
++                    bitch("CHAOS class is not supported");
++                    continue;
++                } else if (*class == 'h' && *(class+1) == 's' && *(class+2) == 0) {
++                    bitch("HESIOD class is not supported");
++                    continue;
++                } else {
++                    rdtype = class;
++                }
++            } else {
++                class = extract_label(&s, "class or type", "temporary");
++                if (!class)
++                    continue;
++                if (*class == 'i' && *(class+1) == 'n' && *(class+2) == 0) {
++                    if (isdigit(*s)) {
++                        ttl = extract_timevalue(&s, "TTL");
++                        if (ttl < 0)
++                            continue;
++                    }
++                } else if (*class == 'c' && *(class+1) == 's' && *(class+2) == 0) {
++                    bitch("CSNET class is not supported");
++                    continue;
++                } else if (*class == 'c' && *(class+1) == 'h' && *(class+2) == 0) {
++                    bitch("CHAOS class is not supported");
++                    continue;
++                } else if (*class == 'h' && *(class+1) == 's' && *(class+2) == 0) {
++                    bitch("HESIOD class is not supported");
++                    continue;
++                } else {
++                    rdtype = class;
++                }
++            }
++            if (!rdtype) {
++                rdtype = extract_label(&s, "type", "temporary");
++            }
++            if (!rdtype) {
++                continue;
++            }
++            if (ttl < 0) {
++                ttl = G.default_ttl;
++            }
++
++            {
++                int is_generic;
++                int type = str2rdtype(rdtype, &is_generic);
++                struct rr *rr;
++
++                if (type <= 0) continue;
++
++                if (ttl < 0 && !(G.opt.soa_minttl_as_default_ttl && type == T_SOA)) {
++                    bitch("ttl not specified and default is not known");
++                    continue;
++                }
++
++                if (is_generic)
++                    rr = rr_parse_any(name, ttl, type, s);
++                else if (type > T_MAX)
++                    rr = rr_parse_any(name, ttl, type, s);
++                else if (rr_methods[type].rr_parse)
++                    rr = rr_methods[type].rr_parse(name, ttl, type, s);
++                else
++                    rr = rr_parse_any(name, ttl, type, s);
++
++                if (type == T_SOA && ttl < 0 && rr) {
++                    struct rr_soa *soa = (struct rr_soa *) rr;
++                    soa->rr.ttl = G.default_ttl = soa->minimum;
++                    if (G.opt.verbose) {
++                        fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
++                        fprintf(stderr, "no ttl specified; using SOA MINTTL (%ld) instead\n", G.default_ttl);
++                    }
++                }
++            }
++        }
++        if (ferror(file_info->file))
++            croak(1, "read error for %s", file_info->name);
++        file_info = file_info->next;
++    }
++    return 0;
+ }
+ 
+ void
+ open_zone_file(char *fname)
+ {
+-	FILE *f;
+-	struct file_info *new_file_info;
++    FILE *f;
++    struct file_info *new_file_info;
+ 
+-	if (strcmp(fname, "-") == 0) {
+-		f = stdin;
+-		fname = "stdin";
+-	} else {
+-		f = fopen(fname, "r");
+-	}
+-	if (!f)
+-		croak(1, "open %s", fname);
+-	new_file_info = malloc(sizeof(*new_file_info) + strlen(fname) + 1);
+-	if (!new_file_info)
+-		croak(1, "malloc(file_info), %s", fname);
+-	new_file_info->next = file_info;
+-	new_file_info->file = f;
+-	new_file_info->line = 0;
+-	strcpy(new_file_info->name, fname);
+-	file_info = new_file_info;
++    if (strcmp(fname, "-") == 0) {
++        f = stdin;
++        fname = "stdin";
++    } else {
++        f = fopen(fname, "r");
++        if (!file_info && !G.opt.include_path_specified) {
++            G.opt.include_path = quickstrdup(dirname(quickstrdup_temp(fname)));
++        }
++    }
++    if (!f)
++        croak(1, "open %s", fname);
++    new_file_info = malloc(sizeof(*new_file_info) + strlen(fname) + 1);
++    if (!new_file_info)
++        croak(1, "malloc(file_info), %s", fname);
++    new_file_info->next = file_info;
++    new_file_info->file = f;
++    new_file_info->line = 0;
++    strcpy(new_file_info->name, fname);
++    if (file_info) {
++        new_file_info->current_origin = file_info->current_origin;
++    } else {
++        new_file_info->current_origin = G.opt.first_origin;
++    }
++    file_info = new_file_info;
+ }
+ 
+ void usage(char *err)
+ {
+-	if (err)
+-		fprintf(stderr, "%s\n", err);
+-	fprintf(stderr, "Usage:\n");
+-	fprintf(stderr, "    %s -h\n", thisprogname());
+-	fprintf(stderr, "    %s [options] zone-file\n", thisprogname());
+-	fprintf(stderr, "Usage parameters:\n");
+-	fprintf(stderr, "\t-h\t\tproduce usage text and quit\n");
+-	fprintf(stderr, "\t-f\t\tquit on first validation error\n");
+-
+-	fprintf(stderr, "\t-p name\tperform policy check <name>\n");
+-	fprintf(stderr, "\t\t\tsingle-ns\n");
+-	fprintf(stderr, "\t\t\tcname-other-data\n");
+-	fprintf(stderr, "\t\t\tdname\n");
+-	fprintf(stderr, "\t\t\tnsec3param-not-apex\n");
+-	fprintf(stderr, "\t\t\tmx-alias\n");
+-	fprintf(stderr, "\t\t\tns-alias\n");
+-	fprintf(stderr, "\t\t\trp-txt-exists\n");
+-	fprintf(stderr, "\t\t\tall\n");
+-
+-	fprintf(stderr, "\t-n N\t\tuse N worker threads\n");
+-	fprintf(stderr, "\t-q\t\tquiet - do not produce any output\n");
+-	fprintf(stderr, "\t-s\t\tprint validation summary/stats\n");
+-	fprintf(stderr, "\t-x\t\tskip printing 'time taken' entry in summary/stats\n");
+-	fprintf(stderr, "\t-v\t\tbe extra verbose\n");
+-	fprintf(stderr, "\t-I path\tuse this path for $INCLUDE files\n");
+-	fprintf(stderr, "\t-z origin\tuse this origin as initial $ORIGIN\n");
+-	fprintf(stderr, "\t-t epoch-time\tuse this time instead of \"now\"\n");
+-	exit(1);
++    if (err)
++        fprintf(stderr, "%s\n", err);
++    fprintf(stderr, "Usage:\n");
++    fprintf(stderr, "    %s -h\n", thisprogname());
++    fprintf(stderr, "    %s [options] zone-file\n", thisprogname());
++    fprintf(stderr, "Usage parameters:\n");
++    fprintf(stderr, "\t-h\t\tproduce usage text and quit\n");
++    fprintf(stderr, "\t-f\t\tquit on first validation error\n");
++
++    fprintf(stderr, "\t-p name\tperform policy check <name>\n");
++    fprintf(stderr, "\t\t\tsingle-ns\n");
++    fprintf(stderr, "\t\t\tcname-other-data\n");
++    fprintf(stderr, "\t\t\tdname\n");
++    fprintf(stderr, "\t\t\tnsec3param-not-apex\n");
++    fprintf(stderr, "\t\t\tmx-alias\n");
++    fprintf(stderr, "\t\t\tns-alias\n");
++    fprintf(stderr, "\t\t\trp-txt-exists\n");
++    fprintf(stderr, "\t\t\ttlsa-host\n");
++    fprintf(stderr, "\t\t\tksk-exists\n");
++    fprintf(stderr, "\t\t\tsmimea-host\n");
++    fprintf(stderr, "\t\t\tall\n");
++
++    fprintf(stderr, "\t-n N\t\tuse N worker threads\n");
++    fprintf(stderr, "\t-q\t\tquiet - do not produce any output\n");
++    fprintf(stderr, "\t-s\t\tprint validation summary/stats\n");
++    fprintf(stderr, "\t-v\t\tbe extra verbose\n");
++    fprintf(stderr, "\t-I path\tuse this path for $INCLUDE files\n");
++    fprintf(stderr, "\t-z origin\tuse this origin as initial $ORIGIN\n");
++    fprintf(stderr, "\t-t epoch-time\tuse this time instead of \"now\"\n");
++    exit(1);
+ }
+ 
+ struct rr_methods rr_methods[T_MAX+1];
+ 
+ static void initialize_globals(void)
+ {
+-	int i;
++    int i;
+ 
+-	setenv("TZ", "GMT0", 1);	tzset();
+-	memset(&G, 0, sizeof(G));
+-	memset(&G.opt, 0, sizeof(G.opt));
+-	memset(&G.stats, 0, sizeof(G.stats));
+-	G.default_ttl = -1; /* XXX orly? */
+-	G.opt.times_to_check[0] = time(NULL);
+-	G.opt.n_times_to_check = 0;
+-
+-	for (i = 0; i <= T_MAX; i++) {
+-		rr_methods[i] = unknown_methods;
+-	}
+-	rr_methods[T_AAAA]         =       aaaa_methods;
+-	rr_methods[T_A]            =          a_methods;
+-	rr_methods[T_AFSDB]        =      afsdb_methods;
+-	rr_methods[T_CERT]         =       cert_methods;
+-	rr_methods[T_CNAME]        =      cname_methods;
+-	rr_methods[T_DHCID]        =      dhcid_methods;
+-	rr_methods[T_DLV]          =        dlv_methods;
+-	rr_methods[T_DNAME]        =      dname_methods;
+-	rr_methods[T_DNSKEY]       =     dnskey_methods;
+-	rr_methods[T_DS]           =         ds_methods;
+-	rr_methods[T_HINFO]        =      hinfo_methods;
+-	rr_methods[T_IPSECKEY]     =   ipseckey_methods;
+-	rr_methods[T_ISDN]         =       isdn_methods;
+-	rr_methods[T_KX]           =         kx_methods;
+-	rr_methods[T_L32]          =        l32_methods;
+-	rr_methods[T_L64]          =        l64_methods;
+-	rr_methods[T_LOC]          =        loc_methods;
+-	rr_methods[T_LP]           =         lp_methods;
+-	rr_methods[T_MB]           =         mb_methods;
+-	rr_methods[T_MG]           =         mg_methods;
+-	rr_methods[T_MINFO]        =      minfo_methods;
+-	rr_methods[T_MR]           =         mr_methods;
+-	rr_methods[T_MX]           =         mx_methods;
+-	rr_methods[T_NAPTR]        =      naptr_methods;
+-	rr_methods[T_NID]          =        nid_methods;
+-	rr_methods[T_NSAP]         =       nsap_methods;
+-	rr_methods[T_NSEC3PARAM]   = nsec3param_methods;
+-	rr_methods[T_NSEC3]        =      nsec3_methods;
+-	rr_methods[T_NSEC]         =       nsec_methods;
+-	rr_methods[T_NS]           =         ns_methods;
+-	rr_methods[T_PTR]          =        ptr_methods;
+-	rr_methods[T_PX]           =         px_methods;
+-	rr_methods[T_RP]           =         rp_methods;
+-	rr_methods[T_RT]           =         rt_methods;
+-	rr_methods[T_RRSIG]        =      rrsig_methods;
+-	rr_methods[T_SOA]          =        soa_methods;
+-	rr_methods[T_SPF]          =        spf_methods;
+-	rr_methods[T_SRV]          =        srv_methods;
+-	rr_methods[T_SSHFP]        =      sshfp_methods;
+-	rr_methods[T_TLSA]         =       tlsa_methods;
+-	rr_methods[T_TXT]          =        txt_methods;
+-	rr_methods[T_X25]          =        x25_methods;
++    setenv("TZ", "GMT0", 1);    tzset();
++    memset(&G, 0, sizeof(G));
++    memset(&G.opt, 0, sizeof(G.opt));
++    memset(&G.stats, 0, sizeof(G.stats));
++    memset(rr_counts, 0, sizeof(rr_counts[0])*(T_MAX+1));
++    G.default_ttl = -1; /* XXX orly? */
++    G.opt.times_to_check[0] = time(NULL);
++    G.opt.n_times_to_check = 0;
++    G.opt.include_path = ".";
++
++    for (i = 0; i <= T_MAX; i++) {
++        rr_methods[i] = unknown_methods;
++    }
++    rr_methods[T_AAAA]         =       aaaa_methods;
++    rr_methods[T_A]            =          a_methods;
++    rr_methods[T_AFSDB]        =      afsdb_methods;
++    rr_methods[T_CAA]          =        caa_methods;
++    rr_methods[T_CDNSKEY]      =    cdnskey_methods;
++    rr_methods[T_CDS]          =        cds_methods;
++    rr_methods[T_CERT]         =       cert_methods;
++    rr_methods[T_CNAME]        =      cname_methods;
++    rr_methods[T_DHCID]        =      dhcid_methods;
++    rr_methods[T_DLV]          =        dlv_methods;
++    rr_methods[T_DNAME]        =      dname_methods;
++    rr_methods[T_DNSKEY]       =     dnskey_methods;
++    rr_methods[T_DS]           =         ds_methods;
++    rr_methods[T_HINFO]        =      hinfo_methods;
++    rr_methods[T_IPSECKEY]     =   ipseckey_methods;
++    rr_methods[T_ISDN]         =       isdn_methods;
++    rr_methods[T_KX]           =         kx_methods;
++    rr_methods[T_L32]          =        l32_methods;
++    rr_methods[T_L64]          =        l64_methods;
++    rr_methods[T_LOC]          =        loc_methods;
++    rr_methods[T_LP]           =         lp_methods;
++    rr_methods[T_MB]           =         mb_methods;
++    rr_methods[T_MG]           =         mg_methods;
++    rr_methods[T_MINFO]        =      minfo_methods;
++    rr_methods[T_MR]           =         mr_methods;
++    rr_methods[T_MX]           =         mx_methods;
++    rr_methods[T_NAPTR]        =      naptr_methods;
++    rr_methods[T_NID]          =        nid_methods;
++    rr_methods[T_NSAP]         =       nsap_methods;
++    rr_methods[T_NSEC3PARAM]   = nsec3param_methods;
++    rr_methods[T_NSEC3]        =      nsec3_methods;
++    rr_methods[T_NSEC]         =       nsec_methods;
++    rr_methods[T_NS]           =         ns_methods;
++    rr_methods[T_PTR]          =        ptr_methods;
++    rr_methods[T_PX]           =         px_methods;
++    rr_methods[T_RP]           =         rp_methods;
++    rr_methods[T_RT]           =         rt_methods;
++    rr_methods[T_RRSIG]        =      rrsig_methods;
++    rr_methods[T_SMIMEA]       =     smimea_methods;
++    rr_methods[T_SOA]          =        soa_methods;
++    rr_methods[T_SPF]          =        spf_methods;
++    rr_methods[T_SRV]          =        srv_methods;
++    rr_methods[T_SSHFP]        =      sshfp_methods;
++    rr_methods[T_TLSA]         =       tlsa_methods;
++    rr_methods[T_TXT]          =        txt_methods;
++    rr_methods[T_X25]          =        x25_methods;
+ }
+ 
+ int
+ main(int argc, char **argv)
+ {
+-	int o;
+-	struct timeval start, stop;
++    int o;
++    struct timeval start, stop;
+ 
+-	initialize_globals();
+-	while ((o = getopt(argc, argv, "fhqsxvI:z:t:p:n:")) != -1) {
+-		switch(o) {
+-		case 'h':
+-			usage(NULL);
+-			break;
+-		case 'f':
+-			G.opt.die_on_first_error = 1;
+-			break;
+-		case 'q':
+-			G.opt.no_output = 1;
+-			break;
+-		case 's':
+-			G.opt.summary = 1;
+-			break;
+-		case 'x':
+-			G.opt.notiming = 1;
+-			break;
+-		case 'v':
+-			G.opt.verbose = 1;
+-			break;
+-		case 'p':
+-			if (strcmp(optarg, "all") == 0) {
+-				int i;
+-				for (i = 0; i < N_POLICY_CHECKS; i++) {
+-					G.opt.policy_checks[i] = 1;
+-				}
+-			} else if (strcmp(optarg, "single-ns") == 0) {
+-				G.opt.policy_checks[POLICY_SINGLE_NS] = 1;
+-			} else if (strcmp(optarg, "cname-other-data") == 0) {
+-				G.opt.policy_checks[POLICY_CNAME_OTHER_DATA] = 1;
+-			} else if (strcmp(optarg, "dname") == 0) {
+-				G.opt.policy_checks[POLICY_DNAME] = 1;
+-			} else if (strcmp(optarg, "dnskey") == 0) {
+-				G.opt.policy_checks[POLICY_DNSKEY] = 1;
+-			} else if (strcmp(optarg, "nsec3param-not-apex") == 0) {
+-				G.opt.policy_checks[POLICY_NSEC3PARAM_NOT_APEX] = 1;
+-			} else if (strcmp(optarg, "mx-alias") == 0) {
+-				G.opt.policy_checks[POLICY_MX_ALIAS] = 1;
+-			} else if (strcmp(optarg, "ns-alias") == 0) {
+-				G.opt.policy_checks[POLICY_NS_ALIAS] = 1;
+-			} else if (strcmp(optarg, "rp-txt-exists") == 0) {
+-				G.opt.policy_checks[POLICY_RP_TXT_EXISTS] = 1;
+-			} else if (strcmp(optarg, "tlsa-host") == 0) {
+-				G.opt.policy_checks[POLICY_TLSA_HOST] = 1;
+-			} else {
+-				usage("unknown policy name");
+-			}
+-			break;
+-		case 'I':
+-			G.opt.include_path = optarg;
+-			break;
+-		case 'z':
+-			if (strlen(optarg) && *(optarg+strlen(optarg)-1) == '.') {
+-				G.opt.current_origin = optarg;
+-			} else if (strlen(optarg)) {
+-				G.opt.current_origin = getmem(strlen(optarg)+2);
+-				strcpy(mystpcpy(G.opt.current_origin, optarg), ".");
+-			} else {
+-				usage("origin must not be empty");
+-			}
+-			break;
+-		case 'n':
+-			G.opt.n_threads = strtol(optarg, NULL, 10);
+-			if (G.opt.n_threads > 256)
+-				usage("non-sensical number of threads requested");
+-			if (G.opt.verbose)
+-				fprintf(stderr, "using %d worker threads\n", G.opt.n_threads);
+-			break;
+-		case 't':
+-			if (G.opt.n_times_to_check >= MAX_TIMES_TO_CHECK)
+-				usage("too many -t specified");
+-			G.opt.times_to_check[G.opt.n_times_to_check++] = strtol(optarg, NULL, 10);
+-			break;
+-		default:
+-			usage(NULL);
+-		}
+-	}
+-	if (G.opt.n_times_to_check <= 0)
+-		G.opt.n_times_to_check = 1;
+-	argc -= optind;
+-	argv += optind;
+-	if (argc != 1)
+-		usage(NULL);
+-	gettimeofday(&start, NULL);
+-	open_zone_file(argv[0]);
+-	read_zone_file();
+-	validate_zone();
+-	verify_all_keys();
+-	if (G.nsec3_present) {
+-		if (first_nsec3) nsec3_validate(&first_nsec3->rr);
+-		perform_remaining_nsec3checks();
+-	}
+-	gettimeofday(&stop, NULL);
+-	if (G.opt.summary) {
+-		printf("records found:       %d\n", G.stats.rr_count);
+-		printf("skipped dups:        %d\n", G.stats.skipped_dup_rr_count);
+-		printf("record sets found:   %d\n", G.stats.rrset_count);
+-		printf("unique names found:  %d\n", G.stats.names_count);
+-		printf("delegations found:   %d\n", G.stats.delegations);
+-		printf("    nsec3 records:   %d\n", G.stats.nsec3_count);
+-		/* "not authoritative names" - non-empty terminals without any authoritative records */
+-		/* delegation points count as authoritative, which might or might not be correct */
+-		printf("not authoritative names, not counting delegation points:\n"
+-			   "                     %d\n", G.stats.not_authoritative);
+-		printf("validation errors:   %d\n", G.stats.error_count);
+-		printf("signatures verified: %d\n", G.stats.signatures_verified);
+-		if (!G.opt.notiming) {
+-			printf("time taken:          %.3fs\n",
+-			   stop.tv_sec - start.tv_sec + (stop.tv_usec - start.tv_usec)/1000000.);
+-		}
+-	}
+-	return G.exit_code;
++    initialize_globals();
++    while ((o = getopt(argc, argv, "fhMqsvI:z:t:p:n:")) != -1) {
++        switch(o) {
++        case 'h':
++            usage(NULL);
++            break;
++        case 'f':
++            G.opt.die_on_first_error = 1;
++            break;
++        case 'M':
++            G.opt.soa_minttl_as_default_ttl = 1;
++            break;
++        case 'q':
++            G.opt.no_output = 1;
++            break;
++        case 's':
++            G.opt.summary++;
++            break;
++        case 'v':
++            G.opt.verbose = 1;
++            break;
++        case 'p':
++            if (strcmp(optarg, "all") == 0) {
++                int i;
++                for (i = 0; i < N_POLICY_CHECKS; i++) {
++                    G.opt.policy_checks[i] = 1;
++                }
++            } else if (strcmp(optarg, "single-ns") == 0) {
++                G.opt.policy_checks[POLICY_SINGLE_NS] = 1;
++            } else if (strcmp(optarg, "cname-other-data") == 0) {
++                G.opt.policy_checks[POLICY_CNAME_OTHER_DATA] = 1;
++            } else if (strcmp(optarg, "dname") == 0) {
++                G.opt.policy_checks[POLICY_DNAME] = 1;
++            } else if (strcmp(optarg, "dnskey") == 0) {
++                G.opt.policy_checks[POLICY_DNSKEY] = 1;
++            } else if (strcmp(optarg, "nsec3param-not-apex") == 0) {
++                G.opt.policy_checks[POLICY_NSEC3PARAM_NOT_APEX] = 1;
++            } else if (strcmp(optarg, "mx-alias") == 0) {
++                G.opt.policy_checks[POLICY_MX_ALIAS] = 1;
++            } else if (strcmp(optarg, "ns-alias") == 0) {
++                G.opt.policy_checks[POLICY_NS_ALIAS] = 1;
++            } else if (strcmp(optarg, "rp-txt-exists") == 0) {
++                G.opt.policy_checks[POLICY_RP_TXT_EXISTS] = 1;
++            } else if (strcmp(optarg, "tlsa-host") == 0) {
++                G.opt.policy_checks[POLICY_TLSA_HOST] = 1;
++            } else if (strcmp(optarg, "smimea-host") == 0) {
++                G.opt.policy_checks[POLICY_SMIMEA_HOST] = 1;
++            } else if (strcmp(optarg, "ksk-exists") == 0) {
++                G.opt.policy_checks[POLICY_KSK_EXISTS] = 1;
++            } else {
++                usage("unknown policy name");
++            }
++            break;
++        case 'I':
++            G.opt.include_path = optarg;
++            G.opt.include_path_specified = 1;
++            break;
++        case 'z':
++            if (strlen(optarg) && *(optarg+strlen(optarg)-1) == '.') {
++                G.opt.first_origin = optarg;
++            } else if (strlen(optarg)) {
++                G.opt.first_origin = getmem(strlen(optarg)+2);
++                strcpy(mystpcpy(G.opt.first_origin, optarg), ".");
++            } else {
++                usage("origin must not be empty");
++            }
++            break;
++        case 'n':
++            G.opt.n_threads = strtol(optarg, NULL, 10);
++            if (G.opt.n_threads > 256)
++                usage("non-sensical number of threads requested");
++            if (G.opt.verbose)
++                fprintf(stderr, "using %d worker threads\n", G.opt.n_threads);
++            break;
++        case 't':
++            if (G.opt.n_times_to_check >= MAX_TIMES_TO_CHECK)
++                usage("too many -t specified");
++            G.opt.times_to_check[G.opt.n_times_to_check++] = strtol(optarg, NULL, 10);
++            break;
++        default:
++            usage(NULL);
++        }
++    }
++    if (G.opt.n_times_to_check <= 0)
++        G.opt.n_times_to_check = 1;
++    argc -= optind;
++    argv += optind;
++    if (argc != 1)
++        usage(NULL);
++    gettimeofday(&start, NULL);
++    open_zone_file(argv[0]);
++    read_zone_file();
++    validate_zone();
++    verify_all_keys();
++    if (G.nsec3_present) {
++        if (first_nsec3) nsec3_validate(&first_nsec3->rr);
++        perform_remaining_nsec3checks();
++    }
++    if (G.dnssec_active && G.opt.policy_checks[POLICY_KSK_EXISTS]) {
++        dnskey_ksk_policy_check();
++    }
++    gettimeofday(&stop, NULL);
++    if (G.opt.summary) {
++        printf("records found:       %d\n", G.stats.rr_count);
++        printf("skipped dups:        %d\n", G.stats.skipped_dup_rr_count);
++        printf("record sets found:   %d\n", G.stats.rrset_count);
++        printf("unique names found:  %d\n", G.stats.names_count);
++        printf("delegations found:   %d\n", G.stats.delegations);
++        printf("    nsec3 records:   %d\n", G.stats.nsec3_count);
++        /* "not authoritative names" - non-empty terminals without any authoritative records */
++        /* delegation points count as authoritative, which might or might not be correct */
++        printf("not authoritative names, not counting delegation points:\n"
++               "                     %d\n", G.stats.not_authoritative);
++        printf("validation errors:   %d\n", G.stats.error_count);
++        printf("signatures verified: %d\n", G.stats.signatures_verified);
++        printf("time taken:          %.3fs\n",
++               stop.tv_sec - start.tv_sec + (stop.tv_usec - start.tv_usec)/1000000.);
++        if (G.opt.summary > 1) {
++            int i;
++            printf("record count by type:\n");
++            for (i = 1; i <= T_MAX; i++) {
++                if (rr_counts[i])
++                    printf("%20s: %d\n", rdtype2str(i), rr_counts[i]);
++            }
++        }
++    }
++    return G.exit_code;
+ }
+diff -Naur validns-0.8/Makefile validns/Makefile
+--- validns-0.8/Makefile	2014-02-11 15:08:39.000000000 -0500
++++ validns/Makefile	2020-10-05 16:59:29.353681351 -0400
+@@ -27,7 +27,7 @@
+ 	dname.o tlsa.o nid.o l32.o l64.o lp.o \
+ 	ipseckey.o cbtree.o mb.o mg.o mr.o minfo.o \
+ 	afsdb.o x25.o isdn.o rt.o px.o kx.o \
+-	dlv.o dhcid.o nsap.o
++	dlv.o dhcid.o nsap.o caa.o
+ 	$(CC) $(CFLAGS) $(OPTIMIZE) -o validns \
+ 	    main.o carp.o mempool.o textparse.o base64.o base32hex.o \
+ 	    rr.o soa.o a.o cname.o mx.o ns.o \
+@@ -38,7 +38,7 @@
+ 	    dname.o tlsa.o nid.o l32.o l64.o lp.o \
+ 	    ipseckey.o cbtree.o mb.o mg.o mr.o minfo.o \
+ 	    afsdb.o x25.o isdn.o rt.o px.o kx.o \
+-	    dlv.o dhcid.o nsap.o \
++	    dlv.o dhcid.o nsap.o caa.o \
+ 	    -L/usr/local/lib -L/opt/local/lib $(EXTRALPATH) \
+ 	    -lJudy -lcrypto $(EXTRALIBS) $(EXTRALINKING)
+ 
+@@ -53,7 +53,7 @@
+ 	-rm -f nid.o l32.o l64.o lp.o ipseckey.o
+ 	-rm -f cbtree.o mb.o mg.o mr.o minfo.o
+ 	-rm -f afsdb.o x25.o isdn.o rt.o px.o kx.o
+-	-rm -f dlv.o dhcid.o nsap.o
++	-rm -f dlv.o dhcid.o nsap.o caa.o
+ 	-rm -f validns.core core
+ 	@echo ':-)'
+ 
+@@ -177,6 +177,9 @@
+ sshfp.o: sshfp.c common.h textparse.h mempool.h carp.h rr.h
+ 	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o sshfp.o sshfp.c $(INCPATH)
+ 
++caa.o: caa.c common.h textparse.h mempool.h carp.h rr.h
++	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o caa.o caa.c $(INCPATH)
++
+ rp.o: rp.c common.h textparse.h mempool.h carp.h rr.h
+ 	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o rp.o rp.c $(INCPATH)
+ 
+diff -Naur validns-0.8/mb.c validns/mb.c
+--- validns-0.8/mb.c	2014-02-11 15:46:38.000000000 -0500
++++ validns/mb.c	2020-10-05 16:59:29.354681360 -0400
+@@ -19,28 +19,28 @@
+ 
+ static struct rr *mb_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_mb *rr = getmem(sizeof(*rr));
++    struct rr_mb *rr = getmem(sizeof(*rr));
+ 
+-	rr->madname = extract_name(&s, "madname", 0);
+-	if (!rr->madname)
+-		return NULL;
+-	if (*s) {
+-		return bitch("garbage after valid MB data");
+-	}
++    rr->madname = extract_name(&s, "madname", 0);
++    if (!rr->madname)
++        return NULL;
++    if (*s) {
++        return bitch("garbage after valid MB data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* mb_human(struct rr *rrv)
+ {
+-	RRCAST(mb);
++    RRCAST(mb);
+     return rr->madname;
+ }
+ 
+ static struct binary_data mb_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(mb);
+-	return name2wire_name(rr->madname);
++    RRCAST(mb);
++    return name2wire_name(rr->madname);
+ }
+ 
+ struct rr_methods mb_methods = { mb_parse, mb_human, mb_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/mempool.c validns/mempool.c
+--- validns-0.8/mempool.c	2014-02-11 15:47:03.000000000 -0500
++++ validns/mempool.c	2020-10-05 16:59:29.354681360 -0400
+@@ -14,10 +14,10 @@
+ 
+ struct pool
+ {
+-	struct pool *next;
+-	size_t pool_size;
+-	size_t free_index;
+-	char mem[0];
++    struct pool *next;
++    size_t pool_size;
++    size_t free_index;
++    char mem[0];
+ };
+ 
+ static struct pool *freespace = NULL;
+@@ -25,78 +25,78 @@
+ 
+ static void new_pool(size_t size)
+ {
+-	struct pool *pool;
++    struct pool *pool;
+ 
+-	size = (size + sizeof(void *) - 1) / sizeof(void *);
+-	size *= sizeof(void *);
+-	pool = malloc(size + sizeof(struct pool));
+-	if (!pool)
+-		croak(1, "new_pool malloc");
+-	pool->next = freespace;
+-	pool->free_index = 0;
+-	pool->pool_size = size;
+-	freespace = pool;
++    size = (size + sizeof(void *) - 1) / sizeof(void *);
++    size *= sizeof(void *);
++    pool = malloc(size + sizeof(struct pool));
++    if (!pool)
++        croak(1, "new_pool malloc");
++    pool->next = freespace;
++    pool->free_index = 0;
++    pool->pool_size = size;
++    freespace = pool;
+ }
+ 
+ void
+ mem_requirements_hint(size_t size)
+ {
+-	if (freespace) return;
+-	new_pool(size);
++    if (freespace) return;
++    new_pool(size);
+ }
+ 
+ void *getmem(size_t size)
+ {
+-	void *ret;
+-	size = (size + sizeof(void *) - 1) / sizeof(void *);
+-	size *= sizeof(void *);
+-	if (!freespace)	new_pool(size > 256000 ? size : 256000);
+-	if (freespace->pool_size - freespace->free_index < size)
+-		new_pool(size > 256000 ? size : 256000);
+-	ret = freespace->mem + freespace->free_index;
+-	freespace->free_index += size;
+-	return ret;
++    void *ret;
++    size = (size + sizeof(void *) - 1) / sizeof(void *);
++    size *= sizeof(void *);
++    if (!freespace) new_pool(size > 256000 ? size : 256000);
++    if (freespace->pool_size - freespace->free_index < size)
++        new_pool(size > 256000 ? size : 256000);
++    ret = freespace->mem + freespace->free_index;
++    freespace->free_index += size;
++    return ret;
+ }
+ 
+ void *getmem_temp(size_t size)
+ {
+-	void *ret;
+-	size = (size + sizeof(void *) - 1) / sizeof(void *);
+-	size *= sizeof(void *);
+-	if (!temp_freespace) {
+-		size_t pool_size = size > 1024*1024 ? size : 1024*1024;
+-		pool_size = (pool_size + sizeof(void *) - 1) / sizeof(void *);
+-		pool_size *= sizeof(void *);
+-		temp_freespace = malloc(pool_size + sizeof(struct pool));
+-		if (!temp_freespace)
+-			croak(1, "getmem_temp malloc");
+-		temp_freespace->next = NULL;
+-		temp_freespace->free_index = 0;
+-		temp_freespace->pool_size = pool_size;
+-	}
+-	if (temp_freespace->pool_size - temp_freespace->free_index < size)
+-		croak(1, "getmem_temp request too large");
+-	ret = temp_freespace->mem + temp_freespace->free_index;
+-	temp_freespace->free_index += size;
+-	return ret;
++    void *ret;
++    size = (size + sizeof(void *) - 1) / sizeof(void *);
++    size *= sizeof(void *);
++    if (!temp_freespace) {
++        size_t pool_size = size > 1024*1024 ? size : 1024*1024;
++        pool_size = (pool_size + sizeof(void *) - 1) / sizeof(void *);
++        pool_size *= sizeof(void *);
++        temp_freespace = malloc(pool_size + sizeof(struct pool));
++        if (!temp_freespace)
++            croak(1, "getmem_temp malloc");
++        temp_freespace->next = NULL;
++        temp_freespace->free_index = 0;
++        temp_freespace->pool_size = pool_size;
++    }
++    if (temp_freespace->pool_size - temp_freespace->free_index < size)
++        croak(1, "getmem_temp request too large");
++    ret = temp_freespace->mem + temp_freespace->free_index;
++    temp_freespace->free_index += size;
++    return ret;
+ }
+ 
+ int freeall_temp(void)
+ {
+-	if (temp_freespace) {
+-		temp_freespace->free_index = 0;
+-	}
+-	return 1;
++    if (temp_freespace) {
++        temp_freespace->free_index = 0;
++    }
++    return 1;
+ }
+ 
+ char *quickstrdup(char *s)
+ {
+-	char *r = getmem(strlen(s)+1);
+-	return strcpy(r, s);
++    char *r = getmem(strlen(s)+1);
++    return strcpy(r, s);
+ }
+ 
+ char *quickstrdup_temp(char *s)
+ {
+-	char *r = getmem_temp(strlen(s)+1);
+-	return strcpy(r, s);
++    char *r = getmem_temp(strlen(s)+1);
++    return strcpy(r, s);
+ }
+diff -Naur validns-0.8/mg.c validns/mg.c
+--- validns-0.8/mg.c	2014-02-11 15:46:40.000000000 -0500
++++ validns/mg.c	2020-10-05 16:59:29.355681369 -0400
+@@ -19,28 +19,28 @@
+ 
+ static struct rr *mg_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_mg *rr = getmem(sizeof(*rr));
++    struct rr_mg *rr = getmem(sizeof(*rr));
+ 
+-	rr->mgmname = extract_name(&s, "mgmname", 0);
+-	if (!rr->mgmname)
+-		return NULL;
+-	if (*s) {
+-		return bitch("garbage after valid MG data");
+-	}
++    rr->mgmname = extract_name(&s, "mgmname", 0);
++    if (!rr->mgmname)
++        return NULL;
++    if (*s) {
++        return bitch("garbage after valid MG data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* mg_human(struct rr *rrv)
+ {
+-	RRCAST(mg);
++    RRCAST(mg);
+     return rr->mgmname;
+ }
+ 
+ static struct binary_data mg_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(mg);
+-	return name2wire_name(rr->mgmname);
++    RRCAST(mg);
++    return name2wire_name(rr->mgmname);
+ }
+ 
+ struct rr_methods mg_methods = { mg_parse, mg_human, mg_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/minfo.c validns/minfo.c
+--- validns-0.8/minfo.c	2014-02-11 15:46:43.000000000 -0500
++++ validns/minfo.c	2020-10-05 16:59:29.355681369 -0400
+@@ -19,38 +19,38 @@
+ 
+ static struct rr *minfo_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_minfo *rr = getmem(sizeof(*rr));
++    struct rr_minfo *rr = getmem(sizeof(*rr));
+ 
+-	rr->rmailbx = extract_name(&s, "rmailbx", 0);
+-	if (!rr->rmailbx)
+-		return NULL;
++    rr->rmailbx = extract_name(&s, "rmailbx", 0);
++    if (!rr->rmailbx)
++        return NULL;
+ 
+-	rr->emailbx = extract_name(&s, "emailbx", 0);
+-	if (!rr->emailbx)
+-		return NULL;
++    rr->emailbx = extract_name(&s, "emailbx", 0);
++    if (!rr->emailbx)
++        return NULL;
+ 
+-	if (*s) {
+-		return bitch("garbage after valid MINFO data");
+-	}
++    if (*s) {
++        return bitch("garbage after valid MINFO data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* minfo_human(struct rr *rrv)
+ {
+-	RRCAST(minfo);
+-	char s[1024];
++    RRCAST(minfo);
++    char s[1024];
+ 
+-	snprintf(s, 1024, "%s %s", rr->rmailbx, rr->emailbx);
+-	return quickstrdup_temp(s);
++    snprintf(s, 1024, "%s %s", rr->rmailbx, rr->emailbx);
++    return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data minfo_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(minfo);
+-	return compose_binary_data("dd", 1,
+-		name2wire_name(rr->rmailbx),
+-		name2wire_name(rr->emailbx));
++    RRCAST(minfo);
++    return compose_binary_data("dd", 1,
++        name2wire_name(rr->rmailbx),
++        name2wire_name(rr->emailbx));
+ }
+ 
+ struct rr_methods minfo_methods = { minfo_parse, minfo_human, minfo_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/mr.c validns/mr.c
+--- validns-0.8/mr.c	2014-02-11 15:46:46.000000000 -0500
++++ validns/mr.c	2020-10-05 16:59:29.355681369 -0400
+@@ -19,28 +19,28 @@
+ 
+ static struct rr *mr_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_mr *rr = getmem(sizeof(*rr));
++    struct rr_mr *rr = getmem(sizeof(*rr));
+ 
+-	rr->newname = extract_name(&s, "newname", 0);
+-	if (!rr->newname)
+-		return NULL;
+-	if (*s) {
+-		return bitch("garbage after valid MR data");
+-	}
++    rr->newname = extract_name(&s, "newname", 0);
++    if (!rr->newname)
++        return NULL;
++    if (*s) {
++        return bitch("garbage after valid MR data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* mr_human(struct rr *rrv)
+ {
+-	RRCAST(mr);
++    RRCAST(mr);
+     return rr->newname;
+ }
+ 
+ static struct binary_data mr_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(mr);
+-	return name2wire_name(rr->newname);
++    RRCAST(mr);
++    return name2wire_name(rr->newname);
+ }
+ 
+ struct rr_methods mr_methods = { mr_parse, mr_human, mr_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/mx.c validns/mx.c
+--- validns-0.8/mx.c	2014-02-11 15:45:19.000000000 -0500
++++ validns/mx.c	2020-10-05 16:59:29.355681369 -0400
+@@ -19,59 +19,59 @@
+ 
+ static struct rr *mx_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_mx *rr = getmem(sizeof(*rr));
++    struct rr_mx *rr = getmem(sizeof(*rr));
+ 
+-	rr->preference = extract_integer(&s, "MX preference");
+-	if (rr->preference < 0)
+-		return NULL;
+-	/* XXX preference range check */
+-	rr->exchange = extract_name(&s, "MX exchange", 0);
+-	if (!rr->exchange)
+-		return NULL;
+-	if (*s) {
+-		return bitch("garbage after valid MX data");
+-	}
++    rr->preference = extract_integer(&s, "MX preference", NULL);
++    if (rr->preference < 0)
++        return NULL;
++    /* XXX preference range check */
++    rr->exchange = extract_name(&s, "MX exchange", 0);
++    if (!rr->exchange)
++        return NULL;
++    if (*s) {
++        return bitch("garbage after valid MX data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* mx_human(struct rr *rrv)
+ {
+-	RRCAST(mx);
++    RRCAST(mx);
+     char s[1024];
+ 
+     snprintf(s, 1024, "%d %s",
+-	     rr->preference, rr->exchange);
++         rr->preference, rr->exchange);
+     return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data mx_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(mx);
++    RRCAST(mx);
+ 
+     return compose_binary_data("2d", 1,
+-		rr->preference, name2wire_name(rr->exchange));
++        rr->preference, name2wire_name(rr->exchange));
+ }
+ 
+ static void* mx_validate_set(struct rr_set *rr_set)
+ {
+-	if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) {
+-		struct rr *rr = rr_set->tail;
+-		return moan(rr->file_name, rr->line, "host name contains '/'");
+-	}
+-	return NULL;
++    if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) {
++        struct rr *rr = rr_set->tail;
++        return moan(rr->file_name, rr->line, "host name contains '/'");
++    }
++    return NULL;
+ }
+ 
+ static void *mx_validate(struct rr *rrv)
+ {
+-	RRCAST(mx);
++    RRCAST(mx);
+ 
+-	if (G.opt.policy_checks[POLICY_MX_ALIAS]) {
+-		if (find_rr_set(T_CNAME, rr->exchange)) {
+-			return moan(rr->rr.file_name, rr->rr.line, "MX exchange is an alias");
+-		}
+-	}
+-	return NULL;
++    if (G.opt.policy_checks[POLICY_MX_ALIAS]) {
++        if (find_rr_set(T_CNAME, rr->exchange)) {
++            return moan(rr->rr.file_name, rr->rr.line, "MX exchange is an alias");
++        }
++    }
++    return NULL;
+ }
+ 
+ struct rr_methods mx_methods = { mx_parse, mx_human, mx_wirerdata, mx_validate_set, mx_validate };
+diff -Naur validns-0.8/naptr.c validns/naptr.c
+--- validns-0.8/naptr.c	2014-02-11 15:45:22.000000000 -0500
++++ validns/naptr.c	2020-10-05 16:59:29.355681369 -0400
+@@ -20,74 +20,74 @@
+ 
+ static struct rr *naptr_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_naptr *rr = getmem(sizeof(*rr));
+-	int i;
+-	struct binary_data text;
+-
+-	i = extract_integer(&s, "order");
+-	if (i < 0)
+-		return NULL;
+-	if (i >= 65536)
+-		return bitch("order range is not valid");
+-	rr->order = i;
+-
+-	i = extract_integer(&s, "preference");
+-	if (i < 0)
+-		return NULL;
+-	if (i >= 65536)
+-		return bitch("preference range is not valid");
+-	rr->preference = i;
+-
+-	text = extract_text(&s, "flags");
+-	if (text.length < 0)
+-		return NULL;
+-	for (i = 0; i < text.length; i++) {
+-		if (!isalnum(text.data[i])) {
+-			return bitch("flags contains illegal characters");
+-		}
+-	}
+-	rr->flags = text;
+-
+-	text = extract_text(&s, "services");
+-	if (text.length < 0)
+-		return NULL;
+-	rr->services = text;
+-
+-	text = extract_text(&s, "regexp");
+-	if (text.length < 0)
+-		return NULL;
+-	rr->regexp = text;
+-
+-	rr->replacement = extract_name(&s, "replacement", 0);
+-	if (!rr->replacement)
+-		return NULL;
+-
+-	if (*s) {
+-		return bitch("garbage after valid NAPTR data");
+-	}
++    struct rr_naptr *rr = getmem(sizeof(*rr));
++    int i;
++    struct binary_data text;
++
++    i = extract_integer(&s, "order", NULL);
++    if (i < 0)
++        return NULL;
++    if (i >= 65536)
++        return bitch("order range is not valid");
++    rr->order = i;
++
++    i = extract_integer(&s, "preference", NULL);
++    if (i < 0)
++        return NULL;
++    if (i >= 65536)
++        return bitch("preference range is not valid");
++    rr->preference = i;
++
++    text = extract_text(&s, "flags");
++    if (text.length < 0)
++        return NULL;
++    for (i = 0; i < text.length; i++) {
++        if (!isalnum(text.data[i])) {
++            return bitch("flags contains illegal characters");
++        }
++    }
++    rr->flags = text;
++
++    text = extract_text(&s, "services");
++    if (text.length < 0)
++        return NULL;
++    rr->services = text;
++
++    text = extract_text(&s, "regexp");
++    if (text.length < 0)
++        return NULL;
++    rr->regexp = text;
++
++    rr->replacement = extract_name(&s, "replacement", 0);
++    if (!rr->replacement)
++        return NULL;
++
++    if (*s) {
++        return bitch("garbage after valid NAPTR data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* naptr_human(struct rr *rrv)
+ {
+-	RRCAST(naptr);
++    RRCAST(naptr);
+     char s[1024];
+ 
+-	snprintf(s, 1024, "%hu %hu \"%s\" ...",
+-			 rr->order, rr->preference, rr->flags.data);
++    snprintf(s, 1024, "%hu %hu \"%s\" ...",
++             rr->order, rr->preference, rr->flags.data);
+ 
+-	return quickstrdup_temp(s);
++    return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data naptr_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(naptr);
++    RRCAST(naptr);
+ 
+     return compose_binary_data("22bbbd", 1,
+-		rr->order, rr->preference,
+-		rr->flags, rr->services, rr->regexp,
+-		name2wire_name(rr->replacement));
++        rr->order, rr->preference,
++        rr->flags, rr->services, rr->regexp,
++        name2wire_name(rr->replacement));
+ }
+ 
+ struct rr_methods naptr_methods = { naptr_parse, naptr_human, naptr_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/nid.c validns/nid.c
+--- validns-0.8/nid.c	2014-02-11 15:46:20.000000000 -0500
++++ validns/nid.c	2020-10-05 16:59:29.355681369 -0400
+@@ -19,39 +19,39 @@
+ 
+ static struct rr *nid_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_nid *rr = getmem(sizeof(*rr));
+-	int preference;
++    struct rr_nid *rr = getmem(sizeof(*rr));
++    int preference;
+ 
+-	rr->preference = preference = extract_integer(&s, "NID preference");
+-	if (preference < 0)
+-		return NULL;
+-	if (extract_u64(&s, "NodeID", &rr->node_id) < 0)
+-		return NULL;
+-
+-	if (*s) {
+-		return bitch("garbage after valid NID data");
+-	}
++    rr->preference = preference = extract_integer(&s, "NID preference", NULL);
++    if (preference < 0)
++        return NULL;
++    if (extract_u64(&s, "NodeID", &rr->node_id) < 0)
++        return NULL;
++
++    if (*s) {
++        return bitch("garbage after valid NID data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* nid_human(struct rr *rrv)
+ {
+-	RRCAST(nid);
++    RRCAST(nid);
+     char s[1024];
+ 
+     snprintf(s, 1024, "%d %x:%x:%x:%x",
+-	     rr->preference,
+-		 (unsigned)(rr->node_id >> 48) & 0xffff,
+-		 (unsigned)(rr->node_id >> 32) & 0xffff,
+-		 (unsigned)(rr->node_id >> 16) & 0xffff,
+-		 (unsigned)(rr->node_id >> 0) & 0xffff);
++         rr->preference,
++         (unsigned)(rr->node_id >> 48) & 0xffff,
++         (unsigned)(rr->node_id >> 32) & 0xffff,
++         (unsigned)(rr->node_id >> 16) & 0xffff,
++         (unsigned)(rr->node_id >> 0) & 0xffff);
+     return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data nid_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(nid);
++    RRCAST(nid);
+     return compose_binary_data("28", 1, rr->preference, rr->node_id);
+ }
+ 
+diff -Naur validns-0.8/nsap.c validns/nsap.c
+--- validns-0.8/nsap.c	2014-02-11 15:46:48.000000000 -0500
++++ validns/nsap.c	2020-10-05 16:59:29.355681369 -0400
+@@ -19,15 +19,15 @@
+ 
+ static struct rr* nsap_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_nsap *rr = getmem(sizeof(*rr));
++    struct rr_nsap *rr = getmem(sizeof(*rr));
+ 
+-	rr->data = extract_hex_binary_data(&s, "NSAP data", EXTRACT_EAT_WHITESPACE);
+-	if (rr->data.length < 0)	return NULL;
++    rr->data = extract_hex_binary_data(&s, "NSAP data", EXTRACT_EAT_WHITESPACE);
++    if (rr->data.length < 0)    return NULL;
+ 
+-	if (*s) {
+-		return bitch("garbage after valid NSAP data");
+-	}
+-	return store_record(type, name, ttl, rr);
++    if (*s) {
++        return bitch("garbage after valid NSAP data");
++    }
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* nsap_human(struct rr *rrv)
+@@ -37,9 +37,9 @@
+ 
+ static struct binary_data nsap_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(nsap);
++    RRCAST(nsap);
+ 
+-	return compose_binary_data("d", 1, rr->data);
++    return compose_binary_data("d", 1, rr->data);
+ }
+ 
+ struct rr_methods nsap_methods = { nsap_parse, nsap_human, nsap_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/ns.c validns/ns.c
+--- validns-0.8/ns.c	2014-02-11 15:45:28.000000000 -0500
++++ validns/ns.c	2020-10-05 16:59:29.355681369 -0400
+@@ -20,63 +20,63 @@
+ 
+ static struct rr *ns_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_ns *rr = getmem(sizeof(*rr));
+-	struct rr *ret_rr;
++    struct rr_ns *rr = getmem(sizeof(*rr));
++    struct rr *ret_rr;
+ 
+-	rr->nsdname = extract_name(&s, "name server domain name", 0);
+-	if (!rr->nsdname)
+-		return NULL;
+-	if (*s) {
+-		return bitch("garbage after valid NS data");
+-	}
+-
+-	ret_rr = store_record(type, name, ttl, rr);
+-	if (ret_rr) {
+-		if (!(ret_rr->rr_set->named_rr->flags & (NAME_FLAG_APEX|NAME_FLAG_DELEGATION))) {
+-			ret_rr->rr_set->named_rr->flags |= NAME_FLAG_DELEGATION;
+-			G.stats.delegations++;
+-		}
+-	}
+-	return ret_rr;
++    rr->nsdname = extract_name(&s, "name server domain name", 0);
++    if (!rr->nsdname)
++        return NULL;
++    if (*s) {
++        return bitch("garbage after valid NS data");
++    }
++
++    ret_rr = store_record(type, name, ttl, rr);
++    if (ret_rr) {
++        if (!(ret_rr->rr_set->named_rr->flags & (NAME_FLAG_APEX|NAME_FLAG_DELEGATION))) {
++            ret_rr->rr_set->named_rr->flags |= NAME_FLAG_DELEGATION;
++            G.stats.delegations++;
++        }
++    }
++    return ret_rr;
+ }
+ 
+ static char* ns_human(struct rr *rrv)
+ {
+-	RRCAST(ns);
++    RRCAST(ns);
+ 
+     return rr->nsdname;
+ }
+ 
+ static struct binary_data ns_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(ns);
+-	return name2wire_name(rr->nsdname);
++    RRCAST(ns);
++    return name2wire_name(rr->nsdname);
+ }
+ 
+ static void* ns_validate_set(struct rr_set *rr_set)
+ {
+-	struct rr *rr;
+-	if (G.opt.policy_checks[POLICY_SINGLE_NS]) {
+-		if (rr_set->count < 2) {
+-			rr = rr_set->tail;
+-			return moan(rr->file_name, rr->line, "there should be at least two NS records per name");
+-		}
+-	}
+-	return NULL;
++    struct rr *rr;
++    if (G.opt.policy_checks[POLICY_SINGLE_NS]) {
++        if (rr_set->count < 2) {
++            rr = rr_set->tail;
++            return moan(rr->file_name, rr->line, "there should be at least two NS records per name");
++        }
++    }
++    return NULL;
+ }
+ 
+ static void *ns_validate(struct rr *rrv)
+ {
+-	RRCAST(ns);
++    RRCAST(ns);
+ 
+-	if (G.opt.policy_checks[POLICY_NS_ALIAS]) {
+-		if (find_rr_set(T_CNAME, rr->nsdname)) {
+-			return moan(rr->rr.file_name, rr->rr.line, "NS data is an alias");
+-		}
+-	}
+-	if (strchr(rr->nsdname, '/') != NULL)
+-		return moan(rr->rr.file_name, rr->rr.line, "NS data contains '/'");
+-	return NULL;
++    if (G.opt.policy_checks[POLICY_NS_ALIAS]) {
++        if (find_rr_set(T_CNAME, rr->nsdname)) {
++            return moan(rr->rr.file_name, rr->rr.line, "NS data is an alias");
++        }
++    }
++    if (strchr(rr->nsdname, '/') != NULL)
++        return moan(rr->rr.file_name, rr->rr.line, "NS data contains '/'");
++    return NULL;
+ }
+ 
+ struct rr_methods ns_methods = { ns_parse, ns_human, ns_wirerdata, ns_validate_set, ns_validate };
+diff -Naur validns-0.8/nsec3.c validns/nsec3.c
+--- validns-0.8/nsec3.c	2014-02-11 15:45:31.000000000 -0500
++++ validns/nsec3.c	2020-10-05 16:59:29.355681369 -0400
+@@ -24,125 +24,125 @@
+ static struct rr* nsec3_parse(char *name, long ttl, int type, char *s)
+ {
+     struct rr_nsec3 *rr = getmem(sizeof(*rr));
+-	struct rr *ret_rr;
+-	struct binary_data bitmap;
+-	int i;
+-	int opt_out = 0;
+-	char *str_type = NULL;
+-	int ltype;
+-
+-	i = extract_integer(&s, "hash algorithm");
+-	if (i < 0)
+-		return NULL;
+-	if (i > 255)
+-		return bitch("bad hash algorithm value");
+-	if (i != 1)
+-		return bitch("unrecognized or unsupported hash algorithm");
+-	rr->hash_algorithm = i;
+-
+-	i = extract_integer(&s, "flags");
+-	if (i < 0)
+-		return NULL;
+-	if (i > 255)
+-		return bitch("bad flags value");
+-
+-	if (!(i == 0 || i == 1))
+-		return bitch("unsupported flags value");
+-	if (i == 1)
+-		opt_out = 1;
+-	rr->flags = i;
+-
+-	i = extract_integer(&s, "iterations");
+-	if (i < 0)
+-		return NULL;
+-	if (i > 2500)
+-		return bitch("bad iterations value");
+-	rr->iterations = i;
+-	/* TODO validate iteration count according to key size,
+-	 * as per http://tools.ietf.org/html/rfc5155#section-10.3 */
+-
+-	if (*s == '-') {
+-		rr->salt.length = 0;
+-		rr->salt.data = NULL;
+-		s++;
+-		if (*s && !isspace(*s) && *s != ';' && *s != ')')
+-			return bitch("salt is not valid");
+-		s = skip_white_space(s);
+-	} else {
+-		rr->salt = extract_hex_binary_data(&s, "salt", EXTRACT_DONT_EAT_WHITESPACE);
+-		if (rr->salt.length <= 0)
+-			return NULL;
+-		if (rr->salt.length > 255)
+-			return bitch("salt is too long");
+-	}
+-
+-	rr->next_hashed_owner = extract_base32hex_binary_data(&s, "next hashed owner");
+-	if (rr->next_hashed_owner.length != 20) {
+-		return bitch("next hashed owner does not have the right size");
+-	}
+-
+-	bitmap = new_set();
+-	while (s && *s) {
+-		str_type = extract_label(&s, "type list", "temporary");
+-		if (!str_type) return NULL;
+-		ltype = str2rdtype(str_type, NULL);
+-		if (ltype < 0)
+-			return NULL;
+-		add_bit_to_set(&bitmap, ltype);
+-	}
+-	if (!s)
+-		return NULL;
+-	rr->type_bitmap = compressed_set(&bitmap);
++    struct rr *ret_rr;
++    struct binary_data bitmap;
++    int i;
++    int opt_out = 0;
++    char *str_type = NULL;
++    int ltype;
++
++    i = extract_integer(&s, "hash algorithm", NULL);
++    if (i < 0)
++        return NULL;
++    if (i > 255)
++        return bitch("bad hash algorithm value");
++    if (i != 1)
++        return bitch("unrecognized or unsupported hash algorithm");
++    rr->hash_algorithm = i;
++
++    i = extract_integer(&s, "flags", NULL);
++    if (i < 0)
++        return NULL;
++    if (i > 255)
++        return bitch("bad flags value");
++
++    if (!(i == 0 || i == 1))
++        return bitch("unsupported flags value");
++    if (i == 1)
++        opt_out = 1;
++    rr->flags = i;
++
++    i = extract_integer(&s, "iterations", NULL);
++    if (i < 0)
++        return NULL;
++    if (i > 2500)
++        return bitch("bad iterations value");
++    rr->iterations = i;
++    /* TODO validate iteration count according to key size,
++     * as per http://tools.ietf.org/html/rfc5155#section-10.3 */
++
++    if (*s == '-') {
++        rr->salt.length = 0;
++        rr->salt.data = NULL;
++        s++;
++        if (*s && !isspace(*s) && *s != ';' && *s != ')')
++            return bitch("salt is not valid");
++        s = skip_white_space(s);
++    } else {
++        rr->salt = extract_hex_binary_data(&s, "salt", EXTRACT_DONT_EAT_WHITESPACE);
++        if (rr->salt.length <= 0)
++            return NULL;
++        if (rr->salt.length > 255)
++            return bitch("salt is too long");
++    }
++
++    rr->next_hashed_owner = extract_base32hex_binary_data(&s, "next hashed owner");
++    if (rr->next_hashed_owner.length != 20) {
++        return bitch("next hashed owner does not have the right size");
++    }
++
++    bitmap = new_set();
++    while (s && *s) {
++        str_type = extract_label(&s, "type list", "temporary");
++        if (!str_type) return NULL;
++        ltype = str2rdtype(str_type, NULL);
++        if (ltype < 0)
++            return NULL;
++        add_bit_to_set(&bitmap, ltype);
++    }
++    if (!s)
++        return NULL;
++    rr->type_bitmap = compressed_set(&bitmap);
+ 
+-	rr->corresponding_name = NULL;
+-	rr->next_nsec3 = NULL;
++    rr->corresponding_name = NULL;
++    rr->next_nsec3 = NULL;
+ 
+-	if (!remember_nsec3(name, rr))
+-		return NULL;
++    if (!remember_nsec3(name, rr))
++        return NULL;
+ 
+     ret_rr = store_record(type, name, ttl, rr);
+-	if (ret_rr) {
+-		G.nsec3_present = 1;
+-		G.dnssec_active = 1;
+-		G.stats.nsec3_count++;
+-		if (opt_out) {
+-			G.nsec3_opt_out_present = 1;
+-		}
+-		if (ret_rr && !nsec3param)
+-			nsec3param = ret_rr;
+-	}
+-	return ret_rr;
++    if (ret_rr) {
++        G.nsec3_present = 1;
++        G.dnssec_active = 1;
++        G.stats.nsec3_count++;
++        if (opt_out) {
++            G.nsec3_opt_out_present = 1;
++        }
++        if (ret_rr && !nsec3param)
++            nsec3param = ret_rr;
++    }
++    return ret_rr;
+ }
+ 
+ static char* nsec3_human(struct rr *rrv)
+ {
+-	RRCAST(nsec3);
++    RRCAST(nsec3);
+     char ss[1024];
+-	char *s = ss;
+-	int l;
+-	int i;
++    char *s = ss;
++    int l;
++    int i;
+ 
+     l = snprintf(s, 1024, "%u %u %u ", rr->hash_algorithm, rr->flags, rr->iterations);
+-	s += l;
+-	if (rr->salt.length) {
+-		for (i = 0; i < rr->salt.length; i++) {
+-			l = snprintf(s, 1024-(s-ss), "%02X", (unsigned char)rr->salt.data[i]);
+-			s += l;
+-		}
+-	} else {
+-		sprintf(s, "-");
+-	}
++    s += l;
++    if (rr->salt.length) {
++        for (i = 0; i < rr->salt.length; i++) {
++            l = snprintf(s, 1024-(s-ss), "%02X", (unsigned char)rr->salt.data[i]);
++            s += l;
++        }
++    } else {
++        sprintf(s, "-");
++    }
+     return quickstrdup_temp(ss);
+ }
+ 
+ static struct binary_data nsec3_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(nsec3);
++    RRCAST(nsec3);
+ 
+-	return compose_binary_data("112bbd", 1,
+-		rr->hash_algorithm, rr->flags,
+-		rr->iterations, rr->salt,
+-		rr->next_hashed_owner, rr->type_bitmap);
++    return compose_binary_data("112bbd", 1,
++        rr->hash_algorithm, rr->flags,
++        rr->iterations, rr->salt,
++        rr->next_hashed_owner, rr->type_bitmap);
+ }
+ 
+ struct rr_nsec3 *first_nsec3 = NULL;
+@@ -150,36 +150,36 @@
+ 
+ void* nsec3_validate(struct rr *rrv)
+ {
+-	RRCAST(nsec3);
++    RRCAST(nsec3);
+ 
+-	if (!first_nsec3) {
+-		first_nsec3 = rr;
+-	}
+-	if (latest_nsec3) {
+-		if (memcmp(latest_nsec3->next_hashed_owner.data, rr->this_hashed_name.data, 20) != 0) {
+-			char *expected_name = quickstrdup_temp(rr->rr.rr_set->named_rr->name);
+-			/* guaranteed to have same length, I think */
+-			encode_base32hex(expected_name, 32, latest_nsec3->next_hashed_owner.data, 20);
+-			if (rr == first_nsec3) {
+-				moan(latest_nsec3->rr.file_name, latest_nsec3->rr.line,
+-					 "broken NSEC3 chain, expected %s, but nothing found",
+-					 expected_name);
+-			} else {
+-				moan(latest_nsec3->rr.file_name, latest_nsec3->rr.line,
+-					 "broken NSEC3 chain, expected %s, but found %s",
+-					 expected_name,
+-					 rr->rr.rr_set->named_rr->name);
+-			}
+-			if (rr != first_nsec3)
+-				latest_nsec3->next_nsec3 = rr;
+-			latest_nsec3 = rr;
+-			return NULL;
+-		}
+-		if (rr != first_nsec3)
+-			latest_nsec3->next_nsec3 = rr;
+-	}
+-	latest_nsec3 = rr;
+-	return rr;
++    if (!first_nsec3) {
++        first_nsec3 = rr;
++    }
++    if (latest_nsec3) {
++        if (memcmp(latest_nsec3->next_hashed_owner.data, rr->this_hashed_name.data, 20) != 0) {
++            char *expected_name = quickstrdup_temp(rr->rr.rr_set->named_rr->name);
++            /* guaranteed to have same length, I think */
++            encode_base32hex(expected_name, 32, latest_nsec3->next_hashed_owner.data, 20);
++            if (rr == first_nsec3) {
++                moan(latest_nsec3->rr.file_name, latest_nsec3->rr.line,
++                     "broken NSEC3 chain, expected %s, but nothing found",
++                     expected_name);
++            } else {
++                moan(latest_nsec3->rr.file_name, latest_nsec3->rr.line,
++                     "broken NSEC3 chain, expected %s, but found %s",
++                     expected_name,
++                     rr->rr.rr_set->named_rr->name);
++            }
++            if (rr != first_nsec3)
++                latest_nsec3->next_nsec3 = rr;
++            latest_nsec3 = rr;
++            return NULL;
++        }
++        if (rr != first_nsec3)
++            latest_nsec3->next_nsec3 = rr;
++    }
++    latest_nsec3 = rr;
++    return rr;
+ }
+ 
+ struct rr_methods nsec3_methods = { nsec3_parse, nsec3_human, nsec3_wirerdata, NULL, nsec3_validate };
+diff -Naur validns-0.8/nsec3checks.c validns/nsec3checks.c
+--- validns-0.8/nsec3checks.c	2020-10-05 16:57:07.219376944 -0400
++++ validns/nsec3checks.c	2020-10-05 16:59:48.870860473 -0400
+@@ -29,44 +29,44 @@
+ {
+     struct rr_nsec3param *p = (struct rr_nsec3param *)param;
+     EVP_MD_CTX *ctx;
+-	unsigned char md0[EVP_MAX_MD_SIZE];
+-	unsigned char md1[EVP_MAX_MD_SIZE];
+-	unsigned char *md[2];
+-	int mdi = 0;
+-	struct binary_data r = bad_binary_data();
+-	struct binary_data wire_name = name2wire_name(name);
+-	int i;
+-	int digest_size;
+-
+-	md[0] = md0;
+-	md[1] = md1;
+-	if (wire_name.length < 0)
+-		return r;
++    unsigned char md0[EVP_MAX_MD_SIZE];
++    unsigned char md1[EVP_MAX_MD_SIZE];
++    unsigned char *md[2];
++    int mdi = 0;
++    struct binary_data r = bad_binary_data();
++    struct binary_data wire_name = name2wire_name(name);
++    int i;
++    int digest_size;
++
++    md[0] = md0;
++    md[1] = md1;
++    if (wire_name.length < 0)
++        return r;
+ 
+-	/* XXX Maybe use Init_ex and Final_ex for speed? */
++    /* XXX Maybe use Init_ex and Final_ex for speed? */
+ 
+     ctx = EVP_MD_CTX_new();
+-		return r;
++        return r;
+     digest_size = EVP_MD_CTX_size(ctx);
+     EVP_DigestUpdate(ctx, wire_name.data, wire_name.length);
+     EVP_DigestUpdate(ctx, p->salt.data, p->salt.length);
+     EVP_DigestFinal(ctx, md[mdi], NULL);
+ 
+-	for (i = 0; i < p->iterations; i++) {
++    for (i = 0; i < p->iterations; i++) {
+         if (EVP_DigestInit(ctx, EVP_sha1()) != 1)
+-			return r;
++            return r;
+         EVP_DigestUpdate(ctx, md[mdi], digest_size);
+-		mdi = (mdi + 1) % 2;
++        mdi = (mdi + 1) % 2;
+         EVP_DigestUpdate(ctx, p->salt.data, p->salt.length);
+         EVP_DigestFinal(ctx, md[mdi], NULL);
+-	}
++    }
+     EVP_MD_CTX_free(ctx);
+ 
+ 
+-	r.length = digest_size;
+-	r.data = getmem(digest_size);
+-	memcpy(r.data, md[mdi], digest_size);
+-	return r;
++    r.length = digest_size;
++    r.data = getmem(digest_size);
++    memcpy(r.data, md[mdi], digest_size);
++    return r;
+ }
+ 
+ int sorted_hashed_names_count;
+@@ -77,193 +77,193 @@
+ static int
+ validate_nsec3_for_name(const char *name, intptr_t *data, void *p)
+ {
+-	struct named_rr *named_rr = *((struct named_rr **)data);
+-	struct binary_data hash;
+-	struct rr_nsec3 **nsec3_slot;
+-	struct rr_nsec3 *nsec3;
++    struct named_rr *named_rr = *((struct named_rr **)data);
++    struct binary_data hash;
++    struct rr_nsec3 **nsec3_slot;
++    struct rr_nsec3 *nsec3;
+ 
+-	if ((named_rr->flags & mask) == NAME_FLAG_KIDS_WITH_RECORDS) {
+-		//fprintf(stderr, "--- need nsec3, kids with records: %s\n", named_rr->name);
++    if ((named_rr->flags & mask) == NAME_FLAG_KIDS_WITH_RECORDS) {
++        //fprintf(stderr, "--- need nsec3, kids with records: %s\n", named_rr->name);
+ needs_nsec3:
+-		freeall_temp();
+-		hash = name2hash(named_rr->name, nsec3param);
+-		if (hash.length < 0) {
+-			moan(named_rr->file_name, named_rr->line, "internal: cannot calculate hashed name");
+-			goto next;
+-		}
+-		if (hash.length != 20)
+-			croak(4, "assertion failed: wrong hashed name size %d", hash.length);
+-		JHSG(nsec3_slot, nsec3_hash, hash.data, hash.length);
+-		if (nsec3_slot == PJERR)
+-			croak(5, "perform_remaining_nsec3checks: JHSG failed");
+-		if (!nsec3_slot) {
+-			moan(named_rr->file_name, named_rr->line,
+-				 "no corresponding NSEC3 found for %s",
+-				 named_rr->name);
+-			goto next;
+-		}
+-		nsec3 = *nsec3_slot;
+-		if (!nsec3)
+-			croak(6, "assertion failed: existing nsec3 from hash is empty");
+-		nsec3->corresponding_name = named_rr;
+-		sorted_hashed_names_count++;
+-		check_typemap(nsec3->type_bitmap, named_rr, &nsec3->rr);
+-	} else if ((named_rr->flags &
+-				(NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_SIGNED_DELEGATION)) ==
+-			   NAME_FLAG_SIGNED_DELEGATION)
+-	{
+-		//fprintf(stderr, "--- need nsec3, signed delegation: %s\n", named_rr->name);
+-		goto needs_nsec3;
+-	} else if (!G.nsec3_opt_out_present && (named_rr->flags &
+-											(NAME_FLAG_APEX_PARENT|NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_DELEGATION|NAME_FLAG_HAS_RECORDS)) ==
+-			   0)
+-	{
+-		//fprintf(stderr, "--- need nsec3, empty non-term: %s\n", named_rr->name);
+-		goto needs_nsec3;
+-	} else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE))==NAME_FLAG_DELEGATION)
+-	{
+-		//fprintf(stderr, "--- need nsec3, no opt-out: %s\n", named_rr->name);
+-		goto needs_nsec3;
+-	} else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_THIS_WITH_RECORDS|NAME_FLAG_NOT_AUTHORITATIVE)) == NAME_FLAG_THIS_WITH_RECORDS)
+-	{
+-		//fprintf(stderr, "--- need nsec3, this with records: %s\n", named_rr->name);
+-		goto needs_nsec3;
+-	} else {
+-		//fprintf(stderr, "--- NO need for nsec3: %s\n", named_rr->name);
+-	}
++        freeall_temp();
++        hash = name2hash(named_rr->name, nsec3param);
++        if (hash.length < 0) {
++            moan(named_rr->file_name, named_rr->line, "internal: cannot calculate hashed name");
++            goto next;
++        }
++        if (hash.length != 20)
++            croak(4, "assertion failed: wrong hashed name size %d", hash.length);
++        JHSG(nsec3_slot, nsec3_hash, hash.data, hash.length);
++        if (nsec3_slot == PJERR)
++            croak(5, "perform_remaining_nsec3checks: JHSG failed");
++        if (!nsec3_slot) {
++            moan(named_rr->file_name, named_rr->line,
++                 "no corresponding NSEC3 found for %s",
++                 named_rr->name);
++            goto next;
++        }
++        nsec3 = *nsec3_slot;
++        if (!nsec3)
++            croak(6, "assertion failed: existing nsec3 from hash is empty");
++        nsec3->corresponding_name = named_rr;
++        sorted_hashed_names_count++;
++        check_typemap(nsec3->type_bitmap, named_rr, &nsec3->rr);
++    } else if ((named_rr->flags &
++                (NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_SIGNED_DELEGATION)) ==
++               NAME_FLAG_SIGNED_DELEGATION)
++    {
++        //fprintf(stderr, "--- need nsec3, signed delegation: %s\n", named_rr->name);
++        goto needs_nsec3;
++    } else if (!G.nsec3_opt_out_present && (named_rr->flags &
++                                            (NAME_FLAG_APEX_PARENT|NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_DELEGATION|NAME_FLAG_HAS_RECORDS)) ==
++               0)
++    {
++        //fprintf(stderr, "--- need nsec3, empty non-term: %s\n", named_rr->name);
++        goto needs_nsec3;
++    } else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE))==NAME_FLAG_DELEGATION)
++    {
++        //fprintf(stderr, "--- need nsec3, no opt-out: %s\n", named_rr->name);
++        goto needs_nsec3;
++    } else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_THIS_WITH_RECORDS|NAME_FLAG_NOT_AUTHORITATIVE)) == NAME_FLAG_THIS_WITH_RECORDS)
++    {
++        //fprintf(stderr, "--- need nsec3, this with records: %s\n", named_rr->name);
++        goto needs_nsec3;
++    } else {
++        //fprintf(stderr, "--- NO need for nsec3: %s\n", named_rr->name);
++    }
+ next:
+-	return 1;
++    return 1;
+ }
+ 
+ void perform_remaining_nsec3checks(void)
+ {
+-	struct rr_nsec3 *nsec3;
++    struct rr_nsec3 *nsec3;
+ 
+-	sorted_hashed_names_count = 0;
+-	mask = NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_NSEC3_ONLY|NAME_FLAG_KIDS_WITH_RECORDS;
+-	if (G.nsec3_opt_out_present) {
+-		mask |= NAME_FLAG_DELEGATION;
+-	}
+-
+-	cbtree_allprefixed(&zone_data, "", validate_nsec3_for_name, NULL);
+-
+-	nsec3 = first_nsec3;
+-	while (nsec3) {
+-		if (!nsec3->corresponding_name) {
+-			moan(nsec3->rr.file_name, nsec3->rr.line,
+-				 "NSEC3 without a corresponding record (or empty non-terminal)");
+-		}
+-		nsec3 = nsec3->next_nsec3;
+-	}
++    sorted_hashed_names_count = 0;
++    mask = NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_NSEC3_ONLY|NAME_FLAG_KIDS_WITH_RECORDS;
++    if (G.nsec3_opt_out_present) {
++        mask |= NAME_FLAG_DELEGATION;
++    }
++
++    cbtree_allprefixed(&zone_data, "", validate_nsec3_for_name, NULL);
++
++    nsec3 = first_nsec3;
++    while (nsec3) {
++        if (!nsec3->corresponding_name) {
++            moan(nsec3->rr.file_name, nsec3->rr.line,
++                 "NSEC3 without a corresponding record (or empty non-terminal)");
++        }
++        nsec3 = nsec3->next_nsec3;
++    }
+ }
+ 
+ void *remember_nsec3(char *name, struct rr_nsec3 *rr)
+ {
+-	char hashed_name[33];
+-	char binary_hashed_name[20];
+-	int l;
+-	struct rr_nsec3 **nsec3_slot;
+-
+-	l = strlen(name);
+-	if (l < 33 || name[32] != '.')
+-		return bitch("NSEC3 record name is not valid");
+-	if (l == 33 && zone_apex_l != 1)  /* root zone */
+-		return bitch("NSEC3 record name is not valid");
+-	if (l > 33 && strcmp(name+33, zone_apex) != 0)
+-		return bitch("NSEC3 record name is not valid");
+-
+-	memcpy(hashed_name, name, 32);  hashed_name[32] = 0;
+-	l = decode_base32hex(binary_hashed_name, hashed_name, 20);
+-	if (l != 20)
+-		return bitch("NSEC3 record name is not valid");
+-	JHSI(nsec3_slot, nsec3_hash, binary_hashed_name, 20);
+-	if (nsec3_slot == PJERR)
+-		croak(2, "remember_nsec3: JHSI failed");
+-	if (*nsec3_slot)
+-		return bitch("multiple NSEC3 with the same record name");
+-	*nsec3_slot = rr;
+-	rr->this_hashed_name.length = 20;
+-	rr->this_hashed_name.data = getmem(20);
+-	memcpy(rr->this_hashed_name.data, binary_hashed_name, 20);
+-	return rr;
++    char hashed_name[33];
++    char binary_hashed_name[20];
++    int l;
++    struct rr_nsec3 **nsec3_slot;
++
++    l = strlen(name);
++    if (l < 33 || name[32] != '.')
++        return bitch("NSEC3 record name is not valid");
++    if (l == 33 && zone_apex_l != 1)  /* root zone */
++        return bitch("NSEC3 record name is not valid");
++    if (l > 33 && strcmp(name+33, zone_apex) != 0)
++        return bitch("NSEC3 record name is not valid");
++
++    memcpy(hashed_name, name, 32);  hashed_name[32] = 0;
++    l = decode_base32hex(binary_hashed_name, hashed_name, 20);
++    if (l != 20)
++        return bitch("NSEC3 record name is not valid");
++    JHSI(nsec3_slot, nsec3_hash, binary_hashed_name, 20);
++    if (nsec3_slot == PJERR)
++        croak(2, "remember_nsec3: JHSI failed");
++    if (*nsec3_slot)
++        return bitch("multiple NSEC3 with the same record name");
++    *nsec3_slot = rr;
++    rr->this_hashed_name.length = 20;
++    rr->this_hashed_name.data = getmem(20);
++    memcpy(rr->this_hashed_name.data, binary_hashed_name, 20);
++    return rr;
+ }
+ 
+ void *check_typemap(struct binary_data type_bitmap, struct named_rr *named_rr, struct rr *reference_rr)
+ {
+-	int type;
+-	char *base;
+-	int i, k;
+-	struct rr_set *set;
+-	uint32_t nsec_distinct_types = 0;
+-	uint32_t real_distinct_types;
+-
+-	base = type_bitmap.data;
+-	while (base - type_bitmap.data < type_bitmap.length) {
+-		for (i = 0; i < base[1]; i++) {
+-			for (k = 0; k <= 7; k++) {
+-				if (base[2+i] & (0x80 >> k)) {
+-					type = ((unsigned char)base[0])*256 + i*8 + k;
+-					nsec_distinct_types++;
+-					set = find_rr_set_in_named_rr(named_rr, type);
+-					if (!set) {
+-						return moan(reference_rr->file_name, reference_rr->line,
+-								   	"%s mentions %s, but no such record found for %s",
+-									rdtype2str(reference_rr->rdtype), rdtype2str(type), named_rr->name);
+-					}
+-				}
+-			}
+-		}
+-		base += base[1]+2;
+-	}
+-	real_distinct_types = get_rr_set_count(named_rr);
+-	if (real_distinct_types > nsec_distinct_types) {
+-		void *bitmap = NULL;
+-		struct rr_set **rr_set_slot;
+-		int rc;
+-		Word_t rcw;
+-		Word_t rdtype;
+-		int skipped = 0;
+-
+-		base = type_bitmap.data;
+-		while (base - type_bitmap.data < type_bitmap.length) {
+-			for (i = 0; i < base[1]; i++) {
+-				for (k = 0; k <= 7; k++) {
+-					if (base[2+i] & (0x80 >> k)) {
+-						type = ((unsigned char)base[0])*256 + i*8 + k;
+-						J1S(rc, bitmap, type);
+-					}
+-				}
+-			}
+-			base += base[1]+2;
+-		}
+-		rdtype = 0;
+-		JLF(rr_set_slot, named_rr->rr_sets, rdtype);
+-		while (rr_set_slot) {
+-			J1T(rc, bitmap, (*rr_set_slot)->rdtype);
+-			if (!rc) {
+-				if ((named_rr->flags & NAME_FLAG_DELEGATION) &&
+-					((*rr_set_slot)->rdtype == T_A ||
+-					(*rr_set_slot)->rdtype == T_AAAA))
+-				{
+-					skipped++;
+-				} else {
+-					moan(reference_rr->file_name, reference_rr->line,
+-						 "%s exists, but %s does not mention it for %s",
+-						 rdtype2str((*rr_set_slot)->rdtype),
+-						 rdtype2str(reference_rr->rdtype),
+-						 named_rr->name);
+-					J1FA(rcw, bitmap);
+-					return NULL;
+-				}
+-			}
+-			JLN(rr_set_slot, named_rr->rr_sets, rdtype);
+-		}
+-		J1FA(rcw, bitmap);
+-		if (real_distinct_types - skipped > nsec_distinct_types) {
+-			return moan(reference_rr->file_name, reference_rr->line,
+-						"internal: we know %s typemap is wrong, but don't know any details",
+-						rdtype2str(reference_rr->rdtype));
+-		}
+-	}
+-	return reference_rr;
++    int type;
++    char *base;
++    int i, k;
++    struct rr_set *set;
++    uint32_t nsec_distinct_types = 0;
++    uint32_t real_distinct_types;
++
++    base = type_bitmap.data;
++    while (base - type_bitmap.data < type_bitmap.length) {
++        for (i = 0; i < base[1]; i++) {
++            for (k = 0; k <= 7; k++) {
++                if (base[2+i] & (0x80 >> k)) {
++                    type = ((unsigned char)base[0])*256 + i*8 + k;
++                    nsec_distinct_types++;
++                    set = find_rr_set_in_named_rr(named_rr, type);
++                    if (!set) {
++                        return moan(reference_rr->file_name, reference_rr->line,
++                                    "%s mentions %s, but no such record found for %s",
++                                    rdtype2str(reference_rr->rdtype), rdtype2str(type), named_rr->name);
++                    }
++                }
++            }
++        }
++        base += base[1]+2;
++    }
++    real_distinct_types = get_rr_set_count(named_rr);
++    if (real_distinct_types > nsec_distinct_types) {
++        void *bitmap = NULL;
++        struct rr_set **rr_set_slot;
++        int rc;
++        Word_t rcw;
++        Word_t rdtype;
++        int skipped = 0;
++
++        base = type_bitmap.data;
++        while (base - type_bitmap.data < type_bitmap.length) {
++            for (i = 0; i < base[1]; i++) {
++                for (k = 0; k <= 7; k++) {
++                    if (base[2+i] & (0x80 >> k)) {
++                        type = ((unsigned char)base[0])*256 + i*8 + k;
++                        J1S(rc, bitmap, type);
++                    }
++                }
++            }
++            base += base[1]+2;
++        }
++        rdtype = 0;
++        JLF(rr_set_slot, named_rr->rr_sets, rdtype);
++        while (rr_set_slot) {
++            J1T(rc, bitmap, (*rr_set_slot)->rdtype);
++            if (!rc) {
++                if ((named_rr->flags & NAME_FLAG_DELEGATION) &&
++                    ((*rr_set_slot)->rdtype == T_A ||
++                    (*rr_set_slot)->rdtype == T_AAAA))
++                {
++                    skipped++;
++                } else {
++                    moan(reference_rr->file_name, reference_rr->line,
++                         "%s exists, but %s does not mention it for %s",
++                         rdtype2str((*rr_set_slot)->rdtype),
++                         rdtype2str(reference_rr->rdtype),
++                         named_rr->name);
++                    J1FA(rcw, bitmap);
++                    return NULL;
++                }
++            }
++            JLN(rr_set_slot, named_rr->rr_sets, rdtype);
++        }
++        J1FA(rcw, bitmap);
++        if (real_distinct_types - skipped > nsec_distinct_types) {
++            return moan(reference_rr->file_name, reference_rr->line,
++                        "internal: we know %s typemap is wrong, but don't know any details",
++                        rdtype2str(reference_rr->rdtype));
++        }
++    }
++    return reference_rr;
+ }
+diff -Naur validns-0.8/nsec3param.c validns/nsec3param.c
+--- validns-0.8/nsec3param.c	2014-02-11 15:45:41.000000000 -0500
++++ validns/nsec3param.c	2020-10-05 16:59:29.355681369 -0400
+@@ -24,94 +24,94 @@
+ static struct rr* nsec3param_parse(char *name, long ttl, int type, char *s)
+ {
+     struct rr_nsec3param *rr = getmem(sizeof(*rr));
+-	struct rr *ret_rr;
+-	int i;
++    struct rr *ret_rr;
++    int i;
+ 
+-	i = extract_integer(&s, "hash algorithm");
+-	if (i < 0)
+-		return NULL;
+-	if (i > 255)
+-		return bitch("bad hash algorithm value");
+-	if (i != 1)
+-		return bitch("unrecognized or unsupported hash algorithm");
+-	rr->hash_algorithm = i;
+-
+-	i = extract_integer(&s, "flags");
+-	if (i < 0)
+-		return NULL;
+-	if (i > 255)
+-		return bitch("bad flags value");
+-	if (i != 0)
+-		return bitch("flags is supposed to be 0 for NSEC3PARAM");
+-	rr->flags = i;
+-
+-	i = extract_integer(&s, "iterations");
+-	if (i < 0)
+-		return NULL;
+-	if (i > 2500)
+-		return bitch("bad iterations value");
+-	rr->iterations = i;
+-	/* TODO validate iteration count according to key size,
+-	 * as per http://tools.ietf.org/html/rfc5155#section-10.3 */
+-
+-	if (*s == '-') {
+-		rr->salt.length = 0;
+-		rr->salt.data = NULL;
+-		s++;
+-		if (*s && !isspace(*s) && *s != ';' && *s != ')')
+-			return bitch("salt is not valid");
+-		s = skip_white_space(s);
+-	} else {
+-		rr->salt = extract_hex_binary_data(&s, "salt", EXTRACT_DONT_EAT_WHITESPACE);
+-		if (rr->salt.length <= 0)
+-			return NULL;
+-		if (rr->salt.length > 255)
+-			return bitch("salt is too long");
+-	}
+-	if (*s) {
+-		return bitch("garbage after valid NSEC3PARAM data");
+-	}
++    i = extract_integer(&s, "hash algorithm", NULL);
++    if (i < 0)
++        return NULL;
++    if (i > 255)
++        return bitch("bad hash algorithm value");
++    if (i != 1)
++        return bitch("unrecognized or unsupported hash algorithm");
++    rr->hash_algorithm = i;
++
++    i = extract_integer(&s, "flags", NULL);
++    if (i < 0)
++        return NULL;
++    if (i > 255)
++        return bitch("bad flags value");
++    if (i != 0)
++        return bitch("flags is supposed to be 0 for NSEC3PARAM");
++    rr->flags = i;
++
++    i = extract_integer(&s, "iterations", NULL);
++    if (i < 0)
++        return NULL;
++    if (i > 2500)
++        return bitch("bad iterations value");
++    rr->iterations = i;
++    /* TODO validate iteration count according to key size,
++     * as per http://tools.ietf.org/html/rfc5155#section-10.3 */
++
++    if (*s == '-') {
++        rr->salt.length = 0;
++        rr->salt.data = NULL;
++        s++;
++        if (*s && !isspace(*s) && *s != ';' && *s != ')')
++            return bitch("salt is not valid");
++        s = skip_white_space(s);
++    } else {
++        rr->salt = extract_hex_binary_data(&s, "salt", EXTRACT_DONT_EAT_WHITESPACE);
++        if (rr->salt.length <= 0)
++            return NULL;
++        if (rr->salt.length > 255)
++            return bitch("salt is too long");
++    }
++    if (*s) {
++        return bitch("garbage after valid NSEC3PARAM data");
++    }
+ 
+-	G.dnssec_active = 1;
++    G.dnssec_active = 1;
+     ret_rr = store_record(type, name, ttl, rr);
+-	if (ret_rr && !nsec3param && (ret_rr->rr_set->named_rr->flags & NAME_FLAG_APEX))
+-		nsec3param = ret_rr;
+-	if (G.opt.policy_checks[POLICY_NSEC3PARAM_NOT_APEX] &&
+-		(ret_rr->rr_set->named_rr->flags & NAME_FLAG_APEX) == 0)
+-	{
+-		return bitch("NSEC3PARAM found not at zone apex");
+-	}
+-	return ret_rr;
++    if (ret_rr && !nsec3param && (ret_rr->rr_set->named_rr->flags & NAME_FLAG_APEX))
++        nsec3param = ret_rr;
++    if (G.opt.policy_checks[POLICY_NSEC3PARAM_NOT_APEX] &&
++        (ret_rr->rr_set->named_rr->flags & NAME_FLAG_APEX) == 0)
++    {
++        return bitch("NSEC3PARAM found not at zone apex");
++    }
++    return ret_rr;
+ }
+ 
+ static char* nsec3param_human(struct rr *rrv)
+ {
+-	RRCAST(nsec3param);
++    RRCAST(nsec3param);
+     char ss[1024];
+-	char *s = ss;
+-	int l;
+-	int i;
++    char *s = ss;
++    int l;
++    int i;
+ 
+     l = snprintf(s, 1024, "%u %u %u ", rr->hash_algorithm, rr->flags, rr->iterations);
+-	s += l;
+-	if (rr->salt.length) {
+-		for (i = 0; i < rr->salt.length; i++) {
+-			l = snprintf(s, 1024-(s-ss), "%02X", (unsigned char)rr->salt.data[i]);
+-			s += l;
+-		}
+-	} else {
+-		sprintf(s, "-");
+-	}
++    s += l;
++    if (rr->salt.length) {
++        for (i = 0; i < rr->salt.length; i++) {
++            l = snprintf(s, 1024-(s-ss), "%02X", (unsigned char)rr->salt.data[i]);
++            s += l;
++        }
++    } else {
++        sprintf(s, "-");
++    }
+     return quickstrdup_temp(ss);
+ }
+ 
+ static struct binary_data nsec3param_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(nsec3param);
++    RRCAST(nsec3param);
+ 
+-	return compose_binary_data("112b", 1,
+-		rr->hash_algorithm, rr->flags,
+-		rr->iterations, rr->salt);
++    return compose_binary_data("112b", 1,
++        rr->hash_algorithm, rr->flags,
++        rr->iterations, rr->salt);
+ }
+ 
+ struct rr_methods nsec3param_methods = { nsec3param_parse, nsec3param_human, nsec3param_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/nsec.c validns/nsec.c
+--- validns-0.8/nsec.c	2014-02-11 15:44:21.000000000 -0500
++++ validns/nsec.c	2020-10-05 16:59:29.355681369 -0400
+@@ -1,18 +1,18 @@
+ /*
+  * Part of DNS zone file validator `validns`.
+-			604800	NSEC	example.com. NS DS RRSIG NSEC
+-			604800	RRSIG	NSEC 10 3 604800 20130321184221 (
+-					20130219184221 35615 example.com.
+-					WWg7EiYoY8Hp593I2i5Mkl2ezg7YuAnq0y75
+-					oymTCuEfGwh4OxbMT/mWNqAFL5Y8f0YoQOOY
+-					wZP0m/sGK/EJN7ulNsfQyULY4WsyHIGlKMwT
+-					KdyDXJLrmrzlmRnGv7pFb0bo53n3osE0uFfH
+-					yMQYOkQRYfqa4yWXF9Nl48dy67frtVih0foy
+-					9Mm76mmJSDUd/jGsYQmaoFGVU/a64rWapVQ9
+-					O/mXPqr6Pw2ZCHecsF4ElMEp41YqG1DfR5QR
+-					khTjvTlg4aTKvgX1YuvDhjUygSHit47xn2NC
+-					2WwEZF+vYXT9DIUCMcKdVeb4bjWwUXbWNFqz
+-					Ca3jb/mpOpUDFnrRPw== )
++            604800  NSEC    example.com. NS DS RRSIG NSEC
++            604800  RRSIG   NSEC 10 3 604800 20130321184221 (
++                    20130219184221 35615 example.com.
++                    WWg7EiYoY8Hp593I2i5Mkl2ezg7YuAnq0y75
++                    oymTCuEfGwh4OxbMT/mWNqAFL5Y8f0YoQOOY
++                    wZP0m/sGK/EJN7ulNsfQyULY4WsyHIGlKMwT
++                    KdyDXJLrmrzlmRnGv7pFb0bo53n3osE0uFfH
++                    yMQYOkQRYfqa4yWXF9Nl48dy67frtVih0foy
++                    9Mm76mmJSDUd/jGsYQmaoFGVU/a64rWapVQ9
++                    O/mXPqr6Pw2ZCHecsF4ElMEp41YqG1DfR5QR
++                    khTjvTlg4aTKvgX1YuvDhjUygSHit47xn2NC
++                    2WwEZF+vYXT9DIUCMcKdVeb4bjWwUXbWNFqz
++                    Ca3jb/mpOpUDFnrRPw== )
+  *
+  * Copyright 2011-2014 Anton Berezin <tobez@tobez.org>
+  * Modified BSD license.
+@@ -35,114 +35,114 @@
+ static struct rr* nsec_parse(char *name, long ttl, int type, char *s)
+ {
+     struct rr_nsec *rr = getmem(sizeof(*rr));
+-	struct binary_data bitmap;
+-	char *str_type = NULL;
+-	int ltype;
++    struct binary_data bitmap;
++    char *str_type = NULL;
++    int ltype;
+ 
+     rr->next_domain = extract_name(&s, "next domain", KEEP_CAPITALIZATION);
+-	/* TODO: validate next_domain, http://tools.ietf.org/html/rfc4034#section-4.1.1 */
++    /* TODO: validate next_domain, http://tools.ietf.org/html/rfc4034#section-4.1.1 */
+ 
+-	bitmap = new_set();
+-	while (s && *s) {
+-		str_type = extract_label(&s, "type list", "temporary");
+-		if (!str_type) return NULL;
+-		ltype = str2rdtype(str_type, NULL);
+-		if (ltype < 0)
+-			return NULL;
+-		add_bit_to_set(&bitmap, ltype);
+-	}
+-	if (!s)
+-		return NULL;
+-	if (!str_type) {
+-		return bitch("NSEC type list should not be empty");
+-	}
+-	rr->type_bitmap = compressed_set(&bitmap);
+-	G.dnssec_active = 1;
++    bitmap = new_set();
++    while (s && *s) {
++        str_type = extract_label(&s, "type list", "temporary");
++        if (!str_type) return NULL;
++        ltype = str2rdtype(str_type, NULL);
++        if (ltype < 0)
++            return NULL;
++        add_bit_to_set(&bitmap, ltype);
++    }
++    if (!s)
++        return NULL;
++    if (!str_type) {
++        return bitch("NSEC type list should not be empty");
++    }
++    rr->type_bitmap = compressed_set(&bitmap);
++    G.dnssec_active = 1;
+ 
+     return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* nsec_human(struct rr *rrv)
+ {
+-	RRCAST(nsec);
++    RRCAST(nsec);
+     char ss[1024];
+-	char *s = ss;
+-	int l;
+-	char *base;
+-	int i, k;
+-	int type;
+-	char *type_name;
++    char *s = ss;
++    int l;
++    char *base;
++    int i, k;
++    int type;
++    char *type_name;
+ 
+     l = snprintf(s, 1024, "%s", rr->next_domain);
+-	s += l;
+-	base = rr->type_bitmap.data;
+-	while (base - rr->type_bitmap.data < rr->type_bitmap.length) {
+-		for (i = 0; i < base[1]; i++) {
+-			for (k = 0; k <= 7; k++) {
+-				if (base[2+i] & (0x80 >> k)) {
+-					type = ((unsigned char)base[0])*256 + i*8 + k;
+-					type_name = rdtype2str(type);
+-					l = snprintf(s, 1024-(s-ss), " %s", type_name);
+-					s += l;
+-				}
+-			}
+-		}
+-		base += base[1]+2;
+-	}
++    s += l;
++    base = rr->type_bitmap.data;
++    while (base - rr->type_bitmap.data < rr->type_bitmap.length) {
++        for (i = 0; i < base[1]; i++) {
++            for (k = 0; k <= 7; k++) {
++                if (base[2+i] & (0x80 >> k)) {
++                    type = ((unsigned char)base[0])*256 + i*8 + k;
++                    type_name = rdtype2str(type);
++                    l = snprintf(s, 1024-(s-ss), " %s", type_name);
++                    s += l;
++                }
++            }
++        }
++        base += base[1]+2;
++    }
+     return quickstrdup_temp(ss);
+ }
+ 
+ static struct binary_data nsec_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(nsec);
++    RRCAST(nsec);
+ 
+-	return compose_binary_data("dd", 1,
+-		name2wire_name(rr->next_domain), rr->type_bitmap);
++    return compose_binary_data("dd", 1,
++        name2wire_name(rr->next_domain), rr->type_bitmap);
+ }
+ 
+ static void* nsec_validate(struct rr *rrv)
+ {
+-	RRCAST(nsec);
+-	struct named_rr *named_rr;
++    RRCAST(nsec);
++    struct named_rr *named_rr;
+ 
+-	named_rr = rr->rr.rr_set->named_rr;
+-	if (!check_typemap(rr->type_bitmap, named_rr, rrv))
+-		return NULL;
++    named_rr = rr->rr.rr_set->named_rr;
++    if (!check_typemap(rr->type_bitmap, named_rr, rrv))
++        return NULL;
+ 
+-	return rr;
++    return rr;
+ }
+ 
+ void validate_nsec_chain(void)
+ {
+-	struct rr_set *rr_set;
+-	struct named_rr *named_rr;
++    struct rr_set *rr_set;
++    struct named_rr *named_rr;
+ 
+-	rr_set = find_rr_set(T_NSEC, zone_apex);
+-	if (!rr_set) {
+-		named_rr = find_named_rr(zone_apex);
+-		moan(named_rr->file_name, named_rr->line, "apex NSEC not found");
+-		return;
+-	}
+-	while (1) {
+-		char name[1024];
+-		struct rr_nsec *rr = (struct rr_nsec *)rr_set->tail;
+-		char *s, *t;
+-
+-		if (strcasecmp(rr->next_domain, zone_apex) == 0) /* chain complete */
+-			break;
+-		freeall_temp();
+-		s = rr->next_domain;
+-		t = name;
+-		while (*s) *t++ = tolower(*s++);
+-		*t = 0;
+-		rr_set = find_rr_set(T_NSEC, name);
+-		if (!rr_set) {
+-			moan(rr->rr.file_name, rr->rr.line, "broken NSEC chain %s -> %s",
+-				 rr->rr.rr_set->named_rr->name, rr->next_domain);
+-			break;
+-		}
+-	}
+-	freeall_temp();
++    rr_set = find_rr_set(T_NSEC, zone_apex);
++    if (!rr_set) {
++        named_rr = find_named_rr(zone_apex);
++        moan(named_rr->file_name, named_rr->line, "apex NSEC not found");
++        return;
++    }
++    while (1) {
++        char name[1024];
++        struct rr_nsec *rr = (struct rr_nsec *)rr_set->tail;
++        char *s, *t;
++
++        if (strcasecmp(rr->next_domain, zone_apex) == 0) /* chain complete */
++            break;
++        freeall_temp();
++        s = rr->next_domain;
++        t = name;
++        while (*s) *t++ = tolower(*s++);
++        *t = 0;
++        rr_set = find_rr_set(T_NSEC, name);
++        if (!rr_set) {
++            moan(rr->rr.file_name, rr->rr.line, "broken NSEC chain %s -> %s",
++                 rr->rr.rr_set->named_rr->name, rr->next_domain);
++            break;
++        }
++    }
++    freeall_temp();
+ }
+ 
+ struct rr_methods nsec_methods = { nsec_parse, nsec_human, nsec_wirerdata, NULL, nsec_validate };
+diff -Naur validns-0.8/PAUL.txt validns/PAUL.txt
+--- validns-0.8/PAUL.txt	1969-12-31 19:00:00.000000000 -0500
++++ validns/PAUL.txt	2020-10-05 17:00:40.157331142 -0400
+@@ -0,0 +1 @@
++new:
+diff -Naur validns-0.8/ptr.c validns/ptr.c
+--- validns-0.8/ptr.c	2014-02-11 15:45:36.000000000 -0500
++++ validns/ptr.c	2020-10-05 16:59:29.355681369 -0400
+@@ -19,29 +19,29 @@
+ 
+ static struct rr *ptr_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_ptr *rr = getmem(sizeof(*rr));
++    struct rr_ptr *rr = getmem(sizeof(*rr));
+ 
+-	rr->ptrdname = extract_name(&s, "name server domain name", 0);
+-	if (!rr->ptrdname)
+-		return NULL;
+-	if (*s) {
+-		return bitch("garbage after valid PTR data");
+-	}
++    rr->ptrdname = extract_name(&s, "name server domain name", 0);
++    if (!rr->ptrdname)
++        return NULL;
++    if (*s) {
++        return bitch("garbage after valid PTR data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* ptr_human(struct rr *rrv)
+ {
+-	RRCAST(ptr);
++    RRCAST(ptr);
+ 
+     return rr->ptrdname;
+ }
+ 
+ static struct binary_data ptr_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(ptr);
+-	return name2wire_name(rr->ptrdname);
++    RRCAST(ptr);
++    return name2wire_name(rr->ptrdname);
+ }
+ 
+ struct rr_methods ptr_methods = { ptr_parse, ptr_human, ptr_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/px.c validns/px.c
+--- validns-0.8/px.c	2014-02-11 15:46:50.000000000 -0500
++++ validns/px.c	2020-10-05 16:59:29.355681369 -0400
+@@ -19,45 +19,45 @@
+ 
+ static struct rr *px_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_px *rr = getmem(sizeof(*rr));
++    struct rr_px *rr = getmem(sizeof(*rr));
+ 
+-	rr->preference = extract_integer(&s, "PX preference");
+-	if (rr->preference < 0)
+-		return NULL;
++    rr->preference = extract_integer(&s, "PX preference", NULL);
++    if (rr->preference < 0)
++        return NULL;
+ 
+-	rr->map822 = extract_name(&s, "map822", 0);
+-	if (!rr->map822)
+-		return NULL;
++    rr->map822 = extract_name(&s, "map822", 0);
++    if (!rr->map822)
++        return NULL;
+ 
+-	rr->mapx400 = extract_name(&s, "mapx400", 0);
+-	if (!rr->mapx400)
+-		return NULL;
++    rr->mapx400 = extract_name(&s, "mapx400", 0);
++    if (!rr->mapx400)
++        return NULL;
+ 
+-	if (*s) {
+-		return bitch("garbage after valid KX data");
+-	}
++    if (*s) {
++        return bitch("garbage after valid KX data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* px_human(struct rr *rrv)
+ {
+-	RRCAST(px);
++    RRCAST(px);
+     char s[1024];
+ 
+     snprintf(s, 1024, "%d %s %s",
+-	     rr->preference, rr->map822, rr->mapx400);
++         rr->preference, rr->map822, rr->mapx400);
+     return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data px_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(px);
++    RRCAST(px);
+ 
+     return compose_binary_data("2dd", 1,
+-		rr->preference,
+-		name2wire_name(rr->map822),
+-		name2wire_name(rr->mapx400));
++        rr->preference,
++        name2wire_name(rr->map822),
++        name2wire_name(rr->mapx400));
+ }
+ 
+ struct rr_methods px_methods = { px_parse, px_human, px_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/rp.c validns/rp.c
+--- validns-0.8/rp.c	2014-02-11 15:45:43.000000000 -0500
++++ validns/rp.c	2020-10-05 16:59:29.355681369 -0400
+@@ -20,26 +20,26 @@
+ 
+ static struct rr *rp_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_rp *rr = getmem(sizeof(*rr));
++    struct rr_rp *rr = getmem(sizeof(*rr));
+ 
+-	rr->mbox_dname = extract_name(&s, "mbox domain name", 0);
+-	if (!rr->mbox_dname)
+-		return NULL;
++    rr->mbox_dname = extract_name(&s, "mbox domain name", 0);
++    if (!rr->mbox_dname)
++        return NULL;
+ 
+-	rr->txt_dname = extract_name(&s, "txt domain name", 0);
+-	if (!rr->txt_dname)
+-		return NULL;
++    rr->txt_dname = extract_name(&s, "txt domain name", 0);
++    if (!rr->txt_dname)
++        return NULL;
+ 
+-	if (*s) {
+-		return bitch("garbage after valid RP data");
+-	}
++    if (*s) {
++        return bitch("garbage after valid RP data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* rp_human(struct rr *rrv)
+ {
+-	RRCAST(rp);
++    RRCAST(rp);
+     char s[1024];
+ 
+     snprintf(s, 1024, "\"%s\" \"%s\"", rr->mbox_dname, rr->txt_dname);
+@@ -48,24 +48,24 @@
+ 
+ static struct binary_data rp_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(rp);
++    RRCAST(rp);
+ 
+-	return compose_binary_data("dd", 1,
+-		name2wire_name(rr->mbox_dname),
+-		name2wire_name(rr->txt_dname));
++    return compose_binary_data("dd", 1,
++        name2wire_name(rr->mbox_dname),
++        name2wire_name(rr->txt_dname));
+ }
+ 
+ static void *rp_validate(struct rr *rrv)
+ {
+-	RRCAST(rp);
++    RRCAST(rp);
+ 
+-	if (G.opt.policy_checks[POLICY_RP_TXT_EXISTS]) {
+-		if (name_belongs_to_zone(rr->txt_dname) && !find_rr_set(T_TXT, rr->txt_dname)) {
+-			return moan(rr->rr.file_name, rr->rr.line, "%s RP TXT %s does not exist",
+-				rr->rr.rr_set->named_rr->name, rr->txt_dname);
+-		}
+-	}
+-	return NULL;
++    if (G.opt.policy_checks[POLICY_RP_TXT_EXISTS]) {
++        if (name_belongs_to_zone(rr->txt_dname) && !find_rr_set(T_TXT, rr->txt_dname)) {
++            return moan(rr->rr.file_name, rr->rr.line, "%s RP TXT %s does not exist",
++                rr->rr.rr_set->named_rr->name, rr->txt_dname);
++        }
++    }
++    return NULL;
+ }
+ 
+ struct rr_methods rp_methods = { rp_parse, rp_human, rp_wirerdata, NULL, rp_validate };
+diff -Naur validns-0.8/rr.c validns/rr.c
+--- validns-0.8/rr.c	2014-02-11 15:45:34.000000000 -0500
++++ validns/rr.c	2020-10-05 16:59:29.355681369 -0400
+@@ -20,859 +20,899 @@
+ #include "cbtree.h"
+ 
+ static char* rdtype2str_map[T_MAX+1] = {
+-	"0",
+-	"A",
+-	"NS",
+-	"MD",
+-	"MF",
+-	"CNAME", /* 5 */
+-	"SOA",
+-	"MB",
+-	"MG",
+-	"MR",
+-	"NULL", /* 10 */
+-	"WKS",
+-	"PTR",
+-	"HINFO",
+-	"MINFO",
+-	"MX",  /* 15 */
+-	"TXT", 
+-	"RP",
+-	"AFSDB",
+-	"X25",
+-	"ISDN", /* 20 */
+-	"RT",
+-	"NSAP",
+-	"NSAP-PTR",
+-	"SIG",
+-	"KEY",  /* 25 */
+-	"PX",
+-	"GPOS",
+-	"AAAA",
+-	"LOC",
+-	"NXT",  /* 30 */
+-	"EID",
+-	"NIMLOC",
+-	"SRV",
+-	"ATMA",
+-	"NAPTR", /* 35 */
+-	"KX",
+-	"CERT",
+-	"A6",
+-	"DNAME",
+-	"SINK", /* 40 */
+-	"OPT",
+-	"APL",
+-	"DS",
+-	"SSHFP",
+-	"IPSECKEY", /* 45 */
+-	"RRSIG",
+-	"NSEC",
+-	"DNSKEY",
+-	"DHCID",
+-	"NSEC3", /* 50 */
+-	"NSEC3PARAM",
+-	"TLSA",
+-	      0, 0, 0, 0, 0, 0, 0, 0, /* 60 */
+-	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 70 */
+-	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 80 */
+-	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 90 */
+-	0, 0, 0, 0, 0, 0, 0, 0,
+-	"SPF",
+-	                           0, /* 100 */
+-	0, 0, 0,
+-	"NID",
+-	"L32",
+-	"L64",
+-	"LP",
++    "0",
++    "A",
++    "NS",
++    "MD",
++    "MF",
++    "CNAME", /* 5 */
++    "SOA",
++    "MB",
++    "MG",
++    "MR",
++    "NULL", /* 10 */
++    "WKS",
++    "PTR",
++    "HINFO",
++    "MINFO",
++    "MX",  /* 15 */
++    "TXT", 
++    "RP",
++    "AFSDB",
++    "X25",
++    "ISDN", /* 20 */
++    "RT",
++    "NSAP",
++    "NSAP-PTR",
++    "SIG",
++    "KEY",  /* 25 */
++    "PX",
++    "GPOS",
++    "AAAA",
++    "LOC",
++    "NXT",  /* 30 */
++    "EID",
++    "NIMLOC",
++    "SRV",
++    "ATMA",
++    "NAPTR", /* 35 */
++    "KX",
++    "CERT",
++    "A6",
++    "DNAME",
++    "SINK", /* 40 */
++    "OPT",
++    "APL",
++    "DS",
++    "SSHFP",
++    "IPSECKEY", /* 45 */
++    "RRSIG",
++    "NSEC",
++    "DNSKEY",
++    "DHCID",
++    "NSEC3", /* 50 */
++    "NSEC3PARAM",
++    "TLSA",
++    "SMIMEA",
++             0, 0, 0, 0, 0,
++    "CDS",
++    "CDNSKEY", /* 60 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 70 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 80 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 90 */
++    0, 0, 0, 0, 0, 0, 0, 0,
++    "SPF",
++                               0, /* 100 */
++    0, 0, 0,
++    "NID",
++    "L32",
++    "L64",
++    "LP",
++                         0, 0, 0, /* 110 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 120 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 130 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 140 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 150 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 160 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 170 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 180 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 190 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 200 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 210 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 220 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 230 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 240 */
++    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 250 */
++    0, 0, 0, 0, 0, 0,
++    "CAA",
++                         0, 0, 0, /* 260 */
+ };
+ struct cbtree zone_data = {NULL};
+ char *zone_apex = NULL;
+ int zone_apex_l = 0;
++int rr_counts[T_MAX+1];
+ 
+ char *rdtype2str(int type)
+ {
+-	char s[10];
+-	char *r;
+-	if (type < 0 || type > 65535) {
+-		return "???";
+-	}
+-	if (type > T_MAX) {
+-		sprintf(s, "TYPE%d", type);
+-		return quickstrdup_temp(s);
+-	}
+-	r = rdtype2str_map[type];
+-	if (r)	return r;
+-	if (type == 32769) {
+-		return rdtype2str_map[type] = "DLV";
+-	}
+-	sprintf(s, "TYPE%d", type);
+-	return quickstrdup_temp(s);
++    char s[10];
++    char *r;
++    if (type < 0 || type > 65535) {
++        return "???";
++    }
++    if (type > T_MAX) {
++        sprintf(s, "TYPE%d", type);
++        return quickstrdup_temp(s);
++    }
++    r = rdtype2str_map[type];
++    if (r)  return r;
++    if (type == 32769) {
++        return rdtype2str_map[type] = "DLV";
++    }
++    sprintf(s, "TYPE%d", type);
++    return quickstrdup_temp(s);
+ }
+ 
+ static unsigned char *name2findable_name(char *s)
+ {
+-	int l = strlen(s);
+-	unsigned char *res = getmem_temp(l+1);
+-	unsigned char *r = res;
+-	int i;
+-
+-	if (l > 0 && s[l-1] == '.')
+-		l--;
+-	while (--l >= 0) {
+-		i = l;
+-		while (i >= 0 && s[i] != '.')
+-			i--;
+-		memcpy(r, s+i+1, l-i);
+-		r += l-i;
+-		*r = '\x01';
+-		r++;
+-		l = i;
+-	}
+-	if (r > res)    r--;
+-	*r = 0;
+-	return res;
++    int l = strlen(s);
++    unsigned char *res = getmem_temp(l+1);
++    unsigned char *r = res;
++    int i;
++
++    if (l > 0 && s[l-1] == '.')
++        l--;
++    while (--l >= 0) {
++        i = l;
++        while (i >= 0 && s[i] != '.')
++            i--;
++        memcpy(r, s+i+1, l-i);
++        r += l-i;
++        *r = '\x01';
++        r++;
++        l = i;
++    }
++    if (r > res)    r--;
++    *r = 0;
++    return res;
+ }
+ 
+ struct binary_data name2wire_name(char *s)
+ {
+-	unsigned char *res = getmem_temp(strlen(s)+2);
+-	unsigned char *r = res;
+-	unsigned char *c = res;
+-	struct binary_data toret;
+-
+-	r++;
+-	*c = 0;
+-	while (*s) {
+-		if (*s != '.') {
+-			*r++ = *s++;
+-		} else {
+-			*c = (unsigned char)(r-c-1);
+-			c = r;
+-			*c = 0;
+-			r++;
+-			s++;
+-		}
+-	}
+-	*c = (unsigned char)(r-c-1);
+-	toret.length = r-res;
+-	toret.data = (char*)res;
+-	if (toret.length == 2) /* "." is just 00, not 00 00 */
+-	    toret.length = 1;
+-	return toret;
++    unsigned char *res = getmem_temp(strlen(s)+2);
++    unsigned char *r = res;
++    unsigned char *c = res;
++    struct binary_data toret;
++
++    r++;
++    *c = 0;
++    while (*s) {
++        if (*s != '.') {
++            *r++ = *s++;
++        } else {
++            *c = (unsigned char)(r-c-1);
++            c = r;
++            *c = 0;
++            r++;
++            s++;
++        }
++    }
++    *c = (unsigned char)(r-c-1);
++    toret.length = r-res;
++    toret.data = (char*)res;
++    if (toret.length == 2) /* "." is just 00, not 00 00 */
++        toret.length = 1;
++    return toret;
+ }
+ 
+ static struct named_rr *find_or_create_named_rr(char *name)
+ {
+-	struct named_rr *named_rr = find_named_rr(name);
++    struct named_rr *named_rr = find_named_rr(name);
+ 
+-	if (!named_rr) {
+-		struct named_rr **named_rr_slot;
+-		char *s;
+-
+-		named_rr = getmem(sizeof(struct named_rr));
+-		named_rr->name = quickstrdup(name);
+-		named_rr->rr_sets = NULL;
+-		named_rr->line = file_info->line;
+-		named_rr->file_name = file_info->name;
+-		named_rr->flags = 0;
+-		named_rr->parent = NULL;
+-
+-		if (strchr(name, '/') != NULL)
+-			named_rr->flags |= NAME_FLAG_CONTAINS_SLASH;
+-
+-		named_rr_slot = (void *)cbtree_insert(&zone_data, (char *)name2findable_name(name));
+-		if (!named_rr_slot)
+-			croak(2, "find_or_create_named_rr: tree insertion failed");
+-		if (*named_rr_slot)
+-			croak(3, "find_or_create_named_rr: assertion error, %s should not be there", name);
+-		*named_rr_slot = named_rr;
+-		G.stats.names_count++;
+-
+-		s = strchr(name, '.');
+-		if (s && s[1] != '\0') {
+-			named_rr->parent = find_or_create_named_rr(s+1);
+-		}
+-	}
++    if (!named_rr) {
++        struct named_rr **named_rr_slot;
++        char *s;
++
++        named_rr = getmem(sizeof(struct named_rr));
++        named_rr->name = quickstrdup(name);
++        named_rr->rr_sets = NULL;
++        named_rr->line = file_info->line;
++        named_rr->file_name = file_info->name;
++        named_rr->flags = 0;
++        named_rr->parent = NULL;
++
++        if (strchr(name, '/') != NULL)
++            named_rr->flags |= NAME_FLAG_CONTAINS_SLASH;
++
++        named_rr_slot = (void *)cbtree_insert(&zone_data, (char *)name2findable_name(name));
++        if (!named_rr_slot)
++            croak(2, "find_or_create_named_rr: tree insertion failed");
++        if (*named_rr_slot)
++            croak(3, "find_or_create_named_rr: assertion error, %s should not be there", name);
++        *named_rr_slot = named_rr;
++        G.stats.names_count++;
++
++        s = strchr(name, '.');
++        if (s && s[1] != '\0') {
++            named_rr->parent = find_or_create_named_rr(s+1);
++        }
++    }
+ 
+-	return named_rr;
++    return named_rr;
+ }
+ 
+ static struct rr_set *find_or_create_rr_set(struct named_rr *named_rr, int rdtype)
+ {
+-	struct rr_set *rr_set = find_rr_set_in_named_rr(named_rr, rdtype);
+-	if (!rr_set) {
+-		struct rr_set **rr_set_slot;
+-
+-		rr_set = getmem(sizeof(struct rr_set));
+-		rr_set->head = NULL;
+-		rr_set->tail = NULL;
+-		rr_set->named_rr = named_rr;
+-		rr_set->rdtype = rdtype;
+-		rr_set->count = 0;
+-
+-		JLI(rr_set_slot, named_rr->rr_sets, rdtype);
+-		if (rr_set_slot == PJERR)
+-			croak(2, "find_or_create_rr_set: JLI failed");
+-		if (*rr_set_slot)
+-			croak(3, "find_or_create_rr_set: assertion error, %s/%s should not be there",
+-				  named_rr->name, rdtype2str(rdtype));
+-		*rr_set_slot = rr_set;
+-		G.stats.rrset_count++;
+-	}
+-	return rr_set;
++    struct rr_set *rr_set = find_rr_set_in_named_rr(named_rr, rdtype);
++    if (!rr_set) {
++        struct rr_set **rr_set_slot;
++
++        rr_set = getmem(sizeof(struct rr_set));
++        rr_set->head = NULL;
++        rr_set->tail = NULL;
++        rr_set->named_rr = named_rr;
++        rr_set->rdtype = rdtype;
++        rr_set->count = 0;
++
++        JLI(rr_set_slot, named_rr->rr_sets, rdtype);
++        if (rr_set_slot == PJERR)
++            croak(2, "find_or_create_rr_set: JLI failed");
++        if (*rr_set_slot)
++            croak(3, "find_or_create_rr_set: assertion error, %s/%s should not be there",
++                  named_rr->name, rdtype2str(rdtype));
++        *rr_set_slot = rr_set;
++        G.stats.rrset_count++;
++    }
++    return rr_set;
+ }
+ 
+ int name_belongs_to_zone(const char *name)
+ {
+-	int name_l;
++    int name_l;
+ 
+-	name_l = strlen(name);
+-	if (zone_apex && name_l >= zone_apex_l) {
+-		if (strcmp(zone_apex, name+name_l-zone_apex_l) != 0) {
+-			return 0;
+-		} else if (name_l > zone_apex_l && name[name_l-zone_apex_l-1] != '.') {
+-			return 0;
+-		}
+-	} else {
+-		if (zone_apex) {
+-			return 0;
+-		} else {
+-			// XXX this is actually very bad, zone apex is not know
+-			return 0;
+-		}
+-	}
+-	return 1;
++    name_l = strlen(name);
++    if (zone_apex && name_l >= zone_apex_l) {
++        if (strcmp(zone_apex, name+name_l-zone_apex_l) != 0) {
++            return 0;
++        } else if (name_l > zone_apex_l && name[name_l-zone_apex_l-1] != '.') {
++            return 0;
++        }
++    } else {
++        if (zone_apex) {
++            return 0;
++        } else {
++            // XXX this is actually very bad, zone apex is not know
++            return 0;
++        }
++    }
++    return 1;
+ }
+ 
+ struct binary_data call_get_wired(struct rr *rr)
+ {
+-	rr_wire_func get_wired;
++    rr_wire_func get_wired;
+ 
+-	if (rr->rdtype > T_MAX || rr->is_generic)
+-		get_wired = any_wirerdata;
+-	else
+-		get_wired = rr_methods[rr->rdtype].rr_wire;
+-	if (!get_wired) return bad_binary_data();
+-	return get_wired(rr);
++    if (rr->rdtype > T_MAX || rr->is_generic)
++        get_wired = any_wirerdata;
++    else
++        get_wired = rr_methods[rr->rdtype].rr_wire;
++    if (!get_wired) return bad_binary_data();
++    return get_wired(rr);
+ }
+ 
+ struct rr *store_record(int rdtype, char *name, long ttl, void *rrptr)
+ {
+-	struct rr *rr = rrptr;
+-	struct named_rr *named_rr;
+-	struct rr_set *rr_set;
+-	int name_l;
+-	int apex_assigned = 0;
+-	int is_generic = 0;
+-
+-	if (rdtype < 0) {
+-		rdtype = -rdtype;
+-		is_generic = 1;
+-	}
+-	name_l = strlen(name);
+-	if (name_l > 511)
+-		return bitch("name is too long: %s", name);
+-
+-	if (G.stats.rr_count == 0) {
+-		if (rdtype != T_SOA) {
+-			return bitch("the first record in the zone must be an SOA record");
+-		} else {
+-			zone_apex = name;
+-			zone_apex_l = name_l;
+-			apex_assigned = 1;
+-		}
+-	}
+-	if (zone_apex && name_l >= zone_apex_l) {
+-		if (strcmp(zone_apex, name+name_l-zone_apex_l) != 0) {
+-			return bitch("%s does not belong to zone %s", name, zone_apex);
+-		} else if (name_l > zone_apex_l && name[name_l-zone_apex_l-1] != '.') {
+-			return bitch("%s does not belong to zone %s", name, zone_apex);
+-		}
+-	} else {
+-		if (zone_apex) {
+-			return bitch("%s does not belong to zone %s", name, zone_apex);
+-		} else {
+-			croakx(3, "assertion error: %s does not belong to a zone", name);
+-		}
+-	}
+-
+-	named_rr = find_or_create_named_rr(name);
+-	if (apex_assigned) {
+-		named_rr->flags |= NAME_FLAG_APEX;
+-	}
+-	rr_set = find_or_create_rr_set(named_rr, rdtype);
+-
+-	rr->rdtype = rdtype;
+-	rr->ttl = ttl;
+-	rr->line = file_info->line;
+-	rr->file_name = file_info->name;
+-	rr->is_generic = is_generic;
+-
+-	if (rr_set->count > 0) {
+-		struct binary_data new_d, old_d;
+-		struct rr *old_rr;
+-
+-		new_d = call_get_wired(rr);
+-		if (new_d.length < 0) goto after_dup_check;
+-
+-		old_rr = rr_set->tail;
+-		while (old_rr) {
+-			old_d = call_get_wired(old_rr);
+-			if (old_d.length == new_d.length &&
+-				memcmp(old_d.data, new_d.data, old_d.length) == 0)
+-			{
+-				G.stats.skipped_dup_rr_count++;
+-				return old_rr;
+-			}
+-			old_rr = old_rr->next;
+-		}
+-	}
++    struct rr *rr = rrptr;
++    struct named_rr *named_rr;
++    struct rr_set *rr_set;
++    int name_l;
++    int apex_assigned = 0;
++    int is_generic = 0;
++
++    if (rdtype < 0) {
++        rdtype = -rdtype;
++        is_generic = 1;
++    }
++    name_l = strlen(name);
++    if (name_l > 511)
++        return bitch("name is too long: %s", name);
++
++    if (G.stats.rr_count == 0) {
++        if (rdtype != T_SOA) {
++            return bitch("the first record in the zone must be an SOA record");
++        } else {
++            zone_apex = name;
++            zone_apex_l = name_l;
++            apex_assigned = 1;
++        }
++    }
++    if (zone_apex && name_l >= zone_apex_l) {
++        if (strcmp(zone_apex, name+name_l-zone_apex_l) != 0) {
++            return bitch("%s does not belong to zone %s", name, zone_apex);
++        } else if (name_l > zone_apex_l && name[name_l-zone_apex_l-1] != '.') {
++            return bitch("%s does not belong to zone %s", name, zone_apex);
++        }
++    } else {
++        if (zone_apex) {
++            return bitch("%s does not belong to zone %s", name, zone_apex);
++        } else {
++            croakx(3, "assertion error: %s does not belong to a zone", name);
++        }
++    }
++
++    named_rr = find_or_create_named_rr(name);
++    if (apex_assigned) {
++        named_rr->flags |= NAME_FLAG_APEX;
++    }
++    rr_set = find_or_create_rr_set(named_rr, rdtype);
++
++    rr->rdtype = rdtype;
++    rr->ttl = ttl;
++    rr->line = file_info->line;
++    rr->file_name = file_info->name;
++    rr->is_generic = is_generic;
++
++    if (rr_set->count > 0) {
++        struct binary_data new_d, old_d;
++        struct rr *old_rr;
++
++        new_d = call_get_wired(rr);
++        if (new_d.length < 0) goto after_dup_check;
++
++        old_rr = rr_set->tail;
++        while (old_rr) {
++            old_d = call_get_wired(old_rr);
++            if (old_d.length == new_d.length &&
++                memcmp(old_d.data, new_d.data, old_d.length) == 0)
++            {
++                G.stats.skipped_dup_rr_count++;
++                return old_rr;
++            }
++            old_rr = old_rr->next;
++        }
++    }
+ after_dup_check:
+-	if (rdtype == T_SOA) {
+-	   	if (G.stats.soa_rr_count++) {
+-			return bitch("there could only be one SOA in a zone");
+-		}
+-	}
+-
+-	rr->rr_set = rr_set;
+-	rr->next = NULL;
+-	rr->prev = rr_set->head;
+-	rr_set->head = rr;
+-	if (rr->prev)
+-		rr->prev->next = rr;
+-	if (!rr_set->tail)
+-		rr_set->tail = rr;
+-
+-	rr_set->count++;
+-
+-	if (G.opt.verbose) {
+-		char *rdata;
+-		if (rdtype > T_MAX)
+-			rdata = any_human(rr);
+-		else
+-			rdata = rr_methods[rdtype].rr_human(rr);
+-		fprintf(stderr, "-> %s:%d: %s IN %ld %s",
+-				file_info->name, file_info->line,
+-				name, ttl, rdtype2str(rdtype));
+-		if (rdata) {
+-			fprintf(stderr, " %s\n", rdata);
+-		} else {
+-			fprintf(stderr, "\n");
+-		}
+-	}
++    if (rdtype == T_SOA) {
++        if (G.stats.soa_rr_count++) {
++            return bitch("there could only be one SOA in a zone");
++        }
++    }
++
++    rr->rr_set = rr_set;
++    rr->next = NULL;
++    rr->prev = rr_set->head;
++    rr_set->head = rr;
++    if (rr->prev)
++        rr->prev->next = rr;
++    if (!rr_set->tail)
++        rr_set->tail = rr;
++
++    rr_set->count++;
++
++    if (G.opt.verbose) {
++        char *rdata;
++        if (rdtype > T_MAX)
++            rdata = any_human(rr);
++        else
++            rdata = rr_methods[rdtype].rr_human(rr);
++        fprintf(stderr, "-> %s:%d: %s IN %ld %s",
++                file_info->name, file_info->line,
++                name, ttl, rdtype2str(rdtype));
++        if (rdata) {
++            fprintf(stderr, " %s\n", rdata);
++        } else {
++            fprintf(stderr, "\n");
++        }
++    }
+ 
+-	G.stats.rr_count++;
+-	named_rr->flags |= NAME_FLAG_HAS_RECORDS;
++    G.stats.rr_count++;
++    named_rr->flags |= NAME_FLAG_HAS_RECORDS;
+ 
+-	return rr;
++    return rr;
+ }
+ 
+ struct named_rr *find_named_rr(char *name)
+ {
+-	struct named_rr **named_rr_slot;
++    struct named_rr **named_rr_slot;
+ 
+-	named_rr_slot = (void*) cbtree_find(&zone_data, (char *)name2findable_name(name));
+-	if (named_rr_slot)
+-		return *named_rr_slot;
+-	return NULL;
++    named_rr_slot = (void*) cbtree_find(&zone_data, (char *)name2findable_name(name));
++    if (named_rr_slot)
++        return *named_rr_slot;
++    return NULL;
+ }
+ 
+ struct named_rr *find_next_named_rr(struct named_rr *named_rr)
+ {
+-	struct named_rr *res;
++    struct named_rr *res;
+ 
+-	if (cbtree_next(&zone_data, (char *)name2findable_name(named_rr->name), (intptr_t *)&res) == NULL)
+-		return NULL;
++    if (cbtree_next(&zone_data, (char *)name2findable_name(named_rr->name), (intptr_t *)&res) == NULL)
++        return NULL;
+ 
+-	return res;
++    return res;
+ }
+ 
+ struct rr_set *find_rr_set(int rdtype, char *name)
+ {
+-	struct named_rr *named_rr;
++    struct named_rr *named_rr;
+ 
+-	named_rr = find_named_rr(name);
+-	if (!named_rr)
+-		return NULL;
++    named_rr = find_named_rr(name);
++    if (!named_rr)
++        return NULL;
+ 
+-	return find_rr_set_in_named_rr(named_rr, rdtype);
++    return find_rr_set_in_named_rr(named_rr, rdtype);
+ }
+ 
+ struct rr_set *find_rr_set_in_named_rr(struct named_rr *named_rr, int rdtype)
+ {
+-	struct rr_set **rr_set_slot;
++    struct rr_set **rr_set_slot;
+ 
+-	JLG(rr_set_slot, named_rr->rr_sets, rdtype);
+-	if (rr_set_slot)
+-		return *rr_set_slot;
+-	return NULL;
++    JLG(rr_set_slot, named_rr->rr_sets, rdtype);
++    if (rr_set_slot)
++        return *rr_set_slot;
++    return NULL;
+ }
+ 
+ uint32_t get_rr_set_count(struct named_rr *named_rr)
+ {
+-	uint32_t count;
+-	JLC(count, named_rr->rr_sets, 0, -1);
+-	return count;
++    uint32_t count;
++    JLC(count, named_rr->rr_sets, 0, -1);
++    return count;
+ }
+ 
+ struct rr *rr_parse_any(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_any *rr = getmem(sizeof(*rr));
+-	long long len;
++    struct rr_any *rr = getmem(sizeof(*rr));
++    long long len;
+ 
+-	if (*s++ != '\\') {
++    if (*s++ != '\\') {
+ invalid:
+-		return bitch("invalid custom type rdata");
+-	}
+-	if (*s++ != '#')
+-		goto invalid;
+-	if (*s && !isspace(*s) && *s != ';' && *s != ')')
+-		goto invalid;
+-	s = skip_white_space(s);
+-	if (!s)	return NULL;
+-
+-	len = extract_integer(&s, "custom data size");
+-	if (len < 0) return NULL;
+-	if (len > 65535) goto invalid;
+-
+-	rr->data = extract_hex_binary_data(&s, "custom data", EXTRACT_EAT_WHITESPACE);
+-	if (rr->data.length < 0)	return NULL;
+-	if (rr->data.length != len)
+-		return bitch("custom data is longer than specified");
+-
+-	if (*s) {
+-		return bitch("garbage after valid %s data", rdtype2str(type));
+-	}
++        return bitch("invalid custom type rdata");
++    }
++    if (*s++ != '#')
++        goto invalid;
++    if (*s && !isspace(*s) && *s != ';' && *s != ')')
++        goto invalid;
++    s = skip_white_space(s);
++    if (!s) return NULL;
++
++    len = extract_integer(&s, "custom data size", NULL);
++    if (len < 0) return NULL;
++    if (len > 65535) goto invalid;
++
++    rr->data = extract_hex_binary_data(&s, "custom data", EXTRACT_EAT_WHITESPACE);
++    if (rr->data.length < 0)    return NULL;
++    if (rr->data.length != len)
++        return bitch("custom data is longer than specified");
++
++    if (*s) {
++        return bitch("garbage after valid %s data", rdtype2str(type));
++    }
+ 
+-	return store_record(-type, name, ttl, rr);
++    return store_record(-type, name, ttl, rr);
+ }
+ 
+ char* any_human(struct rr *rrv)
+ {
+-	RRCAST(any);
+-	char buf[80];
++    RRCAST(any);
++    char buf[80];
+ 
+-	sprintf(buf, "\\# %d ...", rr->data.length);
+-	return quickstrdup_temp(buf);
++    sprintf(buf, "\\# %d ...", rr->data.length);
++    return quickstrdup_temp(buf);
+ }
+ 
+ struct binary_data any_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(any);
++    RRCAST(any);
+ 
+-	return compose_binary_data("d", 1, rr->data);
++    return compose_binary_data("d", 1, rr->data);
+ }
+ 
+ struct rr_methods unknown_methods = { NULL, any_human, any_wirerdata, NULL, NULL };
+ 
+ int str2rdtype(char *rdtype, int *is_generic)
+ {
+-	if (!rdtype) return -1;
+-	if (is_generic) *is_generic = 0;
+-	switch (*rdtype) {
+-	case 'a':
+-		if (strcmp(rdtype, "a") == 0) {
+-			return T_A;
+-		} else if (strcmp(rdtype, "aaaa") == 0) {
+-			return T_AAAA;
+-		} else if (strcmp(rdtype, "afsdb") == 0) {
+-			return T_AFSDB;
+-		}
+-		break;
+-	case 'c':
+-		if (strcmp(rdtype, "cname") == 0) {
+-			return T_CNAME;
+-		} else if (strcmp(rdtype, "cert") == 0) {
+-			return T_CERT;
+-		}
+-		break;
+-	case 'd':
+-		if (strcmp(rdtype, "ds") == 0) {
+-			return T_DS;
+-		} else if (strcmp(rdtype, "dnskey") == 0) {
+-			return T_DNSKEY;
+-		} else if (strcmp(rdtype, "dname") == 0) {
+-			return T_DNAME;
+-		} else if (strcmp(rdtype, "dlv") == 0) {
+-			return T_DLV;
+-		} else if (strcmp(rdtype, "dhcid") == 0) {
+-			return T_DHCID;
+-		}
+-		break;
+-	case 'h':
+-		if (strcmp(rdtype, "hinfo") == 0) {
+-			return T_HINFO;
+-		}
+-		break;
+-	case 'i':
+-		if (strcmp(rdtype, "ipseckey") == 0) {
+-			return T_IPSECKEY;
+-		} else if (strcmp(rdtype, "isdn") == 0) {
+-			return T_ISDN;
+-		}
+-		break;
+-	case 'k':
+-		if (strcmp(rdtype, "kx") == 0) {
+-			return T_KX;
+-		}
+-		break;
+-	case 'l':
+-		if (strcmp(rdtype, "loc") == 0) {
+-			return T_LOC;
+-		} else if (strcmp(rdtype, "l32") == 0) {
+-			return T_L32;
+-		} else if (strcmp(rdtype, "l64") == 0) {
+-			return T_L64;
+-		} else if (strcmp(rdtype, "lp") == 0) {
+-			return T_LP;
+-		}
+-		break;
+-	case 'm':
+-		if (strcmp(rdtype, "mx") == 0) {
+-			return T_MX;
+-		} else if (strcmp(rdtype, "mb") == 0) {
+-			return T_MB;
+-		} else if (strcmp(rdtype, "mg") == 0) {
+-			return T_MG;
+-		} else if (strcmp(rdtype, "minfo") == 0) {
+-			return T_MINFO;
+-		} else if (strcmp(rdtype, "mr") == 0) {
+-			return T_MR;
+-		}
+-		break;
+-	case 'n':
+-		if (strcmp(rdtype, "ns") == 0) {
+-			return T_NS;
+-		} else if (strcmp(rdtype, "naptr") == 0) {
+-			return T_NAPTR;
+-		} else if (strcmp(rdtype, "nsec") == 0) {
+-			return T_NSEC;
+-		} else if (strcmp(rdtype, "nsec3") == 0) {
+-			return T_NSEC3;
+-		} else if (strcmp(rdtype, "nid") == 0) {
+-			return T_NID;
+-		} else if (strcmp(rdtype, "nsec3param") == 0) {
+-			return T_NSEC3PARAM;
+-		} else if (strcmp(rdtype, "nsap") == 0) {
+-			return T_NSAP;
+-		}
+-		break;
+-	case 'p':
+-		if (strcmp(rdtype, "ptr") == 0) {
+-			return T_PTR;
+-		} else if (strcmp(rdtype, "px") == 0) {
+-			return T_PX;
+-		}
+-		break;
+-	case 'r':
+-		if (strcmp(rdtype, "rrsig") == 0) {
+-			return T_RRSIG;
+-		} else if (strcmp(rdtype, "rp") == 0) {
+-			return T_RP;
+-		} else if (strcmp(rdtype, "rt") == 0) {
+-			return T_RT;
+-		}
+-		break;
+-	case 's':
+-		if (strcmp(rdtype, "soa") == 0) {
+-			return T_SOA;
+-		} else if (strcmp(rdtype, "srv") == 0) {
+-			return T_SRV;
+-		} else if (strcmp(rdtype, "spf") == 0) {
+-			return T_SPF;
+-		} else if (strcmp(rdtype, "sshfp") == 0) {
+-			return T_SSHFP;
+-		}
+-		break;
+-	case 't':
+-		if (strcmp(rdtype, "txt") == 0) {
+-			return T_TXT;
+-		} else if (strcmp(rdtype, "tlsa") == 0) {
+-			return T_TLSA;
+-		} else if (strncmp(rdtype, "type", 4) == 0) {
+-			long type = strtol(rdtype+4, NULL, 10);
+-			if (is_generic) *is_generic = 1;
+-			if (type <= 0 || type > 65535)
+-				bitch("invalid rdtype %s", rdtype);
+-			return type;
+-		}
+-		break;
+-	case 'x':
+-		if (strcmp(rdtype, "x25") == 0) {
+-			return T_X25;
+-		}
+-		break;
+-	}
+-	bitch("invalid or unsupported rdtype %s", rdtype);
+-	return -1;
++    if (!rdtype) return -1;
++    if (is_generic) *is_generic = 0;
++    switch (*rdtype) {
++    case 'a':
++        if (strcmp(rdtype, "a") == 0) {
++            return T_A;
++        } else if (strcmp(rdtype, "aaaa") == 0) {
++            return T_AAAA;
++        } else if (strcmp(rdtype, "afsdb") == 0) {
++            return T_AFSDB;
++        }
++        break;
++    case 'c':
++        if (strcmp(rdtype, "cname") == 0) {
++            return T_CNAME;
++        } else if (strcmp(rdtype, "cert") == 0) {
++            return T_CERT;
++        } else if (strcmp(rdtype, "caa") == 0) {
++            return T_CAA;
++        } else if (strcmp(rdtype, "cds") == 0) {
++            return T_CDS;
++        } else if (strcmp(rdtype, "cdnskey") == 0) {
++            return T_CDNSKEY;
++        }
++        break;
++    case 'd':
++        if (strcmp(rdtype, "ds") == 0) {
++            return T_DS;
++        } else if (strcmp(rdtype, "dnskey") == 0) {
++            return T_DNSKEY;
++        } else if (strcmp(rdtype, "dname") == 0) {
++            return T_DNAME;
++        } else if (strcmp(rdtype, "dlv") == 0) {
++            return T_DLV;
++        } else if (strcmp(rdtype, "dhcid") == 0) {
++            return T_DHCID;
++        }
++        break;
++    case 'h':
++        if (strcmp(rdtype, "hinfo") == 0) {
++            return T_HINFO;
++        }
++        break;
++    case 'i':
++        if (strcmp(rdtype, "ipseckey") == 0) {
++            return T_IPSECKEY;
++        } else if (strcmp(rdtype, "isdn") == 0) {
++            return T_ISDN;
++        }
++        break;
++    case 'k':
++        if (strcmp(rdtype, "kx") == 0) {
++            return T_KX;
++        }
++        break;
++    case 'l':
++        if (strcmp(rdtype, "loc") == 0) {
++            return T_LOC;
++        } else if (strcmp(rdtype, "l32") == 0) {
++            return T_L32;
++        } else if (strcmp(rdtype, "l64") == 0) {
++            return T_L64;
++        } else if (strcmp(rdtype, "lp") == 0) {
++            return T_LP;
++        }
++        break;
++    case 'm':
++        if (strcmp(rdtype, "mx") == 0) {
++            return T_MX;
++        } else if (strcmp(rdtype, "mb") == 0) {
++            return T_MB;
++        } else if (strcmp(rdtype, "mg") == 0) {
++            return T_MG;
++        } else if (strcmp(rdtype, "minfo") == 0) {
++            return T_MINFO;
++        } else if (strcmp(rdtype, "mr") == 0) {
++            return T_MR;
++        }
++        break;
++    case 'n':
++        if (strcmp(rdtype, "ns") == 0) {
++            return T_NS;
++        } else if (strcmp(rdtype, "naptr") == 0) {
++            return T_NAPTR;
++        } else if (strcmp(rdtype, "nsec") == 0) {
++            return T_NSEC;
++        } else if (strcmp(rdtype, "nsec3") == 0) {
++            return T_NSEC3;
++        } else if (strcmp(rdtype, "nid") == 0) {
++            return T_NID;
++        } else if (strcmp(rdtype, "nsec3param") == 0) {
++            return T_NSEC3PARAM;
++        } else if (strcmp(rdtype, "nsap") == 0) {
++            return T_NSAP;
++        }
++        break;
++    case 'p':
++        if (strcmp(rdtype, "ptr") == 0) {
++            return T_PTR;
++        } else if (strcmp(rdtype, "px") == 0) {
++            return T_PX;
++        }
++        break;
++    case 'r':
++        if (strcmp(rdtype, "rrsig") == 0) {
++            return T_RRSIG;
++        } else if (strcmp(rdtype, "rp") == 0) {
++            return T_RP;
++        } else if (strcmp(rdtype, "rt") == 0) {
++            return T_RT;
++        }
++        break;
++    case 's':
++        if (strcmp(rdtype, "soa") == 0) {
++            return T_SOA;
++        } else if (strcmp(rdtype, "srv") == 0) {
++            return T_SRV;
++        } else if (strcmp(rdtype, "spf") == 0) {
++            return T_SPF;
++        } else if (strcmp(rdtype, "sshfp") == 0) {
++            return T_SSHFP;
++        } else if (strcmp(rdtype, "smimea") == 0) {
++            return T_SMIMEA;
++        }
++        break;
++    case 't':
++        if (strcmp(rdtype, "txt") == 0) {
++            return T_TXT;
++        } else if (strcmp(rdtype, "tlsa") == 0) {
++            return T_TLSA;
++        } else if (strncmp(rdtype, "type", 4) == 0) {
++            long type = strtol(rdtype+4, NULL, 10);
++            if (is_generic) *is_generic = 1;
++            if (type <= 0 || type > 65535)
++                bitch("invalid rdtype %s", rdtype);
++            return type;
++        }
++        break;
++    case 'x':
++        if (strcmp(rdtype, "x25") == 0) {
++            return T_X25;
++        }
++        break;
++    }
++    bitch("invalid or unsupported rdtype %s", rdtype);
++    return -1;
+ }
+ 
+ void validate_rrset(struct rr_set *rr_set)
+ {
+-	struct rr *rr;
+-	int ttl;
++    struct rr *rr;
++    int ttl;
+ 
+-	/* This can happen when rr_set was allocated but
+-	 * nothing was added to it due to an error. */
+-	if (rr_set->count == 0) return;
+-	rr = rr_set->tail;
+-	if (!rr) {
+-		croakx(4, "assertion failed: %s %s is null, but count is %d",
+-			   rdtype2str(rr_set->rdtype), rr_set->named_rr->name,
+-			   rr_set->count);
+-	}
+-	if (rr_set->rdtype < T_MAX && rr_methods[rr_set->rdtype].rr_validate_set)
+-		rr_methods[rr_set->rdtype].rr_validate_set(rr_set);
+-	ttl = rr->ttl;
+-
+-	while (rr) {
+-		validate_record(rr);
+-		if (ttl != rr->ttl) {
+-		   	if (rr->rdtype != T_RRSIG) /* RRSIG is an exception */
+-				moan(rr->file_name, rr->line, "TTL values differ within an RR set");
+-		}
+-		rr = rr->next;
+-	}
++    /* This can happen when rr_set was allocated but
++     * nothing was added to it due to an error. */
++    if (rr_set->count == 0) return;
++    rr = rr_set->tail;
++    if (!rr) {
++        croakx(4, "assertion failed: %s %s is null, but count is %d",
++               rdtype2str(rr_set->rdtype), rr_set->named_rr->name,
++               rr_set->count);
++    }
++    if (rr_set->rdtype < T_MAX && rr_methods[rr_set->rdtype].rr_validate_set)
++        rr_methods[rr_set->rdtype].rr_validate_set(rr_set);
++    ttl = rr->ttl;
++
++    while (rr) {
++        validate_record(rr);
++        if (ttl != rr->ttl) {
++            if (rr->rdtype != T_RRSIG) /* RRSIG is an exception */
++                moan(rr->file_name, rr->line, "TTL values differ within an RR set");
++        }
++        rr = rr->next;
++    }
+ }
+ 
+ void debug(struct named_rr *named_rr, char *s)
+ {
+-	fprintf(stderr, "%s %s", s, named_rr->name);
+-	if ((named_rr->flags & NAME_FLAG_APEX))
+-		fprintf(stderr, ", apex");
+-	if ((named_rr->flags & NAME_FLAG_HAS_RECORDS))
+-		fprintf(stderr, ", has records");
+-	if ((named_rr->flags & NAME_FLAG_DELEGATION))
+-		fprintf(stderr, ", delegation");
+-	if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE))
+-		fprintf(stderr, ", not auth");
+-	if ((named_rr->flags & NAME_FLAG_NSEC3_ONLY))
+-		fprintf(stderr, ", nsec3 only");
+-	if ((named_rr->flags & NAME_FLAG_KIDS_WITH_RECORDS))
+-		fprintf(stderr, ", kid records");
+-	if ((named_rr->flags & NAME_FLAG_SIGNED_DELEGATION))
+-		fprintf(stderr, ", signed delegation");
+-	if ((named_rr->flags & NAME_FLAG_APEX_PARENT))
+-		fprintf(stderr, ", apex parent");
+-	fprintf(stderr, "\n");
++    fprintf(stderr, "%s %s", s, named_rr->name);
++    if ((named_rr->flags & NAME_FLAG_APEX))
++        fprintf(stderr, ", apex");
++    if ((named_rr->flags & NAME_FLAG_HAS_RECORDS))
++        fprintf(stderr, ", has records");
++    if ((named_rr->flags & NAME_FLAG_DELEGATION))
++        fprintf(stderr, ", delegation");
++    if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE))
++        fprintf(stderr, ", not auth");
++    if ((named_rr->flags & NAME_FLAG_NSEC3_ONLY))
++        fprintf(stderr, ", nsec3 only");
++    if ((named_rr->flags & NAME_FLAG_KIDS_WITH_RECORDS))
++        fprintf(stderr, ", kid records");
++    if ((named_rr->flags & NAME_FLAG_SIGNED_DELEGATION))
++        fprintf(stderr, ", signed delegation");
++    if ((named_rr->flags & NAME_FLAG_APEX_PARENT))
++        fprintf(stderr, ", apex parent");
++    fprintf(stderr, "\n");
+ }
+ 
+ static int
+ validate_named_rr(const char *name, intptr_t *data, void *p)
+ {
+-	struct named_rr *named_rr = *((struct named_rr **)data);
+-	Word_t rdtype;
+-	struct rr_set **rr_set_p;
+-	int nsec3_present = 0;
+-	int nsec3_only = 1;
+-	static int seen_apex = 0;
+-
+-	if ((named_rr->flags & NAME_FLAG_APEX))
+-		seen_apex = 1;
+-	if (!seen_apex)
+-		named_rr->flags |= NAME_FLAG_APEX_PARENT;
+-
+-	if (named_rr->parent && (named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) {
+-		named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE;
+-		if ((named_rr->flags & NAME_FLAG_HAS_RECORDS) != 0) {
+-			G.stats.not_authoritative++;
+-		}
+-	}
+-
+-	if (G.nsec3_opt_out_present && (named_rr->flags & NAME_FLAG_DELEGATION)) {
+-		JLG(rr_set_p, named_rr->rr_sets, T_DS);
+-		if (!rr_set_p)
+-			named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE;
+-	}
++    struct named_rr *named_rr = *((struct named_rr **)data);
++    Word_t rdtype;
++    struct rr_set **rr_set_p;
++    int nsec3_present = 0;
++    int nsec3_only = 1;
++    static int seen_apex = 0;
++
++    if ((named_rr->flags & NAME_FLAG_APEX))
++        seen_apex = 1;
++    if (!seen_apex)
++        named_rr->flags |= NAME_FLAG_APEX_PARENT;
++
++    if (named_rr->parent && (named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) {
++        named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE;
++        if ((named_rr->flags & NAME_FLAG_HAS_RECORDS) != 0) {
++            G.stats.not_authoritative++;
++        }
++    }
++
++    if (G.nsec3_opt_out_present && (named_rr->flags & NAME_FLAG_DELEGATION)) {
++        JLG(rr_set_p, named_rr->rr_sets, T_DS);
++        if (!rr_set_p)
++            named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE;
++    }
+ //debug(named_rr, ">>>>");
+ 
+-	rdtype = 0;
+-	JLF(rr_set_p, named_rr->rr_sets, rdtype);
++    rdtype = 0;
++    JLF(rr_set_p, named_rr->rr_sets, rdtype);
+ 
+-	while (rr_set_p) {
+-		validate_rrset(*rr_set_p);
+-		if (rdtype == T_NSEC3)
+-			nsec3_present = 1;
+-		else if (rdtype != T_RRSIG)
+-			nsec3_only = 0;
+-		if (rdtype != T_NSEC3 && rdtype != T_RRSIG && rdtype != T_NS)
+-			named_rr->flags |= NAME_FLAG_THIS_WITH_RECORDS;
+-		if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE) == 0 &&
+-			rdtype != T_NS && rdtype != T_NSEC3 && rdtype != T_RRSIG)
+-		{
+-			struct named_rr *nrr = named_rr;
+-			int skip_first = rdtype == T_NS;
+-
+-			while (nrr && (nrr->flags & NAME_FLAG_KIDS_WITH_RECORDS) == 0) {
+-				if ((nrr->flags & NAME_FLAG_APEX_PARENT) || strlen(nrr->name) < zone_apex_l) {
+-					nrr->flags |= NAME_FLAG_APEX_PARENT;
+-					break;
+-				}
+-				if (!skip_first)
+-					nrr->flags |= NAME_FLAG_KIDS_WITH_RECORDS;
+-				skip_first = 0;
+-				nrr = nrr->parent;
+-			}
+-		}
+-		if (rdtype == T_DS) {
+-			struct named_rr *nrr = named_rr;
+-			while (nrr && (nrr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) {
+-				// nrr->flags &= ~(NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE);
+-				nrr->flags |= NAME_FLAG_SIGNED_DELEGATION;
+-				nrr = nrr->parent;
+-			}
+-		}
+-		JLN(rr_set_p, named_rr->rr_sets, rdtype);
+-	}
+-	if (nsec3_present && nsec3_only) {
+-		named_rr->flags |= NAME_FLAG_NSEC3_ONLY;
+-	}
+-	return 1;
++    while (rr_set_p) {
++        validate_rrset(*rr_set_p);
++        if (rdtype == T_NSEC3)
++            nsec3_present = 1;
++        else if (rdtype != T_RRSIG)
++            nsec3_only = 0;
++        if (rdtype != T_NSEC3 && rdtype != T_RRSIG && rdtype != T_NS)
++            named_rr->flags |= NAME_FLAG_THIS_WITH_RECORDS;
++        if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE) == 0 &&
++            rdtype != T_NS && rdtype != T_NSEC3 && rdtype != T_RRSIG)
++        {
++            struct named_rr *nrr = named_rr;
++            int skip_first = rdtype == T_NS;
++
++            while (nrr && (nrr->flags & NAME_FLAG_KIDS_WITH_RECORDS) == 0) {
++                if ((nrr->flags & NAME_FLAG_APEX_PARENT) || strlen(nrr->name) < zone_apex_l) {
++                    nrr->flags |= NAME_FLAG_APEX_PARENT;
++                    break;
++                }
++                if (!skip_first)
++                    nrr->flags |= NAME_FLAG_KIDS_WITH_RECORDS;
++                skip_first = 0;
++                nrr = nrr->parent;
++            }
++        }
++        if (rdtype == T_DS) {
++            struct named_rr *nrr = named_rr;
++            while (nrr && (nrr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) {
++                // nrr->flags &= ~(NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE);
++                nrr->flags |= NAME_FLAG_SIGNED_DELEGATION;
++                nrr = nrr->parent;
++            }
++        }
++        JLN(rr_set_p, named_rr->rr_sets, rdtype);
++    }
++    if (nsec3_present && nsec3_only) {
++        named_rr->flags |= NAME_FLAG_NSEC3_ONLY;
++    }
++    return 1;
+ }
+ 
+ 
+ static void* nsec_validate_pass2(struct rr *rrv)
+ {
+-	RRCAST(nsec);
+-	struct named_rr *named_rr, *next_named_rr;
++    RRCAST(nsec);
++    struct named_rr *named_rr, *next_named_rr;
+ 
+-	named_rr = rr->rr.rr_set->named_rr;
+-	next_named_rr = find_next_named_rr(named_rr);
+-	/* Skip empty non-terminals and not authoritative records from consideration */
+-	while (next_named_rr) {
+-		if ((next_named_rr->flags & NAME_FLAG_HAS_RECORDS) == 0) {
+-			next_named_rr = find_next_named_rr(next_named_rr);
+-			continue;
+-		}
+-		if (next_named_rr->parent &&
+-			(next_named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0)
+-		{
+-			named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE;
+-			next_named_rr = find_next_named_rr(next_named_rr);
+-			continue;
+-		}
+-		break;
+-	}
+-
+-	if (strcasecmp(rr->next_domain, zone_apex) == 0) {
+-		if (next_named_rr) {
+-			return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s is the last name, but %s exists",
+-						named_rr->name, next_named_rr->name);
+-		}
+-	} else {
+-		if (!next_named_rr) {
+-			return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but nothing does",
+-						rr->next_domain, named_rr->name);
+-		} else if (strcasecmp(rr->next_domain, next_named_rr->name) != 0) {
+-			return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but %s does",
+-						rr->next_domain, named_rr->name, next_named_rr->name);
+-		}
+-	}
++    named_rr = rr->rr.rr_set->named_rr;
++    next_named_rr = find_next_named_rr(named_rr);
++    /* Skip empty non-terminals and not authoritative records from consideration */
++    while (next_named_rr) {
++        if ((next_named_rr->flags & NAME_FLAG_HAS_RECORDS) == 0) {
++            next_named_rr = find_next_named_rr(next_named_rr);
++            continue;
++        }
++        if (next_named_rr->parent &&
++            (next_named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0)
++        {
++            named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE;
++            next_named_rr = find_next_named_rr(next_named_rr);
++            continue;
++        }
++        break;
++    }
++
++    if (strcasecmp(rr->next_domain, zone_apex) == 0) {
++        if (next_named_rr) {
++            return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s is the last name, but %s exists",
++                        named_rr->name, next_named_rr->name);
++        }
++    } else {
++        if (!next_named_rr) {
++            return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but nothing does",
++                        rr->next_domain, named_rr->name);
++        } else if (strcasecmp(rr->next_domain, next_named_rr->name) != 0) {
++            return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but %s does",
++                        rr->next_domain, named_rr->name, next_named_rr->name);
++        }
++    }
+ 
+-	/* TODO: more checks */
+-	return rr;
++    /* TODO: more checks */
++    return rr;
+ }
+ 
+ static int
+ second_pass_one_name(const char *name, intptr_t *data, void *p)
+ {
+-	struct named_rr *named_rr = *((struct named_rr **)data);
+-	struct rr_set **rr_set_p;
++    struct named_rr *named_rr = *((struct named_rr **)data);
++    struct rr_set **rr_set_p;
+ 
+-	freeall_temp();
+-	JLG(rr_set_p, named_rr->rr_sets, T_NSEC);
+-	if (rr_set_p && (*rr_set_p)->tail) {
+-		nsec_validate_pass2((*rr_set_p)->tail);
+-	}
+-	return 1;
++    freeall_temp();
++    JLG(rr_set_p, named_rr->rr_sets, T_NSEC);
++    if (rr_set_p && (*rr_set_p)->tail) {
++        nsec_validate_pass2((*rr_set_p)->tail);
++    }
++    return 1;
+ }
+ 
+ void validate_zone(void)
+ {
+-	cbtree_allprefixed(&zone_data, "", validate_named_rr, NULL);
+-	cbtree_allprefixed(&zone_data, "", second_pass_one_name, NULL);
++    cbtree_allprefixed(&zone_data, "", validate_named_rr, NULL);
++    cbtree_allprefixed(&zone_data, "", second_pass_one_name, NULL);
+ 
+-	if (G.dnssec_active && !G.nsec3_present)
+-		validate_nsec_chain();
++    if (G.dnssec_active && !G.nsec3_present)
++        validate_nsec_chain();
+ }
+ 
+ void validate_record(struct rr *rr)
+ {
+-	freeall_temp();
+-	if (!rr->is_generic && rr->rdtype < T_MAX && rr_methods[rr->rdtype].rr_validate)
+-		rr_methods[rr->rdtype].rr_validate(rr);
++    freeall_temp();
++    if (!rr->is_generic && rr->rdtype <= T_MAX)
++        rr_counts[rr->rdtype]++;
++    if (!rr->is_generic && rr->rdtype <= T_MAX && rr_methods[rr->rdtype].rr_validate)
++        rr_methods[rr->rdtype].rr_validate(rr);
+ }
+ 
+ int extract_algorithm(char **s, char *what)
+ {
+-	int alg;
+-	char *str_alg;
++    int alg;
++    char *str_alg;
+ 
+-	if (isdigit(**s)) {
+-		alg = extract_integer(s, what);
+-		if (algorithm_type(alg) == ALG_UNSUPPORTED) {
+-			bitch("bad or unsupported algorithm %d", alg);
+-			return ALG_UNSUPPORTED;
+-		}
+-		return alg;
+-	} else {
+-		str_alg = extract_label(s, what, "temporary");
+-		if (!str_alg) return ALG_UNSUPPORTED;
+-		if (strcmp(str_alg, "dsa") == 0)
+-			return ALG_DSA;
+-		if (strcmp(str_alg, "rsasha1") == 0)
+-			return ALG_RSASHA1;
+-		if (strcmp(str_alg, "dsa-nsec3-sha1") == 0)
+-			return ALG_DSA_NSEC3_SHA1;
+-		if (strcmp(str_alg, "rsasha1-nsec3-sha1") == 0)
+-			return ALG_RSASHA1_NSEC3_SHA1;
+-		if (strcmp(str_alg, "rsasha256") == 0)
+-			return ALG_RSASHA256;
+-		if (strcmp(str_alg, "rsasha512") == 0)
+-			return ALG_RSASHA512;
+-
+-		if (strcmp(str_alg, "ecc-gost") == 0)
+-			return ALG_ECCGOST;
+-		if (strcmp(str_alg, "ecdsap256sha256") == 0)
+-			return ALG_ECDSAP256SHA256;
+-		if (strcmp(str_alg, "ecdsap384sha384") == 0)
+-			return ALG_ECDSAP384SHA384;
+-
+-		if (strcmp(str_alg, "privatedns") == 0)
+-			return ALG_PRIVATEDNS;
+-		if (strcmp(str_alg, "privateoid") == 0)
+-			return ALG_PRIVATEOID;
+-		bitch("bad or unsupported algorithm %s", str_alg);
+-		return ALG_UNSUPPORTED;
+-	}
++    if (isdigit(**s)) {
++        alg = extract_integer(s, what, NULL);
++        if (algorithm_type(alg) == ALG_UNSUPPORTED) {
++            bitch("bad or unsupported algorithm %d", alg);
++            return ALG_UNSUPPORTED;
++        }
++        return alg;
++    } else {
++        str_alg = extract_label(s, what, "temporary");
++        if (!str_alg) return ALG_UNSUPPORTED;
++        if (strcmp(str_alg, "dsa") == 0)
++            return ALG_DSA;
++        if (strcmp(str_alg, "rsasha1") == 0)
++            return ALG_RSASHA1;
++        if (strcmp(str_alg, "dsa-nsec3-sha1") == 0)
++            return ALG_DSA_NSEC3_SHA1;
++        if (strcmp(str_alg, "rsasha1-nsec3-sha1") == 0)
++            return ALG_RSASHA1_NSEC3_SHA1;
++        if (strcmp(str_alg, "rsasha256") == 0)
++            return ALG_RSASHA256;
++        if (strcmp(str_alg, "rsasha512") == 0)
++            return ALG_RSASHA512;
++
++        if (strcmp(str_alg, "ecc-gost") == 0)
++            return ALG_ECCGOST;
++        if (strcmp(str_alg, "ecdsap256sha256") == 0)
++            return ALG_ECDSAP256SHA256;
++        if (strcmp(str_alg, "ecdsap384sha384") == 0)
++            return ALG_ECDSAP384SHA384;
++        if (strcmp(str_alg, "ed25519") == 0)
++            return ALG_ED25519;
++        if (strcmp(str_alg, "ed448") == 0)
++            return ALG_ED448;
++
++        if (strcmp(str_alg, "privatedns") == 0)
++            return ALG_PRIVATEDNS;
++        if (strcmp(str_alg, "privateoid") == 0)
++            return ALG_PRIVATEOID;
++        bitch("bad or unsupported algorithm %s", str_alg);
++        return ALG_UNSUPPORTED;
++    }
+ }
+ 
+ int algorithm_type(int alg)
+ {
+-	switch (alg) {
+-	case ALG_DSA:
+-		return ALG_DSA_FAMILY;
+-	case ALG_RSASHA1:
+-		return ALG_RSA_FAMILY;
+-	case ALG_DSA_NSEC3_SHA1:
+-		return ALG_DSA_FAMILY;
+-	case ALG_RSASHA1_NSEC3_SHA1:
+-		return ALG_RSA_FAMILY;
+-	case ALG_RSASHA256:
+-		return ALG_RSA_FAMILY;
+-	case ALG_RSASHA512:
+-		return ALG_RSA_FAMILY;
++    switch (alg) {
++    case ALG_DSA:
++        return ALG_DSA_FAMILY;
++    case ALG_RSASHA1:
++        return ALG_RSA_FAMILY;
++    case ALG_DSA_NSEC3_SHA1:
++        return ALG_DSA_FAMILY;
++    case ALG_RSASHA1_NSEC3_SHA1:
++        return ALG_RSA_FAMILY;
++    case ALG_RSASHA256:
++        return ALG_RSA_FAMILY;
++    case ALG_RSASHA512:
++        return ALG_RSA_FAMILY;
+         case ALG_ECCGOST:
+                 return ALG_ECC_FAMILY;
+         case ALG_ECDSAP256SHA256:
+                 return ALG_ECC_FAMILY;
+         case ALG_ECDSAP384SHA384:
+                 return ALG_ECC_FAMILY;
+-	case ALG_PRIVATEDNS:
+-		return ALG_PRIVATE_FAMILY;
+-	case ALG_PRIVATEOID:
+-		return ALG_PRIVATE_FAMILY;
+-	}
+-	return ALG_UNSUPPORTED;
++    case ALG_ED25519:
++        return ALG_ECC_FAMILY;
++    case ALG_ED448:
++        return ALG_ECC_FAMILY;
++    case ALG_PRIVATEDNS:
++        return ALG_PRIVATE_FAMILY;
++    case ALG_PRIVATEOID:
++        return ALG_PRIVATE_FAMILY;
++    }
++    return ALG_UNSUPPORTED;
+ }
+diff -Naur validns-0.8/rr.h validns/rr.h
+--- validns-0.8/rr.h	2014-02-11 15:46:57.000000000 -0500
++++ validns/rr.h	2020-10-05 16:59:29.355681369 -0400
+@@ -9,49 +9,53 @@
+ #ifndef _RR_H
+ #define _RR_H 1
+ 
+-#define T_A		1
+-#define T_NS	2
+-#define T_CNAME	5
+-#define T_SOA	6
+-#define T_MB	7
+-#define T_MG	8
+-#define T_MR	9
+-#define T_PTR	12
+-#define T_HINFO	13
+-#define T_MINFO	14
+-#define T_MX	15
+-#define T_TXT	16
+-#define T_RP	17
+-#define T_AFSDB	18
+-#define T_X25	19
+-#define T_ISDN	20
+-#define T_RT	21
+-#define T_NSAP	22
+-#define T_PX	26
+-#define T_AAAA	28
+-#define T_LOC	29
+-#define T_SRV	33
+-#define T_NAPTR	35
+-#define T_KX	36
+-#define T_CERT	37
+-#define T_DNAME	39
+-#define T_DS	43
+-#define T_SSHFP	44
+-#define T_IPSECKEY	45
+-#define T_RRSIG	46
+-#define T_NSEC	47
+-#define T_DNSKEY	48
+-#define T_DHCID	49
+-#define T_NSEC3	50
+-#define T_NSEC3PARAM	51
+-#define T_TLSA	52
+-#define T_SPF	99
+-#define T_NID	104
+-#define T_L32	105
+-#define T_L64	106
+-#define T_LP	107
++#define T_A     1
++#define T_NS    2
++#define T_CNAME 5
++#define T_SOA   6
++#define T_MB    7
++#define T_MG    8
++#define T_MR    9
++#define T_PTR   12
++#define T_HINFO 13
++#define T_MINFO 14
++#define T_MX    15
++#define T_TXT   16
++#define T_RP    17
++#define T_AFSDB 18
++#define T_X25   19
++#define T_ISDN  20
++#define T_RT    21
++#define T_NSAP  22
++#define T_PX    26
++#define T_AAAA  28
++#define T_LOC   29
++#define T_SRV   33
++#define T_NAPTR 35
++#define T_KX    36
++#define T_CERT  37
++#define T_DNAME 39
++#define T_DS    43
++#define T_SSHFP 44
++#define T_IPSECKEY  45
++#define T_RRSIG 46
++#define T_NSEC  47
++#define T_DNSKEY    48
++#define T_DHCID 49
++#define T_NSEC3 50
++#define T_NSEC3PARAM    51
++#define T_TLSA  52
++#define T_SMIMEA  53
++#define T_CDS   59
++#define T_CDNSKEY 60
++#define T_SPF   99
++#define T_NID   104
++#define T_L32   105
++#define T_L64   106
++#define T_LP    107
++#define T_CAA   257
+ #define T_DLV   32769
+-#define T_MAX	32769
++#define T_MAX   32769
+ 
+ #define ALG_DSA                  3
+ #define ALG_RSASHA1              5
+@@ -62,6 +66,8 @@
+ #define ALG_ECCGOST             12
+ #define ALG_ECDSAP256SHA256     13
+ #define ALG_ECDSAP384SHA384     14
++#define ALG_ED25519             15
++#define ALG_ED448               16
+ #define ALG_PRIVATEDNS         253
+ #define ALG_PRIVATEOID         254
+ 
+@@ -88,14 +94,15 @@
+ typedef void* (*rr_validate_set_func)(struct rr_set*);
+ typedef void* (*rr_validate_func)(struct rr*);
+ struct rr_methods {
+-	rr_parse_func        rr_parse;
+-	rr_human_func        rr_human;
+-	rr_wire_func         rr_wire;
+-	rr_validate_set_func rr_validate_set;
+-	rr_validate_func     rr_validate;
++    rr_parse_func        rr_parse;
++    rr_human_func        rr_human;
++    rr_wire_func         rr_wire;
++    rr_validate_set_func rr_validate_set;
++    rr_validate_func     rr_validate;
+ };
+ extern struct rr_methods rr_methods[T_MAX+1];
+ extern struct rr_methods unknown_methods;
++extern int rr_counts[T_MAX+1];
+ 
+ struct binary_data call_get_wired(struct rr *rr);
+ struct rr *rr_parse_any(char *name, long ttl, int type, char *s);
+@@ -130,58 +137,58 @@
+ 
+ struct named_rr
+ {
+-	char *name;
+-	void *rr_sets;
++    char *name;
++    void *rr_sets;
+ 
+-	int line;
+-	char *file_name;
+-	uint32_t flags;
+-	struct named_rr *parent;
++    int line;
++    char *file_name;
++    uint32_t flags;
++    struct named_rr *parent;
+ };
+ 
+ struct rr_set
+ {
+-	struct rr* head;
+-	struct rr* tail;
+-	struct named_rr *named_rr;
+-	int rdtype;
+-	int count;
++    struct rr* head;
++    struct rr* tail;
++    struct named_rr *named_rr;
++    int rdtype;
++    int count;
+ };
+ 
+ struct rr
+ {
+-	struct rr* next;
+-	struct rr* prev;
+-	struct rr_set *rr_set;
+-
+-	int	ttl;
+-	int rdtype;
+-
+-	int line;
+-	int is_generic;
+-	char *file_name;
++    struct rr* next;
++    struct rr* prev;
++    struct rr_set *rr_set;
++
++    int ttl;
++    int rdtype;
++
++    int line;
++    int is_generic;
++    char *file_name;
+ };
+ 
+ struct rr_any
+ {
+-	struct rr rr;
+-	struct binary_data data;
++    struct rr rr;
++    struct binary_data data;
+ };
+ 
+ struct rr_a
+ {
+-	struct rr rr;
+-	struct in_addr address;
++    struct rr rr;
++    struct in_addr address;
+ };
+ extern struct rr_methods a_methods;
+ 
+ struct rr_soa
+ {
+-	struct rr rr;
+-	uint32_t serial;
+-	int refresh, retry, expire, minimum;
+-	char *rname;
+-	char *mname;
++    struct rr rr;
++    uint32_t serial;
++    int refresh, retry, expire, minimum;
++    char *rname;
++    char *mname;
+ };
+ extern struct rr_methods soa_methods;
+ 
+@@ -197,19 +204,23 @@
+     struct rr rr;
+     int id_type;
+     int digest_type;
+-	struct binary_data digest;
++    struct binary_data digest;
+ };
+ extern struct rr_methods dhcid_methods;
+ 
++struct rr_txt_segment {
++    struct binary_data txt;
++    struct rr_txt_segment *next;
++};
+ struct rr_txt
+ {
+     struct rr rr;
+     int count;
+-    struct binary_data txt[1];
++    struct rr_txt_segment *txt;
+ };
+ extern struct rr_methods txt_methods;
+ 
+-struct rr_tlsa
++struct rr_tlsa_smimea
+ {
+     struct rr rr;
+     uint8_t cert_usage;
+@@ -218,20 +229,21 @@
+     struct binary_data association_data;
+ };
+ extern struct rr_methods tlsa_methods;
++extern struct rr_methods smimea_methods;
+ 
+ struct rr_ipseckey
+ {
+     struct rr rr;
+-	uint8_t precedence;
+-	uint8_t gateway_type;
+-	uint8_t algorithm;
+-	union {
+-		char           *gateway_none; /* gateway_type == 0 */
+-		struct in_addr  gateway_ipv4; /* gateway_type == 1 */
+-		struct in6_addr gateway_ipv6; /* gateway_type == 2 */
+-		char           *gateway_name; /* gateway_type == 3 */
+-	} gateway;
+-	struct binary_data public_key;
++    uint8_t precedence;
++    uint8_t gateway_type;
++    uint8_t algorithm;
++    union {
++        char           *gateway_none; /* gateway_type == 0 */
++        struct in_addr  gateway_ipv4; /* gateway_type == 1 */
++        struct in6_addr gateway_ipv6; /* gateway_type == 2 */
++        char           *gateway_name; /* gateway_type == 3 */
++    } gateway;
++    struct binary_data public_key;
+ };
+ extern struct rr_methods ipseckey_methods;
+ 
+@@ -270,20 +282,20 @@
+ struct rr_naptr
+ {
+     struct rr rr;
+-	uint16_t order;
+-	uint16_t preference;
+-	struct binary_data flags;
+-	struct binary_data services;
+-	struct binary_data regexp;
+-	char *replacement;
++    uint16_t order;
++    uint16_t preference;
++    struct binary_data flags;
++    struct binary_data services;
++    struct binary_data regexp;
++    char *replacement;
+ };
+ extern struct rr_methods naptr_methods;
+ 
+ struct rr_nsec
+ {
+-	struct rr rr;
+-	char *next_domain;
+-	struct binary_data type_bitmap;
++    struct rr rr;
++    char *next_domain;
++    struct binary_data type_bitmap;
+ };
+ extern struct rr_methods nsec_methods;
+ 
+@@ -291,208 +303,218 @@
+ 
+ struct rr_nsec3
+ {
+-	struct rr rr;
+-	uint8_t hash_algorithm;
+-	uint8_t flags;
+-	uint16_t iterations;
+-	struct binary_data salt;
+-	struct binary_data next_hashed_owner;
+-	struct binary_data type_bitmap;
+-	struct binary_data this_hashed_name;
+-	struct named_rr *corresponding_name;
+-	struct rr_nsec3 *next_nsec3;
++    struct rr rr;
++    uint8_t hash_algorithm;
++    uint8_t flags;
++    uint16_t iterations;
++    struct binary_data salt;
++    struct binary_data next_hashed_owner;
++    struct binary_data type_bitmap;
++    struct binary_data this_hashed_name;
++    struct named_rr *corresponding_name;
++    struct rr_nsec3 *next_nsec3;
+ };
+ extern struct rr_methods nsec3_methods;
+ 
+ struct rr_nsec3param
+ {
+-	struct rr rr;
+-	uint8_t hash_algorithm;
+-	uint8_t flags;
+-	uint16_t iterations;
+-	struct binary_data salt;
++    struct rr rr;
++    uint8_t hash_algorithm;
++    uint8_t flags;
++    uint16_t iterations;
++    struct binary_data salt;
+ };
+ extern struct rr_methods nsec3param_methods;
+ extern struct rr *nsec3param;
+ 
+ struct rr_rrsig
+ {
+-	struct rr rr;
+-	uint16_t type_covered;
+-	int algorithm;
+-	int labels;
+-	int orig_ttl;
+-	uint32_t sig_expiration;
+-	uint32_t sig_inception;
+-	uint16_t key_tag;
+-	char *signer;
+-	struct binary_data signature;
++    struct rr rr;
++    uint16_t type_covered;
++    int algorithm;
++    int labels;
++    int orig_ttl;
++    uint32_t sig_expiration;
++    uint32_t sig_inception;
++    uint16_t key_tag;
++    char *signer;
++    struct binary_data signature;
+ };
+ extern struct rr_methods rrsig_methods;
+ 
+ struct rr_srv
+ {
+-	struct rr rr;
+-	uint16_t priority;
+-	uint16_t weight;
+-	uint16_t port;
+-	char *target;
++    struct rr rr;
++    uint16_t priority;
++    uint16_t weight;
++    uint16_t port;
++    char *target;
+ };
+ extern struct rr_methods srv_methods;
+ 
+ struct rr_cname
+ {
+-	struct rr rr;
+-	char *cname;
++    struct rr rr;
++    char *cname;
+ };
+ extern struct rr_methods cname_methods;
+ 
+ struct rr_mb
+ {
+-	struct rr rr;
+-	char *madname;
++    struct rr rr;
++    char *madname;
+ };
+ extern struct rr_methods mb_methods;
+ 
+ struct rr_mg
+ {
+-	struct rr rr;
+-	char *mgmname;
++    struct rr rr;
++    char *mgmname;
+ };
+ extern struct rr_methods mg_methods;
+ 
+ struct rr_minfo
+ {
+-	struct rr rr;
+-	char *rmailbx;
+-	char *emailbx;
++    struct rr rr;
++    char *rmailbx;
++    char *emailbx;
+ };
+ extern struct rr_methods minfo_methods;
+ 
+ struct rr_mr
+ {
+-	struct rr rr;
+-	char *newname;
++    struct rr rr;
++    char *newname;
+ };
+ extern struct rr_methods mr_methods;
+ 
+ struct rr_dname
+ {
+-	struct rr rr;
+-	char *target;
++    struct rr rr;
++    char *target;
+ };
+ extern struct rr_methods dname_methods;
+ 
+ struct rr_aaaa
+ {
+-	struct rr rr;
+-	struct in6_addr address;
++    struct rr rr;
++    struct in6_addr address;
+ };
+ extern struct rr_methods aaaa_methods;
+ 
+ struct rr_mx
+ {
+-	struct rr rr;
+-	int   preference;
+-	char *exchange;
++    struct rr rr;
++    int   preference;
++    char *exchange;
+ };
+ extern struct rr_methods mx_methods;
+ 
+ struct rr_rt
+ {
+-	struct rr rr;
+-	int   preference;
+-	char *intermediate_host;
++    struct rr rr;
++    int   preference;
++    char *intermediate_host;
+ };
+ extern struct rr_methods rt_methods;
+ 
+ struct rr_afsdb
+ {
+-	struct rr rr;
+-	int   subtype;
+-	char *hostname;
++    struct rr rr;
++    int   subtype;
++    char *hostname;
+ };
+ extern struct rr_methods afsdb_methods;
+ 
+ struct rr_x25
+ {
+-	struct rr rr;
++    struct rr rr;
+     struct binary_data psdn_address;
+ };
+ extern struct rr_methods x25_methods;
+ 
+ struct rr_isdn
+ {
+-	struct rr rr;
++    struct rr rr;
+     struct binary_data isdn_address;
+     struct binary_data sa;
+-	int sa_present;
++    int sa_present;
+ };
+ extern struct rr_methods isdn_methods;
+ 
+ struct rr_px
+ {
+-	struct rr rr;
+-	int   preference;
+-	char *map822;
+-	char *mapx400;
++    struct rr rr;
++    int   preference;
++    char *map822;
++    char *mapx400;
+ };
+ extern struct rr_methods px_methods;
+ 
+ struct rr_kx
+ {
+-	struct rr rr;
+-	int   preference;
+-	char *exchanger;
++    struct rr rr;
++    int   preference;
++    char *exchanger;
+ };
+ extern struct rr_methods kx_methods;
+ 
+ struct rr_dnskey
+ {
+-	struct rr rr;
+-	uint16_t flags;
+-	uint8_t protocol;
+-	uint8_t algorithm;
+-	struct binary_data pubkey;
+-	/* calculated */
+-	uint16_t key_tag;
+-	int pkey_built;
+-	void *pkey;
++    struct rr rr;
++    uint16_t flags;
++    uint8_t protocol;
++    uint8_t algorithm;
++    struct binary_data pubkey;
++    /* calculated */
++    uint16_t key_tag;
++    int pkey_built;
++    void *pkey;
++    /* extras */
++    int key_type;
++    struct rr_dnskey *next_key;
+ };
+ extern struct rr_methods dnskey_methods;
++extern struct rr_methods cdnskey_methods;
++
++#define KEY_TYPE_UNUSED 0
++#define KEY_TYPE_KSK    1
++#define KEY_TYPE_ZSK    2
+ 
+ int dnskey_build_pkey(struct rr_dnskey *rr);
++void dnskey_ksk_policy_check(void);
+ 
+ struct rr_ds
+ {
+-	struct rr rr;
+-	uint16_t key_tag;
+-	uint8_t algorithm;
+-	uint8_t digest_type;
+-	struct binary_data digest;
++    struct rr rr;
++    uint16_t key_tag;
++    uint8_t algorithm;
++    uint8_t digest_type;
++    struct binary_data digest;
+ };
+ extern struct rr_methods ds_methods;
++extern struct rr_methods cds_methods;
+ 
+ struct rr_dlv
+ {
+-	struct rr rr;
+-	uint16_t key_tag;
+-	uint8_t algorithm;
+-	uint8_t digest_type;
+-	struct binary_data digest;
++    struct rr rr;
++    uint16_t key_tag;
++    uint8_t algorithm;
++    uint8_t digest_type;
++    struct binary_data digest;
+ };
+ extern struct rr_methods dlv_methods;
+ 
+ struct rr_nsap
+ {
+-	struct rr rr;
+-	struct binary_data data;
++    struct rr rr;
++    struct binary_data data;
+ };
+ extern struct rr_methods nsap_methods;
+ 
+ struct rr_hinfo
+ {
+-	struct rr rr;
++    struct rr rr;
+     struct binary_data cpu;
+     struct binary_data os;
+ };
+@@ -500,7 +522,7 @@
+ 
+ struct rr_rp
+ {
+-	struct rr rr;
++    struct rr rr;
+     char *mbox_dname;
+     char *txt_dname;
+ };
+@@ -508,14 +530,14 @@
+ 
+ struct rr_loc
+ {
+-	struct rr rr;
+-	uint8_t version;
+-	uint8_t size;
+-	uint8_t horiz_pre;
+-	uint8_t vert_pre;
+-	uint32_t latitude;
+-	uint32_t longitude;
+-	uint32_t altitude;
++    struct rr rr;
++    uint8_t version;
++    uint8_t size;
++    uint8_t horiz_pre;
++    uint8_t vert_pre;
++    uint32_t latitude;
++    uint32_t longitude;
++    uint32_t altitude;
+ };
+ extern struct rr_methods loc_methods;
+ 
+@@ -530,15 +552,15 @@
+ {
+     struct rr rr;
+     uint8_t algorithm;
+-	uint8_t fp_type;
+-	struct binary_data fingerprint;
++    uint8_t fp_type;
++    struct binary_data fingerprint;
+ };
+ extern struct rr_methods sshfp_methods;
+ 
+ struct rr_spf
+ {
+     struct rr rr;
+-	int count;
++    int count;
+     struct binary_data spf[1];
+ };
+ extern struct rr_methods spf_methods;
+@@ -546,13 +568,22 @@
+ struct rr_cert
+ {
+     struct rr rr;
+-	uint16_t type;
+-	uint16_t key_tag;
+-	int algorithm;
+-	struct binary_data certificate;
++    uint16_t type;
++    uint16_t key_tag;
++    int algorithm;
++    struct binary_data certificate;
+ };
+ extern struct rr_methods cert_methods;
+ 
++struct rr_caa
++{
++    struct rr rr;
++    uint8_t flags;
++    struct binary_data tag;
++    struct binary_data value;
++};
++extern struct rr_methods caa_methods;
++
+ extern struct rr_nsec3 *first_nsec3;
+ extern struct rr_nsec3 *latest_nsec3;
+ 
+diff -Naur validns-0.8/rrsig.c validns/rrsig.c
+--- validns-0.8/rrsig.c	2020-10-05 16:57:07.219376944 -0400
++++ validns/rrsig.c	2020-10-05 16:59:48.871860482 -0400
+@@ -16,6 +16,7 @@
+ #include <arpa/inet.h>
+ #include <openssl/evp.h>
+ #include <openssl/err.h>
++#include <openssl/ecdsa.h>
+ 
+ #include "common.h"
+ #include "textparse.h"
+@@ -25,135 +26,154 @@
+ 
+ struct verification_data
+ {
+-	struct verification_data *next;
++    struct verification_data *next;
+     EVP_MD_CTX *ctx;
+-	struct rr_dnskey *key;
+-	struct rr_rrsig *rr;
+-	int ok;
+-	unsigned long openssl_error;
++    struct rr_dnskey *key;
++    struct rr_rrsig *rr;
++    int ok;
++    unsigned long openssl_error;
+ };
+ 
+ struct keys_to_verify
+ {
+-	struct keys_to_verify *next;
+-	struct rr_rrsig *rr;
+-	struct rr_set *signed_set;
+-	int n_keys;
+-	struct verification_data to_verify[1];
++    struct keys_to_verify *next;
++    struct rr_rrsig *rr;
++    struct rr_set *signed_set;
++    int n_keys;
++    struct verification_data to_verify[1];
+ };
+ 
+ static struct keys_to_verify *all_keys_to_verify = NULL;
+ 
+ static struct rr* rrsig_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_rrsig *rr = getmem(sizeof(*rr));
+-	int type_covered, key_tag;
+-	char *str_type_covered;
+-	struct binary_data sig;
+-	long long ts;
+-
+-	str_type_covered = extract_label(&s, "type covered", "temporary");
+-	if (!str_type_covered) return NULL;
+-	type_covered = str2rdtype(str_type_covered, NULL);
+-	if (type_covered <= 0 || type_covered > 65535) return NULL;
+-	rr->type_covered = type_covered;
+-
+-	rr->algorithm = extract_algorithm(&s, "algorithm");
+-	if (rr->algorithm == ALG_UNSUPPORTED)	return NULL;
+-	if (rr->algorithm == ALG_PRIVATEDNS || rr->algorithm == ALG_PRIVATEOID) {
+-		return bitch("private algorithms are not supported in RRSIG");
+-	}
+-
+-	rr->labels = extract_integer(&s, "labels");
+-	if (rr->labels < 0)	return NULL;
+-	/* TODO validate labels, see http://tools.ietf.org/html/rfc4034#section-3.1.3 */
+-
+-	rr->orig_ttl = extract_timevalue(&s, "original TTL");
+-	if (rr->orig_ttl < 0) return NULL;
+-
+-	ts = extract_timestamp(&s, "signature expiration");
+-	if (ts < 0) return NULL;
+-	rr->sig_expiration = ts;
+-
+-	ts = extract_timestamp(&s, "signature inception");
+-	if (ts < 0) return NULL;
+-	rr->sig_inception = ts;
+-
+-	key_tag = extract_integer(&s, "key tag");
+-	if (key_tag < 0)	return NULL;
+-	rr->key_tag = key_tag;
+-
+-	rr->signer = extract_name(&s, "signer name", 0);
+-	if (!rr->signer) return NULL;
+-	/* TODO validate signer name, http://tools.ietf.org/html/rfc4034#section-3.1.7 */
+-
+-	sig = extract_base64_binary_data(&s, "signature");
+-	if (sig.length < 0)	return NULL;
+-	/* TODO validate signature length based on algorithm */
+-	rr->signature = sig;
+-
+-	if (*s) {
+-		return bitch("garbage after valid RRSIG data");
+-	}
+-	G.dnssec_active = 1;
+-	return store_record(type, name, ttl, rr);
++    struct rr_rrsig *rr = getmem(sizeof(*rr));
++    int type_covered, key_tag;
++    char *str_type_covered;
++    struct binary_data sig;
++    long long ts;
++
++    str_type_covered = extract_label(&s, "type covered", "temporary");
++    if (!str_type_covered) return NULL;
++    type_covered = str2rdtype(str_type_covered, NULL);
++    if (type_covered <= 0 || type_covered > 65535) return NULL;
++    rr->type_covered = type_covered;
++
++    rr->algorithm = extract_algorithm(&s, "algorithm");
++    if (rr->algorithm == ALG_UNSUPPORTED)   return NULL;
++    if (rr->algorithm == ALG_PRIVATEDNS || rr->algorithm == ALG_PRIVATEOID) {
++        return bitch("private algorithms are not supported in RRSIG");
++    }
++
++    rr->labels = extract_integer(&s, "labels", NULL);
++    if (rr->labels < 0) return NULL;
++    /* TODO validate labels, see http://tools.ietf.org/html/rfc4034#section-3.1.3 */
++
++    rr->orig_ttl = extract_timevalue(&s, "original TTL");
++    if (rr->orig_ttl < 0) return NULL;
++
++    ts = extract_timestamp(&s, "signature expiration");
++    if (ts < 0) return NULL;
++    rr->sig_expiration = ts;
++
++    ts = extract_timestamp(&s, "signature inception");
++    if (ts < 0) return NULL;
++    rr->sig_inception = ts;
++
++    key_tag = extract_integer(&s, "key tag", NULL);
++    if (key_tag < 0)    return NULL;
++    rr->key_tag = key_tag;
++
++    rr->signer = extract_name(&s, "signer name", 0);
++    if (!rr->signer) return NULL;
++    /* TODO validate signer name, http://tools.ietf.org/html/rfc4034#section-3.1.7 */
++
++    sig = extract_base64_binary_data(&s, "signature");
++    if (sig.length < 0) return NULL;
++    /* TODO validate signature length based on algorithm */
++    if (algorithm_type(rr->algorithm) == ALG_ECC_FAMILY) {
++        /*
++         * Transform ECDSA signatures from DNSSEC vanilla binary
++         * representation (r || s) into OpenSSL ASN.1 DER format
++         */
++        ECDSA_SIG *ecdsa_sig = ECDSA_SIG_new();
++	BIGNUM *r, *s;
++        int l = sig.length / 2;
++	r = BN_bin2bn((unsigned char *)sig.data, l, NULL);
++	s = BN_bin2bn((unsigned char *)sig.data + l, l, NULL);
++	if ((r == NULL) || (s == NULL))
++            return NULL;
++	ECDSA_SIG_set0(ecdsa_sig, r, s);
++        sig.length = i2d_ECDSA_SIG(ecdsa_sig, NULL);
++        sig.data = getmem(sig.length); /* reallocate larger mempool chunk */
++        unsigned char *sig_ptr = (unsigned char *)sig.data;
++        sig.length = i2d_ECDSA_SIG(ecdsa_sig, &sig_ptr);
++        ECDSA_SIG_free(ecdsa_sig);
++    }
++    rr->signature = sig;
++
++    if (*s) {
++        return bitch("garbage after valid RRSIG data");
++    }
++    G.dnssec_active = 1;
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* rrsig_human(struct rr *rrv)
+ {
+-	// RRCAST(rrsig);
++    // RRCAST(rrsig);
+     // char s[1024];
+ 
+     //snprintf(s, 1024, "SOA %s %s %d %d %d %d %d",
+-	 //    rr->mname, rr->rname, rr->serial,
+-	  //   rr->refresh, rr->retry, rr->expire, rr->minimum);
++     //    rr->mname, rr->rname, rr->serial,
++      //   rr->refresh, rr->retry, rr->expire, rr->minimum);
+     //return quickstrdup_temp(s);
+-	return NULL;
++    return NULL;
+ }
+ 
+ static struct binary_data rrsig_wirerdata_ex(struct rr *rrv, int with_signature)
+ {
+-	RRCAST(rrsig);
+-	struct binary_data bd;
++    RRCAST(rrsig);
++    struct binary_data bd;
+ 
+-	bd = compose_binary_data("2114442d", 1,
+-		rr->type_covered, rr->algorithm, rr->labels,
+-		rr->orig_ttl, rr->sig_expiration, rr->sig_inception,
+-		rr->key_tag, name2wire_name(rr->signer));
+-	if (with_signature) {
+-		return compose_binary_data("dd", 1, bd, rr->signature);
+-	}
+-	return bd;
++    bd = compose_binary_data("2114442d", 1,
++        rr->type_covered, rr->algorithm, rr->labels,
++        rr->orig_ttl, rr->sig_expiration, rr->sig_inception,
++        rr->key_tag, name2wire_name(rr->signer));
++    if (with_signature) {
++        return compose_binary_data("dd", 1, bd, rr->signature);
++    }
++    return bd;
+ }
+ 
+ static struct binary_data rrsig_wirerdata(struct rr *rrv)
+ {
+-	return rrsig_wirerdata_ex(rrv, 1);
++    return rrsig_wirerdata_ex(rrv, 1);
+ }
+ 
+ struct rr_with_wired
+ {
+-	struct rr *rr;
+-	struct binary_data wired;
++    struct rr *rr;
++    struct binary_data wired;
+ };
+ 
+ static int compare_rr_with_wired(const void *va, const void *vb)
+ {
+-	const struct rr_with_wired *a = va;
+-	const struct rr_with_wired *b = vb;
+-	int r;
+-
+-	if (a->wired.length == b->wired.length) {
+-		return memcmp(a->wired.data, b->wired.data, a->wired.length);
+-	} else if (a->wired.length < b->wired.length) {
+-		r = memcmp(a->wired.data, b->wired.data, a->wired.length);
+-		if (r != 0) return r;
+-		return -1;
+-	} else {
+-		r = memcmp(a->wired.data, b->wired.data, b->wired.length);
+-		if (r != 0) return r;
+-		return 1;
+-	}
++    const struct rr_with_wired *a = va;
++    const struct rr_with_wired *b = vb;
++    int r;
++
++    if (a->wired.length == b->wired.length) {
++        return memcmp(a->wired.data, b->wired.data, a->wired.length);
++    } else if (a->wired.length < b->wired.length) {
++        r = memcmp(a->wired.data, b->wired.data, a->wired.length);
++        if (r != 0) return r;
++        return -1;
++    } else {
++        r = memcmp(a->wired.data, b->wired.data, b->wired.length);
++        if (r != 0) return r;
++        return 1;
++    }
+ }
+ 
+ static struct verification_data *verification_queue = NULL;
+@@ -164,211 +184,219 @@
+ 
+ void *verification_thread(void *dummy)
+ {
+-	struct verification_data *d;
+-	struct timespec sleep_time;
++    struct verification_data *d;
++    struct timespec sleep_time;
+ 
+-	while (1) {
+-		if (pthread_mutex_lock(&queue_lock) != 0)
+-			croak(1, "pthread_mutex_lock");
+-		d = verification_queue;
+-		if (d) {
+-			verification_queue = d->next;
+-			G.stats.signatures_verified++;
+-		}
+-		if (pthread_mutex_unlock(&queue_lock) != 0)
+-			croak(1, "pthread_mutex_unlock");
+-		if (d) {
+-			int r;
+-			d->next = NULL;
++    while (1) {
++        if (pthread_mutex_lock(&queue_lock) != 0)
++            croak(1, "pthread_mutex_lock");
++        d = verification_queue;
++        if (d) {
++            verification_queue = d->next;
++            G.stats.signatures_verified++;
++        }
++        if (pthread_mutex_unlock(&queue_lock) != 0)
++            croak(1, "pthread_mutex_unlock");
++        if (d) {
++            int r;
++            d->next = NULL;
+             r = EVP_VerifyFinal(d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
+-			if (r == 1) {
+-				d->ok = 1;
+-			} else {
+-				d->openssl_error = ERR_peek_last_error();
+-			}
+-			if (pthread_mutex_lock(&queue_lock) != 0)
+-				croak(1, "pthread_mutex_lock");
+-			verification_queue_size--;
+-			if (pthread_mutex_unlock(&queue_lock) != 0)
+-				croak(1, "pthread_mutex_unlock");
+-		} else {
+-			sleep_time.tv_sec  = 0;
+-			sleep_time.tv_nsec = 10000000;
+-			nanosleep(&sleep_time, NULL);
+-		}
+-	}
++            if (r == 1) {
++                d->ok = 1;
++            } else {
++                d->openssl_error = ERR_peek_last_error();
++            }
++            if (pthread_mutex_lock(&queue_lock) != 0)
++                croak(1, "pthread_mutex_lock");
++            verification_queue_size--;
++            if (pthread_mutex_unlock(&queue_lock) != 0)
++                croak(1, "pthread_mutex_unlock");
++        } else {
++            sleep_time.tv_sec  = 0;
++            sleep_time.tv_nsec = 10000000;
++            nanosleep(&sleep_time, NULL);
++        }
++    }
+ }
+ 
+ static void start_workers(void)
+ {
+-	int i;
++    int i;
+ 
+-	if (workers_started)
+-		return;
+-	if (G.opt.verbose)
+-		fprintf(stderr, "starting workers for signature verification\n");
+-	workers = getmem(sizeof(*workers)*G.opt.n_threads);
+-	for (i = 0; i < G.opt.n_threads; i++) {
+-		if (pthread_create(&workers[i], NULL, verification_thread, NULL) != 0)
+-			croak(1, "pthread_create");
+-	}
+-	workers_started = 1;
++    if (workers_started)
++        return;
++    if (G.opt.verbose)
++        fprintf(stderr, "starting workers for signature verification\n");
++    workers = getmem(sizeof(*workers)*G.opt.n_threads);
++    for (i = 0; i < G.opt.n_threads; i++) {
++        if (pthread_create(&workers[i], NULL, verification_thread, NULL) != 0)
++            croak(1, "pthread_create");
++    }
++    workers_started = 1;
+ }
+ 
+ static void schedule_verification(struct verification_data *d)
+ {
+-	int cur_size;
+-	if (G.opt.n_threads > 1) {
+-		if (pthread_mutex_lock(&queue_lock) != 0)
+-			croak(1, "pthread_mutex_lock");
+-		d->next = verification_queue;
+-		verification_queue = d;
+-		verification_queue_size++;
+-		cur_size = verification_queue_size;
+-		if (pthread_mutex_unlock(&queue_lock) != 0)
+-			croak(1, "pthread_mutex_unlock");
+-		if (!workers_started && cur_size >= G.opt.n_threads)
+-			start_workers();
+-	} else {
+-		int r;
+-		G.stats.signatures_verified++;
++    int cur_size;
++    if (G.opt.n_threads > 1) {
++        if (pthread_mutex_lock(&queue_lock) != 0)
++            croak(1, "pthread_mutex_lock");
++        d->next = verification_queue;
++        verification_queue = d;
++        verification_queue_size++;
++        cur_size = verification_queue_size;
++        if (pthread_mutex_unlock(&queue_lock) != 0)
++            croak(1, "pthread_mutex_unlock");
++        if (!workers_started && cur_size >= G.opt.n_threads)
++            start_workers();
++    } else {
++        int r;
++        G.stats.signatures_verified++;
+         r = EVP_VerifyFinal(d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
+-		if (r == 1) {
+-			d->ok = 1;
+-		} else {
+-			d->openssl_error = ERR_peek_last_error();
+-		}
+-	}
++        if (r == 1) {
++            d->ok = 1;
++        } else {
++            d->openssl_error = ERR_peek_last_error();
++        }
++    }
+ }
+ 
+ static int verify_signature(struct verification_data *d, struct rr_set *signed_set)
+ {
+-	uint16_t b2;
+-	uint32_t b4;
+-	struct binary_data chunk;
+-	struct rr_with_wired *set;
+-	struct rr *signed_rr;
+-	int i;
+-
+-	EVP_MD_CTX_init(&d->ctx);
+-	switch (d->rr->algorithm) {
+-	case ALG_DSA:
+-	case ALG_RSASHA1:
+-	case ALG_DSA_NSEC3_SHA1:
+-	case ALG_RSASHA1_NSEC3_SHA1:
+-		if (EVP_VerifyInit(&d->ctx, EVP_sha1()) != 1)
+-			return 0;
+-		break;
+-	case ALG_RSASHA256:
+-		if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1)
+-			return 0;
+-		break;
+-	case ALG_RSASHA512:
+-		if (EVP_VerifyInit(&d->ctx, EVP_sha512()) != 1)
+-			return 0;
+-		break;
+-	default:
+-		return 0;
+-	}
+-
+-	chunk = rrsig_wirerdata_ex(&d->rr->rr, 0);
+-	if (chunk.length < 0)
+-		return 0;
++    uint16_t b2;
++    uint32_t b4;
++    struct binary_data chunk;
++    struct rr_with_wired *set;
++    struct rr *signed_rr;
++    int i;
++
++    d->ctx = EVP_MD_CTX_new();
++    switch (d->rr->algorithm) {
++    case ALG_DSA:
++    case ALG_RSASHA1:
++    case ALG_DSA_NSEC3_SHA1:
++    case ALG_RSASHA1_NSEC3_SHA1:
++        if (EVP_VerifyInit(d->ctx, EVP_sha1()) != 1)
++            return 0;
++        break;
++    case ALG_RSASHA256:
++        if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1)
++            return 0;
++        break;
++    case ALG_RSASHA512:
++        if (EVP_VerifyInit(d->ctx, EVP_sha512()) != 1)
++            return 0;
++        break;
++    case ALG_ECDSAP256SHA256:
++        if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1)
++            return 0;
++        break;
++    case ALG_ECDSAP384SHA384:
++        if (EVP_VerifyInit(d->ctx, EVP_sha384()) != 1)
++            return 0;
++        break;
++    default:
++        return 0;
++    }
++
++    chunk = rrsig_wirerdata_ex(&d->rr->rr, 0);
++    if (chunk.length < 0)
++        return 0;
+     EVP_VerifyUpdate(d->ctx, chunk.data, chunk.length);
+ 
+-	set = getmem_temp(sizeof(*set) * signed_set->count);
++    set = getmem_temp(sizeof(*set) * signed_set->count);
+ 
+-	signed_rr = signed_set->tail;
+-	i = 0;
+-	while (signed_rr) {
+-		set[i].rr = signed_rr;
+-		set[i].wired = call_get_wired(signed_rr);
+-		if (set[i].wired.length < 0)
+-			return 0;
+-		i++;
+-		signed_rr = signed_rr->next;
+-	}
+-	qsort(set, signed_set->count, sizeof(*set), compare_rr_with_wired);
+-
+-	for (i = 0; i < signed_set->count; i++) {
+-		chunk = name2wire_name(signed_set->named_rr->name);
+-		if (chunk.length < 0)
+-			return 0;
++    signed_rr = signed_set->tail;
++    i = 0;
++    while (signed_rr) {
++        set[i].rr = signed_rr;
++        set[i].wired = call_get_wired(signed_rr);
++        if (set[i].wired.length < 0)
++            return 0;
++        i++;
++        signed_rr = signed_rr->next;
++    }
++    qsort(set, signed_set->count, sizeof(*set), compare_rr_with_wired);
++
++    for (i = 0; i < signed_set->count; i++) {
++        chunk = name2wire_name(signed_set->named_rr->name);
++        if (chunk.length < 0)
++            return 0;
+         EVP_VerifyUpdate(d->ctx, chunk.data, chunk.length);
+         b2 = htons(set[i].rr->rdtype);    EVP_VerifyUpdate(d->ctx, &b2, 2);
+         b2 = htons(1);  /* class IN */   EVP_VerifyUpdate(d->ctx, &b2, 2);
+         b4 = htonl(set[i].rr->ttl);       EVP_VerifyUpdate(d->ctx, &b4, 4);
+         b2 = htons(set[i].wired.length); EVP_VerifyUpdate(d->ctx, &b2, 2);
+         EVP_VerifyUpdate(d->ctx, set[i].wired.data, set[i].wired.length);
+-	}
++    }
+ 
+-	schedule_verification(d);
+-	return 1;
++    schedule_verification(d);
++    return 1;
+ }
+ 
+ static void *rrsig_validate(struct rr *rrv)
+ {
+-	RRCAST(rrsig);
+-	struct named_rr *named_rr;
+-	struct rr_set *signed_set;
+-	struct rr_dnskey *key = NULL;
+-	struct rr_set *dnskey_rr_set;
+-	int candidate_keys = 0;
+-	struct keys_to_verify *candidates;
+-	int i = 0;
+-	int t;
+-
+-	named_rr = rr->rr.rr_set->named_rr;
+-	for (t = 0; t < G.opt.n_times_to_check; t++) {
+-		if (G.opt.times_to_check[t] < rr->sig_inception) {
+-			return moan(rr->rr.file_name, rr->rr.line, "%s signature is too new", named_rr->name);
+-		}
+-		if (G.opt.times_to_check[t] > rr->sig_expiration) {
+-			return moan(rr->rr.file_name, rr->rr.line, "%s signature is too old", named_rr->name);
+-		}
+-	}
+-	signed_set = find_rr_set_in_named_rr(named_rr, rr->type_covered);
+-	if (!signed_set) {
+-		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG exists for non-existing type %s", named_rr->name, rdtype2str(rr->type_covered));
+-	}
+-	if (signed_set->tail->ttl != rr->orig_ttl) {
+-		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG's original TTL differs from corresponding record's", named_rr->name);
+-	}
+-	dnskey_rr_set = find_rr_set(T_DNSKEY, rr->signer);
+-	if (!dnskey_rr_set) {
+-		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find a signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer);
+-	}
+-	key = (struct rr_dnskey *)dnskey_rr_set->tail;
+-	while (key) {
+-		if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) {
+-			candidate_keys++;
+-			dnskey_build_pkey(key);
+-		}
+-		key = (struct rr_dnskey *)key->rr.next;
+-	}
+-	if (candidate_keys == 0)
+-		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find the right signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer);
+-
+-	candidates = getmem(sizeof(struct keys_to_verify) + (candidate_keys-1) * sizeof(struct verification_data));
+-	candidates->next = all_keys_to_verify;
+-	candidates->rr = rr;
+-	candidates->signed_set = signed_set;
+-	candidates->n_keys = candidate_keys;
+-	all_keys_to_verify = candidates;
+-	key = (struct rr_dnskey *)dnskey_rr_set->tail;
+-	while (key) {
+-		if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) {
+-			candidates->to_verify[i].key = key;
+-			candidates->to_verify[i].rr = rr;
+-			candidates->to_verify[i].ok = 0;
+-			candidates->to_verify[i].openssl_error = 0;
+-			candidates->to_verify[i].next = NULL;
+-			i++;
+-		}
+-		key = (struct rr_dnskey *)key->rr.next;
+-	}
++    RRCAST(rrsig);
++    struct named_rr *named_rr;
++    struct rr_set *signed_set;
++    struct rr_dnskey *key = NULL;
++    struct rr_set *dnskey_rr_set;
++    int candidate_keys = 0;
++    struct keys_to_verify *candidates;
++    int i = 0;
++    int t;
++
++    named_rr = rr->rr.rr_set->named_rr;
++    for (t = 0; t < G.opt.n_times_to_check; t++) {
++        if (G.opt.times_to_check[t] < rr->sig_inception) {
++            return moan(rr->rr.file_name, rr->rr.line, "%s signature is too new", named_rr->name);
++        }
++        if (G.opt.times_to_check[t] > rr->sig_expiration) {
++            return moan(rr->rr.file_name, rr->rr.line, "%s signature is too old", named_rr->name);
++        }
++    }
++    signed_set = find_rr_set_in_named_rr(named_rr, rr->type_covered);
++    if (!signed_set) {
++        return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG exists for non-existing type %s", named_rr->name, rdtype2str(rr->type_covered));
++    }
++    if (signed_set->tail->ttl != rr->orig_ttl) {
++        return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG's original TTL differs from corresponding record's", named_rr->name);
++    }
++    dnskey_rr_set = find_rr_set(T_DNSKEY, rr->signer);
++    if (!dnskey_rr_set) {
++        return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find a signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer);
++    }
++    key = (struct rr_dnskey *)dnskey_rr_set->tail;
++    while (key) {
++        if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) {
++            candidate_keys++;
++            dnskey_build_pkey(key);
++        }
++        key = (struct rr_dnskey *)key->rr.next;
++    }
++    if (candidate_keys == 0)
++        return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find the right signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer);
++
++    candidates = getmem(sizeof(struct keys_to_verify) + (candidate_keys-1) * sizeof(struct verification_data));
++    candidates->next = all_keys_to_verify;
++    candidates->rr = rr;
++    candidates->signed_set = signed_set;
++    candidates->n_keys = candidate_keys;
++    all_keys_to_verify = candidates;
++    key = (struct rr_dnskey *)dnskey_rr_set->tail;
++    while (key) {
++        if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) {
++            candidates->to_verify[i].key = key;
++            candidates->to_verify[i].rr = rr;
++            candidates->to_verify[i].ok = 0;
++            candidates->to_verify[i].openssl_error = 0;
++            candidates->to_verify[i].next = NULL;
++            i++;
++        }
++        key = (struct rr_dnskey *)key->rr.next;
++    }
+ 
+-	return rr;
++    return rr;
+ }
+ 
+ static pthread_mutex_t *lock_cs;
+@@ -376,81 +404,87 @@
+ 
+ unsigned long pthreads_thread_id(void)
+ {
+-	unsigned long ret;
++    unsigned long ret;
+ 
+-	ret=(unsigned long)pthread_self();
+-	return(ret);
++    ret=(unsigned long)pthread_self();
++    return(ret);
+ }
+ 
+ void pthreads_locking_callback(int mode, int type, char *file, int line)
+ {
+-	if (mode & CRYPTO_LOCK) {
+-		pthread_mutex_lock(&(lock_cs[type]));
+-		lock_count[type]++;
+-	} else {
+-		pthread_mutex_unlock(&(lock_cs[type]));
+-	}
++    if (mode & CRYPTO_LOCK) {
++        pthread_mutex_lock(&(lock_cs[type]));
++        lock_count[type]++;
++    } else {
++        pthread_mutex_unlock(&(lock_cs[type]));
++    }
+ }
+ 
+ void verify_all_keys(void)
+ {
+-	struct keys_to_verify *k = all_keys_to_verify;
+-	int i;
+-	struct timespec sleep_time;
+-
+-	ERR_load_crypto_strings();
+-	if (G.opt.n_threads > 1) {
+-		lock_cs = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
+-		lock_count = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long));
+-		for (i = 0; i < CRYPTO_num_locks(); i++) {
+-			lock_count[i] = 0;
+-			pthread_mutex_init(&lock_cs[i],NULL);
+-		}
+-
+-		CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id);
+-		CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback);
+-
+-		if (pthread_mutex_init(&queue_lock, NULL) != 0)
+-			croak(1, "pthread_mutex_init");
+-	}
+-
+-	while (k) {
+-		freeall_temp();
+-		for (i = 0; i < k->n_keys; i++) {
+-			if (dnskey_build_pkey(k->to_verify[i].key))
+-				verify_signature(&k->to_verify[i], k->signed_set);
+-		}
+-		k = k->next;
+-	}
+-	start_workers(); /* this is needed in case n_threads is greater than the number of signatures to verify */
+-	while (verification_queue_size > 0) {
+-		sleep_time.tv_sec  = 0;
+-		sleep_time.tv_nsec = 10000000;
+-		nanosleep(&sleep_time, NULL);
+-	}
+-	k = all_keys_to_verify;
+-	while (k) {
+-		int ok = 0;
+-		unsigned long e = 0;
+-		for (i = 0; i < k->n_keys; i++) {
+-			if (k->to_verify[i].ok) {
+-				ok = 1;
+-				break;
+-			} else {
+-				if (k->to_verify[i].openssl_error != 0)
+-					e = k->to_verify[i].openssl_error;
+-			}
++    struct keys_to_verify *k = all_keys_to_verify;
++    int i;
++    struct timespec sleep_time;
++
++    ERR_load_crypto_strings();
++    if (G.opt.n_threads > 1) {
++        lock_cs = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
++        lock_count = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long));
++        for (i = 0; i < CRYPTO_num_locks(); i++) {
++            lock_count[i] = 0;
++            pthread_mutex_init(&lock_cs[i],NULL);
++        }
++
++        CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id);
++        CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback);
++
++        if (pthread_mutex_init(&queue_lock, NULL) != 0)
++            croak(1, "pthread_mutex_init");
++    }
++
++    while (k) {
++        freeall_temp();
++        for (i = 0; i < k->n_keys; i++) {
++            if (dnskey_build_pkey(k->to_verify[i].key))
++                verify_signature(&k->to_verify[i], k->signed_set);
++        }
++        k = k->next;
++    }
++    start_workers(); /* this is needed in case n_threads is greater than the number of signatures to verify */
++    while (verification_queue_size > 0) {
++        sleep_time.tv_sec  = 0;
++        sleep_time.tv_nsec = 10000000;
++        nanosleep(&sleep_time, NULL);
++    }
++    k = all_keys_to_verify;
++    while (k) {
++        int ok = 0;
++        unsigned long e = 0;
++        for (i = 0; i < k->n_keys; i++) {
++            if (k->to_verify[i].ok) {
++                if (k->to_verify[i].rr->rr.rr_set->named_rr->flags & NAME_FLAG_APEX) {
++                    if (k->to_verify[i].key->key_type == KEY_TYPE_UNUSED)
++                        k->to_verify[i].key->key_type = KEY_TYPE_KSK;
++                } else {
++                    k->to_verify[i].key->key_type = KEY_TYPE_ZSK;
++                }
++                ok = 1;
++                break;
++            } else {
++                if (k->to_verify[i].openssl_error != 0)
++                    e = k->to_verify[i].openssl_error;
++            }
+             EVP_MD_CTX_free(k->to_verify[i].ctx);
+-		}
+-		if (!ok) {
+-			struct named_rr *named_rr;
+-			named_rr = k->rr->rr.rr_set->named_rr;
+-			moan(k->rr->rr.file_name, k->rr->rr.line, "%s RRSIG(%s): %s",
+-				 named_rr->name, rdtype2str(k->rr->type_covered),
+-				 e ? ERR_reason_error_string(e) : "cannot verify signature, reason unknown");
+-		}
+-		k = k->next;
+-	}
++        }
++        if (!ok) {
++            struct named_rr *named_rr;
++            named_rr = k->rr->rr.rr_set->named_rr;
++            moan(k->rr->rr.file_name, k->rr->rr.line, "%s RRSIG(%s): %s",
++                 named_rr->name, rdtype2str(k->rr->type_covered),
++                 e ? ERR_reason_error_string(e) : "cannot verify signature, reason unknown");
++        }
++        k = k->next;
++    }
+ }
+ 
+ struct rr_methods rrsig_methods = { rrsig_parse, rrsig_human, rrsig_wirerdata, NULL, rrsig_validate };
+diff -Naur validns-0.8/rrsig.c.orig validns/rrsig.c.orig
+--- validns-0.8/rrsig.c.orig	2014-02-11 15:45:39.000000000 -0500
++++ validns/rrsig.c.orig	1969-12-31 19:00:00.000000000 -0500
+@@ -1,455 +0,0 @@
+-/*
+- * Part of DNS zone file validator `validns`.
+- *
+- * Copyright 2011-2014 Anton Berezin <tobez@tobez.org>
+- * Modified BSD license.
+- * (See LICENSE file in the distribution.)
+- *
+- */
+-#include <sys/types.h>
+-#include <string.h>
+-#include <stdlib.h>
+-#include <stdio.h>
+-#include <time.h>
+-#include <pthread.h>
+-#include <netinet/in.h>
+-#include <arpa/inet.h>
+-#include <openssl/evp.h>
+-#include <openssl/err.h>
+-
+-#include "common.h"
+-#include "textparse.h"
+-#include "mempool.h"
+-#include "carp.h"
+-#include "rr.h"
+-
+-struct verification_data
+-{
+-	struct verification_data *next;
+-	EVP_MD_CTX ctx;
+-	struct rr_dnskey *key;
+-	struct rr_rrsig *rr;
+-	int ok;
+-	unsigned long openssl_error;
+-};
+-
+-struct keys_to_verify
+-{
+-	struct keys_to_verify *next;
+-	struct rr_rrsig *rr;
+-	struct rr_set *signed_set;
+-	int n_keys;
+-	struct verification_data to_verify[1];
+-};
+-
+-static struct keys_to_verify *all_keys_to_verify = NULL;
+-
+-static struct rr* rrsig_parse(char *name, long ttl, int type, char *s)
+-{
+-	struct rr_rrsig *rr = getmem(sizeof(*rr));
+-	int type_covered, key_tag;
+-	char *str_type_covered;
+-	struct binary_data sig;
+-	long long ts;
+-
+-	str_type_covered = extract_label(&s, "type covered", "temporary");
+-	if (!str_type_covered) return NULL;
+-	type_covered = str2rdtype(str_type_covered, NULL);
+-	if (type_covered <= 0 || type_covered > 65535) return NULL;
+-	rr->type_covered = type_covered;
+-
+-	rr->algorithm = extract_algorithm(&s, "algorithm");
+-	if (rr->algorithm == ALG_UNSUPPORTED)	return NULL;
+-	if (rr->algorithm == ALG_PRIVATEDNS || rr->algorithm == ALG_PRIVATEOID) {
+-		return bitch("private algorithms are not supported in RRSIG");
+-	}
+-
+-	rr->labels = extract_integer(&s, "labels");
+-	if (rr->labels < 0)	return NULL;
+-	/* TODO validate labels, see http://tools.ietf.org/html/rfc4034#section-3.1.3 */
+-
+-	rr->orig_ttl = extract_timevalue(&s, "original TTL");
+-	if (rr->orig_ttl < 0) return NULL;
+-
+-	ts = extract_timestamp(&s, "signature expiration");
+-	if (ts < 0) return NULL;
+-	rr->sig_expiration = ts;
+-
+-	ts = extract_timestamp(&s, "signature inception");
+-	if (ts < 0) return NULL;
+-	rr->sig_inception = ts;
+-
+-	key_tag = extract_integer(&s, "key tag");
+-	if (key_tag < 0)	return NULL;
+-	rr->key_tag = key_tag;
+-
+-	rr->signer = extract_name(&s, "signer name", 0);
+-	if (!rr->signer) return NULL;
+-	/* TODO validate signer name, http://tools.ietf.org/html/rfc4034#section-3.1.7 */
+-
+-	sig = extract_base64_binary_data(&s, "signature");
+-	if (sig.length < 0)	return NULL;
+-	/* TODO validate signature length based on algorithm */
+-	rr->signature = sig;
+-
+-	if (*s) {
+-		return bitch("garbage after valid RRSIG data");
+-	}
+-	G.dnssec_active = 1;
+-	return store_record(type, name, ttl, rr);
+-}
+-
+-static char* rrsig_human(struct rr *rrv)
+-{
+-	// RRCAST(rrsig);
+-    // char s[1024];
+-
+-    //snprintf(s, 1024, "SOA %s %s %d %d %d %d %d",
+-	 //    rr->mname, rr->rname, rr->serial,
+-	  //   rr->refresh, rr->retry, rr->expire, rr->minimum);
+-    //return quickstrdup_temp(s);
+-	return NULL;
+-}
+-
+-static struct binary_data rrsig_wirerdata_ex(struct rr *rrv, int with_signature)
+-{
+-	RRCAST(rrsig);
+-	struct binary_data bd;
+-
+-	bd = compose_binary_data("2114442d", 1,
+-		rr->type_covered, rr->algorithm, rr->labels,
+-		rr->orig_ttl, rr->sig_expiration, rr->sig_inception,
+-		rr->key_tag, name2wire_name(rr->signer));
+-	if (with_signature) {
+-		return compose_binary_data("dd", 1, bd, rr->signature);
+-	}
+-	return bd;
+-}
+-
+-static struct binary_data rrsig_wirerdata(struct rr *rrv)
+-{
+-	return rrsig_wirerdata_ex(rrv, 1);
+-}
+-
+-struct rr_with_wired
+-{
+-	struct rr *rr;
+-	struct binary_data wired;
+-};
+-
+-static int compare_rr_with_wired(const void *va, const void *vb)
+-{
+-	const struct rr_with_wired *a = va;
+-	const struct rr_with_wired *b = vb;
+-	int r;
+-
+-	if (a->wired.length == b->wired.length) {
+-		return memcmp(a->wired.data, b->wired.data, a->wired.length);
+-	} else if (a->wired.length < b->wired.length) {
+-		r = memcmp(a->wired.data, b->wired.data, a->wired.length);
+-		if (r != 0) return r;
+-		return -1;
+-	} else {
+-		r = memcmp(a->wired.data, b->wired.data, b->wired.length);
+-		if (r != 0) return r;
+-		return 1;
+-	}
+-}
+-
+-static struct verification_data *verification_queue = NULL;
+-static int verification_queue_size = 0;
+-static pthread_mutex_t queue_lock;
+-static int workers_started = 0;
+-static pthread_t *workers;
+-
+-void *verification_thread(void *dummy)
+-{
+-	struct verification_data *d;
+-	struct timespec sleep_time;
+-
+-	while (1) {
+-		if (pthread_mutex_lock(&queue_lock) != 0)
+-			croak(1, "pthread_mutex_lock");
+-		d = verification_queue;
+-		if (d) {
+-			verification_queue = d->next;
+-			G.stats.signatures_verified++;
+-		}
+-		if (pthread_mutex_unlock(&queue_lock) != 0)
+-			croak(1, "pthread_mutex_unlock");
+-		if (d) {
+-			int r;
+-			d->next = NULL;
+-			r = EVP_VerifyFinal(&d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
+-			if (r == 1) {
+-				d->ok = 1;
+-			} else {
+-				d->openssl_error = ERR_peek_last_error();
+-			}
+-			if (pthread_mutex_lock(&queue_lock) != 0)
+-				croak(1, "pthread_mutex_lock");
+-			verification_queue_size--;
+-			if (pthread_mutex_unlock(&queue_lock) != 0)
+-				croak(1, "pthread_mutex_unlock");
+-		} else {
+-			sleep_time.tv_sec  = 0;
+-			sleep_time.tv_nsec = 10000000;
+-			nanosleep(&sleep_time, NULL);
+-		}
+-	}
+-}
+-
+-static void start_workers(void)
+-{
+-	int i;
+-
+-	if (workers_started)
+-		return;
+-	if (G.opt.verbose)
+-		fprintf(stderr, "starting workers for signature verification\n");
+-	workers = getmem(sizeof(*workers)*G.opt.n_threads);
+-	for (i = 0; i < G.opt.n_threads; i++) {
+-		if (pthread_create(&workers[i], NULL, verification_thread, NULL) != 0)
+-			croak(1, "pthread_create");
+-	}
+-	workers_started = 1;
+-}
+-
+-static void schedule_verification(struct verification_data *d)
+-{
+-	int cur_size;
+-	if (G.opt.n_threads > 1) {
+-		if (pthread_mutex_lock(&queue_lock) != 0)
+-			croak(1, "pthread_mutex_lock");
+-		d->next = verification_queue;
+-		verification_queue = d;
+-		verification_queue_size++;
+-		cur_size = verification_queue_size;
+-		if (pthread_mutex_unlock(&queue_lock) != 0)
+-			croak(1, "pthread_mutex_unlock");
+-		if (!workers_started && cur_size >= G.opt.n_threads)
+-			start_workers();
+-	} else {
+-		int r;
+-		G.stats.signatures_verified++;
+-		r = EVP_VerifyFinal(&d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
+-		if (r == 1) {
+-			d->ok = 1;
+-		} else {
+-			d->openssl_error = ERR_peek_last_error();
+-		}
+-	}
+-}
+-
+-static int verify_signature(struct verification_data *d, struct rr_set *signed_set)
+-{
+-	uint16_t b2;
+-	uint32_t b4;
+-	struct binary_data chunk;
+-	struct rr_with_wired *set;
+-	struct rr *signed_rr;
+-	int i;
+-
+-	EVP_MD_CTX_init(&d->ctx);
+-	switch (d->rr->algorithm) {
+-	case ALG_DSA:
+-	case ALG_RSASHA1:
+-	case ALG_DSA_NSEC3_SHA1:
+-	case ALG_RSASHA1_NSEC3_SHA1:
+-		if (EVP_VerifyInit(&d->ctx, EVP_sha1()) != 1)
+-			return 0;
+-		break;
+-	case ALG_RSASHA256:
+-		if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1)
+-			return 0;
+-		break;
+-	case ALG_RSASHA512:
+-		if (EVP_VerifyInit(&d->ctx, EVP_sha512()) != 1)
+-			return 0;
+-		break;
+-	default:
+-		return 0;
+-	}
+-
+-	chunk = rrsig_wirerdata_ex(&d->rr->rr, 0);
+-	if (chunk.length < 0)
+-		return 0;
+-	EVP_VerifyUpdate(&d->ctx, chunk.data, chunk.length);
+-
+-	set = getmem_temp(sizeof(*set) * signed_set->count);
+-
+-	signed_rr = signed_set->tail;
+-	i = 0;
+-	while (signed_rr) {
+-		set[i].rr = signed_rr;
+-		set[i].wired = call_get_wired(signed_rr);
+-		if (set[i].wired.length < 0)
+-			return 0;
+-		i++;
+-		signed_rr = signed_rr->next;
+-	}
+-	qsort(set, signed_set->count, sizeof(*set), compare_rr_with_wired);
+-
+-	for (i = 0; i < signed_set->count; i++) {
+-		chunk = name2wire_name(signed_set->named_rr->name);
+-		if (chunk.length < 0)
+-			return 0;
+-		EVP_VerifyUpdate(&d->ctx, chunk.data, chunk.length);
+-		b2 = htons(set[i].rr->rdtype);    EVP_VerifyUpdate(&d->ctx, &b2, 2);
+-		b2 = htons(1);  /* class IN */   EVP_VerifyUpdate(&d->ctx, &b2, 2);
+-		b4 = htonl(set[i].rr->ttl);       EVP_VerifyUpdate(&d->ctx, &b4, 4);
+-		b2 = htons(set[i].wired.length); EVP_VerifyUpdate(&d->ctx, &b2, 2);
+-		EVP_VerifyUpdate(&d->ctx, set[i].wired.data, set[i].wired.length);
+-	}
+-
+-	schedule_verification(d);
+-	return 1;
+-}
+-
+-static void *rrsig_validate(struct rr *rrv)
+-{
+-	RRCAST(rrsig);
+-	struct named_rr *named_rr;
+-	struct rr_set *signed_set;
+-	struct rr_dnskey *key = NULL;
+-	struct rr_set *dnskey_rr_set;
+-	int candidate_keys = 0;
+-	struct keys_to_verify *candidates;
+-	int i = 0;
+-	int t;
+-
+-	named_rr = rr->rr.rr_set->named_rr;
+-	for (t = 0; t < G.opt.n_times_to_check; t++) {
+-		if (G.opt.times_to_check[t] < rr->sig_inception) {
+-			return moan(rr->rr.file_name, rr->rr.line, "%s signature is too new", named_rr->name);
+-		}
+-		if (G.opt.times_to_check[t] > rr->sig_expiration) {
+-			return moan(rr->rr.file_name, rr->rr.line, "%s signature is too old", named_rr->name);
+-		}
+-	}
+-	signed_set = find_rr_set_in_named_rr(named_rr, rr->type_covered);
+-	if (!signed_set) {
+-		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG exists for non-existing type %s", named_rr->name, rdtype2str(rr->type_covered));
+-	}
+-	if (signed_set->tail->ttl != rr->orig_ttl) {
+-		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG's original TTL differs from corresponding record's", named_rr->name);
+-	}
+-	dnskey_rr_set = find_rr_set(T_DNSKEY, rr->signer);
+-	if (!dnskey_rr_set) {
+-		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find a signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer);
+-	}
+-	key = (struct rr_dnskey *)dnskey_rr_set->tail;
+-	while (key) {
+-		if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) {
+-			candidate_keys++;
+-			dnskey_build_pkey(key);
+-		}
+-		key = (struct rr_dnskey *)key->rr.next;
+-	}
+-	if (candidate_keys == 0)
+-		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find the right signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer);
+-
+-	candidates = getmem(sizeof(struct keys_to_verify) + (candidate_keys-1) * sizeof(struct verification_data));
+-	candidates->next = all_keys_to_verify;
+-	candidates->rr = rr;
+-	candidates->signed_set = signed_set;
+-	candidates->n_keys = candidate_keys;
+-	all_keys_to_verify = candidates;
+-	key = (struct rr_dnskey *)dnskey_rr_set->tail;
+-	while (key) {
+-		if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) {
+-			candidates->to_verify[i].key = key;
+-			candidates->to_verify[i].rr = rr;
+-			candidates->to_verify[i].ok = 0;
+-			candidates->to_verify[i].openssl_error = 0;
+-			candidates->to_verify[i].next = NULL;
+-			i++;
+-		}
+-		key = (struct rr_dnskey *)key->rr.next;
+-	}
+-
+-	return rr;
+-}
+-
+-static pthread_mutex_t *lock_cs;
+-static long *lock_count;
+-
+-static unsigned long pthreads_thread_id(void)
+-{
+-	unsigned long ret;
+-
+-	ret=(unsigned long)pthread_self();
+-	return(ret);
+-}
+-
+-static void pthreads_locking_callback(int mode, int type, char *file, int line)
+-{
+-	if (mode & CRYPTO_LOCK) {
+-		pthread_mutex_lock(&(lock_cs[type]));
+-		lock_count[type]++;
+-	} else {
+-		pthread_mutex_unlock(&(lock_cs[type]));
+-	}
+-}
+-
+-void verify_all_keys(void)
+-{
+-	struct keys_to_verify *k = all_keys_to_verify;
+-	int i;
+-	struct timespec sleep_time;
+-
+-	ERR_load_crypto_strings();
+-	if (G.opt.n_threads > 1) {
+-		lock_cs = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
+-		lock_count = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long));
+-		for (i = 0; i < CRYPTO_num_locks(); i++) {
+-			lock_count[i] = 0;
+-			pthread_mutex_init(&lock_cs[i],NULL);
+-		}
+-
+-		CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id);
+-		CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback);
+-
+-		if (pthread_mutex_init(&queue_lock, NULL) != 0)
+-			croak(1, "pthread_mutex_init");
+-	}
+-
+-	while (k) {
+-		freeall_temp();
+-		for (i = 0; i < k->n_keys; i++) {
+-			if (dnskey_build_pkey(k->to_verify[i].key))
+-				verify_signature(&k->to_verify[i], k->signed_set);
+-		}
+-		k = k->next;
+-	}
+-	start_workers(); /* this is needed in case n_threads is greater than the number of signatures to verify */
+-	while (verification_queue_size > 0) {
+-		sleep_time.tv_sec  = 0;
+-		sleep_time.tv_nsec = 10000000;
+-		nanosleep(&sleep_time, NULL);
+-	}
+-	k = all_keys_to_verify;
+-	while (k) {
+-		int ok = 0;
+-		unsigned long e = 0;
+-		for (i = 0; i < k->n_keys; i++) {
+-			if (k->to_verify[i].ok) {
+-				ok = 1;
+-				break;
+-			} else {
+-				if (k->to_verify[i].openssl_error != 0)
+-					e = k->to_verify[i].openssl_error;
+-			}
+-		}
+-		if (!ok) {
+-			struct named_rr *named_rr;
+-			named_rr = k->rr->rr.rr_set->named_rr;
+-			moan(k->rr->rr.file_name, k->rr->rr.line, "%s RRSIG(%s): %s",
+-				 named_rr->name, rdtype2str(k->rr->type_covered),
+-				 e ? ERR_reason_error_string(e) : "cannot verify signature, reason unknown");
+-		}
+-		k = k->next;
+-	}
+-}
+-
+-struct rr_methods rrsig_methods = { rrsig_parse, rrsig_human, rrsig_wirerdata, NULL, rrsig_validate };
+diff -Naur validns-0.8/rrsig.c.rej validns/rrsig.c.rej
+--- validns-0.8/rrsig.c.rej	2020-10-05 16:57:07.219376944 -0400
++++ validns/rrsig.c.rej	1969-12-31 19:00:00.000000000 -0500
+@@ -1,54 +0,0 @@
+---- rrsig.c
+-+++ rrsig.c
+-@@ -97,10 +97,13 @@ static struct rr* rrsig_parse(char *name, long ttl, int type, char *s)
+-          * representation (r || s) into OpenSSL ASN.1 DER format
+-          */
+-         ECDSA_SIG *ecdsa_sig = ECDSA_SIG_new();
+-+	BIGNUM *r, *s;
+-         int l = sig.length / 2;
+--        if ((BN_bin2bn((unsigned char *)sig.data, l, ecdsa_sig->r) == NULL) ||
+--            (BN_bin2bn(((unsigned char *)sig.data) + l, l, ecdsa_sig->s) == NULL))
+-+	r = BN_bin2bn((unsigned char *)sig.data, l, NULL);
+-+	s = BN_bin2bn((unsigned char *)sig.data + l, l, NULL);
+-+	if ((r == NULL) || (s == NULL))
+-             return NULL;
+-+	ECDSA_SIG_set0(ecdsa_sig, r, s);
+-         sig.length = i2d_ECDSA_SIG(ecdsa_sig, NULL);
+-         sig.data = getmem(sig.length); /* reallocate larger mempool chunk */
+-         unsigned char *sig_ptr = (unsigned char *)sig.data;
+-@@ -267,29 +270,29 @@ static int verify_signature(struct verification_data *d, struct rr_set *signed_s
+-     struct rr *signed_rr;
+-     int i;
+- 
+--    EVP_MD_CTX_init(&d->ctx);
+-+    d->ctx = EVP_MD_CTX_new();
+-     switch (d->rr->algorithm) {
+-     case ALG_DSA:
+-     case ALG_RSASHA1:
+-     case ALG_DSA_NSEC3_SHA1:
+-     case ALG_RSASHA1_NSEC3_SHA1:
+--        if (EVP_VerifyInit(&d->ctx, EVP_sha1()) != 1)
+-+        if (EVP_VerifyInit(d->ctx, EVP_sha1()) != 1)
+-             return 0;
+-         break;
+-     case ALG_RSASHA256:
+--        if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1)
+-+        if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1)
+-             return 0;
+-         break;
+-     case ALG_RSASHA512:
+--        if (EVP_VerifyInit(&d->ctx, EVP_sha512()) != 1)
+-+        if (EVP_VerifyInit(d->ctx, EVP_sha512()) != 1)
+-             return 0;
+-         break;
+-     case ALG_ECDSAP256SHA256:
+--        if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1)
+-+        if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1)
+-             return 0;
+-         break;
+-     case ALG_ECDSAP384SHA384:
+--        if (EVP_VerifyInit(&d->ctx, EVP_sha384()) != 1)
+-+        if (EVP_VerifyInit(d->ctx, EVP_sha384()) != 1)
+-             return 0;
+-         break;
+-     default:
+diff -Naur validns-0.8/rt.c validns/rt.c
+--- validns-0.8/rt.c	2014-02-11 15:46:53.000000000 -0500
++++ validns/rt.c	2020-10-05 16:59:29.356681378 -0400
+@@ -19,38 +19,38 @@
+ 
+ static struct rr *rt_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_rt *rr = getmem(sizeof(*rr));
++    struct rr_rt *rr = getmem(sizeof(*rr));
+ 
+-	rr->preference = extract_integer(&s, "RT preference");
+-	if (rr->preference < 0)
+-		return NULL;
+-
+-	rr->intermediate_host = extract_name(&s, "intermediate-host", 0);
+-	if (!rr->intermediate_host)
+-		return NULL;
+-	if (*s) {
+-		return bitch("garbage after valid RT data");
+-	}
++    rr->preference = extract_integer(&s, "RT preference", NULL);
++    if (rr->preference < 0)
++        return NULL;
++
++    rr->intermediate_host = extract_name(&s, "intermediate-host", 0);
++    if (!rr->intermediate_host)
++        return NULL;
++    if (*s) {
++        return bitch("garbage after valid RT data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* rt_human(struct rr *rrv)
+ {
+-	RRCAST(rt);
++    RRCAST(rt);
+     char s[1024];
+ 
+     snprintf(s, 1024, "%d %s",
+-	     rr->preference, rr->intermediate_host);
++         rr->preference, rr->intermediate_host);
+     return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data rt_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(rt);
++    RRCAST(rt);
+ 
+     return compose_binary_data("2d", 1,
+-		rr->preference, name2wire_name(rr->intermediate_host));
++        rr->preference, name2wire_name(rr->intermediate_host));
+ }
+ 
+ struct rr_methods rt_methods = { rt_parse, rt_human, rt_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/soa.c validns/soa.c
+--- validns-0.8/soa.c	2014-02-11 15:45:26.000000000 -0500
++++ validns/soa.c	2020-10-05 16:59:29.356681378 -0400
+@@ -20,61 +20,64 @@
+ 
+ static struct rr* soa_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_soa *rr = getmem(sizeof(*rr));
+-	long long i;
++    struct rr_soa *rr = getmem(sizeof(*rr));
++    long long i;
+ 
+-	rr->mname = extract_name(&s, "mname", 0);
+-	if (!rr->mname) return NULL;
+-	rr->rname = extract_name(&s, "rname", 0);
+-	if (!rr->rname) return NULL;
+-	i = extract_integer(&s, "serial");
+-	if (i < 0) return NULL;
+-	if (i > 4294967295UL) return bitch("serial is out of range");
+-	rr->serial = i;
+-	rr->refresh = extract_timevalue(&s, "refresh");
+-	if (rr->refresh < 0) return NULL;
+-	rr->retry = extract_timevalue(&s, "retry");
+-	if (rr->retry < 0) return NULL;
+-	rr->expire = extract_timevalue(&s, "expire");
+-	if (rr->expire < 0) return NULL;
+-	rr->minimum = extract_timevalue(&s, "minimum");
+-	if (rr->minimum < 0) return NULL;
+-	if (*s) {
+-		return bitch("garbage after valid SOA data");
+-	}
+-	return store_record(type, name, ttl, rr);
++    rr->mname = extract_name(&s, "mname", 0);
++    if (!rr->mname) return NULL;
++    rr->rname = extract_name(&s, "rname", 0);
++    if (!rr->rname) return NULL;
++    i = extract_integer(&s, "serial", NULL);
++    if (i < 0) return NULL;
++    if (i > 4294967295UL) return bitch("serial is out of range");
++    rr->serial = i;
++    rr->refresh = extract_timevalue(&s, "refresh");
++    if (rr->refresh < 0) return NULL;
++    rr->retry = extract_timevalue(&s, "retry");
++    if (rr->retry < 0) return NULL;
++    rr->expire = extract_timevalue(&s, "expire");
++    if (rr->expire < 0) return NULL;
++    rr->minimum = extract_timevalue(&s, "minimum");
++    if (rr->minimum < 0) return NULL;
++    if (ttl < 0 && G.opt.soa_minttl_as_default_ttl) {
++        ttl = rr->minimum;
++    }
++    if (*s) {
++        return bitch("garbage after valid SOA data");
++    }
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* soa_human(struct rr *rrv)
+ {
+-	RRCAST(soa);
++    RRCAST(soa);
+     char s[1024];
+ 
+     snprintf(s, 1024, "%s %s %u %d %d %d %d",
+-	     rr->mname, rr->rname, rr->serial,
+-	     rr->refresh, rr->retry, rr->expire, rr->minimum);
++         rr->mname, rr->rname, rr->serial,
++         rr->refresh, rr->retry, rr->expire, rr->minimum);
+     return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data soa_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(soa);
++    RRCAST(soa);
+ 
+-	return compose_binary_data("dd44444", 1,
+-		name2wire_name(rr->mname), name2wire_name(rr->rname),
+-		rr->serial, rr->refresh, rr->retry,
+-		rr->expire, rr->minimum);
++    return compose_binary_data("dd44444", 1,
++        name2wire_name(rr->mname), name2wire_name(rr->rname),
++        rr->serial, rr->refresh, rr->retry,
++        rr->expire, rr->minimum);
+ }
+ 
+ static void *soa_validate(struct rr *rrv)
+ {
+-	RRCAST(soa);
++    RRCAST(soa);
+ 
+-	if (strchr(rr->mname, '/') != NULL)
+-		return moan(rr->rr.file_name, rr->rr.line, "MNAME contains '/'");
+-	if (strchr(rr->rname, '/') != NULL)
+-		return moan(rr->rr.file_name, rr->rr.line, "RNAME contains '/'");
+-	return NULL;
++    if (strchr(rr->mname, '/') != NULL)
++        return moan(rr->rr.file_name, rr->rr.line, "MNAME contains '/'");
++    if (strchr(rr->rname, '/') != NULL)
++        return moan(rr->rr.file_name, rr->rr.line, "RNAME contains '/'");
++    return NULL;
+ }
+ 
+ struct rr_methods soa_methods = { soa_parse, soa_human, soa_wirerdata, NULL, soa_validate };
+diff -Naur validns-0.8/spf.c validns/spf.c
+--- validns-0.8/spf.c	2014-02-11 15:46:10.000000000 -0500
++++ validns/spf.c	2020-10-05 16:59:29.356681378 -0400
+@@ -19,70 +19,70 @@
+ 
+ /* XXX
+  * We need to add the following spf-specific policy checks:
+- * 	- record not too long (DNS name + length of SPF+TXT < 450) - rfc4408, 3.1.4
+- * 	- record should match /^v=spf1( |$)/  - rfc4408, 4.5
+- * 	- maybe check for other syntax features
+- * 	- there should be an identical TXT record - rfc4408, 3.1.1
+- * 	- there should only be one SPF per DNS name - rfc4408, 4.5
++ *  - record not too long (DNS name + length of SPF+TXT < 450) - rfc4408, 3.1.4
++ *  - record should match /^v=spf1( |$)/  - rfc4408, 4.5
++ *  - maybe check for other syntax features
++ *  - there should be an identical TXT record - rfc4408, 3.1.1
++ *  - there should only be one SPF per DNS name - rfc4408, 4.5
+  */
+ 
+ static struct rr *spf_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_spf *rr;
+-	struct binary_data spf[20];
+-	int i;
+-
+-	i = 0;
+-	while (*s) {
+-		if (i >= 20)
+-			return bitch("program limit: too many SPF text segments");
+-		spf[i] = extract_text(&s, "SPF text segment");
+-		if (spf[i].length < 0)
+-			return NULL;
+-		if (spf[i].length > 255)
+-			return bitch("SPF segment too long");
+-		i++;
+-	}
+-	if (i == 0)
+-		return bitch("empty text record");
+-
+-   	rr = getmem(sizeof(*rr) + sizeof(struct binary_data) * (i-1));
+-	rr->count = i;
+-	for (i = 0; i < rr->count; i++) {
+-		rr->spf[i] = spf[i];
+-	}
++    struct rr_spf *rr;
++    struct binary_data spf[20];
++    int i;
++
++    i = 0;
++    while (*s) {
++        if (i >= 20)
++            return bitch("program limit: too many SPF text segments");
++        spf[i] = extract_text(&s, "SPF text segment");
++        if (spf[i].length < 0)
++            return NULL;
++        if (spf[i].length > 255)
++            return bitch("SPF segment too long");
++        i++;
++    }
++    if (i == 0)
++        return bitch("empty text record");
++
++    rr = getmem(sizeof(*rr) + sizeof(struct binary_data) * (i-1));
++    rr->count = i;
++    for (i = 0; i < rr->count; i++) {
++        rr->spf[i] = spf[i];
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* spf_human(struct rr *rrv)
+ {
+-	RRCAST(spf);
++    RRCAST(spf);
+     char ss[1024];
+-	int i;
+-	char *s = ss;
+-	int l;
+-
+-	for (i = 0; i < rr->count; i++) {
+-		l = snprintf(s, 1024-(s-ss), "\"%s\" ", rr->spf[i].data);
+-		s += l;
+-	}
++    int i;
++    char *s = ss;
++    int l;
++
++    for (i = 0; i < rr->count; i++) {
++        l = snprintf(s, 1024-(s-ss), "\"%s\" ", rr->spf[i].data);
++        s += l;
++    }
+     return quickstrdup_temp(ss);
+ }
+ 
+ static struct binary_data spf_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(spf);
+-	struct binary_data r, t;
+-	int i;
+-
+-	r = bad_binary_data();
+-	t.length = 0;
+-	t.data = NULL;
+-	for (i = 0; i < rr->count; i++) {
+-		r = compose_binary_data("db", 1, t, rr->spf[i]);
+-		t = r;
+-	}
++    RRCAST(spf);
++    struct binary_data r, t;
++    int i;
++
++    r = bad_binary_data();
++    t.length = 0;
++    t.data = NULL;
++    for (i = 0; i < rr->count; i++) {
++        r = compose_binary_data("db", 1, t, rr->spf[i]);
++        t = r;
++    }
+     return r;
+ }
+ 
+diff -Naur validns-0.8/srv.c validns/srv.c
+--- validns-0.8/srv.c	2014-02-11 15:45:48.000000000 -0500
++++ validns/srv.c	2020-10-05 16:59:29.356681378 -0400
+@@ -19,60 +19,60 @@
+ 
+ static struct rr *srv_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_srv *rr = getmem(sizeof(*rr));
+-	int i;
++    struct rr_srv *rr = getmem(sizeof(*rr));
++    int i;
+ 
+-	/* TODO validate `name` (underscores etc) http://tools.ietf.org/html/rfc2782 */
++    /* TODO validate `name` (underscores etc) http://tools.ietf.org/html/rfc2782 */
+ 
+-	i = extract_integer(&s, "priority");
+-	if (i < 0)
+-		return NULL;
+-	if (i >= 65536)
+-		return bitch("priority range is not valid");
+-	rr->priority = i;
+-
+-	i = extract_integer(&s, "weight");
+-	if (i < 0)
+-		return NULL;
+-	if (i >= 65536)
+-		return bitch("weight range is not valid");
+-	rr->weight = i;
+-
+-	i = extract_integer(&s, "port");
+-	if (i < 0)
+-		return NULL;
+-	if (i >= 65536)
+-		return bitch("port range is not valid");
+-	rr->port = i;
+-
+-	rr->target = extract_name(&s, "target", 0);
+-	if (!rr->target)
+-		return NULL;
+-
+-	if (*s) {
+-		return bitch("garbage after valid SRV data");
+-	}
++    i = extract_integer(&s, "priority", NULL);
++    if (i < 0)
++        return NULL;
++    if (i >= 65536)
++        return bitch("priority range is not valid");
++    rr->priority = i;
++
++    i = extract_integer(&s, "weight", NULL);
++    if (i < 0)
++        return NULL;
++    if (i >= 65536)
++        return bitch("weight range is not valid");
++    rr->weight = i;
++
++    i = extract_integer(&s, "port", NULL);
++    if (i < 0)
++        return NULL;
++    if (i >= 65536)
++        return bitch("port range is not valid");
++    rr->port = i;
++
++    rr->target = extract_name(&s, "target", 0);
++    if (!rr->target)
++        return NULL;
++
++    if (*s) {
++        return bitch("garbage after valid SRV data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* srv_human(struct rr *rrv)
+ {
+-	RRCAST(srv);
++    RRCAST(srv);
+     char s[1024];
+ 
+-	snprintf(s, 1024, "%hu %hu %hu %s",
+-			 rr->priority, rr->weight, rr->port, rr->target);
++    snprintf(s, 1024, "%hu %hu %hu %s",
++             rr->priority, rr->weight, rr->port, rr->target);
+ 
+-	return quickstrdup_temp(s);
++    return quickstrdup_temp(s);
+ }
+ 
+ static struct binary_data srv_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(srv);
++    RRCAST(srv);
+     return compose_binary_data("222d", 1,
+-		rr->priority, rr->weight, rr->port,
+-		name2wire_name(rr->target));
++        rr->priority, rr->weight, rr->port,
++        name2wire_name(rr->target));
+ }
+ 
+ struct rr_methods srv_methods = { srv_parse, srv_human, srv_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/sshfp.c validns/sshfp.c
+--- validns-0.8/sshfp.c	2014-02-11 15:45:51.000000000 -0500
++++ validns/sshfp.c	2020-10-05 16:59:29.356681378 -0400
+@@ -19,63 +19,63 @@
+ 
+ static struct rr* sshfp_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_sshfp *rr = getmem(sizeof(*rr));
+-	int algorithm, fp_type;
++    struct rr_sshfp *rr = getmem(sizeof(*rr));
++    int algorithm, fp_type;
+ 
+-	algorithm = extract_integer(&s, "algorithm");
+-	if (algorithm < 0)	return NULL;
+-	if (algorithm != 1 && algorithm != 2 && algorithm != 3)
+-		return bitch("unsupported algorithm");
+-	rr->algorithm = algorithm;
+-
+-	fp_type = extract_integer(&s, "fp type");
+-	if (fp_type < 0)	return NULL;
+-	if (fp_type != 1 && fp_type != 2)
+-		return bitch("unsupported fp_type");
+-	rr->fp_type = fp_type;
+-
+-	rr->fingerprint = extract_hex_binary_data(&s, "fingerprint", EXTRACT_EAT_WHITESPACE);
+-	if (rr->fingerprint.length < 0)	return NULL;
+-	
+-	if (rr->fp_type == 1 && rr->fingerprint.length != SHA1_BYTES) {
+-		return bitch("wrong SHA-1 fingerprint length: %d bytes found, %d bytes expected",
+-					 rr->fingerprint.length, SHA1_BYTES);
+-	}
+-	if (rr->fp_type == 2 && rr->fingerprint.length != SHA256_BYTES) {
+-		return bitch("wrong SHA-256 fingerprint length: %d bytes found, %d bytes expected",
+-					 rr->fingerprint.length, SHA256_BYTES);
+-	}
+-
+-	if (*s) {
+-		return bitch("garbage after valid SSHFP data");
+-	}
+-	return store_record(type, name, ttl, rr);
++    algorithm = extract_integer(&s, "algorithm", NULL);
++    if (algorithm < 0)  return NULL;
++    if (algorithm != 1 && algorithm != 2 && algorithm != 3 && algorithm != 4)
++        return bitch("unsupported algorithm");
++    rr->algorithm = algorithm;
++
++    fp_type = extract_integer(&s, "fp type", NULL);
++    if (fp_type < 0)    return NULL;
++    if (fp_type != 1 && fp_type != 2)
++        return bitch("unsupported fp_type");
++    rr->fp_type = fp_type;
++
++    rr->fingerprint = extract_hex_binary_data(&s, "fingerprint", EXTRACT_EAT_WHITESPACE);
++    if (rr->fingerprint.length < 0) return NULL;
++    
++    if (rr->fp_type == 1 && rr->fingerprint.length != SHA1_BYTES) {
++        return bitch("wrong SHA-1 fingerprint length: %d bytes found, %d bytes expected",
++                     rr->fingerprint.length, SHA1_BYTES);
++    }
++    if (rr->fp_type == 2 && rr->fingerprint.length != SHA256_BYTES) {
++        return bitch("wrong SHA-256 fingerprint length: %d bytes found, %d bytes expected",
++                     rr->fingerprint.length, SHA256_BYTES);
++    }
++
++    if (*s) {
++        return bitch("garbage after valid SSHFP data");
++    }
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* sshfp_human(struct rr *rrv)
+ {
+-	RRCAST(sshfp);
++    RRCAST(sshfp);
+     char ss[4096];
+-	char *s = ss;
+-	int l;
+-	int i;
++    char *s = ss;
++    int l;
++    int i;
+ 
+     l = snprintf(s, 4096, "%u %u ", rr->algorithm, rr->fp_type);
+-	s += l;
+-	for (i = 0; i < rr->fingerprint.length; i++) {
+-		l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->fingerprint.data[i]);
+-		s += l;
+-	}
++    s += l;
++    for (i = 0; i < rr->fingerprint.length; i++) {
++        l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->fingerprint.data[i]);
++        s += l;
++    }
+     return quickstrdup_temp(ss);
+ }
+ 
+ static struct binary_data sshfp_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(sshfp);
++    RRCAST(sshfp);
+ 
+-	return compose_binary_data("11d", 1,
+-		rr->algorithm, rr->fp_type,
+-		rr->fingerprint);
++    return compose_binary_data("11d", 1,
++        rr->algorithm, rr->fp_type,
++        rr->fingerprint);
+ }
+ 
+ struct rr_methods sshfp_methods = { sshfp_parse, sshfp_human, sshfp_wirerdata, NULL, NULL };
+diff -Naur validns-0.8/t/issues/36-include/empty-include.zone validns/t/issues/36-include/empty-include.zone
+--- validns-0.8/t/issues/36-include/empty-include.zone	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/36-include/empty-include.zone	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,4 @@
++$ORIGIN example.com.
++@       IN  200    SOA     ns hostmaster 1 10800 3600 2592000 1200
++        IN      NS      ns
++$INCLUDE ; there is no include, and it is wrong
+diff -Naur validns-0.8/t/issues/36-include/inc2.inc validns/t/issues/36-include/inc2.inc
+--- validns-0.8/t/issues/36-include/inc2.inc	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/36-include/inc2.inc	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,2 @@
++$ORIGIN inc2 ; i.e., inc2.inc1.example.com.
++@ A 55.55.55.55
+diff -Naur validns-0.8/t/issues/36-include/include.zone validns/t/issues/36-include/include.zone
+--- validns-0.8/t/issues/36-include/include.zone	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/36-include/include.zone	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,6 @@
++$ORIGIN example.com.
++@       IN  200    SOA     ns hostmaster 1 10800 3600 2592000 1200
++        IN      NS      ns
++$INCLUDE reldir/inc1.inc ; relative to the zone file
++; here we should be back to our origin
++@ IN A 99.99.99.99
+diff -Naur validns-0.8/t/issues/36-include/missing-include.zone validns/t/issues/36-include/missing-include.zone
+--- validns-0.8/t/issues/36-include/missing-include.zone	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/36-include/missing-include.zone	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,4 @@
++$ORIGIN example.com.
++@       IN  200    SOA     ns hostmaster 1 10800 3600 2592000 1200
++        IN      NS      ns
++$INCLUDE nosuch.inc
+diff -Naur validns-0.8/t/issues/36-include/reldir/inc1.inc validns/t/issues/36-include/reldir/inc1.inc
+--- validns-0.8/t/issues/36-include/reldir/inc1.inc	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/36-include/reldir/inc1.inc	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,5 @@
++$ORIGIN inc1 ; i.e., inc1.example.com.
++@ A 11.11.11.11
++$INCLUDE inc2.inc ; still relative to the zone file, not to this dir
++; should be back to this origin
++@ AAAA 1111::1111
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/dsset-example.sec. validns/t/issues/41-ksk-policy-check/dsset-example.sec.
+--- validns-0.8/t/issues/41-ksk-policy-check/dsset-example.sec.	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/41-ksk-policy-check/dsset-example.sec.	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,2 @@
++example.sec.		IN DS 7686 7 1 51B9CD8F901235705C6D353ADA23736AE954B4DE
++example.sec.		IN DS 7686 7 2 9EC80B8BAD67C66954B8FE726E06CA7840282C7F444BE51A916ED11C 36908A3F
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/example.sec validns/t/issues/41-ksk-policy-check/example.sec
+--- validns-0.8/t/issues/41-ksk-policy-check/example.sec	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/41-ksk-policy-check/example.sec	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,12 @@
++$TTL    1d
++@       IN      SOA     ns.example.sec. hostmaster.example.sec. (
++                              1         ; Serial
++                         604800         ; Refresh
++                          86400         ; Retry
++                        2419200         ; Expire
++                         604800 )       ; Negative Cache TTL
++                IN      NS      ns1.example.net.
++subA            IN      NS      ns1.example.net.
++subb            IN      NS      ns1.example.net.
++subC            IN      NS      ns1.example.net.
++myMX	IN	MX 5 mx.example.net.
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/example.sec.signed validns/t/issues/41-ksk-policy-check/example.sec.signed
+--- validns-0.8/t/issues/41-ksk-policy-check/example.sec.signed	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/41-ksk-policy-check/example.sec.signed	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,131 @@
++; File written on Tue Jun 30 15:31:27 2015
++; dnssec_signzone version 9.9.7
++example.sec.		86400	IN SOA	ns.example.sec. hostmaster.example.sec. (
++					1          ; serial
++					604800     ; refresh (1 week)
++					86400      ; retry (1 day)
++					2419200    ; expire (4 weeks)
++					604800     ; minimum (1 week)
++					)
++			86400	RRSIG	SOA 7 2 86400 (
++					20150730123127 20150630123127 64232 example.sec.
++					b1Qs5d/0a4IDAvFPVvDKqWpir4189XoPOD4E
++					804eiNXRLP2ShkEUBPil44+6Ikwup5Im24XU
++					PLnmStjUFHVniicvwbwT/IY4etXR4xNoBHUc
++					BU8LiADPpZGfJ1tC/s/IHLcPbX21OltyYzi0
++					++z9gxZGy4vCG5gYCH0vm+Q96fY= )
++			86400	NS	ns1.example.net.
++			86400	RRSIG	NS 7 2 86400 (
++					20150730123127 20150630123127 64232 example.sec.
++					gyqsk3xSnKefnjTOVzJS4sdDFiJ5cPEupSkP
++					+LGXGRDGrclY6V9mkfddQz3MkeCCjujvQNAi
++					NpZllyzFj221se5bHLAVydkT0jhl2jgp8bsL
++					DBk15FGa7SXcwtpXn5rkDvR1/wmS7M/aYnrY
++					3j5dTSSsOlZQLENWBEtct9QSNbU= )
++			86400	DNSKEY	256 3 7 (
++					AwEAAaMBYu1QXBi6AII33FKwWpHhOkGMhcVc
++					IWJ73npEFjvDe0jJfLjkghnij4tMfDI8MPIZ
++					6xwVLYsEshxsDNEJJGdZ1dUvfJDxSCv8Wp0a
++					2IffxQ5NDRHSpUw27yJoQfI5gUqvor+wGTNC
++					UWx2OU0Y1BOy1whHtVbDl1gt1R6/8mOZ
++					) ; ZSK; alg = NSEC3RSASHA1; key id = 64232
++			86400	DNSKEY	257 3 7 (
++					AwEAAciLWglw17dt8EDAN88BrQYCIaGPifC4
++					pxrizfz3S1cC4XbSyRW5loj5SSHVveUmmIV9
++					0MTEOhGCDUVq/qiYG7NgTNHn3YiqyRU3sirw
++					4SACFiwln/ejxFDpQkeAbZMCzU8FQhTIB1K9
++					y7QRiLacI6naULzgP3h4PsdQSQmw3/TWy973
++					M+lHzwkgVq6ML42L18rGG0sn1KQDNSs/6sd9
++					dcRjPo7uJ2OuUsnbu/5N3vWYLciSBUnY27FU
++					vbFLkVIq072wjUMIb0Xc2EgYGRFKyV2MMckL
++					voD7vPclBE0Krv9fO/B2/KXsbObTgz4m5iQN
++					F45QLU02kmvwB4iyIzIk9O0=
++					) ; KSK; alg = NSEC3RSASHA1; key id = 7686
++			86400	RRSIG	DNSKEY 7 2 86400 (
++					20150730123127 20150630123127 7686 example.sec.
++					YQ42WBCr7e4MR51W+d6Awkxdff7tTNiA1qfJ
++					wsst0UiNXKAv504YRcS6B34u4CfG59lWWtcd
++					+xBHU7Zuox5nehsLEkFAneD1YrJLkgVw03nZ
++					NzDNWFvlxfQ2/tJ7vGbjKG2cEwUnbJKl+Kcl
++					JTAc5JzZegfM75M0Z4Yi9NiDjicpHbaICtKJ
++					5WZ6T5nVFo1nl2xCq2CiXiR1+jGKARUW+btO
++					NzHMApLQszDo7CMgvYJoHy0CHAV1Uc7Ka4zO
++					P3dVYkwu1Puk+gixhNUqo+UhKgLB2JUYdci7
++					cQ1JR9RzqEXzyZgGpLmXCOEOc8KD2c2dDN5L
++					uvOV40OrWhST/bAQ+Q== )
++			86400	RRSIG	DNSKEY 7 2 86400 (
++					20150730123127 20150630123127 64232 example.sec.
++					lKX35bocQ1iR4VTW0Es+2bZ2qX1ON7OGU1fO
++					Pb0ZqueG2GYgI63VE4Jv3WeOmGg/Tkjvsdb6
++					bMHVuVpxHvQKRqqzfaQmY7nzoDe53LfSJewj
++					p2TvdhvpPRroEZGXXPmVl46R/p+jlYMJd47T
++					o0oqB/BvQPUS61a5NThagGq6vJM= )
++			0	NSEC3PARAM 1 0 10 -
++			0	RRSIG	NSEC3PARAM 7 2 0 (
++					20150730123127 20150630123127 64232 example.sec.
++					hNJlc3JuGYBpnYEZQrhqNwrIL2fBegnnR4ii
++					TOW+0Km2maqF5ZZMxBZ7x54gW4T0amXXz89+
++					uE+l02eknf/FgM81FFOrQvJul0toOzKW9g67
++					e2VwQAwcw7g6H06cSsypXM/h9wvsNQpoSdx0
++					rq6qU2ruYM9NmJf+xUzUk38AFUw= )
++subA.example.sec.	86400	IN NS	ns1.example.net.
++subb.example.sec.	86400	IN NS	ns1.example.net.
++subC.example.sec.	86400	IN NS	ns1.example.net.
++93GL7KF6D2G7J2PSLEO2CIA70A3MM4KQ.example.sec. 604800 IN	NSEC3 1 0 10 - (
++					CSLD6RFNKVSKA73DGNI0EOM95Q8DKGBQ
++					NS )
++			604800	RRSIG	NSEC3 7 3 604800 (
++					20150730123127 20150630123127 64232 example.sec.
++					JRhyC3PbmnvYBkXzV5GmIBnj5LJTnrVeC1t3
++					v6t6o+3udfPZRecHw2cApf/Oed8H9jCeox77
++					vA13/fLXui635CYAcqXYxVgO4g0au1d1S6lo
++					N2Pw96JXDNhIqyVBVj1Ii2ZOQLWXZ8YgZRQ6
++					lxgww8m0QGC8FjEnzR8z2liSG88= )
++3ED4GMVJJ0FT4TCFDKNFQ5EPEFSDBPNM.example.sec. 604800 IN	NSEC3 1 0 10 - (
++					93GL7KF6D2G7J2PSLEO2CIA70A3MM4KQ
++					NS )
++			604800	RRSIG	NSEC3 7 3 604800 (
++					20150730123127 20150630123127 64232 example.sec.
++					B9L5NrHjO/J6FDmv7DjT1xq/f8jiB2WTEXSl
++					bFeUVcTivoyvdyfNNTH+YlzJesqTtQ9GaEPQ
++					ouzw7XbdyvtJ//GD+vrO/7XwfrVmkckQgEVl
++					zPm70TksAkwLzj0uY6WBIGIPq/KJMM14f6El
++					ct5w2KtgvF9sazFP+KMchU5Be3Q= )
++myMX.example.sec.	86400	IN MX	5 mx.example.net.
++			86400	RRSIG	MX 7 3 86400 (
++					20150730123127 20150630123127 64232 example.sec.
++					lh8vFwFg77gLtLyXbzqzYSlebkzn3yAlXHU2
++					/hgiyUWYcuZa5E33Ul+ZrUJPCGLaUQs3X+yL
++					p/uk6LP2dnMaf/X1mow/tyYNtIdn0MhTYNqs
++					WmYV1Ga/NSoErtoHYoNgeqV1w0Q/nfhipMdX
++					RekpxVR6RUUt2d3LS8UIH+pEYd8= )
++CSLD6RFNKVSKA73DGNI0EOM95Q8DKGBQ.example.sec. 604800 IN	NSEC3 1 0 10 - (
++					JC1M8I9IPBEENK9RDGMN9LQKAMMSQEVV
++					MX RRSIG )
++			604800	RRSIG	NSEC3 7 3 604800 (
++					20150730123127 20150630123127 64232 example.sec.
++					menCNV7RkbVWmfhuPfoYHfHCEtvQmVb3+p/x
++					WYVymu5hXUPQ2+K4Ns0jQ+om4GuTmXmm1DYY
++					IjIXv4jthJoD6jydqN6Hr+tr0ewxr6mHXj3I
++					RizTBuw4zcgPUrIRVQStkMtwyjN4Nlznhg7I
++					txZ14uH1G4U1DgkR2oC6YZsSqi8= )
++JC1M8I9IPBEENK9RDGMN9LQKAMMSQEVV.example.sec. 604800 IN	NSEC3 1 0 10 - (
++					NLF2NKFTCGVVRC4C941FOOCD00TPI9DV
++					NS SOA RRSIG DNSKEY NSEC3PARAM )
++			604800	RRSIG	NSEC3 7 3 604800 (
++					20150730123127 20150630123127 64232 example.sec.
++					ggLIoKQYmI9GeBkSccVdE87G1QQwGGO0HlrN
++					dg9Ah5QiWWjZ5icSOU4vyEm0XiqkFCrGEAq0
++					9L4HMOFuELMa28dAhVxOvZldbXizXUSCbWCS
++					miYFLOIKcQ9IcmzeEgg+uJzHdAyYSSK2Jb+0
++					YYuoXOhiZwzluj+u2i6kbf6wDY4= )
++NLF2NKFTCGVVRC4C941FOOCD00TPI9DV.example.sec. 604800 IN	NSEC3 1 0 10 - (
++					3ED4GMVJJ0FT4TCFDKNFQ5EPEFSDBPNM
++					NS )
++			604800	RRSIG	NSEC3 7 3 604800 (
++					20150730123127 20150630123127 64232 example.sec.
++					buRQJjfJDIbRFZFr8s7odGSxqnrSHXXN/AAu
++					tbG1k2L7WD+DGYFiRnR5Uia/C2oL186PqBtT
++					R8oDKf/4zr5qOsZz9xYabaBqG98JVXwPTiFk
++					JBoc7sFcwGJ16hj9Zey05aNs1h5RZm6BL8W0
++					9bRF3qIezckG0VA+U7ASTLNH4ME= )
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key
+--- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,5 @@
++; This is a key-signing key, keyid 7686, for example.sec.
++; Created: 20150630133112 (Tue Jun 30 15:31:12 2015)
++; Publish: 20150630133112 (Tue Jun 30 15:31:12 2015)
++; Activate: 20150630133112 (Tue Jun 30 15:31:12 2015)
++example.sec. IN DNSKEY 257 3 7 AwEAAciLWglw17dt8EDAN88BrQYCIaGPifC4pxrizfz3S1cC4XbSyRW5 loj5SSHVveUmmIV90MTEOhGCDUVq/qiYG7NgTNHn3YiqyRU3sirw4SAC Fiwln/ejxFDpQkeAbZMCzU8FQhTIB1K9y7QRiLacI6naULzgP3h4PsdQ SQmw3/TWy973M+lHzwkgVq6ML42L18rGG0sn1KQDNSs/6sd9dcRjPo7u J2OuUsnbu/5N3vWYLciSBUnY27FUvbFLkVIq072wjUMIb0Xc2EgYGRFK yV2MMckLvoD7vPclBE0Krv9fO/B2/KXsbObTgz4m5iQNF45QLU02kmvw B4iyIzIk9O0=
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private
+--- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,13 @@
++Private-key-format: v1.3
++Algorithm: 7 (NSEC3RSASHA1)
++Modulus: yItaCXDXt23wQMA3zwGtBgIhoY+J8LinGuLN/PdLVwLhdtLJFbmWiPlJIdW95SaYhX3QxMQ6EYINRWr+qJgbs2BM0efdiKrJFTeyKvDhIAIWLCWf96PEUOlCR4BtkwLNTwVCFMgHUr3LtBGItpwjqdpQvOA/eHg+x1BJCbDf9NbL3vcz6UfPCSBWrowvjYvXysYbSyfUpAM1Kz/qx311xGM+ju4nY65Sydu7/k3e9ZgtyJIFSdjbsVS9sUuRUirTvbCNQwhvRdzYSBgZEUrJXYwxyQu+gPu89yUETQqu/1878Hb8pexs5tODPibmJA0XjlAtTTaSa/AHiLIjMiT07Q==
++PublicExponent: AQAB
++PrivateExponent: d5kDfRXaz/20hikcH0v0j9y9icg8j17P6WzRQ8eHGsERDPfwDBC+AboJLzB1Ky+1TgcWdgJATyisGXYRoSH1gygvKA+LQnH3sbuheZJl79zOtE1L9TepYEd7y4B/2GiXYETWf+Y619Fwpla+nYjIjAcylzF1KLctWVg79peROEXC0zb+IxWQFIBpe7OzTZ1qxG8ymm6uiu9KXH6qQi3BLSarxj5rY+tO8oj0qQNOGkbSVsXFax0arZ0qMRFT5UooOm+2Yl8Q9Z/PC52qwNqkSDZ2QeoYTJx5tDFhuVJxXhioxGIueA4QuCRA4cRL2U5ZnCYcQa10JFE2O4N990eLUQ==
++Prime1: 5LW1fl8ky4bBaIPg48Cq8bXQIvaK5syFTvzzMopuTeD6PGwOByuzc4u9KLVrDRebjeYfNVkqXIJAHMjolOr4jURWp2Q3FUrewqdgyY2ULSLMmQo0+dHkvjJIs2A/6vNme+MtFms6msJjyzj3EhLf32djvCH+jWStP3Vb/jopYWs=
++Prime2: 4HlJJB25JSLygHd0GWi8yu0z3FaYhWXnIs8bwpT8er1lH+tsBeYI8ughuX9h19STMRnBhAh0ZlQaKHOrPTsdVOFQJWr6aUbWIAhv5m+ij1IFsQ58DKnsYP0DXiNkR7K4pXO8yzPTo9UfaMCJAKYipENTgpfb43sVBQnDIGr9oQc=
++Exponent1: aJpK9g9h7swlLT4T31bBWGeFWFhWUxT7a5L5UAZMSMY67OOmztTH8HLbAwFmgshnVtEHOQkc/M59sCybY3DMWSAGWezV3KEvnOucstJUEQi3ds9aR2AeNHcfFRtSYI0ONF9EwdotJZb+uXXGWrfTOIQ681LA7746FqoAdxf20R0=
++Exponent2: QlFS3Iqzglc60d14vXEGJeXCZpxm3zJmARCzIN+nYBPIZo/FEFEP38PZAtaxb3RsMBtt4rYkvX6nY8AYnTRzy/ntFcDvTl8RL9GOTcQ5gKI48EBZQdyJ63WUoyFNpSkWCDuTUW10X3i9mNMZJsnufh0t9O0sl55rbVue/Frfp80=
++Coefficient: aLnGdfeRJ3nSjmbby8IDkJ+W+gFGOHd3XAMDSNP9D8kn6B3JyAfY6FDSg0+Bh+F80PFNGsESkYimXlWr3B6NlC0Gq99hPSV8yU2pYHq3TPVB0tWOAkNVIXM9icEH9wshCQH7wD7cPDWvhhgcgo64nYOGYeK6sjTL7XDtRanvbP8=
++Created: 20150630133112
++Publish: 20150630133112
++Activate: 20150630133112
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key
+--- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,5 @@
++; This is a zone-signing key, keyid 64232, for example.sec.
++; Created: 20150630133105 (Tue Jun 30 15:31:05 2015)
++; Publish: 20150630133105 (Tue Jun 30 15:31:05 2015)
++; Activate: 20150630133105 (Tue Jun 30 15:31:05 2015)
++example.sec. IN DNSKEY 256 3 7 AwEAAaMBYu1QXBi6AII33FKwWpHhOkGMhcVcIWJ73npEFjvDe0jJfLjk ghnij4tMfDI8MPIZ6xwVLYsEshxsDNEJJGdZ1dUvfJDxSCv8Wp0a2Iff xQ5NDRHSpUw27yJoQfI5gUqvor+wGTNCUWx2OU0Y1BOy1whHtVbDl1gt 1R6/8mOZ
+diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private
+--- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,13 @@
++Private-key-format: v1.3
++Algorithm: 7 (NSEC3RSASHA1)
++Modulus: owFi7VBcGLoAgjfcUrBakeE6QYyFxVwhYnveekQWO8N7SMl8uOSCGeKPi0x8Mjww8hnrHBUtiwSyHGwM0QkkZ1nV1S98kPFIK/xanRrYh9/FDk0NEdKlTDbvImhB8jmBSq+iv7AZM0JRbHY5TRjUE7LXCEe1VsOXWC3VHr/yY5k=
++PublicExponent: AQAB
++PrivateExponent: ATf/b1rMdXreihq00QF0i+atMtREI8eekEfwz+U2bVf20gJ/pjo/JsZk4FvACfgdPZIoCdu2rXVph4DfT6jL1t7sDY/9mfcMd2Zge6eB8Kat3QpdDu4qClgkXFTYFLj2lQ5Bm/b+YbQ8fiPlZovp7YGFodmsjfnNvbT7UiOiSKE=
++Prime1: 1wNWdr5FIrew1NTzpbeClZr5NIIoRBpEPsSDCBZpbRDZ944LcjWgrJpVlG1klkp/cR/zcSzrq+637rva30jglQ==
++Prime2: whQSB4wqB87wyYrewJLU5qFY5Up/YiZ0iyD4m4OIQMk/K7eXtuqFuSOP4xTR4WAWHIyRixa1F85/eh7y6+9h9Q==
++Exponent1: XjHZJEYw9Yex0VvFrdjaPX5aJJXM3CEButnOabGf2Cckxl4VR6CU1mj6iv7trSXP9RhBR1idmoIHVHA57832jQ==
++Exponent2: dtzn9etoSoP5gNYmevbyoZWr5jJsNeardhJpcIVsS5F1uQamSob0A2G+XCuCJ3A72pxU/0SXAM+dz2NpEAr6iQ==
++Coefficient: egVfeiBCmggrVDolCSvAIg+XEb+YmLcD1SLT5qFLuqCtPKWGDx9lGMbqbx5s2gzeeoAPL1r34pohHNLMCqCNdw==
++Created: 20150630133105
++Publish: 20150630133105
++Activate: 20150630133105
+diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/13.example.com validns/t/issues/51-support-curved-algorithms/13.example.com
+--- validns-0.8/t/issues/51-support-curved-algorithms/13.example.com	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/51-support-curved-algorithms/13.example.com	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,16 @@
++$TTL 86400 ; (1 day)
++$ORIGIN 13.example.com.
++$INCLUDE K13.example.com.+013+18450.key;
++@ IN SOA ns1.example.com. hostmaster.example.com. (
++                2014012401 ; serial YYYYMMDDnn
++                14400      ; refresh (4 hours)
++                1800       ; retry   (30 minutes)
++                1209600    ; expire  (2 weeks)
++                3600       ; minimum (1 hour)
++                )
++ 
++         172800    IN   NS    ns1.example.org.
++         172800    IN   NS    ns2.example.org.
++ 
++                   IN   A     203.0.113.10
++www                IN   CNAME 13.example.com.
+diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/13.example.com.signed validns/t/issues/51-support-curved-algorithms/13.example.com.signed
+--- validns-0.8/t/issues/51-support-curved-algorithms/13.example.com.signed	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/51-support-curved-algorithms/13.example.com.signed	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,55 @@
++; File written on Tue Mar 29 15:52:18 2016
++; dnssec_signzone version 9.9.8-P4-RedHat-9.9.8_P4-2.el7.0
++13.example.com.		86400	IN SOA	ns1.example.com. hostmaster.example.com. (
++					2014012401 ; serial
++					14400      ; refresh (4 hours)
++					1800       ; retry (30 minutes)
++					1209600    ; expire (2 weeks)
++					3600       ; minimum (1 hour)
++					)
++			86400	RRSIG	SOA 13 3 86400 (
++					20160428125218 20160329125218 18450 13.example.com.
++					7LfQswmP8B9hr6Bg8nr9o8yd/fe6n86HDhs9
++					pAByPITSjdqML6Rwb4NOHWvFDZJXVA4mz5Pe
++					TG4JVHiGYU7HCw== )
++			172800	NS	ns1.example.org.
++			172800	NS	ns2.example.org.
++			172800	RRSIG	NS 13 3 172800 (
++					20160428125218 20160329125218 18450 13.example.com.
++					eses1PGFULOHDZbqPt+CMQHdYCIVNdxVMYba
++					YtW3iA9nN4mfvS6jls69J60bqSA4p3w4tD3k
++					v9dnDcFdS+tEUQ== )
++			86400	A	203.0.113.10
++			86400	RRSIG	A 13 3 86400 (
++					20160428125218 20160329125218 18450 13.example.com.
++					2QqqZ4i7yq1sCrK82aLm85pTSUgpWR0XsBzi
++					MVFyjcoW75f0ysZKZafO5lFJECKEP8ncJfEP
++					NEMXVuyAUJihSA== )
++			3600	NSEC	www.13.example.com. A NS SOA RRSIG NSEC DNSKEY
++			3600	RRSIG	NSEC 13 3 3600 (
++					20160428125218 20160329125218 18450 13.example.com.
++					IV+0txuv6DNk7kRBUmkk4jorMjXoyi/klFC/
++					1g5ZK8/cZuFcKREuIW7bmpvhB4Mhj8yWpLJ9
++					CVNy339z+Rt/6g== )
++			86400	DNSKEY	257 3 13 (
++					SFycyLoVKBBL0re1qD6sezd/bOM9jwtT/mTT
++					1KkW0yqIXixXN/szwzm49r6YzlIFHRDXry8a
++					7aaIKWopkx8WBA==
++					) ; KSK; alg = ECDSAP256SHA256; key id = 18450
++			86400	RRSIG	DNSKEY 13 3 86400 (
++					20160428125218 20160329125218 18450 13.example.com.
++					OsKqN6fhvL4b0XK5TOEpZXrSoC/GcRMlCqIe
++					csfZem7xMmcBjUe333/fJdw0x1QKmA17BoX/
++					Px88zz24dRW0Vg== )
++www.13.example.com.	86400	IN CNAME 13.example.com.
++			86400	RRSIG	CNAME 13 4 86400 (
++					20160428125218 20160329125218 18450 13.example.com.
++					CFfxilFg72g3rQerviVCO6jmf8kVodqusejq
++					WETSBiCAfMhcB2+uLsitmaH8LsAiNLNMY7nc
++					533WnQjsJ4vsmQ== )
++			3600	NSEC	13.example.com. CNAME RRSIG NSEC
++			3600	RRSIG	NSEC 13 4 3600 (
++					20160428125218 20160329125218 18450 13.example.com.
++					IWqCg2pcOd9kX4waHb8Ij3kWeJxfXGKUBbpf
++					Fuc3bhOJ/rvQ2kPYO305TeZP5Rfcd7+efDEb
++					i8be+VqhOgf7Pg== )
+diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/14.example.com validns/t/issues/51-support-curved-algorithms/14.example.com
+--- validns-0.8/t/issues/51-support-curved-algorithms/14.example.com	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/51-support-curved-algorithms/14.example.com	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,16 @@
++$TTL 86400 ; (1 day)
++$ORIGIN 14.example.com.
++$INCLUDE K14.example.com.+014+01045.key;
++@ IN SOA ns1.example.com. hostmaster.example.com. (
++                2014012401 ; serial YYYYMMDDnn
++                14400      ; refresh (4 hours)
++                1800       ; retry   (30 minutes)
++                1209600    ; expire  (2 weeks)
++                3600       ; minimum (1 hour)
++                )
++ 
++         172800    IN   NS    ns1.example.org.
++         172800    IN   NS    ns2.example.org.
++ 
++                   IN   A     203.0.113.10
++www                IN   CNAME 14.example.com.
+diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/14.example.com.signed validns/t/issues/51-support-curved-algorithms/14.example.com.signed
+--- validns-0.8/t/issues/51-support-curved-algorithms/14.example.com.signed	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/51-support-curved-algorithms/14.example.com.signed	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,63 @@
++; File written on Tue Mar 29 15:52:22 2016
++; dnssec_signzone version 9.9.8-P4-RedHat-9.9.8_P4-2.el7.0
++14.example.com.		86400	IN SOA	ns1.example.com. hostmaster.example.com. (
++					2014012401 ; serial
++					14400      ; refresh (4 hours)
++					1800       ; retry (30 minutes)
++					1209600    ; expire (2 weeks)
++					3600       ; minimum (1 hour)
++					)
++			86400	RRSIG	SOA 14 3 86400 (
++					20160428125222 20160329125222 1045 14.example.com.
++					5FEzZuz1HrgRNTakg4D24h1RrO1Kx9IDzXN6
++					S/00bsfO5AQ8hxVd2X7XzrYGdqs+gpecBpkl
++					WLG1MrEgzYvRVgPTVY0bL0U7GxmvqAp871WH
++					yuJKB8NFTkgQDA7cA2Do )
++			172800	NS	ns1.example.org.
++			172800	NS	ns2.example.org.
++			172800	RRSIG	NS 14 3 172800 (
++					20160428125222 20160329125222 1045 14.example.com.
++					9Yol4eoRhw52o7LJqCnTlDlQlFbaHFyTOGf4
++					3MAPNe5hx2NFCujCg9RxE66l+BE6otDMC+tb
++					hJKVPfb5U8+rpjDna3H1RSjV7MkS4crlzS0k
++					0rximlQ9x7OIy2wkZ0bw )
++			86400	A	203.0.113.10
++			86400	RRSIG	A 14 3 86400 (
++					20160428125222 20160329125222 1045 14.example.com.
++					DG685u5rAML7/ga7TnixPiLwBEHFzcGpQeRc
++					WZkPX2W/gJ8VyejkZbWDinYEZIVUeQaRTNW4
++					RcXBSq7o5wDgTJUSih+fnoLh9Fuzlfch6voG
++					qGKMeWl4i+2eYF7QImB8 )
++			3600	NSEC	www.14.example.com. A NS SOA RRSIG NSEC DNSKEY
++			3600	RRSIG	NSEC 14 3 3600 (
++					20160428125222 20160329125222 1045 14.example.com.
++					tPxJtlAhflaMsTI0zx0vt+R73cmU9zL9ly20
++					xrhZlRWhScxZ4y8fAIs57rfbl4XCe1Rln6y/
++					TZ3V0BcpXH2fl3vXxOJqcnsK/RHHxl57va7E
++					v704MwP3Je9qhirfLd6O )
++			86400	DNSKEY	257 3 14 (
++					FWoMjTSsjInt9389me7cymDHNbntmNWejqPI
++					zSsifAs2CdBtfCoN98LvEU1eADIG4kkpKvVv
++					QTYnoiUP/jsFQa6Uz+PmfgKO+PpyNl1fNy+b
++					N7uEPJzIZhen3X6bIwYg
++					) ; KSK; alg = ECDSAP384SHA384; key id = 1045
++			86400	RRSIG	DNSKEY 14 3 86400 (
++					20160428125222 20160329125222 1045 14.example.com.
++					FD2AI0MGo8w5JRfVihohNNsgj1pVrCUxaehv
++					R7DH2eS7STiJFEBFr8e8UO1CiDGXuOGhgoPY
++					CyEay93XJfdHaWBA4iCPctZUkdyA5ZXrYrpT
++					iCkK6GK0MtbyH7W3H4Uu )
++www.14.example.com.	86400	IN CNAME 14.example.com.
++			86400	RRSIG	CNAME 14 4 86400 (
++					20160428125222 20160329125222 1045 14.example.com.
++					Y8knRqg1Hpta6KZ57zc+eY6XDgIgRLVYWZ0m
++					7YESOgRTU0oEU8j8NQ+S1RPAZM8migNkHjB4
++					NKdm9DCMnlD237546++VmZFUZgzGnKW3lQAQ
++					GpTe7MtqMUY40B+TxSIg )
++			3600	NSEC	14.example.com. CNAME RRSIG NSEC
++			3600	RRSIG	NSEC 14 4 3600 (
++					20160428125222 20160329125222 1045 14.example.com.
++					TnQB0LmuU2Z4WtQDOBslDrIWFguyh4rv17gZ
++					nV8GvUJnn1Wk8/djZv47chNeNK6Rxt+lUaDm
++					E9S6f7eSJiGTAP6N0Mgfg7BmFbmD+4ZOUez2
++					t5FEl5KRUrPoiHQvOB8w )
+diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.key validns/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.key
+--- validns-0.8/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.key	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.key	2020-10-05 16:59:29.357681388 -0400
+@@ -0,0 +1,5 @@
++; This is a key-signing key, keyid 18450, for 13.example.com.
++; Created: 20160302102736 (Wed Mar  2 11:27:36 2016)
++; Publish: 20160302102736 (Wed Mar  2 11:27:36 2016)
++; Activate: 20160302102736 (Wed Mar  2 11:27:36 2016)
++13.example.com. IN DNSKEY 257 3 13 SFycyLoVKBBL0re1qD6sezd/bOM9jwtT/mTT1KkW0yqIXixXN/szwzm4 9r6YzlIFHRDXry8a7aaIKWopkx8WBA==
+diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.private validns/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.private
+--- validns-0.8/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.private	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.private	2020-10-05 16:59:29.358681397 -0400
+@@ -0,0 +1,6 @@
++Private-key-format: v1.3
++Algorithm: 13 (ECDSAP256SHA256)
++PrivateKey: X3Mr05PnOJKClnUa14y2CdCCHUjkUNFl6wh1knpRKg==
++Created: 20160302102736
++Publish: 20160302102736
++Activate: 20160302102736
+diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.key validns/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.key
+--- validns-0.8/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.key	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.key	2020-10-05 16:59:29.358681397 -0400
+@@ -0,0 +1,5 @@
++; This is a key-signing key, keyid 1045, for 14.example.com.
++; Created: 20160302103027 (Wed Mar  2 11:30:27 2016)
++; Publish: 20160302103027 (Wed Mar  2 11:30:27 2016)
++; Activate: 20160302103027 (Wed Mar  2 11:30:27 2016)
++14.example.com. IN DNSKEY 257 3 14 FWoMjTSsjInt9389me7cymDHNbntmNWejqPIzSsifAs2CdBtfCoN98Lv EU1eADIG4kkpKvVvQTYnoiUP/jsFQa6Uz+PmfgKO+PpyNl1fNy+bN7uE PJzIZhen3X6bIwYg
+diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.private validns/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.private
+--- validns-0.8/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.private	1969-12-31 19:00:00.000000000 -0500
++++ validns/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.private	2020-10-05 16:59:29.358681397 -0400
+@@ -0,0 +1,6 @@
++Private-key-format: v1.3
++Algorithm: 14 (ECDSAP384SHA384)
++PrivateKey: U2ji19bf3QQ3wqgNm1/PJUcD4Bp17Gb53UIcSCPe9yNd665GOvlRSCQaKbr+IXCY
++Created: 20160302103027
++Publish: 20160302103027
++Activate: 20160302103027
+diff -Naur validns-0.8/t/test.pl validns/t/test.pl
+--- validns-0.8/t/test.pl	2014-02-11 15:08:39.000000000 -0500
++++ validns/t/test.pl	2020-10-05 16:59:29.358681397 -0400
+@@ -20,7 +20,7 @@
+ run('./validns', @threads, 't/zones/galaxyplus.org');
+ is(rc, 0, 'valid zone parses ok');
+ 
+-run('./validns', @threads, '-t1381239017', 't/zones/example.sec.signed');
++run('./validns', @threads, '-t1501789043', 't/zones/example.sec.signed');
+ is(rc, 0, 'valid signed zone parses ok');
+ 
+ run('./validns', @threads, '-t1303720010', 't/zones/example.sec.signed');
+@@ -28,7 +28,7 @@
+ @e = split /\n/, stderr;
+ like(shift @e, qr/signature is too new/, "signature is too new");
+ 
+-run('./validns', @threads, '-t1421410832', 't/zones/example.sec.signed');
++run('./validns', @threads, '-t1561789043', 't/zones/example.sec.signed');
+ isnt(rc, 0, 'valid signed zone with timestamps in the past');
+ @e = split /\n/, stderr;
+ like(shift @e, qr/signature is too old/, "signature is too old");
+@@ -113,11 +113,34 @@
+ like(shift @e, qr/name cannot start with a dot/, "dot-dot");
+ like(shift @e, qr/garbage after valid DNAME data/, "DNAME garbage");
+ 
++like(shift @e, qr/CAA flags expected/, "CAA without a flag");
++like(shift @e, qr/CAA tag expected/, "CAA without a tag");
++like(shift @e, qr/CAA unrecognized flags value/, "CAA with bad flags");
++like(shift @e, qr/CAA unrecognized tag name/, "CAA with bad tag");
++like(shift @e, qr/CAA tag is not valid/, "CAA with bad chars in tag");
++like(shift @e, qr/CAA reserved tag name/, "CAA with reserved tag 1");
++like(shift @e, qr/CAA reserved tag name/, "CAA with reserved tag 2");
++like(shift @e, qr/CAA reserved tag name/, "CAA with reserved tag 3");
++like(shift @e, qr/CAA missing tag value/, "CAA without a tag value");
++like(shift @e, qr/garbage after valid CAA/, "CAA + garbage");
++## these things are not validated but probably should be
++#like(shift @e, qr/CAA invalid issue domain/, "CAA bad issue domain");
++#like(shift @e, qr/CAA missing issue parameter value/, "CAA missing issue parameter value");
++#like(shift @e, qr/CAA missing issue parameter tag/, "CAA missing issue parameter tag");
++#like(shift @e, qr/CAA invalid issuewild domain/, "CAA bad issuewild domain");
++#like(shift @e, qr/CAA missing issuewild parameter value/, "CAA missing issuewild parameter value");
++#like(shift @e, qr/CAA missing issuewild parameter tag/, "CAA missing issuewild parameter tag");
++#like(shift @e, qr/CAA iodef value not a URL/, "CAA iodef value is not a URL");
++#like(shift @e, qr/CAA iodef value unrecognized URL/, "CAA iodef value unrecognized URL");
++
+ ## actual validations done after parsing
+ like(shift @e, qr/CNAME and other data/, "CNAME+CNAME");
+ like(shift @e, qr/CNAME and other data/, "CNAME+something else");
+ like(shift @e, qr/there should be at least two NS records/, "NS limit");
++like(shift @e, qr/not a proper domain name for an SMIMEA record/, "SMIMEA host 1");
+ like(shift @e, qr/not a proper prefixed DNS domain name/, "TLSA host 1");
++like(shift @e, qr/not a proper domain name for an SMIMEA record/, "SMIMEA host 2");
++like(shift @e, qr/not a proper domain name for an SMIMEA record/, "SMIMEA host 3");
+ like(shift @e, qr/not a proper prefixed DNS domain name/, "TLSA host 2");
+ 
+ like(shift @e, qr/TTL values differ within an RR set/, "TTL conflict");
+@@ -215,6 +238,35 @@
+ like(shift @e, qr/leading zero octets in public key exponent/, "leading zeroes in exponent 2");
+ is(+@e, 0, "no unaccounted errors for DNSKEY policy checks");
+ 
++# issue 36: https://github.com/tobez/validns/issues/36 - $include implementation
++run('./validns', @threads, 't/issues/36-include/empty-include.zone');
++isnt(rc, 0, 'empty include detected');
++@e = split /\n/, stderr;
++like(shift @e, qr/\bINCLUDE directive with empty file name\b/, "Expected error with empty INCLUDE");
++is(+@e, 0, "no unaccounted errors for empty include");
++
++run('./validns', @threads, 't/issues/36-include/missing-include.zone');
++isnt(rc, 0, 'missing include detected');
++@e = split /\n/, stderr;
++like(shift @e, qr/\bNo such file or directory\b/, "Expected error with missing INCLUDE file");
++is(+@e, 0, "no unaccounted errors for missing include");
++
++run('./validns', @threads, '-v', 't/issues/36-include/include.zone');
++is(rc, 0, 'zone with nested includes parses ok');
++@e = split /\n/, stderr;
++for my $rx ((qr/\d:\s+example\.com\.\s+IN\s+\d+\s+NS\s+ns\.example\.com\./,
++			 qr/\d:\s+inc1\.example\.com\.\s+IN\s+\d+\s+A\s+11\.11\.11\.11/,
++			 qr/\d:\s+inc2\.inc1\.example\.com\.\s+IN\s+\d+\s+A\s+55\.55\.55\.55/,
++			 qr/\d:\s+inc1\.example\.com\.\s+IN\s+\d+\s+AAAA\s+1111::1111/,
++			 qr/\d:\s+example\.com\.\s+IN\s+\d+\s+A\s+99\.99\.99\.99/))
++{
++	my $ok = 0;
++	for my $e (@e) {
++		$ok = 1 if $e =~ $rx;
++	}
++	is($ok, 1, "found expected record with correct ORIGIN tracked across INCLUDEs");
++}
++
+ # issue 21: https://github.com/tobez/validns/issues/21
+ run('./validns', @threads, '-t1345815800', 't/issues/21-nsec3-without-corresponding/example.sec.signed');
+ is(rc, 0, 'issue 21 did not come back');
+@@ -227,6 +279,19 @@
+ run('./validns', @threads, '-t1345815800', 't/issues/25-nsec/example.sec.signed');
+ is(rc, 0, 'issue 25 did not come back');
+ 
++# issue 41: https://github.com/tobez/validns/issues/41
++run('./validns', @threads, '-t1345815800', '-pksk-exists', 't/issues/25-nsec/example.sec.signed');
++isnt(rc, 0, 'KSK policy check fails');
++@e = split /\n/, stderr;
++like(shift @e, qr/\bNo KSK found\b/, "KSK policy check produces expected error output");
++is(+@e, 0, "no unaccounted errors for KSK policy check");
++
++run('./validns', @threads, '-t1435671103', '-pksk-exists', 't/issues/41-ksk-policy-check/example.sec.signed');
++is(rc, 0, 'signed zone with KSK parses ok when KSK policy check is active');
++
++run('./validns', @threads, '-pksk-exists', 't/zones/galaxyplus.org');
++is(rc, 0, 'unsigned zone ignores KSK policy checks');
++
+ # issue 26: https://github.com/tobez/validns/issues/26
+ run('./validns', @threads, '-t1349357570', 't/issues/26-spurios-glue/example.sec.signed.no-optout');
+ is(rc, 0, 'issue 26 did not come back (NSEC3 NO optout)');
+@@ -296,24 +361,31 @@
+ is(rc, 0, 'issue 32: SSHFP supports ECDSA and SHA-256');
+ 
+ # issue 34: multiple time specifications
+-run('./validns', @threads, ('-t1381239017') x 32, 't/zones/example.sec.signed');
++run('./validns', @threads, ('-t1501789043') x 32, 't/zones/example.sec.signed');
+ is(rc, 0, 'valid signed zone parses ok');
+ 
+-run('./validns', @threads, ('-t1421410832') x 33, 't/zones/example.sec.signed');
++run('./validns', @threads, ('-t1501789043') x 33, 't/zones/example.sec.signed');
+ isnt(rc, 0, 'too many time specs');
+ @e = split /\n/, stderr;
+ like(shift @e, qr/too many -t/, "too many -t");
+ 
+-run('./validns', @threads, '-t1381239017', '-t1303720010', 't/zones/example.sec.signed');
++run('./validns', @threads, '-t1501789043', '-t1303720010', 't/zones/example.sec.signed');
+ isnt(rc, 0, 'multitime: valid signed zone with timestamps in the future');
+ @e = split /\n/, stderr;
+ like(shift @e, qr/signature is too new/, "multitime: signature is too new");
+ 
+-run('./validns', @threads, '-t1381239017', '-t1421410832', 't/zones/example.sec.signed');
++run('./validns', @threads, '-t1501789043', '-t1561789043', 't/zones/example.sec.signed');
+ isnt(rc, 0, 'multitime: valid signed zone with timestamps in the past');
+ @e = split /\n/, stderr;
+ like(shift @e, qr/signature is too old/, "multitime: signature is too old");
+ 
++# issue 51: support curved algorithms 
++run('./validns', @threads, '-t1459259658', 't/issues/51-support-curved-algorithms/13.example.com.signed');
++is(rc, 0, 'issue 51: support ECDSAP256SHA256');
++
++run('./validns', @threads, '-t1459259658', 't/issues/51-support-curved-algorithms/14.example.com.signed');
++is(rc, 0, 'issue 51: support ECDSAP384SHA384');
++
+ }
+ 
+ done_testing;
+diff -Naur validns-0.8/t/zones/example.sec validns/t/zones/example.sec
+--- validns-0.8/t/zones/example.sec	2014-02-11 15:08:39.000000000 -0500
++++ validns/t/zones/example.sec	2020-10-05 16:59:29.359681406 -0400
+@@ -14,7 +14,21 @@
+ 		A 3.4.5.6
+ 		RP some.mail.box @
+ 		TXT "Responsible person"
++        CAA 0 issue "example.sec" ; fine
+ 
++        CDS	50458 12 3 2e40b2a6ccd2760ec70af69d1c144064c8931e53a6b3eee78bdb9e0bafbb9c02
++        CDNSKEY 256 3 8 (
++            AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27
++            3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe
++            avuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90
++            yQwfC53hxyH10GzGnAx4Sutrdkh1w4HM1nMB
++            dlTMa0g9yxjJ0vm/T7qHzj+3dTUi84s8Du2m
++            fMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB
++            /QUuoY2FyThfidT+nhOQpzftVtLcta0E0Uv3
++            PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/
++            byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01
++            u8SJYP6ULwx0mZ0p5BmoMH8=
++        )
+ ns1		A	1.2.3.4
+ ns2		A	5.6.7.8
+ mail	A	2.3.4.5
+@@ -33,6 +47,12 @@
+ _25._tcp.mail IN TLSA (
+       3 0 0 30820307308201efa003020102020123 )
+ 
++c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com IN SMIMEA (
++      1 1 2 92003ba34942dc74152e2f2c408d29ec
++            a5a520e7f2e06bb944f4dca346baf63c
++            1b177615d466f6c4b71c216a50292bd5
++            8c9ebdd2f74e38fe51ffd48c43326cbc )
++
+ delegation NS ns1
+ delegation NS ns2
+ delegation DS 60485 5 1 ( 2BB183AF5F22588179A53B0A
+diff -Naur validns-0.8/t/zones/example.sec.signed validns/t/zones/example.sec.signed
+--- validns-0.8/t/zones/example.sec.signed	2014-02-11 15:08:39.000000000 -0500
++++ validns/t/zones/example.sec.signed	2020-10-05 16:59:29.360681415 -0400
+@@ -1,5 +1,5 @@
+-; File written on Tue Oct  8 15:28:55 2013
+-; dnssec_signzone version 9.8.4-P2
++; File written on Fri Aug  4 16:23:33 2017
++; dnssec_signzone version 9.9.10-P3
+ example.sec.		300	IN SOA	ns1.example.sec. hostmaster.example.sec. (
+ 					42         ; serial
+ 					3600       ; refresh (1 hour)
+@@ -7,237 +7,321 @@
+ 					604800     ; expire (1 week)
+ 					300        ; minimum (5 minutes)
+ 					)
+-			300	RRSIG	SOA 5 2 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					L2S8qd2eLKNZZSLsCwPtfw6oDRyWSTTj9E7a
+-					7kt2uCnwCpNFFYuNSJp8NgEUkjWHO2XWbTSt
+-					gpiz4jefzxG6wiLH7LjbDCNVhljKkwIlicP2
+-					srahJ9oUGM+MdYXHKKHqAUsgzeQQi87psTQL
+-					KzDjN7dV9LfxBPXK1TybQg3ME6s= )
+-			300	RRSIG	SOA 5 2 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					HYXfJCuz0aBt+Ye/+vnk4H4EOHvhTCBB6+BE
+-					TJLzzSCuNtrOOdhftFi58IHBon10OSsbrp6W
+-					SmiCAte+JuijZ0VNK+90foCnW5qVJy/KagrV
+-					U8rhmUcL/vMsxEBHtKadu60UO0800FNi2PH2
+-					nS+VvXjM5kKA+F0HiPTaLcc9Z8Ez0sQslhmI
+-					9LHgV4kd/XvXJ5E7oJwnd0Ex5MCXUwnFjvgU
+-					t1iL7s8Lfryfy0av0y9z9+yHqRgywoyHiaF5
+-					4UtIpQeezu5MoqbLDh8w94tfiAMxGJH20JOZ
+-					ObaYPtc887wpOlh+iDNvAl2xKqce5KbGbxuV
+-					21Pm9R6zjhEFlKlcvw== )
+-			300	RRSIG	SOA 8 2 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					ICsoYt1gdoIS4d1VRon0e6DZ1c0nK3UDHlFr
+-					+or12x+W7I63ZwFz2dOtV4nW2CN44ElhkxG3
+-					wpNzy2V5XKk5uHWrc0aMttwsOq7yguu3Ieee
+-					YahgmGBzbsPmwBszuMXyIyGH21DOx3cqe38f
+-					6OT9RYiH8jYQtz7jhr/dR5eaLk3Tf54GrPQt
+-					c9ltFgwgb/Z6nkKsOTu6OnjGxCsS++hfwLM2
+-					Dp25HeLxAfdwyDqvZn+tIBgqh7+SAtfrhZEU
+-					7wv0YKD7GCuxhc1ci+CQpDuHJOSBc/Se30Kv
+-					EyPFRPCwIrH1IuVIU7SJ6UgNdDFcPGNiKmDF
+-					Sl1aeg1YIGONZtlV4g== )
++			300	RRSIG	SOA 5 2 300 (
++					20181212121212 20161010101010 516 example.sec.
++					ZUaelSGCJvMFzMaQy77tad0kbZp+dbTSPSrC
++					T3STmG8SlLx5XTU+gh9TC9gogFrBe5Yv51an
++					aMUSREyGWgjPeGQkC4nozxnvXsqC1THqjrZz
++					acHk96pKiUeLhCiqXXM3XLT7LS5dIwDQ6SUz
++					b6croHRgfwhbWakKO3Y2fjQjGxI= )
++			300	RRSIG	SOA 5 2 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					VhaLnLhWTPgDn9mxsaHekoDaoO2L2Y7nQ48/
++					Qf+LphujRkprAUB5p/FP+FCpuC0ZFi+6DEeA
++					J9DB1CRxbrefursnTnM0HIGH8qv1pC5ugCWB
++					i7St+pPPUULdxbasdVlAzEAo9L8uMx+qDl/y
++					WEo/WCrV93FTM91rvLvd/6ZYDTHaIe4Q34xF
++					5wgZ72UeYwh6yb4iCaY8BT7E85vpLnb3ljn8
++					Sh7EyctWmJFUR6rHaMliVibGmPaYAjtl6NH9
++					Lv8V0H8I++EntvLCzmrICcfr/ZHbZUUdvlyh
++					bYOhSCCbR3GEajLJ/isRJP9se5nNdmQKwOtj
++					gpjWyP5KqOZ0a+J9zw== )
++			300	RRSIG	SOA 8 2 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					JeQBLagZYcSSUcjMSKqDTitliweSc++0c/+c
++					MIbUjKIySJjFbCeDX6zaZ/R7xvCC5YR+nUVn
++					byghJZoNR7sATP5a6pT4+7u2oYOuEjryqKZm
++					Qo+KTsbcULnuyQDGMgyDtzQAoZMVSZF88AtC
++					bLKHHgQhsAPl+g+1zGgvFKyoqmzPHuCidSeq
++					y0pX8IITkES+PpqgO9VHC/orfwYiTRDdunoa
++					USPwiXUpRMXwuPH8F0/BHkf0wWnk0/9MkhZb
++					5Xmltt9L8BU/wO9tFWMMlvVH/CQX4swNxRlX
++					UNDxNBboRczWb4mbnzjJRDm8V3RYlDVIh3fi
++					pcyDncf5QtpJvKCgiA== )
++			300	RRSIG	SOA 10 2 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					JwTWJEU0r+bSc1t5KXDRo+Ykd/EjTmpD25/O
++					7X14X55IWELlUV1NKHUfGAE7JcK7HUFj4ADx
++					tKMYHU+FQRcbdzYhTLwtWLYy/kol1WHWP2Hn
++					9iCzY6Lx1ZHkrM23204osCor9q3+DIuTF2rT
++					z6uDBeSF5SHCmft9SmJWFEgI9SH02Y1GDZB8
++					FtA+EMe3pBG8o8yJOQY2soaTiKG03ZdW9Kl6
++					De6Wdfg5nDeCN2idqN5l3AH+P773gnMfuaCk
++					kRhfZ2dK++J6H/5EJ1MHd5BZ1TN71r7GSqUh
++					+sLr/Qs68ZaSdNEF3HFLZ8Dt4gW2GvigoqTQ
++					947r5ge941Cro4uP7w== )
+ 			300	NS	ns1.example.sec.
+ 			300	NS	ns2.example.sec.
+-			300	RRSIG	NS 5 2 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					Is2FN6iXMylX2qYT7PVbW3jzSwLV9egXRxN3
+-					Al8PGlBLZ55smhDdkDc64PiazFfK/u7FG6Qk
+-					cx8SCA6MEVaDALtSU6qzYYZ89X/QBmdeQCUb
+-					5pb6A7rMuvxWKZ07NAZ+M+kNBrcasVSuX7m+
+-					7+95oWQo0gnaGegpP7UTB25zpM0= )
+-			300	RRSIG	NS 5 2 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					nTskckPf0Gaj3CFbzSZXRA6uBQ3hDGPXmJT8
+-					HahnznWdnMq2w/gg0I2VSmTb8PZ84To8bGu+
+-					53hbxA1NBlAtydTFYrdh3H9qcAnP4ASJm8Pd
+-					NrXWEl6N1iGiPXUHawBpWy44MGu5mqVqUHUn
+-					tuO/ERBRNudhvp9zouLehgrtWcW5BMq2q8pK
+-					R8OZxkd4YJtbVjv/1N1yVyRGkNg6XJLqbbf9
+-					pW/btCU+JPoOJ4g6G77T5v7m7PH3yYrk4rTz
+-					97KMrLMqh6Q4pzwr/BjjAV2vs742ieo8UKKn
+-					tAL4GsBPOnd7EzFuadI37+EGrsSAHOMbnD09
+-					yp7Gnu33Ql5f4Zr63Q== )
+-			300	RRSIG	NS 8 2 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					qifctVQsOnhFpUz+d0xcVK6nNu1F2IYwrUhM
+-					H+kwNTFYJByMGmiZ8Q7ezWD/g40SOBw5T/TP
+-					xwHyXHRMr8uqbMFQsEPhAM6Ly14bj4JygnIb
+-					8iuVfnTWzNhZAJficuuLFaX5u1aJY4N9MZCD
+-					okYBI6AMIVuTI3GRQx857q1PxMdnUm5KmsAB
+-					GqwplhjhIAhHuDygJ/2ZR6aQeL8GJTF9CdmW
+-					1av2rJzOdtRfgHmU056Fof8tvB73SbW9Mhb2
+-					dECJ4vYJpp/VfywREcLzcG4EcWDmgHvNgbzs
+-					DhSEGXAj/ytIGRshPk8j8tIcHN//soqfV9dn
+-					3Xv42NZTk7xt/Q+bOw== )
++			300	RRSIG	NS 5 2 300 (
++					20181212121212 20161010101010 516 example.sec.
++					l+fqpS+kssvC9xvQ06eiXo/j4UdAYdNDET6X
++					rL/UE5RLQMT1F+n4lqFawdGEFisSF9LszgRo
++					xS67wAHx5lrm6cfOwkVsRRL7isA/tM/RYaFS
++					4M0LqTuoM3pPIUr9qbFfGFRPW0IW198q2KMd
++					pPveE8yc3AlJvaqh2/KzHNPrzUQ= )
++			300	RRSIG	NS 5 2 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					zU6ylvFVb7xbpUbGbCwgA0xRLt/J4iZ+qYSg
++					93c1IN3tkNEJkcnbkJfTwxG2kpgAdOU782tY
++					lOyNMyT9sujFVSsdMxGz4MB5x2wefaznuJRc
++					ERGwfwxGY2Bdwe4z1/OGQhU/wppuukOR4n3P
++					WihMo2v04TqcY8lNahglBjvKYLPDWRiW1xJI
++					XfQg5A0pha09ykfjaDmMyvUZ1BtnWtk0r8N6
++					gVXDuaSWc3fqS0lcRew4PW6D37Hr0Dk4uFnx
++					zNHY2QkejV1+FCRhZjVWzX4ycyIEHqXprWed
++					iXnIiNdR2oYfoP8uRaSpoIhYzaXtfSvtXLQ6
++					KgHjjsi0LC1sb3N52g== )
++			300	RRSIG	NS 8 2 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					uHjuwG8FbPQqBkDSCaL5FIBq7tLnIPII7vGU
++					dLN07Fb8jrCqYKiYtBWXn44JSRnhr+lJsbrh
++					qTUkKmqL/jBSQwwv5nWs+Xq93/FHfzBLsM0b
++					2YDVTCbFYY0ui0TU2BDmdkCeQbmcQXPI6Oer
++					l5GILqLmlsnW5ka/jBA3j3jUBRFtVM2uTKTZ
++					XUkzQAhA3F63UfnVaZUwA79ix53BvmnefD19
++					V6yJ2fCs5Prw3jWtvQCz4qDOM+MnNmxeIYZQ
++					jL/iW62FadgScYPSq0pPYYCJbPTMJUnTlfsa
++					L2DRZ7D496e7XvgjP7yui+V9s5E+3/3fOZmw
++					9hVp2SL65Esw48lmQg== )
++			300	RRSIG	NS 10 2 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					RqC1fn5PA7hDmsv8/ZywJWMGF5NJAsCHZbs/
++					0619xJe62kVDzky2pIT7C5XiDRwAdpvZeCh4
++					0CRYA6ejFqQLai3oVuvcZFSenQJNmRxzuH/Z
++					2hq84kGz/3bsEL/GQd3zyL9mNO7xgm56dm7m
++					q+UIxNwx8FFOVVUBKSSDjsnCVNTZKYmwIZV3
++					L2KdaKwOn6Jl4g4ZKuFlKyPadJM8tAO+Gjd6
++					YJksXWWIiOoqpNwuh/S/9G9iveWxziHM35yu
++					8Fs3Ty1oYSKnzWSDgfFfnKeGelcgNk/9KB8f
++					8OHUWAApgWc2qbSxlhrs5McTKyhcdBAnqzbK
++					WjgUVosg4Jnjn6mkzg== )
+ 			300	A	3.4.5.6
+-			300	RRSIG	A 5 2 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					REruNlWPhPdn0OwDISrhCIYEHLpL/9RrAAAl
+-					JNlCRluGECUt4pKGBcNYsFl/BCu0ZSaGu0ol
+-					c5gvD9CsP92HoiWhFjmJG8epEiblcUnQmYfK
+-					cfqhRxb4Pwvaw5eP/p5ysBhhJhcklLs0eETu
+-					UsqFT0LbnDHkLZL7SX0EvlMCNWY= )
+-			300	RRSIG	A 5 2 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					Zs9ZU25qM+2tWswmMNbByYvJmFdC/x1Hzc0E
+-					5kdb5Z7x8Su7Qir+sINQtqZ/CmPextOV746c
+-					bgH5Yax+G9sCJK7ssVQaCsNB4rcECELDpQRP
+-					6ca7+dOQ3pMGX5a6FGO+b3zucLdexkWf9VKo
+-					zS0BTnjDl9R0sVr1FaN29YbjtRJpO65UVfKV
+-					FkYFIaBQCS+E5/cLzTzI6iP8ZThhzgDd6Mux
+-					cHxqGtb0fXKP5igpEcUHwh/+G5h5RthvSCn1
+-					nlo35njMb4UR7q5WPUSrHCv1LB2KdqxHBq5u
+-					ckS96/q2X/grY4NnFr8f02+ZwhHy77VqPcpL
+-					SKoobHQkkMSaY8F6ww== )
+-			300	RRSIG	A 8 2 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					iYrO6bkdXX4d8SU6yay5yY1rm3RPcr6eQSbv
+-					NIZSiP4T9oM96uEXTeVt52RNFSH5E3FPctBY
+-					LJ4wgga8MemwCNi3N+SLtIKQztAFb1TxgrF4
+-					1tJXnNEtsMSpJFxNSSDDWye1BgAMF6IE99Jb
+-					dGWGm+n/GV/UOCZrHTJs7cI+LtDgxJq+3dys
+-					ZD+ZO2uncAm0Z7o93HQqHpNzmZmhNOy6RTaC
+-					D2RIPo4fwSfI8LmbvOpCOUhdU8cKv/ruhuaW
+-					g9163lz3Nyxj30S2TX1Aj6QDAZbGYgi+t+Q8
+-					ad1dOqTam5DZx3ksjyjGDz4UEufJKFa7SG5E
+-					UGLnRHbWGLZaMcGxcw== )
++			300	RRSIG	A 5 2 300 (
++					20181212121212 20161010101010 516 example.sec.
++					q9IkSE8SR3e6sFKsFyHl82mKw1yDvlnHEUnH
++					T3dHAyymmteFobaCSQqLTf7yWu8yu65kam8c
++					g8vUm+VLDEeqAlXTXqDlNcUhPsIYQbHvdSr/
++					4toES5X9eWZL3Qrcjjn5qarpIcz3woiD6d2I
++					CHmeUgyU4ZCfgKp7kX2bmSj7a6c= )
++			300	RRSIG	A 5 2 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					ZKGRCTHYjDBFSHJ2tyeo0kUhJaUdKgpO3CPx
++					EYtOak3I4HBFUn20GvxV6gA04g6wqWUzJlmt
++					1vzW/x954Fbz5Xz6N3JDFMmNRdXcqFqpGTXL
++					zuGyMA2yo3O3sFUXOl9Yp1P6/LDApHS6teJo
++					Kt8Cibn++ZrcgV9iF2cc8i3e0KJ/14LexPSw
++					d39iokwrc0K5FECT8BhQ1Tv8uuDjOOA5WOQr
++					9cslS2bR96gcBXHCVF9IA2ZfgUvpbGvYX7gI
++					93Ke5wWxfT7QQkhP7Ux0ulEsNVXTxbDkqgJV
++					5CsyxBOKQDWCc5iQ/IgQY2N9BW8sd9lZ+lgl
++					XoFm3smgQQBd9lt4VQ== )
++			300	RRSIG	A 8 2 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					qfWdvC+YOs8XEdMzPOgk3QeWMH5pLTy6Emea
++					k53wChLO5J11ZVGRsILxP7ewn0VFmI+nzD5t
++					QTvhSeaJlotPkgGaL6UOZ1SKQ2TurGbU0zpO
++					/YkSTCGg9trliIPSafs6NEQrXCtyG889H8GZ
++					pCZJ5YhNz22/F9/0vOfGrVlA9ZCLYOOwlx0t
++					Um8cmyzWqOud7Et0AzF1t1D78iPxJ21/E0IE
++					T36lf14IsoJNkcSZcEEg8Rc27vSQsBSUfIFh
++					mjSmLmnHRwsAG26XqJ7enaGw2lq0XDDMzaFI
++					MvdTfsmmUmhXXLUyuLPtYURYkgCvygI4uZas
++					2xs74kWMFcRY4UxTRw== )
++			300	RRSIG	A 10 2 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					dunBRK95/L3G4kIgV05yUMk4KeM1kuwpmtMe
++					DpMxGCt4sG7M43zmcTN4lvcBPVu+pJUPmiFb
++					3DnF0+R/9wEpy06s4ldITPCxRZnfNpYZowUk
++					ThrnO6GK3CC7E3Z89l4p9waBb45Ej3igEZ0S
++					8s4RNQhgKUdEnmx8uR9Qhzg0Ep48saui7vrv
++					gsmf6xLopwcyaIRYaKzhmI8aAeBSE22Dh3hd
++					x/Pp1W60r0ZHUcH9r+p8dpaesbSvRWbhKuBc
++					TUSEaL5adDUVLLfa17+waGlZOFRHX92P83zH
++					ChaLEKBDJt0RRversJ+fzFwRfxELYlOyYzD5
++					qqVmnfrd+adA7SuQHg== )
+ 			300	MX	5 mail.example.sec.
+-			300	RRSIG	MX 5 2 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					gcagSolgEmDVIc5cU08Zt4K7abuJ5aXWxWbB
+-					xe4F6fz2slHoG09n8WUxUz4duF4omLAtnuB+
+-					uW+79fdn7p+EwhzBZ8ds8WIlGSdtI5edU6cA
+-					A5SL2msnLqv512puF1wXxrVoNYBdkcBgFjlR
+-					VLpKMhBZR6dsYkr552R0qcJP0UQ= )
+-			300	RRSIG	MX 5 2 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					XXsoPIEF4nldBqzujYDPNefWYdo2BO31uXli
+-					nTd+bjPT5S5fhBcTGqWSSOW2/hTTdEjhd7sA
+-					9crpwCNex1BV4WySdsctwwwxSi/uQDbV4Ld4
+-					GBtef94RFwtAiDs4kE7J8LjDrM10DKmQxTTi
+-					KCU6u8LRyQCTS8f2XcX0HnM9z41z0y7USNz/
+-					WTAJa0e4lVXv4wMPfQRel8TAgBc9RNUg9qyd
+-					c8JFGlpxL09tXA7n6LvBoqHFDZSHf2eSBwDk
+-					2fwsqHw1FF1fcMkAvsv2R8P0yv+oJkbT5Dv8
+-					AKzyw2OVTBygImCZpREtz3OBs8R4vSN6RF1K
+-					HTEnfuPVunKd89zctA== )
+-			300	RRSIG	MX 8 2 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					qcDxTb50zfqGgiIsk8x+0pDm6AAFdCXy1+Oa
+-					i3SfnVrUYKp+BUvvPPZasEj5+19O0Ih1jdPu
+-					2zB/Af7jS0pp2LwdN5dh2fJGvf4yId1sZfD+
+-					FjwRXli+F2MP+S9cEqiICk0aknEH8wEHNjJl
+-					DkxtCWtYvfbNOJ15PhtgspolbDh+WKNgq0fA
+-					JcCqkyaZIIQvV2YITqzXDHH0K+jZEqVIfa4m
+-					SCbYidkbBkeX1JsaY/RX0u4mM/CcugGfrVdL
+-					PxfeIZDJh9qJ+WxjR/tVSs1mhOBRTeBzlS3m
+-					zNnlHJovqj1KRPFaNWu2Bg7V/9cQMr7HnoyB
+-					hUkYh17aBRxZA50ttw== )
++			300	RRSIG	MX 5 2 300 (
++					20181212121212 20161010101010 516 example.sec.
++					j6ABEspumt737VkKITDnM6TZ3hyGqUsKQDsb
++					yHl2FEoebBXr37+6e/0WvoH1NFovuM1PEDTL
++					lwJvv/YdNHgUmNphP581vUQter9/xMJXLwBR
++					3BHcV3r1+djzRIJ1m4ZUXQ9Ph+B4hkL08/cy
++					QSiVR7FHEMLS63nVyo/YKhvMLWE= )
++			300	RRSIG	MX 5 2 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					qbcrNIqYGCAMB9+lVjpx+P8yAn43Y19uYbIa
++					YQza9Vf2d7p6cosbcONv0j2WjTTImXbvooot
++					RYyLHrwD9NwBMxhH4KD8am/tsgGouX6Bz7Nx
++					kglq9UbRSRDybtEXbbSRXHh5WqGdifzmvKMT
++					036OX6FwLoKLOvgHcEx+CyiW9Ype10LIhkpY
++					VMedUPynLpXX8q3wqDOW3dK8XxEMQAr4/FYU
++					pVj4cySRQTygwOfFHpLI5yPsm5VuWNLQ1TKX
++					gLuDZfWLxrBQr/xK3RdVWTACo11JW1BDsRKQ
++					DNjHbcng7SOFzkYzgV+BnMXy8n0gXqnL+718
++					PffuMjRCkljCibvklA== )
++			300	RRSIG	MX 8 2 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					yf1HatMaCU0CDEaCgtYKYzF4DlpnOBLQTHdX
++					tn3Lh6unhrn39WlHivLzDoWksGuE3HI/z831
++					iRT7iG85aqRlgQpX8nldszwKQMC7KUh0R9nL
++					dsLZvHhEmUduo8dudHuGEcAjDUw2M0dT2ReR
++					wLZb0wiGowmDTT2u3RhHsSW3hDYf9KVsQBf2
++					G4ax7Oa2jdc/1y/hFJJGuJ4RmADMKGBKwgU3
++					LQyvr12onH+SomYv7Wufa+IKxwLVVHRcP1+X
++					yx9vTixTcTJc5iNKxa7bZwVwtK9HRYSxlbF/
++					6T4+JX6RFcY0pWwFfvkNl15NPqTZyiYJzdr3
++					5xcOWMMnvD7oVygz4g== )
++			300	RRSIG	MX 10 2 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					AgetqsB/CZ/UjSj06mTeO1WM1UzfUxmuKIe3
++					Ls+P1yYJBwv7S03HO62uuuU3c2cvcv2S/vR4
++					bAeU8cS80cz05xQHMOvyvU5qesJuSM7/x6n1
++					MV2rnr68KxlFev/ihZTDxY/VNykr0Zh+abNq
++					aYrXROCjMak5XY7GJtxhhC/guZWTHKaYYMW7
++					7AyD/KJQy3t4horHs1qRMLYVaB/Hmg4wlNwh
++					HMvqfyQpPtKvq6fUX9DBo1WxAmkoJQ8C5VG8
++					P84IlLD4raAPpmKeb1k+Y9uh3mU5CTNrYluX
++					mgVTyqQljzutS8efQLwU38turMxqgFdABEdT
++					4Fov31RylTYYHCpq8A== )
+ 			300	TXT	"Responsible person"
+-			300	RRSIG	TXT 5 2 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					W5OGt0M32rE9ap4wt0EOv2XYrHNL82jXfUHE
+-					f/NlLZBTrsZgOtv/kUig/mfynYY9UT+Nabrk
+-					GZ354v41yoMjRs8T8xYPW5d4U3CkeIGldzoj
+-					ccJYgvbd0kfirTLnFozQmq/NZ6XPDeSUvmPI
+-					zNzyu5MWG97toTkXWXwcoEcNOZw= )
+-			300	RRSIG	TXT 5 2 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					inApW4wPqSfEMEHSrT+X9yJt/V9GJdSu4h8r
+-					QvZurxth3xyqOezB1fdffF3Z37wd2tDdCwj4
+-					f9vuTNlFYjVaQe5Q8555tnEpVTOjXxwe7FfP
+-					cPGJEj4ufh2R+k5PDLqLiom9HZuFMR7qO6+K
+-					iSHbnThFCwN99hX70YtHxlv+tohZdHpRJ+4+
+-					68bRfMkZ15gQLDRcaXG83zN4QBup/n73eSsw
+-					zWPi6ZUuMbK7tKXqLNupXS00QsIqhe4AucP4
+-					7bjlHLo6a0g4ds73l6LSHr6Mxow968mM0dQ/
+-					Uxhg6o4dFujGNjwEzv5bQ1LFnhgOyh2MG9ue
+-					DgOl1BUANskW35uuoQ== )
+-			300	RRSIG	TXT 8 2 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					QRfJNke6ca9HqkTzuIreT7bMmNbrEas3mArh
+-					K84gox4s4Y0Ud7JPn4iusX7JyaIsY5Yzbmr6
+-					BtfHTM0DFC8WgCdO6i37l/illpJOJ1TEZ7Cs
+-					CT/HUSOVxvpOS94T2hEoDXzDZbnBhm0mRERC
+-					N7VWoio5zxzX7Gn/iyNeJiYOzyayKPQoOyrO
+-					KgfvlWnbk8MsN4a/KVHYAZ7xEYDCbWNw17dE
+-					zP49wVJTNK6mQ/inKXnzmdk2QVBoNhE+OPHo
+-					owIUzavwBUI0MiFMFtD9OULrH9JU+t2wja/u
+-					VNzHjz+i1Ka2u1Y879b1RHCTFcDaH725H6rN
+-					kQSSwyiCC5yemHP9Jw== )
++			300	RRSIG	TXT 5 2 300 (
++					20181212121212 20161010101010 516 example.sec.
++					hOqntsY0coi126BO7dw/eTlLhiVA1DDo7/cY
++					MHxaPAxvLpU2QPkvgie5T1eNwvJoezQPqieW
++					QA21Naq0hH4x4YAPSDVwhDmKQ7bZJm7HeWxE
++					EAA3TIr2tic5FI7kqhHeczvYX9CIB7lMA3Jv
++					kH7xUYJrBLO15f7vrEV7yifJX6Y= )
++			300	RRSIG	TXT 5 2 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					VoRm9hszby6JmfJ7rAhTTvsR3C78pkJVy63a
++					Xi+Bx6q78hXFE9bGKW6qBqKxG2f6j3S+z+Na
++					UL7QtlcYNLKVWgvaQK137pDFZMMWTp7tWYEm
++					Omgxn3+2f+JWT/unaPWcmphlfl7fCEYqSkOs
++					1YYTnVuDXf91TNo+mOwMVKWu2gg7WR0jp+Ky
++					f1/2jm9jt8zv/0vlbOcMP5DqLU6ajF2Lqh0R
++					e2gr3812E3QigpG92E3Eq3H+mZUKdzuBqHec
++					B2j1iKEqfGpykLkzblvuzEUY1AL6nrOYvxkE
++					4SnW7B09qh1A3opM0y3XZGm/DY+fjq32PC6A
++					DHTdTuz+ftk6tOMMKw== )
++			300	RRSIG	TXT 8 2 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					V6tkO6CFnsbBXhDYWuEnppbtLN62nD9q8LVw
++					fAv6/jRAfw9+gJw3rUNaFg9sFwjhK4wY7FZj
++					+JbUDX7izurv5udlORXkdMODC874kVdrbJ1q
++					sE0JMu6lrzmi6PopiYeb7AEduXFJzktFIaio
++					dCbhu9ZY3k0s7Z1Aox6cVzYH+KljAgvrsItJ
++					olPKJpPajjZGJeS7LMxIcuLs3+LMfVl27Ehj
++					Z8PBfomJ5AXShwdCJ8BzyD2ue3L0HKnMLG86
++					+zTPVrjq+d+bxP4YfkYlpHQQ0cO1U0CkVlAz
++					2yw006HbE5n9hjyLwNu+p51eDWBo57LHrxO/
++					CkM5kIxNl7fyq2T7JQ== )
++			300	RRSIG	TXT 10 2 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					fC7OMWgo/mj4cPKb19Npao6fPdso8/9zhLjN
++					YAN8D3bTeAoioW3rJTCM6Jejx/KfPaXDyQ3u
++					JeBO5xC5rGuE/RpGphVmJOp/2kFvlamqoP1R
++					PgKfQC7lOcIQlr+LEE5FSUwLRgWsgeQS0waI
++					AiWbdH+X+lFPBl8Els99WWcG95VzzMqC9r5g
++					FB85E3LkLqLWoX+NJNGHVnA4c5M9m/OKBdF/
++					4BckVUbGYx0piazHcCEvPQC1vYoxvBw7U6ac
++					fz6vmYzNEBE+YAQi0bCSEjWxWDP/Qhl2UBBU
++					OuyKFo1TteeBnvPSkGU8YludcfYHOMyIlSCS
++					pgCM7uEM5PUAka1zmg== )
+ 			300	RP	some.mail.box.example.sec. example.sec.
+-			300	RRSIG	RP 5 2 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					JuqZzfAFhs9gBrCGKSQPmq2cOzZSum4PzvfL
+-					mCXjZg5zYXZUoW3HKboRpCIkQzuKKZWJC4PA
+-					jWau/6mZCE1Fsk33AqkHB18mn+06fPtmFAZY
+-					UyRjfWmbyoKzqewbfLrCzdwqjfAVQEhCjPfl
+-					jarWyvCYn155l8dW/oW3/ib/d84= )
+-			300	RRSIG	RP 5 2 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					HfYsVtUxudMxdmeRXfXpjoJx7700b938l0GC
+-					rjHmH054yb7r/gwvQT/7ZSglHRiCeLINtu0u
+-					K+3ejMaADM1SIUS2X0/K/Wv9wO8i826CHjp/
+-					EZ0X4GQLMKMqgvgpzVYldA1Vh2XUkPswu9Xi
+-					/zvp/5SrjBPEAD7QlyO6M5odBvqIGUv4ZIJR
+-					U6QaQakv0RB+gb1DLOwqwutpyPUZehMEGeIn
+-					SnSZZwq1KUyS0Cma3KNC4aYUL/SboSeBEHPq
+-					SXG8ueXAPNoa5fDP1DuiOB5haW4yomuRa0as
+-					wBaFLcjw2tD5jDNwvLfUxB8QpslaUY+Js2M2
+-					F2m13hC8T8eZ6pC9zA== )
+-			300	RRSIG	RP 8 2 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					BfTyse4P2G1V/6L6JNZlEKT4OpNEXw4zIIDf
+-					xz1iMdFHyDCng53xlDrm4VLCcjkzMmllaPid
+-					HtZ65SfHpdJncaLFsFSSmeiSg/UAe485LSmD
+-					KGgTxCHBmFT+FFoFkimbn8L2Jr7V2FQQ2ILB
+-					/CAuWpBSogX5N6vssiLEbVcfIQlWzqod1qV4
+-					TPC0xNinSmtD0eTep1L4ZVGJHq8ZI/+Mzzrp
+-					RvUCyWEEAD2H9BBxhXY/D/qHeQsvpFVsJUwY
+-					cahL/AIjdbksEMjkw/KDNTs6WZWRluskvVy9
+-					NfkzBioZk0xGzryV8xfiBNbdVkei708PZDyE
+-					BfNPJodoCmqHS0w+Pw== )
+-			300	NSEC	alias.example.sec. A NS SOA MX TXT RP RRSIG NSEC DNSKEY SPF
+-			300	RRSIG	NSEC 5 2 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					Q1MtdC/FeeI0yxUEuR2yE9LHjPdKttjFUPic
+-					BpX7FaxE0YKgk3rlodPoL5dRz3rQWI7I1Wfl
+-					EPQKOIZTWIFrRvjbDamwnsa25m8CCvIMUpbQ
+-					CvuDHn5ycbpbEpaHfJi17sCylGoj3niCehwg
+-					h/uOOigKQHLQK8DTgN0e0Ddxv9U= )
+-			300	RRSIG	NSEC 5 2 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					bTXEqJah647l0EOnVO6SXO/XIJ3bQcFN/Ci1
+-					jFvtPipkyk2pQvkwuWlRUyt8ip4fjuHgCDPK
+-					D7ODTzMEiHVZNuh7bSv7LoW7bpM11ie5qnO6
+-					TfyOYcHjR2lYHcDNjwGTUjadN8yiAFUBAXNq
+-					84h34yKA3slx5DQLaNoA5a7XWr0ODsslDll+
+-					Of9EwBGhjHvlyiJrXT3VMUg/SBGndxoIZrtN
+-					CGON0mkNI1Pk/ZSqyib29N1U8POiP/wPAz1C
+-					phG7IAlc6PUMiXegNDanaWQuPhOI4uV+f0tV
+-					ZDFa/9mIAgF3rZC0mqHDk3h0GjJn/Ocbp4sg
+-					RoGUCOcPuZnLlyJ9tw== )
+-			300	RRSIG	NSEC 8 2 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					g9vjezK5ony2cpKX7v/ISk/XEW9VHFUd99pH
+-					4QV6SrX3J1OVQ5PzrKCyN/Ak1gWSVrETtIfv
+-					fLpvxHxBR8EWZdunUUTi0ElrhVY0xW/UT+/s
+-					GjaCTcuTHRhw/ee4bdcE8aH3S5FCFzZPa10E
+-					w8K597UiFyzZUF/LqjXqSoI0fUvRTSwMQ/ZV
+-					AoNtBi/3dP6ItrvIirJLMdI8QXR/X2segPyW
+-					DnVfK4m6OzyNbcAV/9NaycsU2L6MiUpwPTNy
+-					um5LdGwiUJXfVRMbD5+CI/UaXhozoNbAoy5K
+-					1Zr7mZzjl9l8a3WAkeAUWxT9H1xLWX9ux0FC
+-					yO1REofyVJ0WPnGKJg== )
++			300	RRSIG	RP 5 2 300 (
++					20181212121212 20161010101010 516 example.sec.
++					Po+c+7fuZHTa+aFAWg+6Jf7zkmr3qrISwh0n
++					8sX+b0D1lS51TSH9ehLDSYjzVEJdGpkvun8L
++					CfapnT2cqFvRZ2KN+7UBEbRjCdIYSfLvDWaC
++					9hqglmtxuKcH6mR3cbBFbB5x3qm3qQBh4CL3
++					5g/VH3btSpfLA5wq7DKJw4iEHB0= )
++			300	RRSIG	RP 5 2 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					KMiPSeGt1Go/WLm2Gzs3F9SNXtm2dndVRlfl
++					qvgNlyx/fpzNvW6DI0fLeTTTrZZy/nDsRgbr
++					AbEqO7aCV1wQbGb+dZLGyyNp+VUkN4fbzgt4
++					yH0mYU5ba0e0Uktpnx7PZMdbzfcK6C1riNBi
++					M5B9hFphPcLZp7INI5JmfsZaWIKEOGrSCq6I
++					rKVrt9XA1m0lL3Wo7e3W8bz9xw9WKhObvdv7
++					Txx3b/ofL/PQBFiM2DLq7aJq+7BzLQ37UxqI
++					mfbup3qpUPON6kKmMmY5PTTg5XdNcOqgTRzs
++					3eXVJOkiXCaxnhMGZjPJJUOegRSpAguO5avE
++					3qIoqGFSZy+WXuDzxg== )
++			300	RRSIG	RP 8 2 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					yGFkdmcp30W22O5x3rQ+mIBM0JUZUyAUKN8R
++					9RK1RAqw4BWmUwH5ZY5srve7QGirPNQSU+sr
++					lUZ5dwOrqqd3wfqfhQsnovfsnXdrDOcpt2Nj
++					VJWnFY8uyUAfSPhhSPgOnzRJtV7WniV8G/vM
++					6ctiwxQQZKigKEiPMAj61AO9nZgiR/Jp3Xav
++					yg8aeQvdPJ9TQF6xxlcRwfAINO1Ba3twvOp/
++					t+nEETzM/KLyxy9QRh2WaosxdB8seDOoFvW2
++					CU/z3ALKzwYtbNjxFNkJBfJqYl3GH+rf/V3X
++					rO0hqk/GptdPtQ0Vi0F9H3adMUYpCavAE9Dm
++					slXrCvKeq6b+16f+Xg== )
++			300	RRSIG	RP 10 2 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					DW/0qQc6HV/qEEjmi7c3blTZAUajQT8Wll45
++					ASYH4rqfwwTgHt9zSujALbDLuvN4Hi5z6qu/
++					2xTGfnXj96YTvjYf7FHBWuCk/TH32bbo30zJ
++					SHK+tWJmeMvUg4WnIgutXlbH0veGw/dYXyn0
++					UuTX2K1kJvDNl76AaaqfRjF5jMXLQdJ8/115
++					jRRC2t/xcuPQfzzPmFlTWG8yzjYQ4v2q74T9
++					6W4r03tbvuLXlfC3+OBbyqQLCIIvgt2nmffW
++					IHuLZZm67TD/XdMbeZ4Skqlx/WjrIs6kOZGf
++					1f4T+fUmq4SDzbTw7qZ/wpC7a/FMoewKshJz
++					CLI5G6UHTnuq098zvQ== )
++			300	NSEC	alias.example.sec. A NS SOA MX TXT RP RRSIG NSEC DNSKEY CDS CDNSKEY SPF CAA
++			300	RRSIG	NSEC 5 2 300 (
++					20181212121212 20161010101010 516 example.sec.
++					A6DDPO48A6D8JjqHyvCPkPshwnEHzbfIQFtw
++					2+U+JGmN/b2/73aCZfKoF7sOS/hTv1hOwFX3
++					OJGMeDATZrQBdpuWEZmsxnJkOXTg+0cSrAsU
++					9WfsJqPcP+9uy7vyUuNTjCodjqTblFlAugTB
++					r8BpDsXhD805y7/2pY9k1niJ7iU= )
++			300	RRSIG	NSEC 5 2 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					pKsw4iVWwNUEdboHCHS4yeatbMSHHJY+ZTp1
++					6lJUSVfaT5a0dnQul47LUCXJJ+E/pUl8G9ZA
++					O9XztxGh+4ixHpPDyro8QTkj8FQU/V5dZGFr
++					56NwBTHGJTI5RgAtIPmPJaeuW6OCfQscGSwE
++					cfatGz+qCc7aK6ePVsFeT5yOD7+yutfmSgzr
++					gpRn+NJLR76NBTf3rzIIisICXens1A2GtKUZ
++					AuWmSRrp+wNBTpvKljRyyCZMd0rjTUCf7ZfM
++					QiEMFBTXUEDZskHWx2fjVi3BtRtIUHXONrNX
++					SAFQKqWDIQbegyQPhC9UWfqHaySU6Y7fj4C1
++					u2e1kRAnAbeB3pmRhg== )
++			300	RRSIG	NSEC 8 2 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					VW+L1LdmUkZTXASOdkCS6536gjj2cy0aVYk2
++					nMAJG409aub4yKuwEnZWQZ9w95+RClowHZAA
++					yjTW1vkANKbc/UYsIf3zZw5t6wcVDy31q/rm
++					7juWmR7vQOmLYlsQfKjki5qBf6OuFwr/h5G0
++					SNwcJjnAE0puBYzhhpTrcU9YIzkgxJFdnZii
++					150z9V8EYr57R1HYRoSnVHx80KieBUilWT9V
++					EUkKAqrlKg0fXTYRlLmltWDt5BC8sg1MmbMJ
++					OwpNalmX761h7anEuIvWFSTtGHDDrwa5DDFq
++					fEfV4c1WeqtfIe+wLyqPHrN7X2X0jcZYWOjx
++					eyKHIEi3aUNDdzTVVA== )
++			300	RRSIG	NSEC 10 2 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					Hd8cbN+6kNpmQCAtjTIZC+hv8nqe7uh7bz8/
++					BczipNlRYc5TQ8pdK0acwWTHZxNjmC9RlKzA
++					PTDGWmQHx2JmDSJ9aZxaA+xMfPZF5jc/Rn4G
++					0Escxw4wCtITQn12adpm2EVJGp2uSQLm+W12
++					o9ekxuVrJhKHpjqcYBNdcgDy7xD1pKVCJtKE
++					cTeTAfTb+scRdpFJhjs12DhUdwaAcHAKxnbf
++					EeW4yshT/UdvjD86Vb2BBySrLVtHqt2szk6o
++					2ed/gMMvcFaaBQ7dVxv5dQcGqb3XjYV5RZ/t
++					RAqCGyo27eBkWdLVzu5WR2JIpgusUwULkNFl
++					vP/trHJpqbLnRUayVw== )
+ 			300	DNSKEY	256 3 5 (
+ 					AwEAAbqjCxtmin71unORku1IrrQx2S49KTmw
+ 					45jnlNdreCH40YmhDZo26CMiVXbq29rvUDW+
+ 					ZEJqVT5fd5GrA1wEEGbrudd2LDr5AedBK7fY
+ 					TsZf/LEm32/Bu//KzynrJqyB4HSN3GIPbp3K
+ 					YyY/Hl7HawOvWAd+tUHgUtes4trE/4pr
+-					) ; key id = 516
++					) ; ZSK; alg = RSASHA1 ; key id = 516
+ 			300	DNSKEY	256 3 5 (
+ 					AwEAAeluubFtl7Qtw4TpuZl85abGI+HXO4ag
+ 					qzv1kSLQ5tkYFGdpZyZwQcBU2znMrdw03o6d
+@@ -249,7 +333,7 @@
+ 					t8er3cZ1y62yOSbPK0SlouSRplbz+ezNyqD3
+ 					c5zvz6F2AcZ4NqaTZOMWZbOowujQj3FxElaZ
+ 					S+/ughQZKq3OtMN8bqc0tZ0=
+-					) ; key id = 44427
++					) ; ZSK; alg = RSASHA1 ; key id = 44427
+ 			300	DNSKEY	256 3 8 (
+ 					AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27
+ 					3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe
+@@ -261,7 +345,7 @@
+ 					PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/
+ 					byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01
+ 					u8SJYP6ULwx0mZ0p5BmoMH8=
+-					) ; key id = 48381
++					) ; ZSK; alg = RSASHA256 ; key id = 48381
+ 			300	DNSKEY	256 3 10 (
+ 					AwEAAcZdPacjnWNuQKCF8CPmUW1/NUxI/G7x
+ 					dbwrU9lOuAD3sw14rLw2NTzpbC/bubt2aHQ0
+@@ -273,504 +357,824 @@
+ 					knECGC8L/9o/R1zfSzSN+ay+dI45t+jOOLgW
+ 					p5gmjsI/mXhoO6GqX8rbZoV7/DQyAR5rATJH
+ 					W1eausJhOgE2wBJgl6V0XbM=
+-					) ; key id = 1862
+-			300	RRSIG	DNSKEY 5 2 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					RK/yubKLU0d+bs9z+qzPSNA+mSn+7Q7zDff+
+-					uAzcd4tD0QvVO8jIQaVAxVWOfenQ0tovTzXH
+-					39VuRH52UW0i4a9ylxlq1HFv96f9wsV6wGEb
+-					sNGGMebDESHUkfMLIiZzAx7hmjX+YjlrYLEY
+-					chOaBsoYc4pEtmWLHSL3Qc7TCxU= )
+-			300	RRSIG	DNSKEY 5 2 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					DM9TZSWvwPIKkg2oB7NDRqpDMYGvl3sX3/BZ
+-					2MALATpbDPQqJt+4b2837rjXPR7hP6cGTl0l
+-					kjRc/wSqG8scYqQzhcUJ/j76jtFVwwggPycD
+-					u0pgzl9h8lvR7pFAEKlQHUz+MXtVs51eq3GQ
+-					NgqFVd2Nze717phEJJF0Vpw05jsZzqokl8Ep
+-					/Dps27AslVY9vyg8ZNfJ3rgCl/zSsAcuBVfv
+-					22+t0Y/crI76AxhqHIgxjyoQ3Bd2pXKU/1Dn
+-					PI9Igw+1TzeKXoGQEHkN3ij+J8dL62EUgR27
+-					RIFl3X4U2snEaznDXZdGd5x0Q1uv6V6+g1T+
+-					rx3gnmitBrDbrhnV4g== )
+-			300	RRSIG	DNSKEY 8 2 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					lepL7TovQDjJN5c2g9jMnrOUqljp6qrVjmeG
+-					nSTWiTbxItUMzx6nWx+I44u8j9bpUYcPnx9T
+-					HZBjOtGTqzDx6eepB0mWoUbqkUsj2dk9r/F5
+-					uSx/I75XeT7vma52K3TLTua5AsYwaXYFOoX0
+-					rXWRS5rlCY4FeK5TZUgfjvLYQAFrvonRtVcW
+-					Tk/BdmDkKgvWm2FbJmCBEhQj5q6V8dIXnGPn
+-					d/7mRQ0OmnQtqKIMzWhdD9Lpkfda9B6vzmln
+-					tvOAUcHMgG9PGrEDAW/pp42douc2u0nDdpaA
+-					0UkIFm60cDmMuDM8TOXZJQ2l6uLQGNiAWrsi
+-					z3e/fFbUIkccz2LxVg== )
++					) ; ZSK; alg = RSASHA512 ; key id = 1862
++			300	RRSIG	DNSKEY 5 2 300 (
++					20181212121212 20161010101010 516 example.sec.
++					P4ilLbwbloDRSZMw3dHOXE2Zg/dNB6VmDPRN
++					8jppzAKtKWHnZ83fsPeF35PvK2paDN2kFib5
++					R+tcXaLVi5h97QacHoPhoqEujX9KdHkLG9yg
++					vuJJvTgMDaKyzZPMTYUifKlzIGD4y4ChixO/
++					d6HUDFMrh7/5/8kpVRxndGotgSI= )
++			300	RRSIG	DNSKEY 5 2 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					YxpolCqYSlVhnOl82FFEdaGDj9KEkfl3+x0z
++					gHhGZ8Sbaa3MTFE6C2tsYJF3f+wsvKE/q6mH
++					WrGalB7BAaDFOmwRmjfV0DNA0MpN5h42yHJE
++					5y9GXJt+5V1VXj1LdXKLLWAkNPitnrpNoB0U
++					Ysk4X5tvcq1KrHrRH5FG6qhxaqs2TY5EFhJf
++					HFPnLfSSOoWEADIhwoTCDtQ1EimNA/PXp45f
++					Wh3Sb1TZZnJEXpvO55ZIMkeThZje5eQbhd5E
++					LBol46Olx9qnCenBMuQV4JNt8u5Q+/Kznwll
++					DVTeiRYfPEUYcEMtZrkTu5zbk19lgonPFI1h
++					dBUv5/WqV80cQCq9Kg== )
++			300	RRSIG	DNSKEY 8 2 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					1TfsvBo16W3Lu9h07C0n1KmRu+tOiwzQYccB
++					hTUWq34DeYLM3gZ1GLRzh4agva7bo9XeNZ+2
++					F5MoHgZE+DZbGxAVWbPcL1Eg6KB251PtEqFA
++					4z/Dm8VOLRWohucVwAEQOOLqDoV6pPCTYSRF
++					TRwuUcvwENzfHRNWIergssL1CzybyCmbHZiL
++					x1NI5yZrkioHDFxO8XELJIOqJmBkXiCgEQoH
++					TuBOl43ulF7vu/ZCvHKHTVdNRKacxd2+YXno
++					tlGxXp/9GdJiLqwfNqXb2eYCi9RPwIt59ggW
++					2v45h/QaiM3QwHo0b92jUusZEtszxTO2AQgy
++					Eq7CncYxzcU6oavH8w== )
++			300	RRSIG	DNSKEY 10 2 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					GJ3J1Iro3+XVgVa6by2QMOOkgrIKK2yaGM/M
++					a48WDa4kfP5GU9ukoScgNTgp4rSB9hcJ1KfN
++					eL+HUCA3/Dk0KrfjlN3TTWcxmB09jchuGQLE
++					mdaas4WLf4PW9kMZaqP3KAddzd/B2cFAkK3+
++					pVcCinD27AuhjiMmhHa98cNfNowFao9dWp4d
++					GEO9m8y8lsQtinaGSk6TL6r1C8LQe2DOtNX+
++					vufx3dH/MO7B5iqqENGHNuJFJIhAi1h8Gq3v
++					d4x81B+HwNWDSWYYSFrBYxsKR2EM4v0amywA
++					njeJPrvl/9GH/Pl2tNbyQBbwa/o3g/U+0TCt
++					rThbMAyzhhZ9zLHcmw== )
++			300	CDS	50458 12 3 (
++					2E40B2A6CCD2760EC70AF69D1C144064C893
++					1E53A6B3EEE78BDB9E0BAFBB9C02 )
++			300	RRSIG	CDS 5 2 300 (
++					20181212121212 20161010101010 516 example.sec.
++					e+fYaOwAOKNB89dJKd8eKB3wB8zvnzerm6fU
++					zIoeMj3xBnNxsadFJY3IwSjFsA2LhN8G8Nfo
++					EUYyFA/D25gT/FPLjfFxv2227bpEV/sxfMs3
++					ax6jNEHyuXSxoSQ0XNu2msJc5cdweJHbjcn5
++					SaeNQCqYIv3K5IOyXrbYBMcD5OI= )
++			300	RRSIG	CDS 5 2 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					Y8Z8cMmZhnW6vLI6aylycsAfrhS4PT9SOvD8
++					jeNjLdL0EDgQE7+KXnpzVgbEh/NLte4ewmUf
++					UbHsJxUgpmr0+ak5cgSqeII56a4hEHYoseC8
++					RI/gtcy7BQFwtKZs9c9SjQsCN7j8+gbJASfa
++					PIEaWuciKu2wsJkq6/oOFhB0Gu3232Ty4U0f
++					4/oeddmd+t9p4sFr1jhWEKajJN+951Ux6cDi
++					IbiCrFhBORncjuXu4fEpgt5wRozrlKWbKqzS
++					ipV7G6jdhgcMv5ejDT2JrcdRcwtvSRWXoNl6
++					VzbQVw4bwqpEyV9hErN+XhcYEC/vCoSpDfmY
++					K4nkkXXs1XGJl+/Czg== )
++			300	RRSIG	CDS 8 2 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					dlGP8OjPHifuzuJ+VSlO4XSRaG/ZJZTV0sYs
++					uLm7G7bLGn+WPQRJWfQcggo5KBgN23/SoMfR
++					2xA4+3l5e1RxAss/tCHosnh/EeVyTcUuTzxB
++					3/h/pwu5x9MtnlJ3Ybuzpp3fFd251f6o9jxT
++					K1GXZ5sT9E45bV22Mss4xppLrNY++e6cYBwx
++					weUA/abG5emxO7N+Y0mV61IkoJnPtORbove7
++					HxW0EY0fIe0zQviUi9sgxR3aj/+S1ZkAlonW
++					dhWAP4jEGYRP1PIwO0HiAadRdpx1wf9ns3le
++					PRcxl/jVvwVsJc46hgVGiMdasFVuqD2Lot1o
++					proWTh/W00CH5mhBiA== )
++			300	RRSIG	CDS 10 2 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					EhHaPji1zb/BBgFoCHHFKQgLzF+i6ErJYXh6
++					cw2QLRIEHirWgQ/MmOvAxGti9on56Pwtn1oO
++					D27t84B525KLRj3TJ7CVtlMR6YcJX23pfIrO
++					9TZV4DPHFKf4lFmHjEy9S3QtEaKJDg+zxpnU
++					0np89RRFeEXY/2xeDyt1AmyAyEuy/bdZPK3S
++					IQrG8EdG18PAfx+fNlF9DxHgY8gmaeUc7b8S
++					i6WCaOap+W+RFfazMm0NeppxCztBBh3gZsuH
++					nqTCLlF8wxayKgJZgP+i440FwhtnbEZR92IE
++					UVGOiDgb7g6FsgBmquGzXmCpG1gycBK72uLZ
++					4QrJt3IR6XYZ7Elclg== )
++			300	CDNSKEY	256 3 8 (
++					AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27
++					3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe
++					avuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90
++					yQwfC53hxyH10GzGnAx4Sutrdkh1w4HM1nMB
++					dlTMa0g9yxjJ0vm/T7qHzj+3dTUi84s8Du2m
++					fMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB
++					/QUuoY2FyThfidT+nhOQpzftVtLcta0E0Uv3
++					PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/
++					byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01
++					u8SJYP6ULwx0mZ0p5BmoMH8=
++					) ; ZSK; alg = RSASHA256 ; key id = 48381
++			300	RRSIG	CDNSKEY 5 2 300 (
++					20181212121212 20161010101010 516 example.sec.
++					Q/H66+MGtrftHL5uJrHk72G52YySeOsR55YF
++					iO6h9obTrFOHGAmfSQbpl9c6BtXYD4Q0ka4u
++					xN69mHKv3qpfx75lT8X4eAw8dEB7LMSHXSUG
++					VTpoILN/l/o25RZHD0SNTre7l38Y51ldNyyR
++					0Ow/hPH3bflqakBZBHxhItz1chk= )
++			300	RRSIG	CDNSKEY 5 2 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					aM0wQ2jtoBT4iGTjH2jrhCQ7uND715dnybkj
++					GHkoVu5iq/MUOB+j5u9RlbhWnZhzD2QjG9wm
++					wKJiXeAkcMfP0GhxGiZleIQw5JbAAluiMKh3
++					aefZ62GRt8cgx7UoF/G1QDhxLfNxtgWCNUo/
++					d0vqcBfTDlmNKfHfmoRj4nIvYC2HSo0jwGwe
++					eXF0ROzqyVuRjqiSMixqp0HrMf0pzCMu2eSR
++					zpL4gRu2ja70oDWpWbkO9JwqppVmcCLKT4kB
++					bYZoJ4GUuryi5EyrsaL+v53wtd+/Y9Skxv/w
++					qjAz46S4OCGlz+Nueep13x1azQ2VXj9ztAit
++					AAik5G5DcQuxAAjYhg== )
++			300	RRSIG	CDNSKEY 8 2 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					zqO8HvhNJnQMcmfdq+2Xj9eR60eWLVaPn018
++					ViP7SXl/EILd/T23u9gd6/mI3cL/tYUQMAlC
++					6IGnVwtC/pe0Hirotkuq/qaTYtRtDw+d5cwJ
++					pnshJKtVbgpPUNsu9K9KyXxld3kkQGhh06XR
++					Pp3WEoJoXfJOsRSzVCarGXrE0UVU3ekpQf4D
++					ofLndCuqDbMzlgPli3xPXhDP9M85fqFdkLel
++					FNyDU25OlznZCbylUszJ9Aziijp+D5+FPV2t
++					Avkj7TngL6y8Ux88FjK8RYy3YqVrKV0G9Izw
++					f07LCR43sLGwUTzcsgLkq+F0MtC6VIbjWLAc
++					bgZrlpLaDd+c9D/7SA== )
++			300	RRSIG	CDNSKEY 10 2 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					awyvSG3Fgti6GD/VOBhWKU7ULLz8YTLimth/
++					0w41WpGMwnNYI0Zd4d8cqzjubtFUmxQS9JMU
++					ICxmZohryh7zJYDUHv0lJTKO7ZoACqfwz6Mv
++					/xw0lMvHIdxtx77SbxwOXeLOXehqH7fDo5fL
++					g0fWLZ7AcK/98a92sd/6YOqxnwQxpmg/17A6
++					MZwNwC4e5os11OGrEkurBV3TJAbg/HeYYacH
++					N2K2dx9ldGeHzuK1js9zrMATaCzUkW66fRLY
++					lZVlVCAgezGCk8hz9+fDxSC29z0Q8qArpwH2
++					q8PVlkoL9tisnony2JXBRkoAcZRVVC5gk4xe
++					gxlNWk3j+HCBifW3Xg== )
+ 			300	SPF	"v=spf1 a:mail.example.sec -all"
+-			300	RRSIG	SPF 5 2 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					RWs0sDBYmiqAGzP2gfRP0p6BzzPh2XqDpCHZ
+-					LsDaCmlZI+XIdJy/dV9jGNwJ7+YWLNA/gIIG
+-					NcIj8HElceCzlv14z84hL+8gkvOU90RX/bH0
+-					wIXMQDqo68JwQ+A65V498Hf5ouzKbRitAFu9
+-					zEGiW3TXhWUilqfjFm3H+qoeS/M= )
+-			300	RRSIG	SPF 5 2 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					cpiGOZZZsTeROsxC22DEBjuCFs+GZOXwY6Wh
+-					le/jrshFrjjANERcA2TrQRFXS+GCxkXb7dI+
+-					ZxnmaSx4uh8PHcJSn3cIJt0rZgPPGX12S0qI
+-					vj3iKPG73VHhBXiXC8tq5+mEi3/2u9+HJLCk
+-					Lfc3fFJUamhtsElaLsGX76qgnr2brb5bf9D5
+-					avjPRA1mPQdxCb6Sh8iC28bfXQBWdLolNDNO
+-					EefhmVLU6H399dMD57mXzuBKWRrC6L+i5vIr
+-					KfNKRqodm8AVJybAZImBONQybIkpjMKWNC5z
+-					MoNqfYxskZS/W3N1jHAXFush9+MltyevFvxm
+-					VWQ14I31At06oQfong== )
+-			300	RRSIG	SPF 8 2 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					GILnbrIqzGeuNVHG0GigYP/SKkPvW55L2QYo
+-					/Jmd7/DauvShmxW3KWZu1QD2ibJi7evbpysL
+-					4ktJ67dzhfTpWHFsKBPrMTG965iqcckIfWMk
+-					5LPs6hqjvCyTS1qWcCxu7vYsNyp8Dyb1wWgO
+-					5Y4zR0X5MYFVaDOZ3m/td3SFVKTgawkOtiWh
+-					24paSPl+lzbknBaLtaG6TYFS4MTsdlwpApw2
+-					V6s2zSaoKIXQbethxFAqWNUOmxp/Gcyusff/
+-					UKi5NM6DAsrWfuLRkmGD09bWbtf0aPIzTVZT
+-					CaQ3Ys71cUBnJbb73qUCO3c9MGxIpJ9SU0wu
+-					UIBe5nLshMGnv4voEg== )
++			300	RRSIG	SPF 5 2 300 (
++					20181212121212 20161010101010 516 example.sec.
++					J1CgUN17y4TVrVx2Px5NBViQnRwZZ1rif58h
++					xAWraY5kbgB7yw+zocCb1QnCbGTgCelQIh8T
++					buel4rpUeMBz98B/ddmYyuzORK6IAB5fLmlF
++					oNZhHWG48ugKZye7C8ufjmlskIQeRvNl5kd2
++					fq7t/paVl/zEZ0h0r4uJ8iG6u+4= )
++			300	RRSIG	SPF 5 2 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					QPQCtQuiqPtrebdPeC8ESc9TBfF3zl0rjhFr
++					wlNdlK8r2Fp4L6X7idnbctf8XXDidxNxmGDT
++					/S7B+h8j3mg5oFcGzy3oH7jMp64D6xQnGeLB
++					l4yKn/+ivG/wp2XqZXMTdp0+GJ7wQ20GzGZQ
++					dvhBZd8hbOXLxQhkNBXbxBY08M6I94FJxH+k
++					kGlVUaRQ9GM0qxJ4nCNfyyv/NqtRW3W+m+Pg
++					Fe0xLO5I+imEsv0CIFqB+tqHbtVLUp7dKccE
++					xqSIIF4ygsyZoFdHaw4GWELh1T2IwDL+Nh1r
++					jwAxojherHL6mcWELjYndTVGiZKrbhLthkYM
++					qG7o6+f7IUf5jmzNBg== )
++			300	RRSIG	SPF 8 2 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					v53uhdO0bwgxTAhCJjZ42bUwqB2P9vwoU0m5
++					6Sj7FsK66ulyw2+vCXJsHcMM2KuuWViag/Wk
++					NfYqWObu0K2yZXgrhPtQ+VYKeiB1WHlI4mtR
++					oFSIlUM3VVwJeUkzeRRyRJkOM+oV59ZIRnVn
++					lQ5skC2Oy9n7xK/XjmxvSady7f1eyB+L9iFU
++					ZMVHTo11KNT5B4T4tb/S5fb6sw1Vcmwyo0FN
++					sCOc2LGwFRcIsqzPWn//HrT1SQSdC9k0wx1D
++					KAg2s4cYl9BVcVtAx++Aj6+ym5dEEmUCyM7Q
++					BSptcl/7fM7cIZv4WcZbbrKuPRQJtIUWHk9l
++					wPvhWuJoLblxN7sqdA== )
++			300	RRSIG	SPF 10 2 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					gRIEs+4ZWNO30DTdZecDsPO95HLIaWdqiqhU
++					moVflYcA80XkyETHzrPHp5VM405LSbGn0eSw
++					ZYD4b4DFpW32JTYKB4f/8VzEPZ+AvXePGp7/
++					3YkBu242xZEXBcaqNtsxXnPcgmFKbPb75hVd
++					IkY4nEezPgjcxeDY6Ajnnwrhv8/g1yTX59pz
++					QvCc+IB8V5IOf7jRA6axauQ2CjP0jOBxdJNE
++					qVF4OKnZfaWAv5amGD4uNBn9kRSH/2UpcXJm
++					J73in3qfoWfVaSeUBo+U8RKrUA/n3qBjqWXg
++					ezkT7moL6GrpZh+0OWNtXgL4z3gpmFDZ6Ruz
++					7cTpzI7N57Qx1ZALdw== )
++			300	CAA	0 issue "example.sec"
++			300	RRSIG	CAA 5 2 300 (
++					20181212121212 20161010101010 516 example.sec.
++					Tg2gLgMkTTPnO9hug8P6TthqlZ6wnTiBq+Uf
++					14qlfD5tV2N8MgxSoLtsTxFvTjeGyqUgEAER
++					/vhVAfPWsIuNSytedrfj2EEqeakpdX+b6De3
++					ZK2jrV4qSl0XQB4qw0ysjmM7stASKavOqsOY
++					Iwf2+42Xcd+YkIbLoqrSDfko30g= )
++			300	RRSIG	CAA 5 2 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					gpg6iv7/pWHCzCF1YBKVzA7ShtvV8vnXNxxd
++					ojv1wlxkyI5LADHaKjdkzjtQq4CF2UIJkRsx
++					VY1y4KC4EW1ACUIDvBDMtN6i8wMLhySsdcjJ
++					kkUoiZc+h5VM664Nezhf1bU+1AT1hx0vC+ol
++					dXqs1w9EPj9i2iId4Pd9tQ3yiwH7KthYLXap
++					DVKxtGb5CzgkRfeZfJABdPs3eH8LWHc84sSk
++					YWD7/T1wjlR6MtAeZcTTrYeq8o1dBtBndqGx
++					gi8q8eCGdeUNAJ33fUWmcuF50IcCAmCm01lk
++					pNRxGOXjmEChnCk/diNW1bAo/11EVATR87Tm
++					LwgrQGG3zYsglEs6bw== )
++			300	RRSIG	CAA 8 2 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					Zdnsv+j/2VJ30qQ7jFzygrzbtiaSbJACPEwD
++					pojI7+IEGeYWQoUdTRiZjg8Tay4iql+b1dao
++					+HOlfIxvl/w+Vp4TgonTtydcYICCKZKZdrYB
++					Hf0GSMJrdaCU5HV/uCTdrww44dXDISYTph4l
++					KTmdeqIuDDk5ZZ28XaqGdCYJg76YorZxzS3e
++					332BzPBKjcWpWhPzbKXYF1070AgXlvNsboGb
++					JlFdYBNBsMqwsl9PolxURfsEKsnrz99cTAmX
++					iV2xJGYHZjSY3+t7Uqt4VtD/8faeW0kgkMe/
++					Rktevt+UQJGnqif6dDNgJOLFvtOvb/rZWXNi
++					6kRM+l0MghRD2t4ldA== )
++			300	RRSIG	CAA 10 2 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					FnjAGBYlAWL7ggOc1aoaCIkF3VC1032MYoVn
++					6MRBImO7EUnTn3K1Dx0n8AgIcgvMeg9yZh2q
++					tojGJa/mtZK4EOdAOhFu5uRxbnKJkLaNeezA
++					p3opWnDyzjGn7svDJyR3cQOqXK+cboNNhOso
++					xOvTJ0MHrvewpouObAcI0Mlz3mLeZ2G0vVF4
++					7Bkkd6vIj3yYLAf1Kg1HoDFwvlInz/2ivNhK
++					xULcE3F8UA3b22eXVZELVhHtXrO+c4svKAcN
++					3OF8JxVNlerqnknf8yth9JA6InizyvkYWBHj
++					RAIdSn+7LzDfK2xHGxNNTZ5U1l0ILujJETx9
++					ej96BYwhqb1uKmyV/A== )
+ a.ns.delegation2.example.sec. 300 IN A	8.8.1.1
++delegation2.example.sec. 300	IN NS	a.ns.delegation2.example.sec.
++			300	NSEC	delegation3.example.sec. NS RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					N/dKyieQ9YnNG5ryp9kgvgZ4AfvdPQmNcSaO
++					FA3qougSU3JVYOQ4bxep5jTEetudM7fhgGwD
++					I7yRzgmc8oohiHZkG7yDIeC6CG98nuq1mWSw
++					xX1AtsxfMHsujDeXf6wNuOsspPXyVBlW2t8D
++					s5urv/DxCx/mG2uUMJCOa1mb8+4= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					XJWlVH5VeNY08IT4AJVGBgTynQtXEfmXrXYx
++					qjE78snQZCvPeHMi1U200oRQm0Zmd2b5S3JZ
++					8LhEl+4kyBuUQC/cldgf6/3s2PT+usLt2yxA
++					jek+W8y70jKsZDyCE77+o6vP5TNpSl6VyxKe
++					uvUReVYe/i/0elQ3kj1wZHTjt597j3ZIdpgU
++					phKgDpMnubf/oT4jvvJrbDqUwjZZVS8Q9ZNl
++					NLkqbNt3pri/tqt7iQkSeZBN8dZtLk3GrUPT
++					cEGqeqUPDan6N07uUU+/dkJZaCN4cF4a0foD
++					axqfzCZwqTw9cIr+1or0AncRm6571VU/CSuh
++					EejAYmuqnQtGWoLT5w== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					MZN/l5ivOmOOhExQL79guD4yuF1LCMVJZ3PQ
++					RT7SLcldN2kS/NTb/0k0lHR9/1Yq5G4Vc8Lv
++					F5A2Gji1K8V+l1ZQ2m/033/ykTcNO1SO+ivH
++					5IRStznBsusEGtfRb4FT9Y7mCQJgXyACCFeh
++					7meti9nykB8ncGNC78QJtPxp+SF4DpUhmSVT
++					OVBxS8RsZJt2AB4iW1cRsv4DF6M1UuuJ1oUG
++					uOVXwkfITlhdLt745l2T8IRZeMrmv7oWS76r
++					UIJmQDevvc8/nCXVFVdfEwQ5j2aE5BEr0DVf
++					zhMJ5hGix+XI/s+kW4b04nyABcYnX3ZNdB0k
++					zg56eg+gdrZiXuMVMQ== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					mgFMIU5xdIzb0jgvbbMeEmWbpLJN6Q3JZ+oG
++					bfAm4hJHf2kAyKJTRf2HEFfNCFb24JTVNAmm
++					jhpcVOxXSQgSD3ffrLEUt2k7qSNjXuCigI9E
++					OvRhoM2fP2F0GqcRVYbTI9Lykf5QrP01w4e1
++					wG4Ho3FCF65As12coaPO61Uh0xBTnNf/mHfC
++					NAc9PMrhh3p9m0/7H61ZN1IYlNhegyIODuXu
++					fTdp8ajmcku01RQf92W/JacU1dx+1kvqj4dZ
++					aqykIHIOzqjxoe/m9eiVOHd7cegzT+jwB4Yh
++					svv70irBU1uZimJ88ES0PI4vfl+ALKMcf+jj
++					6Q5apgo7p8DXVUafjA== )
++delegation4.example.sec. 300	IN NS	delegation4.example.sec.
++			300	AAAA	2001:2010:1::feef
++			300	NSEC	ghost.example.sec. NS RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					bNEy+yaf6tq+ZH3QnqILlmvI4ldeebL2mbqR
++					z85MyEaz6BTDkarnglIi1X1lBZQcHrdYJ4Zm
++					IMSqzR2Mk05r4uUOvDSosTExbp9HNB1C0SB/
++					BeJ1uQ9HsJHNDAM4F3f+m3tGQZndW9yG+iAi
++					5Zs5MJJWvQoFDHcH5GbRjCDogMg= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					pzswCphGA9sNJ0h69aFI6KaTkcNZ51IN1t2q
++					aIR+EE+vjpcSKCVJPJq/UNWcqy3IUjDogL/H
++					T1ez18wmjK7MWmelQty2EXm827Z+CJy7Wbnl
++					OytU5grXG38bVS06wS90YtDLbIww+kfoyJsY
++					k/CqMg3mNA6HsTlmvD42M4tZIRHOUFQ2bQKd
++					nuERZcn0drH88OS7XCbiWkVWNmI0p6Ud432H
++					obKFUJf6U3+B90sPPiCOF3JckzBJ6yJPj18k
++					8fLbEP9c9zkvb+SOa/SxxftI3E+BtD84Y6zY
++					SowCCa3xSNdgVKpasZAttESD9xLvEC2E1muy
++					GCCB2d1XvqANp2rgLw== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					ZowFOEUjJl8qIdNa2VGuREBPDx2PtBEicdWF
++					giLk7tJNxOgwyf1waNdHiuGsAaE6M5UVDOA2
++					GfOQ/ip0R62WE5uAifSxpiq0MmV8X1+UonIf
++					bWeNWYwtmq9Y3rAxzHK/3b4P44DxxicQyZSX
++					lDs2XbfhhGVWAUIFNVYNlA+2eDSEUsKfJ27J
++					7s6AfdFdAAvWEGPolHKJ7glnldElabkxhLR3
++					5z0VVuJ+zQg8bWmZ+WkwE1Z0tcvtQzH1fH9K
++					VvMLjDnOVhFJtd4fuEpQA0pquEsEyUUvVlh1
++					SKNk511c07lXNTOZcaVtU7ZTuMmtJdELerW+
++					LX6+Owt4Cfi38f6Zfg== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					VxyoGuLjUDV2f2ENKsLnFdoU5Gv7+xs3gkC8
++					6Vf73QLVIwFbVXfwZ/PocbotObAdgIpg9XTv
++					0NTeKjwu4/3PdeVeHc/+AhNWpdIfi29Fxl5c
++					V3Fyl8IUbDOhaBxNStjddyKcuLCtE14t4Jss
++					SLGFP4oDt6NZlWVXSyOj6Tdhllj6B7ggtFQF
++					lePkeKkSRYsXQPx778roj08/7k7I3BED7irn
++					4D+mG9cDfB1hK0CIPD3ROfh8ER8rBt1mBT3S
++					FBSmz9F5G9cz4YeWiAMso0zHTOZSt0pAsg6i
++					YUrh9mxA5uFILjI+4U4l+xi/CbC8mquemg8q
++					FaXnwHpcxf2yNqL9CQ== )
+ delegation3.example.sec. 300	IN NS	delegation3.example.sec.
+ 			300	A	1.2.9.253
+ 			300	NSEC	delegation4.example.sec. NS RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					CD0RsskZkRqESk9FFf6Xs6V05y34ogZVMQxb
+-					xFTmXwGXFJujPot8Y+r524aHtZ/TMT+5jmZC
+-					272lf5THZa8L6GSmjOXEShEzE/NxK6QPi0A/
+-					41hyTDLfTdMeS434vEArzjCte8vFi3Gs1lke
+-					ALxfuXEPFlqShzRH049QIiKVb7E= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					aA3RBcFysyza0jCN2bN4fRv/K+NTvsseUw1p
+-					eM39ciePCxg20JhsGDWIMCqpSz5R3BLPemSg
+-					ll+B8CuHMCQPLWcb3vg1WOTpSPjIZxgt97I8
+-					VRfGga9FWxyKk9qohvjVIBKOiROE15OKEnVl
+-					1T5dk2I32BaWKvOxQEbjxYUcnLwPPsostvWQ
+-					L6e7vsDpFPh2boW/x7tc9oADCX770TPVtS7d
+-					0Tn6eAganiw2SzgDHsRcOv3Y3PvNCuBxxUla
+-					dkOsPk0Aeho6Go50N6Pq5u9P0EXZQuMN9NMp
+-					cuwn3kotN0XoYBX5fIXnsEsZceiyCDntsPdf
+-					sOXRjg+PmWiM5L/nRw== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					bnK6CJhATrnBj+HNVW55je0rBI2Xsvqfhv/C
+-					IFNaesD3eRA5Sq23rZ+kRJuZb7JlndzPKfCt
+-					axjm3m/9GGXf0YVUvMp/vRvxgemllQn9ANyh
+-					d9KTnEK/L9Fn6KgeT+tti4RkIJB3ok2Yllv7
+-					uYg3IUDKKrDjETppQeoFKuiflHbAnN3s9wta
+-					HgF5Q1/jI204i9Ausup4wBjFYpJTx1J2Z0ak
+-					zg7zjw5H0fgnKXDGcmT+ErWWMsYYsHMUx6CO
+-					qFrqpP1BnRdOBZ43Nt9OTgUQMTJ+fTJwC+pS
+-					Qxa9+P87gbXCGoV7vyCiYcla3oB9bP7Hnztc
+-					3gxrjI1G4oUg2GdHbQ== )
+-delegation2.example.sec. 300	IN NS	a.ns.delegation2.example.sec.
+-			300	NSEC	delegation3.example.sec. NS RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					fvrYyP2h+pG+7CEEE6CjzruLRi+9yentUTE+
+-					AOxJs41pEs11Uw7MR1wO+TGPxanzJlJwvJCs
+-					9xIBZE4PQta2AKqyAML/s1DeK4a392qPUHrQ
+-					8N7evTS2KoOKH6F7pdXOPv6xOIhm54ufg7tb
+-					QSr2Ngn3jQFH+rqQqAQluTNXjys= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					SUDQwaDyaGV0a554BvxUbJzFjh9Jhp6Xr98B
+-					/pFXzUvJMcW9gvlAZiWh+Uu+h0w5449aFAFU
+-					I3DByimfOIJJG+iPQ8A8I9u5W6goVeeB6WzT
+-					QL24+e8vAjLrLCInHxlxAQGgkkX1hhFMceRW
+-					+pZyxsS2uBt11jCVM8y8qzVkQE+3gU/DODO8
+-					8a7zd2gNNNJ5RIdigzvPxvVq69FGfl70nRLZ
+-					kMBnQQ1Ot/E5KysoprCbEeYSVF3wglFxCmcs
+-					QAJQ9Fj9jsTrBO4M3cQFJcB5KjM0BE7+R57c
+-					yxg7ZKMMMgqe/ubt9NvFJXQFQfQjSmB/3yR7
+-					Zczk4Z8FScb4NQlAPA== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					ItHnrTkwSbhG9tYZQKAC9XCRmKkt4lSWrXjB
+-					fn5Vwm4cf66uVFkj6gHNGapR5w/Vg+snvffp
+-					gzAGUsgkLk6+xxbFcGGoeQ/VwflWsDWTtOau
+-					XsChTTVnOiQ5vTRhUOmDOHXGk/LF60FaBMBG
+-					R8p9kTtFe6sLtstuVvmMw/e7gfJrYMO8IZ1A
+-					Wy4rnBTzf1MMKZBpJJM8CAyDq3dzinjgFkA8
+-					/cRwH0+7ODBbEo7r492VOLMzbMWXPBJjs0kR
+-					yZeI9lxr1Ah52WIw99mOAWQ6TW/w4RxsP8J2
+-					Xj34MwPmIMR3Qy8sf+yeHeUD4cS0woHOlpyu
+-					ButVE7zeuDPgS+Bojg== )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					Sa8w0Gtmmmt/koUXa1jM+pR0blfDb8uQjZ5z
++					sWR+Qtm9pUeVi6Im7ZsLF0UvThhPB4M7Cssu
++					e8mZq8djWe24yfoROn/CM3Za+Zt+pN/CBStQ
++					wecdIEwY0NuUTqDpc8eqMiMfi+FQkMwyxO0X
++					SXi+6wfLZMPqa6E1Xko1mHO0VUE= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					GxBmASFjw1z882KzO6qRQuClpk9VCSyJIljM
++					qCqfjKKdGKqLkvcn2DsfsYj3ZbJo5hgJKumR
++					1DPrHFbRBmjAWrVZ7kXxTTvhZgqekSldo1wf
++					cT+ssNVmFTm+VTVY3Cz8msNjbtv5VLiE5RTI
++					fX370c0+cCK/6svDtnYgw0vj/3bayYxQ5sx/
++					R/jE8CumJ2FNuGx+6+/kDO7MZsNHJ1glZqTW
++					FCS/2wybR/N8ErEihov35j6Z5NIKAZqG3oXJ
++					g4WjhuHc9fhfZLn3uRVd+USn3SNnjm35UODX
++					qS+kLeFvQvLiWYuiJQTiqPoYQuup3DpILMxo
++					vX9mMUHILutOYGYuFg== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					w2KrHdEoyXYzPAg9cqx8vF1hhc4zdjSvEjIs
++					+sb+ZgrHKPRMrezf6zQKIjfeZ1DyeMN8nKsS
++					cmzUOuDUKoytvX8Xo9FB2nUqU+Y8RRao36FV
++					4PXOqnmsyHdTAQYFAGaDXqYzQvt3Ev+KRa4I
++					CjGzwVhhuijSskv393NNJVeTKXIR51Etz0DO
++					kdk8SamYpitDoGSLr7oKX3nw6Fv//+faGdk6
++					zQq+tcj4Gu09nrfe4I2RQDcsMXJODv0RwF9y
++					64ilGuRZxsN81sM8849uzBUDdNQIxd9Tod+w
++					Gg8P7AFxWyFhhhfO4lTS/OiLCgG1yYT0L2l/
++					pU5AWah3d8VT1PzULQ== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					kMb4PgqThtSZSJUiBRUeSOJl9S4toailINo8
++					Fs7wG0yqMzI4jZ3YiI6myWiw36m/y66X8P7d
++					9eYomaEbO4/1QpUNDtbuBams4KzWVygStswe
++					2AK0VrZV1o7RhaJfQ5PwWc6tYMyepE4NwqUe
++					0t1JF/ktw7yXiG9vcy4copaYnqLSnfgotG02
++					3sc8f7YAMthm4/o9lAtYVCWGwd7YIiLz6CHR
++					kcbfRn61GqNKUOTJU98AEhIqaQ99iIrD9gtA
++					q2p6eP9YH+jR6GqXjKKo93hrcdev0rWPD+Bp
++					xHVStzs6Fu0frnAjzPJCNjxD4TZN9dqp6Ffk
++					CfAF8X41YLSdbVmSHw== )
++mail.example.sec.	300	IN A	2.3.4.5
++			300	RRSIG	A 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					uBuhc3/9thGl1UkMMxLoI2y0Pck5siv2bm9y
++					8ZZ+mj5n5CxMtY1dKg1Ie5AnWUklOceXespb
++					eImHlRcr05gVBSAYkH00hANMWgnoTSWp05G9
++					78/14rMVC9XfuHHYqL9rlqZfRpKTELPYuI4T
++					YReeJL4DG82WN46CGipmhSFI6rQ= )
++			300	RRSIG	A 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					vHfCAnnCsulD6AXdpDClBtnNThqRSxwC5Wxf
++					Pj8toyQqEvGV3I8bh3/jq6yWv+bjTHBLy6qQ
++					X8Vob50ezCFcdJ6qlwVlVHGjsPSL3wXvaxKs
++					tG3yClwy/UmI2Ey4UUy8KBRrPvOHhn5f+LAe
++					yOM7IfPPDDABkDoLXNJpXLIhUrTjhB01jhvn
++					wcdGmR77QBF5+I9eZsrQC2Dmr4xwOcOWYRwQ
++					398LmCuZYh10X/A/IEcTm8SxnUwfAOw0Dg2J
++					TRnU6Es1ag0nEU2dOvwVVefqm4F4H3ZeEaZD
++					qZiKvmf8vTWaPF0X0RKwdJVu0sZnQdNFwliN
++					mhVCgnMLtRLm5f6QEA== )
++			300	RRSIG	A 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					etcmhIlYcyL/MJWcI1HWKYQRKlQN83SJglUw
++					tqMEDQYvC9aIl/EnWp9OMlkEytl8dIdpNMIH
++					+kttjnxmoyY/CFUXXbNKGxc42AZB8NCNeT15
++					EI3YE2LNP4kG4dYDi/2K/05eel6U6JkuzByW
++					0vC0DCRqvkI13r+igDp73hVta+Ee9JcfrokV
++					RLO6X0nK4P4a1RxI8OVklVOQ9Vu5fWlxLjd9
++					ki8MI9V2kNiVvNVyQFb4IW1d9qjZQgsFQIco
++					uL6IMWxR9QCQd9cGRxOD9hodqObsm2E2YYPE
++					/CtMpE6hpAjVm6oSEyby1oHjFH+Mzzv5lfvY
++					AsBXgVPKeK14Q5P45Q== )
++			300	RRSIG	A 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					Iixa0xKHw5w70HJ7xYdvFk4iJLyMJ/4puisU
++					NQZKnEZqzFEND1HdtplcWI7/GW8QWG+D9Lhr
++					XPCbaPSIT6al1gHmLUpf/nCsI1fL9VY8Wyc1
++					ZHhsyItDJHwErbXBFo5tWpqM0WDjeFAwJGI6
++					ZjC1VeRX1FWDelXcVPMP8IZgQ4fbGrdC60Kz
++					Wew2YFEPdiHXmCZ2t6t1lfBdkVKlNqLEWwiD
++					Yjl0liXKOy3t031LLN9z5PJ+gpWePwFpdlgL
++					Od2kmXBTOKqB54J71py1NZagoTrEvXGNna+F
++					MDVkqdOv7ExXbv221atZOF92xIxuzrto7Grp
++					3c21bdJDbX10e7+Q0g== )
++			300	NSEC	_25._tcp.mail.example.sec. A RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					UydDK1ifmnSxlnDhmxEwiku23EYm1B6LEeUs
++					AOEFtlkFDCBtn8LUir1HwGsOwRNBTPi0ofN1
++					VpUdcAF91RQoZdVogjJKKirldqci3CFH+Cop
++					YV6WTOLLSidi+O+lykt3ejflrrEBwuKUcu0M
++					UWfVKWQQcEE+1KIS6A8MGLCtxFs= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					UYRGOZZaoYg0FnsImfKW3p7J0CEMIzYBHYpn
++					PSHvUKIuBVID44uQVNVqJ5KDaO4squ0FgrC4
++					PKqMjExEcZAi3e57xuXWciHf0uQT60mvXqMT
++					LA94SOC9CYF13Qft+XY0TMB0ufI0BWTuBDK0
++					qDpYKa9fdviwmLHJnXyrJxYI2kKFE0fOkoaE
++					vGa6B/fSzSzT4xpk1zrsWbfhWM2X6uY/Wv9d
++					KKnVw/S41EshBwsUWKLGqRigyn8/XOI+baoZ
++					We9+JbSu/mbIi5w2TqBndKkFwnb7mKUCDz0Y
++					SLkCeMywApytF3EgQggb68sDP/vApt0YVuy1
++					oJphlerS+RsWUUSHXQ== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					thTuKDb8SXg2IgbU0MKhtlU1109j9UGeo1OW
++					cJAqAGfNUC9vT0qzYQxmmZiCBDBzsBu95Gtk
++					9k2cORB/Hvn/CY8Rso72t0Um3ergBfCcA/Dk
++					57XAb+oDYV0sIBnXOvYpNAO1pIhFAgfMnqUB
++					pKuslPOMyHR+E3lrbGHplPYlDizLqJu89WhC
++					TVU1yHuCxFKte8G8ViRE8RyScNC8ESAQQ3bR
++					HA0Ido9+iy//ZnsLeDjnOicKNo22NS906s7+
++					DAV1P1BaW2c990zO03dJa3mFAR9p8nbwsGLa
++					MOtXlTufHBjG7WcMq8sVpQSa4HGP85TAxHzP
++					SKalXVqikQeiV5P0Ww== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					jGUL3AKnEao3XDQBPr2ZErCmowkDihF1kPB6
++					SZfKAI1VisPEFn6kZrucHNAW9842HS3ihvB+
++					KbIVa00iy70o0O9CHTeGherk9iNwiBI8YEFd
++					rkZotXFk+fxpQ0n8G+nkCSaHLSoXvp+i91Qi
++					/1Zi4hkldcfdblH3mprbZMyFsaxBIPjNma/4
++					fzYZ0hVl9RA9mHtU2Ef+/uS7X1B4iu5OrRIv
++					8n2WMz4F1KzLzoPglO2oEoprNMqpDfvxhQ9J
++					d+jEsiyciHPPT1us5hWnPzfQx9POSCUn6ZJz
++					Mzup6QnKCWT9eTJ39BNgUYPK/0I6vypmlb4M
++					eOsytBhJVquQqQl0Hw== )
+ delegation.example.sec.	300	IN NS	ns1.example.sec.
+ 			300	IN NS	ns2.example.sec.
+ 			300	DS	60485 5 1 (
+ 					2BB183AF5F22588179A53B0A98631FAD1A29
+ 					2118 )
+-			300	RRSIG	DS 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					HBXFIbzthhFqFB7YUceWeSHsb3jlbWvhJaqa
+-					xqhh4G58Ktbq/eD/ODKJWpTwDsrwK9neYp1P
+-					En/ZfvmBZe8jS8SmdTAWt0Ov3yMMN/lk3rEQ
+-					vE7xlsCFxk2MvJubUBaTGK8Ixf4mSJBKiew6
+-					2lxjroBoK2AV84tScm2mxTS8GMg= )
+-			300	RRSIG	DS 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					zf2WlfNwFRqt888jC5ORYqgHeMp0TLkO0bWP
+-					tPcw/hgyCF+JdqIXuEDyubiqGZD7QQM0xEoO
+-					jLprcOG8ZdTMjhW5JXBoyOY4B5MfD1Ucy8Of
+-					4onnUcP4Pfm91xuXr2Rb3RbTDyfqCyJ1fNsA
+-					nAh7nOChJmxHJYz9oH0AfQvvClUWd16inwgn
+-					XIOdQxDmKkEtdU2u42FwAk6pSiOzR6zbJ1yo
+-					lXWeINVxL8TxWjVfq2XIzwXFEkWMftDQjTwH
+-					/LX2aueermN2xa5uqOqDVhsLG3PHR3sQMFTL
+-					heIY3Vietpxu0LMZgiL2IaNTLWEW+mhCvtmq
+-					aaxKq7kSKxjg+VU9pA== )
+-			300	RRSIG	DS 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					RLaaahYnGiGwt0y3MapNhZ1wrmaK4pxp4fMx
+-					LgK60SNOGymW6JfnoLIEDLIYG3m8mLVhdEvA
+-					nt/5739u2Nu5HN3LQLNeeF4Kcd795Ns+Lggz
+-					bte1nVdvj79L4xd+5woTs4FgD+gO0iV/i93n
+-					Qy0MlnkNDN1js7VU1ONSb6GZu2ggVO6lY6hl
+-					+HeOX+9xIdD7lsJj2UDZWKV0SLLT5kBDxLvs
+-					I9ZA/u9tce30uEEpmZIopF0UABHzqZqm4vNs
+-					Qcr3jP85Kuw25E47Bpgg9RIirITAooac4jjs
+-					qVh/ydgLMzoklcPB3tISSIh0x1iKvnWVevMm
+-					aloA6DajwqBSlcA7nA== )
++			300	RRSIG	DS 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					FFR1I0RCKnQAiZjnbYSa0IChopcJV6xwrejk
++					g2yhwUF55yLgmICr0qC8OyfcctHIzTl6At9Q
++					s6u6wG7mDqCxvD4wv90DbJb4VheGO2rHC3Ie
++					Ie5M6TKqHbcOxGKxPpJSFBiX+hnOwAjcOaez
++					+fT+MPZavgQWjfYgIORMjw4JULo= )
++			300	RRSIG	DS 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					qGi/8U4Z1lYF54aGwcxLdgZ7vm+14atpACBN
++					XGF1qFQjL1W4d/Vw/19KaPuXsjHJPOmK0Zce
++					4qS1hosa5wPnJOJBUmUOkRW2tVojpnmkKaSS
++					jbjcQiTlKHcUNPMJrNVrwJHtOMyZjCwzdzFs
++					mnzLa7yW+CNoP6mHd25bErC4iZ6MDi7j6Q3Z
++					+MUi63BbUUNxL6tuCl62m+pr+0ShsCvwd0IN
++					l5+OI8VexQOydES2o8NxoRwR2yE7a0MELM6K
++					AurhtViy95nQ0kOYJ/0sJkTrVsbZ/RHnnlzK
++					czn/6D156tN9pL5O5YYwPWDQRC0Mq4DJMi0j
++					POol+ZTFys1OfnVfrA== )
++			300	RRSIG	DS 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					0JohpJrNEFwcDbffWpOAU/L6O3e4zO0aK9aK
++					P5X8BQMj0NHvQGZXE5PMvB2pZLTyi5zq9udg
++					/4Vv10Qbn2AMV9NpIyj30nhsIZrG2ruDjaX6
++					I6xW+Yp+LeS6ddDekBCFtvgvxP15H3T1kAmc
++					kpfHjCfTnKnoxgOBqaNjYe1YPwo7jXJ+qOVs
++					SZdEglCSJeVTMsj0W/YQdJmwOI+gbWNA78jn
++					TMAgWMbbsG2k7B2VDhYLwJQgZbm9vIhtfJLW
++					JxdEbMCgVB3d5O47Su2nPTXOv1a2QX91ahRn
++					BFxhhCn9/9SHGxe/OuK+XwzxefjfMyhBWI+3
++					OecSui9MhQtAhwIaHg== )
++			300	RRSIG	DS 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					YkXhW2eX/F2Y2G4/eH2vJ4PEN24vLCFmbHho
++					RR048doWiquWN1qmVsvtrVxOs+akCqItazVO
++					KyoVAGc5Nc2OM57Rz+4kH2V0crWCrIRZb88I
++					+5/e0RFGe3+CDnhIl1V8U9JqlmFq2QYknjbP
++					gu6QcwUwJbxff2mFWO9RSmm2/ARFMfjMfk0j
++					VVA1o3/e9R18njNijmnDVtVd3fp1aUQCr4R0
++					C7VbsG7+pEicPaY4B6AjWp19WZQLU56JyTyj
++					E52NU67U3QcED0gQhj3Bz2nivJDKnq2XelzH
++					0/EC8vV9BdqDBLjMhnXq+Q9jREKBWSNjaPCc
++					ieTw0KM+YQIAtMjfag== )
+ 			300	NSEC	delegation2.example.sec. NS DS RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					syy7tcQTts42hPpDms1kF92e/4duPtn5wuuS
+-					CXMw+C7aIIMEm2EJ5BHtjLfQ5Qh5QRieCgJC
+-					S6aT6hr9DXCfmXa1x+Ing97VBoYll1GxNDup
+-					xiRR4nXam9d8T9UM7I82L6pV4qF3NSVDGiVN
+-					VqW1wTPWEwRtGrrRBOdUvn2KyXI= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					EK6oHG96GEBKuirll3p35bCKrDylDYOj65gc
+-					9G4AwWaayurXBAu4iHZhA3ZjBZXixobktlJL
+-					vK+B/KshG5zYwVeKDnqYNMuCxJ9+u2Py7u2x
+-					9uqcQyp5KBF63aPbvS7+Xg6alNsaEKQEwWjc
+-					7J3ZbvMgG4Q4fVR0LO7CeGcX/tlOc1WpBH1m
+-					txhACsZk+Qmy78hC++X9EVc3CA/AwLoGvdhe
+-					UMpclz6uk/C/ZklNyRH6aRZlJz834wBL1Ziz
+-					EskVYIosekKpA0ZCYl/V258dnetBE7lvQ9Nh
+-					qE5JngQyOQnM/SGPFwDQAfGcXIlOJWzhug43
+-					EhL6uVCHe05lN072Dg== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					Mq68uAgzCUU9wD1ybPMBlyEFcICEkgLbS2iK
+-					ZlvdlYfN2GQeiBznSdg7y+Ss2eXoNfZd8ouT
+-					9FIAEbWoKjg9k1B3/HXVtzW/QsdiLFSepgmL
+-					nusgNfgcSIwNbN12g8YMgETNLFnNon8te2Ry
+-					SWuSK6tJ8vKPGT9CA4AaF35qnouvAStYplKh
+-					EaJ//UGoWLvKxFPCmTP+RAyLgqidOvJTAZmf
+-					gLELI+A9SxWI1oB4tKd1Vc2Aq8NbNBx2Z19b
+-					cvOQwBuAuiHRmqiRzHPP6jVBBE+pZ/wI4izT
+-					c+1oSOo49QSpUUQlLIGGjnXgh3IRV229rSiF
+-					0nPycKu/3BOUo5cxjQ== )
+-cert.example.sec.	300	IN CERT	URI 0 0 (
+-					V2Ugc2hhbGwgbmVlZCBhIG51bWJlciBvZiBt
+-					YXRoZW1hdGljYWwgaWRlYXMgYW5kIG5vdGF0
+-					aW9ucyBjb25jZXJuaW5nIGZ1bmN0aW9ucyBp
+-					biBnZW5lcmFsLg== )
+-			300	RRSIG	CERT 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					PdA5ui/NfwgzxQhNBSwqyniuI9QpQedtQqOm
+-					7waMIAXEi4MWEeZurjJwA9ak6EZYHkR2V77Z
+-					n6YoD1gXUp9iE2iX50VRLjDMawHVUmovD59P
+-					/ArjKvm1msx+dtkgqLAXj4v2If3LLcyzO4s3
+-					8mjrp8phLeGPISo17Fen+xUeaJ8= )
+-			300	RRSIG	CERT 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					qFPPehUwkyZhjdJRqXk9ZMJ5ysPmR83af3hF
+-					91OGr9i2wnC46II2o1sxfgiL5F+jNhOYyUv7
+-					QnJWJn3+iqIomGnCHqSYy3JoGpG/fkZBSwek
+-					icxxnvyzEN73tf/EOJ5v9akWPOy2PPyd0L8p
+-					xQWJlqF6EZlAuC5a+OAbANZEF94/2YIGsoKg
+-					wXy2cwTZ701ujeMzvivyuuJG/rhrOZUXDexs
+-					FH/UvREmOLuqyKwelfB64BEJBuk+CuASeabt
+-					PE1b86qzs+rU9nm0O2EtUaImRDVJSWXP3x9b
+-					VflYJbj9rnzB/4edkLLNuMtcpLvViHb9FRVV
+-					XU9PQ7/uGgPyPRdnlg== )
+-			300	RRSIG	CERT 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					Rf95qrkQoPedfcRlD7NfdpGeti7JdKouptkP
+-					YtLUrzwhsb4kEvcI0DC+Ua3jhpDhPKCPZfrN
+-					VBBhmeAeAIZdn/MT7wMKtChGA4VtgI61jmir
+-					2/K2a2/HFqW1PRwWx8NqgFz77C0PbTpOesim
+-					qxsjYCyGJF6HOpKhQ1DBWb1+twt2n3o6lj3d
+-					wYBnveKohQBkK3Hl8LklRFjSkbAU0Qj6309h
+-					OZI4p+WQrZ34+92ZcgcZ9JLYDv2qXcaj4bOq
+-					E5lThX4NLRIjx44fTzrLxW10W7bEXPzgKZAH
+-					vKoRC6GHp6hh/xsGdTCX9GPNf6S0YkVzDsaZ
+-					ZrXvo2sNO9PmPNuBQg== )
+-			300	NSEC	delegation.example.sec. CERT RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					njMBdqH1BnBZyawcmbUHT5WDDroJDBAwc/S7
+-					YYUAUwoXwrPSRiW2aGYHdAKZCbH1M5wrynoz
+-					L4xfEkZlRD+w8m9bN56ydnY2y34RgoRZUq7V
+-					2Pk0n/2P5f0wB/34J3KKkxH8ynxv1Jm8IA8g
+-					XY5PuJebRYA8mxXF73/R+NyR25o= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					lOgiQTRHuvOXU2k4XBQ50x693t6Tb5Hz18Lw
+-					tjrlZKsXHb86IbqP7pgD9c7GS2ov2RpQBh1q
+-					AYsmibLelbjFPppFh8EQz42WqjTL1PM7bunF
+-					KQSgd6pea32ewp7RMYfss69A+nsVD8t0HFNP
+-					JyzUkIAjM1knIYXGPeHfPBQu4XpOzVeF9783
+-					ADEQs1c2oFAA7R+xmuoQh8jX/JDQJuUKEwHa
+-					u84k89GZukCr7pLssqLybZmAYvsH6ajR/NrA
+-					Gv4pjGZWz4wy2s5h1mNMkEFqm/qf5RWqsfKw
+-					kO40Yr2jfKOfTUrmsQjLdvjqBMzgzp+JnAqw
+-					tOzTeEWGtkxb5JVWyg== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					uRSh10E+hDBZH22j8jZqRoLvz/rzQQzcWR8Q
+-					/ayzqu+xizpC08tLr7SGBjqlqkFCvhvGoYkT
+-					X/C46ItvNtx5YDLMuZMeuxOd9RcaTPeVbhfe
+-					TjfQ7Smw3bCEx2PzZvC3urA5Owvi0/JnFvBW
+-					+lWGmDTnHxi632QrfEQ1DoL/dJCBkDUCcYRX
+-					4lYqzXXO2vdJo0GrghtIor86jBy7C6nVrLb6
+-					xe+oNfz7aBlXm8JGXTriXKa0LUbX/xu0Rox2
+-					ETgm1G1e3HwfjXxQ+NCrHLUOxHYeq/GDi9NM
+-					9r+jXTD1gNvMpMCTidufsGDpYMwuGEhCSXTr
+-					0q4c+Z8Vv5GyEEb/Gg== )
+-alias.example.sec.	300	IN DNAME anotherone.sec.
+-			300	RRSIG	DNAME 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					hN5znng+AmkGWTmle6Vm+xCIEgGtZHOX7wu1
+-					L5tQbdQygpRWAL3AEvI2B7zqOURAokvl9Dqp
+-					2O6JhxtxxH7hTW8wk0ZeL8SAWXGe+Dmw7OYi
+-					lnDuO8DahBZmg3rMQHFo7jlWqRB2BYicSAmh
+-					78e9JVIwZE1zsdJBpvFjVgYWWPw= )
+-			300	RRSIG	DNAME 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					lQRMT04a7jSKtyoPyhCoa9cEJU0Psria1SqB
+-					fFq4pccSeBTjZcbiXs322ogGc3cmUO/4+YRC
+-					742YEd9/iAiCILrEZXPpCprgymCIqZ2uJxIK
+-					Vk2QUNDHOaJOjbZ7U4/g9T9K6LlCqBwsUAuG
+-					euur4wDsiuEQPln5T+9hIwjS8Jbhx8jPRs1J
+-					QXe+G8zwg733I0GSU7F+IuNhzgt1N6O/8J5y
+-					OzLPLdUwLs9ty9B2rbyU2zMySQgiWaD+wSnp
+-					bZ5iJLrg192nxIZhaeOZ5Ig4mwk3UdF8baCq
+-					UpxAUddSdSLtd402+F/6dQV38mEeez4FOdv8
+-					egjnfq59oLOSiQxA8Q== )
+-			300	RRSIG	DNAME 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					nrFN+doVZOaYEk2HLbNCwBEreN2Z+nB86rfE
+-					u5f8Xb99sppDFsSrc5dnsNBsOyzmg3OhjmeN
+-					5vXZ/dOTlaAD1AJwYPUEXZ+SPaF8nFusHib1
+-					kVfcbUSMKaGBIaQJmIBQELL0E5u6Vx85PwwP
+-					gfujuUSs29VoDmXkRj2978PVihb7U1mX9fjw
+-					az0ZYmbMDKzlKEYKYEz7PnDIvl1HBmYxSZlx
+-					HLLLeImzszHMJMdzeH7wSmH+INj69bPpNREn
+-					SO1F1AJvFW5vjHtoa692Ggk8kUyYJhRFMNDV
+-					1JDTQxNeEikvp5glE3ywPKRRVxVDWCXVFgJP
+-					m67Q3r6pfzRQbP9obA== )
+-			300	NSEC	cert.example.sec. DNAME RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					arLwaxZ/s64IufkYQljXb1V49hgVY6aOA/4G
+-					CrFOB4KO/eEaHiinFBuXznKlE9ePiKKtGsbm
+-					ALz4gP/zeUEsYuDYbuFAYixWvhHG4wDMKF3y
+-					V3Hfxeue3PYulOreyPuRriK24sZJDhy7LVN3
+-					Ps/z1TWJ+HWnMDeprU2qjj223YM= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					ew74MRufBg6jYSbb/cDx3f6kVpPxD7lfzp0G
+-					kPVIsgqaRARFbl4cLQIUCaAhRIIjwR0G56gl
+-					2EqrjXKWr2hBDIsvhX8Pgdom5j4vGC1TS0wI
+-					0YMrfuyuviNXnutdyxKqEPhgtnUa327/suTX
+-					Z/aoQoe4Um+EI7AFBpVuHdAYxgYF3qiDCNqO
+-					nzNxQCuW/Tx0NzocmRHxw3sl/MRknbQvKUgi
+-					1inJQizjxtncLdjNPxn4UoJcb+QUE55letYO
+-					TuIDyaBc9kuPnT4l/1GsnbZuODDAiRI/f565
+-					h3dw18WeoaDk7sJKdiGZISt9hj99ARrGgpn9
+-					u1w4JRpoO6rXpgXopQ== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					Xzl+kKu9k2pjKyeg9hz06MD5ItGIt9SkWHf4
+-					fXcNtSQ+GabNVNtSlCPbaIRycHSLf6/AluJe
+-					SSijB/dEaSSnPogAATefm6NlgF6Tc9NjRM6S
+-					dz0s1sFNP8pnGP89JSA6HTk/13hcAbIhkXUg
+-					aWMUpmTn78+g7LnzGmnCPTsEKr65x0IETfsh
+-					06/0zjZJXLOmNr270cuj11SHNtEr5Y6qw0v+
+-					FzSeWn5GySsgShj+q0ZZY7OJmdQFjW3j5ic5
+-					YpHwaHGq8Fv/VoTiKUjE+Or7cZFW5nFkA2L9
+-					KYR9z2bXY4uteKxU+VfpIn8+BGtnTBR+LE2k
+-					y8/ie58TOaga3W3yWQ== )
+-ghost.example.sec.	300	IN NS	ns1.example.sec.
+-			300	IN NS	ns2.example.sec.
+-			300	DS	50458 12 3 (
+-					2E40B2A6CCD2760EC70AF69D1C144064C893
+-					1E53A6B3EEE78BDB9E0BAFBB9C02 )
+-			300	RRSIG	DS 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					dbS4zOt4yPFQz+tp6SmfVPSgWF1bSkJBVq5b
+-					y13h2bZayms064FdTJmdGNErN29VVnZXiaFe
+-					1gf7kmSdR2YLYoI2U740DD01NUC+3eH/E3cu
+-					IWmjQKkwhB9Iwe8UaX7jqaG00bxNaTJpb/Cq
+-					+zMy2gjMcG7KvQvuQ6SPzdmCUC8= )
+-			300	RRSIG	DS 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					DsjOIOocYhuHZJWNijzIj02FOxQPXFlaUhPM
+-					u9hBsWEOA2CFyuAdpshG9EQJa4jISUT3Setz
+-					9RZA5UZAV7/ERHsLdDKAZez+j5v2d/MqwiNA
+-					d6SdhSUWlZqPUMQluM81RfMCzqYbcNE5sw+N
+-					0MzzBQz2iHdO2+tJ8Tvg+4ek0aaCAIJ+IrRT
+-					f7wiWgiUmiMkWTjjkuFxGtOKotTZp+W64KuW
+-					yEbt0ApmpahDlwSUKruXs76FVZPk9OLRM9zQ
+-					agLs4pVKpwP8OK3KUVUiR16W25JrycEd4TKU
+-					IuDAuodR0SRrXatBj3X/Qm63CT4gjQf3F/Ga
+-					nLDeZKDi7aL+86qPzw== )
+-			300	RRSIG	DS 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					Ske9cNhh15n9cJxkozsENJtlTgnEPDIi/7Hx
+-					Q3nj3UPSx24JTiTHdddQAcFwmnDj2qVuVyoG
+-					sDq4GBdj20soTcP6+cGrQ8ELokXwZoQ8ddGy
+-					uaJnkqh4JBcSXNCv3OoimAj/tVxse9zjpFgl
+-					d9c/C2LF7/4rEtflLybmgLmlFwVVsDUCpQ9X
+-					S+Btx+fgQNvpK6BbeVaDEr57X9ysLBy6UxJM
+-					mXyV6/oDEcK/8enhqTIiExOi40yhx2woQRMy
+-					X4szYS/jwLrS/yUrUrtbpcOHwpW/ISqDFCuC
+-					LWqEfQtPAr6U/H3SXs73++cMAoBuEdbeRUcq
+-					OSZMxNY8m4uZvC2EOg== )
+-			300	NSEC	jumphost.example.sec. NS DS RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					jcw7VqEW7YR70DJAV+oYAKxSHQ9H5vQBLve8
+-					zcW1dge1L/EQppk5I0zRj7yr8f7pTrm7IhNn
+-					aPv0YbFGRGQJI6w0a/xVr965LyQt/LNyp56g
+-					UwLO07msGUvxr9br2bsYb+lI5esjmUeI38K/
+-					GkO77+5iWuv4WcSfx3X0KtfKyRU= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					KDx7V+aqRbzoDaY7QB7PTsuH4IrtBimwJsfx
+-					Oth/fSUdmFfPpByVmY+Zln6HzAcCDMAapKEA
+-					D9QV9f8qPssd8uQpAVKylqfSRcYHkZzeGvvA
+-					ho4bmrNPz2wQEz9XFvB0hXJ8YI89a55HYN/s
+-					TzdNmGtK0WVZO/6A6nALCB96r5FMLTEhdn7s
+-					8iLV1k1DojkWkD44Bojj3Vkq6r6o21h2FVHd
+-					/lOjUQSjEwQvt/1ctI7bJMHnFvMewVCt/oQO
+-					gu7oQijwsyFMGJZl7FDmIQXRLxywHhrTkysH
+-					d05krTNL7A1K6y+GFdw7/Zv2kfqrrVSyRoxH
+-					XF8zxi588nrfOuqcRA== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					Cao7WSRgcLLlQRSTUCB+1AMcfTpkzLAVqs1U
+-					zfz3o6xQHr4Eb6THmF29W4xEx5sYMC+9yLws
+-					sppmbfTRVISRXZe5MoajC8DWBC0lqEbQjMPM
+-					MG2xZ4kinEGPvzM7Xx5TFejV/n3yMRFm7QHp
+-					LBIB3pIfgXWMvpLNINCChUVdwBMXJ8vopULk
+-					rdTJ0ZMtnwO0iMo4W7YmgiWqCD4f8i8+6MWG
+-					4WUFvsitaogroKkvOJgj5hxEL6OXLyAWNgfX
+-					lxF2jBpK+tLCJb8cTe91slIOkus83rCxVmAP
+-					wjwt57GQrn8REiw2bbfeXc+kZzoPC8ud7Hlz
+-					eOYtpW+EfZQhwqXyoQ== )
+-delegation4.example.sec. 300	IN NS	delegation4.example.sec.
+-			300	AAAA	2001:2010:1::feef
+-			300	NSEC	ghost.example.sec. NS RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					ck530M3oNpf6MB6IOEKlAG31GUvfMGvrnmvL
+-					mc3gFj4YkH4cr/Mue35C34JsOITZ4eCAr1qm
+-					90I1ZZFirtznpK+XSoJ2OmpljD7ukp1v4fkr
+-					xcBi4DRVN33O9NvMGo5ByOq83y5Sr5DIZn5B
+-					K1xnLIeGNYNiNabKbvYsL63GNBw= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					KvynUaRjew0Llu0ir/Dae+y39m4n2hiFGEld
+-					U9/ka9ebYwbULECDoZlppm+1VQ7aPfyEtm/1
+-					MulIQHWplHwjxGw10nk71XTLgeiSUsVYCdDN
+-					qK0dC5mJ/xnkaNgR7Q//e4YSg8Z7aVGojkh5
+-					ewXCyVzqg+hLSWWe2TSQV5CeakjBkTmew8hS
+-					Ugg0vRepRtZ+VdFa6A3RX3/35Kj5YE1x+QiO
+-					RKpM6oIaeinSpNcJgOKAUIfsm0rMlGqYwun4
+-					GqDJi+X3rqKmg3ooVNXjq6FqQr8hxtPkO52f
+-					mHQxeGyOczc6odQGMMrlpEEroTmcOLP+r25h
+-					zFicoZjtVpMCk3Im/w== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					u9kemCEEjLcWoyHLMgQiMESYDWJJosTnqbxR
+-					p/0wjbjjtcDCxheIMq1QVzgiM1dlEJhyGgry
+-					en4VD0ap+RAMP2LRTudtoTogAEGb6OuFYOM9
+-					IBV8tYkq8AXAKKQeQ0HDiveQFC2Af66XJbZu
+-					ioTdNy9uJyPHSVQK1FPwyHrMpDkkMyc2pmJo
+-					T0qUGMHTZCDX/JcRkA/tuKpftpkaZq70/edG
+-					oK9ZRF3ke4YnrW8RiwUp64dSmzAWqth2ht0v
+-					W1BmNAoR/oCdBMmMYzPJxNDjJ1BDaZiNUH49
+-					I19wMnvrFdYVz6VP5o/TfJ3wLyejKUMAQi0H
+-					AJcNAWb7T6czVkIXIw== )
+-sec-10.example.sec.	300	IN IPSECKEY ( 10 1 0 192.168.1.10 )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					JzUbP5RijuruLZs7gOepWRrnChCfEGad6nPE
+-					np1kuc5cf1z1FpPDntbxYzgLeyc2sY3PDZ/j
+-					35OWKuE9zNR/M+uqA29ehZMqegYPcJZYIFD7
+-					bPOpacCiwnoB2OYa4y8FKhWIrrLMtUKoYHRA
+-					yKuAiduwr/7ndJXLsW348vbyKRc= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					LbM/he+aYiOZUenKh0WA64OJaljec26uvxYf
+-					PS+NCp3Oe01KlRTvl1odasz+BO7hs2qo/IzK
+-					YezdKU6xyxnP20yqxmOaeQ52S7QNCQciKZm+
+-					YcFfmmrYMMylC8ca4RRzH/lhzM37PSOixCk+
+-					3vUI0jfH/tnYpX0pWKTiU0cw1+yGqbY6yf6Z
+-					KEdTVyLR/x84XFkvEHumDMPLfYwDk1qkpNhC
+-					MqmSPqeRUHrui3DXUv2uhOn9McudB655IF0Q
+-					gEbAKFRZW8/ey+rp1YByJKJp0jlbewBBwKf4
+-					LKTRk+1N0V0QYkObd5zkA0JnjYoLqjit7ckV
+-					wi7HwkcgQzBJ3scTBA== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					WMRM2N9um8rfzVrZDZlZpv4KWRf1unIS/99G
+-					WCyG2RjWGwMSEmOQ3BUaMKGIsd/2qyp8iUf/
+-					NMLxu4L4KnkCbsh0tIujdfh3Y4NhhTLsI/CQ
+-					CbCJ3PBuAqEsQsBMtbQr6gPAVAqIdQRUGVf2
+-					PTQWOoQ9iQVdHDoVUDrfWQjhvv9f0gov5VPQ
+-					M74urfDVM4IqSm6VInygAG1i8jNsZBHOLjgQ
+-					Xt1e97mkSbs3ZAqKUcIdDSzwem+HYo8dH9fG
+-					BiciNg1uR3gqis9mJ6mgYcWD1dielZ3113gx
+-					qd+s4+ZTVKEk79MP41RupkCjC7/lVT7mtKWM
+-					+3hnz+R7kkZVwuatFw== )
+-			300	NSEC	sec-11.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					tW2EHpJUeVBFWDDrFkXykskPkxFOY4BQY4K1
+-					TKJKN7Q0b+Tkdfy7q7aQSfd1oISzZn0w5crz
+-					0HGaTJzZKx2iMYK9E6HVH/FysCRge/p5lfpo
+-					+Y31X2ldA1al8TtjVCpXqh2hyJvkP5+gD0a5
+-					BXhB3s/q0FkdEmM23SfGK4XqPwM= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					0adnfzBJLo+kwjkPR9xFCAyY0J8EFzHgVYbg
+-					bob4jNAZpKEBpCIWivxlTGzN6gb49eWLefgy
+-					CdujmqzRwUCf2fXESYp4R0hLq8gVPbOF087/
+-					4cwajOTeDLGVo9OlQA/MF5hrya4DCDNC/wiB
+-					Mp1jFDDd3rPQIhVRW55UUAUcK67SazvxSSGB
+-					Tnca4Y/q7mXOV224n6E/m6n7drmL17A/rr/3
+-					fJaMH9b9JOSK65k2eqSCbWBaLFt1uYqGJC4M
+-					0bs+QWc4oXV2985AsZNqShtGnNKgEJzKDZDq
+-					h0zCspnlt1JgxzpQukXwrS9CbAYYlgRD4BvR
+-					1i1P6OSSAT6XoJfkew== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					aIbGlRGSMBzpR3ZJDGHbbCjVFVUAoVSUjHLH
+-					Tssbx4zGbRQ+V7agcRsRznYgDxgzuhgiWjOA
+-					rYvjnXDXWGFx0HzWjQ+CbHouuF69eWJdHyUe
+-					RFPzZ/dzKLlo4ucrX1awAf+3DcreTuWe0KcA
+-					33ptJSJGvYILxwOoKpnVk6iymlVpkw1jPQP6
+-					Q7hAD5A9W8z7hXn5tu4qknqU9BjwekkIqm8V
+-					1eoIkGqHogWQs86aFMgeNAHvmklBgSwzcLc+
+-					NHI96eqzfvqkS03MtdKyldUjq9WiCRlLIBbc
+-					2Ra5fHN4dEEaYIUCu6tMhUwNQSjgev+a3WU7
+-					DLivnEX79tIEEyS5bQ== )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					rljjcD5SsIUxIvEB56UoMLkvV61h2C2x46tD
++					kGH48cphkaCQgZDxYnuYo0FLtMFy+JOnNJZE
++					AcGII1+mH1NgQ2hvPW07TY0DVChq5sbZ0uAf
++					7jYIpKYC5N4xFM/SkzLtrMWAW8caA71teXq+
++					/1ChI0L3V1aFLEGyslcw2nSPAPM= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					s8FLFgQBXexonphsXRr+8gW+BY0WKJZx+qHr
++					38fC9AC3bK3dD1w0jRVyKTE1Se2vwRu7FYbV
++					b1xV3HKuHLtCrgW28UYffKnJLHLeIXgeZlJV
++					6YufW6iEPJUhl9db6IHnD0rtJCesu+Mcqxjg
++					uAIgq1YlWOGmJ3edYFyZzy3cfOGROmag6g2g
++					4BlQ6kRtpeQujfl44bPmm30v5FZi+kIH9ba6
++					RpXOmdbZAJqer3hoBohmD8JABpfT0PqnJSFf
++					fAlojw3WnNE44yUxhuMalER+BgK0u5bkwLYO
++					SvkIEawgYFht1BEG9G0xjI3KOzZZFtZloyaR
++					uiAa1K+46gGjMmPJWg== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					g6N0eggix11si7ZI6TBgO3Pys7fxrsysAQmX
++					HK2Yw1kMAAsLe2kwW0ZmefNCrkkNNR0Ln/wc
++					NfMHBEf5iU8ceXfiF1+3xZdH1U46l4YX1gUD
++					gKL2TQI1A+xG3DHpHLQknhKqtwfPCKQThxsg
++					X3NYYfct3GLkdgbaMzLaTa1UHAaPvxSrfSzG
++					/eWSW6jWLU6VsLXOdNCzR6WTwMev8W1p+YG2
++					7dyRyfFfA3S9hBrXFINnzvglCGWBryVXnXAE
++					VYFI535zkjT+mSMEATERoRb6hm/XNgzy7Y3l
++					Fj4bIoZFNebYbCD9HmI6GZCuBBVxOSmhrdfC
++					fOL3mu1i2cK5U7vFgA== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					QqcY0N+DmPDaREk+KMd6ivo2xBcUsTEiPVJB
++					gy/7Oq9x3Lzo9NvO2YKF+4HxzGk8GnkEVrmh
++					WU8jFr2R5wfZmDgBCLMitew+jYU7CkI9vYst
++					sNmsF4x0KZSVMlIF6NymdSZGW/2QkVzxZjmF
++					Vgh1cthUGkOl/M2EU0TJmt3GU6bZNw/wW8bh
++					Mjn2dJnR5MQrFHfoXjbQm/SXdcpl5IAiEK6A
++					m30OxVFijBINNJzfkHLhpNT6Bza8trKBnP1J
++					93hDJz/debKkxxruIMH/409nN8hexlG8Zk4G
++					J9FWOMnSAvyitWAoKB2ykBa4obLyDaAt2NuQ
++					iUt4du7WLqn5dSUXMw== )
++sec-00.example.sec.	300	IN IPSECKEY ( 10 0 0 . )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					MluJokV2J5dK5n5hSqbmf5huLI77QYEnZd82
++					8JmiDlILat+xFkgGrZlKMIvpGJVLWCgU98cV
++					Z8rO13ZK7gr/ifFmocvgocchTrj+lw4J/aXW
++					b1IHHPkhGeCJy2etKc5H+cln4PEt8h7to7IH
++					+XSN4TNaQnQiUcTESdTAhuF3syw= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					dr7alfFGSizXT3Vbm+KM8/gD7GNsmxReRIg0
++					zH0QrY9+kq9fKthsKrHhO3SkWmEACZzv23mA
++					qggE9OpNS7mbOTCP2p3lvNtkbFOTunkYWK4h
++					/EJqgs4J3QACtsU6h5uR5dALFjtODkegEo2v
++					aQ5dV7XPfLK9UOG5v/NKamI1rBPwvLoAFLxL
++					hx2QxLYKfsWjdNvK9YV2Bjw2Tvi9mk4M3EZG
++					bEsvuRVDeT3M6THyt/1vV2yJBPey98dZqiFi
++					Jzwrsufe8/PKT1fCGJVepkFqAzCPOYo8giTG
++					t5rG2R+pfiXwKKTBWZUHt0GOR1JDrh33FR8O
++					bH5mi/m4wh+6+6/lvg== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					BFyy/6BnJVa4IiTFkxiL9XjLHzEsdBp/vBSe
++					ozTHysTnxfcqe9n0eQ4r1HCofwUgmnDnA+TO
++					k0ojN3EK4QY0ksooBVAWSQDXGzhQc+rMeave
++					92YyEglaNehWsBzM1wz2IXKS/2fLvA62KW4F
++					87TBO6Ic6TZpNjNrKR/QRjKGXaxyLJ/9zD6x
++					xGWUhGIa5gXoaLx13Zh4VXwCsty6TzNsV7EW
++					elwSCSZmp0XrVz1+99qJ3Z2JjBCuXVA3uW8g
++					yy1POb3bBskf/k3imiMmKz1FvXv5DjloUAUp
++					ERYwByiFOOJXKgpiKoWb7RaAk0+etHrN6t5/
++					tOHE/G6Qv4ewdwppvQ== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					Cf/VcD01yZOu6S3flMqW9ORT1v8g1NKIPKJ2
++					Cat56avdz9g4HM9grub+K2he2svt68He4GVU
++					x4Yn6JgHKXHIqD847kwFuOgn+gsUckUK2c8V
++					vIoq2eQd2dwFfk5VAHtWXMEupBEixbBnbr6t
++					Jn84/FIxabYBm0ItZTFjjPUO/RlmT4+7sqif
++					AZl8pUit9cy1hR5tJCc8QGjUQi2m1E7tUhm0
++					kd3VlbBJYZ7Gm8ky4vgeyQxxp7vbjvD50uCR
++					0GS6O1CJUqdsk6xJW4O7vV5zbMEREZ2twHl3
++					9Xq+nD6A6ZDdtUQQ7WrLrjRHLiD98o8v2LN+
++					VG4MJFijTZqOIn8Bqg== )
++			300	NSEC	sec-01.example.sec. IPSECKEY RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					muTWQdST0SXHIiJGTAvdhxFOHTne1ti82RbM
++					DqXJynyYEgm5NlnmEZn+U+MyPAkjUdsciukW
++					UGo2640qt78WTL1G7WuIWS3KmRD3WTFo61gm
++					DdfMOcxBuyvDl84si6E/sMSjsM/GZJ8Z2BFn
++					hUZB5RlhNbCeC/9O5rP591a84D4= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					W8RduB+y8pfSQ7343Pqa57PgfUqKMAylt13R
++					tsTvudxywnxclvafjl65sREgHuq5ujwfOn0N
++					qTKpmCCmeuUdWoeRLnl9agRdh6INv4u/lTXz
++					y0xcmJeLhaI27IqjYYcsHmhlOy6w0OaL91Gp
++					V4dTsr58H+jbxY6Z01NujZvaa3dC1ZjDDYMH
++					DpyIj1RqNN6gMK+Dfcsh23Ok3LGyQgYw7byo
++					bMmtOi8T6MZ7/kZ8F+iejAr9MiUGKIBQdNVu
++					m7IpwWGJmkOQ6T1fDHLRuhrpyZx/PDl9kwxL
++					XD7+sYke4TAlRiDokIreNR7zwLIqKY69JHx/
++					GiX2a5hp9PRlYaQmRA== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					YT2sKENrTnNOOGhnRaVcD3YZAGDf04z7y5P/
++					WcitVjRKx3ow9gIpFiI62yLi7ZQ11Hugqreb
++					HDTY3F5PMuiDK0Fd4F9WkD5M8vJApfVfmrYQ
++					2hDPbgzs88fHWtTHvReS3rNRk4RLFdvU/YoX
++					zzrdpLqZDJah44eQWprr8WctjBk66slNhGgy
++					T65l032BSi7Qh+fQe3R0IzgqLwxh9WAee2VU
++					1nLRkszwzNygcfjE8trdf7pwtyauqZY9zqDj
++					sKNsFFabP9pYvHi7dfweR/C7cGcbMLFJVSIp
++					iEit3cMKHoJdU9nOC4AvUCxHXoXcpDByU8RL
++					x9/BWaVFGbGAZePlZw== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					mHxAhUL2naUhz8gY2u68zZm0JDQAE0Nc8IPN
++					dlsMHBA8SdSmZ9M3TwWxoB7/EqylOiT8GDRf
++					QzbYqYgNChWdYc6Sc66czbdB5zPnwcYf4UT2
++					YXkunPuTXSxWFAha9W78YeNutHIJwJ4Osuuy
++					h3pO8UfJc3oSyDM6SeknxH15RzHs/dr1S/VY
++					NlBByu33hC08VQ49MxJ22I7zQHjCEBcXoB6p
++					LQ0z7JlDpRJimZyHLx3QIoDXXH58TxSrUPwf
++					+faL6nMDGQfJGwYWpK6gThg/ZWFWbeUruZeZ
++					BXjtM4Du9GirSGujpHAG9NAkcBxIvmZ2Y37t
++					jsSwdr45U50mK6LLoA== )
++jumphost.example.sec.	300	IN SSHFP 2 1 (
++					123456789ABCDEF67890123456789ABCDEF6
++					7890 )
++			300	RRSIG	SSHFP 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					isolD6Ge9KtgMdZMFeR6SD8eu8gie9LMIGjd
++					4Hba7ebnUi8d83e9DRfURbOYtZTjPJqmwSrp
++					I0muhs3KaAmT8Sw5GxDp9dtBRYBexV7dDGvb
++					wyFqICy3OfhOTORdumW+pxEKfgdAfsNv9VYJ
++					EZIYm9vfX+qsIANXFH3D++7sNgg= )
++			300	RRSIG	SSHFP 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					2D7q1ELbpNl9Ix4KrAizQSFPr7aG7F6OIc/W
++					D0R10gAjkHZhH+t/JpwvzcDqGkd3590cAWn8
++					9MV+zRkUnR/qj7+POaRb34oBFbYAA8f4mARl
++					BybDjTWxfbF0VTfMfixM1jz/PbJ0o0I3FBdB
++					zUx+g2nYmipcs7DYNAoWik5hfzalREH/fBW1
++					gQg/BDbn1TvEQC1jVEfQ3YR7VMF/SMm4eoa2
++					UcbjaBsDN/Mev/Nokv9+BaH34XBIh/lzSF0X
++					mX8MAJZEzzwzgrqwYk4Ocp7EBda5pO55Lc6Y
++					UQxVPNvgsrOpk8JkKlsrt7aD5nPnjWKy602j
++					aaZizMEvU+hpaUGQoA== )
++			300	RRSIG	SSHFP 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					k+jHq5IPvjzWCPmDKKfd4VWmE8GuvBcHENDU
++					bgMAUw9x6Q4630/KDOR/euZWUS65HPALZdqX
++					PibxJSI6xumkMIUxN2hh2IUrXlyLIVeY+DFg
++					//Jdwo9kC9NZrIcynxiIXYcEQpFE+ICk3qIZ
++					3rp37ysrX7P8OCNYa3zXT7M305iTkRVTG4Br
++					313e1OAvM1cWp0fIMo32+UM9yegMMXu2DL4C
++					+cD65Cd4BJtEu7dF4yUe7B2t78HzqZOxyWGK
++					wO+XYaSB/rSOuqTNl/0bL6NA89O7DDWCAJoR
++					mw0N2k+ujDF9gUOFhs9yzAgHbXppC4zocmwQ
++					imYF2t3Bf0u+RVaKwQ== )
++			300	RRSIG	SSHFP 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					Zjn8vpwvq7lAfqlM1SR474M+d3xffCkiEXaO
++					W+AxUEUAJ+yi9uAF6fsA1wpCbKjaIvPbrZgr
++					kvOczZlBiX0W/3cCL6KhGe7Lsd2YKqGO3TRe
++					cStF9Ylj/KnFFfXnLPDdODXLQChQEEnLTB86
++					Jk+ZtV6psNwOjSCimSSgc2x26i3rR9VxYIf3
++					5s0K9XN/D8NR+T3NJx2ejsBzPoxQeJIb32iC
++					EaimzXrnSJqLuDSKezP6aqtz2Jrc/Q+E7XeL
++					1PJpgG+xBmmIxIf4SijxRTCG2a656lS4hcY8
++					yl36lzj6QbwQk/EE35SLuyXRjvbowwhALRK7
++					PcNjz9yClFecgRXxbA== )
++			300	NSEC	mail.example.sec. SSHFP RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					aMan7ISnjzaeoqSZNWc1qqnAHd/Uuw8Viqwq
++					2AKYBv2aN8gWkpj5M+61I6RJKXEqoK8PXVMu
++					tzaROubJXbi1qC1gAo6H4sPqQWdJ2MuJ7G7A
++					+VBvKz+U4R5P90g3/mqpBjE4+BGHNkAZ+SKE
++					pZcgPBhzFOsKQlZQ6DWJyJVlG4A= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					jx6Tr9aDQu1NWU+iArkQXSJu/dhsQ/+UuiKU
++					Q5JF83RlPjiqQhFhlyKtlARN3PepXbxOmzkI
++					W3T2Jnd9HDfzy5+b4tJgh6vVDDylDu72G3Ij
++					7kQErZ0gSQd1FDZSU6LMDDNidUHryWMcQQXT
++					9286y9ia/zey4ZawbgmdbC+YYVeKZRBkZNM4
++					F9+vuOm8laYrJwj/waUAAuuvtlc9rGOxb+hE
++					LP4H2PkKVcMbO6jIR6qbXLl87vx7fsqzzPcK
++					RS7HSDAAZhmFKvvOPVMXfk1GZi0F7jxzoTIt
++					Gl4B1rvR941G6VxejaqvXmOA+sLs49drSCn4
++					lyBW45ylAW/ZW/Uxlg== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					r5wkR1XWQcuQ/bINl2pHKgWDkk64NJZe5N6o
++					EKODsgCysToooedN1kCkkaCNkjb7u7h9+tBG
++					YFJmHFv3Gek0PW2ldT80wMSyVn21HVPmpANX
++					daTkl0EE3NkjnAu7jCC8MZHAUJ1S24dEedGB
++					PJuDwjTlFBt/B6/dOUCVxDW5+xRbC+w6mF1v
++					VLsXhzq1VCb/udhbwoqfQXdztDbBNGRdkyBB
++					tc6F68ceUhRVWqjU2cLBl98wrxD+ZbdIXqyX
++					qwJJb6YtCy7swYb+8nOfVwZpAwcNkeHptDNB
++					zEoDFqn5Zl+vCDIgFozwj9Qp8cCioq1jZzlw
++					vSdWL609KjdlUbN9RQ== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					FQEazIPqzHedFVbV2IVHLqfS538V1bNZr0S9
++					h4i+jAnWSz8bhyGPcIwY4kw42wbD6J6sffoK
++					NlUS9F/DfoIgCpTwPLYRaq+2QD5lyUDA9uFX
++					5L7JVgWkZI0dobp33sTelqvxZjcOl7rXO+z0
++					MoJVJdAr0J5kPP3nz31+EWFL9g4Wu3h7ueFb
++					eF0zA0DYqsgD2G5DtycAwz8M2RUZNbi/Io2P
++					+DvjYLng9eiXJmmQ1HGBC7Vp/9D2OHm73ClM
++					Xa82lu6onm2ScyO5+0sUuNXCDZf+rVgtr3Ac
++					AsBUGjkVFgvLxKaRGZZ4ND/tuQZJrVLxwVfn
++					mwntrMBMVL3khHfldQ== )
++_25._tcp.mail.example.sec. 300	IN NSEC	ns1.example.sec. RRSIG NSEC TLSA
++			300	RRSIG	NSEC 5 5 300 (
++					20181212121212 20161010101010 516 example.sec.
++					r+qJPmXLdfqfW/lGABbtRauhF1ivwtJYgYnL
++					JP6Z2UyGcaThmBnGCBh+ZVqsTF5ye6RqvfBc
++					pVzgLwclRHclZv3gawRptRdKRCC9cVAagAtz
++					oO+jt4Hz7ZmELS4HVUYd58bHYjHqGK3JCpUW
++					Rtzc1MzQXMerzT4kcV4te+0sem0= )
++			300	RRSIG	NSEC 5 5 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					FwiVZ84+pSDj4Ai5nM1IMg8FFMV5Rb9GbLP6
++					0oyEVx54dKBlc7aet+L/jLeptXdvf3RoU00i
++					C89BgPhXYBqi6IBevANrL4HnI0VLD7cKGQw8
++					Bh53d5rTXKYlCgvQh5lSLdbTtnUAmhjz8Gbs
++					xob0zTpVuLfKBLfJdibdX3YD3k+jpyvAPfXq
++					5ABOy8UJIerhxTIHvo2iPa/M/b7EtBD2xPje
++					+4hHq0kR5gdhg+RhNdSTlHE+LTHFy29l1gvQ
++					m32rYOhv+l9NnnzPbVPcpAp/UXIvZ5sSJuNv
++					UFk3bQ1bslh2Kb468PqnBd6uoTZXb6zmkpbP
++					x5BUhkWFBwL/LdvDSw== )
++			300	RRSIG	NSEC 8 5 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					n/Q1maoE9ygqDPu74PBnkZ8te2+yF2Rx099K
++					GUkf/s/bBD4gYYkzELdpF9+qrHcQlh0dpsDt
++					qtOAVwaU80VpYJCTrci3sEWZN+suwsfCVan2
++					tTj8Q54FCQhbxkqcd9t7YbuyJi4ASVhGQW5n
++					MUdlop3M2nrvI1FadBWuiMe8RAYziiPsA3sb
++					X1vJpl49bgguOzp5d81LT3YrVQnIGuRSqZhH
++					xo+3zkGiBa4oBTf2SGKC1EO7ziul8JVbNmRv
++					EG5UhYBfQGmJ21a6bBftMOqvSKS1jmKIOivI
++					dzVJ7w+KyoUQsH6FHaxDHh8mKkKJJmDxXbGy
++					3TkgwAq9Lw+qh2IjOQ== )
++			300	RRSIG	NSEC 10 5 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					VNERZktOVwpJwneQu5jisBU3ffMS2MoWqDIt
++					gtFzswwJA1WFr99WpCE8oKPnVY/QmHSZK3ol
++					rcl9nTjjbWx4aFO0UVooNR548Hi/G8nQE7s4
++					WluaGEMJzmcClTJ1n6JLE0goXb4930Q+Ljmd
++					/TS0Y5+k0UclxSII0TErC8FllJ/N2uqGIx1a
++					aev+HYvwWdnr5tkYE+7ieqLeAjN5sU4zkwyW
++					Cj33djkBkguA9KqqEtVD2SaWBdh1rCRdAt8f
++					bwKK5bV2sU58wERVBKKupiUWPy8dMUeIAEky
++					5cS0vDQIRTF8f+joTiXYjZeLwsbmTVSInTdz
++					zOjEvwKKAQMtVCVWlQ== )
++			300	TLSA	3 0 0 (
++					30820307308201EFA003020102020123 )
++			300	RRSIG	TLSA 5 5 300 (
++					20181212121212 20161010101010 516 example.sec.
++					EUrc8WLvZmbuSRmymBPExTiotQIGn+zcIX68
++					AiUWZKQ0wvltwKM2o6ilQLK8goxcZ5qZOmEb
++					6hEivCKoRP0ov4yhJcndCJieQ0saa2+5DOZJ
++					mf6BTSyRmO65P6lVANTJpi/fSh/Bxt+qFerF
++					snrmHQSGVjzFBySCg5GhXB/oVP0= )
++			300	RRSIG	TLSA 5 5 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					vVF5lbC0wOSj2ISUul+4ss46jRZ3mmXbf9NY
++					XEQ+ArA+TThi0031cinFCbSU+4ELgDxRw0YT
++					T2AwhFCnEHVYxs9RoynIIiVPbnmNVtDKrGc+
++					VNjDFcGQ9XikKqw6w1B1dUyRUi+I5rYa/V4C
++					mnDSrynMAgeZOADFbFI/JWo0p8JkPjsVakTi
++					RufzRg+S3ViSaAIheUxDggav2h+BbCa4MTbl
++					0BIyNDrrGEwLETtDnYu51SQbJgfDam1o576W
++					eaEmSX3vf1hccFJem5ITVrCj+tWZY6MLGhwm
++					DfJSt8Umhwg+TWbQm2hXd0AdAbQVSkucY9Fy
++					TtYfK2gDmtZq6Fs1XQ== )
++			300	RRSIG	TLSA 8 5 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					GTsa2uIy2wS9syW/ErQ5YGemfacsG95datpp
++					CBeCplKsQw/Vh8oqgZRn2r39NaSroEY6rUMQ
++					AWtcl/LUeGsKGMAjJ3QLauiWNFXc5kqlptRL
++					iqlBhNSpMzROXEqpwu6o2C2MF2hFkUEtUnj/
++					BZxGKbQmn+a3fA10iy9ADXAHQRXvVaX/V6S/
++					yOtuAL53BC+yDGrLKKivSLW2w7y+iOf8yBA8
++					Vmolq/p3+M8naHZl8LzmWReRcoBITOUMmIf0
++					eq0BJ2ddwEAoneGg+168vCASDbTarXpUihDV
++					XlS/EWfpnG9eRSEEyFq+pj4pdb3lLNxLRY1G
++					RWvv8/A3n7H4rhtLMA== )
++			300	RRSIG	TLSA 10 5 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					kdBkuHzOk9CA9UIAvW00ghDCkNTqmpxjqk5E
++					16e7RaCrKA3UY0Hi5iXAiBkOhwTyGCWgRuQq
++					AWgp2KwYnzs5ZuN5YWBqLVied0klCOWeWmAU
++					mb7IGK1f2veAlTM9db3WLDmSepvmbkdw3F+K
++					JrrqGn/sGYSj3LtXZ1oggHv/9cZWbHfipwZi
++					bY1NfA7matOb2aNhO70Jvym72LFtNVbwanlK
++					sesybPh+dHyRzMAyQLibm7tapJahko1d+KnR
++					L/O426UvkFEGeu3Gm7xhN+hx3TM+URDfc7zR
++					oWvs4rod6IZBIi++ZB/LuO+l3zMIntIy6etY
++					y4ZQr6lSwWqCZQIaFg== )
+ sec-11.example.sec.	300	IN IPSECKEY ( 10 1 1 192.168.1.11
+ 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
+ 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
+@@ -783,134 +1187,182 @@
+ 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
+ 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
+ 					zZP5Vd2t )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					EnEg1ej/+kvQzICpJiLxQG8cQ9/cIR+6R1oB
+-					aFIPxhIdoqWAvLGjAbZsgxajFsTK3nLrZ4V4
+-					AknNa72DRIBsQ6CvLK+UHQU4nGnHg4933/zD
+-					OW7CAXg0dEUYUReiKxukUjJcGQvs7zL9tyq/
+-					1vk7gGxrNaR5hHurD9kpmwQB9Xs= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					NTVi/tlizek1k2PbjlpU5aPI0U0c+zLsFHsM
+-					Kce2FHauoGuItfoRXRDryYw6hJ1xAdqhh657
+-					SCsMYCXOfzmU6qsstKpTCMH+cM5TzuVzyIYL
+-					gmiA+y7qq68LVdArrb0ht762RpQZ8RrU/4MI
+-					YJKX4cqvqXvqHtenBXeqtsklZc9fuQCH2OKu
+-					wUxLNoXuv08FVEXGQb5BV3Pp8JjoTD7z/SL+
+-					qicgqSQkyO+TdUOQjtQIC0yRaUw2evvh46cC
+-					pXc5uXRMukdMU7neSI7MMFoeDYTLip5xas2D
+-					oeecHXrqC3PWGgP8mrnOT7s8ztNZ3BtU42XP
+-					hx+ZYqumRqu6+zVtVw== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					UKuKZlAvsrmOd2k9PdEwz5x3TlVazEmfZEts
+-					iV4z7nhKECj0LFE0YjC9dVWXQrJ451ulpMhO
+-					RPWd1lKpJkx3rPWxphsFrP96cx+MnUOSaCxE
+-					FoeSNHc8ODtXBU8CR2oXQwMAHOABpfE0M7d+
+-					laGQBtEj/izMuNwSVGNd9TAHv+v/1zARaz6n
+-					0owOBRoXvszAvKkyEHvV/8LZMJ+aMZLvJmCj
+-					vb0E6Szky2dBgBKO3JEk73Avb6GLtxo1s6WL
+-					s8lYmQxpOlqY4pJi9jqCB5PeNa6BQbRbIyFh
+-					6nIPgi/QT64MTPRzI12wcvqLDJczgtD23K78
+-					hBDZRe5WoJHE7bnMbA== )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					D+MmZHKbVmQCIkTu8SchY0UjsB8y+UtTC50R
++					Sd/5DekXVogIw+f0QY3PEZXl4cJVBlKS+lRp
++					tHtS5/244I2N+cRSffdHwhBlZpt9iD7S7CL4
++					yhPVw1oRqhSlNv9rPTiXVwiX6HmCeoxQCSD5
++					G3vX0k3zSCGGdkqlk0qtO1QT694= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					xyMK4+VtzkwjdR8ikxuZ8WR5UMntcaS9vZ0J
++					dpMSTk6283PEtwurrITYxkPLNnrQPgp8R9Dt
++					JHUpU2HSMOgYMeCQ/Kn+0/bI3zAuv6RfPzaO
++					s5olCS6EYYn1+cCeowLETTiL/OV2zmtuCRx7
++					Bbl82788cTEydVlLs+cFT+J4RzWE3f1DW+Gf
++					Jf1o2TQtQKQSZM+USCfLD+Ze0EHkQZkffWgF
++					5RwLxeeI8AaXDDut/ZVQpEXqFvUMTVa5RlMq
++					QdITIJ3f2xKs0eeeef9xRS3IS6/fD0uEBg1+
++					MRBMezzbYl//99R2MZVEOOLQ1XeY1m/akTBF
++					OIHxzGEjLuhXEhv9ew== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					DuOUhn590KHaanXsaZkjxlGLnconU8B8QlF3
++					lmn8GBViqcpegxEMKvqkwIazJDLGsPoDZeaP
++					eSEFGxC13dLJiAeMpTnzzv24EjRTJS+NamJM
++					CKHQDSKqgJkOzmiyUOlPfA3vfZLaPZADrXGR
++					uGFwqPcEH5lkNKfWfr5QT2mjosIZtuAvjnpG
++					Siz6LnaTLiFffin2iWKXkgcjRCYr0cgTDUvt
++					8bWBwxS4RD1yZIJmHx8UwOptUKrBZnPbbqXZ
++					3Iqm4NeOzVIKlx19p3MXqUWl5dgPGBr7qUbG
++					r4y1zmnu0DbVKiCfezgM94Y03Rfff7T7dCga
++					dwjuEsRStvRKig2DBA== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					DRKBmqio3VJ+jnJ4F45B2Wf1ZXNRMUDKUwfB
++					ECFhRTBG4fAko58EVJDvNF2j+Hx+MRFjokgm
++					ZKeKZYleu/jo0SbwZjxsk+LZnUmRte7A8uQ/
++					HVNR7CK070H7gYS4TE+F2IyMd9S5z1GH2e2f
++					VgsMwlA9TSZaqvb3VnvoPNw0IZiwbmw+T6Ie
++					DvMp6pVC91GRc472mbqmfg01GApuAYvGRvLz
++					1tU+g+tOLQZzxjFw7cHkbd20a0eRBGxTSN9j
++					wmloooDznXy9aiSxBCQ+aYh11hvYMpzoIoMF
++					1F2mnT3LT3FFgCnbLH2o0P0MpOYvKj55kdrB
++					o/fw2K2jN9bINLrhfA== )
+ 			300	NSEC	sec-12.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					ehNmR/L+tbSda5bN5mTUfSqUMd/OL66QnwXO
+-					v/m8msSR8bfEs2xVqkrWTVgXkw5C+UBBU+3b
+-					2hfcsvseeaKxeOSiaS0zNNDTNLmK5AHE7r0l
+-					f4bo2QeCjcWr7BlToPUeqMCKoMNO0dQH374v
+-					VEFH2EKCLM1g+CF7bFhM33//sTQ= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					YuvKjeXvCexLL0JicGPIaKEo1PwTr+oS4p4w
+-					LuqZ0neZosi5dpelpmT0Jn5ZXJNstCS72cRZ
+-					93DyIdvUNcgf10razoOsPPRnRMAMM0iGRN/7
+-					JQu53DGHV8xHoRleyddNcre9/XHK/HYGAEbo
+-					w4cFlnzwxTtNLfx1tv3qEVjEIBSLxiZDDj1s
+-					VnfP/YHYhTxSQliakrrnKKKWe6fx4NMptJrp
+-					O6YMXD21vlajzqtt1aA4m8mIAMSNkNRcbTVf
+-					Dw2DJEe31agigtBRFZPICiZrq8YcH69rn5V7
+-					rOy+InUYTozL8XOUTThiOvAE3gZqAB3J73PN
+-					LSACnFRq1Ntt3mqdNw== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					EJfIAFT8ihSZXxRlLLV/0vJ8S5P3ml/97dNW
+-					Loy2ifAL3+r1qVFIf8ZOGomN6ZF98OK4M1Cu
+-					Rk8TrXbplE4CiQFF7+vWwSes4NtcSMTJTA3Q
+-					V9Ehk/zjiEgrvUl8o6IEbMo6Li9Neo+/SKCw
+-					A+GmSmq8mr1QGbKmPuwgmpSkij6SDN//xuCw
+-					x2AMDppwnKahVYeeA/fn5d2Ja2KhEwoxkM9X
+-					GGVdPBKxdG6r25v5xImows4AWqDiJysBjT9P
+-					XrhA+7IEzh1oujMimZ4nV/f0h7rknxaGgkjr
+-					9pweheUpI0xb2qGVf9+it36fHSJL7Y7BvFP/
+-					H72Cci1DGCXAaZ38uQ== )
+-mail.example.sec.	300	IN A	2.3.4.5
+-			300	RRSIG	A 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					j3or3OPRZZcy93VY/A9mWcZkPxqi/NcPz52a
+-					X5jPjXoHVcpwM6/SbQmnkjv8H3PdfVaWwW7/
+-					KOD2GOMEudZC/E1LiA09IGDtMR1Sz+7Ythq2
+-					uGQ3JPlWAmFq7sWegWVSpIDeOKRuJN91/Y5F
+-					olyY0WTYk9LZu5Jhjp1YcD8FoxE= )
+-			300	RRSIG	A 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					brufiALVyphNdDEA4NLWVi9iQUVEB63Af+Ro
+-					2uig2q22XPTUOBLg1hrNJDUkdczG8vCUBBC6
+-					ZKiCQ/z6d7cm2gBTrFBZZs+OzRKZjZDY5mfL
+-					wz0JJ6pH9befaznow5RUGOA9qvf6k8Ob0yWM
+-					/JWfN99n0e/RJxBqQeo82tYW23/O/RVinmZx
+-					TmabPHJYybSzlNAd6yBFgzqz/Rm5Qqz03re/
+-					tghkgALM/H77NoWKzO79l4wChQqPrG5XNV29
+-					TKQ9+p6tR/9HxR2SPeMHhBCQSR9WHcaZp4Wk
+-					jYXD1Bo8fnz0dka5D+R6nKCuT+TfuUezQmjK
+-					sJKM6/tRBryilBBMRQ== )
+-			300	RRSIG	A 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					AhsXyz+TztaueevZHV3V1YC8kMsz1VisZ8Ja
+-					T4/LtB+ZaJYGgSqT66AovcGivXfhv73lM6cw
+-					Kp1VnlvBhr4f30sPkXuOsC80KSLAvsLp6yCS
+-					QnSMLT6XVCNgZwLc5WPpsOthAOjhNxiNbPz6
+-					O+odMa/rW/EooC504a83KJkcLvvX1okacSG7
+-					ljnVqtO1XCFozTi5aImXf3dO7+AzK/6Dl0Wi
+-					Os3bme2jb9gPuyjwtIYbC3ej6IwDYJ0upV6l
+-					G6ibkUWEPTQgoRPa5opBOod3vHd6sEEqr9V2
+-					4pRuK9k17NujJrcgmPtI4Vhqmfy2eQmp29TY
+-					dgftgmEdr810yDlAFg== )
+-			300	NSEC	_25._tcp.mail.example.sec. A RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					SFFAGKi+qM26llKMe4ePNYY7lXsqkbP2+pXd
+-					6jCc1ID9R7QOGQlV9LqO5rsEUkWSXUEUg8hZ
+-					Z2R58go6jHpGIDltduVZ67ltG+jRqQM0VlAs
+-					EGVBkqlF5k9PHVHg0O5OF/6pIi341EvOYodF
+-					CF/9Ywwx+N9K6kquU2M4A1Hz+UU= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					ESaQbBc7BRAfQS0eqqjo8GHZs+D3UuEiah7T
+-					c24iuLvUODcZUCsabvxXReJBaVxX8eATuhdi
+-					chpLnjJKbqDM6/00lmMtnJD989d620L0Zbcn
+-					GhqEzOv/5sqCXZ1cdu3Og3Vm6UsN99xfEDcZ
+-					/FVEjAQqraDo0Lj/pDgmkpHX5gPEHR5l1bal
+-					JO6BWuHRmgr7t0HE6j+Sq3OFRnfGGlOAgMmJ
+-					BYZHOGrHKNgo8d4ToeGKY+Liw2+3+n2iFwQ3
+-					u99v5E1jycps8gKWavQjfZ915LKkCmPljbSr
+-					SwMU5UBNvw+q/Amu4GafHOpJjMwxnnvIROER
+-					utFLORV0YcNBv2oKKg== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					Cgv9JsUZJziHfWwMWuHkcUgDcNWj5zEZZoDZ
+-					UbHZ5MGb/yRSaq9Ps2NT7yzWbTtKkHx4K/Kr
+-					kzVOWyRshHyHbzzRwmbC7tr6sTKJEsxZCoTd
+-					DtLf+V2xrQECP4oI012Pxcg27l4BnK/Hu2Or
+-					WYoPsZIWKcmd3NfDgBZW1M2/plhex4dIzXR/
+-					886+vjAjRCT2Its4ZD6IAexVhJsSQiej2SLm
+-					0D7O+LAFlAs/NWYV8uwHVGslSb0QzB0Y9Ui9
+-					O6UtL9ggc9Gz5I9S/mO4pbE+POqBInTk8kju
+-					BsJxi0ZcdxEg4Mg9ZYIFBO5BkeQZ/9c4Oi6k
+-					sg1GY4dE7xU6RB2eSw== )
+-sec-02.example.sec.	300	IN IPSECKEY ( 10 0 2 .
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					XzqRMTJMJ0oSPYwQt6RIOfScmhcQa0iHfbSs
++					Ix5TV/c8lPWuMpanbjWUvsMblw/GypZLiIm5
++					DjKi2eMDlLNyYNN9DsflkwkPaBbKirWq4vgg
++					d18bhRwqL3Y96x2ks89aiP39AWrau2yZDzX0
++					y5fJiN2jcSc49EWsdwk2i+Gr6y8= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					N0FMEYPy/Za21InzmzSYAp9OnDF9IEhiCXaz
++					EhGlk3cBFsnuRvXZrtTScoDkUBXuuFncyJMW
++					Sj+WGg17L5UhsX6rwx/EjQF/XGyI/DOLZKB3
++					c4ll4t6QodCo9Iz7kPXmra8qrdZTRPRgRqzV
++					6HAk/so2iCidbEaG8gIBfz9YWBRn0VCKG2Wp
++					yqLqs3IlAdR5mJ3haOPM0JWr0kWywXA9YmWA
++					fvxXtq46gepNcVJv7/JXr2b3c6LQX4V3+6mc
++					NhxsDK8KrLZ4KOdgwUWYv0X5mXZ6EE8/rQJe
++					SVrViDzVWGshK2mS3+VJzbZuPkXaRXfxjkcN
++					led8XSLpIlzGhzJdTg== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					MR7kag6aIIFa0Cjm2FaQ429gN3BNaXZOSFer
++					Lfop7SrNbBG1+K4beNuyX8oUUFuxaK/JyQnt
++					B8gZ3Sd4+X+gRQ53gf4AX3qNCsngR7OjucmU
++					71r38xw37B7VaTmGYMR48byanpvlX2RkINoS
++					utxs2w+O/oKGZsK4VwNrQcQc6ZuvQ5DskIEH
++					lpKwkZejlg7GuLaosnZCRiHmTxehhl6tP3cu
++					hq5cal0gObUPDrZDnV/ii8E4o9alh3TWeUoN
++					3pvBVlMTOEtjRA4LRw8b2AhDEne/GwNlo96l
++					dDvcMaUL7K6BBFEkauxvL3L1nqzirLqBUKQk
++					OeGbPbQtWjtChxhlyQ== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					mzBFRnRJRVITpu2gG5Z88sxCRVtPxJUvII6+
++					luYDKgZtmIflXHcpS4CC9zccaGJAuSjuBAgv
++					mDsbN2Wf9s1sC+T/YFQG53zwom7HSakr/A5P
++					LfYMgZTlp76W7/Bd+6AzdhV/LQ5lFUBOd4QU
++					GrTObiRlpTBidCP64780KeJuputoYPx5QOUT
++					zxaIRht1HYSvpHYv45tCraBK6ab/1bZKrcAO
++					qVFaKuWeYhgJQ4YNyyAzKke+Acjr3Vu5Uz6n
++					mMyvoiPx8saiDJZs+aonkrEVONYF1ZW31UtW
++					gIAbxJvWPwfoh7Dx79v+TEwtH2nEPknuQdso
++					pV1/AAwEJwMo9ypOlQ== )
++ns1.example.sec.	300	IN A	1.2.3.4
++			300	RRSIG	A 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					VSulhGHN1NV7QH6uzJ55ApxAjZq+6Qn+DvT4
++					Y/Kx5c4bw+ZiXErJmJJBmENScT+52Hh3Ki1k
++					x2O2hoIm7v7LSC/+3jlTjEXmPxV6+Cam3s2U
++					apmxZN+B6KlssH/1lgc7qzh6yBDfs+IZaakj
++					tMt+2gUSx3qdajLtXmAnCyiLJLg= )
++			300	RRSIG	A 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					o47UUbgcUSd9S8zOFs8h3vWTmcuP+cZRD684
++					UOEtfOrWNGmX3kQZqB4UznyUxALz9gxRRWzX
++					zDK3huPkA0WupVEbYJhqx36EqLMEwryoGqE7
++					L8upivTohovDeuJRcmz1xq1M+8nSNOr33N9T
++					yEbpiuN744WsnvGM2K/aja4tkMRImuk6Ed7n
++					sFMUBK8+SQxmIVMdGe4laJZLOxVKqXAkmIw+
++					xs7yDjPs2JWzFD3XFpX5yiQdcGuwFIFbpc1G
++					kdxcs12H/XHvNoVUvMTf1soJTcvaBzv/UMFy
++					KnRSuhCk9JwQQmguULZ7jTgiKVSSpZ9+xr6e
++					xuxUMIuaR45XPUXV7w== )
++			300	RRSIG	A 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					Ce86aefdf0aMdoDxrkoP3cpUTeZRR6us25Vi
++					6T/ShoY5st8+0z/gkjraK0/7huNZMkvixVeZ
++					rnsi+g2z1Kvlu9wjodDfiVWUymjrFdNtqscG
++					tsqNfBRnH3Hrzr9ul7txWZFlcnrLSKm5wtNK
++					XJZ5ChH02rFvIgOpyJGj/msvh50j1xmXENrq
++					xLevWMy9dQjqi/iJ2K0dQQCL6w9iKW/ixxh2
++					Js7F9zYkWYoPp8A+UhrAZep8Q7jE88iymyko
++					EAKIbb7+/+QENqJw7WDx+fZ7eBJkvLNwisU7
++					SwPT1vYRgDR4eHzRJGPEWWEIGCsRCj3PqOW0
++					no3CMvdnYisET4I6TQ== )
++			300	RRSIG	A 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					XFdqOX0w3WgayGkDBihXDKD1zhCBVOeaW3yV
++					J5YJS2mJNgbGUY3QXz7OwSeQs8cD9cHxget1
++					oIMR+op3H8VY6h3AzJP2EUNWw7Tuyh9wpdpU
++					NRAkRA3vsfT6eBccQIbTWSYFIypdDufT6PHA
++					hMJNvzSa7ljRPTuGiTZCersfvJ0cObNE5R55
++					Y1qNNcmoFPysCHzZE7sdxmU1AO4IlhuXMA8A
++					/LCXGFiMb5MKzm/qlrukTnUn39t62yEkisuA
++					9P0jMD5fWey7KyZVS1K2dKqJdfuhF0eUUf7D
++					5i5wi0s1eOCZGRV7BU24Up91DkMUHCyWQ2y8
++					LoXhow/oMgADtWMk3w== )
++			300	NSEC	ns2.example.sec. A RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					kVV6hLZf14IQaAISR/uaacBi1VBjKH46BsYG
++					E9AoKqcBO7Kxu+KEj95yBdea08vzko36kOP/
++					uWZ9cMXjXCigMojjqFWkv1RhJdMVkQ/IgDPx
++					MCDiHrA+LI4z2YexyDuW/dnDacDDBS8Zv0XG
++					gwMu5+86R/lPpBbC2KIfPXWZbnA= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					VoYzCDJPSLHtbuhrKoX+po/RHHYU2oYly+pp
++					xhL4M3SNRxD7JZ9+dY/irqcGLheiMREuRjA3
++					rCGp2NbPtLjmMfZkARzhoOTtYNri+p0ka53v
++					a73X8T1xYAOW588ziWLLruqKa4Mdi+Ru+9e3
++					aNW6AzQC/MGhiP/Wjd1j9ZeGbzyIPq7rFXgI
++					7keT6XhRkdsGI0jMZmm6YWPRqwJXr0I809Wj
++					GMdVfl3+Z5FHaMQyEXE2LN6pZnUY4817GfLY
++					dAynL077dRtcUOjG7MU9tQx57rx6aNw9I/Qd
++					SjWg5DGWcqAD6hVZB7OutY07HbODFwW2YBKK
++					SD4pO6+t3OUyTimNKw== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					MuiOyDyiepK/LcssFA8yXDEeBQiw+O+45C5J
++					Jzae7DMDqkW/LtZR8BBrKmbp9H0rTs32Bnx+
++					CD+UKc9IW4q7N6ReWp9/LAEK44SgYa7PEnkm
++					YGWBZqPeWqmzp2UTVipD2n9w87iFXu0lB6Iq
++					7/nuBd76WBBXULjMq7HppkDyITEo1LowffkS
++					le/rNacTQYmoGjIhjZG6aCIbHSVdzsxT7Keh
++					apXowiGAJST7zzL05055Vfw0VaPx2XyPacGV
++					xlTwZD6og/fH0dphUIPy2Bsad+Im/ce1rmQ+
++					H3XeUqzVIOWpYJqNzEcythfxfcfDTdPg35Hq
++					Fxo5vKGXe2FteolkQQ== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					Sga51xsZS7XpV6Qgm6bL8HY7xsplIOwKyw6W
++					VTFtZk86lIysiGEOCPkZWJ9kkc6QpytyM/Lp
++					hUfSKU1Swto+laEKt4zGadVFALDb03XL3Mdc
++					RB3qrmZLIDv+8ox8mTrscv/mTjt1PPYS8/gn
++					IwMtuJkFb819ntuIgPoD3WL8ttCCIJkq2KHU
++					+Tv77wOGGoos5OUKtzXw07t3aQwbcNRkYJjr
++					91YZqRxLL67FSBXKhTRZmpmvC3Mp848en07A
++					4vgvij0JJ1YL8Zp3aIc24dyf/CZ8HzwzTQuF
++					he33AXb6xjgmADby130rM66bO1dSDo+/2GRU
++					6p+CttcRRbjk2GParQ== )
++sec-01.example.sec.	300	IN IPSECKEY ( 10 0 1 .
+ 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
+ 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
+ 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
+@@ -922,295 +1374,270 @@
+ 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
+ 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
+ 					zZP5Vd2t )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					srEElTd1pqezDk4QXaxCDonm3SDN2vSLfSV2
+-					51LzIcLuWaAP8uLydQfk5j/EclOLq1RRpcNS
+-					QqGpH6pibLFEP17dzqBbPj/lpu3FC62u9mLE
+-					3WIQm1rb//yX623M2pLmMLnXLdbXiDISwX/N
+-					27brQ8xtg09uLo9NbIYX9CtA6+I= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					SR/yF8wfPQwjqtzJF+XmZ+06sUz7drIUyCcJ
+-					03iBBq65kMEMlglSf8qVboaCY2H7X0E3cNfs
+-					Jioc0uxmRbhMZrChMrPY4PR5eKQ+BP4GENLp
+-					SnBUAWeBGmPhfK0vwXuj9Pp6AgHrCZcgYxM7
+-					AtZemWm07+BqiWwQWM1e9hy4BMjH8yCyTCAq
+-					a1y7KtYXWcAvs6YRgrI8GPMwDtI4E1JDBUR6
+-					VN3aSFFfSXLGSO/Xt1ogVWeAMIifzm8at7xh
+-					OmHkkOJmw58lMRceaKH4DiNwgMe3Wn7d0wgO
+-					BHhh1awLYLXibzHDeH2WbfK83lMbPRPs6Ajh
+-					EJigKAIYWDGebUi7mQ== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					TWykLOTIRHVZaU/h4nnrfHWBE11dbknXM5Jj
+-					LWtXv1Eb6Z6r+b31uQCJDItjr+t6PotEDx3U
+-					c5yNnD1L+4REoWsTxdGj1J6rS+QE7h25kyBn
+-					FBD2y8X/c8NjqJy3zfYw7LOALrC11IaI03iH
+-					SpS4P62+B9mQa/QG7WFc0N9Bjr7QrcW9QI3r
+-					AGiu33yQ3BGx3sBXFFiGRxq+N4hGHx/LpUJU
+-					DW85qFE7Omq2Zd7kaLUkuo45fiwV9P/54G3e
+-					MvwHOmTjucJOZraKKoNibsyX0KtC9WROTgnf
+-					OwaWBFjR3xILtHOphvgjcDDU8Jj4Cbgo9Br8
+-					USMYDy2MWtYapSuAuw== )
+-			300	NSEC	sec-10.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					s1KV6YbHSHFljDxAM+N0yWIbqBc3bV2nBEEw
+-					c7i3dLQgVALjyqItuthZNgI5AB8lBgcFstNR
+-					uM1+Lp8lS02lv0lQRu5fXzaeieg8l7LM4Cdj
+-					uRLhqdVZEzYuiCS4ZojnRjwzDTigF5ckXbMa
+-					g3Z1/x/WFcGhlBhwktrOVJXaJpQ= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					HD0pNArh0/sVcgLhfaJagHVPJ8+v7HMwmwE0
+-					KrzvDBrRBKmcQOfZ1KK7JaJfv6lHdkHYizxm
+-					gkJFcSj0b+gHNZGi1S9la8M0967noVZoZjjX
+-					rY1F+VcxTq5LUu+IQVyMoY6hd8twvNK5LSPN
+-					zt51UKm9BB8yNrKwOQi0fYz0M4dYC3x/5Mij
+-					QiBMZrdUj7DjNP/mYpse3TOMip8ISKeEFEZe
+-					7m6g01mjc3yPlsl+yNyRRdwXTv3HExGo0pGL
+-					JRio9dt600BP23yI4d/QPiLPOAiQ8lpNMrVu
+-					MsVqS/clsOg4fJMLLie2lqmGPjnJCkx9CUbS
+-					AFaOKXHgPwfRWj3vNA== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					ZOjgqUmmAgf+Q2dCVvoEhEGMOpQ6BYV9NkQg
+-					kJTY/b7sk3lolOH4D2sPNeJPXEn9IwWx2HVH
+-					5ou9paYj9Bn3CffUPaEDBh5eX+1wiQKiv8SN
+-					FTVOYFds38i85PplVu8liY05P9eic8kXNoC5
+-					clK3c8wWKZNtcewhJn+bH1YvSbJ+4qWgzSXi
+-					NSKXo+wFElkh+IJDLJXjxPe4f0tKPGA55j0Q
+-					1/uTGoOW/1Igeb4zm2q3fLtsxn4bNwDdVbG6
+-					/mQRjNm8X280bzzaIofdF00nXxpigOHwFLll
+-					Fh3OcZ/73IQlGUB/ZNljzjjI47aWWMilcEcZ
+-					1JfN6sYJMPWWLiFoxw== )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					tG9BDXttAhq/pvqvAtAnsUin46/z66T9yHLH
++					Pt3gzwnIa+r3F5hqGxqmWEhelWUUxvwGJcQh
++					NDscQmWvIY9acwKF58d+2sY4JUOj/wR1ZSWD
++					9oYSMe1Jnt5smGcbVEEwvc+oyQ2POVYRO9wL
++					KKaodgZ8W5BGgyk4IHYqS6Fp7YI= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					E810x3vA/rvBht30WgCi7oBxxN6hPlJn8dKY
++					uy1jAC9vl2W3J5A8UhIt89sff8kTGCd3dN9L
++					yrx4PEzRNRKxbCXXF/ZCZdGiG8aA4BiLUTPw
++					tgtDzuqx2RAm6hxRlYw8iERDn5h9tdA625CR
++					9cnROxhjx3x5F/Y9hcJf4mz4jMKti486DMQB
++					uKENyFFBbSx78ZUtFy0Zo17MXV0xM5GsMSgP
++					gcS3IRgiY72OR43eQ9HXpexGmt3mnQt5xQ6+
++					QWELLmWNkKcOTZamkeMPnQmwVdh+NGJVLStM
++					xQJflq606f0e1YMj7FMGJnIG5yJZwrT2jrQD
++					2N8DcDc9H8/wci8sZA== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					MRFDvSNaBDN0uXJHShWHAoe3163OlwKjh5Vv
++					bHPOGmMqChzJT56E2YN1LLNHNOCCePWUqWzI
++					8KUpSEzHPn0T2v3NoX2D59ZpHWBY1S2CFqxE
++					nQf/qEh34C1N0ue9sDlj9lH0ze2+S5rKbI35
++					UVjcO94kGKpEcBDPfRDEBcfgoni0qrE0FuFG
++					S0ycAv87e3wkWeF6ISkeuHph6hSyrtol59z+
++					KdlMTNY3vRvAQPv6oBdmb2Ri6RgINkb6s5ze
++					gCR640JglKzjPDyysJkTOeAUK9TZzNuvlXVu
++					btZkqqSdKpug1ik5WfpQWI1u9RIeSYFu/+ai
++					usucxtivAa/mE1lsdQ== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					iydE1zSvkIyU3ogg44zbiyv8aMcs/o1peWKT
++					49o38rb1cg5w1dU6Y6SuyHmGI7LThohOhZbI
++					gNewSLV1SOa+40a1sEeKuwyMdqDKMgTicH42
++					t4P0FKdZIJmMtwbRqV4zW1uB+6FiGQbYwyAE
++					AWMKIbo6MGxKO9kXfYCpjewS3yIhI02WL0V4
++					lUsw+rupSUbDfhykghy14qBlF4EUCUfIcwZ0
++					ROm2V6oEF3f8dNYcuSDovgF93qCamn7q0MXe
++					U3lsmz1B3CspT1anuezpvR/kXIXJVpXSi2Ox
++					U35K404MZkLzl7wZNaGR1pwkW2oTsWqPJSQs
++					79ph+sMC8vi9c+xguw== )
++			300	NSEC	sec-02.example.sec. IPSECKEY RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					YCt3Cz/LoltgpW8xGEYNTIH1tHzuE3BWX057
++					gEex4Ymi1vVQacfBYMaiDZWg9VeVonQ9kVNP
++					0q2cpWCIbbwu5FhLqiDQhBE/eQg8eDlY0Gwk
++					CCSZqont4U94Q0NkuL8P2cVH6KMkTyifYa8I
++					9/YYV8y3QbZvFVWyv0kvOXuUqP8= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					UwuuJi4OO24/1H1+Tve5xkBiisXsvk8rnPac
++					34/Wpx01PXiKKfSmkCUX7tREYQDqHeMbgNQF
++					OQYIjeLNPVEEKwrAzu6115+H2FKCk8DDnxRr
++					OOAVAQXflDXtZ7op7I7BwvAMsxA0N1r4e/lm
++					tpeStt8Ky4QVICZs/XJ/zqnMwoOa/QJwY/nG
++					Kfs+V5VbuZqQQDBEVLq73l1Zb1r8G/Wj+SNb
++					/d/WBDd8rf+u71OFZKlJgqSd73Q9fQyYtZea
++					cKiGtOpzkh1WT0SnATNhE8TEDDzN+K9ymoSW
++					8/gggv+W6L8/cvvfFYkAvKhGgdhuzJS2SE6n
++					p16Gl/Yp7jQnmVgnoQ== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					Yd9ttghL3MV3+45CbmglhbEDp9n1qH3lfLs2
++					HKoNzSCh0AGHFwnNbdAjn0l99dk70v0aYZ7k
++					RVQkYVXqHkHVvQdqYs9FRtIXct4e9bHP2ZKB
++					xAAoRSgKpAiwjhr0MX/nq8j7UacsNB6ndU5R
++					wpAy9LVHJi260ofvyAumJazCYA3z/a1N+sTv
++					O2Wzgkm/qSlx8AKrnTdbOcTnD3Vq/bpRoY0w
++					RFcs4N3qdkILyTBK6X2I5eh8twHouBoeATWX
++					nIs+I3LGvp+H0gAntT2OQGqeMaDQwYaRjBJJ
++					akwoyc6dRN7rhD5Kp8Kpwm/HOJ+I0nW9UZH2
++					jwrE5q3ghaCkAS24Gg== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					hPq+o9oKOcu4lXZqKZljb5vqEgyXceKdZhSA
++					Cb9iTH9gQOAdl3xPLMebiiugPaQ9loJgZ7dl
++					115RFqpykpbM62aMs4gL8qB5HXzeoT4tmxyC
++					HHJMiIGfBBAvUcbTUXqC4P50NiFaC7dmmW+E
++					ntAZDbBn6QcsH2La7pPgtoqTA3vANDzvxDfa
++					OSwqXKaTvaYuuMo5I8ITuwygymWup0DtE3PV
++					fc/c7K0vxWFFKV3uss3WV9f1kTD5AzSqh/Q+
++					rxYyixdPi2LlLmZ4K/7NRBy0KLKxXGQZaBkl
++					rWF0rTpwnJYh2pnfhKJN0RuPBQxUEuMqg2Ul
++					VN8KhJEgxPg+2PzL6g== )
+ sec-20.example.sec.	300	IN IPSECKEY ( 10 2 0 2001:2010:1::20 )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					qJHEWMPK9AnL64sEGYj2CNF10HQWeTFdV4IU
+-					hU6O1/z9U4PVOIKmJNE71avxoKOSRBIfAB1f
+-					yR6BK3HBHcqsIB0GpGlsau9NQHHCYYDdypFX
+-					KlkgH0GR/vEnhTlkEO1KPK06fpx6C68Gr0dL
+-					4B+vf+S0I6KbXnP10Cj6u0mO63I= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					t6PoSUCO18D6svanlBKJhl811aei9SkFRuND
+-					RM+DV7hvdeWLIY7/qgZnlxIRD6m/Rzta41Is
+-					3H8NFLXkIUrB+V/CpXMMN8PWiSgrsoh6Ovb0
+-					K5EWOiEjZbh9TxMhgQzDBwwU7M7wXnUssWWY
+-					IVpWiEKvqGqKj9SCdV+Guig3SSt6yR16kRJL
+-					+63OJW59tA4/TSdyywTVfu3abQzZe1akZz7y
+-					cRkgwb204NAJCSLnU0AG9Ss5ic5Zzc3+ps6a
+-					Q4dv/7a1YLnvzTWf/WxeWy3V+naEVS9SOG83
+-					3qqydc5VVI9dTM7dgUm+Gv0cf3JM+JXehYGK
+-					OkQUj5A0OQYk9XizTA== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					Ts3gkpxjiQ4DT0TxAPaYjCWfVyVg5a2QErWP
+-					YAd+8go4QDLmMz2hzg+ANapHzuht6LRNaaTU
+-					gQlhbT5xKrgBSwcu6WRyWx5YHrR1FaMoH8DN
+-					eq8xpzm+81A6TVpMWfzWYBd5YY2itftkiinq
+-					ke+QFp8rRtnN9ORY5G6jn0FOIzV5fHBiaxg/
+-					oSVbR/Da2OP3XZlDxpzrijXJOCOkn8ROw1MM
+-					o8o7V1XH0HpU9sFrT+gb8wp3fg02IgfBKxLW
+-					WM7ytoZ8comdKy5HA5WzypVY7rRx49H0fVWb
+-					3Lokqe1tubWBQeeJBVytDIgKMwyOETX2kAW3
+-					SG2JJuT1qGSN5UAtog== )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					tjylwqmHqeA8Fd9Pfs73MTlpWZRfE0n+WYQP
++					Otr35nqTntkGdy09rAj5Brx1tEWn8DsMDu/h
++					iyLnbOePqYBXhFaCoBNVxR3/IgoTx8iz+exK
++					8a+RFzJN8JTtZ2F66Bw4NKuywy3wQrUECUDm
++					aSdd48ut7s3venVkYsqWeOUv8YQ= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					0zgPGp2mHOVlSqV1eSy1kMr634A/DktQ2O7j
++					9rwhC8yYq/hfNvyEd/+q3j+femQ9r4KDFucT
++					xDalycVnQ1SVIaF398skn3YcJbUvezIvlG96
++					+8hsTomnwvBul6dWQoTfeYcTjPch63XOQAz9
++					lkrenfVdqrR/tD8sEe5fj8NysSPPGZYepXOm
++					lqTHzMRRLkecFKDIgcIGiMbaZID143t9ywek
++					Y7sBRR2e8V57MiKwA1n4K3cssYy8n4g3QoYs
++					scBGpKKYJLAoj8wSfMXxq8ne0vfWOrwkI2WD
++					TkyMpgyI0k0ZW2nwQa+VvSKu7VFDF+O3oKEd
++					8nNAPLkm74o5Xz21bQ== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					Ggsal8D0dAgBvqf8i510LVt4FrWzK99/tf1E
++					IwJ1zFPGl5vdkDDUkBCDizhJ7suar1wKBae/
++					3okQQaS9oYy13BdikijxyyFiL9I3fiZ4YH50
++					x/ZIDju8whbNxrExYV/xig4MrrkWLcVDBuKt
++					N7ZKYBpD9d1CigZ37YtRzWXL6XdRrPTkDEGp
++					Os4At1yjCsRisbpA35xGCHuy1Pznu7wyIe++
++					+I9a2j/hJFTOsfeeTnRpNfWzQ2d7PMLglwDf
++					IXpmxsKQKwLgJAgCOZZgLzxUldAZuGIb5/dC
++					KzCcJVNai7IKpn32dOrRT/oTFXPlZBKzA7we
++					H3cXS39r/CtwAksnDg== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					eGibxPy14OhN6qywILDF6U2ZX0Nn6+LyxMgZ
++					E+GUTElgKZVj5MW4Fv/Sc9labsVFPh2jHbbM
++					vShcRFDeN9s2krI2xCUfwftmR3hYXnRoNCN3
++					lr+ug75ePSXW7K7uo8JTyCc8IgpdrOMgQVMH
++					s9ap9WddvB6wcXUnSWr9PYmmtAkYGvs9VbpZ
++					84lyxtXpXz/NahrToVmip7xjARVZydq+vTfh
++					WwZJz0NhaJKJdRUDA1kSRF99aqJqnLd21LTe
++					cLmCMEqtpXx17bxMXlaBUb3B7rq/BKJg4czn
++					UKvF78/9rEysIUpju7LxxmLSl6q8dd0dX6R4
++					mHx+wJiNYMEz2tZ/PA== )
+ 			300	NSEC	sec-21.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					oj0HO+ZcjJeWeNJkf4R9kYx570wwEW9BKOJj
+-					Pf7lSydkpCusVfIlS69BBoBDEVKClw0Aofq0
+-					h0KEQclUX7gj5rR0lWHJISHAA/70a2DJqRvB
+-					W3ItQ7RLen1q8zMGs7LyfNXPjrQjdrwZ80Zv
+-					s+tDaKtZVOUMG8XIIv8thbWarWQ= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					KJmUYgivZf5BE9CmPLcNAIfqRCkKhNbtUTuP
+-					vnc7hgEK/ifUBwGSUIlvwg72UuTZcd2TSykZ
+-					MUFfhWbBqcR4ejzye1IQaYEiNPW342zLnsaw
+-					rqzYENZOMkXSAV2fJo9NrNfh9tTqijtKKqy1
+-					5fEhpz4mxecFakCmnWnqXPfsCujQ9a5qvbeg
+-					kUrBeto33SH5SG6SEnLqXlHNDc8VLLhETFzZ
+-					Ym9LFz5m9zcd5hlETjou6xCFhoXSxg/vfqQd
+-					joJmc7/YDGjaA+v2C6xIfPMgDke2BchoYN5V
+-					3ylTQP96cuPb9OdgvgdS5VVnXhHjoxRCWjHg
+-					7fjWU6QgASdP+1GkPw== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					ZxY4LUFxLnczFLHPP805TWHIkwE8PREHMEBf
+-					OAXV/F3LN5LRoG+m43ze+SelcuUkOa8JZWhO
+-					5SYdLyV8yzpchrmX/+/uKfX0cS8meg7DwOpv
+-					s1vrfIxGhGGHagF/aSAlJx/chpTaS2iRLaUX
+-					AMasPRKnFaF5Hyi6mCjbA55wMn53l2xT/KEs
+-					dOqXqNr+oSE2BW1cnJv233K/J9kpS9mMeETV
+-					T6KfgEUMhyYH6lbGFmplhUxFlS/7eSWh05SF
+-					W7OMJv8oKMTZSp4EDqdEr/tc5dRwlV4RJk5C
+-					IGf6Gmk/SCkLrLzouLOBQGks9J31Ci7wE4ja
+-					mlcQ4CHD4osm+MCRDg== )
+-_25._tcp.mail.example.sec. 300	IN NSEC	ns1.example.sec. RRSIG NSEC TLSA
+-			300	RRSIG	NSEC 5 5 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					GZUj441s800Vb4C0mUVvQfuEtkn6fhZ8+78Z
+-					O+nVsn/EcKBhJ3+qLomFDopFGIedDMDN0bfw
+-					0DLFkZGlMJlYIOxhBDEmonbmmiFNiuotzlI7
+-					7bBBWc881/qgSVVVP5BkZkZzCOgn/Er41aiO
+-					AZOXRlgIeGYjZ9OZKIMqtPnVTbY= )
+-			300	RRSIG	NSEC 5 5 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					T2KQtM2CUU8g1ylwdjMsIx7e2WI/j2qA/45o
+-					DMDnSlqGNpFMFgn4l4/5wJQALE+cskBFPx2w
+-					UTZC4W3qXBhrF/QJSW56HU0gYEq/bA7Yw3Bw
+-					T6ClJho2693XTBZDwu3j/BP21LExqNK0nQZ9
+-					z074CiXUm1pTimc3K8wmrEBNT5G3dKOztd21
+-					ktretO7gOFDkLLCHpvweWox6zpsUdMXqC5vV
+-					0g4ibDzNOej28As13dtLc+7qrOphmIRYi0Gj
+-					+4WsCtiT48ybKfM9Xq4UsspxQg8fE3ztGfJy
+-					aKeIpW3GHehgu3Ja78udKUpGHKl9cIN8qL+8
+-					x5g1nx8TjwrCSp38jQ== )
+-			300	RRSIG	NSEC 8 5 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					zK9ePGE0f6NcsUsrRWA73otHTWfD8uzY0yBY
+-					vlmYoQtbc5FtnHLUYb6I4xoqYL3C2ILbpvcC
+-					pUQxZ5daykW8mHd1iJXEsnPogqr0WBDyGOQf
+-					ad44CCcNiJ1C0Wtk3Mn44Qe4rQE7zpZ42+MM
+-					1kBTMFF+dZ/1Ud+QbK9u1gAVagsutJZ2CmmE
+-					s+heNr2TEaED+FpUUbNdCw/Fd9Mk+I3OWFVG
+-					xrMr8Uh9g9W+d4iCVqgQ/iohGIwNBMTEsePe
+-					+odNGQBDgl9GTv2PpgMXETtcy5wDkTwan2/j
+-					1DOqYiOdu4BPieVwPTfRWC1VrqI0XzQp91nV
+-					DoWdbSntdVtQBt9yWg== )
+-			300	TLSA	3 0 0 (
+-					30820307308201EFA003020102020123 )
+-			300	RRSIG	TLSA 5 5 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					onpENNKVruacKg+VOesbEGIffNGUJlOyPqyI
+-					gZ1F4A/qLhyYCMqnkNOQSOYXDeYTCqB/UCn7
+-					OzJIObaOmm5osmxlHlIALUzP2LQSnRr6qt1z
+-					aipTHTzmVAefB39lBgSXmsEI1xvJ9/6tnwUM
+-					EBz4oYroKxKkJjAGt/I24WOoSjg= )
+-			300	RRSIG	TLSA 5 5 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					kZKszgG8KVjZNdhfWIITRr0Z7Q20RPTNrrBZ
+-					b3Q1WXdRxAXK3w9UAcOmb7Yg6m+1y1arrmDQ
+-					1MuestqGpHmJntvH4rnEtz8F4BsdxX8q2Cr0
+-					fZ4ZzGNuH7F//0jkeSlNFPLZN9uHgQxQ0vaj
+-					flGcgB0r3B36DomI6uj2vMGN0f8CS53o04+B
+-					tJaqdbmR8BrRDP1KIWe968tq01yhPtrZqtYe
+-					+WXy9bJv76fb6N0s4Ak6RZ9vH0vjik+BsblL
+-					YIF8A1MV5kSDMzCqU4eoUvxHhc87XCUa/aC+
+-					sxA11oyPhMJhY8mZeqZ2xJ84myPSiNGSEEhq
+-					OIsDfIdbQFHOCB4Qmg== )
+-			300	RRSIG	TLSA 8 5 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					IH5582QvSgX9COm/HqiI1bUu8XNew1RMdjXE
+-					leb05YrZIZ+eqoGbHOg41eCAjy830wu7qoXw
+-					yXoXDDGt3bYxYAgKAGIQryYT0rNXDOuSeZam
+-					/SFkd5EQmslbouQD1SMAQQ6ok331lgkIuUMq
+-					vbWxUv3gl38c65dEeP/hqsSgvN6U6INDuzeR
+-					tLLt5uvwC8XPBGI8O/0h39+x1GIaNpcR0mbq
+-					Gvw9arZtvQmaGwu7TQyKyctyXNWhWUNEL+1R
+-					TcIwbCxUbPQswgH8OZrazjs82WuPgSkdk8Vr
+-					bfQNXl+4ZZWp35Ah3zxCeRbrt0RspF2Vh1tN
+-					KhhMBu46kqIpDunK6Q== )
+-public.example.sec.	300	IN HINFO "i386" "FreeBSD"
+-			300	RRSIG	HINFO 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					uEfwWvVJN3COlaXZ4oM6PRnyLApSeLFyJOKf
+-					9t1+Ds9dTTWg/6THtVRLYwMwd6MJduAKXNFS
+-					W8NgAv4el2gboXSGZSRFGkKDjZU/S6nLopvI
+-					MkCeYYQuN9w3/bvR/xHB8UJcaPopzFl4t+IG
+-					EKmKnFq6GEJOuq88Vr7VhRXxOpY= )
+-			300	RRSIG	HINFO 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					p1RR/HJNu5mNCIDPE0JaJz8V6PgR3IGBF3mI
+-					aq/FuMlFVEuJ/CQnk6lzpRjI35WAtZpfYUl/
+-					Vdj6WvTetDa49imIAn7zdM9pQ0LU1sZHKQ5z
+-					m2JdU/r/fmK8QExPYCLhPEMPDTGqOFRrz6up
+-					XiFGlmp3YA8pKxNbx69rfYELUsYbjA6+qwTQ
+-					AaBNtcSb1l2AdS4w7bedmdzgy/rAcLljbj6f
+-					hM2CLIoDmoIz3zO20PQ3g5l/ScSL+zZUW1NS
+-					uOec9dzMhiNdNzdqV9fImpySkbfjdvydFu5Z
+-					E5I3yrmNC+iTkB1ZeA4WgMSTQIOwuCo0tdup
+-					eWp96pY5cRdo4LC1ww== )
+-			300	RRSIG	HINFO 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					v4+OOdw/M4MIsBXhX32TjtQJBmB+32CDc2DC
+-					LXqvd8g37QnMJHzEPIYAmvEsMRn1DRlB7nk6
+-					7HSy2DwPNHtbu4swyYogCs7LGCbzk5aeEZbT
+-					Mkcac/ONSZjl+kEiJUav32dp4/IySt1dG795
+-					nyjuzz3/4WSC/fv/QJrOWvU7eLqF/bbqQa0+
+-					VDZ87U2exA1gq7iIg1rKken3yAL8l1BHBfRj
+-					oI+oozIBPInOm+wA3leZMmj2tcCzDvSGEgdf
+-					VRB4IIx/zzdVPP4WG/DNoVJ+otM6h1APHDRj
+-					PBKFDZhfQda8GT/R01fC8uxm8Tm5FyIgJnz7
+-					IQfkHNcMAXCsPo9lDw== )
+-			300	LOC	55 40 15.258 N 12 41 56.378 E 9.57m 10m 10000m 10m
+-			300	RRSIG	LOC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					GHNspK9gS/zAz0cU8GZBU6P48xU5vOXYov+/
+-					STQsf4jGW4Ikbog2ns3/+4kvZQsDNIhbOAgZ
+-					GdWMwRPGC1DWXzUw8PIpYe42Pql2O+wm0mTI
+-					yxso4A6sV3EhSofqh07dmX9L94N/Q/X1vQyL
+-					SPrncF+FMZCX1CnIee6iFUvDsls= )
+-			300	RRSIG	LOC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					Lb1zNgN/yVV2ziP/bXacrsBdqDNH+LS63IZF
+-					t2R5SLbdLdSsrVlXcL+9jdNObCzqpC/H5qzQ
+-					3j51B0mQ5JSN1mQrIXoNsomDUSM164+Dgbpc
+-					76qHM4r7PNUeu5CAZ6zUGStgvfFleVC9M1Pg
+-					Z2Zgqo9QJnN6rZcYgOjqOZX2U2i8JYrzdPnt
+-					/e4/btWs5Im/j+4ZoAmCjjoFwsI2halDEdpZ
+-					tS8XA+garId2+OuzW090dPJZpaR8ldB7czOd
+-					QbPuwADNWYL98FlFA/+SOd+C5gD0Q08iBKdU
+-					ddIzuoyKcsYwLpWLpM/6Klg3Y+7mwMn46+43
+-					wx5LzUkfIG97aAOk8A== )
+-			300	RRSIG	LOC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					HvUQYw8WP9/DdbJeICJFxhIpUj7VK8LMIa+C
+-					ntxAO/1xGiq4ll449e7ylW3qdZMXo/5m8YZR
+-					SayHpvSsAhRlfaqf6UO6CBWs3C39jr1+pB7K
+-					dRL2RyzAs5I7kERvVR7OCqoWOXkBlqM/dSz5
+-					ClaWQE3md+ZMXBi//9Ico/yK6noSzyM7Lrjn
+-					aBQUYwFJbS3xsT1rc0UtL4v4Pt5iHUjSdE/8
+-					0kA9F1APb6LNZ/VTo/uGzKd5vaRFU1Z4zaN+
+-					zyWxrwyauKHXg+JVNbYjlbSXa3LnmKs/xlci
+-					LzNvdXiUTHBQR+3w+s2GEMNQ7XDYtM2rYXIg
+-					J9KF8v1CU/iQXqqy+w== )
+-			300	NSEC	sec-00.example.sec. HINFO LOC RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					qxNbV3M0mNEVBIWaQfMcf5jXPjsmKqC+bcLe
+-					2kM+j22RhkRYmhvhJPvw5hNSVjAZDJlkhgHo
+-					Yu7hdpLC+xGFJ2TESRXBdiv+0+mxF0CnECJn
+-					i0Xn3ftldu5+RFyZRPLmh//S/eSZqTTgiZ3l
+-					nH1WrmGnM6U/ih2Z8RzdTzc97GY= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					Tu2X+rtzL9YbC7q/TxxtxCGxslGAUXUD1eKU
+-					+nhwSB1/p2A4ZTIVHxkKton+3OM/oCeuy/Mw
+-					n6sEkSJRioJcWIm8J56YtMF/v+Q119WDOF94
+-					hf8YWuEDC0T+zB2XhLy8xcOye4K1K5wLv+UD
+-					leifQ5jgNWtkDeC1rWHd7QH4/GNXya1OrQ4u
+-					rMoIHn0uzuRFdP7t5KVIlqlr3I0HPdu6C5Fh
+-					FsQC6egvKRGbpNhOw6XgT3JOvloSicX7nlER
+-					01roxOVY/mQGP223b6y9mgTqeekVwzrbr54Y
+-					zceMskVpa7zamkDcjb6BdavSb0dd9fmCrtjT
+-					xva8yelrjvIqtfYZcQ== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					TrcPcHA41scU0PInaREU5/6/yOx7OAB8t0Ch
+-					96kMoEe2OXklnx8NTcX8mQs4QjEJ5ABijSoS
+-					z2OdKI/XX5xhS6BO1DQvv0TCK1HZ/y/1pO1j
+-					50Q7YEUvtm3KsyABDL8ejwHgnHnJ3LE/gnrD
+-					fHU8m58uyEIXRVz/m5yScIn+fUD44VpMuQCa
+-					QMlUi/1yLiJfOjhUps0hcSSm/eAsa7A2wVZ1
+-					YWvYh74OeZgP7oDr0dzUhM7r4HETzY502h62
+-					97geaIxgZiciqcfxWaziDD8X+jV7XDSOsJC3
+-					aSgYX8OzYibrA+F/MoumBu8sGK/Jok67qD2G
+-					hiV7F3NQIXu+MZZEzg== )
+-sec-01.example.sec.	300	IN IPSECKEY ( 10 0 1 .
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					N+IOMKdgPX9Rr3i0bbe7pUWq0dck1PoIGnyg
++					FhGPQ5N9kN9SHAzJqiwyA8Wk1go/NrdRpara
++					UwuueTlZhOnWUFTeNZ3zHtBawrQpeVoTfdos
++					Ev666zh0UWfTbY7mXaF4Ypm1xSUmxC4Z/r7d
++					aatMwv60DefxPnsROwlx1HZocgw= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					Ev/1PbSAmIrukwT1clYw49BaCTNH4CpUhA7L
++					jRNDsJ+R84lN57O/TPeB17k6YivRNh6TFNgD
++					SBBhtYnk6YZI4yG23h8E/PwFwSD/bXoYp8gC
++					NgqS7IogNgFsVyI9YorzC2ngWFHHku02CFvI
++					nMdA8jp+/pZwYiTB2QdBSnSCtmwoVhQo5uy6
++					na4/GXeh78LEPVCdeHXHTLTdhzmqL8tNraIc
++					Esc0OG/548XJ7wzAxUC3AEql4iu7msFFLw0r
++					5bnv9nLYNF2B1B4+fifOmleJSerlsB+qbXAP
++					ssV+BENJPKKtykXPv0laVw4fDOkkVL/cie+d
++					8g4qmvKtu4tZesHkcw== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					Kr8agywhkHOZGdA+1m9zYIGkKKwtGaz72FPk
++					l1yg9UMVgIDN2vAj9kYnexefsZ9L4jCopJMU
++					uGD64tXbOeVIWvxdOwwer3GtxSMxVgRhfFlc
++					AcS74bOXC1QNFTRsFBCAxauASH+sAml1CuKC
++					ysZPPWuxg3U28dHqbzalNILf8SwIy8AFsmdu
++					7VYeSLqt5DslrO+xGTqZpb9L3S30MIz6TpX5
++					TL20ILVOWno51Hzy3v73qLjpjeuwoXDm8V9M
++					0tKP58Uh9TPW+XC7WnJ/W1NNJAd5LoZ2Rpc/
++					xCY0BymxdDre6of2DOLmtwP6DqICJB6lSg/V
++					u8IBAJarrNfATWuPJA== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					pbxReQlDMPgS8HZut3zOBhnpQYVc7aiT15Sl
++					C3mehzUrn5QvRSlQyZrnwLstg0nx423UaWqZ
++					uqIWXSTmkJEYGstT9B/EruBb9bc2PUSpp4vY
++					NcXIWHH8w6vsHUPWVOKPQHDtT5tYtK+6GC2w
++					dnPFtI9E1L3RyQrgPoqYz/5f/31VLyb4R65X
++					rMlSZX1oUO9pmHxwogfoiAyuA88hncerKkRD
++					CR6aVRG3DhEa7xjGn6Hxi7Wo/ZGKtaSNdYp0
++					KIaiUVIxQhAFIOiuU/9nqDFgTcNw72Btpty2
++					fREGSFq1bRSTk+CBJXw/UjvLnZdIwJvZ8BxK
++					GrkWE/rSnF+kmxGczQ== )
++sec-10.example.sec.	300	IN IPSECKEY ( 10 1 0 192.168.1.10 )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					AOvxiEY8HYQno1h41Kjg7P/U35XRa/EhJUYk
++					U/PnHwH7/aStPAn0npvZY6pOKGqzZXmGS8Le
++					B04NPpRU2j3/b2hlR81WvMvMU+BAdBtwct69
++					gd1aG1+za4sgfiB9BQQELznuJVeo3/Zc15AP
++					Z/TVYG6cqZNfLw7JPORTCexavk0= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					WoLkHtWH5V2fxCwsSXli+Li1sQE8meKwDMCq
++					6ZnS1r6INL68kWIsvgCOSmt360j2ZK9JvrsM
++					vdfOLy9+wVB75tlYWUS6aem8YwG8bSCvZwwY
++					OgG8BVbZNisutmmRjhUf0unGBRjiXRUWiYDj
++					nVnAO8rSDNWN/TXzqYMGep06pEEiBzKN2Ig0
++					Mft/6Ar9vm5fAYtDcR0Jo79YByhA51Fr677a
++					2p7IfVO+koTuK3MFoRLVSZGQrc7ALFu9UEaw
++					JbQkk5IDIlJnU8ae/Bsx+B0wgv+px4rK5i5/
++					hAdk/1hECjNLI95F6hCPHTCR0Mx+lPOJPD0m
++					TV77HDLGqxBQ0jhIjA== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					GSBxoR9JRcThupcNlgjm/g6XTwyEAF/vHyoK
++					JmwH7DAgfVhwyHjVYw79PkaHGmN/sUwdenPV
++					Bd1GKgOUjvjHXvtO6BQ4+mSEOlCbWlHmOH2y
++					nFSal249NSm9eU4ab3PV7BMFPziGH6o6bhZf
++					Yfe756/4e0rwCKqiFIcD1wlNeGmwVnejPgz4
++					i73nRVn55r+QgcC6Qby+jeZiNzLXgsLsLr9/
++					q4G3Jkaa0AAXmOb7XaFpmEXuqROZzCnceGHB
++					7biLR4U55rC9DgkJPTLSOzuqRn0NwfPs6e6t
++					R/7wClYjUt6XHjBwHqSvLiTLrlv4q65eQWq1
++					ft/uhKP3iI3tXHa8cg== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					eO944SxxYuWjbMQ9XT7Yc/5C8KuphOPU/9xM
++					CvX0KsZMXIWMEdsjLVyyLTPFYmqpyhA82tWg
++					3rOhofLSnyOo1ANoHsJ+9dwVAhw41RERhTTQ
++					Jzv38c/YuTyMgoPHfOafHzgLi55/3adxWsD5
++					FD0CH56K4rBHKTKzpWtjyRqPqiaPCXejKQeT
++					Vk4XYYYpDCoEIx71Vo5TZanr6GKfSNeT89wl
++					wiztTRChDo7GiMQsli1YP48GQGyPm8jRU5JM
++					h6fJg1CaWuoxCTWX/v5+1rxcIjZQx227FVka
++					z9rD3n/xA2bv2DKbLlMBc2nouPIb7C3+3wrG
++					iNRVyhoGksoDY9F1RQ== )
++			300	NSEC	sec-11.example.sec. IPSECKEY RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					XGhMtyCDdm4i3LcU6YgE+Cm9hVbEzUZY08Jb
++					7wBByMAbO7k/x4PTrgA7Ig/cTKbS1YF+cDad
++					ZjIGhfljB476tAr42DiyXLbq9nYBgk5jLpIr
++					hk2nvvIKOThdhQRAH1FSA1XPWXt+8MRNqv2p
++					vqFUf0EThn2JobC61evB1FYJr2I= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					oP5Ph4R9BnLVI3r3btH6NdWs2hznmWt/O5OG
++					qW2o5ttsVsjllzCV6RscxYrh/UmMCllXIhm8
++					hMqFPNASCoBEorZ8AY90B3FS7zXw2pl/B628
++					T1ItaRai837uBdbrv2RQ3JXYqBZEr9hLxlSj
++					PsDjKoy8mkVsDrI472wY+Ym301WrWl0wKDQR
++					1JS7fGDtRdY0YCnx4n0K3P/04zle77Efmfij
++					dYALh0mlZ7JN71pfSwMapWB/JTNo7O2udWGm
++					rEM/zO3eJH8uXhyTe4CFzAWJM+pbdswWwxRk
++					7NqHAohC/YkSf88C+aYXijCZlYJ0UdmA7nlE
++					SiJWqelz2nMww+zoVQ== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					QRiKplqddN7ogKMh6qu16OSH371f6+5Cw6OD
++					6A7kWvsP4s2ie8Fu9WfYyWl1qRNWd4gEYc5A
++					BkJa49zi7qmtDvOoZRD1KFSF6N3vKmwUbBVE
++					c32oxf3kQZxs0Dsp7B056Pv1BE0KaapP45Bb
++					9jwsaJaO/x8muLsOjokbfsACfY/XlJ4kQGrY
++					z4hwJ7xm3b6SHY46Zv6XRw1TyW2CvHkx/2c+
++					pg9gCCB6h2Zjn56FRQPHPcZqYMBroK/azY2B
++					4+GbKTgfA/NqGdw2lf5bBi2fHziJhk6sWkh3
++					RXRRYTQHMZatoehblQ1YR9Bo1F7U6qq/RI2x
++					Tdbe/4cHjVQCkO7t0Q== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					VaOMaZWd4yo3vG8eFaeErZ1PjSpkKsRHNtqA
++					O4EKRe+0SbypAJzg7MiuXyqFoDh6wrMopq1h
++					MwGE0PrJUnMQYJmtAethsMpBkUtxgqZPaFaH
++					jHUTRhaBK87jZDKQ0R/P5gw/whPQK7DJnwkb
++					+4lj9ZT5bbJyJfvfX2jdl7zLEllK8ShboiqN
++					v7LrrQJECCsCe7PL4f4qyCKW5zY8DZyuu8Gl
++					ifE0+wY+8rFNnJWnRShPBivyy4evVsbgfMFw
++					XRqkW1yY0TGfJA4C6bloanBbREeQ0ENiR0KS
++					EfLjVCQqTn7UR+RMhphqYvNvCYKVIQKk7em9
++					jb5HCsYAE3E5KB2hqA== )
++sec-32.example.sec.	300	IN IPSECKEY ( 10 3 2 some.name.
+ 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
+ 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
+ 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
+@@ -1222,70 +1649,94 @@
+ 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
+ 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
+ 					zZP5Vd2t )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					dYRRx1AlyU8o0KvNvy0mAK3jU6x+BnioMJ69
+-					0YtKQdcakpyFUzlswYxhB/7YIm7CfZSFOoJA
+-					3ae8CkzD4sSFthM3BZjvZZZX+nRvw4lju9oV
+-					5SzgrhPDPnpnL9ifCtGVTWA/8vVh5dPHAZVU
+-					zh6vl8tnKQrwmiVApLRqZu5PFMw= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					cxhg/Zu4Y7Why4ftvdVWip4dmqIqi8/qACa+
+-					ZdalnAbGyRAGSWAEAG19tLBtYMFX2NFF6yM1
+-					Em9M8e37tHmwyNLpEnTi9QWGTOs6MCkUAIIW
+-					teCAGiWu3MQMS5QiOCAiJBddLCrV5APi+Uwb
+-					wWavFe5RqvIPxZ1GVG0WcgdI3GabVEavPtyd
+-					7zSeT34J7Bd4bJxpPgXQiRWZpJkgep1e7xDT
+-					MtEmhrUU8y2Bbt5WT3k0ARNYOh00dNjEDvpx
+-					e/pIThrE+xySXvmOUZrvuP8V8cT73IcsMw5I
+-					W0k2WvueLUDZEOHQrd3Yn0BFMnsVAnG/ciQB
+-					92Ma1s0gM+SgZwOHRg== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					YdF5IyJaQVoYlRfuldCFW5CC1qICMS4Gjrve
+-					H5GeqLHReuDhRVe5T7X27MexaC8u5O0Z89Ua
+-					4O5YV14rACPv2Atzk+4wlLmVtk4Oswu30yav
+-					NkdNIKDmvv8voJnjUkYTlDng7I7m9vNqCUn5
+-					Nw1ciuawIzrL4JTdFUrKFWoOEYw/c8NHBhre
+-					7RqJGzSbjr0Qo/Wcur4Kb2LkcuQtN9LSx9c6
+-					wqNmOiX5WyKaS1DDNam2RuRXsdz1oTz1brV0
+-					3LtIydp7F+AHrx2d5bhtjQK/v+tccNBsIpkO
+-					BqXrXJM0hbo7cZ0uNGSnlzjbGKzF4jqaX4pR
+-					xM/0wkKHe4MsnLg8hg== )
+-			300	NSEC	sec-02.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					Ny1BBKgi9V9hPIQSHbLcmLBsglGjGFiBzrCc
+-					tSaGM7UnbNjqiq9s1h7wBl9Y9CmnIUa0s3Hn
+-					wsf8KQkMQrg3Obq44f8a+YEs3m0Mb6KsvrMj
+-					46QswOwr3bXm9DXzyCwYePQmeed/w5oaOhe4
+-					lTVwFW7fxug5PcfIe89MLMkqIsA= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					jEHbUbVWirjrY1WkWHojuFXqw5Nhg8zax9jX
+-					eSQ49yBlwSnmhnEAA02IIYHyfrdnXEMztz31
+-					r/bNqfHn5etXoPZvxxlj9hNxR1qBO/ZfR9Cq
+-					pzQNeAxrVP1f9xuhcZwqMPjEqFnOnkbjlcWz
+-					vLv9Ko1HOO/ifAhMQEwviR4yU3HEdca6r9uO
+-					tBGo+BTuoYVzQqPhIYpA4QRStWNOKgIe/cgV
+-					Fv+fvWnYzYXY21w4yRYv0AR4rxYXtSvX0/+u
+-					fV+/9r+fz5O6ZX23fO9GrV/P2wi64m+B84Wg
+-					AzdkstuI8eyNuLBymjlYcCgCDMJdE9W+E5ER
+-					ABXyXzjWDvig6jkAyw== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					P9DCOfUpee9rYTXyA1tLCYheQDSIN8FYPee1
+-					9evOBiJooO56RXM1TOBz1NxpIyaarFFG43E/
+-					ZheazaUogq4wPBuG6exJiNnPA/cPV/7oLRGs
+-					odaNXU3vKyTcX1EzhxGPvawZt33dxxGBdq7F
+-					YaCg7wAvmV0LM1oa3RVzzicdNLtBfNgO2Zzc
+-					ra+RE2mhtiiDjpFXeWP5kVd5ck7pVy4Y6yGT
+-					MtL1EfiMQROQj7KNsuRMbE0bIEaYmwbcv8yy
+-					PJcs5LAd/PYijHY7iat3eyjgGm+FTDnhsH3L
+-					VjZspLQaK9jDDZ9bWnfC7pBrMODPxkFHBFQO
+-					NWWQkJ5f96JrMutnPA== )
+-sec-31.example.sec.	300	IN IPSECKEY ( 10 3 1 some.name.
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					WFKnw31YDWLiuNfHWYZnghyxu1m3supAa1u8
++					BTroxFvmWai9zunHo0n6JtQD3mwwYxPo9Vgu
++					FXgXuOaB/vnRqIP1gbspgc8CJd2iBMlGeLa7
++					zCsXe9t8OgGL+8sLCDZpeWJiLmQPEu9+rcgA
++					fNP5eINMWGzZFo0O7hmEcTQ1zWw= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					dD/tZ1ANTC6FYZcfJlXBC2V8I0pvqs9bkbYm
++					bicN2Tdcks+BlB8NWl/muWsr2/8r08KJpN+8
++					mZnOpCbLVI3wGjYaHoH4wQHfEo/W//gUGUGb
++					He8R/YMCh3BOjtvzwiuoePRmyyDiWUOKn0or
++					bL3nf6cp/9exLHdNnXe+8NV/A14Y735qGvni
++					k4e6lGYyZ4wexmqzj+QQ3z0glPe/iu1wUHix
++					9stdCHh28DQI0SxG0U849NurrWEsBkNwA3t2
++					EHuIIPtPrTADGvOD68tVhxziBGd0SyqsHpWn
++					vbS2QWLzWeKwIN49ePqTYMFp3JNbgR64F+ty
++					77NbquNRRlKIz9wT6w== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					lr5WSXh3JBrHFzpfHiNTITkFX+z+s36o/WOV
++					gYc3aT+BoWPkFPFGn550rYixJZUM1az7zuGS
++					sTGi7y10bT57dJfw3bNqxLRzCuLO3ppmI4AT
++					0xfIrrTJqm3KAyXUiXQqJ/e02eR5k3A3ptfv
++					uraQQaMYVzXp6RYNKojysPNleNwwjjxoZQ0M
++					9VSdU7Mwbu/USQQ/T8vQPOZ+pVAyadBEFB71
++					7IbyYkcttSIUEn2vNuY06Qo7dpS8xcEdkt3N
++					TP5sY4tOLDAm+Pov0iGCzf5XtxqdnhA/0k0W
++					yxTSwMMHE3gwmjVmw8F+pUfLhEayC6BoUdME
++					36tzfs4MgRzT52kGjQ== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					psHHwUHzPaXdd73twQNarWkgvihwT4qaZk0H
++					JL36KwsMIXacL4gYhlv4k3Yo8fTk/xz1ea7R
++					ZQo6RbTjotpkwXl3JKL2lBbUQgisUgBNqrm4
++					bV9xcxxoeJh70xSyNsPKNRlhIiQI7S59lESy
++					LnmLGfM2AxjAVWIvkyAPWkusuKkE29YjQx+h
++					OECKQO266Aln6XWpglT17tUHqwk1pMsrSmYS
++					8rhP/g9s5euVuGYMh5KA3m8fQWQCs97CVofN
++					hJl4B8RE8ZSCQtYVKYTAcZ8Uxl43IZGajvc0
++					aYlA/iDmsm1D8Z6N1e8mcsefjJnXYMaOunsd
++					uVoBjKxAnLf+ko4V7A== )
++			300	NSEC	sec-mixed-30.example.sec. IPSECKEY RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					B2rLde15M3+mnWcVSgP536sFS6jp0w2m6C9Z
++					COpIAxg+hFuESbnqC4KTQsjiC6D+r26r9c/F
++					YNy7fPlKTpG3+BfmRKvx0M48XTB7kuMZFSv+
++					3bscm8rNon7QzCan7mMaBaK2iE+B7RHJ3yWQ
++					lclS4/ISJS6hOe0mJWQ7MZ5USZE= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					ZRvKcFEP5Ewm4uKrLoE3Jl7hSAKQBPNSClJ5
++					GKqdQIGEgFVY2wJ9oeWrpnrBeUNKxqAUfsEX
++					X/8WFfkYFuJWVabi8R6MQ6PpLV361jctMXhx
++					zbym0NP86yuOb8RLzzZLR8h1RXWdyKcbSRY5
++					BJ/bRxHwno1AKvwgSd4bOsi5jypytjaXW08s
++					VeKzZiiqx9CabukMS4KOqLgLBrNzyE/Kjd+l
++					j6SkvSAK+9ABMNWPlv03lnbo3itK7HYUTNVQ
++					DoX1o0MePgvYxh8A24MGZxoZMcHmxNAeUYM1
++					CZ1GxbkVZ398YkI1NnvscW3DOGjoA739i/ha
++					4UPgBPBEv6WAdRwGfg== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					04pyV9O+WCy7anxAcybbvEcSFOQp00Pq49PV
++					2EwfaZwmATg1BooKXSfHepppnSJJbUAc4pm3
++					PUJImhSpPQI1Xthqu0N7IGaA48a+ltps0qUu
++					EeZqAWxK/Un6gDt6iguqlQZnMuCPs3vY+VaO
++					ObHw9j7LTmbrSOQ7/wbuZEq/J1/xSU6SkePK
++					pp3A6DXwfhETAx3xX9CfEVYdcicptqdqF+Ci
++					VjLvUoTfeb3UJn5Fw9UNSD6H5UaxD8k7WVNq
++					b9Wy5mfRrRlu0fuHNFmVFLnnM7p2UK0+qDyf
++					60a9l9V9L04HD1ttW81Hj4eWX3xNEKYl1Tj6
++					NA3UYQwNU8Nnc5FF3Q== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					beTmIlSaUs2hWD7A+TLnflYGpSTO1f7k1RAK
++					4b4I8VPQnoErHap5PvXovIqIjyJz7tZgb8ht
++					6sWcASJmTCm5BO6PVROlf1ZHPmNGrKz7/sVh
++					WnA2WVCtsY+EzJo7sAiOl/zgmiGA+cKGyx4Z
++					9cTDZnYcg3oQn//ZJOJPFC/FrauNM/rDsEV0
++					nAaPTP8o3Td/Z/0jbdvSa/w4F8h2V5mVLWZu
++					ieaPH/+xc4hRRHy+ixDZ2U9SXDpQIBJZBFNq
++					PTYL+ywDNrcO+fig3fGNObjpL7bbIeSauBRO
++					d20xkERNHSthmdjnXDdReGxdp7I8NTRTj44T
++					1EMikumdg7FKVNQUoA== )
++sec-22.example.sec.	300	IN IPSECKEY ( 10 2 2 2001:2010:1::22
+ 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
+ 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
+ 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
+@@ -1297,70 +1748,270 @@
+ 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
+ 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
+ 					zZP5Vd2t )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					ZAqqDBfAVkm5GAkLn0I+fY1Yh3q1P7c3953w
+-					DHdglMo5DnBal5ezQH7c0vrI8GvJJO8fG3T5
+-					MUZMhTaG648LQJ1oGQdky9PREi4yrFvSQlta
+-					6NQgsPuAcDgtEGrKsL2IC0dMV3lkBV8OOqpz
+-					JaI9HlxvLorGmLEEaBCNFLi4sk8= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					UZMDwvoYhyTLYr6PATsXcuZCeuBkeRXmfH2X
+-					ishLwWnnYQ5ghMwkl4qtmn9/n5FDLwDkRtGv
+-					iLpBEo1VNxGU2G/PAYTNaUGcULQFeGVbbAsq
+-					v9427G8fNzGAPhqpBHRd8JRQ/eeoEA74/uKS
+-					phs8FNUO18hEKmzol4JqchzSSIFSW9/bBaKz
+-					Y6TkCYZtIutiBEHFRTlavgbyWqMxdXEji+Nn
+-					Xze2v+sRi2kyaQFS7zSWBHH6VFMh0KygxCND
+-					x5n00Sdl6aljlpuklNn75o/8iEkFdN2DsRI0
+-					tkVQomX6js3SgTlQ2C2FUAo05jxlxzrIfcdO
+-					/DcAG9FRlPvHoEhOPQ== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					tnQ2kFyCF7LHz3BpVO0OVVQVkyjwq+POLBl9
+-					2d7WjjkIOnpaXMQRl3PxloQ5+eaTrPejynKU
+-					Ck5BENCxzG7RyRMi4I5ewPBgrbVL+xEpVOJ7
+-					9WsL2xKhkcFpIPcqWzPzo89szXreI++xEDex
+-					WuBWBQ5t6K0+RJROl/yoq7v/AGiIsQ0QvESH
+-					19YnNaXmhjBQVnU+Z7+edwMbBCZzbrq72Qp1
+-					PH+a4wUOeQqp0AvSm9iWrsmK0k4iKq14fHPy
+-					17TlC3PanW3PnG8DcRA79rBxDf2UWOcj6C+S
+-					MVvDuJHjKHDXogWZHF4k3Np0lddMta5uTlfT
+-					i/sXL0nKu1Ld0FWtvQ== )
+-			300	NSEC	sec-32.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					YtGwkJFT45E5qfMwpUiGyqclXQTdgaANlprv
+-					c11f0o6hy2U8I9bbeji2sD35xRB/gJxbeKUU
+-					ASe5cdjJn7BuBRVpob3UItRDJMqTp1jihWEt
+-					Z+ZUp5s0BC7gwC4C+879+I0828Y+X06NwE4L
+-					PKt4eyZdl1EQLj1lyBKpKHxrMys= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					5bW1ijtao7NmBEWHKgoUg7JXjKcpz53S+LRk
+-					vm2VG7Eo36H/3J+HZPPAwCSOLDJjh+CAa+E3
+-					IZyuq+GIA+0EG7otHJVtc0dN/iQs1lPjdqFj
+-					3qAtHIuftfcobQ5LDbFHh2r3VH0FLoaKvQYK
+-					8nb4Uk43FRvK3MfUvUGX0VtkUggLSktYLdJN
+-					tqvJCKnR4ydhMwBudqiTnR61dJkTjJS+hhcs
+-					MqGNiAFFcbNF7WZZT88hXS3we3vyyAjfPUQi
+-					QKi2BHK6IhthQ8tDyDu0hwX7wpuTNp9++6z7
+-					MTRc2HsPjSyHc/1xmNFIFC3jJwjJlfZDMl8Z
+-					5FvTr3nq3OI4XwtKqg== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					nEZGkAFPbQFS6bLUu4O3SzHAe/DtJs4wTFRe
+-					LFN8SSp11JRcyPu5VdPjQ6EWNbHvmB3CWs3o
+-					dKmsmSWtpT+fPsLPDuYjijjwXe5fefr/wRC8
+-					VRr3rGqC3aoXm+NuaXMEKHHOf4MeIGVCDK6D
+-					NEjPhagr96bv04SwrL4/LqclUlXrnMbHQe/f
+-					xvULs6IyvLMTdCgEMRQ64eJLZDIerZkEPEqb
+-					WYqy11ViCw+ASdN5lg/cwaXOAQ/Ao6S8Lsqm
+-					DLy1rXe4kRHgMsei7c8/X3Pre0ZU80Bv55/s
+-					vioJUwD1wihD41+dBCU8aPaxjuyRK2uqnyun
+-					MKn/jYFoyNLMy9+nOw== )
+-sec-32.example.sec.	300	IN IPSECKEY ( 10 3 2 some.name.
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					iWhWTw7iJntB+YHQzcTxoQ+6lzzXXAS6T/w1
++					JZG3YDQSfh0kHpJfaNGmZH3bA2iHbU/phU/F
++					DSjUCt5zu2aMaCRM4Gol8Au6BqEY3DDKfI50
++					IaAy3Uw58J8f8pM+PNI49yHrVDc2ldoe1aaR
++					nczvy3ifuq21ZMUQJMzd+l2Sr2I= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					PNqqrfsn3yiz2jzf8Gf988KbXIQC8szY2KFY
++					LcYgf2+Hy+04TgSglJ5YPGUvotvfgH0n/oeZ
++					W/TRlj3W18zbTko63oFYw56pOVVz6SwRrz0x
++					swo7TP63OmgBrefaSbLW2u7hLsB4oB1MH9zN
++					C72vx+fDX3Pz+VolB4AP11bLZjKILgLydU5p
++					IMJUSWf/DVP/LictbcQkRb8bvZq2LeDZEvyE
++					l0sGfxrgn/0lwtRRx3VOAunOnmV4KrTSwC/8
++					XJWpqFsEPftILsqscglUK8RuWMsw7ivMClAb
++					GbQbp1m/vfjJAT4RZQ1yU3/Q4qTSe6HX+pKx
++					15TOhBSlil3I4P6xAw== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					MMoNOaud6z87L6uapJ0VfB3/R/SE1Bkp50qP
++					NQ2TWas4vWgB4woubS0pomneuIyVABpuYvHR
++					es57hgh3XK12OfYZ4c8nh/KmoJXfSNvWSBXq
++					9orJHkmfDLES3djWR5zdrOSS1xIElYj4QL2S
++					eeV7aKR1MrkyNIUqgqK6Lqdj8oXjREpTq/C+
++					H7vdw9XgQeWZn5I86cUEhjf1Ugj+w8+hQNSI
++					eoFnQCScI7lLO0Zn5uJg+X74/6JpguluwfAU
++					8TLTdFISo89fvDkAzZQ5/WWW+XseV8doY4uf
++					uWL/EfOkgSVb4rJuhN4LjaDpNNwKVupXUCgC
++					animCObiB4dhlAfMTw== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					whhkXRVK2O3u1oR1Fvb2m3MIsZNi+6MtMjuK
++					+h+r5RsLVcqhiFDUZrMiqaQomt42NQJNFn5A
++					W0tOTudijAm7EwJyYg+m39LSJ8WJpH3Ek+po
++					P/PcV3nkmDCHWVzYzRixP/QIF9hTjo9SiUAy
++					++jP3S6LMnfHkGFIxemxqUwO4eotrvhNgVOA
++					A0NA3UYMmbz5zyJcyD+Bsi5IQozB6GfaPtgi
++					SBrmoNm5kBKM2qW2vmCYpKTqK17kwEaVgE6R
++					tawaUy4lZK1Uj9O2vpWwnkJTPoeIYdducoAp
++					Xet/azFBTh3n3DGOuYlk8xzrtYys+/lrgl1F
++					9D8eBgSO8oRB6i1jrQ== )
++			300	NSEC	sec-30.example.sec. IPSECKEY RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					h6dh0L2hnMjLbqHnfBW7zVcux6WgU+Htbt9i
++					/s1xH3PYPNSB4YkqddSVkBEtFTkgZimOseEM
++					nPGSPPqONAluT7gIAksWCqqUltbck5xLHbww
++					Xv35SLvc2gVtxv3iFpxyid62D4mucIByYdvd
++					l+6WpWU/As4COnT7HqCwTV8y1kA= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					u+WKYXFuvlOUudgJeALAAPscGsRZUM9+O2Z2
++					XkuEAzxvZPiNxAGUg/sMOP2gVgfCrdMsKPd2
++					/gWfvNyqwGF6jZHfklOJfnoy4apAa4qVrvYj
++					KyCBKuigzeXjSpGMgohP86e5WbqVFkeV74zz
++					fTYum+1VVrHAMyC1n+96A1Ssr1T8ApOx6Jwt
++					T+3Z2VdxxPBOyNmQLKNzVBcuM6WP/5dlypPk
++					BdyrqJlfZXhqTM8yG3MMOybmhYDLvz7Hmo5l
++					I7rNrib3k3VLg2Pg0r5X3Yoci1LXQLo36N1U
++					fvfApdgkP8XraiBSGIFBBq+Ouy7tDyll1HHa
++					S1IlxGI7+j6g0gxTEA== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					Y+pNKoL+y01pqsQk/R3ofhx8YGTt+PkomQNk
++					9NRVhI+sJH1opj8mDxSHdiw6UOHyU680eDhU
++					i5jcOZSFvzyk9F08EfC4+Ko9Uyl4QFK/0OtV
++					0rZ+xoRwOfB3xLlkffOc80dCc2WZQit2u3+R
++					EYguqgNGbzuaN1BNXG42K97xeLiIU0eGv8rl
++					mpHs39Fzcl8JiISeaQ5rkmkvKfpABq0jxbmp
++					IIAJvSkxcuBtHmS54zzyUt+EVTxIRrytZNCq
++					9rqdOV9C8FTfpMV2iVN2GBpH2jPClq+j8L2N
++					DlDg7FRdR0ydTsudKEqUWhr9562LPL5/kIcZ
++					4+IdhPjndoN9zuWgRQ== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					LNQxYEE1M3w/XlXaYlh+6TYj0tBmfAYrBAAf
++					Fy+H2k4RX4gn7ep/MJgYOEzYJr9kNaWWADbt
++					1321oKf+FjQTe6qwYmaRz6Cynp/d6vVSliA4
++					pRhr8tIsZp8vCtHLgBILFBNFgu8HUtdYL1r8
++					souiajW0zNsGd6sMCpde1PAjGsJjTM2/O0ry
++					Ddu0QImJmbjsEWWaVx1C51ZOJgbt7zVHtfTN
++					mbpYEf0NKxGID+aM6t3Ih7Ab8yw5GSyYS5c5
++					uBPn1IEc/JAiEjXDpjhJ2TwKbAi9w9gYny6o
++					6R+bCy9ogSgtE8WfLcmbX7nqQICM+c5B+YgK
++					prqxsvSaDfi9Ntrjtw== )
++sec-30.example.sec.	300	IN IPSECKEY ( 10 3 0 some.name. )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					n1/3YCfqAJhwmG/+X907lQTAdwoc2m7S+HWY
++					SCB29a4Kum2jTyJ2TP5f67jAEbY+JAnUB2HL
++					xGQ4096yXhXORKlZQ4jbGPZ5TL7AcKzDdaIt
++					EoyMhB5IxYRfoSodaqHxw79CR38PzCWwcMsW
++					spJD3yLzAxAGRN1g3q9unxBLtDM= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					kHFdQVysC8wtp8X4Vn94KaogvEzjBoxOB/fa
++					NiklxzLxLFtwC4uwTvaZebNv4RLfuwtW1n+T
++					pfIFxMDJ7fog890mD8BKPVZwKREohTPyjuTA
++					tO57EyL64A9Ergqvjb2BxlXEo8q/hqn1PQ2p
++					53T8wY4Bgd1BWFoB4PcvxNKU+SCcxSt85fyx
++					RsUOnJbY0v1aGkOJYSXFHjr3VeWsc1o8lzxN
++					mMO8qMwLsxbLr1kEq03FNNlFwTmpIKUojIwV
++					78hI0APghgVxDrHNhKeRppuQlApkcyhDIjJd
++					PEmaIoZ9azP4Otmi03C+duaheiIW3fv9UKzw
++					7zoZ3Wa+HXM/joa0Kw== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					dQCgAn79u7gPzfdWGaASCzI4A9lsQbeT/wFs
++					io+TFnqtDlhgaBH8OBjsLT9waEAuJYUbG+XM
++					j//s7Qkc8gUwkbWGmSWMRBdXOcLv1yJPqb77
++					6sGwNhWLyJ+wI442Ng3r6OyJw6oWm/HDwzus
++					aEKwTDip2qPVmP2X14CQuOhri1pNc51vOTg0
++					m8M2UsOBlmGQ3mHwPgU/zxWHjwJDxf/tYQRP
++					5w2uMcTdY4kdydmLjaj1vBSln1ig8d5PaXiv
++					eZCYPJj3+ToXtQbR1SCGksnwYTjwehfl4dq+
++					60fiEytN8jAhZBqXcd5JWuhsDe+78J55yyzt
++					z+tr0kBa+ClqpOvdDw== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					EV2YvMX367otPE5fj/NlAZdVU+jnKPvEG9np
++					FUxtF9RzEoPTffdGIALsvGTzvQ1MRQrPT1xT
++					dKp5sJ2yd+oAj0wMDVEHnDqcqkATFu9rV2zT
++					V6Ec2ACsGKCzsIvynI1cm3FyaZkRa4IUa/4o
++					iqdYWQbB6lvFNxlyxLsMjX1gkPE0bHYE02xF
++					XArlqnCmbtaXx/EWTFLiOx528p8x8ZD5MN2w
++					K985CA/oxOOhQc1DZ1R47ELad4a3F1/g+2hM
++					V5FvA3bjQ7XJyAgjYFufJSyP0N6HLINIDdj/
++					xB537dxxShUB11XFzKBtafrCRLFhrQ1Ksauq
++					om5sY0Pm8ZtdTGfm4g== )
++			300	NSEC	sec-31.example.sec. IPSECKEY RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					LwLKdvbnWMZOdQGkhOYN5UmFYO1jv6sCemUt
++					TSVg/ekhh598VJog/uPpkkyc8Z5fWDNXU7qa
++					qodH9o4ybxEKPTQMvNZhHGqEBO1zrFb+82YQ
++					5YFBbmyHqtXZEoZsUBz83pVqenBJPvhk4fHu
++					I2KzloN1mll+PxwP6ITX609QfLk= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					IiRrrSBHzcSODDc8rl99LDQ9+X42WqVLOTbs
++					aaECCylMz7/d3Md423p7ZbZocZuso0fbC7RS
++					PVPLfZGzAiiPddeb743XoH4oPTrXVShQoTpG
++					NZX8+9hXmaI9VRVjtelRLvR1uq6MFkUQxBR/
++					FJdVv8Ms7yYgX81DAZ5X7jHJ8g46zfR5vAaY
++					BieizGl0POVYvgO63JI5S6Wes4C4tchMC68k
++					y/FXtQZ+7uOhgpJmr9gpgkHDOa17Bfshu97i
++					eHvaMhUbeL4V9mkGX0lnc7Fs8i9gi4p6rfx2
++					cuCl/hcgFweMDRRoV9yTOnARECy2eOFeM3Yz
++					bDKUzBWlp67bL4HFTA== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					t4As9gdV+R85vaKPjUKFrHfDNwe5kqREgeoM
++					xWqEo/jVkGBDa60UqzUutLGT7O3zjwZa0Kl1
++					g4yqCuiW9VhICtUd5Q7gGnWnSGBFqfvQVrae
++					Fww+Pbn9xqmmeTntYtMq/OgUxrk1mdlLxY1B
++					p5RFleFA1OAnTn4ZDGEUWkBuMP4TillZwsKI
++					4W3qMzLfieOB/gknJn9JLPKj4+hIOzUY/r7t
++					uNEzdpTiGP6/0YlzSjEwxzO3TuN1nrdgmnIk
++					oW0GTuQCfZOah7xAdYe4oZemC2u10wK84PMV
++					X8a8F8xWtUO90if8JEYD9o/BWBeoEUE3+5I1
++					51VUfzXGG7kVeoaW2w== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					qSr0muO+ZSs1QIC68tsr+U4UlUtYGJ4Ygx/1
++					PxoHzBTa5U642csRN4SDBL+5J0fl5tTkDYep
++					piPmI/wgy6wnQs8hhCkdPPaeJZZ+YjOtcTr+
++					72skfVX1z2aRRg4tWnhhRGNW1hPxYBawCZhQ
++					Ktg7XDCALip1trc9mns2607rKhqCjv8PoHdI
++					O5TQFmr4Xz1RW5Pau5bo/rZr+Qwn7mxPR1M1
++					NPAuWpLJvQuaMcGq1A8IJstj3JyFLhgbwidz
++					hsu+WeGio80Defl9VVE1COQ3ahlgZuv4iTlT
++					EfQzSv68OKrn0MDRIAcE/ojVdYI7XY6HmCAm
++					bez0AQJM300Jxrr4Pw== )
++sec-mixed-30.example.sec. 300	IN IPSECKEY ( 10 3 0 sOme.naMe. )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					ENm4Dd0+Dx1N/BOYIoqlq1AbugLTxHLeNDyg
++					HXO8zpgL8yTaa1U7dtE04wB4vYx0v4SYpJF7
++					rFafGsKaPEvRxCbbPJ1K6/cWReYq1droXdPg
++					YmYn2qKB+2rNqMhJsIGLhsFxJys69UJmoLoW
++					+5djG08e62r+UK4EzoE8oz3iGVA= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					kkk49jmaU9PcciLS1yAK93kLIVXoXrdm0MP8
++					q0BKwm48RAwia+E0p8HuSNAgMrHWYkSJJHYG
++					QoTwBsMqBaL+6dE9+1woGa77Yu48+orUSC5L
++					3Asx2tCc0A3ulYS9c9Sh5L3Uu4S8tau98FPG
++					VcijrWzMGN4qIh4BNVxJ+ct7AqSPdsOqK8aj
++					IfCZ4kUaUOYXWQeDPTfowhhk0YXBzf7P/v72
++					navtsoeiAHCh7BOl502kQZ34XGkWNXnI4Kq2
++					HmZ5+YdBVVQT87aVSDdZDvErWn8I6VLTaQQ0
++					8VAog0jCL5DHXpB0ESbdxlWr8PlElTe3eZgr
++					OFlX0SSAwEB21esr9Q== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					OLfBWi8gku1GmuWBRiMYWaH85HxHTfhbx+OB
++					tmzJ6k2cICoyqmJ7Uxrvbl21/Qy2evrQrq90
++					X+ZS3XbcrAUN6vw6OU9cG88JeinMexRADRjX
++					WzaJx0JN32+9ummvyf+f3G8NtxjYQd5KLR5P
++					lOUv/rm7jHgcslEsTlYE49r+xrr9upoZdJ84
++					45Qy8mqjy3hcErT0X9jXV+5qscQ4Z9j679rB
++					eLQcLjQ3bW8IeRqgYB2+2PDUb6gcdAkAR83V
++					KBGbIwZeO7k82BIUSNDQIFq1IPP7+cFWdmFR
++					uaZlFWFgZOpSwiy3VIkC+lzktjzWsYUEymQW
++					6f72cdXioDqTX2Tcyw== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					xj4OSCDJKYoJrSmmtJPj9Gcan9iXkliNoYFt
++					uKA+nBOIRGPq7V1ohNSksdW6fMIKEmrR0MwW
++					mVxxRuKPseU//i2QBCBzQBz9YbmS9/nXx6PP
++					UT8IOG592j8LojLxxp61oH0MB5t/cJUQ4ymd
++					JvVT1NjdpEj268TdaevjnQ+c0uHJVc6XLHxq
++					1K4FaufpqFI4KDncMJ7EzONGLw0pSP0NZbtw
++					aWP9w2MVBv/pggNpS9ihNVMuEX5KjLsLVKez
++					eMaOdtS2kSt5vNLpwbGwtCRmQSSbb0lTos9o
++					opHrKzFEpULHqCTQ9CHoohJ63XlCU7nojX6s
++					1gxQHC3ZQXSFhQCpSQ== )
++			300	NSEC	sec-mixed-31.example.sec. IPSECKEY RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					KGljdH6WD8gODIrIGmNRHGdOlReJ5+aK2pxh
++					ACdNe/nb+uJpRflPywuYGA4q11I+6ufcLmB7
++					FKjRcmbI1Mnh/5DqLNhKu7aszdjUx84/r4Xq
++					szLV8NDmjIyrYmNEiYjl4Z39Az91IFKblqOC
++					e8GTMkAeaVJRmozUpXHE0/3gd1k= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					m09tl6HuH7v4fUkxtw8jCFRFzyVbBLkk0LvP
++					pVZPT/8g7HsLX3wwcD2h9dRkAdYDuJ3VSOM+
++					tusDIHlKIcPfIK1fjSKv+aHQu3/dn3huRkwb
++					i+rp+ieNrTo66xHds7KzgR3kHtzQp5RUHoqh
++					K1ppHrN4yMm3KZZv7U1g5D/ED2qXxCupoYAk
++					UwRNgpocc3z9fjeaawtaRvUF+Qd+y6eCPU44
++					f7sjbppSw4+Z6zQKPrsSCuIvs9lYaDHTf4NV
++					+/Ec8CbH7uKrAA8qN1dJ1gUQye9dFnES2VkH
++					tkAyReBxJ0EBTcdiLxf+MYHgE7JTlVILn22S
++					E61hzZPlZzdbHra2vg== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					P40fI/B+2QZe63yXmyj1DiBjMixs2qTzFQsd
++					X+rlEvc4B2xqKjJyTQLSqqKxECXF469z1RaM
++					noQ0nWOXPOiQS+ITy1Nj0RwcwKBnCf4RZGyw
++					+0WUufZqnNfnptSUTxdp1Jh+F6AUAC+EBsTE
++					6BvnBjXvpvowdF4X/izJ6DvbQfuPMtAHGVZM
++					d3e9DpSrDW7sh0AfB5Qc9XmNBnx5LhskBtJk
++					ZmoNLt0QpnsYyTfGW3zc3e+1o8CKRrxP5KR+
++					nTIlH16IhLNGQYMi2URRSZcLgCROkvY0U5Jt
++					7URlDL7dcu74EO6n6YyfszHLXEi4TBW5Rj6p
++					rH6XCaqJuB11JpDRkw== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					MdeBeBKykG4JHZtN/pVHBM4v84pkRcTjByvU
++					egrKgl646PpGE9+sVjagR8DBIh12tjmQCVif
++					wzMmqWLAcwWVPceYOPSFn5A+rRTV1xUmDs5Q
++					6CT84fUYF2tfr12eMkpwX0A3mEv1np4wMA6x
++					dG6QH80+7dJBisI09dwXWYnPFsJPSn54Ejnx
++					gZxVZ5tQPgDP9O1JsDIwfyVia4Yd+ZyqrC1z
++					H3W2/oraVZ8Kd+0oTzuP7U+J451WGwuQAyi2
++					616ddcs8PUDth4oFcdIowU6Xrv7AJkgYudEP
++					lFC0F2sFUQL/5gs1bCcseJcEar/gkYm3D6h/
++					PLn0VINZFSnTYki6WA== )
++sec-mixed-31.example.sec. 300	IN IPSECKEY ( 10 3 1 Some.namE.
+ 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
+ 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
+ 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
+@@ -1372,134 +2023,94 @@
+ 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
+ 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
+ 					zZP5Vd2t )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					CZJn5AslpFHB5i82KpADbin+ahFv+WkS04+x
+-					ghMl+/iKWel63pNkn6ROWFEiLYiRRcpI1R8x
+-					pkVHgoCocBQKioGtNRicqFzaiHWmcNwVLX6R
+-					W6mFdErpEzP67m2+dg9hrpsQ0E8dlAj29FGp
+-					LT5agAWqb+GL39advZ7+XeFYPhk= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					JTi78vBkBuGJH+i6gjjq/7aVH0V7Lo1y/1nT
+-					OwJOaaQGvTszXtNEgnuaZWKRP7mmMMj/EDXw
+-					4pY5t7uetwQsnoyBfNINevwgBvEv4xPNGly3
+-					bazXmlPC9WL2pHIhH5OW5ktHs0n0C/oFxCcO
+-					IVtqBSvylx3cwN7unAFF5jSF1zgMHSubRjZL
+-					RzAwGQbpbPi3BXg3zT970wr1XIMsMnoU129K
+-					Ii4+mgYdxitLeLw7/eIxTYYrUMPBOpDkSQ2u
+-					k6GU+eqTXIzZCNhXWcXKnRe1CrrLkRtRwraQ
+-					JlCXh408v0lLo6Em0b3gjYpWxRWyAmMz+wVA
+-					CKoQo721i+2WURHytg== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					zvwNflQYyZDVLSjAGPb/NtE4D0vB48V17Pm2
+-					nz2Snh63bllu4iCZwvO87DEl33L7me446rxH
+-					/G21XZoGz8cwN7ecF40SQUv/grdpqdMPhqCu
+-					15+irjwTF0vthMxKJIuMRUr8xqHis/1KKxLG
+-					Wa6Rm28BFLfMKOti+o5wRyD7iB42UfK7dWlC
+-					SRAJxB3kk42LchLGydC12FehBE7rJl8z/O3l
+-					cULmW5UTB/4+AsNNQM7GrhGA/zvhrxGOGksV
+-					0ncFq1I6na9XDYq7zZZQUAbTbaRWt/MhVcsV
+-					W8d1Vqa9XvfC3FLlyUZq2jjAv4VSupTE2CSZ
+-					OCx9JAqD7fMWUJU7dg== )
+-			300	NSEC	sec-mixed-30.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					p4fImnEiq0raswfRFbjM7d8CA6WhMtdIn7RR
+-					AmGcesf5xwgXlNcY4Uu8ac0UxxlqeNcf5+5A
+-					AIrRraMEOPZOAC7daWoRLFgsgdKqrmZYHMpO
+-					VxWcuyIc+5XXIFvfA5tHKUv47xq9wjJD+3+P
+-					mVaeY7/tyBAu4OYBAaw5WfW8020= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					HXA5QfVNaSkandKCqFcvBg0TYwdnAywDzAS4
+-					McM11MXxI2AUnYnRmBg0+ambJRt67P2VYw4/
+-					3JlQftbTLd0r8b1Rb3yydEv0uUcfOe+AXn9f
+-					kd8kgwutMCNYg99TDPUAAjBk4cbMXsNqu+Qv
+-					xRPboSmONUiJ8TaHSLzLnNAOTIKbdnmq+p38
+-					Dh3Xtfy2o9ZtxuHlqoldQmNHTN3opt3GJOO5
+-					Ia/8mLJurOe9J5lDMjhSZQb/HYLRCM/1CRt0
+-					C3TZnqP1RkOnSDqRP7petZcTWSsENjOFIBAL
+-					V7uCzYIQWdeRQu81V9MYFp9c4lQ6FTGElKWJ
+-					V7DQxTRpgjS5GkHu0g== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					dbdl0cBXuuV0G3mX7P1aMCGrJY+JXVVTVmBh
+-					P4k8hWEp0RDWPsNV2YV002L4vz1HYIJWysDr
+-					58IWpQPqy+MafcippdH49we4zLIWkstE0vEA
+-					S3qWmymBnk/ZuhucDXF/HLGs6PXj0nw0h7Qx
+-					/6Fwnyys+pAe77k3E35Zb/+EaZ5hwFgueswm
+-					AwE5i94SUYATd0wljjzCcEB5ougB8epWmssY
+-					azJ608EPu6wZ3rxkgvj+bZm9oj9jpujbWzls
+-					95fgDTJPn7FUoXySCwa+lB/2S4GfzoWsgjF0
+-					ho9zhNrG1hnbjWw4GEp8rVJwsTiBxrxIcMdm
+-					DHHX0i9yF7DkxsDWXw== )
+-sec-mixed-30.example.sec. 300	IN IPSECKEY ( 10 3 0 sOme.naMe. )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					Yn3qB+wu6No6XErby8iIjeIUWYG79xb28NWO
+-					v7hveY+Z6/sKErALFM5pJCJ44ih3hINUdYep
+-					HPcLh7ePz2iwdUVGvRD54fI48HTWMtj/dn1E
+-					qp8SsHB90wHXmIeUaTPndDhHbTtLrs6+SJWL
+-					ZyojgMongSZvbHNWisq2MOZMujM= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					qk0vQIuCA2+o9nLprjIyyUtVOZ8Pu8UDRBYK
+-					e9/0s6VDQIFP1n81hM9ii8gdj1ETcYYEVUXw
+-					g4STWkNiRGtOF9x2AiZwGumgf31169sFk/jc
+-					654gRUQDdxQnB+qHLX9HugTGZrSvsIR5WrFm
+-					eLe264dsniLc589N5JXWHV7iE9zEMj9zljDu
+-					rXwj/7FptwoxDyUt/QzG8RhVjGwRduFOHbd6
+-					fJf/tqQ/QI4yZiYoG0S1GkkaFERX7fJSpqxd
+-					yI/B78KW31jWevGCdt7NsuifG0f2zJ5kkmUh
+-					jCHvKi/yiji39sGm0kSlqtaw7Q47Rx0Ihegf
+-					mylJPYx1cnzlibGVvA== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					wrzoKA22gia0sNq83CCag0ZjaraCbvE6Vi/J
+-					7qeUXAuKhS0ekuYZx7SWp/hLgyUARrtQvoRM
+-					VQmuHON4rSbmsL4ds48IpeQqcP5QqSdhAXAU
+-					fDZSln9hvWpZpJC2dFBgE4H6tjPmZUe+116I
+-					De/67cYRpqF6Y1VDxVjkLPmN7Tzuyjf8FF5z
+-					prvaq21OTMBu3sBRnfAhFPwNZHf4q7+t+Lnl
+-					rfe+koj3SdLgwNkxAA62Dj4mMCdmUT6nfC/4
+-					wdi2NiJzlIyzVstprwiL/ZjueOHPyKJcdeDK
+-					jR2f2P/6AF8//pCqTH2nmKGnX/nOHeKm7eBS
+-					h1c0ZvFhooU9N+2DJA== )
+-			300	NSEC	sec-mixed-31.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					AC8/yz3J6AdTfTvEy+VEyV1rH5fNfz1uxBs2
+-					m+OHMBUZf6LpUmqf3HMRt4ymUEzZ4TXUFun+
+-					BCRfuVl67ryfvU7Du1VIXaIjgq1NccJFPamX
+-					cy5bvn7VfB/XgTYCOhkirPAo4bUEN5UyP90I
+-					JZgfxjpy7/iSB7+Gn6rbefjRTJ0= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					lewi9S8lGbimRUFnQDXb0SG01qcbNbDbkSb+
+-					zjyC/CcVBEYwwtl9+z4NDXp/tR/sgGZSHkeB
+-					bnfJD+LcQ5/GFOC2xAhbebtFZbtuhMbI2N/W
+-					oanScK2gH43sFgihjtE8L2c301cAIPjaLzyU
+-					p4FIMeEowVVu8louVwACKr8kMQ2txCIjMJVo
+-					4GblPUhx7lSIQnyF+AiKBW7qiAmlqvchtqr4
+-					djaCWoXIjPA9Se1Qb5V/zdrjAav0x7nSoJvI
+-					KaslX211RgodE7zlCb30bOk3KMmQ2jU2//se
+-					6VhQO/qx6jKFkK4nSV4jXYpEACIhY/KrU115
+-					qGNs9dnFv3q2ucCLtA== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					WW29gBQhuzzVjOwPWCwXIeewzcop7BMtMjzQ
+-					vA5lMYTta4EAemgUksP9aBoP9jZfFhbCIhjk
+-					WuAEE72t74236wxg3vAOfBCVVL7WrhjcXmiK
+-					euT2D0I5EfeWzOy/izl/NbBgYwDCfiYcJGpC
+-					61V3XFkKR+vF//LeXQdQqf5Lhz49AeOqW5yW
+-					VSyWXi30DomFVM9m+94RUeefNq3MuZXa026r
+-					ON3Sui6Jfy7P2L5Nm/k3ITnYd8oz5H8UYJHp
+-					YwPc7uSC+Cu/sNpIow+eAneJt5TUj97KVxrk
+-					x0eDIqLmwW47vLw0kLFZ1+69vWoO06xcNDbC
+-					4RWHAwI/K1A35QK0Qw== )
+-sec-21.example.sec.	300	IN IPSECKEY ( 10 2 1 2001:2010:1::21
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					UZyvsV9lD3KguJJfmvxJypmy+h6VqKOoLBGQ
++					3pWpY4YOSZM618hSq1M87Um8W+hzA7HYK0bw
++					1UDJrtTz7V6ohTe7Rp3q4ec1fGKLLHYM8OM1
++					KoAwTSMWafZukf6NmNojHMGJ+auSMhB5xOsU
++					DySe1nmno7NuU45sakWGvg5L+zI= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					0iXY8/u0b+OpgoxpGTbVtHmcF6ihlqs3IZXz
++					O5uIozJHxJABSjKKjGZF7f0BY1Ax1VZKvxJ7
++					x4wSs5hyZ68XOUCD3Zc6Ec8VdUOPA9hZa7AH
++					U0U6/IkEcenLjCl3rPizpQIlfzmO0tbjGM9B
++					zCT4l5C7VfVw46O4ybmdXKm0cL0DTo1v2x3d
++					b3UWDeQlkYEGSCRXS0+GFE56w9EoH8/uS+Ir
++					cBfvULf/Deta4UOd2el2jX6izvkedgtWdI6t
++					qF3yhT65zXQgxmFtLNhgRgu3JHE8rNnTzmpj
++					unto2AYjwDxH9IjhWvOEQCa2w4GiwKq+tT3t
++					tFyCjHw4eq3tZSk3bg== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					I2VIZNkZ3u+CqOu1Pr3Yh3PQH/ODvbD9RS+A
++					+A8TAvl2ULfcXAKq7tcmr5WTL7k+PrMC4+OK
++					ojdROtqsPWtMi82iAkxkCULD9Xm9pVgVJ882
++					NUkHgoHe+tKijf2RFV3hCGgpxqLjEvoVNB3k
++					mEH283iRRxbQYDIBVTaVtHZgLDs2LzeK96ha
++					NMS67/+hIVCJoXZar7HCR6TeurGytCG//Tnd
++					VuWerWQQLo7sjB2MRtmdjarFt4ZOeQmiS/Hh
++					O2gvsf74MSGSb8K9FJ32GvCT+VIT3iv2Dlad
++					3l+i8iAiNyPhY3f3UvxvUQVBiHyTP0IU1sv5
++					EcGJCXZqP/ssqvjRHw== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					KWizoHwBtTqYSl7U2z3BlcpS2Gvb6A0ivojA
++					OaVwhsiZ+v7/2agZyrAaHKCvgl2yq89dC0Hf
++					REprexspi9z1Ru37g8B4p/3MdUsK9JP6Gn7X
++					8ajHQaqaLNHS9k8LsU0Cf05a0vaH/q8MmKxy
++					XW8cxRqsh/1IGvN8SUaDjlBr+OyRr4YqxPsj
++					JBp6HKkjrLQ1M0St2JBh2IXh8jqyrii6NCM3
++					H+gCzSDlREqx+nT7oSGcLpw+uAeq1OJ/L24y
++					E+coI82NKozyXv69uDpgr0AMirApmyoeVJCg
++					zSK4RxOvYSv3isKlpqzIRWTA4F6Am3lTIw9J
++					jKmMqt3KjMs19t7pbw== )
++			300	NSEC	sec-mixed-32.example.sec. IPSECKEY RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					ipQjEsGLS43Fv0UrNVpJU6G3kQdY38W8PKuh
++					VgBEPXoyHXuIcOrLhTATdnX9MC/2LfqQJooH
++					G3dwa3Jh5PFN2JcUYATP9NQ1IflqxgjSq2gn
++					WrCKbQI5yUCXRI7WLTXu7wihKM9ptBb6i5zY
++					rYU35dDKPFd3Xnu0LtrrrNX7kQo= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					xC1thQOyAPxxYdZDoiko6pb41+RWZ0TZy4YB
++					zeY49op+rU0q1Q2R+jnlH6Tgbudn2NQpw98V
++					qvE1POZ9yo2YXOIQoaOaWkCTJT2AJQNNyiHq
++					R3kM7uer6dyqGwXn9l3Y4RcCzqdG5+aJlgNC
++					r9Vb3E/tMU/AyV+mz0O3W0fNPN/zZ7VcgyGf
++					TrD8V799AGx2sA/xa3h9cYBxGuGpSJi73ZpI
++					Ear1sUHcBYMWP9HEsJsV672ntIrXSwYkhraN
++					W/9nTHYFgsZvyz4K2TTxLy4etd+PS0+TndLM
++					Q12d6TuAXU3KLDmO8RQ1SXF84LshfDPV92f6
++					JbckfOa8zKPsAklprw== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					JLD2RhURqgRnBqnNw/W0qobtvg28M4qoaIKZ
++					VJcsKAtw2+tvAiGbFEgN6E7nAlSd6ei0Cj1S
++					tGefXx9B8p1hYHnC9eE/XTzjr97YW8D3DJ/3
++					F2+PL/PSYENeNzd+otcHKZFUdV1+g9rKgXjZ
++					+N4vX3BXvABuVOQdYwdwXrejz9u/23Qhu9zL
++					jiuigqafYXygE317KgVwga7VVCMgTmPsDQwc
++					ri9V8Sm3jeklaUm/ISx9AQt0FwylPl1qNVHH
++					ZZhoyvKK7Wqr3Hnl+i0tlhoL6k15I7RER9Ht
++					7CzM6WOEYKUAFwsfJ8govxpeCx1fe5ZxLv88
++					g+h8Ud1P5zRIdkcGCQ== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					I5ZgJ6QGF3H6T4GJtqCxIZVmOyCEz3dw28pe
++					Aiuay4yVo2rEDEgAVEc1j5jAHWqasI5kNPpY
++					BuIEEFfcEl/1j1wCYbpivh7a691MoWgWAbsP
++					bT8KM/PrRKiV95axgScCT3fsDQedtuJV7XH5
++					9nPbtf72v8t650ExblZWaZV7fZ4xUi+KINfn
++					Wn2px6hvmEIjlm0h8m/YRBu/ujzw9q5EMW/l
++					kfXp/5t7d20hflEPE3FyYOjc9elrSqBTvYgZ
++					nbFnHy6UG1p3w1eksjot25i8XGElHlvRYXOs
++					x7KG8l62142tPqUrv/i2BgkLSKN3DO0CtdzB
++					KrvBo73gvsVNsLghHw== )
++sec-mixed-32.example.sec. 300	IN IPSECKEY ( 10 3 2 soMe.NAme.
+ 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
+ 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
+ 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
+@@ -1511,197 +2122,93 @@
+ 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
+ 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
+ 					zZP5Vd2t )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					h0+HIceO4TyqQTpyxId6XNOUib32igcXidZl
+-					7UIiHygAtYQyofUkMoYwjOuCTd5pQJe6jXyF
+-					rcIslo9C1JDAyqcEewgLRi4/A2CEUhhmknxP
+-					2qJBlQJ9GiWAzK05zS5g1+Q2y++Sp0gPYJFj
+-					VY8MXOH4C2i09/HKPb7AmGQHTMQ= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					ccAqjClDisTOEK5baQDYScY87iFiQlQtbWjc
+-					VoI3EhQ/TUqNLwK0fIdJijxBoQtfDwhiYDHx
+-					Ban7hV/LWOBTC93AeJDM6aF2zIODDvGeSqWz
+-					a1z95di1mNcMLd+m/0wAc5VwscyaCSgID39v
+-					Az6ZoawlXo7LZ9JLeekx2UXcMS65ngUM78WT
+-					co42xwz7EC5YSR74roPBWb5Xcu6RjBa1YWrD
+-					5RCwwEyAJUiD/+1GlokbmWXNJOQbC/Y5b7Em
+-					2/DfFmYo3GvmN9mZEUSkPcXz88sazuPeMojM
+-					JJH5A0iM7FnZtEAMho7+UGvjbOdZEUr5GpKZ
+-					elwJ1748pZZSzeQUwg== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					dc9l4nstQkI6gbn9u78X4DfpJsvTqiswhR42
+-					VLckznSlTYn5UNv+pFfcAWx9cQM5HGx899xM
+-					rzeEfXUegTZOQwCYmJWZrZsSrr4Lthigl8IW
+-					kJ4BGEVbast5W33BjlwNACX03o4ysKn28JYQ
+-					dhGB06g4Zfo7PNDKWMFh0Pbs2WjsvdTpk2ey
+-					OazJ0FPAlGc3r2Xq7OVt27zc+iTZutgG8yFt
+-					dYDuY8E525q7nlLwHAbx4zrZWyBRdg7Sw/l/
+-					EsPBDv2wOo+0XIpnc0lipOICAhwzUoKf37rh
+-					Nb0TAyviQwWkhFJ6MRl7jxYivFHJQAWCU5Dq
+-					E4zy9dwoF3zHP1pj1g== )
+-			300	NSEC	sec-22.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					K0DNo+HfGohkx6Q2HJh6kLNEG+NW9rqVq1qy
+-					5i4NyR7yU9PCn8BJDWyhoG/t3EKHPGjc47n9
+-					ChyJi/XSywK05PiWptIb1ByL1NtocO9b64EV
+-					0fvi2peCm/f3njyOvDlPSJO7HP+vPZMKITb3
+-					heoiHXv0tX5wrV4VtJBhZcgxy6o= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					SXlyw5BASyyMehGz6QUMAkvfExmoPQLHt/w2
+-					wgJ1fHXTI+SFZEV/8xeII+DjOvkUBoebEyxZ
+-					6PalHCEv6K6GnPbpJGNGhNwuuOucHx6FVoc/
+-					xmU7ArMwiZORhyoTec3izKavKG2T6mJk+rvG
+-					Xy9xi4K2g2CE7w1anGdA8oRPag1SIwhhB3AX
+-					Trxch8RptYk3Z19jDaHZUxCSZWrfh/oISNWn
+-					ycdERmHrQw8BMl87Hc2cICMLYWLSgvmor19z
+-					4DYaqVa/IgDnS8kKwK2heUjNhhBrqOqxp3cO
+-					7M3bCbSadHYH1yVuv2+7rYfhfAl6clkWftvX
+-					dqu8/+1eU3MHZw+6bQ== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					gBq4IJtDynwz9Lx25Uu+BP0CNlKgUpDvIHvs
+-					CYSVa8M2HvLury63U0YW6j1NP/5MMlr7Feky
+-					jPEzMmlyXhn8WsiJiyy9pvpK4vVtVX429DJe
+-					KwAtFjP29vpPZmjH0ZJqGTC7ojaBIE3GYiDw
+-					7kGqGyxLFHC64kl8xJx7CFQtA3eicKAkwB5R
+-					uIu1d8lG3BBnjrx1i8xkdlRj2vp0YU8zjcSY
+-					K27gYKX3uZkY5R9Y/zbwyV5PhNb5DBfLNzFg
+-					7lE28oevdOrlHQ/S2Tn5vEfja5bjo0Fmf1hC
+-					ekt4+sOtUsob1hCOeaRxkYcVb+hWB9jQITNI
+-					AibednFJmQEMr2Hn1w== )
+-ns1.example.sec.	300	IN A	1.2.3.4
+-			300	RRSIG	A 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					Hd5lXR86upb7H8fuiGZ0kcoO5h9s4R9Y98iL
+-					StU1pnXxG5KV/AxMlz5p3s4/u0gte7japaiN
+-					TFyASUxbTc8w6t79jyYMLlPauutggLPgPx5b
+-					1DS3aFzrA/XKdTD9jJyKLkEgiYmHm1yRq9oW
+-					U3gl2lF9kq/JTC6vHTJ6VdfR3GE= )
+-			300	RRSIG	A 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					IpzshcLIMj4iWcq6jPh9fRUdHpciA2KsRhDz
+-					6F0SYMg9Baauc55pNMihqq5mhQvpJqGnKVHS
+-					GEgJbEUNAxI8OBwewVyMgDdTt8R1NK3ZjFGE
+-					0VmtluwrEdKT9HyR45yVH0/SpFZeQTMKH9Ck
+-					yPAuD5s53nEGHALkFFadEalyLOCSvrU1+j++
+-					tHCfa22+QYbh1nSQAdvzzx5jhX/mrl0Blj0t
+-					v91hb28yoClOzGzJIQisdfn6xPAdEGW9FP9M
+-					wENWiSO2bhIMZQNxiCpBCmAeMRdlQVPwP6BP
+-					SsH64WQJCIGVPrL+xiJQXaIXx6aZTBeLQKB9
+-					RJQRDywk2cHNdji2Wg== )
+-			300	RRSIG	A 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					vusjtNWhFBkOD/uIqtPS0tIByS/9SNIGDw+R
+-					+SxcvJ5ovwZrNe0083ZOZ9nkt2+k7nWdsAw8
+-					MBF2Sb2EP966f4fxCI0HE/oygHvZJ6oqtF70
+-					IyS1CrwU8QJqoYsLFXBtprulN0fYvJk1KYff
+-					RDfHtoae1Nmfn0tb375TBf01e+/ijpHdzlYL
+-					rRF6eduUMgXOjstdzZb4mQIQ/UPZ18Ij86Q8
+-					CTSZ5BAv8EQNKPkblEUzB7IPiYlTTLIENx1p
+-					1lWIeZvrfufCubg1uVQZ30g2yOyexNaMT2Le
+-					LVj00WsCuVcLRHEcxn5nQzBXZp8wZeVm9G0e
+-					wFAsrFzRnQz+ttQXaw== )
+-			300	NSEC	ns2.example.sec. A RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					AzygrAd/tnGAb5LOZFZxs84u3VRBrHAN/z59
+-					e5uy/OBSa/3P7dFwlwfFHkCA02NFV+2oLO6B
+-					WbwuK4hPwACrYZuJvw9rKa3rfYNZM1MF6fUx
+-					FQ2p17NkSKetFR25G1dzXMzM1MlbK87EfBWb
+-					ZXcw5e81JAvba8q6ZXCcXZz7DTk= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					zx0VjSCfOb9ajlaLpLD8gGahBk/GYwT3J2AT
+-					D8KZwlpCFN28TQRlPCIaqCBDlb35sTBiYU0S
+-					3rcJMWUGrUaDON4jmeMZZbGSASNVd+D5hcEp
+-					hQpqN6Su8mFitflVMKIKdLnqACCXJUicb6g7
+-					7SElAiesy1DuWEWMKwyyXV/X3bEHzmvdjIsB
+-					9T4wsCcElDQbVItnPyms0No9xrgZmpNR3UTN
+-					yoA882da5Wi4TubusiYryzncZZQKzZzCGKZ9
+-					HSl+5STjx+nBvHL9ud8rLkimlzLHO5BEHrN9
+-					hvkzqEQkmOer+15f3iQtFoovDZhR0Qp1Ag34
+-					agn/nh19LtgqBFT6pg== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					x7P+aGsZoDroKh/AaVkBzmXLIy+TC7iUzUAS
+-					M54UOWoGjlpU5gfyo6kL41dxRk2A77yYKxN7
+-					HHSB/z+1u2IK0uXL/0teTgcUJ/yu+wTC21Z+
+-					nKc4lPNr5koIsEMgdags9Coa90rMbLp8Nk1R
+-					mv07wjykShruY5o7q9sf+EV/slSFcUmCXfsb
+-					zmzfor0kUrwliqzgNPpwnI3eNIGkjUF4wW+u
+-					t1c/9Yyv25a2ViFF1V6I1BvNKFtVAkRff96p
+-					i2LPWjaH3/ISi+8T3Um1d63ALW+M6hvKdbh/
+-					nrjG098f97DWL2+VrI+/bBVi1GPmzR9bdK+p
+-					Lptct6Fg11LSqj5QJw== )
+-ns2.example.sec.	300	IN A	5.6.7.8
+-			300	RRSIG	A 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					E99YjCcD6e1mGnx+Gxj6pFw5/ISt2SGlGoOb
+-					XHVaa0EWF4L8jZJGgzs1P+shE5miZqvhgGMo
+-					aUZ1RPywjUBZ4NOxZrXOIutPMi4DTcH649rx
+-					HWhbjgBJptfYVGI3fvnL/JustEQxchOCamdi
+-					ohnkMS8K/+9LdNcVoBbXmd2xSWw= )
+-			300	RRSIG	A 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					f+xyLGM0FkJuvIsBsiOpD4S54PC78wJRGHlJ
+-					HGeOO9Rt0ZcuFP0zqqza+8J9ddYXxzAt74ut
+-					QhYxhoWp0Cwv/Ah2ekgX1c2SHXB7gaWiS1jm
+-					QInH+34hG/YOfDzdBmEvcghr0SA99mfSJPcM
+-					iTdlP6ripnqhjiaILF69P86Wp8DJgGQXeAzT
+-					bN26F+3YePj14TdO4d1W98nMolx3ASpE7Yzk
+-					L+v5TV86OdwnLB0qOsHEwch+NvglXLS7mDn2
+-					XljFd8FX4DVElTTGaWW9cwLBwwhZpz6VMx4G
+-					mQw/nAEJ7Kp/2JYE9ma2H1dPoH7Yj/z/zRTY
+-					+4bgonvmTaVyg8MFVA== )
+-			300	RRSIG	A 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					uTBym8cXJHSj7GxGFNzqX+NL/Ys49a36kWLw
+-					lEhjWH+z+CdEBuHRIfCQdPHe4XrUNsP9eWg9
+-					TspzM+g4Fd/dh8Jz7WRQ9IEnEU0qnt7HagQW
+-					qfOsxve4ny1Pjm2oc/RICfsGTBJpqL5UwVNw
+-					u+4bCr2ZdJwz1VZeCaFQIG+iuaAWE/zQ+xJW
+-					e8mGvPM/VTCb3l7ZXePvE6ej3XFHfGIXqr1Q
+-					sB/c36gw4bkFajA9/U/Ni8Su4MjxkkvZnG8n
+-					aT7YrHXocZI0GyoQJMk3IVERc/khN00P6NO4
+-					5FQR6X6U32tBn7ijOHmdd+ldt4ckdcqZB/oH
+-					4yjM5N+K/gt2/E4puw== )
+-			300	NSEC	public.example.sec. A RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					ldRLarLBSF8qLKnXpiWUK03lLnJ+OaDnWK1c
+-					60K5LY98IJSuHHuMeVw3t/NMJMUjSMBz29Ih
+-					AJMViXc4BNr8U5kUryi3ryRtfc23PbPLGLK7
+-					s7GDA2Mjd2dxx87MZwP0ER8l+o3dFjwqUBC5
+-					jWfupB+Z12AkZtINb/BR9lAaOWg= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					fuH2T2IDBQ+QG1zc7cPrIVSm8Wk+phIDUhUn
+-					rT6yYtpYeAfzsDzKlAC2iqLLXIT3C4ydda7P
+-					vNlqS0W5Xl4SkVp3M796q1rOskBK3CqM/GvT
+-					zRcFg35bXA0GgclMKfT/N3hp4ksWA1nQokIN
+-					oeYNY9ChZVjEitJvxW2XdjxS8gWFvHpSJvr8
+-					Qtk8/w0ghYl2WwmhwswDfQ6z//dgFrew9JXD
+-					to0UEMkloBOFpmTJY7rtv5+52nRMw5wBnrgd
+-					4cIAeZ9Fy0QNZvXvk50DLBS+KpSzpHIs55n2
+-					jSLGLP6iTYSYJp3EbprqgqHrcGqno66Kb2SJ
+-					fbtPtQo01WJn7FnWbw== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					imdOqDzfX3ecLJahnF8nCpHIAvL95A403DFb
+-					ccKYOYG1cdJzyYyINOcWx1WluUxQRT5PQ1Dp
+-					00vM5SGPwVljomtJEfxYi1uuGlGN/arwiL/L
+-					7bdC0TtVBBuRsxp7XWUeakJqIZNfKdA8NabR
+-					W9+16sdD1qQKrHZtmfyA8NRd9WuT0XuUqp9i
+-					KsMH7CvKY9X3fiym9bUz2otu1ZT/hvm22ny4
+-					cGQSHyZ318HoTVmzuS0HUAtT4SjInHdZOrf/
+-					2HF+AMcF67HAGSQnmFVXJmpoZDowGt3HzPQ4
+-					ztt7F4k6C+h4kMqeamrWmt/588OdfL1E+rAM
+-					AzXmWlHrVgaMQVw12g== )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					ucuaYq3+riPlg50nnHLhNfopzI3q9bPyu/Hp
++					OVxsp+Krmzjfxqnzr+XDVLquFQJoOFw/D9nJ
++					/shPPjd81rHiHVZxLpPX9tzV2FMBv+vBcX6C
++					/3K6WrL1qEejArcogPHrM6hdNdwEORueWq4W
++					T+QOTHIagvn2E5gvgu5QJpX5TJ0= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					P/gQrVcBfPomBi4TtMOPgj++Z9rBza90vAxO
++					57PYV72687WO+WOz60sxs5QH+NwfSYb9ABjV
++					5Kv9W1Av4EMMBSXKM/Gw8FiPV5baB21MaHjz
++					Qrf0LFmUWoDzEvaG8tQuwwJbBxvU4vIPzcO8
++					ngwdY+C1UYOf4qGyMeZ055wKyk+ZA9xLO7Ag
++					sEBtDMe28H4zq3T7WI24wwz7nj/TNf44DEpG
++					+KJNVt76i3YHGtZKmtdEJ19zHMdkPpsGWZBN
++					6FO66GXJrYtZtdssmNHb8dEMm/JhXt+0jz9Q
++					lh4B3Ywmi9cyj4AsqMwFdNhXM61xTsokahe5
++					0tJ20+Ig8aOWGwCUwQ== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					DewU0DqTaoYReXPJ1S+/EYaPyxyZFj7+hId1
++					lhDtLSInAut0p9KaJZQSIJ3RBpZVJMoozoO4
++					3HmA4CMgBbwIJeGJ3AhaGEPLwpTDVk+PWe4U
++					SZoCdkK7snkyABe72NQ8sNO6FXnsU189WOln
++					eQzRKU00u02qOFX8yRuQGaMtk4KV+Mw9FA0K
++					r8RFTiwTn7V7+8r16uekK7jUcxYhCDvp6K21
++					jOiFxPblSl7GlcIFAKOWEzh86KbcnvYOovNA
++					P6Izq0NmEDspCCiUoKT/1+TSIqn6coOivMMw
++					wI4/xXTLc8u6CK4XfMM8ch+OlKpewRfXneSY
++					VyMGz/F9huAhpg+HUg== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					cXIFojsz8lrfCktQv9cxZZbPXULytrRYyN5L
++					A912WJz98UCrneLxgcqw7/rTpuBqra77AoUx
++					lz6+qPqxQ6DWPTGcyXzfgw9XQzUtHrqsRd0f
++					8E+2y5+5+8Jjc45+7lkNa1LzAWCAikZwJii/
++					OhU3iE5nZeXtUPcrztbLHg/pkKE2Y4NgE8uZ
++					VkK8OfGHDve2gENhD+asBOBR+h9VRaicGo+u
++					B5TA9G/SNSEHbkJGCp6e7XFVaCg8tf/z3o6V
++					Yj46qtjhgwdCof9ajXQ5mM/za/JqQmmWIZDO
++					ysFrEDtrXBYFfJkVz1YhvbPkodDdJkW5zOMJ
++					epBdq0qS1tsN1pvK2w== )
++			300	NSEC	sha384.example.sec. IPSECKEY RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					Xs1Px23rT5bBoLza06WFUJZkRkElWHQXVr+l
++					2JnIlobHOLhT7cjAIvQmSbwxtF7bW9b96FVY
++					ZoRgBJjvn//nRbs3X6YANeWBEfVeBQxrffWp
++					6puGiXbCe2RiFPNJ4YXzltcuaNbDi4jYb3KW
++					YTIkjeGmi6AMQmHwGMsebOnZlU8= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					Q6N4jEM6yO7skZ5rt5KnDhmMzcck+5EYu6mr
++					2kEiicgbeWFnzTg3wcCrnW9KPXLGu5fH34Ol
++					kIj4Ke6P7ev//k/ygscI8KQAmEKH/hV1cOhL
++					5vMamczhrVp0Z/V5rHc5kIWOJMRo0tQ//ORV
++					alrHTS+itAdAQzF9yR1rC1f6nbRXQofIO2K5
++					TEWnV6Nwb55ZZ8QZVbJbDxWOJz/bIRquMlJJ
++					JUfB1b5TRLqTj2jvqJaiSBVXV643ZucAfOa5
++					B1UQnoxWzakMFKEkBRirxr8bw8PXujGu3P5D
++					wNi6aquMAj16nhUow8T7AHJBWvMo8X+pNXTL
++					Yf7RRYjYTSr8a8Z1vg== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					ltspdDOlwncTQ+Gtr4OPq43xdCSnrkGlNvnE
++					vNpgNCI5QXYdythuOFnVvdhOTJJsoo3dVoV9
++					N98FHLqgCJ2gjtHqPCe/ZfqsVKZ9BF+DHuUU
++					OY5xNooQrWkLxFcKbSwfl3fJgFVqy+eyw0Ii
++					VppS+1WEZhmhI/ib9+kBpd6/eYJkAuoVAzpJ
++					eXbCK9SUMEATx5+ELQtCNyS1qTMVJ+I4+I/4
++					hpkiCWizgmx0miZhWpWMmffkq8RyUF7NEa0C
++					w9tj+Ls67bFJkzFjPXZa1YWBZcfYCWiGRsdo
++					EzqPW5i78B+h1NECW8tVIHPA8MPZz1dTQUNM
++					wPE76HikvyRfYMewSw== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					uardZlGiJG0zPdms/JRd0M20177k5W2Crf3K
++					zVFlOT0//TjgJY7H3eA4rW7jQXcovVxaELFp
++					NovHObB7mWyNgCsQGbY+RT1eVGXgf0CuFtVN
++					kSjecmt5vIsJJmEzcBCR9M1hpUOj4k6NERuI
++					ott4o8l6FKqk9yu230fj07HAOfpfaRXTaSes
++					Q/rGzNOj393KEWTDZFjUDMz7nkYM1Vhrg0W6
++					ooGvJIqdvgB2gWQ4j9ehdBAqsepGixFUn2oi
++					Gn23iozFGgtEOlvAs+2Vc5UgsMyu2ekuh5kS
++					NqhYo7U0X2aHiyEcGRCc1y0/X5l9KiTYIeP2
++					1RgtaE5XClR/mPxTMA== )
+ sec-12.example.sec.	300	IN IPSECKEY ( 10 1 2 192.168.1.12
+ 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
+ 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
+@@ -1714,70 +2221,186 @@
+ 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
+ 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
+ 					zZP5Vd2t )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					Bp3Y98+B6Rgsy39TcRw3TPRmbXBGGBQTaXvi
+-					oSywo/qBfkfoJgRYSxq0SffMHq9AstMAaoqT
+-					VY1dSGloMJeF4J/VV9m5XWTtLoSB9fPLLOM+
+-					JFYHtpYGQBLrkDvlLR0mMyiHLMB58YJ4qgVY
+-					/swU//Bmf+ivf3OZAC9PAFJmh6k= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					TEoklx8wcff5wNwRdU49/WvfLb6V/NiVbJuE
+-					7oWtSL2Djp1w4/Mo+p/mLk/UzcbQLxBU3TUO
+-					jOWKsBxUrfhIn4O+6L27/7fKXlK4RbTsvWBI
+-					RhSlj9/bVzpJzHZY86BNWQLJ2XJg13foQkLh
+-					k2rm/s4lLvsdCJBhhf8yqhl9YpabrvvVKs8B
+-					riGfZtfJRq817quPoG3bEHj+FS3SlrSP+wVX
+-					aDlGrLJgMs2Jdo8koRnmq2bC14o7fB3Sb3C1
+-					NqTyoVv4y4ORrfIUVfPHto5U4BJm1KNx7/6e
+-					qlP4BGkfYIseNRRAc0YHwTmY/qEh5OXh1VT+
+-					hHzexvbXkSdaNvsFDA== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					oKaq8JJMlTF6r9L9UypicA5tJ1FZ6lgEKXVg
+-					yRjHyngziDDwetCumeu0spZ2gIYhlZ6+iO9e
+-					bzLyaisD2/cX1TTwtHpOXdnLBmazdDK0N2Nc
+-					thodwl/rn3Iw2IWUvArb7NFiM7G7H9XEy9Dc
+-					KPXYj3NwXlbx45dzlaWcfeOcrphFdQfjqch7
+-					WiCpeGoF4iWYCdwPOUXkLmETwzn16x8f7t+A
+-					5yr0ou8EuNquAvPFZ7238w7g0K+jJAkiPq9u
+-					PDzPEqf1XcFqhJtHgfOWSYtVY0BVF8gKmmdJ
+-					iDmEoHE/u1cuaUaXw8u1e0f+mqahIykFVXLN
+-					Hw1SuDZ692Rzej0JkA== )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					sp9cM4vtiPCYR/q/zjEFQMvp4Lae8VwcFoBS
++					zVP1vbXrfLGjECmS29PS9w2EuSgG65ufsjsH
++					ewjCQxXtbhS3GbkqW6T+BczchuTbxVPoeiwJ
++					SpA1Nka3LhheDRznREFNi67LFe7T6WgqX9ji
++					Fay7JIEKjO+dQcZyeFbPDn3GvSw= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					HH0l3riJtHnVsJ7e5mlYEP2K7gvsHo8H55qb
++					k0itDJkpeCwnIPuXB4iOnoZYtcwecOTES3ir
++					71J2wcdZFXp/ZDpM+u5ZxRhutSKU6kDk25ug
++					k/yl/nNg8ea++Bzmf6OB+tTZ4yaCySIy5X3R
++					7uIDisCQ5LJ3wkYCAP8z1h6gMdkJjITHa1+P
++					hsGi2x9QuDOUcxxOPTvmLZyVdgnMN3K0ViUb
++					PTqVqvj5dn7pOLreyQve4/iwaBfxlUtsXO+i
++					wtzsyhb5Bd7y+1vHVbxvKGGY0gIF7cKovgkp
++					NDh75Thkrg4oMJtTrqDRO9A+S0OtxQcN/osK
++					FRxby5ILfQAKeN8oSw== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					flRzj3hURIHk9DLH1t7hTsOmyY4DIlTBP8qF
++					rRGpDnjsbyFBw2+FQfxWaoqAc3hbaYZXyZ87
++					r1QnZczUZoceroe9Y+45dMhy37xgtI0fNMC8
++					sKCAX8Ph79yVdhekiBYcWp7XZPjKI3rP2I8M
++					OrOMhBc0OYKk+Eo+RWPdv3TI3Fhbi70phUPV
++					nFJAkDOVdusNwXwPJDVFBXVxT5yvtkgCdlc4
++					nf/LYKHHnafWNxEhnnnuCR8o8y0PnnL/sc5D
++					U1JFg9+nZRcgIhqffjZ4xOhCkjYYFnQ/1SCR
++					K9u2F6XChf0sZlSrl8BYw3VjGyYRxM5X5R1W
++					VunDRGfcKEVeJbtJug== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					F8yPUuB27JKYxQS9NOMLHulFa9BUPUXfVzum
++					paCTXKJWp2YjOhoOwYj5+oNzelYqhiB5Cn6w
++					oG6eYA3MiD4ZdEHpnw4ogWTN/MNVRIMoMOKx
++					XE/iwM3QRSM7I++0eaIV16VuAKqLukJs3X7O
++					ETsL9snQuMl+qFGkchJ/kGh5+Zgk6t3shsPi
++					LnPIBM16Ts8xyIThJUrJ/mpA05fYx+ZdMyby
++					aJCRAPhUzEcxe0c2scMyHTE0clrMGDdpmLcE
++					ensARJyNuLIT+ikbkGudHTxNqgwxQ+16fZav
++					ERlPx9Q1pSMFKtDFfyaqnSHeYBrB5PLijy7d
++					rt40jwVeWtlVOGr27g== )
+ 			300	NSEC	sec-20.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					AkRa3kAjknF3xBG0FiCOWdgvKUXTsjJQYZ3w
+-					vH6hKtIw6iJLIHXBuw8ip09IXWvaYxYZboNV
+-					r4M4bsg7dOArDvwWvKxXVzY1qLv/l+CzpWLF
+-					H97Uhdv8oOvgfB50Va6zdwnm8NYWpSyZR8Sp
+-					sUNRN42iDIx68g4DC0iXY73l3kM= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					z9SmmJ/i05AcUl2tl/kWmOFrScWGIErE3xyP
+-					K6PJs/oFSH3qGsgS14Cx3nqARFkQujuxIVkX
+-					H1mtu3uWnMa5q35cVgBym3ud9BLPtQDx4sGI
+-					1bmkl5xh3Bi90xfx5fz4e8ziV7BGn7mvEKSl
+-					l/ea7Gfa5yc3LmPUUbRHrHYJujuyX+d46hS7
+-					KQ/haDf9shBoXt+/IWcQBT3azgwEZuiM+Csf
+-					uyn2YyXxDJZpmzfOCL5dO/Hjh7yBAi+rc4jL
+-					UdDrfplO2L3JDSXnY5abOwADAqbnUS7wUt9S
+-					3EuGrQkmwDapvcph6dx5LXZRbsMMcJ3FwSJR
+-					/rTeK+ifClOZqxqbvQ== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					GIjekPGJYOhERvkHNWc9eHrhjjyZccZe29Hw
+-					MEgxNRnoGXrPEscbrR2L3JX0BqGdwp4DzoTn
+-					ho1sbUQ77W0TaI12r+h0/jQjVlIvBgFUNMgT
+-					4myQiUK2ubBg1mMjNkq/QYbZmgfuLahPXor6
+-					UmefhMkR8tfzPJT9kBTxtWiEgbuJhwMGydPZ
+-					zRoc9x+iH9xDu/nY8HFKAKmzoDtR/e6/AlPF
+-					SBeF4nJe/YdglvNKeDUl4QKtE2spGnQlhvaY
+-					eR9saXai7ErBF6q8oU7Bn0qDz0gI6qMFzBg2
+-					IoJDqOe2PMg6OiNIm18Dwab80SiPggUxPhH1
+-					XFwi/+vLRM+P30Lszg== )
+-sec-mixed-32.example.sec. 300	IN IPSECKEY ( 10 3 2 soMe.NAme.
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					P4JeTGEPJ0b/373X144T/ZU1TzwnnLrUvsEL
++					l9sR9gT86yKszFKMwIvjBtY3zMvYwTzVR5KF
++					DTEf0xTXK1SGbXzHc4vLtz6/qRtwr7efaa+7
++					kkeEt/FZ6r++YCUYF3pJ62VRYmyjJp1aWIn3
++					64qXmpCbXLCTTtugcSmcjK1eGn8= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					s6+Evh5RDlAvlfTNNe9++eRiqH4G8F59coJu
++					vFxHznIuDOBguVPmvVF62ESw+xgi40zw/QCL
++					/Qn6y3tWEVrIvvmzNno97ZZ2r0hafRYxug0Z
++					GDweMrck7Ax0a/mfYyrKII0A5xUZP0BNpNGo
++					KOq9DKeO9M9h3rOkzUt8/K5U1GUjpb0trpWC
++					mwyHpP93vFS6BVzvtwVjxOm4XvX7Chzw7W9S
++					SHN1QLOJCEOAdc3+EA0h/aqIo7Hah7DXWBOX
++					esGcKCEJQfMwuiHQG4u9bLUvyd9tTsiA1J0S
++					iFuvppcsaBgAPw3f8mIvMXGT8L9XXppUl3MC
++					CUvkRDk+GcmXUOvMqQ== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					vcAtprqLVI83SUYywC/qG+ZGOXbif+uIti6K
++					3Nr5NzTRo9ZrkwrmnWMQPirkSFki6abodNhQ
++					LNIWKjqpssw47wwjJ2HZPLpjGd2VWk0D+Iiq
++					fteggBTkVEfw/mJZ02MUejOzBSVt4pW0y9BU
++					Gwr1461niz+v7WUtYcLUV3DWUwZ2nmXE9qWd
++					tC5zzfYBJYEnkTm7WRYSrOG2GKLZIxS/2D+i
++					SRrY+KaL9hBUcWusK+vFJ3OFEaq3RHOVCBpG
++					+ZyDAVSZAgsn7ObuEiLswuFD753b5ieteBfV
++					2U5inlw6bHGRSctaq95TMiqKtgbgKyWaDyAN
++					DKaBMdRGg098GH+zZA== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					L4jH5AxKcqyy8U7Di0m7MmmosO9e05fN37ZJ
++					Bwkmg1Gf6k3Nv3nK+oaQyPgusHLnZAO8/V8m
++					LY392PAo6mn5c8Jq2wxZFRV4splx+N6dGt5m
++					bdaWZbUNqtTKgvfJhdPJFIxsJrm/c/iFit1A
++					LFyQnRXFtZJXlH8+akFlYMwNxiY9tL9vbNhg
++					MkjB8kKj38mfZ2cZB4/CN+bFyObjoIriF7jh
++					MAWl62M1TA60zdmCSRGq70ACFZ1ttJxE47mh
++					35OjlitMeW+9q5s8J7mIq+z8i7Bt+zYAivVx
++					saaJvKaKpXDMit1pnJ0W7UuAGGD5YCixFKXm
++					esrszfQpnoX8JqWTow== )
++c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com.example.sec. 300 IN NSEC delegation.example.sec. RRSIG NSEC SMIMEA
++			300	RRSIG	NSEC 5 6 300 (
++					20181212121212 20161010101010 516 example.sec.
++					jC5HX6U+DvUztGWPsCcqzRPGCx7618IEcZnZ
++					AXNH3Bs1HgTnP71z7+H5d8Oy7l500MOEA6+M
++					aJ31XH9xYUfrcE8l03i1Fs5qynB0NW22Knm6
++					I9mipv1L3Z52OPRQdgQGNzOEml81fopAm9u8
++					B6DZs141OOirem0et1qfozSnCXI= )
++			300	RRSIG	NSEC 5 6 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					w6ukkiN/1Z9sH+8stG6WDsem+0oF/Vd8aD2y
++					QYyP1uX4ICjgYNDMwUDc48v5zJU4zsT/IGXJ
++					zSnys7VqjawHb9j6TouvtaW3lFTC9/Lfez/2
++					SeeKqbyWCJKQzMIo3YoUG1V8nHbOb7zDqGsk
++					6QFjPpy/uArLudiIezdc4azqud+JUpDhh80T
++					t7fHRBB3mGTn1HVziwEJiQ6N0YiZEzEEuU4q
++					ltgsQUhwOgbM+ZzKc0wyYeI2rUteO9IGOPgk
++					PBMFTZolO08FA1z9/8ZtGlKvel6eHg5HuXn8
++					WjfEcj3HPNpE4XFN/aKh/P5inuNocuTZeiUQ
++					BzRwmiwjfRafwMddpQ== )
++			300	RRSIG	NSEC 8 6 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					Ro2XNWTeWt8KuDq6UMwWkcQU+NdboYP5VoG0
++					ldzWcRyMPGj1EOOT/vhDaehi9wp843nty4bt
++					jIGReezourFpjHBG1TkGXexqLgx+1H74Bl4j
++					XMs9DIKzFlXOkk8W554NG1bdQDOlrbtlM8pL
++					zBO7sI91WbhKpJSABJR3rksNhDlwt+HzbN0G
++					58+tiH3YLDdEgzs6yBPtkJTVp8N22EtEmesr
++					RppiFOSPlubRZF90c1S44Kw2fBSpYZJ1hdGL
++					NCx2fYO0e+oOF6scvS9DRrxnHyd4PwYfQDyH
++					R4UcoVchhIbh3n0bi8T4F7teUT1LAYQadjpW
++					KrfRqL8aB4nzyUT0sQ== )
++			300	RRSIG	NSEC 10 6 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					Zr1faE3PrEg+05hjB0Rrkbgg4TNuR40PSBIc
++					7iK8h7ItSP1hhAdUuaKvLAscHHlxfu5OR2AW
++					GpsKIa3LSwdD8eOaSBgzmTCS0tBXrhtoEPn3
++					e/sFB4uuOyo6NTBHLcbW1d8Fzg4JbvFHDNkw
++					P1sUVUcy5qmaJeKLDWAEwYyksaigvJXDYOqf
++					KEIYBecpm6Yw3Cld4weJBtulA2zS0i5mN1DL
++					SqR/ML1etHNJxOJzRE3ps9IVaIlQye4YGFl2
++					MaXmI+yS4fvqyc15fqnduo9ZO/Bo4Qb/rHF0
++					rdCz+sasUPqOvkEG1mWxDiWtMwQH/l5qXPvV
++					5qjTYcLhRFGHPRaOUQ== )
++			300	SMIMEA	1 1 2 (
++					92003BA34942DC74152E2F2C408D29ECA5A5
++					20E7F2E06BB944F4DCA346BAF63C1B177615
++					D466F6C4B71C216A50292BD58C9EBDD2F74E
++					38FE51FFD48C43326CBC )
++			300	RRSIG	SMIMEA 5 6 300 (
++					20181212121212 20161010101010 516 example.sec.
++					rgcYP4gQoJrfpOnvqi/eJ8BZwFy7UHQhoptr
++					j8lf0hnxSPAytI84DHpse5o5E3kqJzfemhzV
++					H7B/JZcR2/ELkaBM0HlVLZ2Hj5B9sUtoZo05
++					W0019NkcsSW42KX4g3XXyniwM61Ibr/NtLvp
++					xxZkGpnECcSxdKvjYc0Qbkbjwrs= )
++			300	RRSIG	SMIMEA 5 6 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					nJQgbeNHvf1819+EGoOqapsmoPdB+rKscTp1
++					pT260UL4EdvWGeZKuowKUwRHGktKkbk8yjwu
++					eZWH3VedfFUYSAP75IR/jZFQy7bSRK0/u+iV
++					uuwL0Rgbl8n5mGWGJk7/lyiSosfeYklKeBu+
++					4JcO8wIjMSpb2+IgY3VEO5ykw66En/YfcM/O
++					OXYpOAiHL8l5kYzTxQYhtquAZtw+TZ89CLiY
++					B7Al2KvM7M6fh7jk84Q3sjMQbUNF3MI2mkzn
++					xfTzZ+gE5D5FrKtMSE2kauVOvjerDsUUz8Y4
++					O3cp6gldUOwSezlYWA+T84w6Phh9vMUjEBW5
++					536uxZaQslhKqXWGGQ== )
++			300	RRSIG	SMIMEA 8 6 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					S5Cs6tXyQ/3d53vtCxPuVi8b8w2wKjK4ZFNS
++					ttOHnIDk1hV7xdAIqcbjyRBQjowFdp2huIBP
++					ZWtdNoEFvUEqWTzl9jU4eapLmyAr3HzLvJsY
++					Ajajx0BcRyT+gf04UOe+lnHbsbh3/zPCmqs4
++					3aYQBnHZNnR+hIvtWYE3sUHQw8jFB9zcR/0a
++					K0MGO4uamGKMI9ixq6bO5YIZ86hROnk9T8Mg
++					r++C2ZI6e7vQrjqSuU/0c+3k1f+YucX/b8N4
++					0rX7rdsuA97Yw4717y7srrG2eyuc+sBlfHD3
++					fUS5ZNAF7hCqlgR0PaPJyhrx0VSDW5L8hp8y
++					Yv5jse1Pj6t4zJrQlA== )
++			300	RRSIG	SMIMEA 10 6 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					juY0ypbmPM0AU056OcCLf9TVzKC20tlEE9oo
++					RMDh2qsq4yYccb8kO/H0GerBDgO7PNUV7dV2
++					ryw6EFvzj0Tg9BWUYymnk1OV2gwRjFNRLCJI
++					mc1akWOUYsZL1NJvkX967bPoDDCZMphO1R0G
++					7Z47JnYwPjGRAHBVUdZSk33+ENVrpXtFbDJW
++					K5yALboYV4/XJ0/4KNOrteOdNwe+yRVJcxBm
++					GJzI/lsIEZ3ujqDWgqtPCIJfEMU+n1/jAiuX
++					v0vefSuHBlr0oryuUIgT5lkh+oKauzibYeHV
++					mNfYj+VbDFn8RjqtBlyBiUOLWQWooxAhr2Ej
++					h8uTAWMWRp3o5XOnnQ== )
++sec-31.example.sec.	300	IN IPSECKEY ( 10 3 1 some.name.
+ 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
+ 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
+ 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
+@@ -1789,269 +2412,584 @@
+ 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
+ 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
+ 					zZP5Vd2t )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					Q98uLQa4yiNx20mu2+eKuoDUIp1trGYoPIfh
+-					2xjpF3LdJPKf7IWHRrKg/83mS/ZIUYMpubTc
+-					UReFmBU+H8m2cNT52dgy5J2HDzsi32oj+0c5
+-					rryu8ukq4w3WVCNfMB40HryiJfpo0xyxOlcY
+-					pxA8T0H3pzxxF00PLsD6qEpzXLg= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					huDnVbUefzBpcL2koVKRLUDwoT1xGgkNCCyC
+-					yreQ+VQyJPUOUPYmW76xSugebDPTus0l0dkO
+-					6hzK2qH8WpTz48toCPndNLojiF2cIxZwAbDh
+-					h9A2icNe9ho3Hr30WlzRCqtTOPkOW9AOcGHZ
+-					wRANW/DQhwE4ibCUWx6BuXxlljcujJPfQqbr
+-					pzG+jLg9Dw6ZygpjpHXv71cbEEWWNnoJgbfm
+-					ijyE1R6mXBZWY6S2TPDfd4qyhWbnzH5caqfc
+-					5TD5eAoDnnE1NmPKFg3+gQua/BTYaZeGksxr
+-					tmbNOo2QndPX60eeR1Kn4ujxBf0nKa7GfAse
+-					D7sX00LaW7kx/rXdaQ== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					xQIef/xGr81KqkEpNwIBHGKKg7c8Rup2Z116
+-					60nevwq1tvbTSZCj7i88gVtgVAbdiDC21Tbb
+-					4Kd7gTsvX2s9oDV5xYTxL/UHP8xbDjiTaAFz
+-					201G5nCx+VLywFvUgjKr1Yu4YT9/aJ2XUkgj
+-					tLKXobQX9lNytKCBThPYrIxTdQmYaPzUy3D0
+-					hxboqhEgJ2AiKD5qZLhWw0o2CrhoAwsdZIjJ
+-					rXsV68psRR7inaHQ3OdPtdwCIMx7MyZKECEZ
+-					JEGveLqrR+NU0RqgltL6tSfPSZin2suDX/sd
+-					otLdkc2RrLyAM/eYP8x9TS3hvhKy3pJKJiKB
+-					bLDYyfw0AFdS/Vfq4A== )
+-			300	NSEC	sha384.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					ZBIHK5XwJUX6lZIbqgOQWklBK9mls54IJ9T/
+-					2q295urzRl/qT9mJk+7NXNMpu97K6DttQu74
+-					7g43pAvQNVORxsP0AfM7c/DeB41IZwXAJ+oy
+-					3VjtID+jSd+6HUJhvOEbvrB36kCxXTMk/Kdv
+-					5Zl+fiHzWLazPtJPtKTjyi6FZn4= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					vnAbysWbBoMXN/4Iy8KSlLHxhXRRbzHkZA9m
+-					q8VlXoyVjbz3xgmGsK87/ztkaAl8mHnYc2kS
+-					qUZ21JpX8vFgY8exGU4GszPK+AdfUfdVcxsk
+-					x2oNVtkpOqte0SVNtHd3IaatHywBdNE5571z
+-					/DhHJytQKOd8AbSOW1B277/mu6c9jKHZdYwu
+-					VEgboqW46QhKwyso7CjQYzUqi/9T2m8zN4iE
+-					z7qcSHac8Ro2F+FpcGxtIyu2Z41W7Czk37ck
+-					4IE9psNkgb4rEyY2YbWTHKIcnuscmlhqT+vg
+-					g3boKmOV15rKH2NvJzgrAaWJsxcjW0p7zNzu
+-					oHvx1TH44vAXzXJZoA== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					dgFnpZutgO50gp4PhC0a5rHQyjPQorrKpMT2
+-					bHElABlUdLlSZL2dyn8iQrDhT75M1c9iuGmO
+-					rnlq9jAEB4he88v3HPRW1EHNJFl3MFWBoSIH
+-					xYZHDrrq2DT1LFFwJrjCgiH7yg61L7FoV+T3
+-					PpIPN8yUaM2zXmuOup0XT/oRFuB7T5liwvtG
+-					/M5v0G8ge4dbmRavN8mQSEwFDyE/ZQlGINXt
+-					llQVyw2GkXf8eMERQyGeNVvV+lRo/w2zWyQI
+-					XHE/3iA6atYJzk/YJooVTDskfbRjU/GaVgju
+-					DpzoA/gm8m2LRJk1F3FWYO86JG66XXCjcq0n
+-					0kzyTrKi8iTNjaGbgQ== )
+-lets.introduce.some.empty.terminals.example.sec. 300 IN	CNAME example.sec.
+-			300	RRSIG	CNAME 5 7 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					nKij8bJe39EFqF17wJ675A/Ez7cBoT6hHUW2
+-					L6xdmeXOwyDsGI9e7PbVD54j8N3saCScDXz4
+-					ItQqJIeAd0q22tGXFXQ+kQQRgLVPOTNS7IdH
+-					957LABHKO21kZkzwVGF3/GL99RJqCYSfFZmz
+-					LX7DQ9Za4nBS4d9AUiMhXRyIgeE= )
+-			300	RRSIG	CNAME 5 7 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					Fp/KiTvkjNtPQh/qaR5EOvjKIc12ozI6sfg8
+-					r4nPTi6JUFILNkfUTU9+47O0zk/0a7MmTrHZ
+-					iZY+6urd8H+nr8RVBgW6b768z0oYUCuJV41q
+-					GVuPooxRG5qfQLkNdUMehWIeGHPNFCKXGuYB
+-					VqZnzR1JYktVmk/X+IduNCVUdkikgjpCfz6y
+-					7m2J41uauMjWDlynA5G7PZYUBFt+WwXv9Ck4
+-					/t3+BJwdJZzAxHX1tM3U/vnkEFzNIxWu2dng
+-					U/A4F8YyPNff5Gfdbun4zq25Ex5mG20hCJDp
+-					TCWlcpCJfd5ROil4VWDNrirdklsVj9frkBc1
+-					EOA4dQ7nb2FFz5ysTw== )
+-			300	RRSIG	CNAME 8 7 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					k6ck+Rrg0dFu8Z3TeskkbTbdLTTL8ByI6qhJ
+-					bRA8XimCd1qCO6Q8fUod2q2cq9KGfHc8z6S2
+-					c/+5TFWjzHOxfZbLEnGrQj7HMXtcAK31YHWp
+-					SpZ9ucDWPbBU3NEfh4BQZmrB8NOkkCnZ/xDB
+-					mjIlWc0Y9tTa5gRePaC3IegPPTQENNhUuEOF
+-					DMvZKQsA+2pXSwrNtNvSXlRxGKLCPOvTF/al
+-					iEnxnYuLjCl0EdYmgbKoG2wuTdZcCqyamqL3
+-					EYqJjr9OmTI0LPTy5oBGPrUxFyaYHhvGa4rC
+-					wXiLjK3KxpcYZfsDjr+nkrZXldHaCPX/KQ6w
+-					ANsJ7JyBxUXR4GJyYw== )
+-			300	NSEC	www.example.sec. CNAME RRSIG NSEC
+-			300	RRSIG	NSEC 5 7 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					lYo1pIcvD8vscR0PVPNW45w6uOPEQGBrjr6N
+-					rKyygzb5h+dJiiZuUdQL03oxI0dl11Ezh/G3
+-					ocF81ndZMHrEnG5ERuKftI9vvAvkYr+DnFDc
+-					D0N0tIfHzB35qp2AQnhNQY/RQ+i1ZSflOw9D
+-					/8rOkoBQSlPAnCpIyGbmddEVcFA= )
+-			300	RRSIG	NSEC 5 7 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					XmqQZjep1qmAHIYIQTnzVk4PTeKoqT2ih0yS
+-					O32LiLcnGTpJZ+y+cdlvLUs6LqZaThePOqtw
+-					foOCOYdMWSKWCCKXwonpwKEPocjt/C8v7tep
+-					so7KOdEX0suWxbDOJP8TMzdNht147RwMXP07
+-					N/TedkKA9Hs14fEYEoiK/y73KKDz2ckxTRIX
+-					rxqeZ7ZJfGTXuK/PxAfAtgJS5nBkGJSDKM6f
+-					ykym+QKrBe0ANqVZdbykaP3I0WR21d29Wg9p
+-					qA+sh7SA2g/waj29e7Qd5NfbMis9AfU7lQrk
+-					me4g7N3u5U9e+FsDRsNItwASl8c/5e7CrA5A
+-					5mkKaTua5ovvwkonxg== )
+-			300	RRSIG	NSEC 8 7 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					wtjR2qaqRvPjQBaTH2JgjhjWsnEZfN8qcPq2
+-					Afjx1LqD3f1purYgNXtZhlqyHWs87qksqPbO
+-					rykcGMB8TZ2VpByJS6yXB7LtRaM6SO9yGfPy
+-					8b3Ki9bDsRuXRC2Ie0HStJW2rDuELlBJj1Mp
+-					gKYUUCLrWJ4OCaF8/Xm72zmJDkzN3rMzThTZ
+-					/6XY8tYBnXwKgnrWn9J+VT720pDwFy7pok2B
+-					os2HTAO5WY3Zvl+20B/jkE/ebfkhTsWGHFob
+-					ENUAukxaaDbPtXuyg4MKreaje2wh+Iu3PWqb
+-					efFTG/pnsfLYTG+pXAnb4uzt75K50Ze0TUB3
+-					+Y3ZTANyeYApZkXo1g== )
+-jumphost.example.sec.	300	IN SSHFP 2 1 (
+-					123456789ABCDEF67890123456789ABCDEF6
+-					7890 )
+-			300	RRSIG	SSHFP 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					WtF4ZiPXqdAu94QyYts0GKM31E2y8xOJg4wa
+-					jPpkZI7WEyQOx4uwILRnpmkSjC6cS+ksRBC5
+-					lgnLtsR+ZsZNCcOIZMZrsMQcGm21/DI93HxR
+-					J+i2jCVQwiYws8hguupSahtrwGYlnwF0fn8l
+-					D5RJryJFZQGHQKii316GQWIJ5fc= )
+-			300	RRSIG	SSHFP 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					PzecZqU6DRFSEWJ1dfx/CGlIlRFdgu+Wjgo+
+-					s7SedJVgGCLrCxhx/lbBbcnExjTiCHDi6/Wt
+-					q0R8OtyUVXvqyKMUwr1f59AEBzWO9GbXs5fr
+-					eqRD2h229Y3o6aVMKHl8hsJUYjxyFCBqNuvR
+-					kFSPQuAJaUF+uQefB4pDiVl1aSJnZDCi6T5G
+-					+pTUyF6Ttr6b9VVsR2EUdwzqF01JyqRNgzZM
+-					hkmfwCQsBfJd9rGh3qCm/9iYVaCVEkNVX1T8
+-					jVVhLm3UOhUEJwmi8IjRyCA7RJsLQmXkRrmw
+-					AX7nROqRienYjw0Ztm0/VGbJPw1HOm3zAuHu
+-					QtxtWTABc3j/C5hLdw== )
+-			300	RRSIG	SSHFP 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					zhh18mu+feoq55Ddkkg03SIJQ/gbqN32ppia
+-					+WKE3jBbBaEaWLJ/wP65WHqIyDu25zctg5g0
+-					m87Z1BbDaaH4WQK4Joh5tLd1bZzvMAUOPip+
+-					X66G3vwE1PXBLJNzjB2c2WZhOXbsghdBXmm8
+-					RJbysUS/vH7JMNRZUTF/tSRSGOtlJkDbqAeh
+-					KS7dd+m5StDlxP3Etv9zPW9tA+n0VxUhkCox
+-					9kags6TtEPf6j8acS3HhYUhEJRqVjH3vEBy4
+-					xhYhkX8Es1K1md5HY0RoKL3z5NSkVj32yMTk
+-					vaFYtg/yhKLlSQsX/Hn75rOjgCDoxTBCj9EH
+-					q/hHLW7UmO77w5RFvg== )
+-			300	NSEC	mail.example.sec. SSHFP RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					L3vgFTbZOLeRq1I+RVhl5jOAPHTgKlKkr8Lk
+-					ChyFcsWnYoaNdNSkotTSKoWW85T0SRwktH4d
+-					BCexiVcc+pzODo9/SkCpFKgkZ+3Q3aC82mo8
+-					rt3qjmgLOeeobCLj3X+lgLZRHqw96d+aRpq7
+-					Jna2ZA963cUv5CGkRW1vUNDWwqo= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					Y07ocMMI0+fY8gCwsPEbdzDtwKdma7+JRKXT
+-					9DMUx1hmcS7YxW53TrIMCW8gA9snXnSJjG0h
+-					/aP0OuFrJvZ2xUUAmpYAsdyw+HoeZtwFb3rg
+-					YJRL94Up6MVzNX89UsNYPvtvP7vEpebnYxzc
+-					gzbOcjnV9F9NPHj86Gr1hT1A8dOarbKVFLTs
+-					J3yXWalgG+qy51qhzThgimMUci3sNpFuKfG2
+-					4SGCGIOt2rW8OulNuAFQzTg3zmR/mkVm+vip
+-					2KVIZ6kre+Ka+fR0A7tZP+4U5xSaZXMh5h3K
+-					YiuDaxUmWZSc6sCU0nJHtsB/HIxTi958T0Am
+-					Scq72LK4IqpAfqSazQ== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					CbV2wVqT7r81G8rqWPnda5iHqPaUwVAqoDyW
+-					zKQhbAj8ydnufTHODju4PV98alGuQCC50yQ5
+-					KBHZu5enOTQ/MKiAcL4O0QQ76/OQ1Lw8HIa4
+-					FtkArpipm9h3AFnFoYfq9wS6xmweX21SrNmG
+-					phgrqYtR7pvjBXlh0O1kZG1h3fRaiF0nA8jt
+-					1ZzkMhMCgiFubEDQCVhygbkucFmSSo31HSCC
+-					ChwGnjLXj40HKvpNg4TUE/f7eUnQDeq95A9N
+-					O8YoVcNkcVTxx0hbSlW6Q8O06Dryf6c/NEVj
+-					lXgHRwxIsLEC2AqPbNuXVCN7A1z0aVLfTFxF
+-					hNFwOEnZfExmu5BOsA== )
+-sha384.example.sec.	300	IN NS	ns1.example.sec.
+-			300	IN NS	ns2.example.sec.
+-			3600	DS	10771 14 4 (
+-					72D7B62976CE06438E9C0BF319013CF801F0
+-					9ECC84B8D7E9495F27E305C6A9B0563A9B5F
+-					4D288405C3008A946DF983D6 )
+-			3600	RRSIG	DS 5 3 3600 20141212121212 (
+-					20121010101010 516 example.sec.
+-					RlSITzGdbUeiO/X6i7jPSTliXXzr/zw0l9MJ
+-					rc4VzGC0dcGGeDYG1ZWodAL+pM/VZmS1O1hJ
+-					8qqgmih6wk/6J1Mo1xFHNOsdQydLPbhb6ziD
+-					aWc/yVfCUWH3bs972JM3VLCKRutNEu+aVrqH
+-					D4GBx6a1ydJtsbAzKmwZ6UntJTo= )
+-			3600	RRSIG	DS 5 3 3600 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					5zkHCXkdljvaiL0IbpLxipLO/bs7qKegn4aS
+-					3XY95f7aCH9jsuKh2uDBDveJkyU5TCLLjwq6
+-					RxqPpYxykXvt9x7ezi2ErTxeJ+BPg6t7kBQ4
+-					LkORMTBcZeGX8i8GDD3ENR5VcdyrTueDiWBx
+-					Pgcs8l1N8yXs9o9Z2e6yiWCP3dGpzUsjcTWF
+-					iIBuMdSROEoB4lTI5+uLPoYu13odCisP7f2n
+-					uZcCJyIrnmsUAO/3gYaP+Rn4tJ4f3rYyIFa+
+-					1dqimIVAlkPM48NWFLT+mQ9G0yJG2qApvjni
+-					xjjR7H8iZjfkokn7v8oYD+s659sZ1p+ZtQEa
+-					V/KtryLRnftxfi486A== )
+-			3600	RRSIG	DS 8 3 3600 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					oXm3VWAtTniky4PqghkkVdndrSxviZ9vWIeg
+-					k/bjcAKeMyFViCuYZNwtKyq/GiDPKTjK+43x
+-					iH5hFzBiMZ4xLfSZULvh6koONQN5UP/UyjGo
+-					oAqayihsnpAd3jNt9vDRwHvkD3Nj7eg/JTU2
+-					kQIIIYzsmCbAj34mnglaSep0Ms/Az37lzPs5
+-					hYWFeW4k9fvD5QNkIWM5lJ1BsdNwVBpgLJw8
+-					r+oXjy+d217hTSU5BzsWrUH+GQT731pk1neN
+-					k3JWQ7zh3YgydJLjk5ajhj+hxfCgoCgE6Bc9
+-					xlBKNJ6Rh1JfIRBt5IfHkheMTRD+xZO4hZVw
+-					+QDVTvnhNjmV2sQnFA== )
+-			300	NSEC	lets.introduce.some.empty.terminals.example.sec. NS DS RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					rC7wuuLqhJ6l+bW/sKlAHte1NWIb/JwiNHAB
+-					wrGHvEIeEXH/qG1rKuMYK3QjeUkIC2oiMXjj
+-					xodTvxPHsSMxqwSavndf5bJeMdJjJ7UaY8KV
+-					EmcuUlXP5Mbb0TyxER07MVIbJW54X5DpM0bl
+-					03Bgsnw7SpG+W2AlvwIWZqJ8Xwk= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					57QM/Ng2WsIIgVJ9f8FMCB99pw2Q2zP8NBcl
+-					GWycLFxgEEIrpQ5+MZo6oORsChrvORQU7rlv
+-					xEaLgEkfO6vS9aqXxBP60TSOL5k5XXtQb1Kf
+-					dCvZTU6CHWjGy4ofynCMjEJWTaKAXe6lhaHn
+-					HBnKhnTw6Kd/CzimHJAhFOISyiBwN/bjjwcJ
+-					mzXZaYS7mZqw+syBbUmInFrxgfvmKMZvOjPm
+-					mEUPq23UdpDgL6NEHPsGEr6dt1ae//xCu7Y7
+-					Nq/q4ZiB+eQ0A6u/FSo5NZo5b8+ndZfgsTTL
+-					dF3T5VUzvZ9LY1mMmda5+QtVMF3l+uM51Y3N
+-					oMCURZ8o9y1kRgOe8g== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					rkUcLynqN37zmLl+S5Yu47n4OAHo0NKRFLUW
+-					VIODdVqV+HNl2wimJpmkusOmZielq+O9xjWp
+-					erdffAJ24MYAXObqaFSHizIRoMZVW0HwGVV9
+-					zhuAjqVFGESd5Leen7sJ/B2Ari9Q1SPFyejT
+-					YvLVeFNcqqYK4AZi64q56waNfA7kWKgyCx6a
+-					crsYPNIYzcZHVtmuv11PWH7xKsZwqpU2wFMR
+-					h8rtjJb8qEYo4MmNNtXCmdj80Cq0haTuqv7n
+-					ESJH17445IDjvrs49q3ibTqzDTh68IwpJhca
+-					G2VPTAWdtpdx/q/CIAuSHRLxU93OrMTUHPqi
+-					gPFvVeDTxcPucgzQIA== )
+-sec-mixed-31.example.sec. 300	IN IPSECKEY ( 10 3 1 Some.namE.
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					o1OyseVi+rnXv5XphFpoyn1S9RA/oBLaMDz1
++					j6EtIxKzPc9hoECBQh/7FjSTweGkdhMbkaTJ
++					AH//72vBj9kpWbBlU/A+cRkbookTsPJNW84t
++					hfQaZEeVDK6tGxFuLjfu95kJKcncDZsEyhaS
++					JUua7gyEBDy4sfyrLojVCT6jIdE= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					pK4pQ2/wxYAm2h//CXEp1otFBem3RsL2MOAs
++					1mMVT4JOKwg/LML0GwrNddfPUEjO7k9Nau6M
++					1B+Av2iir5zCdYaqi0o1JLKYX9atUEm0wXo8
++					ZMZ2X8BqoFcfThvnZt6vd3nGc50wDj82tLJv
++					7YlZm4iNz5qVD1AgWPXcy81U77eT4D14vhUX
++					OpMq6lWzHA9TCXQLtPthLNawJGY6lGYlYGh0
++					pwWrYhddfNhiKyWOzjnfLrt6axJbqGJ4LJ85
++					7e5y22AablBRqPCLR28czCWeNgx4hVpPbiIX
++					dcepLQiOUY2WFBsoFzwXWyt/VE68aR7wLRUZ
++					X0nNt/m2XkruNu8X1g== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					vaoSbgs4NxC7/obO43g0MeMpYYoISPjhIH6t
++					WS2u/k4h+Wwpa+dZB3QGGqtl5zAy5A8xd/ph
++					veyY3ElY/CiRwbDcnZIIqVIrhmN8OiQyWl4P
++					+lIlmCWwq7aw1Mp+PtyVdmRx0tKLRVVUGr76
++					cxXtPYoHBZM9iGDuR/sBp9ne7Qx5xoqy5COY
++					PYZ99ks/6y3ZnHl5QfKEKuLUGIUuop2LLiOs
++					vNHJXORcW2gBsbtIbj29px74u4ZA7vcD9f+d
++					LR1+4PW5PcPuA8dr+r4BX28VhSmhdizqlC6k
++					gO2KbVplKfrmo1dC2ttQoDAYhko+AARt9g9t
++					iEzQnveDN75dlK+VNg== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					oThQbYNemKxbcxmw1LBjlqLe3bZdpe4fd2ho
++					AQBRN9QUpvrOP1eLrDSH6lp0OHXz7nHE26tI
++					biFbLByyCfh/Bi/6VYwdGh9Q1s2g7YbU8Nru
++					+eLuwbgPe0xpyM9TlLN/uRIkCYeQOEdcLrit
++					7j+vUTCcp6B/o0swUhemn6lxkZLQwouY1A4j
++					zXVUp+9Qqa0ffNtRnPR7Ho+aBY6hx8pBbg2J
++					89wyQ0tu1a8teHTDIQRnnfy3gwObHFYSGBn6
++					avIHcxPmlFwMERx0tNJAHIkhp96cliSFGgqt
++					BDdiVvKXmTxxtGNtFPfAyORs8l2h2KE63rTZ
++					UQHwlF1iELN138njUw== )
++			300	NSEC	sec-32.example.sec. IPSECKEY RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					cvjaA3Qs8UpY6JPG5FbfaZX0j5RWXo5jaJiZ
++					wU8Cz2hPpA9L/GvAT5ww+esIlU6oDej4TeH+
++					gnTcsJ+nZg/+dSAMIuF8G6EEDEHTwdiY6/zX
++					WQqgfA8wMfpnZ+8rpBprseoNH5MDhVxVQ7k2
++					U4w9u5xXgNhhOtTBM+gKi1B9qyo= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					re9WL+24ilv6l7mqsL6U4stMfiIOjB3YxECL
++					mIfroRgqskpuz1E3/amZm2MrSqilm4Ejdg01
++					DLypB/3piihQDew/IggKbYvR6fHfPacHt1J2
++					Mhe57xoFWixS7tWTM2FrWJNq8/LJTdEpOhsR
++					rWk0Dk1jBR6qFljcu8QZoHHt44Hn7h4aEXv5
++					WdXfKO+1fRMW15QOhbWyU8YvCORfrtXQ32BI
++					2D35FgEpWI6gLZcs9iW97H1zx8XeMXeLzRBg
++					sLv4fLJ5gJOc9Reoa9uaSOyefHH462Bq7Y4q
++					Fy8zz7lwU59Hruqy050vJ55So5Fb8KY7MMDZ
++					jV7OIJBfupbEvmGDTw== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					wtVkLK9GQZfFEzUGK1sq7o0q/HbxY+nOt9F4
++					gm+5o41jCQup3t5dkLkfBhsGqbrIAR+xymUo
++					pjIoseU1hKKDRM7pWTd+b51gMyKgmhenKyWS
++					9RrOt1Q0fChEoVr+XgWE9/HhWRpPRp9dTLVx
++					k6FDiKR/5GxPfJIFQSXXRff6TyBVTdkXYdNQ
++					dZAT6s5p6VkaJPgpvnnHBsNs2new9/v7KuXu
++					jAHPIkhdZDvq8NV5/K166txQLE759/6PVnhH
++					D05wQZFoLa+2WBNKL3jdCiiodmyw9khdxvhl
++					4f4pG4A6txIptb7QdOc0czbDzOiEqCx99cMl
++					shOZ5LLz4n8vVLOiAQ== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					Cy3wrexPHDOGUJa8ogxhOfvqwUKSshpHVwG/
++					DkHA/TPDr9pR/MVY2tQU3tsTKMKXgxxkagbh
++					4fhdimu3dUcAHOTf6OcfFM2D1GPqxBhHgVJJ
++					H6Z6KdGIwMpCap1fgvMkarPaVe484s5owwwG
++					sqbq1/4XtGCCmlDK4KE9zBgYm0zPMZd2ZZOm
++					cV46n9oYoUR97pLO64PrM+dZ1Y+zW1R9QIyg
++					WTo9afOZ/IC64eun5dMw52ZbS6513WX/72Vl
++					AwqMTmfYmwlC29JSgSQVQtZtVs4QMlFcdmQH
++					uiY7lI42K0tn6autonajT94rIT7xbN6t/yF+
++					fnRPfoMIJ5T5NONFiA== )
++public.example.sec.	300	IN HINFO "i386" "FreeBSD"
++			300	RRSIG	HINFO 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					HYDUN0tUGAuzK5EPKkYI1dKQ9xu5isKcKIYp
++					bGgrn1M5XLh+jx7oNzGlJxtl3wrfoNNH1Wbx
++					A0qKHanznYIeIiEAdEVy+e5VMRl74D32ant4
++					guuFPJTVV3lGu6D1RDy+5EzUGEQoTEhKVA40
++					g22QkfKE6n4sSlmQyxxd6rUUAiQ= )
++			300	RRSIG	HINFO 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					OQBSWTqQk7yo7xGQEzTEXYqwPNziSwDiWRQk
++					L111w9lAGjLqJmvcI7WhIIjzbtArXWHiCv+b
++					jM8eKLRpsiwpfA2SF9lv9JF9aUMBHxIH9zFI
++					xpW+i7x/xZ8Qa7okflF7woGZeDYoo/Py46o2
++					PY5XKK/e+sWfW/cN4eNb1heEkR78BcEUQo15
++					tv84iuEb/L+UuMS3c3U32/jgt9GSpXoX1vdl
++					DQw4X4VJGjRV4XWQVlOTbX6aGFEwGE6VQRj/
++					i4wyfakpdKML8rnlp/FA2XW/5rEED7qWCK+7
++					DbLTuuYPBxqLQvMA63KQqsfBiTJ0ZKMR3VTi
++					XFrkYahoAlLv+cIo6g== )
++			300	RRSIG	HINFO 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					yg668jHohtmU/dhqNYteS4MmACOo1ErZmAzm
++					eR7yP4mX9cBV4s7l+0ro8cFDKGCowr6IoHCA
++					emS6vfHFDmHx3NdIqeJWBDsovCNVCX0RAHcn
++					DNOfTWy2gp0P3kClzegSXl5RVK6F8n+1uzfs
++					GnZGjA5OyNsMByr0DtGfAHvBvcbNC+tGyoxO
++					VVh3hNEzWuu1HbEEpKHVla2SHGEUUCHvGbBh
++					c7NcIc2WZNzIgjqah5vUhgj2fccImxzQfxvC
++					hQaHNcOGQ41GKS1QW42lKiertl6ivqZuhjH5
++					CYQdyA4Mj9VyvF8tLRXIfDyl4Et7NXLKxTT9
++					l0OemRyGnWw+BTdHNw== )
++			300	RRSIG	HINFO 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					bzKDbXyrkazWFhXhWhfsMcWtY6wTcg035fZU
++					18rgZ1fAHQsfgRmtD5BiFOa+JVW3snT+eLJK
++					9U9m+vHeSUyQkNbnxrl0s7RSny2oXbNRes8P
++					y+cknM3g2mmr4JNXOlAe+kwm6TdzdH4DuUm2
++					mK3KfFgtagnWHu/j6wE4tHYEuGAgrX7uYVpO
++					ffalQ1AFO0pyhFmnErk2E072JYSrpAfi/8Fk
++					lE33sBAr4SmFr1KHnJTrO/WVaAAZhRJqUgbx
++					eWkzBXwiWwJPkZ0PDY7aYJeHXLLuNz6gECZz
++					DpY55ofOEFYLNpSo/qZH0DACfZW0cf5MyyHR
++					zMlkokhK/XcmmEv+LA== )
++			300	LOC	55 40 15.258 N 12 41 56.378 E 9.57m 10m 10000m 10m
++			300	RRSIG	LOC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					U1RcS2POfW/akAGCD9RNOSr9MtqE8ZL646mQ
++					xFUNJWsgOCnc+w47XqB0ohbTMIDL+JSxiZYk
++					bgcX/9y5OwCR7eyy6drWE8J8Wqs0hbYQXVHk
++					AVb+4hrXY0XwFBc+outY4dxbagT05S33ki4R
++					OlDjwoe6NbGV+jvtSlDzKMWN/oE= )
++			300	RRSIG	LOC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					dywJbQdmETg/tdyYGELZFrNYPATirURA4JvV
++					d8u+Ejce5X9a2StTHFG8AO5oHVHBob1z/SNp
++					JKFYBECnGxnTTb5MjZ43n0D/hcbX089HArFN
++					pT5MMCNlKlU01W2VrlYyMkMu6/KsyFQK6Mcb
++					Y/7UOu78DWbbePxwijigZmdhPFJM6PYYWLeA
++					8mJaqX0MmB51o3FtkBEp834s1bxsktFKLI+o
++					QqSgbreLDF272tDleo9LkM8RwqTNBItHf92c
++					99y+VRg8+cmP5hAADV0ANoFWmZ8LIKum6tJd
++					48/kUnHjzSTMRbAPt7lGcw9ItgC074mku4WU
++					FywoK4EGwQJ7uH49yg== )
++			300	RRSIG	LOC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					EdCsT05INrfXrxH7OJu9ZYVOerbeluKqTymi
++					tdatnHH6M85TT4djWnspHnVNsjNSPFy0+56G
++					N2CHHgXsqMW8p1OYAOzwZ+Ba0t2L3tIkeZ0y
++					Fo58ROSBwQFl5nNSX5fZR+VOg1nuAhZR88Zf
++					DM4clTLtCn7zV9TtuBINhqrI0vfXhYBHo5Rh
++					e97ZBVVcJzNMT8b0ehJ9GjTQ/Zy/XW6UVTF4
++					RinWj4b9nZtxZMDCJD1fqpkQnAu356ja1Q7B
++					VgLLRuSi1rAULkISMJipYNowW0uCSdQK9vCH
++					KIDRskLR5d3DJkmjLSgDbaw3Lqya30/rGSgp
++					y2tgRWdgS2aEpjAv9w== )
++			300	RRSIG	LOC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					MGe1S9ZySCoiyDHXhtEuRBFqgFfh6d9j1+8V
++					QSzpVZZt/D23ykb0kNovytKFnznYSq2mm5i9
++					1jGIbRkkTCJUmuKEF6o5BKeG5iIe006tDG+n
++					/2hr81FY58+p3qgY4uaFVcwMAGN5ixuL7J52
++					QeX8qMrGwnLeS6/USfxyfWtu50nmpgPF7a+J
++					KaeV7Xy9E35eBtp/LZUzubxEsx78ejlBYb5A
++					XCLFT1FmxtRktRyQ4RNSOX54sI9XpUs8xqMr
++					YF3IY0C8atFhXJ42M0pr31SOVJjvF9KAax9Y
++					I5QucFL+ovQLRYgxVrj+o3OM0akoyd6ea3M6
++					SxLo0XnQrhTkjr8Q1g== )
++			300	NSEC	sec-00.example.sec. HINFO LOC RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					i6dgTc+9Y4X+JGSuE9o65dgxKLexkwcsLp99
++					x/h1iHgEkck0Y0i+d7MDGNg6ZeMA3uuaxnGr
++					vSntLNBywTMDGQG43aRjn6jZ/OwL/9e/0YNC
++					wU0PoIsKqg3FKgaPFXGk17dPz5U56Px/nymo
++					zSero2AS1cAXyihClqKZ7EjeAdI= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					WKK7b9fLcJRs/xI74VSpnCf6sVr4gPG43TUu
++					etxbTga8TGGHchOzrLhR+l3LVtHkos2Y1p27
++					bZtYxApqZThMUZ/3fsHwwjhLU3dVNjVtymcy
++					Au8g2+Km7htzHPJfEsFtlBV1DEjiTnPxx9iS
++					Ayi6Ib4p1Bp2h1AaltgEM/EbzRtqnBkVq2+j
++					JF+DRN74dB1ZSWltzNXhZaWNuHi6C+ccXd+Q
++					A2EVSg5f2O6GzVS+RjueuE6SH/AifFjcU+Wu
++					p6QyQUe2umElIk4kTmE8RWxFOO8JbDBdX4Hx
++					CyLcvGFk9XKGmtVpC8oLilxTNXC0pgLI+/Cx
++					uNvtYbpYweguxAUduw== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					03EHsunl3E31Z3leZefzCfpwXIw5ZSjvwITg
++					DQJNsSFQ/7xCAozjkuaSbzi26t93/L5ggDdN
++					zK3qAyxslqbCQhc+ILItcsu8YS1AYHce7ATr
++					6lg5QUij7eZp6mvCAde+0N1kun2pvgHXakBr
++					YM+u1ifjJNBwtMFU6DkDYVMvaWGcq+Y48zT6
++					p7Wdt02EZFrUWAu4ZOSjksRxpsQrTc9AfEch
++					xMmOEVGuFP2xpVDRYbYE25gSy5qvyoVqgQWm
++					BgHbCDHzR+9BhInrI9yzhUV64ZGq/wZEOtz6
++					tj2OAh9f5bp3N0rn/BAqh5c6mDfd3S8K5yix
++					MXKlpr8ojAhJNXF17g== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					oNhHACRQ6raBdFx4fpCx+UW6OHPUGGyRd2LN
++					AliBFGKXCXdAED66EJlwjnTTYduegY07zhXu
++					39DVCsTfNWu3nurjLel1J9LIIGwkspnLnQ3z
++					tZftNUfVr/PjQNoA7q29TY7B/LxHcGDniBZI
++					0JfOATi2J4iWRd3UJMMOUAY54FGj+dVzPiCU
++					cKEt7WSlHDSq98EEsoPYkZTWrTpM46LvC5KI
++					hgFwpWKbIIzwFNV2C9ykMfLLFRLi3JO4MQbd
++					qbtxkUV+j2T7NbTWml9OY96Vs9oMQjSlKN/v
++					CpPPoRqwXyzpsMt6NfznBYNFWV2VGknXIsXu
++					TDTjFhCaXd5uDEKOwQ== )
++alias.example.sec.	300	IN DNAME anotherone.sec.
++			300	RRSIG	DNAME 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					IuMBiJ2cfyjxV1O+K18LbL5OuVk6fG4iAogl
++					KxuKZi9biDB7UaH6Fd0ShEcM0rUL6MzcmEbg
++					FovFTTyBL8+O/LhzElse+dGV0hOz/FilEE3m
++					LZzjb+WB6sh64zSRQTV3vzMgJxs/I60JbVtE
++					eKJ5ktnNmcCS0T+0Vdw55dX+j+Q= )
++			300	RRSIG	DNAME 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					WQTSaB4LddH6Y/sQuvqAawmY7bdhTeY7vZD8
++					YNUvtgx798+DZWKQHmoWD4KDhvqMO3D3rFbM
++					AvjtZJsamVgHFDVnblBfi1oGKL892nRquFa9
++					d40XUtKW5d6I6MaYyO6Cnxs0DFNOKC5NUuUE
++					dKWOx7fuuVaXliZqsGzDESKU6mwiOwrvuSqx
++					wf20bNXy+NgWHom36L4dOkBdiOWgcJ7fmI0N
++					XCmVLTRRrzw5E4kIIX1nIysGSW5WyWC6gxz8
++					9EYBBK5N38eqIHmxwUO9a/8tQcn2PWNqBNMD
++					LFYiuhweentelGwe8E8yajaLfjBZjmr48Jb4
++					HNI7A+9xbiCjBseGOQ== )
++			300	RRSIG	DNAME 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					010KT3MX1e3al35LdCNFqsZT7+TbZerO9AQB
++					DdaiVgmyQw7+UELxrTEyxPS3V0bMzUc3g5jz
++					2XHzCo/ch5tFN8zlV7KUzQSqKO9+vt15JSNk
++					2sSW4jJVK3S7KXH5+YRj0EOPL6O21K2KHwef
++					VZItT0jxk2COVl58qYa1PQ9DoFZ/mzWwC/ko
++					jRFwQc6LXFW+kDDzbHoj8JMeRhJOOFUQhRfL
++					QS5P6CruFekgMJRyeIZabQnqfzgk7yw0YAdR
++					06X7LlxBwsVeS+un4VHs7+kL4TvaFHTfOgpC
++					/d1A5ZEeBSlRF3WrwrcqBNlm/DHb7rkn/w/n
++					osE3j9hC78lfgnm1Lg== )
++			300	RRSIG	DNAME 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					SIK086vGT9CP6NHhDUzNvbF5e+2Wf3tngnBz
++					wOXyU78O5HqY6c3urVCwJqnZa6FfgKigfRui
++					uc6nvCtIIx5/iQvjxKi+3oGGvLiYKJQlJmbe
++					XOocOddpBKkJ2QEx0VWK6M/1MqrHFtOh5l2A
++					D4R5j5Ximl/8K/P24Ek7WFnCBqlpBSS5s0SQ
++					l0oZo2gvZd+GNkiIxIBt20U400p3suKhglEQ
++					MwdOR/8+XHT2KsqUssmsIYlEPBCBiZsLn0aj
++					/tu6brATslv/qmsqc+HQMJRbJ5YHCRpbMOAl
++					rEWgYFEkxachPaRRIVuQwkcTJM3eTjn+D0uK
++					hdlOiQrBACuchImlBg== )
++			300	NSEC	cert.example.sec. DNAME RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					SG2SiQMpOH6rJ6ZhQ3EK9bnnGiKL/7LQILSi
++					D4/agyclVc+vMnfVY9waoA+Jt70MFJEBd32p
++					GScUcRu9MkpdcZ0MiCCWwsGG+nrufdq+rxFr
++					+FOX85LZf4v7qp7s0xL1kf6Uol5G6J7rZIcT
++					yZgWGZfl4WuFSAouPQRnHV/eoqU= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					uIRc9Iio/aaMx8R6vVIuIqMq92y/1iS/mYch
++					wupYiy4A2oz9AjQNZbtGNFu8gInyWPdZVfRM
++					gwSVk5Y6xFI303UWSCDSaFpd3VhkcPFToioi
++					scgtUVI7/v72JOBkhxFrB6nukU923E55ya7L
++					DCZ0lWnLh6VMvSe3MtDLPyUDQKfCZQVAlmNn
++					du4S7uWN6vh5CU8aTNwn6A/bOodtOAx3aDjU
++					m/oFGpn46FGuoYTcnjp3NGUFYOTdLlyWb5wa
++					V2pS39lJgUHBs69+93RP3Lgkhc6ZmsBP/J5j
++					vddRQ2kr8sBQ1g768buWyqeE2566mnGi6PoY
++					lqAEpXO9ReqdPgXqYg== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					xw3R+vgGkofS8s1ihzSnMLoKrEEXxWB60hxL
++					cl3uJpaXSzayoXwco2dZaUzq/Wa9xFBPE06b
++					USSpn00JVhPA5UpAWBx1W7aD6pgyXN4Lfpk2
++					VpjJ/1jjsQEWGZfhvaFnHF2uuPddNaQfWHMX
++					kZDjjpyWC9wLOusy9/7n67vie+SMI68vwqcU
++					pOKlrlTgumJ/HxbTvCEDM2jU5+umyaP4ZvIA
++					mtXSr3r5FUiF5cA5CkrYW0cd5CVivfkHJ9bJ
++					3wEbUZ4NfImKxHCCgzS37ICNl+yB2ldHTfXy
++					6Ho3jmteFbvNVRE5IVNrSozcPaGU9xBLZFVg
++					sle3rAROarz3lLDiBg== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					mF729lkzA2S/Yif4OEuROLkcrLzhValIq/Vs
++					ahpCu8/LQOZrexKLlC/d9SFaSlQaB8KjLQeF
++					L0+s+3OvBk+AGcOxDSIlwm08P5lTRM4kvzdY
++					auZpiNS5rIgLEMM62Yla5mMhvvt+Np/lQ4yA
++					ISpdjAWaCjuV1xBs8099uIX49YNKBLloknSe
++					K4MWHIbEagDbxY8qnF2ao89msx7yQQeCun2k
++					ep4OGnZOWOBMJON0x0InrjUOpQC2XjJPgvIE
++					XTkl041j3leC8nvzpcTDvD5IDlVswExmFZ3a
++					inFdWQq97blgbbDItF82MPdrXUSWTAy/qmjR
++					oUdhgjyO878jx8aicg== )
++_443._tcp.www.example.sec. 300	IN NSEC	_8443._tcp.www.example.sec. RRSIG NSEC TLSA
++			300	RRSIG	NSEC 5 5 300 (
++					20181212121212 20161010101010 516 example.sec.
++					c9om8Z+YcSMHdl9Y9JyXsKtmd4s5dJwnWWBI
++					XC32Gr2gbo2myvNacNo0EOzlnDndF23he+57
++					41VeKKE+jCuHPMzZvieq/INcNXu+wuGytWiQ
++					XTrYQSt3TiejxQdE6OxoxR69RqCyySRBLjDP
++					WT9fXekxVMbSogR0oLjWsuoCREs= )
++			300	RRSIG	NSEC 5 5 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					yQC7jAIX7VS4SSN76lt7Tu0meff3EKGD2RKb
++					hSo0hu9xfRMXlAkxx9W13bnmbg3o5rDD31Wd
++					1x4xjd408l5eswm8G5IZorNvvlmBJHXE0BSu
++					dOHrmC5WmfyqlqRx8kEMsoUrMqQTqct+QmtP
++					rKAKrXdIoSx1kd/76R2YOrzbHWD3ydChvoLy
++					sfHQEJIPd4tvfuMokWzU/CpMpeyqTzebgGN5
++					dSB2B++boFu0sfgTTjt/TGlXsgaU1mHBuknz
++					k0MUvaq+f1oDuw85RGo0/sDAKpkqQVUxW/j4
++					bLv2BhAFhQGaSsv621WDziYWn02wxEccTP/t
++					uc8lah+VM9YF/6NjqA== )
++			300	RRSIG	NSEC 8 5 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					x8TxyxXW/d1su2ijhe449HrUYcjXCLDDlh+/
++					MwZhh+6O3fdZX/bim/q53XtNCOkoTXl6DMus
++					Lei/xwbIQYo8f1J7rEe7bvv44U7z9XR5cpoY
++					bPIXof3EZiEwsqHSb93/UstNpRsDufUeyv4l
++					cdhJxVM2YLmQJ6v0UjwC452NYg3tTfM8vpMU
++					YAfgBn3ajsSpek2TEkW5nt2kktNkoydpnbuj
++					jZk7Pxmw8KbEPt1PO7n9LI80OA8DRkykhoio
++					8SaXh/OI4sS4Mt+wG5+lJixMDUIT7m4jDW9n
++					W2skYvPYyaW4fS8Cfp4gwoIJuKpopHpy10oK
++					f/5s380ql82LvP4uTw== )
++			300	RRSIG	NSEC 10 5 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					mU1SJISNmam1aeKgThUF/ejRdU3Ltet3NgDy
++					50W5MaqpPOSXrR7Ag42R3OziFaxjcbuY4MY6
++					iOIuQQeXh/PcCORCP81+GWI62DxB5ga7hdcd
++					k2zZHSp1FYgtAWoZ4SflxjOBTkFb79irVLpQ
++					3a5Z5CyBZka8zZcFr1Y4EgsAvm/4JRB2616E
++					GJgUbcWxZeL6XHlWHIz+bV3lwv4xctFcmBsh
++					SsGvtn/2av1Sq0Bl+PlbvAYrPhm/2sY8Rtbj
++					5JWCI2Shbr2QUFbp6GlSBbS3oOkeLFz+0L2j
++					dY/CnmRpUHagML3xdd0nhHlMwClFkEEFo5Bm
++					hXIQvYzFz6SpJhaoGw== )
++			300	TLSA	0 0 1 (
++					D2ABDE240D7CD3EE6B4B28C54DF034B97983
++					A1D16E8A410E4561CB106618E971 )
++			300	RRSIG	TLSA 5 5 300 (
++					20181212121212 20161010101010 516 example.sec.
++					m9FBBhkcIdh9DYhNur12tjTfoz5Qtvq11Kwl
++					oYPz8TiUK9P4wqGa3Ufhf/z5ciaASeMueQaR
++					8nrGI0y7WD94mHm9Jg2u5BtuZ1z0hJOUuTRk
++					vETishONzRxv8K9N2W3Jv1ygLMwC7Di1o9D8
++					S0qxYrzkTHmu8bLJj8oPD04+DIQ= )
++			300	RRSIG	TLSA 5 5 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					wVp5u5xaoOntqexU/0tiNrAvPD0KxN5Lq1RG
++					7PkpEMFgR4uf91jgneoIBiUVpTE4agwTO//q
++					0Qt1JAnTwPAo2GrHcTDut3ZkvIbK6SQERC5b
++					c+9l1IR6Lt7PBtDW9NqcSiVTh9SzU3plGEtu
++					KqhAPUzIIAm+kKEDpoOI1JTGsTdJwId0ttSi
++					Qt4QA6OFkYfdjWxm4qSsregIrTdhNuDtHTA+
++					dk9XOmlHlCtlpUnxkTE2uqUors2tk811xkWb
++					aGM+VhFATKRBgNiUt43LkwgCH/Gfordas1fK
++					UsEXIZzAwp7Z3AdY/4PdhO3OAA8uojqHqTp2
++					QO0xKJ7UnHueEnXR9g== )
++			300	RRSIG	TLSA 8 5 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					C6Y2zTg8SKAQBlW5bqGel+4LbcgHjitoxtH1
++					gUv5h07NWCuS97gKv7H0jtQu9vyKE0szSMkZ
++					88tHvFfpVOMfsWxkMiRATJaNP0j4bqlhW5z+
++					48hSfMa0X1jljYVhtxEsXrDqTEUhIv8kZuvM
++					0IpsMDwSWljCFSmf0rspXeCcnpPPJL64I3IX
++					j/EZ52MsBoN3ifSTqodpMxs57xtGfi0lGDJP
++					yvWq2/9Z8BFmzDxvVEPZLvYUCl8w6FbELhgN
++					QD7fpKqM6TmI2xXmsQaEefvl4um5Va+t+e+U
++					mW5T6A+GNYRCNyk4VhBV9bKKPukInMJNolPJ
++					qMbgJ6Gc56V7l3tf5A== )
++			300	RRSIG	TLSA 10 5 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					EC8RLTAf2ga+FZQVmKQmN7gJxHYFXwQ3FUIQ
++					fGYQEiF5O7Nwpl5WPmT4062SEw66EW0mw0Rc
++					Jpq9fXaA2uyf0gWpiuwAlKiLNo/PJNor43Xg
++					JyIO+XqDIpzW0SQGe6sTmCuNciQvwdORR/yA
++					iipYsQW402lR1w8mNF+9MzCJa4w9dHuZQdN1
++					3WvkatYKhplmXxOEdpZ5FlvV5NYEuJi29Mkr
++					2J05Zr7HLGZErDerRjcQRtZ2Y5NgDTXsgC26
++					HB9ODan7Zop0bErddBqXAyTU1p6iS7Mm3eWa
++					5GwVrB94jFBO502HIMIyZbUrVAq7K1PXMRlu
++					/WzABsxYiy4rXER29Q== )
++cert.example.sec.	300	IN CERT	URI 0 0 (
++					V2Ugc2hhbGwgbmVlZCBhIG51bWJlciBvZiBt
++					YXRoZW1hdGljYWwgaWRlYXMgYW5kIG5vdGF0
++					aW9ucyBjb25jZXJuaW5nIGZ1bmN0aW9ucyBp
++					biBnZW5lcmFsLg== )
++			300	RRSIG	CERT 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					RsaoHrajGSkKePvJDvBsaLjVCJO5Mk2VsTZA
++					XfNAWUSi7703MqkMlO13RWdQdEmCx56NxG1x
++					qiS2arILR0fPMo1emt5J0CnZV2FrRk7kbXYG
++					0kDPmhddvIlvTvF4H2WVd1Nysu2SPH5Ve34F
++					luIsEWYv2B/XmCqY8QFLJXutqNw= )
++			300	RRSIG	CERT 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					dEOANGqMChlT1sRhgajcl5XbWFT+cPJbITHa
++					V4ekQxaKRT5/PZOQCYtSX5iOF6lorg95bkQb
++					ztIV1IUckp62dBljoQ8123vhZOpSgClDXZqm
++					YsVinJUx3qKO+XvTEGH+vf/b54f8aywQL3Pv
++					ojw10OHBm9b2vDfww/lZRvtB+RygnoGz1prX
++					jt3AKnKhST77NZktFg77aWbbO/WtuWLsxgZf
++					pckBqB12GSES2r6+6JVST6DE4dTOarCeL14z
++					Z/eygkwFOvXBSG8RzakMIDM4JRUrWC5XQvoF
++					WVmZ1CQM4TGKJylgc6UosC+/kEGyYIZeuLd0
++					iTGYakdsLw++k2XC1g== )
++			300	RRSIG	CERT 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					ifn21DSpcORCBrZPARt8sL++XfPYx74Ay4Cw
++					nWqm2tARJex/oE6Frm3iR0BZ0EYvhVjOjP+/
++					IGlA8LXn95iad5/lk6fY20YA3MVfovN8qt6w
++					uSbQDewWIVgfjR31NhPK96YFruTq3p/KwSCQ
++					ekAobJfx9idiN8B0AdhzdvxLdboeABaUmpkm
++					5e9cC3u3pP0fSAS4GV0ibfSAUNnoMvrTXfmB
++					Bf5nrzx4Weq+AVEa1yltF6UK/P1VWnGAG/Jf
++					PcCYh/XFoTcZfGjso9BGln24vEpkrKd3kklx
++					Hmgw0Ypn0SCM5yhaVRgX2UQtCYFD70BvWrdq
++					p4PfYBm0TZfUnEbQjw== )
++			300	RRSIG	CERT 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					IFwmeo5tNfQ95J8yoi4gpJJQJ+IUF9G4wjou
++					Be4bQYLqP5Or2y3bDzIJ3rRjFxF5Wst5Ovyk
++					zXwEBShFPuQjBXUDoKtCKICR9/pi3eK1FVff
++					2xn40PXk8TrfV/xNA9Izfd2T2BmK0m2HBsSW
++					y4SwyF1sQPPFZC3Z3LpR0yeP5Xo8xD/GUn5C
++					FbncyR3ex7XYNpBytb25Eyy8+eImzM2D7ZZW
++					tXucCN1timxMGP1A34zoa63fsT2y3XlD1Ax4
++					14Vf/Leqmot3h5+85cLbrYbNRAj5SGn2MTO0
++					dbnGpmbAQrTl5mXQRYXY1VEss+eLb2Wq6Jtb
++					mF1MJKJHgLzEYI0GBg== )
++			300	NSEC	c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com.example.sec. CERT RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					YTeprqPKiHtg/ynH/YEPVYktL2Ca2/ZErO41
++					NVUSnK74tUFC6X9CYdnslXOewT9HLmDthr2E
++					7jBUlu9XdJKbXuoRdx7WDbuGl/Nxcjh3EIDK
++					Qi+sVxLE94YQH7gAeYSj0t/HneLhwoRdPf+t
++					pf7O3SHbb7FuBj+cRjCQZMpHWXs= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					qUEKyNbyf5rnPyUEYv5RU9Piglqs3cdkz/yc
++					by3B+W+bvPa/bUMHXnQE5uaSmQ4eSIhBcDQW
++					z+/TKR7zBOIb/wda1wzjjlI3tL2O65UE5s67
++					fAJrDByQ0zEreXM2RiP8eIdYnea3TENoMrUQ
++					c/j+Wj1+nEsbesBbfEXVeE730HXMqqCZPRHT
++					Y8XooxSqBlvY6J/RSS7c/sLYBAc6iHNxni34
++					y5vj5D/mV+yd9hkZiPe5SHuYwsz9wjhbOY84
++					ndtakY7DfG3txgI9W47+HA4qWZESGm4bvdnF
++					OKYZudwMBP2KS74clPqjPoradLRR3EOf7SLH
++					Y/tgBy62TMYXaNDd/A== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					rwPUoJ+kph5rb8FseqpipqwywBvfyfEGT7JA
++					FMAF5R4tWePjo8O+6b8WPydJv0eck5JYkPX3
++					DwJcGBbKiFi8OYt/mdBpxrzhyK2RafMPP0Da
++					t/swWv1NplkpCztJVjHb2aNAITdofe++Hm11
++					NHJE20g4wb47rIzOAaf0fPwb2dsEJhGWGy4W
++					Kb5mpimb26JaKUUy6mmcwfLGo9eLJc5PHA73
++					iQ3cQ/t5/ffQhIXgS+GvgkSF4NKGCuXfoCf8
++					4h+brT3IUv8RRQnWrldFEj8n4a309/nomaMg
++					iZNx3UAebt8DUHl3URtXh/eQ69+enMDIniUs
++					bn+t9OXBFl8WOWc5TA== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					acAM4O4hfy0zz348eNtTs/eb/Pjq+loT7iZM
++					XgyRz0dugP8VRSz4vQmHGYY3JvAvpfGQN3GX
++					aAPDc+Gz0bwM53+4QmOfei4OczpZoi8dSID+
++					fIBS5TnntB0PpCF72pSMR4yyA9D3QY8PFUXg
++					d6rPTE4DGYw5w1vTIZBJjW/wMbF7MsVG+7Wu
++					NGLMFqkX4OSXgeubuWipyL6QkSjMseld3dKM
++					1IQWDgJeBBhPKOsf1IE/7jVl26/6zISGOOM0
++					2u8g+DbnmF1uvUXdbmsrCviCary1KJ8h0G6P
++					8Lh199dYNDdXZat/Vh6xyYgqsov7scSK0yCO
++					P1FRAWUtLq5SEJls1g== )
++ns2.example.sec.	300	IN A	5.6.7.8
++			300	RRSIG	A 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					oSyWhdoAFyep3WDMhrXyH0m8rvVrdmE9hn60
++					tbC1Jo860HcyrnCzIx8KqC0HsmTmlZmTuhOh
++					ATOMeUREaloT8ShrhMNJKzgxLJ2FY1kCRS/i
++					CfwFteHCEXCJ198rExdW4yFVQT94IiyFKoXf
++					FYe2Zc8yZFHoIBwhklXBJuiYur8= )
++			300	RRSIG	A 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					20kC0SNVgkIOAfd8S0EBlezuw+Lye/EAX7QB
++					0G7WPlJXOlDnMxqvTsyjaoETbxLSqo2lZ5zV
++					Tz92cULBzIra7F61eXnaaB9jVDk51crpOV2P
++					rU01sYrYpQlPqoC6gXa+o814lglX5ez3nvT+
++					IzIISSU44yhUIyqSCCVzR5wC69A7QrBzumsf
++					ZI6YvYjqB/s79nPsqzOqxvtpg7GWRYb1OE1m
++					cd9zRQPi9+uVrTDF5WLI/UAA5NzPuY8U20L1
++					/K08/uqKP3K5rdGRgos8hwmXBmSxwnBSS96I
++					NJaCeIGf96b4cvYDyZ2HQmtS8c1U1iUhPk1d
++					S5+S5TDnLGwL/XCOYA== )
++			300	RRSIG	A 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					m9Uk+u+ZJZzPph6KNf5vnyfNWrIByvwQRPg4
++					Qs8veUo7XDiQUxhbZ0282eprW0TVVFtD1q9i
++					QTC68cjnsqHCTKd9+QingWdBr0RwuHSxiPpX
++					8Zbv4LXnskjEbND15gDJ0GRy9W8UgtWoUyuF
++					3MSK/PCxFuWVftNGnGWCl4iuDZM+Q9C/o8hQ
++					YI8YK18zgqlOaqSKPqzMiOK1Yobv6direlf0
++					iYSlWFBHUkm6sgeTihwSPCrLrjVwGqR4Ux3m
++					4bs+SSy1xIOS2nrGNiu809Lhg9arAzkKg9FB
++					DusYCJHQ5VyP1kGcpWbQNpT7ur1D52rtNO6C
++					PudRbNk47qsanIbRcw== )
++			300	RRSIG	A 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					Z/yfD2G/sWFbFsDqZC20BIoKSjniE89aiSKl
++					n/hqmwzzx1GgoK/uTDs9LlIdp7zESPifZ5n4
++					t03pvFxMQgPw5bG5eklQ4Zf/am84DKmIZixz
++					xaUP+SAMjB0IhdpCRBSnC55knBdHlsMC5ryA
++					SdBHOcZ5Df6iX57cpon24fXkI8fqWQ7m1MLR
++					sYXEXs88mFAElh/ARcGIm93T9vwUnk04cxrw
++					QodpUam47Pjp7C7GY1XExtSSdW+h8KijJarR
++					tiYYE1dkOPdT0OjzBybRjbuhjaCa7CPPzGm9
++					tNMph25m6D3Zv9Eay0cvJHYWnbwOZDxO8w9r
++					QpkYgVpLnMvYRQ4iow== )
++			300	NSEC	public.example.sec. A RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					QBDT5kIi+hdEXsZ7b7y/ovk5lGRpKiYStdeK
++					9sKrQvNCC1MLhG8DiT+ssX/66jQEEwZWOBsG
++					R9f+pkm/Y7jImE2KqXfcI2XTaZvmh7bU1wKF
++					17PpytMMqj7bvmomvTJwaIZvyzBX7x65Vm0j
++					B3M1dfQc8AsXruIGlPMyNDJwExM= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					T5wLuqX6ohtXSEIXifG4Yui0TTkNXRkDnaIV
++					9yJrRjFk/GqgYhWzwj0e89yAup9eZNKoftVA
++					bdXOCtEhPHL9lPVK2b5NsQ3+E/TSKvjgxbyy
++					OWAZRkucKKJeQWhzPBbTach3bkEvaWC8fSCH
++					K3X4/R0GFQ39qY6bgxIH1KtamqypTp77EkE/
++					B736JUPhGRX96kgEu+bumR0Z5Nqi5m24pg/5
++					6k+8OL0o4k+SFMP8va1+lryqtpG7eInWRPQ7
++					F4X8DNAoqttpsmf5v6tOpkpgoB+0gt4tNTaw
++					6DQDRX0YCCnCBZEVNQbs04qC8Ij1MhyJSPqO
++					ZOyNSBBNJzdYebkrUw== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					IMXgJDl9M8F6xgSzzFU1GxSpjz6sJ39xRYDj
++					M9ZRXqmIGtZUbVLYiuGksy9oMX3+mXkRdgGc
++					COys/CFeVeJ0slUfT1L3I1ZEpCqi0GpPtcNh
++					muGdvVN0msrbVG3Mfz98vSMg08BJb7r1plPA
++					D0X1bcO+3NGwx09zHGmrZSlhyGfH+rui4nCK
++					U6PAlXNHlany8yfzp/t0IWFS/Ryl2Y6nPxiZ
++					/opY3TJKSIRoXTFgLkxNdiIpyAd8zsbuzq+o
++					hQ0/joZ8cc6Yrs5zpxksSRvdsKAlqj+BWEvC
++					8zGYKygQcv73OmOizw8SSZH1Nhs9Bdv+DNra
++					ka7jzpkOZeE0bA1Jfw== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					HpKVsDx5dLGlLQEKBKAoMrjHhmjccYQepTsK
++					CDILuW8b/Zpx5wajf95xlcutNHp/nuntr5Eq
++					U4ou8jqCmhV6qPXnMnPDoQsmEN7S/Gmwe9oh
++					X6JdmUOX1UimNalp8BycyBwbc9qhCJyadv+d
++					sKds15udRnbqBDmmPGur51k/1k3cSCMAKzqu
++					I3QytXqThwqRlWlOWb032LfnVYNEz5Abwck1
++					XeX5LVc54JBKF1R22yofR9YnDAVBHbVjYt0V
++					ZHtWBtqUTlY5W0ehffEHOBf8r+N4aCA7LfmC
++					BQj8tG0xx1zFMPxRvlQh/bC1uRtuH1lChoK1
++					/ugjjkqZdXRLE9h31g== )
++sec-02.example.sec.	300	IN IPSECKEY ( 10 0 2 .
+ 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
+ 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
+ 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
+@@ -2063,332 +3001,94 @@
+ 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
+ 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
+ 					zZP5Vd2t )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					l5GfjmKbBuz+kN5Zt6vXuI79OxxgUqd+CKMg
+-					HjuzrizNLaLgaI4zV/986SrnxiNn1Q7f6b/v
+-					IHKTfJCt0Cz7oZrz6e1feeAFeZJLDF4AWmhY
+-					nJmnAouu2bWXpRvGvEC20Jk8to3DaPKb+yvM
+-					pCXt1Pv8xZDIJEmUDx/aNpJGJNE= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					yY6veWwWxEb5X1w0LSomZjGKsGegq3jpuAvy
+-					FNl29cLzk3O6FKCEQ61vb8st4661tCuFeYkw
+-					Llx8VN34VHVHZnE8Bf3AXURjJPAw1exTWM66
+-					fd9/htwG2TcaTDp2Jb05HSkmI1fQwKsUpYwH
+-					cXDGmVe0ClD4oOJ4OsTnUMsP/DjvP+p8fb/b
+-					jFlpUxMUBzybbmSsfog1H0J63l5jL266sB+b
+-					8eCofztUfcX9omPZycT1p6qJ/ZaLYe0GnWeL
+-					JeMVHLVkP+iwIge5LcfNIZMXeeEtZ3YrnSAf
+-					WxKdWNh88OLO7vC9XTgnxDXRKyxPXSH4BwmR
+-					Rb1IsKIqtFvDli76Ug== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					yfAMmCbwB2JXh6PAjJxPIWVloV90O4VaJTiy
+-					DeVrY7QAI4iTHFFxPlPD0L//UY1Xf86X+ZT2
+-					lD3X15tlOEbyZ72OhA/+miQNd3rHxVAip37q
+-					Hrkrmi6CtDNRHbxdExjE+NUNTUZH+zn7B/Za
+-					kZP+iT/eeV9lhbaExwk6+ACCxD8w1Achdo92
+-					tLzH6cA6dVzFPKu0+IeD40gN4d8t2ghJgjJS
+-					D0g4xHhYmzwtHA6m5TJHJ2e4P4YuIgp/DCKK
+-					FARapMyEjBUQxS8q8Mn7D+ezGjnA6y07rmLx
+-					Ov2WoqgdmdI/Xbhpo/U0SrL0lghXARe6PucV
+-					cq5x9fCOuT8lSsc9Kw== )
+-			300	NSEC	sec-mixed-32.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					l0YvQfuMnpBx9CSQd50J/SFIky8BoS/Xpl9a
+-					dCV8GF79Etl6S4/fY7k2VCr2CqB0bR3+Qj02
+-					BtTJCqHMrPUjZHL4ug1AUOfPLlsWoE5k0NDm
+-					TJi6Fb8f0kPcdpLOSA8ig60b+zMVsyp2GK9i
+-					d3d/imAL1SUWNkob2B0g3CoIRM4= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					RnNJWYZ4RSDCxNkn2HgcT3/rIjaZZ/2ZkKRp
+-					6tX+ZeWxqk+sRaCvL/mgM8eFCTifi053609l
+-					c6OASaUGfcJJwF5amQoU4icYOZV7UJdnz83Y
+-					ZVEnUD0ndY2Ix++UOeRCjk2I8H5GfhkL+Kaa
+-					Acf7Eg1CXN6PthcSDb2S1ver2QlOm0yuM6A6
+-					kJ4CMMWoEtjRAigUGldTQG5Y3ZLoDjhbSQ3v
+-					T3e7nncVkLib7NdTHmkpA8uiV9WIIC7fchpA
+-					KjIkNC2OHFQaF7f1EbyzbLQ0oJuXEYwcANWX
+-					WP9b+nkXhlIXmVEtpHMtoM+L5enYwfqNs8WC
+-					NfzISWHmX+GO966T6w== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					wLPBkQlHUAzWgeLiU0w2fe4eCJBJOU32KCPN
+-					+7Dnvv6ulBgcuABIZPNg3QSB/RoMt8RqIOSF
+-					DOJ4sWB9Q632AXVLQ0zjfWRxj9oNvlFtKI02
+-					n0zK3t7azjjAYNDiB2nHwT5HPaBrOnT8Ucel
+-					whayIs6iArpERLbk3IuLgux0VRjIfiC8eYG9
+-					CyYQZL/lPtaJOe8bmXpoJTPGj/jJLFDwSIU9
+-					pID+nedbWSkS0O8fVYHLj8evvNLQqAGhXJLI
+-					UKrlGw+siO6VrNp4iFo3k84XJm0ZBDon6Nbf
+-					8q/6wN4xrJmZkRH6Ljvn4HVAamFUXvG62apQ
+-					EV3rjNRYeQNSbWa0gg== )
+-sec-30.example.sec.	300	IN IPSECKEY ( 10 3 0 some.name. )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					rAqWyT3TmNObsQxO0Q2FnG3ZlGAwYkZRCYMv
+-					EYuVBhlaaYA7ZDD4RprckK43l/MGPcJkT5h9
+-					U4vtJQXnNztWRMpH4Z8jb2LOU1tZzsBiHNjs
+-					mQcYlCGmBRXAZ5yi8DsXZTXsjo3iSKUxYNQF
+-					GoxS17+zY7P2GrGdVxDZz3K6kXw= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					AfB4UY/rL+H/dMztnW9/Ajhv7e0DTQ+f6hAk
+-					PiA0CphU2yQL1Lv6R3X4p4iKWz9CDs/sa37C
+-					QlEAoBiUGMqVpHO8vKHREcfn7v8RJCtvzhOz
+-					ZmuMiqWsCOhVkS/EJJtxIAyeYVeD2fABWwV3
+-					DfmG1sAslzN1SrGj9DY2LiZch3FbyXJRzvTt
+-					s5wO/8lnGSj4ws5DaiNMWKt5vvkZneU2otiw
+-					9EXGBJGIAyUpGblzvlsasMQ8j6ixrXiva/yX
+-					4KSUCa5fNWJfgYllNIzTaEBZkXwcdUYbWvJe
+-					bA0ZN6J8ObsnHd2hBLDV2QBl+tV63J4d4EP5
+-					tMw/XynRxYFKW1cMRg== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					tMBxGjqgyirIdIZidMt74conTmA1ZmTDZKKP
+-					9m5HxBTOG3+oMHsi4KOETVUujTlRFMQruL01
+-					Ii4enuob2MJuZQ8Uw7I0q100KaZzBzcAdSaK
+-					IIcNWGEThNw5fE9VTOMLMnVxJoJZFwlpDnZP
+-					MF26aP+apom2VLMx6t0TYpKAkKYjln+TW0Xb
+-					TaKf5lTW9CnOEVLEa9YOUojGFt5HWyz4X0cc
+-					LrjH5f1OV3H/TCIpNENr7u+iMBUqt0gfF8l/
+-					V3Xa8sm+R4YDII8Zkmj4rIbPzAKmqO5uDFMx
+-					shYjiTxued2fAw2a+4dqWMgCbOm1utqEDE2Q
+-					dp70f7dYLTy4scQy9g== )
+-			300	NSEC	sec-31.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					IM5xqIiOsST2LlMPAdvfmwhXiM4xBsVEOMnK
+-					z7W6bYj/R22EzvC1P87j1RlleeHX/rzd1jvR
+-					FaDTOWu3vbRO+Z4tfY/TGZOJaocIVqidsPsO
+-					M2yWDhRdWhhgq49D0RlfHeSQb7VCIM+Sao0R
+-					tQcOqb0HoXsCd1JXdaVmLL7MRG8= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					r+pgljSgBNKaECIwN+MfiquQ557TXPfsYxUA
+-					1efqX2cbAlYTFVZPuPsTXSb1frWtdCHzCUeh
+-					QhU0oJlDqmgT4nvPyXBnpmvgM691TnZz8Zmw
+-					qZP/kE/m4bjgs3KwKXlUsDcW7iTmI2XPfZmX
+-					f7BxuBrvV87DS2x4YbHhfshXhLiDdV5od/nC
+-					aNLHrbQlYKaV9uWMcdggcMuaGxHn6Q6VgFMX
+-					IAXhA6Bl7jnogVjtbE4rCE/E2OaPNoxJMIJ2
+-					TnNEvroZxtW8ctZURG9Q8H4riIfaqerPb6hg
+-					x9wFi/eujNlQpE/L1RF+EMmyRn38mlm4W1z0
+-					10kjKRjbQOWUphDG4Q== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					lFP+AFHKPP4KOaZXDM6yiQp/OYodqhojrTkA
+-					ZBdLSGoAZQAGMbb3uzcQUQwFuua9mBPANnsw
+-					kHYeyKa67i8CXiVfWFN1bGQ7KCxcCJrRYm5o
+-					ePKAf2zoI8aoTtnjROS6CpG6lS2XK7zuc/FB
+-					7oBiAG/QPl1gyAWwvk2kRTjxpVoDwyAQnSqe
+-					hVxQtdOt7ahOmW+xl9xUQcrLURbv0lanjjyO
+-					L0PCnr/LbWi5q7a0VO27QgvOReGJCzm8sCdb
+-					3aZOIz8c6rpahqy9WR/u3mA2WkN9OxMsrxHi
+-					oETHOaKPzg0ZojW68LAoh2YxSjWaiw6P41RQ
+-					5qL9Hh4i9iU5rUrLag== )
+-www.example.sec.	300	IN CNAME example.sec.
+-			300	RRSIG	CNAME 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					M4e9BUzl1pzv5jJ7jrIxpIgU6UhUnyFJOGs7
+-					5LNW93WKd4Edqh5eeStwAdpKzLUN7eVQaYcD
+-					+wCaQ7MfazDqC8TaVGRRVGmhmsZkBpZXgQ7I
+-					2eETGSY57rMqQqmDYs1dYHIi0AVDDA0/yhFj
+-					BlaXl0aqceouM61vU2ovtYI3EIA= )
+-			300	RRSIG	CNAME 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					cLYw1vhsQYUI6NSqvwTT8s2CV3atwm/rhekg
+-					nUc1MVFZFYGYrxgPT2KAZ0LHg9onbays2kZL
+-					wrn2X5VW94eOwhDaA4Kd2wpO0hbuKSbLWn+D
+-					HxUtAjdLDjQyXH0s1nfjYSMrjY6BeQWsOIWi
+-					2Jt6SCEEt3oZhDWmNflKk30wejR/03eRAdqn
+-					BE3X7eZPw6koEKQQV+djGv5dK5d6D9ywcAnA
+-					tdiE1cCQt1n8daOuVNB8G2ab3NrlPGQ+yzHF
+-					8rdLiNS4OCiopSrk4x5m3mQykzJcExbR3Gb9
+-					VSP5wEWkl+GP9a6eEcY6AHWb0ZAL6bnyvUFS
+-					XbIX82ewQvjLzbahbw== )
+-			300	RRSIG	CNAME 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					U84nYJ9iha0zulQtgH79h4BZy4vRQL57Y13P
+-					e+yGYb29AAwJTR3euJWwtKtWRxyXbssyGiBM
+-					KaLEEjd29VXLai2ZnWPVDJ48TWHMORj8G4uJ
+-					Li0oEZMuBBhIUgYXXEZTQ+u9hw46hiIGGzhF
+-					A3QEDOfxXPzi5gqgVtULXbTaaxRptHoSToX+
+-					6eANmce7lN5O/bjGWANG2ngf2qbhOBAjFVSW
+-					UjFQJyZOME9/VVfqoLXmlvP7sBWSwJCIdVkl
+-					CkrYUgcLYT6gF3Ym1FgHqVnYOiNHL24PeI09
+-					1kg+SOG5gU24RIBWG14zSpuztU1XCSsje/D3
+-					OW1jEQO9VvTQ79pK/w== )
+-			300	NSEC	_443._tcp.www.example.sec. CNAME RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					SFkcGKNRIqjuOPIyR7rPoEmNj/1FmJ1KISfL
+-					zFVnW4zFsGMRAimqX7H3WhVj3JRqtglEA2M8
+-					4RCU2gr2Moqk29Ef0Ab/t8lxCocR0VTtd/ui
+-					5f6ZPCoNls/cVc0F2shAFy9uACtg/vOQ0JOQ
+-					7pL3DVLCBEeFwaUwohlgMEdyg7c= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					uCFXDUkjfk1oFOep8G8zz3Gzcy9ERqRH8Y59
+-					syns+HIL3BvcTE1/Ay53hojkljKeQljnvIZQ
+-					dzluDtJEj+BlMNjWgfem08VSHQ54eaGEWZvT
+-					yFSAPp0SuXbXPeDrIxNzg0kjAKinkVv9rWef
+-					p6WEukS6exUJfWkIcFhYI8/tFT+YQUxxQE6s
+-					7xi0IPOldV2re3pJnH0xsptQlTaVZzeVgbCB
+-					j+hbATX4vv6arYcRbJf5RMmpqU6Hx439VQyg
+-					i7bxwElezV07BmHPG4D5wcKW80NYnONQRfBU
+-					xVCx4bmeE5aLnTJB4PitOVH/t+FCrCywboMC
+-					FkcNbOeM0uBvx9xePg== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					eclin/1XUGbVezE0CIM3sNn2pESSAonyfnyi
+-					EosJopPabPNoucHsW1mXa391ErLx5ua7nxL6
+-					2cLdZwxCamGiBWxj9p3ulM9tweJ+BRkEQTNu
+-					YjwkphZlCo278m2ZSbVz3wA456AUNyid6tqc
+-					jzXUG7xkKcLIqNGJGuPR3Gc+M1ouLZ/6MsNn
+-					2VnbsRJg+bqFrccd3F0TUul02td5OBI4FlMn
+-					xB77ltqZo3mkIUgwskgoTrNRb0otJoxlYGVq
+-					8V1qO0g9Gi4LCzanK+s8CYaE+ImIOV4oJz7G
+-					UXS0LAuqIEJJNRWdpeLvRMipYNLzAppAZN4j
+-					IaCXa9pE7/iStJGRjw== )
+-_8443._tcp.www.example.sec. 300	IN NSEC	example.sec. RRSIG NSEC TLSA
+-			300	RRSIG	NSEC 5 5 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					rT7/LuOh9UQtWIl1QJ5d/Qcy/YJH+kFRI2rF
+-					nEII1DR3yEuAuz/IQBwAbN/Q9RUXdt98Zza0
+-					KobvN8o3QVPUkXouJiS5D0GJbmnhU9YUvJoP
+-					gxU/ONagplm4eLB8Ehqn0U2z3sOPFuf9nrKH
+-					MnadGiVdYMSeqwM8IzWDhluk0GA= )
+-			300	RRSIG	NSEC 5 5 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					vZ9JMfyjj1tPn8z1y+87J93N5ZfJIxl2ULyl
+-					huGe3agDcbcvCoqW1G3g5j1Rpno2WYF8O40w
+-					KVySTltRQtf7EuiEVsvYw2NqgfUaYXbv+xLx
+-					wQ3XX0iqBQslY/5GmptTTqKoYyQ0ooWseN1u
+-					prLpoNucpKu0k+muBU9tRk6v0NGU/FZz4lwp
+-					ozQNVakLHeZlXQZvyZWerg63/dxhmJgaTMeX
+-					TGorae+9X8DSEvLxk/CWbEaFHWXlLyPYnat0
+-					njeN5leMB15JJfA4Hfa6IrMuRyVkO4GPL8CX
+-					DB7YcwELt3A8PCGds6FT6l2Oe8GIcdb4qRQa
+-					4aSgi6kwgAXvnHPnZA== )
+-			300	RRSIG	NSEC 8 5 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					aeVnnhP5UQu0xtDzs0uq/2kcvsAo2lXiBsqV
+-					4dAmwnsdTQFkWQxa1JyqZar6AxRpPEJOTSOB
+-					rmuOApn9YbsTbfHhG1/Seh+kKyJdoEQT/oiZ
+-					xb6x1tZPPtoyzD5cjIlEVK/mp6e+C8l5sXIi
+-					EnonJxeKmtPpC6L+V3wFpTnpNG0OQ8dmcwZF
+-					mm/8yKZoT2P3fTmwgQ7IIO3hJ2hmAJJh88aj
+-					IxORQd3UK3A1lPcXLXBFKmi2hPCWPLR2oTF5
+-					zG0sc5yGmqDtAA8Y9U5Gjfh88fbdiQu0ZGLz
+-					MtyaK9PrwLJUoY3+KX8YXQC1WrYOjmYZYgGI
+-					LEgtHHbWKUZuzdAihw== )
+-			300	TLSA	1 1 2 (
+-					92003BA34942DC74152E2F2C408D29ECA5A5
+-					20E7F2E06BB944F4DCA346BAF63C1B177615
+-					D466F6C4B71C216A50292BD58C9EBDD2F74E
+-					38FE51FFD48C43326CBC )
+-			300	RRSIG	TLSA 5 5 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					a6fW+/Hv5PA5jluWFZTSn66JYhM/cKlfWcrB
+-					ZtSqAVvqYrMxbARcqMkVkQN8W0eFiZ+6Pqpz
+-					cm2jpDLPn9MafMBsM3rc0VxhHPssxghDXAO6
+-					eYcyf6HOkw5tNimo7GNXfxsVy0W69994+m6z
+-					wWKMTm4gLS8ABjpndjxQpPDSkdM= )
+-			300	RRSIG	TLSA 5 5 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					CqUhSqFjikCArbLTOacgjB+RK9d1p20eu7ni
+-					kiQx/P0evcYvvLwePeMJZntWcaDx+slpqf1G
+-					YoCpNGfV1T61JALjrwyjz10hdEmFNQJ3H7yf
+-					Xp29pkK7AqUaDDhk9gvZ7vGyaYUOhLUcdb6O
+-					zr4ZFn/T2W1vN9Qj+KklxGTJg9jIIdxeUJOo
+-					lAx6UiKE4xDD0bS8sQqG4Ec8+P07/oKyjZR4
+-					Wemsrh0TzysiOWW8l944GX3oNQVHA0Cl1RaN
+-					HWDp/OhMY9+dsPVtP0kQ3tivyFV/ZgDJGyQi
+-					nZWgeLtDhdUo6fHDTWTgz4tOtNnhPC0GgLwB
+-					S1IOHv28cPRkn4Mc9A== )
+-			300	RRSIG	TLSA 8 5 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					OJTlC1aiTM9UwKHbSFe3q3a1oYdRRMW10lT8
+-					gD4boY8aP2dgWDtaMG3khRjSmSessmvHGw7x
+-					wUnOnk0M3sY4HnXwK3mioWRNdyPC8jYuZJJ5
+-					w9QBEDVvpXwYISm1hi+WD+Q62VeEQ+9Du0uB
+-					qKSQKiFi5FE51mYNKmnjQUkoJ25aZ8ykGjk9
+-					LStfwcxX/uE1oYpsW1eo73ry2YSxAcUQNMli
+-					3BiKHnWV9uLz7Z+YBlSkBylQposQfKCVVv9W
+-					Ipq3wyL67dGXRNJ/zdOFVT4FYX5k6Aw8QOkl
+-					QLhF1yPx+fVsuM1Ae7Cmq2Bjkr+JAVvRVSBE
+-					sxWTVdJmkaTv2lK3Jg== )
+-_443._tcp.www.example.sec. 300	IN NSEC	_8443._tcp.www.example.sec. RRSIG NSEC TLSA
+-			300	RRSIG	NSEC 5 5 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					oKnCz9oWOO9OcUxeeOOPe1pxPnLVRq8k4UKz
+-					M5utgsqU687xWJBRtzRwDz4agyT1TPtDMdvm
+-					Df2v1pXvx8GgdDYTJZmZTv3lDJ9Nbwrr80AO
+-					lGQZgajAbKrMUiwoE9kI5vkPogx/Pnh2JAgu
+-					q8hpapOMtMdKdidkshH7RlW2lDY= )
+-			300	RRSIG	NSEC 5 5 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					kNbqHCDsVwRs+7jMZ9Q5XwbeDr9xmEg5VZxU
+-					9NViIHZHqVd/JJQGCwWGkY5jcToQuLTJ06js
+-					2nBsPzzAWNDJGv3HU8Zp4ktYu9HZ0OooE4Fa
+-					zN3j1uuqqHqPQGzb8neeKzEcqbV8m3KIWtBI
+-					viSSQuoXK/c2zERyed56rGJb2J+TCKIlMa82
+-					ZLJpzVVrBFPWuKVtpG2lN6ffs5/HqE4+7JiI
+-					UmEhqukUPMeXFcYoXDFx95VyzuIUf3mvhLDN
+-					5iXsYTrbcXEN1rybnrfO6esraV983hxvx65S
+-					TuEiC+4us9O73NzQQGQVg/FnziSBIPayU5eB
+-					9Qj010JsT8TuBImc4A== )
+-			300	RRSIG	NSEC 8 5 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					sY1MZuqEvrzYlOCuw8GKrupB1W+E2djH+hYF
+-					b8NWkS4deq21EEXNF6KM66npXaALn+e6Jt5p
+-					DCTWdxmJzg1V7QXD3++zLREp5L8ICH5OUdgX
+-					Xl5YNwxWYj94UcO64oATbLdJ1Y2OM9TMDRvO
+-					pVa5OOAh58On24zJqm9BowvGGo13nJN1ibIV
+-					lCQc4VThk32kYcn3o9/urzIF02iovp+UPb9e
+-					1GYLuCiOgqYqq1te9UAHv965Dz7VKOSG3MuE
+-					Ni1lZdOQnZ5LBe2VyVCq9+oV3Zw74S1hevWk
+-					Fq8ixFLR+fc+mylEeIVbKEhpGfWvvJE93lk6
+-					Vg9n5kpwhkeM1Edbzg== )
+-			300	TLSA	0 0 1 (
+-					D2ABDE240D7CD3EE6B4B28C54DF034B97983
+-					A1D16E8A410E4561CB106618E971 )
+-			300	RRSIG	TLSA 5 5 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					Q1nMaEHS/5pGGOmds2suU9kHpm5oInEQU29Z
+-					JNZ20BWMq2hb1C7GMGJCmB/18IvnxTTCPzLV
+-					m0T+9lQo7UPdmNatQlBRFLM1YjPw5KT8CP6m
+-					4uWbSbVZWtGN+rx3gon8OFnTcgh667OBOkQg
+-					kPBd0yTQY+rTjaMfTcP9EunJm8c= )
+-			300	RRSIG	TLSA 5 5 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					d9kmVufd0Y+v0RQ2zAOffwc3kzfcHoh/ejYn
+-					NobWJB+jrGM+VyG76BiTd862+Ij67kKOVYY2
+-					w4ToTGDvRqCw4ZaGfRt6vcCnfrg9FlCOjwEZ
+-					tpJsuf3BtzQXa1bSwJwNC5UBHiGhpD7LN7W0
+-					G4YHussYcu4w2iFZTif0TvXN/gSYSDMliTHA
+-					5759FTb+MfKb84Ccp/YSKKebHataTXQAYWd4
+-					6dr3IeYfjVyqQg6VYEA2qHCIJfsRxN9gDR5K
+-					oCzN1bDfatwSO5eV1KVuRgV/adHiPApxpfpR
+-					8wPf1Z6Z3RnplVJdT/jnY3SVA/PLzsS8mfOF
+-					BF37wLnLKc+Rp9qjbA== )
+-			300	RRSIG	TLSA 8 5 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					FTCh6C5jbvXb67BRf3nJgL8iStbsNMe+It0K
+-					2v0GKePaE5gzsrJToZpzWhytVA+OpgBdWkAP
+-					IYWubejwoGXYp/EDU1FH3SAA3zV5N2W25lfn
+-					XULsEWLAr7gCpdeamG6Zg10qOVnfWYB6iSaq
+-					xisMO90+luZz61i0J0/wy6aVtraTrn7s+Kpo
+-					KHuZdV9hWZzNl+1Uuw+hEzBiWxEQK+0VAh5X
+-					3mMqD6f9LgfqaD2L9pmyZI3Un1UBFn6qbbfu
+-					zl0Ff149O/9dfRHFrmtrNJBnHindLFh1sRMZ
+-					yNXbUcoNrzwfQ/Q9Uzq/ZCGKntrWLB5mHWBx
+-					bJj+v7003y9raae4vQ== )
+-sec-22.example.sec.	300	IN IPSECKEY ( 10 2 2 2001:2010:1::22
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					KFMeLm5jSyJuu1dYPNjwtFd4Ojx8/o6Rf0BL
++					P0dRMWwSjAs7ncbP3uMOUdTEnVko6EsjWTHT
++					dakYr+D/RHiEgH7r95BidEHI5FXFD5tzCKNY
++					3Jxo1eLw/TSHF5VPMty0/Q8QgwKs3B2lGiFV
++					5EMy1Gy7sBki9ZTmkts1anW8tA8= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					rFbj5Kieh1vU2CxD/xy7bl/xOasrPpapBXsn
++					mMijzocDzvrNbxfB0+sKUxdYGgW60oE0t3ds
++					B8tud5HqfW0XuDeZ2WjpuamefUifeEpU6x8Q
++					oO3Tecgg2NDSn9A1mlBrgfWybrkLNa5jWuW2
++					wFKyzHTUOSzqnYsC9MHZz09OszWshcy8Rlds
++					hKBnMaXRUOzerwtrRZ0zWpllMfQ104F9hTmS
++					2O31UAUDzsv2TjQ5/Fj/15F1FBWGYMRjP0/W
++					wdJ7h2d+Fv3XJTzYvH3V/qx3lpEEymfXGirP
++					Jm9IZLMZiVXeqYKS0MIpbJ8SVp7lBW3rTYt5
++					aCrivAZ9Gt/oGAVGgw== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					ble1OK51ZiXuHX3RfWNBpt5RbG5yM7wWbIu5
++					yHe5oD56Fagowo+flqjQ/xQXZ/n8UG7Mbd9L
++					0jq+gg4SETDl752pw3257a+AvZYtQw+e2iyC
++					lKLQEofIMwrfJlqRXk/1HO176pqc+h7XDThQ
++					4gH/RkH5MSWubmG9z6Zli/hM8ndIxebQ7Wgf
++					3Gqe2+JVzaG1RBgrtxJ7DOmHWOI5+8WOIdTQ
++					W7XHzjYOY5fqXCSs5Qkr8v6++KKgJgy8Emsr
++					ttnKTP+yUL23M/UDMmYTM6MhetsyRF10rEUS
++					CNCOfSYXyBvEeBxUsSWV01/LRcL8XP1fBt24
++					YdfTDsfKtfUxYu04WQ== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					U9SWYQdm78OqWlARa9Js+gltOM39ndb12Fw2
++					3OpXe3J4CKXypDVcJ21pPp/u3eH+ju1BKLOE
++					53/UUUcwXFBmzpQBzfK1g2n6hF3CeHx6PX3i
++					1Lq5YPDePqBz4XHRCllgOnB4fkISle0uhRlt
++					MLALW+BAilqVs2JHsi7ooOR5RHbDEadUDJrB
++					tMaIsqRUEkAtvRRB1VDBgyTiU5k4nrXdeSNY
++					2rcXYkK7DsRh0mhBX5CYHQJyVKtqlqK7WFCF
++					SqrMsWUeQlXkLCt7rhsHbsiP9hkEhm0t+Vnf
++					LCGYQMp5N4TC/UewMq1XBmV7oj4/BdeSIz18
++					E67MiHX8skvb+NBd/Q== )
++			300	NSEC	sec-10.example.sec. IPSECKEY RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					WfrxxSuFA4fUfSkH7MPqYBLR5Gu0ciFsIaxc
++					4RvwDP9RemntRt8q8KfAxpngjd+gDpsWFNpl
++					HErdcb9Gim/x9jFyu3yb0cHu8/SAxL1HFZiZ
++					RzG9geX9gQSEgzQVdsDwMxesd4m/5uTdxnm+
++					hstyplQHPbWzS4hmw3jfBD6qTvQ= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					xtuCY84o2p7fEXud9TFbWA+idFgiKH7EfVZQ
++					JbPxgxCr6K97EcCDaVz3h6p/buhGPzOkjZIy
++					fOkwTD/DHpkcRow7ZzoYOHrFL3fPZTLAg98T
++					E+NxlQkrZQqpfIh3eLM5tuSvJq5kgG4eOc7B
++					8z0jDArk5CQ0+R+WTD2XhxdYvhBi6qy4SIzv
++					M1ja6Vel4WoEysx7nzEju+SyVG1SYgx28amR
++					Db2q+9HO8G6R2aqUmSMKef/Nn2Ci6nMWjgfb
++					zxGwdMpwNLsSD8zOqni38rUpclrKLYZ6c2Hi
++					0nED+xlwcZZ30XoWMSKlvuaBP56/s9B3LICY
++					ev8Gv7693c/7s6YEVw== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					QIW+9Mz6a3qTOQ5q1XgSK++F0BM6LExejjzN
++					AUsY1Nhdhak6fmk8eNs6OunhVP4JVnFgaREn
++					jhzjYaQduSnj7kMCcjcu+2s07FjFhO8tUxYa
++					Yk6gNFhjulbySURFna69mBAH8ZG+WZay1oUa
++					uBdcJLD57WkuYhg0jZB4W4BCHU9gjzrQyyG5
++					nu2CTz4v1efVgY1Dt8/fQHs+jMEipwiuZLdO
++					Nz6bu/orwMfcPWY1HffxB8Nc0exMuDxsdzs4
++					UiB1D/GTrUjZz0dfwtXqGv2672sDS2PC2d6w
++					Rt1QVl0W7paa57JUy8t+eGL7c8INMybCUlw6
++					FlG90wVdfSHTff+uWg== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					OtbnEwYt1s9dhM/rkAgWVl3WRPoNYUXJiRr2
++					IGkTgZK+YABHNf3XX6Y49AB/S1SxAQQEJLme
++					suFsUnxGgxbwC60sgKJP1247NRi5R3XpkY6a
++					3azOYw7qCE2joQvRmf+nEqzWwd5iRRPQixAk
++					oykADq/LLt+grsoNnNdkqybZvMLJoPY2ViIy
++					2lJ9E8ArMMfD3dPf5tUR0TTIyBzrvUIi6cx1
++					gW7gHdvC17aDNPYBMwZgG7umuv2u0CIRqvDo
++					pHdl8WJKJC8xtRCrVjptVmCPeYnx1e2rYfW8
++					z5T2AqtX3P7+RxB6+si+r4f4/L1zH7JJDp+h
++					aqh3e0PJOUmxXtoPHQ== )
++sec-21.example.sec.	300	IN IPSECKEY ( 10 2 1 2001:2010:1::21
+ 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
+ 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
+ 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
+@@ -2400,130 +3100,543 @@
+ 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
+ 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
+ 					zZP5Vd2t )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					LVpb6IWrv/fkkbRP+/U/4i3za41GlD4BKBgc
+-					U8Q272YAusl5Kq0qvRoOvjFqRwbz0BVgtdj2
+-					C+BkaKiPs75iw8+pGct96WQHHPCitNxtWod8
+-					ZtV39PgnRO2XqkeUDxXjih179ax8Po8LFMyP
+-					aqUkkXHUaOyCVA6pmukDDN0JaGo= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					4UrsGwZictKFk5BcOJTTMtg6VADhPm6v9CHl
+-					S3czYvvqFxAmV38go7uWorWhgQJhAYSF1p08
+-					Rc2M21ou5JQK2M1ifJU7CoT3iyMicRyYgMJl
+-					qpa2O4s8wjf4Ikp5n3E7ir34F7uOkLHGDj6P
+-					Ll04UNf+5sZnMTqXErJPkxFDG6OBeR8PWQvF
+-					DXlbeqlPRL2P1+AmA++tr912JZPTNTsykWtv
+-					7pcsv++MB6MZ0c1bMzqza7HAh9zXiKFyS0tL
+-					FpWIUN88zdau7QimsIDXSr5rYJ2qRS2UP/JJ
+-					RHdCGsjNPkw/wEhGTnvkh7XW5c7c+pG3pt5E
+-					ytiqkkeoM7XLUCSj/w== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					qXvlXC9E4JCVNKb40BfrvSW1DYkb5MaqQ6o7
+-					ds41koCGdmRSPsFp9W3Ut8/mOGZDLQvU+0sM
+-					mRGDuz5CJBHFCUuIy0RqrTcd1Hvb27aptkhr
+-					0t40iaRQr3nTZpYFwV+3dp47ux4qhbIg0s09
+-					8GB0VZSfmdqvdy4Y5d5p/QzSka/F7it05nWJ
+-					IewpgrKf3aa3O0srNwwVUi2ZXzPelibx1J6r
+-					o73nxNmNYp8uWkY2tXTvYAfbqvq0+rdUv8H/
+-					LxNzKDElvOcat4mX7Wp+Uftp7jgizblFtqHg
+-					cASPgfKyNZYGPx5pjVPKbffz8o8XtXZHbtOf
+-					3rftFlPcw8fnCSMCLw== )
+-			300	NSEC	sec-30.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					IevfxPqRcQEP4aKs8xesSnChDAE/33+a7v9x
+-					Uh7eb5CzHJ1PGqwcjDAeJyO6Y2dU5BzwAXv8
+-					gNm9MsxRYz2PQxy1rmqYB0aBt+vWHbRUpksP
+-					FWOHeDN7KNpszF3r9DO4d593gbckjfC4a9t6
+-					wpkvsxy8bv654YWQAlzSe4X1UN8= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					FDC0BlhPEF+0WO1Ft3C+cnUSn0Hl5P7Uc+Ar
+-					ukmVZgYVY9ChaujthxcFwwJ+fuNIfk6fuu2L
+-					Lr0ya+iuuOpUrMxF/xWxSnMNTOhrysjA6DrQ
+-					svSGZGHJPfRcTR1hPZQBiz6wl3oxwwUE9uTR
+-					O1J7IDHsL2sZ10jGVIj9YPFhPtcAFUHGMEIt
+-					qeauxyZYOP/IZ0AxpXClQ5+zYepHnbcigebE
+-					cn3FDSgxDDYHJDz3C9ebuXYzmO4+X6s3wmbQ
+-					JDgSFSz2hHdYTv/vPkIkBYBJ4fOMSV+LgltC
+-					LnyE9u7m4pR8Q+kijkOD8LU2Bh9++SR4uC2+
+-					Et80y6CO/wAbDGJR6Q== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					S1mlTix9jV3mDmRk795AWNBC+ylzCsWXkArn
+-					CK6wW7xXdi6vtSnvvhXzov+zVHZNAMwwBkhJ
+-					8YLHZcjANtrYHxgre59bAYahwpTUR8lqjJYA
+-					RnKvVjGcGZFZPV8CUcY42A4iGCgvl1UiO7Z8
+-					m9VzxPJ7LjaLBLhYzdXBqC+SFSyjpz4fAJDf
+-					J7juj1rPhb5OnH4Ca2nEWlwQGn7enesNWkU1
+-					Yd8QslOMrvbfzmlzB6JKrDecO1aMz+soYbmr
+-					TeW7A0VxVvFNdudFtU0fjRgM7lf+IbGEPf5z
+-					oQT8kYhBG60XHITDaEcqTQFVN2wPayYUcPji
+-					JoTeGda5m0g35bZPjw== )
+-sec-00.example.sec.	300	IN IPSECKEY ( 10 0 0 . )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					enZEx05BNsmnCvan+Bhirxn9/GJel5bTDM42
+-					eQV7dH0VV11kD/QM3JdhpCmJASFOo1P7puXN
+-					WWvRkCnSyokSMwDkOiBBHqzA+XBVKCZMoLNV
+-					M9M5OJbXCaOByzHPlJEfEOisNsXHNqgFJzXb
+-					8NuNuTLUOHd+z7vAt2/y2rsvmCk= )
+-			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					Q/uFwU74dwroyXluozzM/VZfPm5YIslvHYJ6
+-					IPoVOVWkaM8hiYHlN+IxZMuaCtRK9SWyHGZ6
+-					++/hqeBW6KezUcpBeOpE49tqNS1lFa2TQCIN
+-					o602Z+Uq1ZaNsxNRzCen8nh6aPk+Ma3VMQeZ
+-					pjifEf3LKrPNOqcocr+vBrb/yTP4Ns9aMywK
+-					Whj18XkkUvZ3Qwc5dmkY24Tr//YlOKieyqNv
+-					k2k1HtU7i1igtIa8/EZ1LSID3P1l6MhnSoAc
+-					vHmqcEo50kZiHPEBRuP9vMxeLo03C5ogetcA
+-					4qSlUsz3PyDKSNXLTn5Oy6WzdnrlZsaQZml5
+-					tqE5oOqMAn14NWkZYA== )
+-			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					sWztwS0jdkc+wToR+bYvyH46tiotZ3W/YdsD
+-					b30HDNZovIjbKXNLofxglzpvg6EeRnuZi4qD
+-					xlC38uoE7Poud7N4l0d7hQbQkz5gdSbHlcII
+-					1TmOAmNNyYiE/7kQHYyfpHPPC48p90bSjPOJ
+-					S9bHdKKW925Vp3RN3MfI4dhNNH+o4xqPIiLY
+-					ZB8jwUHh7zbs0EgWbFiBCtiPsaAq01pAwWp7
+-					RCKfJ9w8wE6dq505icDTLhBrWf15QYPNDgXC
+-					zjLn9pmT+YGWhs6hgPiW5/y28nbiwID2771P
+-					qXy56JjbqSgGBsgHTxE7iBnXr1nyOFrOEyUH
+-					V+YrBe5waLIpgn3MxQ== )
+-			300	NSEC	sec-01.example.sec. IPSECKEY RRSIG NSEC
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 516 example.sec.
+-					L/At1YRILr1Obw284RFZlWU5m1MCYtjJNg/B
+-					XUOlcATRaiCPCA4ugZSJz5EWO3j0VFcgMIHN
+-					ynyXm9Ng3SoSO67r5KI/DrjhqdXQDWZ5JNBM
+-					VrJixQpE3Q6pV3CXvHd9e5z5WZnwB1Ns4p1e
+-					S1K/FdSp8uLotwOpedUPS8TEb5o= )
+-			300	RRSIG	NSEC 5 3 300 20141212121212 (
+-					20121010101010 44427 example.sec.
+-					zkP9awQpTKHAzBEAY61Lvbhnn2gEtk4EPYkm
+-					4qxVfs9Hcf12X6qRtyK2j1Hb/WuynyhLaZ9O
+-					71Zp6isKaG7+gTBGSz1RF+oEcRJRl6r3iRPz
+-					0xzL90PcGtREtbUUz/N9BXDbYT2/w3kB89up
+-					KewS0/Eb8zV/63YcJqRdurzk4FgJdo5kUb+I
+-					Rs4XdZMHMIF5UEvNuKocsevLn1ldP1hpN3a9
+-					SFhUL7nsA2XdKRcEPA63MUS6VYYv8OWCKPds
+-					z1c+/wvBHksDiGe2+0peC2f7rS6XMoULl1hL
+-					czlYssdSkiQveN/K4pQQmUssBhtldKIRq/63
+-					adQouGFFSMuEdPL9yg== )
+-			300	RRSIG	NSEC 8 3 300 20141212121212 (
+-					20121010101010 48381 example.sec.
+-					Lt4gdhFZgltCfgukt7w00G/Cg//MJBLSAKSd
+-					gxtXMP20hvZ4QvSCQ9KSGwLq5ntnRMzQFYSv
+-					Ew28bIl7SGW4fAPALl9WrXMyQ+WG4Bja6E7U
+-					99iYx39j8ZqmTZO/Z2OsH6xM5TPJFO0x/uRY
+-					QEBeLl7mFVljPh1wA5NmMw9fRJxSsR27t0ne
+-					oelM7uZGYPFaPYis1fWLeH+xheLOXeV5QvHr
+-					MZ8H6xsrSXFhdr09q9+SRuWIFI7LG8DLeiAV
+-					UaeiJwd5HTbFOEL/x3KcMH5dUISseyYZmr4+
+-					RdE8KbTgv/c0xG97k3q5bne9tiBnaYsI+0Z8
+-					hBy+OVaiQ83HIRpMZA== )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					goJhatdkze7WqFGplnO28uBT9AHjrsrK54Sb
++					I13110ffVWk/6DaQhNX3GanFXDcbhi1m0N7B
++					MbYFIWZX7y3u24Wyuvak180hUqUdcyuA3G+Q
++					SP9WALt1+7aghjPLWhJ9/igHxC785Cq/Tgf5
++					+KVMN1RT4pi5l/uZQ5jcKdw6J2o= )
++			300	RRSIG	IPSECKEY 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					rXrTeN01xY+uebYRE/bhpy2GThFjdfePR+ll
++					vLe9PzN9GauBsaHCIMl3rr+c4pB0FwVtrGzD
++					DGodUkbqikHmkzw6gAhx9nAcEGl7jCJpP3Zy
++					eirRuNTb4HPsXNSniwXSXryMXeBnHanpERsl
++					4n3bfwvOQlytAqC+X1L0HfvGkSi7DMRGBKK0
++					yZCHuI11dZehOEVUoBGlWV1o/sBr6YwwLhIG
++					ImwHzEzunvRRC7e9SiY41nIpm3zGwnbsVVj8
++					kDGQq9YxOgR5ymFbLhCYAOcM7jSBBQRm4Pcv
++					WKMijHXzFO2e0fXf1nOsJH5VnQEQTxBWiyRc
++					D0SCwpkMKHNIK/D3cA== )
++			300	RRSIG	IPSECKEY 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					T6OZoyEvW0es+JEYsHoM45PIUYcjZjhS8jwy
++					mCDfL04m7fmyjzfUvK8hR2VVxT+2QR6jg1vp
++					DnPFUpVrr0jJnuicU2lCdptTSb2/7jQzlpYa
++					M5b1aaqmlGxCKnSfjWfdeaW4PC/+Oj4yBdPF
++					DXdKHWgFxWPDOuVIkVtKuD2MgG7G/PVOPYw6
++					S2qMn6BSesM1UM274wiAWC4+n86aY3rkH3Ly
++					fgwMP4q6DktOhygDOK082NANVkoGztcVNaH0
++					pqL/5UoUtgN/4wndeLh8Lb2LrRz818+uZuad
++					hSyJKB4pN+u1fs/Z1BQfaw5til/PAVh49KNr
++					IWL3nkNOlCb1pXPuQw== )
++			300	RRSIG	IPSECKEY 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					v1TyfkvJIwEJ76lle7anDNWl1V/l8m0oHlut
++					eihGwNdar6EGmH1uyxNDH9RhGvgUVx29to3p
++					+lWtg1VwYzxXqj+e9TnWOlCfV2MRD856UQ6T
++					htHk16GVJvzfAwx9rX6KMu2lvCxigz+xePwY
++					XJALDOlddHif2fk0CgAlOyH2QSc0K7A99rTr
++					sDaOLYk6qetqRDwe+7XiscNePIc2YFqbbkq5
++					Isl9qUTYZD8Rli8JiJGIP3Iotywqo21lVTv5
++					niIgLU955vWfO7QAYbSMubXpyJtTT/wpPXL6
++					0mjuoJmeKOrTXei+k96gnj0akD6FrRfkzzQr
++					bADlicW9RVcCNxvOPw== )
++			300	NSEC	sec-22.example.sec. IPSECKEY RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					OHE2OH6FGv4SzBbJAWGFfmrtxr/0BhA2xU+s
++					aYg5idShv1LYS+YL/1VRXgNneOsSgF2iDZpM
++					RAp7liIaKN5ZCZHY09chlwjWFvGUDVqT5J3y
++					GJ7oolFFw8xB4raX2H6nGuwkq4PTEZcl5OoC
++					42wat+/Dq8kbSEFtL9Bd3ztcGAk= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					C9oAxEQWQLV1BtoUxvPo/ofqPiFVSKObG7Qu
++					7Dtb/WgmnkhYztsQtXQYw0a9VJ8/VuDKxvW1
++					Bky41/VgioLz1iQk2/+4aMeyVBpfLVp/+Iz4
++					lAldSRUkBQt41XGkWLG3a4msXfGxc0wlOhPe
++					fd5RV/R36T7tXCFWKw9C+b63we3G73gCJytj
++					ZWLD2wVP1f7oaWPJWatLiWsfomqnmp5DDUu6
++					7f8qJ5sNgdRoXIKWXbXX2SBaY8Xm9ot/Nyfb
++					0jXZGMHhw3rl2LQz3rvR5IGCYTtTWF7yyOQ0
++					2cyyPkp2/qZNrQF8Cdq5ymSvntSwC5yMx9DC
++					g5jBBZRK5RlrcNnCjA== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					INMHa0l28dAXSr/0Dk4cKSBWQY8ONmDFWbn0
++					VyoXVPXCrjFtAPu4C1bBdmhgx9poKz4DRN2j
++					WQLepltrq+6+rf+lIEMXj3NkLaoSRv3VTEwT
++					hAKnLv4erWvGAvcWdkzE6FNNOT0T73nwS6Aa
++					o1M5mdg2DRwqx6Nmvz9heBIbgso4ULzi/KIW
++					lI6RjZcIIlQPrYBWBtxB2mQ1PYJMjJGMo99f
++					sq7+LHezKyF0BRktYN0zEUKeV4AYwQmP1o35
++					o3jDlUlCdusrelEXPykBfNGgtFTTlTo9d+hW
++					OGWVsQhJzYAU+Hm+VslAP5eF7LhYCX56ddJO
++					b3/tyfGjTTyZ1Kaztw== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					ZgP1+3VHbAc4NsPSQqS3Sl81SF5AKHFq0A71
++					0gH/OoNCNvHQHbtmFH922IQsEPJNQA8cXPx7
++					yFNfE2zgG00v2/Ua91Qj8WxJgfXePtJhZ8Lg
++					d4bHaGW+tbx7qM53CWrd9vtg9reWVb5/4Xqc
++					+iUbWHN8zEOIbVeSyOK0Z/94Q683urO23C3E
++					vj5coGlSHsFu5NyAl/B02mNZusHJ1UZ59sGj
++					71nJgRw9Vg75QGDr8XTP/AINRNYq7pvlWdrb
++					pHAEDKVkP7ZwNFzbf75VVY1UAV/sk2Za2sTB
++					qyMBMRzi/svqhnSqYVfN20Glkv+Snq6YZuTT
++					Z21Nnpdk58SsOxxFJw== )
++_8443._tcp.www.example.sec. 300	IN NSEC	example.sec. RRSIG NSEC TLSA
++			300	RRSIG	NSEC 5 5 300 (
++					20181212121212 20161010101010 516 example.sec.
++					bB/mN5odg2j9RXrzTyFdm/IIVLNT2JkHsyUQ
++					gziMnpv3vt5TZryVrkEmInIs/PegcSZFbD+A
++					Q3m4ww0Yoz7f7a6rkqFbm6iUs/khaISrLF2X
++					YwPqlPq2MOCfp2P6LaEgoIvmz8QWLmSk4clv
++					/NbCjL/NgBJqe8RPC7zRymwa9IE= )
++			300	RRSIG	NSEC 5 5 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					d84Fcjnygh05Ll4LdYC14XYZFiXbaZlLEAOg
++					SbwGq+kAGohtW2MfKYSMHOt6ynPLNasaAKTN
++					c3XCL1MuozEIQ9I/+2RyelxYSSMIA7XSHjPS
++					vw9tQr4JHX8xZDoUCzZRht1VBYnPRadiZx0M
++					/Dv+iaDM68bEggsu1PhBDvksx+86Uz6Kbk9C
++					fB5GReS7qpS2jHXgS4xksK3UhUp4zUIql3Xp
++					E1uf5NF231sw3HXIEIBox1BAZyUBj7ShaNOu
++					MQg3eg6moAteUxAjubApS3P4UyHaXISOHnzY
++					fVNEUzpP7ym549S79BG22vhlF6/rxfdFS8hp
++					+ijBTtHpoKUmy9IYIQ== )
++			300	RRSIG	NSEC 8 5 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					mn64tEag097G73PBv6nLmaxqjTmSxYUcK7im
++					niJsDArHlxg7xyP4Bi2jQ7KN644aDc5Ck4PW
++					SvmnuVNfISX7HIOmxT/oc6gHRmfJ15CiBx3y
++					xTLmfrfv5nAk9fLErkEdX1+ET39/7hgu5sC9
++					qOkVvIDBqF0PuuYcF/lXz95gWjhaQ8PSG7WJ
++					24PejLukdvCaEp7XuQLiJguoUfIkxDdYPnnI
++					AlNuKyiONntzJuPI96zvQSYQJig69pbHr9k6
++					7BkuCSbfimYP1g5bveGngxZ+tUQpx1UaHfEV
++					YPH4ve2JQhhRT/4awhD9VoPdMAp+abdDRqRK
++					v85EmPPcLz+6NnlqHg== )
++			300	RRSIG	NSEC 10 5 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					nY6RmMUxCpkOsHMerlf+btKjBbSYCwsfNW9c
++					7v8zh95f5iFGf1XTRF9TqAugQg7sCAuAPg/t
++					GfMWw8jFAIZnx/SbRxC80EXDs1wcrfWwk8gF
++					HgWq4d7g3p94pTDhAtIovHeIdZBDMb2f2k2a
++					/3Rbrll8RV/QlOBsXlO+lE+T/RNzO6C/Xl0a
++					wwfALpJPHRpDHwK3+0SRVf6Tlg7oAUHWAhsJ
++					+XNrixGalx+DCeB6k6KHvw46hAX1j9EzwM8f
++					8pAYaJfhsfLAvg2qQPN/14SKx0npeRLvq9t2
++					RS13BTNWUrHoUJ0FID5JaVIwFS+TLFX5XcaM
++					u1dhgLgOQPN7ZAbLsA== )
++			300	TLSA	1 1 2 (
++					92003BA34942DC74152E2F2C408D29ECA5A5
++					20E7F2E06BB944F4DCA346BAF63C1B177615
++					D466F6C4B71C216A50292BD58C9EBDD2F74E
++					38FE51FFD48C43326CBC )
++			300	RRSIG	TLSA 5 5 300 (
++					20181212121212 20161010101010 516 example.sec.
++					TS+4QDNXNzLiEd59Gu0osqODeilrR0ewk+4K
++					J76FS/MWdTby5FRuZoO7dlWknyGcJF8mwsKV
++					PLR/N6PCmlLmPhOeN+LNxkYCH8xMWNckHIwM
++					5rY0Y9zWy1n2oG9c4iObczcA7skeoV7xv4if
++					W71kBgDKeLURupwuXFJs0JEGOkw= )
++			300	RRSIG	TLSA 5 5 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					CBo+fTtF1ypKVYQKHBlv+Z5lSvpFKkGHdP5G
++					cjTWyIZKiWANKJWGK8VhEzvDuOTd3oTPK5L7
++					OABpgyTlypwrTfzMxtz+0sb3dGKAdGAvFWiF
++					20KSv5iYcYo8tABNvxcJQUVe2iEoQaNtKZAm
++					Nw6e9Mvzgj6DjhhrpbAOIOQbq8geKfM9mYTQ
++					dCwDiFdK0PKNHeQquJwbTLofDn2ah7AbOX+9
++					+9OSiORH0drMMbiAvOx1JSRQGgCXYYEXMg1n
++					S3EycAH7uyWyauVNBblPnSAA5wQ6SAzRcpKH
++					C3iYXb70P+1Qwy1AEB3aDdyLKBbi2g4j9bFq
++					pK/pHwt4kVatWUfvZg== )
++			300	RRSIG	TLSA 8 5 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					aEqQxblSO8hE1p5DhgwIcuy3Rmm+yzxwGnUf
++					QQx0RBEzWiIYUoR7BY8hT4q+MRMCjtHkAr7Z
++					g+Yswjgx2/jaPxgxmKSsmQN9ADamEmuIIIFc
++					42THiAzdwKdd3MTHDQJ9PrBkjIYike3Nc+xC
++					jVxnYH0Hk0MlzfDi9pYn035EXINF3Nda2BfS
++					7c6xLV/SJpaIPE00p9EIKIdYtNYpczzoImVM
++					YbmIi6B0xoBhfScMi9q3Tarcwrb9B2KIP60K
++					9n8yVRBVwu6mSsoWw/mGpwiZtwoFZt8tmX0O
++					5V/sQMkhvP9wWPxGI+NWYeO8Yt+DE3VFnPZM
++					qmO6t8FbVma6nFgp7w== )
++			300	RRSIG	TLSA 10 5 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					HpGtSiqI9HWZZPFPkNCgjxteGZ4p+XrL+9Q1
++					PZBi9BX4GjSNhQ8kXDzNBjhc9OCMfePxXf9g
++					VukFekCU7n+HSdDVEFnGizSYBmyG0KSktRg4
++					jG+BrKxmKLLqLN7VpnADQnbzjcRvFILsTrsE
++					422K2cNlAidZrKiEydOauaoV8Y5XrtHOhckj
++					7BdpJBTcJhG97AxKm+tRXVAuhwHIvpXf277V
++					t32b/stuRVaY1mixrDhsyTdqOUui5SA6uxHN
++					kMWVjx3QSeFpn7BSSQ1/UBjP3CglE0U2dKwI
++					eCTZpjpS11dkiR/7Hp2juu3FYamF/Yj4nciX
++					/DxrYrURdHXUkyYYcQ== )
++www.example.sec.	300	IN CNAME example.sec.
++			300	RRSIG	CNAME 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					FZ0ONSWPkz+5Aomi5/TA+T1eVEgF/0UJCraG
++					ZgVCjxw3jO/v3w1ByrR9BpoXPIwf5CA2TkJk
++					gtGvphzFRrYNF3MEhgOdTRbiLfqpcC1L0pDE
++					6IAvRU1rSoXZRo3W2Uzmr6I+KGm55Un8pF5X
++					v1uFVPw7ziaeHnYAZ0b3TXSRX0s= )
++			300	RRSIG	CNAME 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					DNnNbCbJQz/+9ExNHu+M6nnVmytMbLLgHlXM
++					w5UjfIbG3EijYDWenUo4ai7K23l3HHCJRZbz
++					jJITPJZdNUVvN3+bB+RSGeoFwCPCfHkkb/yy
++					VeXJIQslaSmcBIpwrnlIu4mztwrSzce7WI6c
++					iKL+K51a8KaqzQX0H9PaEtw7z8KUhSNhO2lV
++					kbiva/NwDlfsWULjo+r2izTXmMgKU4cgdeG3
++					8RqmpeMSRLP6H/P9B38pfBpvnrBbEpYiK4BV
++					5GlLdiETYtQWV3iHsLizYCNCkYhs4b55UNWI
++					02eVy2jpmeYnNVBx00wqiHBjHy5gkTAn2vNc
++					LPagUqrpq9PI1xiY5w== )
++			300	RRSIG	CNAME 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					BbLte7BZWvbNdj+tYuA4kk+u72ckzBxnBcM/
++					owhFOtB7IZWKd/696MOq2w0MuD2OSqSm7mq3
++					A3Wnm/3RN0+OQImy464IpKSmXwfHHI7ruxFD
++					jX79azCcpY6p/BaIzdusSPtIzN/gjpxJnZU2
++					jTjL2Xx2V3RWoUw+nO3CNJSeH8ltND8hJX8N
++					V+cH1Mu7eRC3oO5cLZeRuS4QILAVFGgf8ZF+
++					kWkruQzwc4e4eosgNFOg5WC4VXnPfW3cqWk0
++					sZTs+q2P21YC9cSBTOIgIxCoczMVQW7GhPLQ
++					8LIea0faxJ6VjB0qHcaKyd+xpR5Jhe8cRLUS
++					+40ORu5rOyJMa6386g== )
++			300	RRSIG	CNAME 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					HoXdx2zby92ALr23GyTVvTZ2sdaJJQH5TeZd
++					ubz1toQEESDns+8WvS8gkaOWhPaLKLmKIq5E
++					fdWaacrscexINxk6NlMjNRBiu5dkAuVfYA9a
++					xOWo/344pACrqKIoboHt2spQvTdIKAmhFuLY
++					JWV9x3uzXon69k6jcedC+rLumGfJGgodkRim
++					mxn/LNU1NHdaCoD2Bo7q0nGbJwDIq+Re0WFp
++					bMLSYJqFHKyYJVhQhhVPHmYtMAgvCFBwulgj
++					lHU7uUl/+yltjxgkoKnXFS+Bfhe/G84rXBRw
++					UX9AzTSnt1tCo4ItiSSja/kHjkcGlJJ3Vs4S
++					h8KDXRRj/FVau4flxw== )
++			300	NSEC	_443._tcp.www.example.sec. CNAME RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					oaIvvXFtkyugmxcLgpeo7tNMhTidHaI61vHy
++					qHCZdzZ6L+7vp5sNbZPQevTbAPXhOSPkr5wZ
++					LcoWtRMZtS9NpFvRJkMiV6aJL/rc/o0hQGBh
++					TkCnpViK3vPsXiH8kvJSvtQy28hDHoW1nS+V
++					BjciCsfcXBFqBuJdbz+msoY+B2E= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					iQtijIDg9MYpZaQdctLPcAdUfUHYgS8v9y4M
++					GlpPwfSg/lyns4vY9HF9jhHO/yhVYriiPAX0
++					INxdKq0D/9te1BgNOKeWRVkV5hJtj282fAfW
++					7z8P48eTvOZi4vWPrhYU/UzcEw4qKS15Nep0
++					U++yhyagqPdV0g8GS6q5hobOvZ+lSNkCL/2l
++					GcAWLq9QDK/urxNdpYQx2PB85SmAjGaD6tMD
++					NjToXfttE9MiUUjAscziJ5lcww0WObBDl+6u
++					mEp/F00wchU7mIbbipzpkURSSL0wxQzhgJ49
++					30aM3Nlw/P2ItyCL6FbcYiEVhJpQB3jCnjKu
++					JptAgu3NkCpLdVJnjQ== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					yJ07XSzPqaco0u/ZfUeYRuVKSrG/nuTxpP2e
++					4gR2eIE8IXcVOp8J9XACvJ85dnqabRkKDea3
++					04ZA083dXvhn7JRtOnPbG/4TyTsmahl13/fd
++					4WL+s+nTMBqqk084BuTClr/spKCgLzRF358X
++					SaQZHtUD+6e8SbOKwDOhUPWp4jn4b7tirgkP
++					ZJ72Y3k1OwMV8JL3eLwhRbGH5iNDZMDfs4gD
++					mLGPSQLaleN/Qekcqzo7Hh1wNBfh3eyTy65I
++					1WhhHCe/L29cqAWAhw+3Fz/zqwyTSepjkwcQ
++					v2G0jvEJEEYA1bRDqQmKMN586ZbHRVgL2/Mx
++					GSqdZCWmG3xoxn+Tuw== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					rnsv561ekllNQ3HeYnHvQPFzZBnMEpKt2Maa
++					2lumqNgrYINBhsAWRjCY+O2PQK0PDf+7r61i
++					ijKRb8bJDfvjy9G3YZyo3A6ybQ0tq7iLfDfL
++					H0zLoWyD220CXI5foZDQJJccJrcroFU8t/jN
++					9oBFAN8xd1mPC7Otd6nEd70fyqH5AM16eih3
++					K6+EeaB4GKK37kHf8VABMddaDoU9WbwVdrr5
++					r8NBB78c4jXF3SdyfOqjWhv/Z5ONiuSZQpCa
++					G3w0y1S987knZpghphycTvQtc0cekgvdxR5B
++					88vBuEoItgAS7uKWJ6bvHxXic7M4N1XzG07D
++					mBIdn4oHHDmqJV37rQ== )
++lets.introduce.some.empty.terminals.example.sec. 300 IN	CNAME example.sec.
++			300	RRSIG	CNAME 5 7 300 (
++					20181212121212 20161010101010 516 example.sec.
++					i96ICBMEwhjWsLMqRNNygtCZwba1Gn/r7wrR
++					ZvMrYzr/HPWRMQwon7/RbEU4kXuQSMpbU+6v
++					vhcm9QN2K0k/lq67efN1JXNGo6P+L8AsY830
++					0FwqiW4q/ufnyexoQ1i9cJe3pZ4QO56f9Umq
++					Qg+m6JBgVHKn6TCVIp6rVJ16y4E= )
++			300	RRSIG	CNAME 5 7 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					PNhMqeo4gJ1emZy/sNwdkJezO3dORiEvPWC3
++					EhfIzK1ZagVYQAlo7yfAJ56/Qhsq8+VEcJp8
++					2tt8J20waiDTbES/FY92Y0i+kSLM11fnZZ9a
++					plG54D4gQnrv1J0BOjMXnYW573kw88aAciaa
++					/XX5mP7JtHdItcTiK3hozmq9cTTsfisChitW
++					S+CqJfiWTRaL0vLDhbfAK/lu5zaCFsTRHXtI
++					3oQdWjxJANE24OjG83JWWWHc2HBfBdMH0+d9
++					6kRbUSAoFXxK4uLZDgsXOvDspRhMhZJsq2+z
++					OB3QPZ6g/n6tbFtMx759a4ZZlR7+k9hleHd7
++					oo377OcIV1iIerIWpg== )
++			300	RRSIG	CNAME 8 7 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					EKWV63NnX9sGZGXPdahDUsw4jcrLDWXJDMiN
++					3D+UTOH3nUPgm2mA7MbGGXPa5emnpaEnJN8Y
++					NFXTKU+SENXN/fYol03Pm1PKRGbmdbpY8Obi
++					KrYIHEazypviyTSPmmZjcHd8NOxcX0pDdybC
++					2mrK3v6K0lOinIeOO/fdHc7/IkS6FmU78/r8
++					49l9+0oI6yenzOYVz9qHGWUGP040eR8h25uo
++					tSNxqvoiNmfz/9hsWKLuwaW0v8mNzeuK4o8J
++					5wkbjc1hemSLUm05ryA75hx5/U+Jt09lLvxP
++					BhwU7iH+WPTCRO/cxavp/k/H2V9vQynPB9kd
++					Pt/VwXnM/hbJlbjqZQ== )
++			300	RRSIG	CNAME 10 7 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					HZBPL0Wqk8WCcTBsMLdefVVsS2aywUC9wgwE
++					SlDx2kP3+Kuw8udz+s5cPRRj74kiKwholxHK
++					68/qH3Z+yiLKHXOrlK9gbDROr/w8hyRqgylT
++					QPvVoPtvffRms/kYck9t1ZtgYpYsUF/VToYX
++					pY/WvLyb7HH2xDeaiOW0XMQzMgaLdCOFXz6h
++					rvRbrWG+8LTvPO483RkzkYjgWVbcjaviMm2M
++					Livb6R6hDcDdUAhq7wyHJOmIOmsoho0prbGO
++					o2uMVHhvQSELDSFkweP1iu4C7h57ZYQv+bFZ
++					ZYBgh45wWPj0DazDhqit7X1sgu2qHMPBlhjs
++					LWpRTSFkPO6T/GXoMg== )
++			300	NSEC	www.example.sec. CNAME RRSIG NSEC
++			300	RRSIG	NSEC 5 7 300 (
++					20181212121212 20161010101010 516 example.sec.
++					ByFYkS41yP8gBlLSknKz3pLdIhYnzXFWsI4u
++					Y+U12xBy9+l6MCWwgj/RcSGIB5+1FKFeQ/SX
++					KfXDK7Bnr+DxK7ymPCmNzZBJLdJm8bCLA/S3
++					YpM9ABg80VbcYW9s5vqXyst8Uf8fvMtal7Zb
++					a6Z5Q+cC9WQO7wrYtWnSS0WRUok= )
++			300	RRSIG	NSEC 5 7 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					kJGdpompkai/KaP9fpyplXN0vqsBqsqig57j
++					fkqKIWhERB2EABBrZF9nAPtdV7axwJEJrViI
++					iLcHU7lN1YQRO4eYUcxAbcLjXFbr9L75MjpL
++					POnvcmaB8eG/aW0H6mjvecacU+DN+ykb5Ef2
++					C5I64PFluL3iXVN6o1xonKpXIdmnj38HMkG2
++					zFwlQnhRAfFKlih0hBCL8dtzr8OaHHq20aH/
++					pOm29fuOyLWUliBTZkyg/q43WMKKbiyLVVNL
++					PXNsicKTYXrQ05oH/EjDkNUtElc+OqJcsRQm
++					FnQgF60rzOfleNBaLDnZTNO5zMJQ2uwVuD2Z
++					II8k8l68zj4p7n6zKQ== )
++			300	RRSIG	NSEC 8 7 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					fblA2SxSL+ZL2oVqUTlbKt4DVZwEbFbxS9U0
++					s/5QvVmiROWviIRZ7hPXqOTh6uRJYiii+4zz
++					mMBhjFuw1EJovHMabEvYRdYqBhihR8KhRK36
++					TYi+tP2r6ByP+O6rBJB2BehyYXqKsFceQpv3
++					LJY7pxBI2RWDsRQdPSU1WDmYVjBX0YoES8IS
++					y4l6Lr0Jdlzk1whzgballdu+ZMlq97g+JvsO
++					arWq7DQBtcgiWs4S7f3fO3PNzE1ltKgsvc2f
++					mtaCD+g+MpjaDLSRXdxmNw0B3MgYQm3Xj1YB
++					gL8SYkzvuj4jK9F35AhvLNGeY0h1UyuQIEKP
++					RmsDN/xIo1C/NY2Xvg== )
++			300	RRSIG	NSEC 10 7 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					c+G1yL4nXJyEfrwW6wewKSi4RzH8PR/LbiXz
++					Xdw3l4s4f8bJI7F5SJ/mdAl8qEoQY23euq/u
++					8lXTok65b70T/n1y1wSj7WBvhEFOLAlh8RcC
++					kEQ0GHP/qjTM7MPJsDjPjFRXHDwp/2xJcWpE
++					T970VWXOKd6S01/BQj06yk056L3GvRW9hswE
++					Oi31T0VLYFcBZacfX12lxRhxwrKRaRAMLuu3
++					uyZOf9FK3xO6Rit+5HOFRX3YDgI4+RKL9Fjv
++					+wC/cXGL8nYzUXG4TmtT5kwsheXd5KzphGkW
++					Knl5KyFJ5tCegS01dx1Qiqox4ujHin5kS8K3
++					bkgejnhECTn7dZMmPg== )
++ghost.example.sec.	300	IN NS	ns1.example.sec.
++			300	IN NS	ns2.example.sec.
++			300	DS	50458 12 3 (
++					2E40B2A6CCD2760EC70AF69D1C144064C893
++					1E53A6B3EEE78BDB9E0BAFBB9C02 )
++			300	RRSIG	DS 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					iclGupmUkGsPDWdWkuEDKTkYMqD6kCvpAyqS
++					fZBuDZD4vrpOciINX+iSWzVO4iFNUhzjZRW9
++					cEbwhA3JDJXcXjDOFQheVWU+2l2+wgsI4LvF
++					ebykSWuJ/bcXZP17uaulK/XUyXZf08iFOBNQ
++					6MOQK7LtilTg4x7hD5KHsepvm0M= )
++			300	RRSIG	DS 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					yC8hYQPjoYu1NY0MSWVvsF+ME/+9Qk+CwUkC
++					JbdrnGR/BCQn9c+vOjJyVp8JVFqvTR+/MYrF
++					l/8qNUwPf8ZjWie2MEBb03pTtscY2dZxM4N5
++					gzWJNeD0BLv9k+z5gIZGchC6P9E0gGiRdGFS
++					L2IayJ6kPl0UQz98VaJH+hdtgH8Lw+K5EATH
++					9ZIccq6Ea+VOK+51GB4ttvQuIBKqfh4y2nox
++					dJdHZH9iGnXoB8BeQoZsh4xMUdpNMjL+JHRc
++					ZCDazd8EeiDz7x1opJG9LHT4IZ41O7UL3vOP
++					vejFmXoLbQ8s/d+wOhpJbTTEqmaFm3hAJi5I
++					dfru4JX94JRntdguaw== )
++			300	RRSIG	DS 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					ch+jJnF6K4wSqfo0Rg8kNedNkumPgNL96ULu
++					nqN7R6JA4aZx7wLxFejYWN6ss6aHPFyDMEkT
++					U8TheY6pBpzD88P7iFhPSjIDI+odzAqsUJGk
++					CabrMijcDyX6ednOu3JnFUvLr3SS7s2Qvylb
++					rGVaDLrQDdLJ6oZLMVpGvIIkVFQ5+IP4dhmj
++					Jb9NvhkEomLQVlWynHVvYCjrR8naPmptKVok
++					Lymc6BNeYqNJLS7huwcKWrl1B4rJTQL5BeP7
++					mRwWxJJoZf4XL7nqO1xiJ5onVTYjunseCBiQ
++					jPmjCV/8c7/arUYrvL8yaFwi6UaRZ5V2MkuV
++					qfJhlSQv8Q8CpBUIKw== )
++			300	RRSIG	DS 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					RfhRZ5IfOTfltrfRj5WG9YZA9V+nbcUdYRLy
++					Kx+fVPXLQde5rWlATNS8bdxh17H2aWAfbG/q
++					sF+AePm7aSCXSVHRCCgDe5STbsZCumZPU341
++					0DEx5LEP03YGGMXxu47OjDwFeXmBNY68R1pJ
++					XZqvTBgcofLFW5lIuzgHOvqAfcfoYfdVMZXN
++					5bHGbPOYTxRLzOozvHs+CPrxVAgfkAbisPxh
++					9kKT+Y7gzPFEeHv0gn45eyNZYEz0/3u4mL7K
++					dHN7HWzo40SOjwwfjMaqnBlaFWZr13GWinpQ
++					tWqhp4cGIQGyhOexh+nw7oZH1fvpEAuMM/Iv
++					1EwmI62OiEuAey+onQ== )
++			300	NSEC	jumphost.example.sec. NS DS RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					B387vqwneeYj2vq2NgMyz7RqY+osCm1GRn9R
++					dg6ucSC+2siErQ5CHZVw6huRCE3GJrIZeHsB
++					fehIs0i4Fn3zCHJbn41nbsvCv9lnWvb+x0Zt
++					RdgcOCaXsZwufczgTCvuzBWv1ujZCoJj4AJm
++					FFETfNSVwNFoXbr2rljhomm90Hk= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					keFijgNnTGMdfPcoBgTfpklCGxi8kIPvi6z3
++					NrLEP5QKq5EXUzN//M+1NlzaczzIHBjPLRcK
++					vdhMnwU6jwhE9U+/209IolARCahz5C2S7CUc
++					Uv8nugElFvQkHfZN4zOnMWiTJ/l4MFs9lxt6
++					JCBeNOVt1hoETDKgiphHH1lC1sXCcFaeA4su
++					JCcHy89n1cuR+iirm6yWuclAIvjYsxyJRJTQ
++					CHDvsKDSt1qlaslstw0jrI3guqxmiUKol7PD
++					7+L9MV+VnNwsR6aHu3DuLWRXaMizg+6lTtp4
++					ahg4LrhywC41KRCDczMK1ON2emH8uTsJIIc7
++					ONkHvohOex/H3C1D8A== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					p3djDh0TA5LBwzPvtBmJZsjlAs6DPdlmBTk5
++					ighk6mxU8WuocwwkqbHS686mdrIlaUEMo/oO
++					RIO4WC+P9jWrkDAFzpYpjqw+zlF/YooKhP3K
++					qXDUxXHcrPdV1UtEv6iz1ps/1YEbTVwACPZt
++					Htpzemt+/C2/ZlFr+fuvJqvTkSjA1EuQufX5
++					Rjp+gG9iUh3Vw33PutCYaLvSN4ksAWcGb7qv
++					9P9xExBSLGPvtDtCOK9Wheu2whVigh0s+m9s
++					nbDxbUmbK3AuhnETES+tT+JdnI5fz6UzTik7
++					e/qHQ4hL2ntopbjdUuxk9K8umzTzSWhf6l17
++					CfOBN4w9blpdg+7gtA== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					nFdtbKA6VF4Ong9P6CNqLy7KXtfPkJqlaVHK
++					3ANEcVkKqbcYl6oBJY442RHqHpxUdtn8dvKg
++					xnwePylEozcaY/GI0Oy3bDIcWjFnlIzW04XW
++					NuellO0OC9vQ+o3AX0wgNZ3lboKNkHHEUTdF
++					KOD3gX4z0r1A/D9Lh50e1sVgCGwQj7Bp/Nhb
++					8m4OU3Kc5UrBOhlS7oC1QWvL2r5HjEcXVCK+
++					7HSPSwM3h88f3DHvN2BpPZJpuro6ZRRitenM
++					GG9gZwAt5UxiTFFG4DnriPIxhn2SbqRF0vNJ
++					kwoejT4rTX+/M1Ht4u4e4p3ad/7Vx6rEvlEJ
++					bvU12qtqXIFOQdAtRw== )
++sha384.example.sec.	300	IN NS	ns1.example.sec.
++			300	IN NS	ns2.example.sec.
++			3600	DS	10771 14 4 (
++					72D7B62976CE06438E9C0BF319013CF801F0
++					9ECC84B8D7E9495F27E305C6A9B0563A9B5F
++					4D288405C3008A946DF983D6 )
++			3600	RRSIG	DS 5 3 3600 (
++					20181212121212 20161010101010 516 example.sec.
++					pA1orlZuEjb+1rxkN7qvO6gFFg3ebxgM4CqM
++					TxFhijcBNbdtQ9jR0zOgNgIpb5UsFe0kj//b
++					+VSKaLT+OtS1bwf5cHvRcgIXGpsTRaGOSEle
++					bbaw1Wk9h6oALjbZ9vaoYGFas8NeIddklabr
++					GAcPeJuWdUTlZOPftHhvcKip29s= )
++			3600	RRSIG	DS 5 3 3600 (
++					20181212121212 20161010101010 44427 example.sec.
++					AxvWrRmB91L3EBQaq3IMiAwS1SxB30bbgM+3
++					xFL1mb0zNUSwV96VlpHGgw5TX3oEXFl3eUp5
++					KYrxzzkxjZEPwNABysgzaju3ovCJ+w4d5mU6
++					S0x8mf8HZUOZB0OXqYAeC6Z3B7/cmCfrOCIG
++					6i3eKZ2vbBJBhGVUDAeEcHblIgeoutbKTHTW
++					YM5+zCSHA2FcIBYxyp+aPQiLBnZrKsOAL3bS
++					hcMiOug8tyBL+qGALIA5BUEViwIYWmDGwRAE
++					SNmsxFTKFNzov9inzZk7THF1iJfCIFBNSoyg
++					Wd0V1DDm3IwH2XWeQfGcQjIMpkvvENHeYcXX
++					6WeSgcFwCmLysuARAg== )
++			3600	RRSIG	DS 8 3 3600 (
++					20181212121212 20161010101010 48381 example.sec.
++					KDoVg8SMwz86zyQLZY2KzLkFLWPJvni/2BAt
++					jTRpL93pDxHoOl8jLs8eI8zjmkoNbquKlpNe
++					+QHFcspLkLUoiNO/PiJej84Ou2H4rykXUOcM
++					qzk6B7Svy4Iv4eSi6hUUzcWAy3L6jm+fM/Hq
++					k5SCBMH+mQ4BYmmY0VnRbOefj1kd89S1foSl
++					NYH+2U9RRmSf0D4eqIO11aq3RUVcQYFMIlWK
++					r+BjsRcRn1MQhrAKWG/WMkEDWibIYGjMp/Ub
++					dMRCGA5hIzVrBqy22756enNdRsoYmmiidpTW
++					yRCk8APk3cPbR6lPtHdpsjS23lV5fzcsUdXB
++					rwGeYyOe0MNusvJPuw== )
++			3600	RRSIG	DS 10 3 3600 (
++					20181212121212 20161010101010 1862 example.sec.
++					Jgc6PlkpSUz1I2Fj0GRFW3VH19gl7upEMQf8
++					32hoT0X770oyo6NbvmovwMiBibUQAVRkR4vY
++					R7WlTcCTBn+WS/nueu9/Rdu5BFAT2P5uyDCp
++					OxPS8aFk3PPYvIJs6T/Q+xkM5lgN7qweljwY
++					EBRPgOznpUypN1PIMj1k76lLFhDqgjAoTpVd
++					whnE3mo9sEQRnZtHkGY+5ZcVEjrJzp37/Iie
++					0UfoRYTUxtK/Odm7Nks9HmNWo8VxASizLafY
++					I1ij2YTLjJiEj6a4V5gd89C+gq9y/dfhats4
++					/IjF5ImtFpBUGAvQ90+DKCGba1dqKo7+Ub60
++					8bCo75+TZJYiMWzjkw== )
++			300	NSEC	lets.introduce.some.empty.terminals.example.sec. NS DS RRSIG NSEC
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 516 example.sec.
++					qtp/vJ/rxl11yZtvFB1AeRt98JPoEiB7iUo8
++					//o1B4DNTdRjUQoUlWXo6qCppHiT6X+X0jBn
++					QF2SQpvUBuvOu3ycWy3v0nBgVp5ZwdTYb2f9
++					hko4c/sxmcFlRTQ6pWEfiCoSUxsuWWucWtiQ
++					THEZbUy9AInu/nRAfqC/Nke7/eE= )
++			300	RRSIG	NSEC 5 3 300 (
++					20181212121212 20161010101010 44427 example.sec.
++					afbTauPUX2myihkQu0XMw4bUPe67MGI60HGA
++					ulUmQMgAJTUMdvzsQTj5u+ywfSzJKK2xz+Rn
++					euiGXw16/O/BbEoNC3O2rsyzRa1d+x467U1r
++					X4SZx5QhbRSi7BwmRiaUFJH8e5ZQTwMMws7u
++					fWx5mGFCDTAp+G+lrnDnGB/QD84AS5UqYLi2
++					Se+ZQyWH69chcTQEFEyqFXtf90T6sGXiKBG1
++					908uOXbc7bDP6kSSIfbFUebsgut2tOTI3h8r
++					YkDwCwgDfqSSkc3bqRHqEqiEtuucdBcdtZ4G
++					V3bo6rVNGGz4b7Ltrij/lsyergKSLxmn6RGw
++					wDKSoxIN6OBjj1ThhA== )
++			300	RRSIG	NSEC 8 3 300 (
++					20181212121212 20161010101010 48381 example.sec.
++					pam09BNhE3P0spzFLYYr2Cm1vHZ5DXtVQ1cH
++					fdc09RER//D9pzZjkJFZN1XArmUyyaL2epps
++					Zi0mIhroiP+98JdhyjLthpgvyl/3pa8ARVjr
++					/R08qknRfjkyjUBh2/kopZXZ+hEtnuv78dKa
++					49lbViT6jbL0giz/uaCdFZo4w8sCCb+FBKW8
++					tlDlKTciKiZlmScNDeFNZxk0C07OwJ3zRwkU
++					F87MgvZ9inslXV4qbbKL92VmF9lK485XLxx1
++					LlDTCvDRkWf8m9f4uRI3DHk7cVjJRhu9P9HR
++					Sihc3gdVqZIt276vlN0DtVnfFLt97s7QNkHa
++					srPp3F/Q+3pysTfL2Q== )
++			300	RRSIG	NSEC 10 3 300 (
++					20181212121212 20161010101010 1862 example.sec.
++					GtKFam1EVbVXETNxw36NHJLG4czkGlqHbSMz
++					6/sGtV1XblNJVFMUXTy5WW31QX5rsYpXHIWZ
++					XcTsBLAZqLjhxjYKjnXXGgkOQe/ci7EsNG78
++					pDO8fDb5CqORIEhcocsoCWXOkHCmopQyXlIv
++					4Hk/3SwKxMhJXt0Ox3DFhuduaPT/NHXTUD+u
++					vxXpZuc6YrxrpDA28slByf5lAJrpgq6s2Q7E
++					kPcDOAsXmGDmRQvVR1xn0XN+5Pheysxr/zIQ
++					9XtN/YUrLn7loSmjS9+3oiDIi1Y6eHnCvQJP
++					o0pkkTNnEsmUSfVaXdXXkZ47dwuUIw93V/mD
++					nxxGe2Hc9+F8fRtsaQ== )
+diff -Naur validns-0.8/t/zones/galaxyplus.org validns/t/zones/galaxyplus.org
+--- validns-0.8/t/zones/galaxyplus.org	2011-05-16 15:42:03.000000000 -0400
++++ validns/t/zones/galaxyplus.org	2020-10-05 16:59:29.360681415 -0400
+@@ -18,4 +18,5 @@
+ cvs     A 194.28.255.11
+ v6		AAAA 2001:2010:1::feef
+ text	TXT	"text1" "Another text" "One more"
++bigtext	TXT	"1" "2" "3" "4" "5" "6" "7" "8" "9" "10" "11" "12" "13" "14" "15" "16" "17" "18" "19" "20" "21" "22" "what is the meaning of this"
+ *.meow	CNAME www
+diff -Naur validns-0.8/t/zones/manyerrors.zone validns/t/zones/manyerrors.zone
+--- validns-0.8/t/zones/manyerrors.zone	2012-08-13 05:37:10.000000000 -0400
++++ validns/t/zones/manyerrors.zone	2020-10-05 16:59:29.360681415 -0400
+@@ -112,6 +112,17 @@
+       0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
+             7983a1d16e8a410e4561cb106618e9aa )
+ 
++; policy  bad domain name for SMIMEA
++smimea IN SMIMEA (
++      0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
++            7983a1d16e8a410e4561cb106618e9aa )
++93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.www IN SMIMEA (
++      0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
++            7983a1d16e8a410e4561cb106618e9aa )
++c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._xmimecert.www IN SMIMEA (
++      0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
++            7983a1d16e8a410e4561cb106618e9aa )
++
+ outside.org. A 194.28.255.11
+ long.outside.org. A 194.28.255.11
+ outsidegalaxyplus.org. A 194.28.255.11
+@@ -156,6 +167,37 @@
+ x.y.z.zzzz5 A 5.6.7.8 ; DNAME must not have any children (but z.zzzz5.galaxyplus.org exists) - yuck
+ zzzz6 DNAME x.y.dk.  ; fine, no induced error
+ 
++@ CAA          ; CAA flag expected
++  CAA 0        ; CAA tag expected
++  CAA 45       ; CAA unrecognized flags value
++  CAA 0 meow   ; CAA unrecognized tag name
++  CAA 0 x-y    ; CAA tag is not valid
++  CAA 0 auth   ; CAA reserved tag name
++  CAA 0 path   ; CAA reserved tag name
++  CAA 0 policy ; CAA reserved tag name
++  CAA 0 issue  ; CAA missing tag value
++  CAA 0 issue ";"   ; fine
++  CAA 0 issue ";" blah  ; garbage after valid CAA
++; commented out things are not validated but probably should be
++;  CAA 0 issue "hello/world" ; CAA invalid issue domain
++  CAA 0 issue "example.net" ; fine
++  CAA 0 issue "example.net ;" ; fine
++;  CAA 0 issue "example.net ; sometag" ; CAA missing issue parameter value
++;  CAA 0 issue "example.net ; =sometag" ; CAA missing issue parameter tag
++;  CAA 0 issue "example.net ; sometag=somevalue othertag=othervalue" ; fine
++  CAA 0 issuewild ";"   ; fine
++;  CAA 0 issuewild "hello/world" ; CAA invalid issuewild domain
++  CAA 0 issuewild "example.net" ; fine
++  CAA 0 issuewild "example.net ;" ; fine
++;  CAA 0 issuewild "example.net ; sometag" ; CAA missing issuewild parameter value
++;  CAA 0 issuewild "example.net ; =sometag" ; CAA missing issuewild parameter tag
++  CAA 0 issuewild "example.net ; sometag=somevalue othertag=othervalue" ; fine
++;  CAA 0 iodef "hello-world"    ; CAA iodef value not a URL
++;  CAA 0 iodef "hello:world"    ; CAA iodef value unrecognized URL
++  CAA 0 iodef "mailto:tobez@tobez.org"    ; fine
++  CAA 0 iodef "http://example.net"    ; fine
++  CAA 128 iodef "https://example.net" ; fine
++
+ @       SOA ns1.catpipe.net. hostmaster.catpipe.net. ( ; skipped again
+             2011011400  ; Serial
+             1H  ; Refresh
+diff -Naur validns-0.8/textparse.c validns/textparse.c
+--- validns-0.8/textparse.c	2014-02-11 15:44:53.000000000 -0500
++++ validns/textparse.c	2020-10-05 16:59:29.360681415 -0400
+@@ -26,975 +26,1060 @@
+ 
+ int empty_line_or_comment(char *s)
+ {
+-	while (isspace(*s)) s++;
+-	if (!*s) return 1;
+-	if (*s == ';')	return 1;
+-	return 0;
++    while (isspace(*s)) s++;
++    if (!*s) return 1;
++    if (*s == ';')  return 1;
++    return 0;
+ }
+ 
+ char *skip_white_space(char *s)
+ {
+-	while (isspace(*s)) s++;
+-	if (*s == ';') {
+-		while (*s) s++;
+-	}
+-	if (*s == 0) {
+-		if (file_info->paren_mode) {
+-			if (fgets(file_info->buf, 2048, file_info->file)) {
+-				file_info->line++;
+-				return skip_white_space(file_info->buf);
+-			} else {
+-				return bitch("unexpected end of file");
+-			}
+-		}
+-	}
+-	if (*s == '(') {
+-		if (file_info->paren_mode) {
+-			return bitch("unexpected opening parenthesis");
+-		} else {
+-			file_info->paren_mode = 1;
+-			s++;
+-			return skip_white_space(s);
+-		}
+-	}
+-	if (*s == ')') {
+-		if (file_info->paren_mode) {
+-			file_info->paren_mode = 0;
+-			s++;
+-			return skip_white_space(s);
+-		} else {
+-			return bitch("unexpected closing parenthesis");
+-		}
+-	}
+-	return s;
++    while (isspace(*s)) s++;
++    if (*s == ';') {
++        while (*s) s++;
++    }
++    if (*s == 0) {
++        if (file_info->paren_mode) {
++            if (read_zone_line()) {
++                return skip_white_space(file_info->buf);
++            } else {
++                return bitch("unexpected end of file");
++            }
++        }
++    }
++    if (*s == '(') {
++        if (file_info->paren_mode) {
++            return bitch("unexpected opening parenthesis");
++        } else {
++            file_info->paren_mode = 1;
++            s++;
++            return skip_white_space(s);
++        }
++    }
++    if (*s == ')') {
++        if (file_info->paren_mode) {
++            file_info->paren_mode = 0;
++            s++;
++            return skip_white_space(s);
++        } else {
++            return bitch("unexpected closing parenthesis");
++        }
++    }
++    return s;
+ }
+ 
+ static char *extract_name_slow(char **input, char *what, int options)
+ {
+-	char buf[1024];
+-	char *t = buf;
+-	char *s = *input;
+-	int d, l, ol;
+-
+-	while (1) {
+-		if (isalnum(*s) || *s == '_' || *s == '.' || *s == '-' || *s == '/') {
+-			if (t-buf >= 1022)
+-				return bitch("name too long");
+-			*t++ = *s++;
+-		} else if (*s == '\\') {
+-			s++;
+-			if (isdigit(*s)) {
+-				d = *s - '0';
+-				s++;
+-				if (!isdigit(*s))
+-					return bitch("bad escape sequence");
+-				d = d*10 + *s - '0';
+-				s++;
+-				if (!isdigit(*s))
+-					return bitch("bad escape sequence");
+-				d = d*10 + *s - '0';
+-				s++;
+-				if (d > 255)
+-					return bitch("bad escape sequence");
+-				if (d == '.')
+-					return bitch("a dot within a label is not currently supported");
+-				*((unsigned char *)t) = (unsigned char)d;
+-				if (t-buf >= 1022)
+-					return bitch("name too long");
+-				t++;
+-			} else if (*s == '.') {
+-				return bitch("a dot within a label is not currently supported");
+-			} else if (*s) {
+-				if (t-buf >= 1022)
+-					return bitch("name too long");
+-				*t++ = *s++;
+-			} else {
+-				return bitch("backslash in the end of the line not parsable");
+-			}
+-		} else {
+-			break;
+-		}
+-	}
+-	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-		return bitch("%s is not valid", what);
+-	}
+-	*t = '\0';
+-
+-	l = strlen(buf);
+-	if (!l)
+-		return bitch("%s should not be empty", what);
+-
+-	if (buf[l-1] != '.') {
+-		if (!G.opt.current_origin) {
+-			return bitch("do not know origin to determine %s", what);
+-		}
+-		ol = strlen(G.opt.current_origin);
+-		if (G.opt.current_origin[0] == '.') {
+-			if (l + ol >= 1023)
+-				return bitch("name too long");
+-			strcat(buf, G.opt.current_origin);
+-		} else {
+-			if (l + ol >= 1022)
+-				return bitch("name too long");
+-			strcat(buf, ".");
+-			strcat(buf, G.opt.current_origin);
+-		}
+-	}
+-
+-	t = strchr(buf, '*');
+-	if (t && (t != buf || t[1] != '.'))
+-		return bitch("%s: bad wildcard", what);
+-	if (buf[0] == '.' && buf[1] != '\0')
+-		return bitch("%s: name cannot start with a dot", what);
+-	if (strstr(buf, ".."))
+-		return bitch("%s: empty label in a name", what);
+-
+-	*input = skip_white_space(s);
+-	if (!*input)
+-		return NULL;  /* bitching's done elsewhere */
+-	if (!(options & KEEP_CAPITALIZATION)) {
+-		t = buf;
+-		while (*t) {
+-			*t = tolower(*t);
+-			t++;
+-		}
+-	}
++    char buf[1024];
++    char *t = buf;
++    char *s = *input;
++    int d, l, ol;
++
++    while (1) {
++        if (isalnum(*s) || *s == '_' || *s == '.' || *s == '-' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$')) {
++            if (t-buf >= 1022)
++                return bitch("name too long");
++            *t++ = *s++;
++        } else if (*s == '\\') {
++            s++;
++            if (isdigit(*s)) {
++                d = *s - '0';
++                s++;
++                if (!isdigit(*s))
++                    return bitch("bad escape sequence");
++                d = d*10 + *s - '0';
++                s++;
++                if (!isdigit(*s))
++                    return bitch("bad escape sequence");
++                d = d*10 + *s - '0';
++                s++;
++                if (d > 255)
++                    return bitch("bad escape sequence");
++                if (d == '.')
++                    return bitch("a dot within a label is not currently supported");
++                *((unsigned char *)t) = (unsigned char)d;
++                if (t-buf >= 1022)
++                    return bitch("name too long");
++                t++;
++            } else if (*s == '.') {
++                return bitch("a dot within a label is not currently supported");
++            } else if (*s) {
++                if (t-buf >= 1022)
++                    return bitch("name too long");
++                *t++ = *s++;
++            } else {
++                return bitch("backslash in the end of the line not parsable");
++            }
++        } else {
++            break;
++        }
++    }
++    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++        return bitch("%s is not valid", what);
++    }
++    *t = '\0';
++
++    l = strlen(buf);
++    if (!l)
++        return bitch("%s should not be empty", what);
++
++    if (buf[l-1] != '.') {
++        if (!file_info->current_origin) {
++            return bitch("do not know origin to determine %s", what);
++        }
++        ol = strlen(file_info->current_origin);
++        if (file_info->current_origin[0] == '.') {
++            if (l + ol >= 1023)
++                return bitch("name too long");
++            strcat(buf, file_info->current_origin);
++        } else {
++            if (l + ol >= 1022)
++                return bitch("name too long");
++            strcat(buf, ".");
++            strcat(buf, file_info->current_origin);
++        }
++    }
++
++    t = strchr(buf, '*');
++    if (t && (t != buf || t[1] != '.'))
++        return bitch("%s: bad wildcard", what);
++    if (buf[0] == '.' && buf[1] != '\0')
++        return bitch("%s: name cannot start with a dot", what);
++    if (strstr(buf, ".."))
++        return bitch("%s: empty label in a name", what);
++
++    *input = skip_white_space(s);
++    if (!*input)
++        return NULL;  /* bitching's done elsewhere */
++    if (!(options & KEEP_CAPITALIZATION)) {
++        t = buf;
++        while (*t) {
++            *t = tolower(*t);
++            t++;
++        }
++    }
+ 
+-	t = quickstrdup(buf);
+-	return t;
++    t = quickstrdup(buf);
++    return t;
+ }
+ 
+ char *extract_name(char **input, char *what, int options)
+ {
+-	char *s = *input;
+-	char *r = NULL;
+-	char *end = NULL;
+-	char c;
+-	int wildcard = 0;
+-
+-	if (*s == '@') {
+-		s++;
+-		if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-			return bitch("literal @ in %s is not all by itself", what);
+-		}
+-		if (!G.opt.current_origin) {
+-			return bitch("do not know origin to expand @ in %s", what);
+-		}
+-		r = quickstrdup(G.opt.current_origin);
+-	} else {
+-		if (!(isalnum(*s) || *s == '_' || *s == '.' || *s == '/')) {
+-			if (*s == '*') {
+-				wildcard = 1;
+-			} else {
+-				if (*s == '\\')
+-					return extract_name_slow(input, what, options);
+-				return bitch("%s expected", what);
+-			}
+-		}
+-		s++;
+-		while (isalnum(*s) || *s == '.' || *s == '-' || *s == '_' || *s == '/')
+-			s++;
+-		if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-			if (*s == '\\')
+-				return extract_name_slow(input, what, options);
+-			return bitch("%s is not valid", what);
+-		}
+-		if (!*s)	end = s;
+-		c = *s;
+-		*s = '\0';
+-		if (*(s-1) == '.') {
+-			r = quickstrdup(*input);
+-		} else {
+-			if (!G.opt.current_origin) {
+-				return bitch("do not know origin to determine %s", what);
+-			}
+-			r = getmem(strlen(*input) + 1 + strlen(G.opt.current_origin) + 1);
+-			if (G.opt.current_origin[0] == '.') {
+-				strcpy(mystpcpy(r, *input), G.opt.current_origin);
+-			} else {
+-				strcpy(mystpcpy(mystpcpy(r, *input), "."), G.opt.current_origin);
+-			}
+-		}
+-		*s = c;
+-	}
+-	if (end) {
+-		*input = end;
+-	} else {
+-		*input = skip_white_space(s);
+-		if (!*input)
+-			return NULL;  /* bitching's done elsewhere */
+-	}
+-	if (!(options & KEEP_CAPITALIZATION)) {
+-		s = r;
+-		while (*s) {
+-			*s = tolower(*s);
+-			s++;
+-		}
+-	}
+-	if (wildcard && r[1] != '.') {
+-		return bitch("%s: bad wildcard", what);
+-	} else if (r[0] == '.' && r[1] != '\0') {
+-		return bitch("%s: name cannot start with a dot", what);
+-	}
+-	return r;
++    char *s = *input;
++    char *r = NULL;
++    char *end = NULL;
++    char c;
++    int wildcard = 0;
++
++    if (*s == '@') {
++        s++;
++        if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++            return bitch("literal @ in %s is not all by itself", what);
++        }
++        if (!file_info->current_origin) {
++            return bitch("do not know origin to expand @ in %s", what);
++        }
++        r = quickstrdup(file_info->current_origin);
++    } else {
++        if (!(isalnum(*s) || *s == '_' || *s == '.' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$'))) {
++            if (*s == '*') {
++                wildcard = 1;
++            } else {
++                if (*s == '\\')
++                    return extract_name_slow(input, what, options);
++                return bitch("%s expected", what);
++            }
++        }
++        s++;
++        while (isalnum(*s) || *s == '.' || *s == '-' || *s == '_' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$'))
++            s++;
++        if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++            if (*s == '\\')
++                return extract_name_slow(input, what, options);
++            return bitch("%s is not valid", what);
++        }
++        if (!*s)    end = s;
++        c = *s;
++        *s = '\0';
++        if (*(s-1) == '.') {
++            r = quickstrdup(*input);
++        } else {
++            if (!file_info->current_origin) {
++                return bitch("do not know origin to determine %s", what);
++            }
++            r = getmem(strlen(*input) + 1 + strlen(file_info->current_origin) + 1);
++            if (file_info->current_origin[0] == '.') {
++                strcpy(mystpcpy(r, *input), file_info->current_origin);
++            } else {
++                strcpy(mystpcpy(mystpcpy(r, *input), "."), file_info->current_origin);
++            }
++        }
++        *s = c;
++    }
++    if (end) {
++        *input = end;
++    } else {
++        *input = skip_white_space(s);
++        if (!*input)
++            return NULL;  /* bitching's done elsewhere */
++    }
++    if (!(options & KEEP_CAPITALIZATION)) {
++        s = r;
++        while (*s) {
++            *s = tolower(*s);
++            s++;
++        }
++    }
++    if (wildcard && r[1] != '.') {
++        return bitch("%s: bad wildcard", what);
++    } else if (r[0] == '.' && r[1] != '\0') {
++        return bitch("%s: name cannot start with a dot", what);
++    }
++    return r;
+ }
+ 
+ char *extract_label(char **input, char *what, void *is_temporary)
+ {
+-	char *s = *input;
+-	char *r = NULL;
+-	char *end = NULL;
+-
+-	if (!isalpha(*s)) {
+-		return bitch("%s expected", what);
+-	}
+-	s++;
+-	while (isalnum(*s))
+-		s++;
+-	if (*s && !isspace(*s)) {
+-		return bitch("%s is not valid", what);
+-	}
+-	if (!*s)	end = s;
+-	*s++ = '\0';
+-	if (is_temporary) {
+-		r = quickstrdup_temp(*input);
+-	} else {
+-		r = quickstrdup(*input);
+-	}
+-
+-	if (end) {
+-		*input = end;
+-	} else {
+-		*input = skip_white_space(s);
+-		if (!*input)
+-			return NULL;  /* bitching's done elsewhere */
+-	}
+-	s = r;
+-	while (*s) {
+-		*s = tolower(*s);
+-		s++;
+-	}
+-	return r;
+-}
+-
+-long long extract_integer(char **input, char *what)
+-{
+-	char *s = *input;
+-	long long r = -1;
+-	char *end = NULL;
+-	char c;
+-
+-	if (!isdigit(*s)) {
+-		bitch("%s expected", what);
+-		return -1;
+-	}
+-	s++;
+-	while (isdigit(*s))
+-		s++;
+-	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-		bitch("%s is not valid", what);
+-		return -1;
+-	}
+-	if (!*s)	end = s;
+-	c = *s;
+-	*s = '\0';
+-	r = strtoll(*input, NULL, 10);
+-	*s = c;
+-
+-	if (end) {
+-		*input = end;
+-	} else {
+-		*input = skip_white_space(s);
+-		if (!*input)
+-			return -1;  /* bitching's done elsewhere */
+-	}
+-	return r;
++    char *s = *input;
++    char *r = NULL;
++    char *end = NULL;
++
++    if (!isalpha(*s)) {
++        return bitch("%s expected", what);
++    }
++    s++;
++    while (isalnum(*s))
++        s++;
++    if (*s && !isspace(*s)) {
++        return bitch("%s is not valid", what);
++    }
++    if (!*s)    end = s;
++    *s++ = '\0';
++    if (is_temporary) {
++        r = quickstrdup_temp(*input);
++    } else {
++        r = quickstrdup(*input);
++    }
++
++    if (end) {
++        *input = end;
++    } else {
++        *input = skip_white_space(s);
++        if (!*input)
++            return NULL;  /* bitching's done elsewhere */
++    }
++    s = r;
++    while (*s) {
++        *s = tolower(*s);
++        s++;
++    }
++    return r;
++}
++
++long long extract_integer(char **input, char *what, const char *extra_delimiters)
++{
++    char *s = *input;
++    long long r = -1;
++    char *end = NULL;
++    char c;
++
++    if (!isdigit(*s)) {
++        bitch("%s expected", what);
++        return -1;
++    }
++    s++;
++    while (isdigit(*s))
++        s++;
++    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++        if (!extra_delimiters || strchr(extra_delimiters, *s) == NULL) {
++            bitch("%s is not valid", what);
++            return -1;
++        }
++    }
++    if (!*s)    end = s;
++    c = *s;
++    *s = '\0';
++    r = strtoll(*input, NULL, 10);
++    *s = c;
++
++    if (end) {
++        *input = end;
++    } else {
++        *input = skip_white_space(s);
++        if (!*input)
++            return -1;  /* bitching's done elsewhere */
++    }
++    return r;
+ }
+ 
+ int extract_double(char **input, char *what, double *val, int skip_m)
+ {
+-	char *s = *input;
+-	char *end = NULL;
+-	char *stop;
+-	char c;
+-	int saw_m = 0;
+-
+-	while (isdigit(*s) || *s == '+' || *s == '-' || *s == '.')
+-		s++;
+-	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-		if (skip_m && (*s == 'm' || *s == 'M')) {
+-			saw_m = 1;
+-		} else {
+-			bitch("%s is not valid", what);
+-			return -1;
+-		}
+-	}
+-	if (!*s)	end = s;
+-	c = *s;
+-	*s = '\0';
+-	*val = strtod(*input, &stop);
+-	if (*stop != '\0') {
+-		*s = c;
+-		bitch("%s is not valid", what);
+-		return -1;
+-	}
+-	*s = c;
+-
+-	if (saw_m) {
+-		s++;
+-		if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-			bitch("%s is not valid", what);
+-			return -1;
+-		}
+-	}
+-
+-	if (end) {
+-		*input = end;
+-	} else {
+-		*input = skip_white_space(s);
+-		if (!*input)
+-			return -1;  /* bitching's done elsewhere */
+-	}
+-	return 1;
++    char *s = *input;
++    char *end = NULL;
++    char *stop;
++    char c;
++    int saw_m = 0;
++
++    while (isdigit(*s) || *s == '+' || *s == '-' || *s == '.')
++        s++;
++    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++        if (skip_m && (*s == 'm' || *s == 'M')) {
++            saw_m = 1;
++        } else {
++            bitch("%s is not valid", what);
++            return -1;
++        }
++    }
++    if (!*s)    end = s;
++    c = *s;
++    *s = '\0';
++    *val = strtod(*input, &stop);
++    if (*stop != '\0') {
++        *s = c;
++        bitch("%s is not valid", what);
++        return -1;
++    }
++    *s = c;
++
++    if (saw_m) {
++        s++;
++        if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++            bitch("%s is not valid", what);
++            return -1;
++        }
++    }
++
++    if (end) {
++        *input = end;
++    } else {
++        *input = skip_white_space(s);
++        if (!*input)
++            return -1;  /* bitching's done elsewhere */
++    }
++    return 1;
+ }
+ 
+ long extract_timevalue(char **input, char *what)
+ {
+-	char *s = *input;
+-	int r = 0, acc = 0;
++    char *s = *input;
++    int r = 0, acc = 0;
+ 
+-	if (!isdigit(*s)) {
+-		bitch("%s expected", what);
+-		return -1;
+-	}
++    if (!isdigit(*s)) {
++        bitch("%s expected", what);
++        return -1;
++    }
+ next_component:
+-	r = 0;
+-	while (isdigit(*s)) {
+-		r *= 10;
+-		r += *s - '0';
+-		s++;
+-	}
+-	if (tolower(*s) == 's') {
+-		s++;
+-	} else if (tolower(*s) == 'm') {
+-		r *= 60;
+-		s++;
+-	} else if (tolower(*s) == 'h') {
+-		r *= 3600;
+-		s++;
+-	} else if (tolower(*s) == 'd') {
+-		r *= 86400;
+-		s++;
+-	} else if (tolower(*s) == 'w') {
+-		r *= 604800;
+-		s++;
+-	}
+-	acc += r;
+-	if (isdigit(*s)) goto next_component;
+-
+-	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-		bitch("%s is not valid", what);
+-		return -1;
+-	}
+-	*input = skip_white_space(s);
+-	if (!*input)
+-		return -1;  /* bitching's done elsewhere */
+-	return acc;
++    r = 0;
++    while (isdigit(*s)) {
++        r *= 10;
++        r += *s - '0';
++        s++;
++    }
++    if (tolower(*s) == 's') {
++        s++;
++    } else if (tolower(*s) == 'm') {
++        r *= 60;
++        s++;
++    } else if (tolower(*s) == 'h') {
++        r *= 3600;
++        s++;
++    } else if (tolower(*s) == 'd') {
++        r *= 86400;
++        s++;
++    } else if (tolower(*s) == 'w') {
++        r *= 604800;
++        s++;
++    }
++    acc += r;
++    if (isdigit(*s)) goto next_component;
++
++    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++        bitch("%s is not valid", what);
++        return -1;
++    }
++    *input = skip_white_space(s);
++    if (!*input)
++        return -1;  /* bitching's done elsewhere */
++    return acc;
+ }
+ 
+ long long extract_timestamp(char **input, char *what)
+ {
+-	char *s = *input;
+-	int year = 0;
+-	int month = 0;
+-	int day = 0;
+-	int hour = 0;
+-	int minute = 0;
+-	int second = 0;
+-	long long epoch = 0;
+-	struct tm tm;
+-
+-	if (!isdigit(*s)) {
+-		bitch("%s expected", what);
+-		return -1;
+-	}
+-	year = year*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (!isdigit(*s)) goto looks_like_epoch;
+-	year = year*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (!isdigit(*s)) goto looks_like_epoch;
+-	year = year*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (!isdigit(*s)) goto looks_like_epoch;
+-	year = year*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (!isdigit(*s)) goto looks_like_epoch;
+-	month = month*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (!isdigit(*s)) goto looks_like_epoch;
+-	month = month*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (!isdigit(*s)) goto looks_like_epoch;
+-	day = day*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (!isdigit(*s)) goto looks_like_epoch;
+-	day = day*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (!isdigit(*s)) goto looks_like_epoch;
+-	hour = hour*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (!isdigit(*s)) goto looks_like_epoch;
+-	hour = hour*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (!isdigit(*s)) goto looks_like_epoch;
+-	minute = minute*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (!isdigit(*s)) goto looks_like_epoch;
+-	minute = minute*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (!isdigit(*s)) goto looks_like_epoch;
+-	second = second*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (!isdigit(*s)) goto looks_like_epoch;
+-	second = second*10 + *s - '0';
+-	epoch = epoch*10 + *s - '0';
+-	s++;
+-	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-		bitch("%s is not valid", what);
+-		return -1;
+-	}
+-	if (second > 60 || minute > 59 || hour > 23 || day < 1 || day > 31 ||
+-		month > 12 || year < 1900 || year > 2037)
+-	{
+-		bitch("%s is not valid", what);
+-		return -1;
+-	}
+-	memset(&tm, 0, sizeof(tm));
+-	tm.tm_sec = second;
+-	tm.tm_min = minute;
+-	tm.tm_hour = hour;
+-	tm.tm_mday = day;
+-	tm.tm_mon = month - 1;
+-	tm.tm_year = year - 1900;
+-	epoch = mktime(&tm);
+-	if (epoch < 0) {
+-		bitch("%s is not valid", what);
+-		return -1;
+-	}
++    char *s = *input;
++    int year = 0;
++    int month = 0;
++    int day = 0;
++    int hour = 0;
++    int minute = 0;
++    int second = 0;
++    long long epoch = 0;
++    struct tm tm;
++
++    if (!isdigit(*s)) {
++        bitch("%s expected", what);
++        return -1;
++    }
++    year = year*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (!isdigit(*s)) goto looks_like_epoch;
++    year = year*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (!isdigit(*s)) goto looks_like_epoch;
++    year = year*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (!isdigit(*s)) goto looks_like_epoch;
++    year = year*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (!isdigit(*s)) goto looks_like_epoch;
++    month = month*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (!isdigit(*s)) goto looks_like_epoch;
++    month = month*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (!isdigit(*s)) goto looks_like_epoch;
++    day = day*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (!isdigit(*s)) goto looks_like_epoch;
++    day = day*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (!isdigit(*s)) goto looks_like_epoch;
++    hour = hour*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (!isdigit(*s)) goto looks_like_epoch;
++    hour = hour*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (!isdigit(*s)) goto looks_like_epoch;
++    minute = minute*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (!isdigit(*s)) goto looks_like_epoch;
++    minute = minute*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (!isdigit(*s)) goto looks_like_epoch;
++    second = second*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (!isdigit(*s)) goto looks_like_epoch;
++    second = second*10 + *s - '0';
++    epoch = epoch*10 + *s - '0';
++    s++;
++    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++        bitch("%s is not valid", what);
++        return -1;
++    }
++    if (second > 60 || minute > 59 || hour > 23 || day < 1 || day > 31 ||
++        month > 12 || year < 1900 || year > 2037)
++    {
++        bitch("%s is not valid", what);
++        return -1;
++    }
++    memset(&tm, 0, sizeof(tm));
++    tm.tm_sec = second;
++    tm.tm_min = minute;
++    tm.tm_hour = hour;
++    tm.tm_mday = day;
++    tm.tm_mon = month - 1;
++    tm.tm_year = year - 1900;
++    epoch = mktime(&tm);
++    if (epoch < 0) {
++        bitch("%s is not valid", what);
++        return -1;
++    }
+ 
+-	goto done;
++    goto done;
+ 
+ looks_like_epoch:
+-	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-		bitch("%s is not valid", what);
+-		return -1;
+-	}
++    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++        bitch("%s is not valid", what);
++        return -1;
++    }
+ done:
+-	*input = skip_white_space(s);
+-	if (!*input)
+-		return -1;  /* bitching's done elsewhere */
+-	return epoch;
++    *input = skip_white_space(s);
++    if (!*input)
++        return -1;  /* bitching's done elsewhere */
++    return epoch;
+ }
+ 
+ int extract_ipv4(char **input, char *what, struct in_addr *addr)
+ {
+-	char *s = *input;
+-	char c;
++    char *s = *input;
++    char c;
+ 
+-	while (isdigit(*s) || *s == '.') {
+-		s++;
+-	}
+-	if (s == *input) {
+-		bitch("%s is not valid", what);
+-		return -1;
+-	}
+-	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-		bitch("%s is not valid", what);
+-		return -1;
+-	}
+-	c = *s;
+-	*s = 0;
+-	if (inet_pton(AF_INET, *input, addr) != 1) {
+-		*s = c;
+-		bitch("cannot parse %s", what);
+-		return -1;
+-	}
+-	*s = c;
+-	*input = skip_white_space(s);
+-	if (!*input) {
+-		return -1;  /* bitching's done elsewhere */
+-	}
+-	return 1;
++    while (isdigit(*s) || *s == '.') {
++        s++;
++    }
++    if (s == *input) {
++        bitch("%s is not valid", what);
++        return -1;
++    }
++    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++        bitch("%s is not valid", what);
++        return -1;
++    }
++    c = *s;
++    *s = 0;
++    if (inet_pton(AF_INET, *input, addr) != 1) {
++        *s = c;
++        bitch("cannot parse %s", what);
++        return -1;
++    }
++    *s = c;
++    *input = skip_white_space(s);
++    if (!*input) {
++        return -1;  /* bitching's done elsewhere */
++    }
++    return 1;
+ }
+ 
+ int extract_ipv6(char **input, char *what, struct in6_addr *addr)
+ {
+-	char *s = *input;
+-	char c;
++    char *s = *input;
++    char c;
+ 
+-	while (isdigit(*s) || *s == ':' || *s == '.' ||
+-		  (*s >= 'a' && *s <= 'f') || (*s >= 'A' && *s <= 'F'))
+-	{
+-		s++;
+-	}
+-	if (s == *input) {
+-		bitch("%s is not valid", what);
+-		return -1;
+-	}
+-	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-		bitch("%s is not valid", what);
+-		return -1;
+-	}
+-	c = *s;
+-	*s = 0;
+-	if (inet_pton(AF_INET6, *input, addr) != 1) {
+-		*s = c;
+-		bitch("cannot parse %s", what);
+-		return -1;
+-	}
+-	*s = c;
+-	*input = skip_white_space(s);
+-	if (!*input) {
+-		return -1;  /* bitching's done elsewhere */
+-	}
+-	return 1;
++    while (isdigit(*s) || *s == ':' || *s == '.' ||
++          (*s >= 'a' && *s <= 'f') || (*s >= 'A' && *s <= 'F'))
++    {
++        s++;
++    }
++    if (s == *input) {
++        bitch("%s is not valid", what);
++        return -1;
++    }
++    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++        bitch("%s is not valid", what);
++        return -1;
++    }
++    c = *s;
++    *s = 0;
++    if (inet_pton(AF_INET6, *input, addr) != 1) {
++        *s = c;
++        bitch("cannot parse %s", what);
++        return -1;
++    }
++    *s = c;
++    *input = skip_white_space(s);
++    if (!*input) {
++        return -1;  /* bitching's done elsewhere */
++    }
++    return 1;
+ }
+ 
+ int extract_u64(char **input, char *what, uint64_t *r)
+ {
+-	char *s = *input;
+-	uint8_t result = 0;
+-	unsigned u;
+-
+-	#define GETHEXBLOCK if (!isxdigit(*s)) { bitch("%s is not valid", what); return -1; } \
+-		u = 0; \
+-		while (isxdigit(*s)) { \
+-			if (isdigit(*s)) { \
+-				u = (u << 4) | (*s - '0'); \
+-			} else if (*s >= 'a' && *s <= 'f') { \
+-				u = (u << 4) | (*s - 'a' + 10); \
+-			} else { \
+-				u = (u << 4) | (*s - 'A' + 10); \
+-			} \
+-			s++; \
+-		} \
+-		if (u > 0xffff) { bitch("%s is not valid, hex out of range", what); return -1; } \
+-		result = (result << 16) | u;
+-	#define SKIPCOLON if (*s != ':') { bitch("%s is not valid", what); return -1; } s++;
+-
+-	GETHEXBLOCK; SKIPCOLON;
+-	GETHEXBLOCK; SKIPCOLON;
+-	GETHEXBLOCK; SKIPCOLON;
+-	GETHEXBLOCK;
+-	*r = result;
+-
+-	#undef GETHEXBLOCK
+-	#undef SKIPCOLON
+-
+-	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-		bitch("%s is not valid", what);
+-		return -1;
+-	}
+-	*input = skip_white_space(s);
+-	if (!*input) {
+-		return -1;  /* bitching's done elsewhere */
+-	}
+-	return 1;
++    char *s = *input;
++    uint8_t result = 0;
++    unsigned u;
++
++    #define GETHEXBLOCK if (!isxdigit(*s)) { bitch("%s is not valid", what); return -1; } \
++        u = 0; \
++        while (isxdigit(*s)) { \
++            if (isdigit(*s)) { \
++                u = (u << 4) | (*s - '0'); \
++            } else if (*s >= 'a' && *s <= 'f') { \
++                u = (u << 4) | (*s - 'a' + 10); \
++            } else { \
++                u = (u << 4) | (*s - 'A' + 10); \
++            } \
++            s++; \
++        } \
++        if (u > 0xffff) { bitch("%s is not valid, hex out of range", what); return -1; } \
++        result = (result << 16) | u;
++    #define SKIPCOLON if (*s != ':') { bitch("%s is not valid", what); return -1; } s++;
++
++    GETHEXBLOCK; SKIPCOLON;
++    GETHEXBLOCK; SKIPCOLON;
++    GETHEXBLOCK; SKIPCOLON;
++    GETHEXBLOCK;
++    *r = result;
++
++    #undef GETHEXBLOCK
++    #undef SKIPCOLON
++
++    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++        bitch("%s is not valid", what);
++        return -1;
++    }
++    *input = skip_white_space(s);
++    if (!*input) {
++        return -1;  /* bitching's done elsewhere */
++    }
++    return 1;
+ }
+ 
+ struct binary_data bad_binary_data(void)
+ {
+-	struct binary_data r;
+-	r.length = -1;
+-	r.data = NULL;
+-	return r;
++    struct binary_data r;
++    r.length = -1;
++    r.data = NULL;
++    return r;
++}
++
++void
++dump_binary_data(FILE *f, struct binary_data d)
++{
++    char *s = d.data;
++    int mem_len = d.length;
++    int i;
++    char o[69];
++    int pos[] = { 0,3,6,9,12,15,18,21,25,28,31,34,37,40,43,46 };
++    char hex[] = "0123456789abcdef";
++
++    if (mem_len < 0) {
++        fprintf(f, "<BAD DATA>\n");
++        return;
++    }
++
++    while (mem_len) {
++        memset(o, ' ', 67);
++        o[67] = '\n';
++        o[68] = 0;
++        for (i = 0; i < 16 && mem_len > 0; i++, mem_len--, s++) {
++            o[pos[i]] = hex[*s >> 4];
++            o[pos[i]+1] = hex[*s & 0x0f];
++            o[51+i] = isprint(*s) ? *s : '.';
++        }
++        fprintf(f, "%s", o);
++    }
+ }
+ 
+ struct binary_data extract_base64_binary_data(char **input, char *what)
+ {
+-	char b64[4096];
+-	int l64 = 0;
+-	char *s = *input;
+-	struct binary_data r = bad_binary_data();
+-	int bl;
+-
+-	while (s && *s) {
+-		if (!isalnum(*s) && *s != '=' && *s != '+' && *s != '/') {
+-			bitch("%s expected", what);
+-			return r;
+-		}
+-		while (isalnum(*s) || *s == '=' || *s == '+' || *s == '/') {
+-			if (l64 >= 4095) {
+-				bitch("%s is too long", what);
+-				return r;
+-			}
+-			b64[l64++] = *s++;
+-		}
+-		s = skip_white_space(s);
+-	}
+-	*input = s;
+-	if (!s)	return r;
+-	b64[l64] = 0;
+-	bl = (l64 * 3 + 3)/4;
+-	r.data = getmem(bl);
+-	r.length = decode_base64(r.data, b64, bl);
+-	if (r.length < 0) {
+-		bitch("error decoding base64 %s", what);
+-		return r;
+-	}
+-	return r;
++    char b64[4096];
++    int l64 = 0;
++    char *s = *input;
++    struct binary_data r = bad_binary_data();
++    int bl;
++
++    while (s && *s) {
++        if (!isalnum(*s) && *s != '=' && *s != '+' && *s != '/') {
++            bitch("%s expected", what);
++            return r;
++        }
++        while (isalnum(*s) || *s == '=' || *s == '+' || *s == '/') {
++            if (l64 >= 4095) {
++                bitch("%s is too long", what);
++                return r;
++            }
++            b64[l64++] = *s++;
++        }
++        s = skip_white_space(s);
++    }
++    *input = s;
++    if (!s) return r;
++    b64[l64] = 0;
++    bl = (l64 * 3 + 3)/4;
++    r.data = getmem(bl);
++    r.length = decode_base64(r.data, b64, bl);
++    if (r.length < 0) {
++        bitch("error decoding base64 %s", what);
++        return r;
++    }
++    return r;
+ }
+ 
+ struct binary_data extract_base32hex_binary_data(char **input, char *what)
+ {
+-	char b32[4096];
+-	int l32 = 0;
+-	char *s = *input;
+-	struct binary_data r = bad_binary_data();
+-	int bl;
+-
+-	while (
+-		   (*s >= 'A' && *s <= 'V') ||
+-		   (*s >= 'a' && *s <= 'v') ||
+-		   (*s >= '0' && *s <= '9') ||
+-		   *s == '=')
+-	{
+-		if (l32 >= 4095) {
+-			bitch("%s is too long", what);
+-			return r;
+-		}
+-		b32[l32++] = *s++;
+-	}
+-	if (l32 <= 0) {
+-		bitch("%s expected", what);
+-		return r;
+-	}
+-
+-	s = skip_white_space(s);
+-	*input = s;
+-	if (!s)	return r;
+-
+-	b32[l32] = 0;
+-	bl = (l32 * 5 + 7)/8;
+-	r.data = getmem(bl);
+-	r.length = decode_base32hex(r.data, b32, bl);
+-	if (r.length < 0) {
+-		bitch("error decoding base32hex %s", what);
+-		return r;
+-	}
+-	return r;
++    char b32[4096];
++    int l32 = 0;
++    char *s = *input;
++    struct binary_data r = bad_binary_data();
++    int bl;
++
++    while (
++           (*s >= 'A' && *s <= 'V') ||
++           (*s >= 'a' && *s <= 'v') ||
++           (*s >= '0' && *s <= '9') ||
++           *s == '=')
++    {
++        if (l32 >= 4095) {
++            bitch("%s is too long", what);
++            return r;
++        }
++        b32[l32++] = *s++;
++    }
++    if (l32 <= 0) {
++        bitch("%s expected", what);
++        return r;
++    }
++
++    s = skip_white_space(s);
++    *input = s;
++    if (!s) return r;
++
++    b32[l32] = 0;
++    bl = (l32 * 5 + 7)/8;
++    r.data = getmem(bl);
++    r.length = decode_base32hex(r.data, b32, bl);
++    if (r.length < 0) {
++        bitch("error decoding base32hex %s", what);
++        return r;
++    }
++    return r;
+ }
+ 
+ struct binary_data extract_text(char **input, char *what)
+ {
+-	char *s = *input;
+-	struct binary_data r = bad_binary_data();
+-	char *o = getmem_temp(65536);
+-	int l = 0;
+-	int c;
+-
+-	if (*s != '"') {
+-		bitch("for now, %s must be put in double quotes", what);
+-		return r;
+-	}
+-	s++;
++    char *s = *input;
++    struct binary_data r = bad_binary_data();
++    char *o = getmem_temp(65536);
++    int l = 0;
++    int c;
++
++    if (*s != '"') {
++        while (*s && !isspace(*s)) {
++            o[l++] = *s++;
++        }
++        *input = skip_white_space(s);
++        if (!*input)
++            return r;  /* bitching's done elsewhere */
++
++        o[l] = 0;
++        r.data = getmem(l+1);
++        r.length = l;
++        memcpy(r.data, o, l+1);
++        return r;
++    }
++    s++;
+ more_text:
+-	while (*s && *s != '"') {
+-		if (*s == '\\') {
+-			s++;
+-			if (*s == 0) {
+-				bitch("bad backslash quoting of %s", what);
+-				return r;
+-			} else if (isdigit(*s)) {
+-				c = 0;
+-				while (isdigit(*s)) {
+-					c = c*10 + *s - '0';
+-					s++;
+-				}
+-				o[l++] = (unsigned char)c;
+-			} else {
+-				o[l] = *s;
+-				goto new_char;
+-			}
+-		} else {
+-			o[l] = *s;
++    while (*s && *s != '"') {
++        if (*s == '\\') {
++            s++;
++            if (*s == 0) {
++                bitch("bad backslash quoting of %s", what);
++                return r;
++            } else if (isdigit(*s)) {
++                c = 0;
++                while (isdigit(*s)) {
++                    c = c*10 + *s - '0';
++                    s++;
++                }
++                o[l++] = (unsigned char)c;
++            } else {
++                o[l] = *s;
++                goto new_char;
++            }
++        } else {
++            o[l] = *s;
+ new_char:
+-			if (l >= 65534) {
+-				bitch("%s string too long", what);
+-				return r;
+-			}
+-			l++;
+-			s++;
+-		}
+-	}
+-	if (!*s) {
+-		if (fgets(file_info->buf, 2048, file_info->file)) {
+-			file_info->line++;
+-			s = file_info->buf;
+-			goto more_text;
+-		} else {
+-			bitch("closing quote not found while parsing %s", what);
+-			return r;
+-		}
+-	}
+-	s++;
+-	*input = skip_white_space(s);
+-	if (!*input)
+-		return r;  /* bitching's done elsewhere */
+-
+-	o[l] = 0;
+-	r.data = getmem(l+1);
+-	r.length = l;
+-	memcpy(r.data, o, l+1);
+-	return r;
++            if (l >= 65534) {
++                bitch("%s string too long", what);
++                return r;
++            }
++            l++;
++            s++;
++        }
++    }
++    if (!*s) {
++        if (read_zone_line()) {
++            s = file_info->buf;
++            goto more_text;
++        } else {
++            bitch("closing quote not found while parsing %s", what);
++            return r;
++        }
++    }
++    s++;
++    *input = skip_white_space(s);
++    if (!*input)
++        return r;  /* bitching's done elsewhere */
++
++    o[l] = 0;
++    r.data = getmem(l+1);
++    r.length = l;
++    memcpy(r.data, o, l+1);
++    return r;
+ }
+ 
+ struct binary_data extract_hex_binary_data(char **input, char *what, int eat_whitespace)
+ {
+-	char hex[4096];
+-	char *s = *input;
+-	struct binary_data r = bad_binary_data();
+-	int hl, hi, hb;
+-
+-	hex[0] = '0';
+-	hl = 1;
+-
+-	if (s[0] == '0' && (s[1] == 'x' || s[1] == 'X'))
+-		s += 2;
+-	if (eat_whitespace == EXTRACT_DONT_EAT_WHITESPACE) {
+-		while (isxdigit(*s)) {
+-			if (hl >= 4095) {
+-				bitch("%s is too long", what);
+-				return r;
+-			}
+-			hex[hl] = *s;
+-			s++;
+-			hl++;
+-		}
+-		if (*s && !isspace(*s) && *s != ';' && *s != ')') {
+-			bitch("%s is not valid", what);
+-			return r;
+-		}
+-		*input = skip_white_space(s);
+-	} else if (eat_whitespace == EXTRACT_EAT_WHITESPACE) {
+-		while (s && *s) {
+-			if (!isxdigit(*s)) {
+-				bitch("%s expected", what);
+-				return r;
+-			}
+-			while (isxdigit(*s)) {
+-				if (hl >= 4095) {
+-					bitch("%s is too long", what);
+-					return r;
+-				}
+-				hex[hl++] = *s++;
+-			}
+-			s = skip_white_space(s);
+-		}
+-		*input = s;
+-	} else {
+-		bitch("%s: internal: invalid eat_whitespace", what);
+-	}
+-
+-	if (!*input)
+-		return r;  /* bitching's done elsewhere */
+-
+-	hb = hl % 2 ? 1 : 0;
+-	if (hb == 0)
+-		bitch("%s: hex data does not represent whole number of bytes", what);
+-	r.data = getmem(hl/2);
+-	r.length = hl/2;
+-	memset(r.data, 0, r.length);
+-	for (hi = 0; hi < hl-hb; hi++) {
+-		r.data[hi/2] <<= 4;
+-		r.data[hi/2] |= 0x0f & (isdigit(hex[hi+hb]) ? hex[hi+hb] - '0' : tolower(hex[hi+hb]) - 'a' + 10);
+-	}
+-	return r;
++    char hex[4096];
++    char *s = *input;
++    struct binary_data r = bad_binary_data();
++    int hl, hi, hb;
++
++    hex[0] = '0';
++    hl = 1;
++
++    if (s[0] == '0' && (s[1] == 'x' || s[1] == 'X'))
++        s += 2;
++    if (eat_whitespace == EXTRACT_DONT_EAT_WHITESPACE) {
++        while (isxdigit(*s)) {
++            if (hl >= 4095) {
++                bitch("%s is too long", what);
++                return r;
++            }
++            hex[hl] = *s;
++            s++;
++            hl++;
++        }
++        if (*s && !isspace(*s) && *s != ';' && *s != ')') {
++            bitch("%s is not valid", what);
++            return r;
++        }
++        *input = skip_white_space(s);
++    } else if (eat_whitespace == EXTRACT_EAT_WHITESPACE) {
++        while (s && *s) {
++            if (!isxdigit(*s)) {
++                bitch("%s expected", what);
++                return r;
++            }
++            while (isxdigit(*s)) {
++                if (hl >= 4095) {
++                    bitch("%s is too long", what);
++                    return r;
++                }
++                hex[hl++] = *s++;
++            }
++            s = skip_white_space(s);
++        }
++        *input = s;
++    } else {
++        bitch("%s: internal: invalid eat_whitespace", what);
++    }
++
++    if (!*input)
++        return r;  /* bitching's done elsewhere */
++
++    hb = hl % 2 ? 1 : 0;
++    if (hb == 0)
++        bitch("%s: hex data does not represent whole number of bytes", what);
++    r.data = getmem(hl/2);
++    r.length = hl/2;
++    memset(r.data, 0, r.length);
++    for (hi = 0; hi < hl-hb; hi++) {
++        r.data[hi/2] <<= 4;
++        r.data[hi/2] |= 0x0f & (isdigit(hex[hi+hb]) ? hex[hi+hb] - '0' : tolower(hex[hi+hb]) - 'a' + 10);
++    }
++    return r;
+ }
+ 
+ struct binary_data new_set(void)
+ {
+-	struct binary_data set;
+-	set.length = 256*(1+1+32);
+-	set.data = getmem_temp(set.length);
+-	memset(set.data, 0, set.length);
+-	return set;
++    struct binary_data set;
++    set.length = 256*(1+1+32);
++    set.data = getmem_temp(set.length);
++    memset(set.data, 0, set.length);
++    return set;
+ }
+ 
+ void add_bit_to_set(struct binary_data *set, int bit)
+ {
+-	int map;
+-	int map_base;
+-	int byte;
+-
+-	if (bit < 0 || bit > 65535)
+-		croakx(1, "bitmap index out of range");
+-	map = bit / 256;
+-	map_base = map*(1+1+32);
+-	set->data[map_base] = map;
+-	bit = bit & 0xff;
+-	byte = bit / 8;
+-	if (set->data[map_base + 1] <= byte)
+-		set->data[map_base + 1] = byte+1;
+-	set->data[map_base + 2 + byte] |= 0x80 >> (bit & 0x07);
++    int map;
++    int map_base;
++    int byte;
++
++    if (bit < 0 || bit > 65535)
++        croakx(1, "bitmap index out of range");
++    map = bit / 256;
++    map_base = map*(1+1+32);
++    set->data[map_base] = map;
++    bit = bit & 0xff;
++    byte = bit / 8;
++    if (set->data[map_base + 1] <= byte)
++        set->data[map_base + 1] = byte+1;
++    set->data[map_base + 2 + byte] |= 0x80 >> (bit & 0x07);
+ }
+ 
+ struct binary_data compressed_set(struct binary_data *set)
+ {
+-	int len = 0;
+-	int map;
+-	int map_base;
+-	struct binary_data r;
+-
+-	for (map = 0; map <= 255; map++) {
+-		map_base = map*(1+1+32);
+-		if (set->data[map_base+1]) {
+-			len += 2 + set->data[map_base+1];
+-		}
+-	}
+-	r.length = len;
+-	r.data = getmem(r.length);
+-	len = 0;
+-	for (map = 0; map <= 255; map++) {
+-		map_base = map*(1+1+32);
+-		if (set->data[map_base+1]) {
+-			memcpy(&r.data[len], &set->data[map_base], 2 + set->data[map_base+1]);
+-			len += 2 + set->data[map_base+1];
+-		}
+-	}
+-	return r;
++    int len = 0;
++    int map;
++    int map_base;
++    struct binary_data r;
++
++    for (map = 0; map <= 255; map++) {
++        map_base = map*(1+1+32);
++        if (set->data[map_base+1]) {
++            len += 2 + set->data[map_base+1];
++        }
++    }
++    r.length = len;
++    r.data = getmem(r.length);
++    len = 0;
++    for (map = 0; map <= 255; map++) {
++        map_base = map*(1+1+32);
++        if (set->data[map_base+1]) {
++            memcpy(&r.data[len], &set->data[map_base], 2 + set->data[map_base+1]);
++            len += 2 + set->data[map_base+1];
++        }
++    }
++    return r;
+ }
+ 
+ struct binary_data compose_binary_data(const char *fmt, int tmp, ...)
+ {
+-	va_list ap;
+-	const char *args;
+-	int sz;
+-	struct binary_data bd;
+-	struct binary_data r;
+-	char *t;
+-	uint8_t b1;
+-	uint16_t b2;
+-	uint32_t b4;
+-	uint64_t b8;
+-
+-	va_start(ap, tmp);
+-	args = fmt;
+-	sz = 0;
+-	while (*args) {
+-		switch (*args++) {
+-		case '1':
+-			va_arg(ap, unsigned int);
+-			sz += 1;
+-			break;
+-		case '2':
+-			va_arg(ap, unsigned int);
+-			sz += 2;
+-			break;
+-		case '4':
+-			va_arg(ap, unsigned int);
+-			sz += 4;
+-			break;
+-		case '8':
+-			va_arg(ap, uint64_t);
+-			sz += 8;
+-			break;
+-		case 'd':
+-			bd = va_arg(ap, struct binary_data);
+-			sz += bd.length;
+-			break;
+-		case 'b':
+-			bd = va_arg(ap, struct binary_data);
+-			if (bd.length > 255)
+-				croak(5, "compose_binary_data: 'b' data too long");
+-			sz += bd.length + 1;
+-			break;
+-		case 'B':
+-			bd = va_arg(ap, struct binary_data);
+-			if (bd.length > 65535)
+-				croak(5, "compose_binary_data: 'B' data too long");
+-			sz += bd.length + 2;
+-			break;
+-		default:
+-			croak(5, "compose_binary_data: bad format");
+-		}
+-	}
+-	va_end(ap);
+-
+-	r.length = sz;
+-	r.data = tmp ? getmem_temp(sz) : getmem(sz);
+-	t = r.data;
+-	va_start(ap, tmp);
+-	args = fmt;
+-	while (*args) {
+-		switch (*args++) {
+-		case '1':
+-			b1 = (uint8_t)va_arg(ap, unsigned int);
+-			memcpy(t, &b1, 1);
+-			t += 1;
+-			break;
+-		case '2':
+-			b2 = htons(va_arg(ap, unsigned int));
+-			memcpy(t, &b2, 2);
+-			t += 2;
+-			break;
+-		case '4':
+-			b4 = htonl(va_arg(ap, unsigned int));
+-			memcpy(t, &b4, 4);
+-			t += 4;
+-			break;
+-		case '8':
+-			b8 = htonl(va_arg(ap, uint64_t));
+-			memcpy(t, &b8, 8);
+-			t += 8;
+-			break;
+-		case 'd':
+-			bd = va_arg(ap, struct binary_data);
+-			memcpy(t, bd.data, bd.length);
+-			t += bd.length;
+-			break;
+-		case 'b':
+-			bd = va_arg(ap, struct binary_data);
+-			b1 = (uint8_t)bd.length;
+-			memcpy(t, &b1, 1);
+-			t += 1;
+-			memcpy(t, bd.data, bd.length);
+-			t += bd.length;
+-			break;
+-		case 'B':
+-			bd = va_arg(ap, struct binary_data);
+-			b2 = htons(bd.length);
+-			memcpy(t, &b2, 2);
+-			t += 2;
+-			memcpy(t, bd.data, bd.length);
+-			t += bd.length;
+-			break;
+-		default:
+-			croak(5, "compose_binary_data: bad format");
+-		}
+-	}
+-	va_end(ap);
+-	return r;
++    va_list ap;
++    const char *args;
++    int sz;
++    struct binary_data bd;
++    struct binary_data r;
++    char *t;
++    uint8_t b1;
++    uint16_t b2;
++    uint32_t b4;
++    uint64_t b8;
++    char *bs;
++    int bsl;
++
++    va_start(ap, tmp);
++    args = fmt;
++    sz = 0;
++    while (*args) {
++        switch (*args++) {
++        case '1':
++            va_arg(ap, unsigned int);
++            sz += 1;
++            break;
++        case '2':
++            va_arg(ap, unsigned int);
++            sz += 2;
++            break;
++        case '4':
++            va_arg(ap, unsigned int);
++            sz += 4;
++            break;
++        case '8':
++            va_arg(ap, uint64_t);
++            sz += 8;
++            break;
++        case 'd':
++            bd = va_arg(ap, struct binary_data);
++            sz += bd.length;
++            break;
++        case 'b':
++            bd = va_arg(ap, struct binary_data);
++            if (bd.length > 255)
++                croak(5, "compose_binary_data: 'b' data too long");
++            sz += bd.length + 1;
++            break;
++        case 'B':
++            bd = va_arg(ap, struct binary_data);
++            if (bd.length > 65535)
++                croak(5, "compose_binary_data: 'B' data too long");
++            sz += bd.length + 2;
++            break;
++        case 's':
++            bs = va_arg(ap, char *);
++            bsl = strlen(bs);
++            if (bsl > 255)
++                croak(5, "compose_binary_data: 's' string too long");
++            sz += bsl + 1;
++            break;
++        default:
++            croak(5, "compose_binary_data: bad format");
++        }
++    }
++    va_end(ap);
++
++    r.length = sz;
++    r.data = tmp ? getmem_temp(sz) : getmem(sz);
++    t = r.data;
++    va_start(ap, tmp);
++    args = fmt;
++    while (*args) {
++        switch (*args++) {
++        case '1':
++            b1 = (uint8_t)va_arg(ap, unsigned int);
++            memcpy(t, &b1, 1);
++            t += 1;
++            break;
++        case '2':
++            b2 = htons(va_arg(ap, unsigned int));
++            memcpy(t, &b2, 2);
++            t += 2;
++            break;
++        case '4':
++            b4 = htonl(va_arg(ap, unsigned int));
++            memcpy(t, &b4, 4);
++            t += 4;
++            break;
++        case '8':
++            b8 = htonl(va_arg(ap, uint64_t));
++            memcpy(t, &b8, 8);
++            t += 8;
++            break;
++        case 'd':
++            bd = va_arg(ap, struct binary_data);
++            memcpy(t, bd.data, bd.length);
++            t += bd.length;
++            break;
++        case 'b':
++            bd = va_arg(ap, struct binary_data);
++            b1 = (uint8_t)bd.length;
++            memcpy(t, &b1, 1);
++            t += 1;
++            memcpy(t, bd.data, bd.length);
++            t += bd.length;
++            break;
++        case 'B':
++            bd = va_arg(ap, struct binary_data);
++            b2 = htons(bd.length);
++            memcpy(t, &b2, 2);
++            t += 2;
++            memcpy(t, bd.data, bd.length);
++            t += bd.length;
++            break;
++        case 's':
++            bs = va_arg(ap, char *);
++            bsl = strlen(bs);
++            b1 = (uint8_t)bsl;
++            memcpy(t, &b1, 1);
++            t += 1;
++            memcpy(t, bs, bsl);
++            t += bsl;
++            break;
++        default:
++            croak(5, "compose_binary_data: bad format");
++        }
++    }
++    va_end(ap);
++    return r;
+ }
+ 
+ /* implementation taken from FreeBSD's libc (minus the __restrict keyword) */
+ char *
+ mystpcpy(char *to, const char *from)
+ {
+-	for (; (*to = *from); ++from, ++to);
+-	return(to);
++    for (; (*to = *from); ++from, ++to);
++    return(to);
+ }
++
++size_t
++mystrlcat(char *dst, const char *src, size_t siz)
++{
++    char *d = dst;
++    const char *s = src;
++    size_t n = siz;
++    size_t dlen;
++
++    /* Find the end of dst and adjust bytes left but don't go past end */
++    while (n-- != 0 && *d != '\0')
++        d++;
++    dlen = d - dst;
++    n = siz - dlen;
++
++    if (n == 0)
++        return(dlen + strlen(s));
++    while (*s != '\0') {
++        if (n != 1) {
++            *d++ = *s;
++            n--;
++        }
++        s++;
++    }
++    *d = '\0';
++
++    return(dlen + (s - src));       /* count does not include NUL */
++}
++
+diff -Naur validns-0.8/textparse.h validns/textparse.h
+--- validns-0.8/textparse.h	2014-02-11 15:45:46.000000000 -0500
++++ validns/textparse.h	2020-10-05 16:59:29.361681424 -0400
+@@ -12,10 +12,12 @@
+ #include <sys/types.h>
+ 
+ struct binary_data {
+-	int length;
+-	char *data;
++    int length;
++    char *data;
+ };
+ 
++void dump_binary_data(FILE *f, struct binary_data d);
++
+ struct binary_data compose_binary_data(const char *fmt, int tmp, ...);
+ /*
+  * Format:
+@@ -28,17 +30,21 @@
+  * B - another binary structure, will incorporate its data,
+  *     and prepend the length as a 16-bit word in NBO,
+  *     fatal error on overflow
++ * s - a NULL-terminated string, will incorporate the string
++ *     without the NULL byte, and prepend the string length as a byte
++ *     (fatal error on overflow)
+  * tmp : allocate temp storage if true, permanent if false
+  *
+  */
+ 
+ #define KEEP_CAPITALIZATION 32
++#define DOLLAR_OK_IN_NAMES  64
+ 
+ int empty_line_or_comment(char *s);
+ char *skip_white_space(char *s);
+ char *extract_name(char **input, char *what, int options);
+ char *extract_label(char **input, char *what, void *is_temporary);
+-long long extract_integer(char **input, char *what);
++long long extract_integer(char **input, char *what, const char *extra_delimiters);
+ long extract_timevalue(char **input, char *what);
+ long long extract_timestamp(char **input, char *what);
+ int extract_ipv4(char **input, char *what, struct in_addr *addr);
+@@ -59,7 +65,9 @@
+ void add_bit_to_set(struct binary_data *set, int bit);
+ struct binary_data compressed_set(struct binary_data *set);
+ 
+-/* stpcpy(3) is not available everywhere */
+-char *mystpcpy(char *to, const char *from);
++char *mystpcpy(char *to, const char *from); /* stpcpy(3) is not available everywhere */
++size_t mystrlcat(char *dst, const char *src, size_t siz); /* so is strlcat */
++
++char *read_zone_line(void);
+ 
+ #endif
+diff -Naur validns-0.8/threads.c validns/threads.c
+--- validns-0.8/threads.c	2011-10-31 16:46:21.000000000 -0400
++++ validns/threads.c	2020-10-05 16:59:29.361681424 -0400
+@@ -7,10 +7,10 @@
+ #include <sys/sysctl.h>
+ #endif
+ 
+-/*	supposedly,
+-	#if defined(PTW32_VERSION) || defined(__hpux)
+-		return pthread_num_processors_np();
+-	but I cannot verify that at the moment
++/*  supposedly,
++    #if defined(PTW32_VERSION) || defined(__hpux)
++        return pthread_num_processors_np();
++    but I cannot verify that at the moment
+ */
+ 
+ #if defined(__GLIBC__)
+@@ -18,16 +18,16 @@
+ #elif defined(__APPLE__) || defined(__FreeBSD__)
+ int ncpus(void)
+ {
+-	int count;
+-	size_t size=sizeof(count);
+-	return sysctlbyname("hw.ncpu",&count,&size,NULL,0) ? 0 : count;
++    int count;
++    size_t size=sizeof(count);
++    return sysctlbyname("hw.ncpu",&count,&size,NULL,0) ? 0 : count;
+ }
+ #else
+ int ncpus(void) { return 0; }  /* "Don't know */
+ #endif
+ 
+-/*	Supposedly, sysconf() can also be used in some cases:
+-	#include <unistd.h>
+-	int const count=sysconf(_SC_NPROCESSORS_ONLN);
+-	return (count>0)?count:0;
++/*  Supposedly, sysconf() can also be used in some cases:
++    #include <unistd.h>
++    int const count=sysconf(_SC_NPROCESSORS_ONLN);
++    return (count>0)?count:0;
+ */
+diff -Naur validns-0.8/tlsa.c validns/tlsa.c
+--- validns-0.8/tlsa.c	2014-02-11 15:46:23.000000000 -0500
++++ validns/tlsa.c	2020-10-05 16:59:29.361681424 -0400
+@@ -21,101 +21,133 @@
+ 
+ /* See http://www.rfc-editor.org/internet-drafts/draft-ietf-dane-protocol-23.txt
+  * for TLSA description.
++ * See https://tools.ietf.org/html/draft-ietf-dane-smime-16
++ * for SMIMEA description.
+  */
+ 
+-static struct rr* tlsa_parse(char *name, long ttl, int type, char *s)
++static struct rr* tlsa_smimea_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_tlsa *rr = getmem(sizeof(*rr));
+-	int cert_usage, selector, matching_type;
++    struct rr_tlsa_smimea *rr = getmem(sizeof(*rr));
++    int cert_usage, selector, matching_type;
+ 
+-	cert_usage = extract_integer(&s, "certificate usage field");
+-	if (cert_usage < 0)	return NULL;
+-	if (cert_usage > 3)
+-		return bitch("bad certificate usage field");
+-	rr->cert_usage = cert_usage;
+-
+-	selector = extract_integer(&s, "selector field");
+-	if (selector < 0)	return NULL;
+-	if (selector > 1)
+-		return bitch("bad selector field");
+-	rr->selector = selector;
+-
+-	matching_type = extract_integer(&s, "matching type field");
+-	if (matching_type < 0)	return NULL;
+-	if (matching_type > 2)
+-		return bitch("bad matching type field");
+-	rr->matching_type = matching_type;
+-
+-	rr->association_data = extract_hex_binary_data(&s, "certificate association data", EXTRACT_EAT_WHITESPACE);
+-	if (rr->association_data.length < 0)	return NULL;
+-	switch (rr->matching_type) {
+-	case 1:
+-		if (rr->association_data.length != SHA256_BYTES)
+-			return bitch("bad SHA-256 hash length");
+-		break;
+-	case 2:
+-		if (rr->association_data.length != SHA512_BYTES)
+-			return bitch("bad SHA-512 hash length");
+-		break;
+-	}
+-
+-	if (*s) {
+-		return bitch("garbage after valid TLSA data");
+-	}
+-	return store_record(type, name, ttl, rr);
++    cert_usage = extract_integer(&s, "certificate usage field", NULL);
++    if (cert_usage < 0) return NULL;
++    if (cert_usage > 3)
++        return bitch("bad certificate usage field");
++    rr->cert_usage = cert_usage;
++
++    selector = extract_integer(&s, "selector field", NULL);
++    if (selector < 0)   return NULL;
++    if (selector > 1)
++        return bitch("bad selector field");
++    rr->selector = selector;
++
++    matching_type = extract_integer(&s, "matching type field", NULL);
++    if (matching_type < 0)  return NULL;
++    if (matching_type > 2)
++        return bitch("bad matching type field");
++    rr->matching_type = matching_type;
++
++    rr->association_data = extract_hex_binary_data(&s, "certificate association data", EXTRACT_EAT_WHITESPACE);
++    if (rr->association_data.length < 0)    return NULL;
++    switch (rr->matching_type) {
++    case 1:
++        if (rr->association_data.length != SHA256_BYTES)
++            return bitch("bad SHA-256 hash length");
++        break;
++    case 2:
++        if (rr->association_data.length != SHA512_BYTES)
++            return bitch("bad SHA-512 hash length");
++        break;
++    }
++
++    if (*s) {
++        return bitch("garbage after valid %s data", type == T_TLSA ? "TLSA" : "SMIMEA");
++    }
++    return store_record(type, name, ttl, rr);
+ }
+ 
+-static char* tlsa_human(struct rr *rrv)
++static char* tlsa_smimea_human(struct rr *rrv)
+ {
+-	RRCAST(tlsa);
++    RRCAST(tlsa_smimea);
+     char s[1024];
+ 
+     snprintf(s, 1024, "%d %d %d ...",
+-		rr->cert_usage, rr->selector, rr->matching_type);
++        rr->cert_usage, rr->selector, rr->matching_type);
+     return quickstrdup_temp(s);
+ }
+ 
+-static struct binary_data tlsa_wirerdata(struct rr *rrv)
++static struct binary_data tlsa_smimea_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(tlsa);
++    RRCAST(tlsa_smimea);
+ 
+-	return compose_binary_data("111d", 1,
+-		rr->cert_usage, rr->selector, rr->matching_type,
+-		rr->association_data);
++    return compose_binary_data("111d", 1,
++        rr->cert_usage, rr->selector, rr->matching_type,
++        rr->association_data);
+ }
+ 
+ static void* tlsa_validate_set(struct rr_set *rr_set)
+ {
+-	struct rr *rr;
+-	struct named_rr *named_rr;
+-	char *s;
+-	int port = 0;
+-	int len;
+-
+-	if (G.opt.policy_checks[POLICY_TLSA_HOST]) {
+-		rr = rr_set->tail;
+-		named_rr = rr_set->named_rr;
+-
+-		/* _25._tcp.mail.example.com. */
+-		s = named_rr->name;
+-		if (*s != '_') {
++    struct rr *rr;
++    struct named_rr *named_rr;
++    char *s;
++    int port = 0;
++    int len;
++
++    if (G.opt.policy_checks[POLICY_TLSA_HOST]) {
++        rr = rr_set->tail;
++        named_rr = rr_set->named_rr;
++
++        /* _25._tcp.mail.example.com. */
++        s = named_rr->name;
++        if (*s != '_') {
+ not_a_prefixed_domain_name:
+-			return moan(rr->file_name, rr->line, "not a proper prefixed DNS domain name");
+-		}
+-		s++;
+-		while (isdigit(*s)) {
+-			port = port * 10  + *s - '0';
+-			s++;
+-		}
+-		if (port <= 0 || port > 65535)	goto not_a_prefixed_domain_name;
+-		if (*s++ != '.')	goto not_a_prefixed_domain_name;
+-		len = strlen(s);
+-		if (len < 6)	goto not_a_prefixed_domain_name;
+-		if (memcmp(s, "_tcp.", 5) != 0 &&
+-			memcmp(s, "_udp.", 5) != 0 &&
+-			memcmp(s, "_sctp.", 6) != 0)	goto not_a_prefixed_domain_name;
+-	}
+-	return NULL;
++            return moan(rr->file_name, rr->line, "not a proper prefixed DNS domain name");
++        }
++        s++;
++        while (isdigit(*s)) {
++            port = port * 10  + *s - '0';
++            s++;
++        }
++        if (port <= 0 || port > 65535)  goto not_a_prefixed_domain_name;
++        if (*s++ != '.')    goto not_a_prefixed_domain_name;
++        len = strlen(s);
++        if (len < 6)    goto not_a_prefixed_domain_name;
++        if (memcmp(s, "_tcp.", 5) != 0 &&
++            memcmp(s, "_udp.", 5) != 0 &&
++            memcmp(s, "_sctp.", 6) != 0)    goto not_a_prefixed_domain_name;
++    }
++    return NULL;
+ }
+ 
+-struct rr_methods tlsa_methods = { tlsa_parse, tlsa_human, tlsa_wirerdata, tlsa_validate_set, NULL };
++static void* smimea_validate_set(struct rr_set *rr_set)
++{
++    struct rr *rr;
++    struct named_rr *named_rr;
++    char *s;
++    int hash_len = 0;
++    int len;
++
++    if (G.opt.policy_checks[POLICY_SMIMEA_HOST]) {
++        rr = rr_set->tail;
++        named_rr = rr_set->named_rr;
++
++        /* c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com. */
++        s = named_rr->name;
++        while (isxdigit(*s)) {
++            hash_len++;
++            s++;
++        }
++        if (*s++ != '.' || hash_len != 56) {
++not_a_proper_smimea_domainname:
++            return moan(rr->file_name, rr->line, "not a proper domain name for an SMIMEA record");
++        }
++        len = strlen(s);
++        if (len < 11)    goto not_a_proper_smimea_domainname;
++        if (memcmp(s, "_smimecert.", 11) != 0)    goto not_a_proper_smimea_domainname;
++    }
++    return NULL;
++}
++
++struct rr_methods tlsa_methods = { tlsa_smimea_parse, tlsa_smimea_human, tlsa_smimea_wirerdata, tlsa_validate_set, NULL };
++struct rr_methods smimea_methods = { tlsa_smimea_parse, tlsa_smimea_human, tlsa_smimea_wirerdata, smimea_validate_set, NULL };
+diff -Naur validns-0.8/txt.c validns/txt.c
+--- validns-0.8/txt.c	2014-02-11 15:45:53.000000000 -0500
++++ validns/txt.c	2020-10-05 16:59:29.361681424 -0400
+@@ -22,62 +22,72 @@
+ 
+ static struct rr *txt_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_txt *rr;
+-	struct binary_data txt[20];
+-	int i;
+-
+-	i = 0;
+-	while (*s) {
+-		if (i >= 20)
+-			return bitch("program limit: too many text segments");
+-		txt[i] = extract_text(&s, "text segment");
+-		if (txt[i].length < 0)
+-			return NULL;
+-		if (txt[i].length > 255)
+-			return bitch("TXT segment too long");
+-		i++;
+-	}
+-	if (i == 0)
+-		return bitch("empty text record");
+-
+-   	rr = getmem(sizeof(*rr) + sizeof(struct binary_data) * (i-1));
+-	rr->count = i;
+-	for (i = 0; i < rr->count; i++) {
+-		rr->txt[i] = txt[i];
+-	}
++    struct rr_txt *rr;
++    struct binary_data txt;
++    struct rr_txt_segment *first = NULL;
++    struct rr_txt_segment *last  = NULL;
++    struct rr_txt_segment *cur   = NULL;
++    int i;
++
++    i = 0;
++    while (*s) {
++        freeall_temp();
++        txt = extract_text(&s, "text segment");
++        if (txt.length < 0)
++            return NULL;
++        if (txt.length > 255)
++            return bitch("TXT segment too long");
++        i++;
++        cur = getmem(sizeof(*cur));
++        cur->txt = txt;
++        cur->next = NULL;
++        if (!first)
++            first = cur;
++        if (last)
++            last->next = cur;
++        last = cur;
++    }
++    if (i == 0)
++        return bitch("empty text record");
++
++    rr = getmem(sizeof(*rr));
++    rr->count = i;
++    rr->txt = first;
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* txt_human(struct rr *rrv)
+ {
+-	RRCAST(txt);
++    RRCAST(txt);
+     char ss[1024];
+-	int i;
+-	char *s = ss;
+-	int l;
+-
+-	for (i = 0; i < rr->count; i++) {
+-		/* XXX would be nice to escape " with \ in strings */
+-		l = snprintf(s, 1024-(s-ss), "\"%s\" ", rr->txt[i].data);
+-		s += l;
+-	}
++    char *s = ss;
++    int l;
++    struct rr_txt_segment *seg = rr->txt;
++
++    while (seg) {
++        /* XXX would be nice to escape " with \ in strings */
++        l = snprintf(s, 1024-(s-ss), "\"%s\" ", seg->txt.data);
++        s += l;
++        seg = seg->next;
++    }
+     return quickstrdup_temp(ss);
+ }
+ 
+ static struct binary_data txt_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(txt);
+-	struct binary_data r, t;
+-	int i;
+-
+-	r = bad_binary_data();
+-	t.length = 0;
+-	t.data = NULL;
+-	for (i = 0; i < rr->count; i++) {
+-		r = compose_binary_data("db", 1, t, rr->txt[i]);
+-		t = r;
+-	}
++    RRCAST(txt);
++    struct binary_data r, t;
++    struct rr_txt_segment *seg = rr->txt;
++
++    r = bad_binary_data();
++    t.length = 0;
++    t.data = NULL;
++    while (seg) {
++        r = compose_binary_data("db", 1, t, seg->txt);
++        t = r;
++        seg = seg->next;
++    }
+     return r;
+ }
+ 
+diff -Naur validns-0.8/usage.mdwn validns/usage.mdwn
+--- validns-0.8/usage.mdwn	2020-10-05 16:54:14.347790456 -0400
++++ validns/usage.mdwn	2020-10-05 16:59:29.361681424 -0400
+@@ -48,6 +48,8 @@
+ 	- ns-alias
+ 	- rp-txt-exists
+ 	- tlsa-host
++	- ksk-exists
++	- smimea-host
+ 	- all
+ 
+ -n *N*
+@@ -59,14 +61,15 @@
+ :   quiet - do not produce any output
+ 
+ -s
+-:   print validation summary/stats
+-
+--x
+-:   skip printing 'time taken' in summary/stats
++:   Print validation summary/stats.
++    If specified twice, also print record counts by type.
+ 
+ -v
+ :   be extra verbose
+ 
++-M
++:   use SOA MINTTL as the default TTL when no TTL specified
++
+ -I *path*
+ :   use this path for $INCLUDE files
+ 
+@@ -133,12 +136,12 @@
+ - TXT domain name mentioned in RP record must have
+   a corresponding TXT record if it is within the zone
+ - domain name of a TLSA record must be a proper prefixed DNS name
++- a KSK key must exist in a signed zone
++- domain name must have the form which is proper for an SMIMEA record
+ 
+ # BUGS
+ 
+ - textual segments in *TXT* and *HINFO* must be enclosed in double quotes;
+-- there cannot be more than 20 textual segments in a *TXT* record;
+-- *$INCLUDE* directive is not implemented;
+ - a dot within a label is not currently supported;
+ 
+ If at least one NSEC3 record uses opt-out flag,
+diff -Naur validns-0.8/validns.1 validns/validns.1
+--- validns-0.8/validns.1	2020-10-05 16:54:14.347790456 -0400
++++ validns/validns.1	2020-10-05 16:59:29.361681424 -0400
+@@ -1,4 +1,4 @@
+-.TH VALIDNS 1 "April 2011" 
++.TH "VALIDNS" "1" "April 2011" "" ""
+ .SH NAME
+ .PP
+ validns \- DNS and DSNSEC zone file validator
+@@ -53,6 +53,10 @@
+ .IP \[bu] 2
+ tlsa\-host
+ .IP \[bu] 2
++ksk\-exists
++.IP \[bu] 2
++smimea\-host
++.IP \[bu] 2
+ all
+ .RE
+ .TP
+@@ -69,17 +73,18 @@
+ .RE
+ .TP
+ .B \-s
+-print validation summary/stats
++Print validation summary/stats.
++If specified twice, also print record counts by type.
+ .RS
+ .RE
+ .TP
+-.B -x
+-skip printing timing summary/stats
++.B \-v
++be extra verbose
+ .RS
+ .RE
+ .TP
+-.B \-v
+-be extra verbose
++.B \-M
++use SOA MINTTL as the default TTL when no TTL specified
+ .RS
+ .RE
+ .TP
+@@ -183,15 +188,15 @@
+ record if it is within the zone
+ .IP \[bu] 2
+ domain name of a TLSA record must be a proper prefixed DNS name
++.IP \[bu] 2
++a KSK key must exist in a signed zone
++.IP \[bu] 2
++domain name must have the form which is proper for an SMIMEA record
+ .SH BUGS
+ .IP \[bu] 2
+ textual segments in \f[I]TXT\f[] and \f[I]HINFO\f[] must be enclosed in
+ double quotes;
+ .IP \[bu] 2
+-there cannot be more than 20 textual segments in a \f[I]TXT\f[] record;
+-.IP \[bu] 2
+-\f[I]$INCLUDE\f[] directive is not implemented;
+-.IP \[bu] 2
+ a dot within a label is not currently supported;
+ .PP
+ If at least one NSEC3 record uses opt\-out flag, \f[C]validns\f[]
+diff -Naur validns-0.8/x25.c validns/x25.c
+--- validns-0.8/x25.c	2014-02-11 15:46:55.000000000 -0500
++++ validns/x25.c	2020-10-05 16:59:29.361681424 -0400
+@@ -23,40 +23,40 @@
+ 
+ static struct rr *x25_parse(char *name, long ttl, int type, char *s)
+ {
+-	struct rr_x25 *rr = getmem(sizeof(*rr));
+-	int i;
++    struct rr_x25 *rr = getmem(sizeof(*rr));
++    int i;
+ 
+-	rr->psdn_address = extract_text(&s, "PSDN-address");
+-	if (rr->psdn_address.length < 0)
+-		return NULL;
+-	if (rr->psdn_address.length > 255)
+-		return bitch("PSDN-address too long");
+-	if (rr->psdn_address.length < 4)
+-		return bitch("PSDN-address too short");
+-	for (i = 0; i < rr->psdn_address.length; i++) {
+-		if (!isdigit(rr->psdn_address.data[i]))
+-			return bitch("PSDN-address contains non-digits");
+-	}
+-
+-	if (*s) {
+-		return bitch("garbage after valid X25 data");
+-	}
++    rr->psdn_address = extract_text(&s, "PSDN-address");
++    if (rr->psdn_address.length < 0)
++        return NULL;
++    if (rr->psdn_address.length > 255)
++        return bitch("PSDN-address too long");
++    if (rr->psdn_address.length < 4)
++        return bitch("PSDN-address too short");
++    for (i = 0; i < rr->psdn_address.length; i++) {
++        if (!isdigit(rr->psdn_address.data[i]))
++            return bitch("PSDN-address contains non-digits");
++    }
++
++    if (*s) {
++        return bitch("garbage after valid X25 data");
++    }
+ 
+-	return store_record(type, name, ttl, rr);
++    return store_record(type, name, ttl, rr);
+ }
+ 
+ static char* x25_human(struct rr *rrv)
+ {
+-	RRCAST(x25);
++    RRCAST(x25);
+ 
+     return rr->psdn_address.data;
+ }
+ 
+ static struct binary_data x25_wirerdata(struct rr *rrv)
+ {
+-	RRCAST(x25);
++    RRCAST(x25);
+ 
+-	return compose_binary_data("b", 1, rr->psdn_address);
++    return compose_binary_data("b", 1, rr->psdn_address);
+ }
+ 
+ struct rr_methods x25_methods = { x25_parse, x25_human, x25_wirerdata, NULL, NULL };
diff --git a/validns-0.8-openssl-1.1.patch b/validns-0.8-openssl-1.1.patch
new file mode 100644
index 0000000..f20384c
--- /dev/null
+++ b/validns-0.8-openssl-1.1.patch
@@ -0,0 +1,248 @@
+From: Author: "Chris West (Faux)" <git@goeswhere.com>
+Date: Fri, 22 Feb 2019 23:39:34 +0100
+Subject: [PATCH] fix compilation on openssl 1.1
+
+BTS: https://bugs.debian.org/859784
+bigeasy: drop locking, check for OOM during allocation.
+Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
+---
+ dnskey.c      |  9 +++++--
+ nsec3checks.c | 29 +++++++++++++---------
+ rrsig.c       | 69 ++++++++++++++-------------------------------------
+ 3 files changed, 42 insertions(+), 65 deletions(-)
+
+diff --git a/dnskey.c b/dnskey.c
+index fecc62abfd21..fda220c14d08 100644
+--- a/dnskey.c
++++ b/dnskey.c
+@@ -154,6 +154,7 @@ int dnskey_build_pkey(struct rr_dnskey *rr)
+ 		unsigned int e_bytes;
+ 		unsigned char *pk;
+ 		int l;
++		BIGNUM *n, *e;
+ 
+ 		rsa = RSA_new();
+ 		if (!rsa)
+@@ -174,11 +175,15 @@ int dnskey_build_pkey(struct rr_dnskey *rr)
+ 		if (l < e_bytes) /* public key is too short */
+ 			goto done;
+ 
+-		rsa->e = BN_bin2bn(pk, e_bytes, NULL);
++		e = BN_bin2bn(pk, e_bytes, NULL);
+ 		pk += e_bytes;
+ 		l -= e_bytes;
+ 
+-		rsa->n = BN_bin2bn(pk, l, NULL);
++		n = BN_bin2bn(pk, l, NULL);
++		if (!e || !n)
++			goto done;
++
++		RSA_set0_key(rsa, n, e, NULL);
+ 
+ 		pkey = EVP_PKEY_new();
+ 		if (!pkey)
+diff --git a/nsec3checks.c b/nsec3checks.c
+index 69c655345bad..2abac9efa1bf 100644
+--- a/nsec3checks.c
++++ b/nsec3checks.c
+@@ -28,7 +28,7 @@
+ static struct binary_data name2hash(char *name, struct rr *param)
+ {
+     struct rr_nsec3param *p = (struct rr_nsec3param *)param;
+-	EVP_MD_CTX ctx;
++	EVP_MD_CTX *ctx;
+ 	unsigned char md0[EVP_MAX_MD_SIZE];
+ 	unsigned char md1[EVP_MAX_MD_SIZE];
+ 	unsigned char *md[2];
+@@ -45,26 +45,31 @@ static struct binary_data name2hash(char *name, struct rr *param)
+ 
+ 	/* XXX Maybe use Init_ex and Final_ex for speed? */
+ 
+-	EVP_MD_CTX_init(&ctx);
+-	if (EVP_DigestInit(&ctx, EVP_sha1()) != 1)
++	ctx = EVP_MD_CTX_new();
++	if (ctx == NULL)
+ 		return r;
+-	digest_size = EVP_MD_CTX_size(&ctx);
+-	EVP_DigestUpdate(&ctx, wire_name.data, wire_name.length);
+-	EVP_DigestUpdate(&ctx, p->salt.data, p->salt.length);
+-	EVP_DigestFinal(&ctx, md[mdi], NULL);
++	if (EVP_DigestInit(ctx, EVP_sha1()) != 1)
++		goto out;
++	digest_size = EVP_MD_CTX_size(ctx);
++	EVP_DigestUpdate(ctx, wire_name.data, wire_name.length);
++	EVP_DigestUpdate(ctx, p->salt.data, p->salt.length);
++	EVP_DigestFinal(ctx, md[mdi], NULL);
+ 
+ 	for (i = 0; i < p->iterations; i++) {
+-		if (EVP_DigestInit(&ctx, EVP_sha1()) != 1)
+-			return r;
+-		EVP_DigestUpdate(&ctx, md[mdi], digest_size);
++		if (EVP_DigestInit(ctx, EVP_sha1()) != 1)
++			goto out;
++
++		EVP_DigestUpdate(ctx, md[mdi], digest_size);
+ 		mdi = (mdi + 1) % 2;
+-		EVP_DigestUpdate(&ctx, p->salt.data, p->salt.length);
+-		EVP_DigestFinal(&ctx, md[mdi], NULL);
++		EVP_DigestUpdate(ctx, p->salt.data, p->salt.length);
++		EVP_DigestFinal(ctx, md[mdi], NULL);
+ 	}
+ 
+ 	r.length = digest_size;
+ 	r.data = getmem(digest_size);
+ 	memcpy(r.data, md[mdi], digest_size);
++out:
++	EVP_MD_CTX_free(ctx);
+ 	return r;
+ }
+ 
+diff --git a/rrsig.c b/rrsig.c
+index 81f24b4c49da..0a9e864285d0 100644
+--- a/rrsig.c
++++ b/rrsig.c
+@@ -26,7 +26,7 @@
+ struct verification_data
+ {
+ 	struct verification_data *next;
+-	EVP_MD_CTX ctx;
++	EVP_MD_CTX *ctx;
+ 	struct rr_dnskey *key;
+ 	struct rr_rrsig *rr;
+ 	int ok;
+@@ -180,7 +180,7 @@ void *verification_thread(void *dummy)
+ 		if (d) {
+ 			int r;
+ 			d->next = NULL;
+-			r = EVP_VerifyFinal(&d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
++			r = EVP_VerifyFinal(d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
+ 			if (r == 1) {
+ 				d->ok = 1;
+ 			} else {
+@@ -232,7 +232,7 @@ static void schedule_verification(struct verification_data *d)
+ 	} else {
+ 		int r;
+ 		G.stats.signatures_verified++;
+-		r = EVP_VerifyFinal(&d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
++		r = EVP_VerifyFinal(d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
+ 		if (r == 1) {
+ 			d->ok = 1;
+ 		} else {
+@@ -250,21 +250,24 @@ static int verify_signature(struct verification_data *d, struct rr_set *signed_s
+ 	struct rr *signed_rr;
+ 	int i;
+ 
+-	EVP_MD_CTX_init(&d->ctx);
++	d->ctx = EVP_MD_CTX_new();
++	if (!d->ctx)
++		return 0;
++
+ 	switch (d->rr->algorithm) {
+ 	case ALG_DSA:
+ 	case ALG_RSASHA1:
+ 	case ALG_DSA_NSEC3_SHA1:
+ 	case ALG_RSASHA1_NSEC3_SHA1:
+-		if (EVP_VerifyInit(&d->ctx, EVP_sha1()) != 1)
++		if (EVP_VerifyInit(d->ctx, EVP_sha1()) != 1)
+ 			return 0;
+ 		break;
+ 	case ALG_RSASHA256:
+-		if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1)
++		if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1)
+ 			return 0;
+ 		break;
+ 	case ALG_RSASHA512:
+-		if (EVP_VerifyInit(&d->ctx, EVP_sha512()) != 1)
++		if (EVP_VerifyInit(d->ctx, EVP_sha512()) != 1)
+ 			return 0;
+ 		break;
+ 	default:
+@@ -274,7 +277,7 @@ static int verify_signature(struct verification_data *d, struct rr_set *signed_s
+ 	chunk = rrsig_wirerdata_ex(&d->rr->rr, 0);
+ 	if (chunk.length < 0)
+ 		return 0;
+-	EVP_VerifyUpdate(&d->ctx, chunk.data, chunk.length);
++	EVP_VerifyUpdate(d->ctx, chunk.data, chunk.length);
+ 
+ 	set = getmem_temp(sizeof(*set) * signed_set->count);
+ 
+@@ -294,12 +297,12 @@ static int verify_signature(struct verification_data *d, struct rr_set *signed_s
+ 		chunk = name2wire_name(signed_set->named_rr->name);
+ 		if (chunk.length < 0)
+ 			return 0;
+-		EVP_VerifyUpdate(&d->ctx, chunk.data, chunk.length);
+-		b2 = htons(set[i].rr->rdtype);    EVP_VerifyUpdate(&d->ctx, &b2, 2);
+-		b2 = htons(1);  /* class IN */   EVP_VerifyUpdate(&d->ctx, &b2, 2);
+-		b4 = htonl(set[i].rr->ttl);       EVP_VerifyUpdate(&d->ctx, &b4, 4);
+-		b2 = htons(set[i].wired.length); EVP_VerifyUpdate(&d->ctx, &b2, 2);
+-		EVP_VerifyUpdate(&d->ctx, set[i].wired.data, set[i].wired.length);
++		EVP_VerifyUpdate(d->ctx, chunk.data, chunk.length);
++		b2 = htons(set[i].rr->rdtype);    EVP_VerifyUpdate(d->ctx, &b2, 2);
++		b2 = htons(1);  /* class IN */   EVP_VerifyUpdate(d->ctx, &b2, 2);
++		b4 = htonl(set[i].rr->ttl);       EVP_VerifyUpdate(d->ctx, &b4, 4);
++		b2 = htons(set[i].wired.length); EVP_VerifyUpdate(d->ctx, &b2, 2);
++		EVP_VerifyUpdate(d->ctx, set[i].wired.data, set[i].wired.length);
+ 	}
+ 
+ 	schedule_verification(d);
+@@ -371,49 +374,12 @@ static void *rrsig_validate(struct rr *rrv)
+ 	return rr;
+ }
+ 
+-static pthread_mutex_t *lock_cs;
+-static long *lock_count;
+-
+-static unsigned long pthreads_thread_id(void)
+-{
+-	unsigned long ret;
+-
+-	ret=(unsigned long)pthread_self();
+-	return(ret);
+-}
+-
+-static void pthreads_locking_callback(int mode, int type, char *file, int line)
+-{
+-	if (mode & CRYPTO_LOCK) {
+-		pthread_mutex_lock(&(lock_cs[type]));
+-		lock_count[type]++;
+-	} else {
+-		pthread_mutex_unlock(&(lock_cs[type]));
+-	}
+-}
+-
+ void verify_all_keys(void)
+ {
+ 	struct keys_to_verify *k = all_keys_to_verify;
+ 	int i;
+ 	struct timespec sleep_time;
+ 
+-	ERR_load_crypto_strings();
+-	if (G.opt.n_threads > 1) {
+-		lock_cs = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
+-		lock_count = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long));
+-		for (i = 0; i < CRYPTO_num_locks(); i++) {
+-			lock_count[i] = 0;
+-			pthread_mutex_init(&lock_cs[i],NULL);
+-		}
+-
+-		CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id);
+-		CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback);
+-
+-		if (pthread_mutex_init(&queue_lock, NULL) != 0)
+-			croak(1, "pthread_mutex_init");
+-	}
+-
+ 	while (k) {
+ 		freeall_temp();
+ 		for (i = 0; i < k->n_keys; i++) {
+@@ -446,6 +412,7 @@ void verify_all_keys(void)
+ 				if (k->to_verify[i].openssl_error != 0)
+ 					e = k->to_verify[i].openssl_error;
+ 			}
++			EVP_MD_CTX_free(k->to_verify[i].ctx);
+ 		}
+ 		if (!ok) {
+ 			struct named_rr *named_rr;
+-- 
+2.20.1
+
diff --git a/validns-0.8-timing.patch b/validns-0.8-timing.patch
index ef3984a..e085a6e 100644
--- a/validns-0.8-timing.patch
+++ b/validns-0.8-timing.patch
@@ -1,18 +1,18 @@
 diff -Naur validns-0.8-orig/common.h validns-0.8/common.h
---- validns-0.8-orig/common.h	2014-02-11 15:45:02.000000000 -0500
-+++ validns-0.8/common.h	2014-02-11 16:18:03.578140738 -0500
-@@ -53,6 +53,7 @@
+--- validns-0.8-orig/common.h	2020-10-05 17:25:53.814455909 -0400
++++ validns-0.8/common.h	2020-10-05 17:26:58.696957376 -0400
+@@ -72,6 +72,7 @@
  		int die_on_first_error;
  		int no_output;
  		int summary;
 +		int notiming;
  		int verbose;
  		char *include_path;
- 		char *current_origin;
+ 		int include_path_specified;
 diff -Naur validns-0.8-orig/main.c validns-0.8/main.c
---- validns-0.8-orig/main.c	2014-02-11 15:47:10.000000000 -0500
-+++ validns-0.8/main.c	2014-02-11 16:18:03.579140774 -0500
-@@ -253,6 +253,7 @@
+--- validns-0.8-orig/main.c	2020-10-05 17:25:53.815455917 -0400
++++ validns-0.8/main.c	2020-10-05 17:28:34.536698118 -0400
+@@ -447,6 +447,7 @@
  	fprintf(stderr, "\t-n N\t\tuse N worker threads\n");
  	fprintf(stderr, "\t-q\t\tquiet - do not produce any output\n");
  	fprintf(stderr, "\t-s\t\tprint validation summary/stats\n");
@@ -20,16 +20,16 @@ diff -Naur validns-0.8-orig/main.c validns-0.8/main.c
  	fprintf(stderr, "\t-v\t\tbe extra verbose\n");
  	fprintf(stderr, "\t-I path\tuse this path for $INCLUDE files\n");
  	fprintf(stderr, "\t-z origin\tuse this origin as initial $ORIGIN\n");
-@@ -328,7 +329,7 @@
+@@ -523,7 +524,7 @@
  	struct timeval start, stop;
  
  	initialize_globals();
--	while ((o = getopt(argc, argv, "fhqsvI:z:t:p:n:")) != -1) {
-+	while ((o = getopt(argc, argv, "fhqsxvI:z:t:p:n:")) != -1) {
+-	while ((o = getopt(argc, argv, "fhMqsvI:z:t:p:n:")) != -1) {
++	while ((o = getopt(argc, argv, "fhMqsxvI:z:t:p:n:")) != -1) {
  		switch(o) {
  		case 'h':
  			usage(NULL);
-@@ -342,6 +343,9 @@
+@@ -540,6 +541,9 @@
  		case 's':
  			G.opt.summary = 1;
  			break;
@@ -39,7 +39,7 @@ diff -Naur validns-0.8-orig/main.c validns-0.8/main.c
  		case 'v':
  			G.opt.verbose = 1;
  			break;
-@@ -431,8 +435,10 @@
+@@ -635,8 +639,10 @@
  			   "                     %d\n", G.stats.not_authoritative);
  		printf("validation errors:   %d\n", G.stats.error_count);
  		printf("signatures verified: %d\n", G.stats.signatures_verified);
@@ -52,9 +52,9 @@ diff -Naur validns-0.8-orig/main.c validns-0.8/main.c
  	return G.exit_code;
  }
 diff -Naur validns-0.8-orig/usage.mdwn validns-0.8/usage.mdwn
---- validns-0.8-orig/usage.mdwn	2014-02-11 15:42:32.000000000 -0500
-+++ validns-0.8/usage.mdwn	2014-02-11 16:18:03.579140774 -0500
-@@ -61,6 +61,9 @@
+--- validns-0.8-orig/usage.mdwn	2020-10-05 17:25:53.817455933 -0400
++++ validns-0.8/usage.mdwn	2020-10-05 17:28:54.400851630 -0400
+@@ -62,6 +62,9 @@
  -s
  :   print validation summary/stats
  
@@ -65,9 +65,9 @@ diff -Naur validns-0.8-orig/usage.mdwn validns-0.8/usage.mdwn
  :   be extra verbose
  
 diff -Naur validns-0.8-orig/validns.1 validns-0.8/validns.1
---- validns-0.8-orig/validns.1	2014-02-11 15:43:21.000000000 -0500
-+++ validns-0.8/validns.1	2014-02-11 16:18:45.445846013 -0500
-@@ -73,6 +73,11 @@
+--- validns-0.8-orig/validns.1	2020-10-05 17:25:53.818455940 -0400
++++ validns-0.8/validns.1	2020-10-05 17:29:25.670093291 -0400
+@@ -75,6 +75,11 @@
  .RS
  .RE
  .TP
diff --git a/validns.spec b/validns.spec
index c8ae205..2e4192f 100644
--- a/validns.spec
+++ b/validns.spec
@@ -3,14 +3,17 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 16%{?dist}
+Release: 18%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
-Patch1: validns-0.8-timing.patch
-Patch2: validns-0.8-Wformat-truncation.patch
+Patch1: validns-0.8-Wformat-truncation.patch
+Patch2: validns-0.8-git20160720.patch
+Patch3: validns-0.8-Makefile.patch
+Patch4: validns-0.8-openssl-1.1.patch
+Patch5: validns-0.8-timing.patch
 BuildRequires:  gcc
-BuildRequires: Judy-devel, compat-openssl10-devel
+BuildRequires: Judy-devel, openssl-devel
 
 %description
 DNS and DNSSEC zone file validator. It comes with no man page and no
@@ -18,9 +21,6 @@ useful README or information, but it's a nice tool anyway :)
 
 %prep
 %autosetup -p1
-#%setup -q 
-#%patch1 -p1 -b .timing
-#%patch2 -p1 -b .Wformat-truncation.patch
 
 %build
 %make_build
@@ -31,12 +31,22 @@ mkdir -p %{buildroot}/%{_bindir} %{buildroot}/%{_mandir}/man1/
 install -m 755 validns %{buildroot}/%{_bindir}/
 cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 
-%files 
+%files
 %doc LICENSE README
 %{_bindir}/validns
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Mon Oct  5 17:30:51 EDT 2020 Paul Wouters <pwouters@redhat.com> - 0.8-18
+- Resolves: rhbz#1879707 FTBFS: Remove compat-openssl10 requirement
+- Resolves: rhbz#1865601 validns: FTBFS in Fedora rawhide/f33
+- Resolves: rhbz#1880829 F34FailsToInstall: validns
+- Updated notiming patch (-x) notiming patch (-x)
+- Pulled in git20160720 updates
+
+* Mon Oct  5 17:03:05 EDT 2020 Paul Wouters <pwouters@redhat.com> - 0.8-17
+- Port to openssl-1.1 based on github and https://github.com/tobez/validns/pull/64
+
 * Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-16
 - Second attempt - Rebuilt for
   https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

From 364ed8f0a48b9fd74cf73d4e0404385f7c22da84 Mon Sep 17 00:00:00 2001
From: Paul Wouters <pwouters@redhat.com>
Date: Mon, 5 Oct 2020 21:36:04 -0400
Subject: [PATCH 14/22] - Workaround for s390x strcpy issues in mempool.c

---
 validns-0.8-s390-mempool.patch | 22 ++++++++++++++++++++++
 validns.spec                   |  4 ++++
 2 files changed, 26 insertions(+)
 create mode 100644 validns-0.8-s390-mempool.patch

diff --git a/validns-0.8-s390-mempool.patch b/validns-0.8-s390-mempool.patch
new file mode 100644
index 0000000..6cad683
--- /dev/null
+++ b/validns-0.8-s390-mempool.patch
@@ -0,0 +1,22 @@
+diff -Naur validns-0.8-orig/mempool.c validns-0.8/mempool.c
+--- validns-0.8-orig/mempool.c	2014-02-11 15:47:03.000000000 -0500
++++ validns-0.8/mempool.c	2020-10-05 20:53:47.014892762 -0400
+@@ -91,12 +91,16 @@
+ 
+ char *quickstrdup(char *s)
+ {
++	if (s == NULL)
++		return NULL;
+ 	char *r = getmem(strlen(s)+1);
+-	return strcpy(r, s);
++	return strncpy(r, s, strlen(r) -1);
+ }
+ 
+ char *quickstrdup_temp(char *s)
+ {
++	if (s == NULL)
++		return NULL;
+ 	char *r = getmem_temp(strlen(s)+1);
+-	return strcpy(r, s);
++	return strncpy(r, s, strlen(r) -1);
+ }
diff --git a/validns.spec b/validns.spec
index 2e4192f..319b178 100644
--- a/validns.spec
+++ b/validns.spec
@@ -7,11 +7,14 @@ Release: 18%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
+
 Patch1: validns-0.8-Wformat-truncation.patch
 Patch2: validns-0.8-git20160720.patch
 Patch3: validns-0.8-Makefile.patch
 Patch4: validns-0.8-openssl-1.1.patch
 Patch5: validns-0.8-timing.patch
+Patch6: validns-0.8-s390-mempool.patch
+
 BuildRequires:  gcc
 BuildRequires: Judy-devel, openssl-devel
 
@@ -43,6 +46,7 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 - Resolves: rhbz#1880829 F34FailsToInstall: validns
 - Updated notiming patch (-x) notiming patch (-x)
 - Pulled in git20160720 updates
+- Workaround for s390x strcpy issues in mempool.c
 
 * Mon Oct  5 17:03:05 EDT 2020 Paul Wouters <pwouters@redhat.com> - 0.8-17
 - Port to openssl-1.1 based on github and https://github.com/tobez/validns/pull/64

From 2fa23df016dd1520caf479055cd65e6ac322673c Mon Sep 17 00:00:00 2001
From: Tom Stellard <tstellar@redhat.com>
Date: Sat, 9 Jan 2021 00:33:46 +0000
Subject: [PATCH 15/22] Add BuildRequires: make

https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot
---
 validns.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/validns.spec b/validns.spec
index 319b178..1b1e6e1 100644
--- a/validns.spec
+++ b/validns.spec
@@ -15,6 +15,7 @@ Patch4: validns-0.8-openssl-1.1.patch
 Patch5: validns-0.8-timing.patch
 Patch6: validns-0.8-s390-mempool.patch
 
+BuildRequires: make
 BuildRequires:  gcc
 BuildRequires: Judy-devel, openssl-devel
 

From 3125898a7528e4d6cebb94f4e5cdfbd9fb2256dd Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 27 Jan 2021 22:53:51 +0000
Subject: [PATCH 16/22] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index 1b1e6e1..f74b5de 100644
--- a/validns.spec
+++ b/validns.spec
@@ -3,7 +3,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 18%{?dist}
+Release: 19%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -41,6 +41,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-19
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
 * Mon Oct  5 17:30:51 EDT 2020 Paul Wouters <pwouters@redhat.com> - 0.8-18
 - Resolves: rhbz#1879707 FTBFS: Remove compat-openssl10 requirement
 - Resolves: rhbz#1865601 validns: FTBFS in Fedora rawhide/f33

From 447091025580deefc215bca2df308027dd005faf Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 23 Jul 2021 20:17:25 +0000
Subject: [PATCH 17/22] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index f74b5de..c286472 100644
--- a/validns.spec
+++ b/validns.spec
@@ -3,7 +3,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 19%{?dist}
+Release: 20%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -41,6 +41,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-20
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
 * Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-19
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 

From 4f175e26ce3e680fef5d4796317db3863c1b0426 Mon Sep 17 00:00:00 2001
From: Sahana Prasad <sahana@redhat.com>
Date: Tue, 14 Sep 2021 19:17:24 +0200
Subject: [PATCH 18/22] Rebuilt with OpenSSL 3.0.0

---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index c286472..5ab7ca9 100644
--- a/validns.spec
+++ b/validns.spec
@@ -3,7 +3,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 20%{?dist}
+Release: 21%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -41,6 +41,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 0.8-21
+- Rebuilt with OpenSSL 3.0.0
+
 * Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-20
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
 

From 27b5ec9d998f081da4b91a3e1ced2dacf44f5d64 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 22 Jan 2022 03:46:56 +0000
Subject: [PATCH 19/22] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index 5ab7ca9..5ccae09 100644
--- a/validns.spec
+++ b/validns.spec
@@ -3,7 +3,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 21%{?dist}
+Release: 22%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -41,6 +41,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-22
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
 * Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 0.8-21
 - Rebuilt with OpenSSL 3.0.0
 

From 5aba988c22a4e1e784942128314632e2af6a654a Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 23 Jul 2022 11:40:37 +0000
Subject: [PATCH 20/22] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index 5ccae09..47570ea 100644
--- a/validns.spec
+++ b/validns.spec
@@ -3,7 +3,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 22%{?dist}
+Release: 23%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -41,6 +41,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-23
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
 * Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-22
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 

From af91f759523725d903a6f58fe38c115920ebe4e7 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 21 Jan 2023 06:06:06 +0000
Subject: [PATCH 21/22] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 validns.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/validns.spec b/validns.spec
index 47570ea..81e05b6 100644
--- a/validns.spec
+++ b/validns.spec
@@ -3,7 +3,7 @@
 Summary: DNS and DNSSEC zone file validator
 Name: validns
 Version: 0.8
-Release: 23%{?dist}
+Release: 24%{?dist}
 License: BSD
 Url:  http://www.validns.net/
 Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
@@ -41,6 +41,9 @@ cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
 %{_mandir}/man1/validns.1.gz
 
 %changelog
+* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-24
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
 * Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-23
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 

From cd760e04274205e0f482d6aede6375ac0d34a101 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Fri, 10 Feb 2023 22:22:11 +0100
Subject: [PATCH 22/22] Retired: Long term failure to build

---
 .gitignore                           |     6 -
 dead.package                         |     1 +
 sources                              |     1 -
 validns-0.5-tlsa-nsec.patch          |  3797 -----
 validns-0.6-timing.patch             |    82 -
 validns-0.7-timing.patch             |    81 -
 validns-0.8-Makefile.patch           |   250 -
 validns-0.8-Wformat-truncation.patch |    24 -
 validns-0.8-git20160720.patch        |  1719 --
 validns-0.8-githead.patch            | 21091 -------------------------
 validns-0.8-openssl-1.1.patch        |   248 -
 validns-0.8-s390-mempool.patch       |    22 -
 validns-0.8-timing.patch             |    81 -
 validns.spec                         |   160 -
 14 files changed, 1 insertion(+), 27562 deletions(-)
 delete mode 100644 .gitignore
 create mode 100644 dead.package
 delete mode 100644 sources
 delete mode 100644 validns-0.5-tlsa-nsec.patch
 delete mode 100644 validns-0.6-timing.patch
 delete mode 100644 validns-0.7-timing.patch
 delete mode 100644 validns-0.8-Makefile.patch
 delete mode 100644 validns-0.8-Wformat-truncation.patch
 delete mode 100644 validns-0.8-git20160720.patch
 delete mode 100644 validns-0.8-githead.patch
 delete mode 100644 validns-0.8-openssl-1.1.patch
 delete mode 100644 validns-0.8-s390-mempool.patch
 delete mode 100644 validns-0.8-timing.patch
 delete mode 100644 validns.spec

diff --git a/.gitignore b/.gitignore
deleted file mode 100644
index eee7db7..0000000
--- a/.gitignore
+++ /dev/null
@@ -1,6 +0,0 @@
-/validns-0.3.tar.gz
-/validns-0.4.tar.gz
-/validns-0.5.tar.gz
-/validns-0.6.tar.gz
-/validns-0.7.tar.gz
-/validns-0.8.tar.gz
diff --git a/dead.package b/dead.package
new file mode 100644
index 0000000..ab7426e
--- /dev/null
+++ b/dead.package
@@ -0,0 +1 @@
+Retired: Long term failure to build
diff --git a/sources b/sources
deleted file mode 100644
index 8d63d2c..0000000
--- a/sources
+++ /dev/null
@@ -1 +0,0 @@
-3de6669b1c8794b21c25425d22215a9d  validns-0.8.tar.gz
diff --git a/validns-0.5-tlsa-nsec.patch b/validns-0.5-tlsa-nsec.patch
deleted file mode 100644
index 5cadfda..0000000
--- a/validns-0.5-tlsa-nsec.patch
+++ /dev/null
@@ -1,3797 +0,0 @@
-diff --git a/Changes b/Changes
-index b9c4cab..068078a 100644
---- a/Changes
-+++ b/Changes
-@@ -1,5 +1,9 @@
- Revision history for validns.
- 
-+0.6 - in progress
-+	Support TLSA records.
-+	Minor bug fixes.
-+
- 0.5 Thu Jun  7 15:45:55 CEST 2012
- 	Parallelize signature verification (-n option)
- 
-diff --git a/LICENSE b/LICENSE
-index ce67f2e..74d6ee2 100644
---- a/LICENSE
-+++ b/LICENSE
-@@ -1,4 +1,4 @@
--Copyright (c) 2011, Anton Berezin "<tobez@tobez.org>". All rights
-+Copyright (c) 2011, 2012 Anton Berezin "<tobez@tobez.org>". All rights
- reserved.
- 
- Redistribution and use in source and binary forms, with or without
-diff --git a/Makefile b/Makefile
-index 9f02db8..5a9ae86 100644
---- a/Makefile
-+++ b/Makefile
-@@ -9,7 +9,7 @@ validns: main.o carp.o mempool.o textparse.o base64.o base32hex.o \
- 	naptr.o srv.o nsec3param.o nsec3.o ds.o \
- 	hinfo.o loc.o nsec3checks.o ptr.o \
- 	sshfp.o threads.o rp.o spf.o cert.o \
--	dname.o
-+	dname.o tlsa.o nid.o l32.o l64.o lp.o
- 	$(CC) $(CFLAGS) $(OPTIMIZE) -o validns \
- 	    main.o carp.o mempool.o textparse.o base64.o base32hex.o \
- 	    rr.o soa.o a.o cname.o mx.o ns.o \
-@@ -17,7 +17,7 @@ validns: main.o carp.o mempool.o textparse.o base64.o base32hex.o \
- 	    naptr.o srv.o nsec3param.o nsec3.o ds.o \
- 	    hinfo.o loc.o nsec3checks.o ptr.o \
- 	    sshfp.o threads.o rp.o spf.o cert.o \
--	    dname.o \
-+	    dname.o tlsa.o nid.o l32.o l64.o lp.o \
- 	    -L/usr/local/lib -L/opt/local/lib -lJudy -lcrypto
- 
- clean:
-@@ -27,7 +27,8 @@ clean:
- 	-rm -f naptr.o srv.o nsec3param.o nsec3.o ds.o
- 	-rm -f hinfo.o loc.o nsec3checks.o ptr.o
- 	-rm -f sshfp.o base32hex.o base64.o threads.o
--	-rm -f rp.o spf.o cert.o dname.o
-+	-rm -f rp.o spf.o cert.o dname.o tlsa.o
-+	-rm -f nid.o l32.o l64.o lp.o
- 	-rm -f validns.core core
- 	@echo ':-)'
- 
-@@ -124,6 +125,21 @@ cert.o: cert.c common.h textparse.h mempool.h carp.h rr.h
- dname.o: dname.c common.h textparse.h mempool.h carp.h rr.h
- 	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o dname.o dname.c $(INCPATH)
- 
-+tlsa.o: tlsa.c common.h textparse.h mempool.h carp.h rr.h
-+	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o tlsa.o tlsa.c $(INCPATH)
-+
-+nid.o: nid.c common.h textparse.h mempool.h carp.h rr.h
-+	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o nid.o nid.c $(INCPATH)
-+
-+l32.o: l32.c common.h textparse.h mempool.h carp.h rr.h
-+	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o l32.o l32.c $(INCPATH)
-+
-+l64.o: l64.c common.h textparse.h mempool.h carp.h rr.h
-+	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o l64.o l64.c $(INCPATH)
-+
-+lp.o: lp.c common.h textparse.h mempool.h carp.h rr.h
-+	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o lp.o lp.c $(INCPATH)
-+
- threads.o: threads.c
- 	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o threads.o threads.c $(INCPATH)
- 
-diff --git a/a.c b/a.c
-index b2a6212..28c942d 100644
---- a/a.c
-+++ b/a.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/aaaa.c b/aaaa.c
-index 408ac45..e5a4fd0 100644
---- a/aaaa.c
-+++ b/aaaa.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/base32hex.c b/base32hex.c
-index b07c910..6e54774 100644
---- a/base32hex.c
-+++ b/base32hex.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/base32hex.h b/base32hex.h
-index 79118ca..d6bd24c 100644
---- a/base32hex.h
-+++ b/base32hex.h
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/base64.c b/base64.c
-index a3ebb04..4bed2c6 100644
---- a/base64.c
-+++ b/base64.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/base64.h b/base64.h
-index 02bd371..a8095ba 100644
---- a/base64.h
-+++ b/base64.h
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/carp.c b/carp.c
-index 0514cfb..c60cdf6 100644
---- a/carp.c
-+++ b/carp.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/carp.h b/carp.h
-index 2ecd9a4..ddd0c0c 100644
---- a/carp.h
-+++ b/carp.h
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/cert.c b/cert.c
-index 9b66f28..ee80e65 100644
---- a/cert.c
-+++ b/cert.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -123,7 +123,7 @@ static char* cert_human(struct rr *rrv)
- 	RRCAST(cert);
-     char s[1024];
- 
--    snprintf(s, 1024, "CERT %d %d %d ...",
-+    snprintf(s, 1024, "%d %d %d ...",
- 		rr->type, rr->key_tag, rr->algorithm);
-     return quickstrdup_temp(s);
- }
-diff --git a/cname.c b/cname.c
-index 51e69f5..956f729 100644
---- a/cname.c
-+++ b/cname.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -21,7 +21,7 @@ static struct rr *cname_parse(char *name, long ttl, int type, char *s)
- {
- 	struct rr_cname *rr = getmem(sizeof(*rr));
- 
--	rr->cname = extract_name(&s, "cname");
-+	rr->cname = extract_name(&s, "cname", 0);
- 	if (!rr->cname)
- 		return NULL;
- 	if (*s) {
-diff --git a/common.h b/common.h
-index 70c6f42..023af1a 100644
---- a/common.h
-+++ b/common.h
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -21,7 +21,7 @@ struct file_info
- 
- extern struct file_info *file_info;
- 
--#define N_POLICY_CHECKS 8
-+#define N_POLICY_CHECKS 9
- 
- #define POLICY_SINGLE_NS 0
- #define POLICY_CNAME_OTHER_DATA 1
-@@ -31,6 +31,7 @@ extern struct file_info *file_info;
- #define POLICY_RP_TXT_EXISTS 5
- #define POLICY_DNAME 6
- #define POLICY_DNSKEY 7
-+#define POLICY_TLSA_HOST 8
- 
- struct globals {
- 	struct stats {
-@@ -65,4 +66,10 @@ struct globals {
- 
- extern struct globals G;
- 
-+#define SHA1_BYTES 20
-+#define SHA256_BYTES 32
-+#define SHA512_BYTES 64
-+/* GOST R 34.11-94 - 32 bytes */
-+#define GOST_BYTES 32
-+
- #endif
-diff --git a/dname.c b/dname.c
-index 10e31e3..c7bc061 100644
---- a/dname.c
-+++ b/dname.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -23,7 +23,7 @@ static struct rr *dname_parse(char *name, long ttl, int type, char *s)
- {
- 	struct rr_dname *rr = getmem(sizeof(*rr));
- 
--	rr->target = extract_name(&s, "dname target");
-+	rr->target = extract_name(&s, "dname target", 0);
- 	if (!rr->target)
- 		return NULL;
- 	if (*s) {
-diff --git a/dnskey.c b/dnskey.c
-index f0bae0b..3ec6b4e 100644
---- a/dnskey.c
-+++ b/dnskey.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/ds.c b/ds.c
-index a7f4d26..7f3cdfa 100644
---- a/ds.c
-+++ b/ds.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -39,25 +39,20 @@ static struct rr* ds_parse(char *name, long ttl, int type, char *s)
- 
- 	/* See http://www.iana.org/assignments/ds-rr-types/ds-rr-types.xml
- 	 * for valid digest types. */
--	/*
--		SHA-1 20 bytes
--		SHA-256 32 bytes
--		GOST R 34.11-94 32 bytes
--	*/
- 	switch (digest_type) {
- 	case 1:
--		if (rr->digest.length != 20) {
--			return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, 20);
-+		if (rr->digest.length != SHA1_BYTES) {
-+			return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES);
- 		}
- 		break;
- 	case 2:
--		if (rr->digest.length != 32) {
--			return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, 32);
-+		if (rr->digest.length != SHA256_BYTES) {
-+			return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES);
- 		}
- 		break;
- 	case 3:
--		if (rr->digest.length != 32) {
--			return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, 32);
-+		if (rr->digest.length != GOST_BYTES) {
-+			return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES);
- 		}
- 		break;
- 	default:
-diff --git a/hinfo.c b/hinfo.c
-index 882e49c..980426e 100644
---- a/hinfo.c
-+++ b/hinfo.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/l32.c b/l32.c
-new file mode 100644
-index 0000000..13e7bf6
---- /dev/null
-+++ b/l32.c
-@@ -0,0 +1,60 @@
-+/*
-+ * Part of DNS zone file validator `validns`.
-+ *
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-+ * Modified BSD license.
-+ * (See LICENSE file in the distribution.)
-+ *
-+ */
-+#include <sys/types.h>
-+#include <stdio.h>
-+#include <netinet/in.h>
-+#include <arpa/inet.h>
-+
-+#include "common.h"
-+#include "textparse.h"
-+#include "mempool.h"
-+#include "carp.h"
-+#include "rr.h"
-+
-+static struct rr *l32_parse(char *name, long ttl, int type, char *s)
-+{
-+	struct rr_l32 *rr = getmem(sizeof(*rr));
-+	struct in_addr ipv4_like;
-+	int preference;
-+
-+	rr->preference = preference = extract_integer(&s, "L32 preference");
-+	if (preference < 0)
-+		return NULL;
-+	if (extract_ipv4(&s, "Locator32", &ipv4_like) <= 0)
-+		return NULL;
-+	rr->locator32 = ipv4_like.s_addr;
-+
-+	if (*s) {
-+		return bitch("garbage after valid L32 data");
-+	}
-+
-+	return store_record(type, name, ttl, rr);
-+}
-+
-+static char* l32_human(struct rr *rrv)
-+{
-+	RRCAST(l32);
-+    char s[1024];
-+
-+    snprintf(s, 1024, "%d %d.%d.%d.%d",
-+	     rr->preference,
-+		 (rr->locator32 >> 24) & 0xff,
-+		 (rr->locator32 >> 16) & 0xff,
-+		 (rr->locator32 >> 8) & 0xff,
-+		 (rr->locator32 >> 0) & 0xff);
-+    return quickstrdup_temp(s);
-+}
-+
-+static struct binary_data l32_wirerdata(struct rr *rrv)
-+{
-+	RRCAST(l32);
-+    return compose_binary_data("24", 1, rr->preference, rr->locator32);
-+}
-+
-+struct rr_methods l32_methods = { l32_parse, l32_human, l32_wirerdata, NULL, NULL };
-diff --git a/l64.c b/l64.c
-new file mode 100644
-index 0000000..bccf25d
---- /dev/null
-+++ b/l64.c
-@@ -0,0 +1,58 @@
-+/*
-+ * Part of DNS zone file validator `validns`.
-+ *
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-+ * Modified BSD license.
-+ * (See LICENSE file in the distribution.)
-+ *
-+ */
-+#include <sys/types.h>
-+#include <stdio.h>
-+#include <netinet/in.h>
-+#include <arpa/inet.h>
-+
-+#include "common.h"
-+#include "textparse.h"
-+#include "mempool.h"
-+#include "carp.h"
-+#include "rr.h"
-+
-+static struct rr *l64_parse(char *name, long ttl, int type, char *s)
-+{
-+	struct rr_l64 *rr = getmem(sizeof(*rr));
-+	int preference;
-+
-+	rr->preference = preference = extract_integer(&s, "L64 preference");
-+	if (preference < 0)
-+		return NULL;
-+	if (extract_u64(&s, "Locator64", &rr->locator64) < 0)
-+		return NULL;
-+
-+	if (*s) {
-+		return bitch("garbage after valid L64 data");
-+	}
-+
-+	return store_record(type, name, ttl, rr);
-+}
-+
-+static char* l64_human(struct rr *rrv)
-+{
-+	RRCAST(l64);
-+    char s[1024];
-+
-+    snprintf(s, 1024, "%d %x:%x:%x:%x",
-+	     rr->preference,
-+		 (unsigned)(rr->locator64 >> 48) & 0xffff,
-+		 (unsigned)(rr->locator64 >> 32) & 0xffff,
-+		 (unsigned)(rr->locator64 >> 16) & 0xffff,
-+		 (unsigned)(rr->locator64 >> 0) & 0xffff);
-+    return quickstrdup_temp(s);
-+}
-+
-+static struct binary_data l64_wirerdata(struct rr *rrv)
-+{
-+	RRCAST(l64);
-+    return compose_binary_data("28", 1, rr->preference, rr->locator64);
-+}
-+
-+struct rr_methods l64_methods = { l64_parse, l64_human, l64_wirerdata, NULL, NULL };
-diff --git a/loc.c b/loc.c
-index 079afa3..17a949b 100644
---- a/loc.c
-+++ b/loc.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/lp.c b/lp.c
-new file mode 100644
-index 0000000..20f1eae
---- /dev/null
-+++ b/lp.c
-@@ -0,0 +1,56 @@
-+/*
-+ * Part of DNS zone file validator `validns`.
-+ *
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-+ * Modified BSD license.
-+ * (See LICENSE file in the distribution.)
-+ *
-+ */
-+#include <sys/types.h>
-+#include <stdio.h>
-+#include <netinet/in.h>
-+#include <arpa/inet.h>
-+
-+#include "common.h"
-+#include "textparse.h"
-+#include "mempool.h"
-+#include "carp.h"
-+#include "rr.h"
-+
-+static struct rr *lp_parse(char *name, long ttl, int type, char *s)
-+{
-+	struct rr_lp *rr = getmem(sizeof(*rr));
-+	int preference;
-+
-+	rr->preference = preference = extract_integer(&s, "LP preference");
-+	if (preference < 0)
-+		return NULL;
-+	rr->fqdn = extract_name(&s, "LP fqdn", 0);
-+	if (!rr->fqdn)
-+		return NULL;
-+
-+	if (*s) {
-+		return bitch("garbage after valid LP data");
-+	}
-+
-+	return store_record(type, name, ttl, rr);
-+}
-+
-+static char* lp_human(struct rr *rrv)
-+{
-+	RRCAST(lp);
-+	char s[1024];
-+
-+	snprintf(s, 1024, "%d %s",
-+			 rr->preference, rr->fqdn);
-+	return quickstrdup_temp(s);
-+}
-+
-+static struct binary_data lp_wirerdata(struct rr *rrv)
-+{
-+	RRCAST(lp);
-+    return compose_binary_data("2d", 1,
-+		rr->preference, name2wire_name(rr->fqdn));
-+}
-+
-+struct rr_methods lp_methods = { lp_parse, lp_human, lp_wirerdata, NULL, NULL };
-diff --git a/main.c b/main.c
-index 98d8ce3..80005b1 100644
---- a/main.c
-+++ b/main.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -41,7 +41,7 @@ static char *process_directive(char *s)
- 			return bitch("bad $ORIGIN format");
- 		}
- 		s = skip_white_space(s);
--		o = extract_name(&s, "$ORIGIN value");
-+		o = extract_name(&s, "$ORIGIN value", 0);
- 		if (!o) {
- 			return NULL;
- 		}
-@@ -112,7 +112,7 @@ read_zone_file(void)
- 					continue;
- 				} else {
- 					/* <domain-name> */
--					name = extract_name(&s, "record name");
-+					name = extract_name(&s, "record name", 0);
- 					if (!name)
- 						continue;
- 				}
-@@ -270,21 +270,25 @@ static void initialize_globals(void)
- 	for (i = 0; i <= T_MAX; i++) {
- 		rr_methods[i] = unknown_methods;
- 	}
--	rr_methods[T_A]            =          a_methods;
- 	rr_methods[T_AAAA]         =       aaaa_methods;
-+	rr_methods[T_A]            =          a_methods;
- 	rr_methods[T_CERT]         =       cert_methods;
- 	rr_methods[T_CNAME]        =      cname_methods;
- 	rr_methods[T_DNAME]        =      dname_methods;
- 	rr_methods[T_DNSKEY]       =     dnskey_methods;
- 	rr_methods[T_DS]           =         ds_methods;
- 	rr_methods[T_HINFO]        =      hinfo_methods;
-+	rr_methods[T_L32]          =        l32_methods;
-+	rr_methods[T_L64]          =        l64_methods;
- 	rr_methods[T_LOC]          =        loc_methods;
-+	rr_methods[T_LP]           =         lp_methods;
- 	rr_methods[T_MX]           =         mx_methods;
- 	rr_methods[T_NAPTR]        =      naptr_methods;
--	rr_methods[T_NS]           =         ns_methods;
--	rr_methods[T_NSEC]         =       nsec_methods;
--	rr_methods[T_NSEC3]        =      nsec3_methods;
-+	rr_methods[T_NID]          =        nid_methods;
- 	rr_methods[T_NSEC3PARAM]   = nsec3param_methods;
-+	rr_methods[T_NSEC3]        =      nsec3_methods;
-+	rr_methods[T_NSEC]         =       nsec_methods;
-+	rr_methods[T_NS]           =         ns_methods;
- 	rr_methods[T_PTR]          =        ptr_methods;
- 	rr_methods[T_RP]           =         rp_methods;
- 	rr_methods[T_RRSIG]        =      rrsig_methods;
-@@ -292,6 +296,7 @@ static void initialize_globals(void)
- 	rr_methods[T_SPF]          =        spf_methods;
- 	rr_methods[T_SRV]          =        srv_methods;
- 	rr_methods[T_SSHFP]        =      sshfp_methods;
-+	rr_methods[T_TLSA]         =       tlsa_methods;
- 	rr_methods[T_TXT]          =        txt_methods;
- }
- 
-@@ -341,6 +346,8 @@ main(int argc, char **argv)
- 				G.opt.policy_checks[POLICY_NS_ALIAS] = 1;
- 			} else if (strcmp(optarg, "rp-txt-exists") == 0) {
- 				G.opt.policy_checks[POLICY_RP_TXT_EXISTS] = 1;
-+			} else if (strcmp(optarg, "tlsa-host") == 0) {
-+				G.opt.policy_checks[POLICY_TLSA_HOST] = 1;
- 			} else {
- 				usage("unknown policy name");
- 			}
-diff --git a/mempool.c b/mempool.c
-index 6e8ff96..2fbb6d0 100644
---- a/mempool.c
-+++ b/mempool.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/mempool.h b/mempool.h
-index bd653e9..c887aac 100644
---- a/mempool.h
-+++ b/mempool.h
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/mx.c b/mx.c
-index 6f89581..70f4b12 100644
---- a/mx.c
-+++ b/mx.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -25,7 +25,7 @@ static struct rr *mx_parse(char *name, long ttl, int type, char *s)
- 	if (rr->preference < 0)
- 		return NULL;
- 	/* XXX preference range check */
--	rr->exchange = extract_name(&s, "MX exchange");
-+	rr->exchange = extract_name(&s, "MX exchange", 0);
- 	if (!rr->exchange)
- 		return NULL;
- 	if (*s) {
-diff --git a/naptr.c b/naptr.c
-index 457d549..4534ded 100644
---- a/naptr.c
-+++ b/naptr.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -58,7 +58,7 @@ static struct rr *naptr_parse(char *name, long ttl, int type, char *s)
- 		return NULL;
- 	rr->regexp = text;
- 
--	rr->replacement = extract_name(&s, "replacement");
-+	rr->replacement = extract_name(&s, "replacement", 0);
- 	if (!rr->replacement)
- 		return NULL;
- 
-diff --git a/nid.c b/nid.c
-new file mode 100644
-index 0000000..3cc8c41
---- /dev/null
-+++ b/nid.c
-@@ -0,0 +1,58 @@
-+/*
-+ * Part of DNS zone file validator `validns`.
-+ *
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-+ * Modified BSD license.
-+ * (See LICENSE file in the distribution.)
-+ *
-+ */
-+#include <sys/types.h>
-+#include <stdio.h>
-+#include <netinet/in.h>
-+#include <arpa/inet.h>
-+
-+#include "common.h"
-+#include "textparse.h"
-+#include "mempool.h"
-+#include "carp.h"
-+#include "rr.h"
-+
-+static struct rr *nid_parse(char *name, long ttl, int type, char *s)
-+{
-+	struct rr_nid *rr = getmem(sizeof(*rr));
-+	int preference;
-+
-+	rr->preference = preference = extract_integer(&s, "NID preference");
-+	if (preference < 0)
-+		return NULL;
-+	if (extract_u64(&s, "NodeID", &rr->node_id) < 0)
-+		return NULL;
-+
-+	if (*s) {
-+		return bitch("garbage after valid NID data");
-+	}
-+
-+	return store_record(type, name, ttl, rr);
-+}
-+
-+static char* nid_human(struct rr *rrv)
-+{
-+	RRCAST(nid);
-+    char s[1024];
-+
-+    snprintf(s, 1024, "%d %x:%x:%x:%x",
-+	     rr->preference,
-+		 (unsigned)(rr->node_id >> 48) & 0xffff,
-+		 (unsigned)(rr->node_id >> 32) & 0xffff,
-+		 (unsigned)(rr->node_id >> 16) & 0xffff,
-+		 (unsigned)(rr->node_id >> 0) & 0xffff);
-+    return quickstrdup_temp(s);
-+}
-+
-+static struct binary_data nid_wirerdata(struct rr *rrv)
-+{
-+	RRCAST(nid);
-+    return compose_binary_data("28", 1, rr->preference, rr->node_id);
-+}
-+
-+struct rr_methods nid_methods = { nid_parse, nid_human, nid_wirerdata, NULL, NULL };
-diff --git a/ns.c b/ns.c
-index 3f486db..e920eae 100644
---- a/ns.c
-+++ b/ns.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -22,7 +22,7 @@ static struct rr *ns_parse(char *name, long ttl, int type, char *s)
- 	struct rr_ns *rr = getmem(sizeof(*rr));
- 	struct rr *ret_rr;
- 
--	rr->nsdname = extract_name(&s, "name server domain name");
-+	rr->nsdname = extract_name(&s, "name server domain name", 0);
- 	if (!rr->nsdname)
- 		return NULL;
- 	if (*s) {
-diff --git a/nsec.c b/nsec.c
-index 789b29d..d76b6ad 100644
---- a/nsec.c
-+++ b/nsec.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -25,7 +25,7 @@ static struct rr* nsec_parse(char *name, long ttl, int type, char *s)
- 	char *str_type = NULL;
- 	int ltype;
- 
--    rr->next_domain = extract_name(&s, "next domain");
-+    rr->next_domain = extract_name(&s, "next domain", KEEP_CAPITALIZATION);
- 	/* TODO: validate next_domain, http://tools.ietf.org/html/rfc4034#section-4.1.1 */
- 
- 	bitmap = new_set();
-@@ -33,6 +33,8 @@ static struct rr* nsec_parse(char *name, long ttl, int type, char *s)
- 		str_type = extract_label(&s, "type list", "temporary");
- 		if (!str_type) return NULL;
- 		ltype = str2rdtype(str_type);
-+		if (ltype < 0)
-+			return NULL;
- 		add_bit_to_set(&bitmap, ltype);
- 	}
- 	if (!s)
-diff --git a/nsec3.c b/nsec3.c
-index c390cdc..a7b8acb 100644
---- a/nsec3.c
-+++ b/nsec3.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -86,6 +86,8 @@ static struct rr* nsec3_parse(char *name, long ttl, int type, char *s)
- 		str_type = extract_label(&s, "type list", "temporary");
- 		if (!str_type) return NULL;
- 		ltype = str2rdtype(str_type);
-+		if (ltype < 0)
-+			return NULL;
- 		add_bit_to_set(&bitmap, ltype);
- 	}
- 	if (!s)
-diff --git a/nsec3checks.c b/nsec3checks.c
-index e9d157b..ef54ab2 100644
---- a/nsec3checks.c
-+++ b/nsec3checks.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -91,6 +91,7 @@ void perform_remaining_nsec3checks(void)
- 	while (named_rr_p) {
- 		named_rr = *named_rr_p;
- 		if ((named_rr->flags & mask) == NAME_FLAG_KIDS_WITH_RECORDS) {
-+//fprintf(stderr, "--- need nsec3, kids with records: %s\n", named_rr->name);
- needs_nsec3:
- 			freeall_temp();
- 			hash = name2hash(named_rr->name, nsec3param);
-@@ -119,10 +120,24 @@ needs_nsec3:
- 					(NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_SIGNED_DELEGATION)) ==
- 				   NAME_FLAG_SIGNED_DELEGATION)
- 		{
-+//fprintf(stderr, "--- need nsec3, signed delegation: %s\n", named_rr->name);
- 			goto needs_nsec3;
--		} else if (!G.nsec3_opt_out_present && (named_rr->flags & NAME_FLAG_DELEGATION))
-+		} else if (!G.nsec3_opt_out_present && (named_rr->flags &
-+					(NAME_FLAG_APEX_PARENT|NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_DELEGATION|NAME_FLAG_HAS_RECORDS)) ==
-+				   0)
- 		{
-+//fprintf(stderr, "--- need nsec3, empty non-term: %s\n", named_rr->name);
- 			goto needs_nsec3;
-+		} else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE))==NAME_FLAG_DELEGATION)
-+		{
-+//fprintf(stderr, "--- need nsec3, no opt-out: %s\n", named_rr->name);
-+			goto needs_nsec3;
-+		} else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_THIS_WITH_RECORDS|NAME_FLAG_NOT_AUTHORITATIVE)) == NAME_FLAG_THIS_WITH_RECORDS)
-+		{
-+//fprintf(stderr, "--- need nsec3, this with records: %s\n", named_rr->name);
-+			goto needs_nsec3;
-+		} else {
-+//fprintf(stderr, "--- NO need for nsec3: %s\n", named_rr->name);
- 		}
- next:
- 		JSLN(named_rr_p, zone_data, sorted_name);
-diff --git a/nsec3param.c b/nsec3param.c
-index 3c24162..539ef80 100644
---- a/nsec3param.c
-+++ b/nsec3param.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/ptr.c b/ptr.c
-index 8cf1c96..8164ef2 100644
---- a/ptr.c
-+++ b/ptr.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -21,7 +21,7 @@ static struct rr *ptr_parse(char *name, long ttl, int type, char *s)
- {
- 	struct rr_ptr *rr = getmem(sizeof(*rr));
- 
--	rr->ptrdname = extract_name(&s, "name server domain name");
-+	rr->ptrdname = extract_name(&s, "name server domain name", 0);
- 	if (!rr->ptrdname)
- 		return NULL;
- 	if (*s) {
-diff --git a/rp.c b/rp.c
-index 6c2a5fd..9f77c49 100644
---- a/rp.c
-+++ b/rp.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -22,11 +22,11 @@ static struct rr *rp_parse(char *name, long ttl, int type, char *s)
- {
- 	struct rr_rp *rr = getmem(sizeof(*rr));
- 
--	rr->mbox_dname = extract_name(&s, "mbox domain name");
-+	rr->mbox_dname = extract_name(&s, "mbox domain name", 0);
- 	if (!rr->mbox_dname)
- 		return NULL;
- 
--	rr->txt_dname = extract_name(&s, "txt domain name");
-+	rr->txt_dname = extract_name(&s, "txt domain name", 0);
- 	if (!rr->txt_dname)
- 		return NULL;
- 
-diff --git a/rr.c b/rr.c
-index 9ab475f..f47328d 100644
---- a/rr.c
-+++ b/rr.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -71,12 +71,19 @@ static char* rdtype2str_map[T_MAX+1] = {
- 	"DHCID",
- 	"NSEC3", /* 50 */
- 	"NSEC3PARAM",
--	0, 0, 0, 0, 0, 0, 0, 0, 0, /* 60 */
-+	"TLSA",
-+	      0, 0, 0, 0, 0, 0, 0, 0, /* 60 */
- 	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 70 */
- 	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 80 */
- 	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 90 */
- 	0, 0, 0, 0, 0, 0, 0, 0,
--	"SPF"
-+	"SPF",
-+	                           0, /* 100 */
-+	0, 0, 0,
-+	"NID",
-+	"L32",
-+	"L64",
-+	"LP",
- };
- void *zone_data = NULL;
- char *zone_apex = NULL;
-@@ -474,6 +481,12 @@ int str2rdtype(char *rdtype)
- 	case 'l':
- 		if (strcmp(rdtype, "loc") == 0) {
- 			return T_LOC;
-+		} else if (strcmp(rdtype, "l32") == 0) {
-+			return T_L32;
-+		} else if (strcmp(rdtype, "l64") == 0) {
-+			return T_L64;
-+		} else if (strcmp(rdtype, "lp") == 0) {
-+			return T_LP;
- 		}
- 		break;
- 	case 'm':
-@@ -490,6 +503,8 @@ int str2rdtype(char *rdtype)
- 			return T_NSEC;
- 		} else if (strcmp(rdtype, "nsec3") == 0) {
- 			return T_NSEC3;
-+		} else if (strcmp(rdtype, "nid") == 0) {
-+			return T_NID;
- 		} else if (strcmp(rdtype, "nsec3param") == 0) {
- 			return T_NSEC3PARAM;
- 		}
-@@ -520,6 +535,8 @@ int str2rdtype(char *rdtype)
- 	case 't':
- 		if (strcmp(rdtype, "txt") == 0) {
- 			return T_TXT;
-+		} else if (strcmp(rdtype, "tlsa") == 0) {
-+			return T_TLSA;
- 		} else if (strncmp(rdtype, "type", 4) == 0) {
- 			long type = strtol(rdtype+4, NULL, 10);
- 			if (type <= 0 || type > 65535)
-@@ -560,12 +577,43 @@ void validate_rrset(struct rr_set *rr_set)
- 	}
- }
- 
-+void debug(struct named_rr *named_rr, char *s)
-+{
-+	fprintf(stderr, "%s %s", s, named_rr->name);
-+	if ((named_rr->flags & NAME_FLAG_APEX))
-+		fprintf(stderr, ", apex");
-+	if ((named_rr->flags & NAME_FLAG_HAS_RECORDS))
-+		fprintf(stderr, ", has records");
-+	if ((named_rr->flags & NAME_FLAG_DELEGATION))
-+		fprintf(stderr, ", delegation");
-+	if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE))
-+		fprintf(stderr, ", not auth");
-+	if ((named_rr->flags & NAME_FLAG_NSEC3_ONLY))
-+		fprintf(stderr, ", nsec3 only");
-+	if ((named_rr->flags & NAME_FLAG_KIDS_WITH_RECORDS))
-+		fprintf(stderr, ", kid records");
-+	if ((named_rr->flags & NAME_FLAG_SIGNED_DELEGATION))
-+		fprintf(stderr, ", signed delegation");
-+	if ((named_rr->flags & NAME_FLAG_APEX_PARENT))
-+		fprintf(stderr, ", apex parent");
-+	fprintf(stderr, "\n");
-+}
-+
- void validate_named_rr(struct named_rr *named_rr)
- {
- 	Word_t rdtype;
- 	struct rr_set **rr_set_p;
- 	int nsec3_present = 0;
- 	int nsec3_only = 1;
-+	static int seen_apex = 0;
-+
-+	rdtype = 0;
-+	JLF(rr_set_p, named_rr->rr_sets, rdtype);
-+
-+	if ((named_rr->flags & NAME_FLAG_APEX))
-+		seen_apex = 1;
-+	if (!seen_apex)
-+		named_rr->flags |= NAME_FLAG_APEX_PARENT;
- 
- 	if (named_rr->parent && (named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) {
- 		named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE;
-@@ -573,24 +621,30 @@ void validate_named_rr(struct named_rr *named_rr)
- 			G.stats.not_authoritative++;
- 		}
- 	}
--	rdtype = 0;
--	JLF(rr_set_p, named_rr->rr_sets, rdtype);
-+//debug(named_rr, ">>>>");
-+
- 	while (rr_set_p) {
- 		validate_rrset(*rr_set_p);
- 		if (rdtype == T_NSEC3)
- 			nsec3_present = 1;
- 		else if (rdtype != T_RRSIG)
- 			nsec3_only = 0;
-+		if (rdtype != T_NSEC3 && rdtype != T_RRSIG && rdtype != T_NS)
-+			named_rr->flags |= NAME_FLAG_THIS_WITH_RECORDS;
- 		if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE) == 0 &&
- 			rdtype != T_NS && rdtype != T_NSEC3 && rdtype != T_RRSIG)
- 		{
- 			struct named_rr *nrr = named_rr;
-+			int skip_first = rdtype == T_NS;
-+
- 			while (nrr && (nrr->flags & NAME_FLAG_KIDS_WITH_RECORDS) == 0) {
- 				if ((nrr->flags & NAME_FLAG_APEX_PARENT) || strlen(nrr->name) < zone_apex_l) {
- 					nrr->flags |= NAME_FLAG_APEX_PARENT;
- 					break;
- 				}
--				nrr->flags |= NAME_FLAG_KIDS_WITH_RECORDS;
-+				if (!skip_first)
-+					nrr->flags |= NAME_FLAG_KIDS_WITH_RECORDS;
-+				skip_first = 0;
- 				nrr = nrr->parent;
- 			}
- 		}
-@@ -607,6 +661,7 @@ void validate_named_rr(struct named_rr *named_rr)
- 	if (nsec3_present && nsec3_only) {
- 		named_rr->flags |= NAME_FLAG_NSEC3_ONLY;
- 	}
-+//debug(named_rr, "<<<<");
- }
- 
- 
-@@ -633,7 +688,7 @@ static void* nsec_validate_pass2(struct rr *rrv)
- 		break;
- 	}
- 
--	if (strcmp(rr->next_domain, zone_apex) == 0) {
-+	if (strcasecmp(rr->next_domain, zone_apex) == 0) {
- 		if (next_named_rr) {
- 			return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s is the last name, but %s exists",
- 						named_rr->name, next_named_rr->name);
-@@ -642,7 +697,7 @@ static void* nsec_validate_pass2(struct rr *rrv)
- 		if (!next_named_rr) {
- 			return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but nothing does",
- 						rr->next_domain, named_rr->name);
--		} else if (strcmp(rr->next_domain, next_named_rr->name) != 0) {
-+		} else if (strcasecmp(rr->next_domain, next_named_rr->name) != 0) {
- 			return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but %s does",
- 						rr->next_domain, named_rr->name, next_named_rr->name);
- 		}
-diff --git a/rr.h b/rr.h
-index 35abd6d..7685eff 100644
---- a/rr.h
-+++ b/rr.h
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -31,8 +31,13 @@
- #define T_DNSKEY	48
- #define T_NSEC3	50
- #define T_NSEC3PARAM	51
-+#define T_TLSA	52
- #define T_SPF	99
--#define T_MAX	99
-+#define T_NID	104
-+#define T_L32	105
-+#define T_L64	106
-+#define T_LP	107
-+#define T_MAX	107
- 
- #define ALG_DSA                  3
- #define ALG_RSASHA1              5
-@@ -96,14 +101,15 @@ struct binary_data name2wire_name(char *s);
- int algorithm_type(int alg);
- int extract_algorithm(char **s, char *what);
- 
--#define NAME_FLAG_APEX                1
--#define NAME_FLAG_HAS_RECORDS         2
--#define NAME_FLAG_DELEGATION          4
--#define NAME_FLAG_NOT_AUTHORITATIVE   8
--#define NAME_FLAG_NSEC3_ONLY          16
--#define NAME_FLAG_KIDS_WITH_RECORDS   32
--#define NAME_FLAG_SIGNED_DELEGATION   64
-+#define NAME_FLAG_APEX                  1
-+#define NAME_FLAG_HAS_RECORDS           2
-+#define NAME_FLAG_DELEGATION            4
-+#define NAME_FLAG_NOT_AUTHORITATIVE     8
-+#define NAME_FLAG_NSEC3_ONLY           16
-+#define NAME_FLAG_KIDS_WITH_RECORDS    32
-+#define NAME_FLAG_SIGNED_DELEGATION    64
- #define NAME_FLAG_APEX_PARENT         128
-+#define NAME_FLAG_THIS_WITH_RECORDS   256
- 
- struct named_rr
- {
-@@ -171,11 +177,53 @@ extern struct rr_methods ns_methods;
- struct rr_txt
- {
-     struct rr rr;
--	int count;
-+    int count;
-     struct binary_data txt[1];
- };
- extern struct rr_methods txt_methods;
- 
-+struct rr_tlsa
-+{
-+    struct rr rr;
-+    uint8_t cert_usage;
-+    uint8_t selector;
-+    uint8_t matching_type;
-+    struct binary_data association_data;
-+};
-+extern struct rr_methods tlsa_methods;
-+
-+struct rr_nid
-+{
-+    struct rr rr;
-+    uint16_t preference;
-+    uint64_t node_id;
-+};
-+extern struct rr_methods nid_methods;
-+
-+struct rr_l32
-+{
-+    struct rr rr;
-+    uint16_t preference;
-+    uint32_t locator32;
-+};
-+extern struct rr_methods l32_methods;
-+
-+struct rr_l64
-+{
-+    struct rr rr;
-+    uint16_t preference;
-+    uint64_t locator64;
-+};
-+extern struct rr_methods l64_methods;
-+
-+struct rr_lp
-+{
-+    struct rr rr;
-+    uint16_t preference;
-+    char *fqdn;
-+};
-+extern struct rr_methods lp_methods;
-+
- struct rr_naptr
- {
-     struct rr rr;
-diff --git a/rrsig.c b/rrsig.c
-index 8e7930a..81befa6 100644
---- a/rrsig.c
-+++ b/rrsig.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -84,7 +84,7 @@ static struct rr* rrsig_parse(char *name, long ttl, int type, char *s)
- 	if (key_tag < 0)	return NULL;
- 	rr->key_tag = key_tag;
- 
--	rr->signer = extract_name(&s, "signer name");
-+	rr->signer = extract_name(&s, "signer name", 0);
- 	if (!rr->signer) return NULL;
- 	/* TODO validate signer name, http://tools.ietf.org/html/rfc4034#section-3.1.7 */
- 
-diff --git a/soa.c b/soa.c
-index 1bc9a42..9e70a09 100644
---- a/soa.c
-+++ b/soa.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -22,9 +22,9 @@ static struct rr* soa_parse(char *name, long ttl, int type, char *s)
- 	struct rr_soa *rr = getmem(sizeof(*rr));
- 	long long i;
- 
--	rr->mname = extract_name(&s, "mname");
-+	rr->mname = extract_name(&s, "mname", 0);
- 	if (!rr->mname) return NULL;
--	rr->rname = extract_name(&s, "rname");
-+	rr->rname = extract_name(&s, "rname", 0);
- 	if (!rr->rname) return NULL;
- 	i = extract_integer(&s, "serial");
- 	if (i < 0) return NULL;
-diff --git a/spf.c b/spf.c
-index efe76c5..5cb1c82 100644
---- a/spf.c
-+++ b/spf.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/srv.c b/srv.c
-index 4683003..e606354 100644
---- a/srv.c
-+++ b/srv.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -45,7 +45,7 @@ static struct rr *srv_parse(char *name, long ttl, int type, char *s)
- 		return bitch("port range is not valid");
- 	rr->port = i;
- 
--	rr->target = extract_name(&s, "target");
-+	rr->target = extract_name(&s, "target", 0);
- 	if (!rr->target)
- 		return NULL;
- 
-diff --git a/sshfp.c b/sshfp.c
-index b10a5ff..ec9c03f 100644
---- a/sshfp.c
-+++ b/sshfp.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -36,9 +36,9 @@ static struct rr* sshfp_parse(char *name, long ttl, int type, char *s)
- 
- 	rr->fingerprint = extract_hex_binary_data(&s, "fingerprint", EXTRACT_EAT_WHITESPACE);
- 	if (rr->fingerprint.length < 0)	return NULL;
--	if (rr->fingerprint.length != 20) {
-+	if (rr->fingerprint.length != SHA1_BYTES) {
- 		return bitch("wrong SHA-1 fingerprint length: %d bytes found, %d bytes expected",
--					 rr->fingerprint.length, 20);
-+					 rr->fingerprint.length, SHA1_BYTES);
- 	}
- 
- 	if (*s) {
-diff --git a/t/issues/21-nsec3-without-corresponding/Kexample.sec.+008+48381.key b/t/issues/21-nsec3-without-corresponding/Kexample.sec.+008+48381.key
-new file mode 100644
-index 0000000..e9cd610
---- /dev/null
-+++ b/t/issues/21-nsec3-without-corresponding/Kexample.sec.+008+48381.key
-@@ -0,0 +1 @@
-+example.sec. IN DNSKEY 256 3 8 AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg273Tp4oRpnmnmgizDFtLQh nIv1Mr3AuwSWVIDeavuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90yQwf C53hxyH10GzGnAx4Sutrdkh1w4HM1nMBdlTMa0g9yxjJ0vm/T7qHzj+3 dTUi84s8Du2mfMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB/QUuoY2F yThfidT+nhOQpzftVtLcta0E0Uv3PcVDp1d7vBXsAEYGHr54r2vb3eXd OTmoFyh/byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01u8SJYP6ULwx0 mZ0p5BmoMH8=
-diff --git a/t/issues/21-nsec3-without-corresponding/Kexample.sec.+008+48381.private b/t/issues/21-nsec3-without-corresponding/Kexample.sec.+008+48381.private
-new file mode 100644
-index 0000000..5beec83
---- /dev/null
-+++ b/t/issues/21-nsec3-without-corresponding/Kexample.sec.+008+48381.private
-@@ -0,0 +1,10 @@
-+Private-key-format: v1.2
-+Algorithm: 8 (RSASHA256)
-+Modulus: 1k6+cu1N1CN90iqofey1vu8jpsmWDbvdOnihGmeaeaCLMMW0tCGci/UyvcC7BJZUgN5q+6LJYgC1+/DLR/cRgi/xizmQOIqzw8TWT3TJDB8LneHHIfXQbMacDHhK62t2SHXDgczWcwF2VMxrSD3LGMnS+b9PuofOP7d1NSLzizwO7aZ8wPqejL6V5nYi5fuUVxrxLMM2aFQ9ORe4WsH9BS6hjYXJOF+J1P6eE5CnN+1W0ty1rQTRS/c9xUOnV3u8FewARgYevniva9vd5d05OagXKH9vJ6FSU+rWAMQfSYFGVZtQepsacrKiXPR1HTW7xIlg/pQvDHSZnSnkGagwfw==
-+PublicExponent: AQAB
-+PrivateExponent: LOxwy9Km3/NYqre6fjsilhW3GX1kcRiSdXFYBBr3rMtUojKvgJsTH9uUeWZvTbTdne4B6yHiqSKRA3Eki79k8i9uqMq2SsP4ju8yJZHLmzjezIfJoHrQ6BxyFcMZoWPzdZkKFKmFwrHpxjjbvFcHvfiAu025Pta9C2o/rZXYC7V3BWQowqYBfukdpZkCEhzFzEtC1ROXN4jPJBwNIma52QTLH6jK5BOfOJ5DhS1SF+r/EkuvXnylApVfjPfUIC8ocVvpn5WLoabWL+eURIi6MvVT59ppzc6WRUT2PxDskT2WUWfw3zq5B7JCM8/qfYIDUHvt1h6JcJHTAOz9Hr2f4Q==
-+Prime1: 8UNey2U7voMhZmVUMpH5C8q7+hp6PQ6dUYd+hjaQVnsDOLPBT+zZf8R3str7pY/xlOOHy+DxYmZ0e17OumSOXTeQR4VSdsr/tpWc/qd2jd1I5N58R4G/yZHgTm8pm6VRb7NwZ7Eg6o2z0G2UEykFeberyg4U6SHBDP6DZNvGrQk=
-+Prime2: 42XeoQUBshFkTYekdeqPfGqC1YXsK0URLGAbPbk8HlOiG7ueVmUnsAS47lyuEJPzIUgqqBbDM+CCdW8AvPJFDXa09l4akfCrLRyAdkreGj3bgmUs5wUFbDZyOHvRFSxdUI8LOcAhXthy86l+wErKwm6sWfd1oPGvMmC1qiSsW0c=
-+Exponent1: JpdjK1+3DcNF7W4Z6LjmwFceeGQR14Bl86ubtnY14k9s9X3zVwiIxeI0T1yt0g7TUsCOcTM7CUVgLne8053QE+MWZgpSZYQVISyPX0CEOy8BQPLBqGJ9vg1idslbO3VXMGngegWgQUSHVbihbesq4AxcI0bbW2s1yRFRDSoGfpk=
-+Exponent2: NbR7bd/21I1S+RSN/ONW2/VzzOYCLv3y3l4cUOmMj0UFRjN7Y8AkLWgQHQt6eKPYigW3PVeS5o+hgAalT/qP4GwmtQDomYsTgmX22Pk5l00AqL0oa6895p69PyXO7Yc6yqnd5te/idzo2S8wpk2DsYPd5KmS+F3cGLPKc9KRekU=
-+Coefficient: ev+8Aj3u6mICRe6Y0NqYTGrXSBMDXf92dI4+CZtwy43cyTvvZSABWvlLTTXf8XAlnnPxszSpG7+e8bQk4A7ZIagcDFSUjzwtVoLqKqbyLPMNjJKqvGW2iTwfpXAHTadd9EmvTPsEVCJnZAvkyn9XQ49phL9IkFzj9kmSrGqnN4Q=
-diff --git a/t/issues/21-nsec3-without-corresponding/dsset-example.sec. b/t/issues/21-nsec3-without-corresponding/dsset-example.sec.
-new file mode 100644
-index 0000000..b4019ef
---- /dev/null
-+++ b/t/issues/21-nsec3-without-corresponding/dsset-example.sec.
-@@ -0,0 +1,2 @@
-+example.sec.		IN DS 48381 8 1 99477B577BF885AB2512B8DCA052D7B71DD968BA
-+example.sec.		IN DS 48381 8 2 E5411AAE0758711B164730F9069CCFA3CAB00391FDD76D04EB3E8610 CAA09E93
-diff --git a/t/issues/21-nsec3-without-corresponding/example.sec b/t/issues/21-nsec3-without-corresponding/example.sec
-new file mode 100644
-index 0000000..352b4e6
---- /dev/null
-+++ b/t/issues/21-nsec3-without-corresponding/example.sec
-@@ -0,0 +1,17 @@
-+$TTL    1d
-+$INCLUDE Kexample.sec.+008+48381.key
-+@       IN      SOA     ns.example.sec. hostmaster.example.sec. (
-+                              1         ; Serial
-+                         604800         ; Refresh
-+                          86400         ; Retry
-+                        2419200         ; Expire
-+                         604800 )       ; Negative Cache TTL
-+
-+        IN      NS      ns1.example.net.
-+1.1.1.1.1.1.1.1.1.1.33  IN      NS      ns1.example.net.
-+
-+6.5.4.3.2.33  IN      NS      ns1.example.net.
-+9.8.7.6.5.4.3.2.33  IN      NS      ns1.example.net.
-+
-+
-+bebe.meme IN A 1.2.3.4
-diff --git a/t/issues/21-nsec3-without-corresponding/example.sec.signed b/t/issues/21-nsec3-without-corresponding/example.sec.signed
-new file mode 100644
-index 0000000..c574155
---- /dev/null
-+++ b/t/issues/21-nsec3-without-corresponding/example.sec.signed
-@@ -0,0 +1,334 @@
-+; File written on Fri Aug 24 16:33:53 2012
-+; dnssec_signzone version 9.8.3
-+example.sec.		86400	IN SOA	ns.example.sec. hostmaster.example.sec. (
-+					1          ; serial
-+					604800     ; refresh (1 week)
-+					86400      ; retry (1 day)
-+					2419200    ; expire (4 weeks)
-+					604800     ; minimum (1 week)
-+					)
-+			86400	RRSIG	SOA 8 2 86400 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					QySkSzvLPglLtsg976XY0GAdDCzZY9IEiVrn
-+					PAsFloXokhd3sYDi+/Wg+XNNPasoqvUv75c9
-+					JYbXyV9ZF0axe7TVvCmynNi2fn5xvfU3MbiX
-+					bQqkoJq708xLtxkDjkKj4wo7aLfNXqItdvlG
-+					8MBNI7lUMd9V1EAp1+sKz4oCbAm67dUZsJTs
-+					NNQewA2NTkZG8SLU12ueBoEm3SFIkDaGf3pr
-+					BqFKnKo7Dpi5quPydRyZv23lDkAFv86eMBky
-+					7Ftz5JSnTrxQ96J5idVzc+8V2VJJLCMps/Lg
-+					0f8EWXU13oy8hVNHgsbMkMgwuhK0TpoAQ3Xu
-+					12I+iB9gXmOB7S1TWw== )
-+			86400	NS	ns1.example.net.
-+			86400	RRSIG	NS 8 2 86400 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					jq61ICTW2ofwSICLNMF5DiPO1wH6Y8t/oDO6
-+					5Rz07pV02fSbEZXHpap4MLne0ikOqKPtFhsP
-+					qdircIdp9SccoXq1biKu+6yw0sGRwbR82Foq
-+					4LIgz9yoSr0W2bUICSaa7SZDtnqpTj9tyVVx
-+					9hFWM1DemqyU9k6wi3Qtvqyge9NRH2IbQstr
-+					Z6IhlpKlxeNR9P+H0aoYEoqfYIb8rSlv9KFq
-+					wB6HeBCgBl0rJ/EpHQI9P9SZzgvgVjzAgWzb
-+					yXCmwkDUoFNDaIt+6rbWIWxTO3NETVOPcCRh
-+					fWFJpahmKqy+7sQOdXYtOkUp4T48bMttktMN
-+					jGx0TDN6hDUWPOGKrA== )
-+			86400	DNSKEY	256 3 8 (
-+					AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27
-+					3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe
-+					avuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90
-+					yQwfC53hxyH10GzGnAx4Sutrdkh1w4HM1nMB
-+					dlTMa0g9yxjJ0vm/T7qHzj+3dTUi84s8Du2m
-+					fMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB
-+					/QUuoY2FyThfidT+nhOQpzftVtLcta0E0Uv3
-+					PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/
-+					byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01
-+					u8SJYP6ULwx0mZ0p5BmoMH8=
-+					) ; key id = 48381
-+			86400	RRSIG	DNSKEY 8 2 86400 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					CxJvtfEuhQr694uCQg6fyz2sAg+TqH242DnL
-+					BSidvv9GzKZdHiZs+iFfcrGC4nJ3pTeWMv5/
-+					zp2AXXkpJeCdW5Gy1xy9aexDRJuUMaFzE4xN
-+					v/QTdDzBWJBujDNM1C/HstntlQvOGLLTFGsY
-+					JCfVguYs0qqSPNd9fbDs7/edhMDe3f6v68+O
-+					UISrEgfy2PJpGeg5idX+63G4GE0OOa08dwUw
-+					LJQAGpobUjk3TjSh08jllQ21iQIdUV1pxfrC
-+					qBu2HH8ZMlSpk4ZoTsDKCNGy5VMQcRxtOOa6
-+					9kTcmhNakfxnK+24Wu+xjqmmIWBPKxtmhYfw
-+					IlzGSu2uuGd7PvwovA== )
-+			0	NSEC3PARAM 1 0 1 94CD
-+			0	RRSIG	NSEC3PARAM 8 2 0 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					N5gosx8Suslg27+3wPYAP8gXeH91Wc4ebH5H
-+					mZMkEL5b0ODgSvVgPhwTRRE1/SJGzXGWXSpW
-+					VopGKMh6SLBNAmfi6gsRtIfPutJA6hmqRtqK
-+					JiKEi6Sy3gRLKPJC1Hd/v8K2rslSoCFFsive
-+					w5cZBonS85f7n+BA9VglfQmPqux2/LvykcGS
-+					/tVGz5zZXWRdPPapj5e+TKrBfVglmcaIL9uk
-+					c4uMHtSkdwlKrXV2SCPK6H9meYIsEg8SvIXN
-+					Kx2Wfo3hvD9XINYRKwsN6FGFYrOvHpdJI/Mz
-+					QUZ70+nUQU4sbV3Y4yoHhI9Y8Dn8khdCqjCg
-+					ynbFt1GVrA0QobO9WQ== )
-+9.8.7.6.5.4.3.2.33.example.sec.	86400 IN NS ns1.example.net.
-+1.1.1.1.1.1.1.1.1.1.33.example.sec. 86400 IN NS	ns1.example.net.
-+6.5.4.3.2.33.example.sec. 86400	IN NS	ns1.example.net.
-+0A8475SNU6T5P84AMC4I7KAEAMKCMIAF.example.sec. 604800 IN	NSEC3 1 0 1 94CD 1F02V227102AEBUICGPQNPFSMSQ56UNC
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					mipK0k5i2YVpsDosay3tcOBgvykaBn9gaDJN
-+					/otEJTXurcfGkRria5C3AsTrq68PIhM9Ct5v
-+					bJxgaz0ab1hBHhDe8AZNVzrqrYWmmSgpNrBk
-+					VJTx3YnYUuO25MYEEh00/1/JYyHwaGdtjkoD
-+					KAwAUt7NqlLZjEHWlZUap+2sxeq1T6l6owDu
-+					xt/FNpb8QdUXYK5lsaqCWbNTHWQ3F8n49h1Y
-+					ve+m5NtbFL8+7qxrBRSC68eBTPrQfsAym4oB
-+					yU05KTFLgHgI7CrexI1dyx+mb19LA0IVKGas
-+					bo8lD20VQdiGuEflZj04rihXmJYGU/rNrV4r
-+					BhyABAvc26GMfGIa1w== )
-+4H7F6LT6O2L8EJJEK17S0MPTF3G1GMS3.example.sec. 604800 IN	NSEC3 1 0 1 94CD 6MMR4M238C6KQ7OL4J0HD33VSF2RBFE6
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					lX7thD4OK1v7YDU4waKvTR/YZN0c/jpLcZRh
-+					vEw/wVY6o2ZjC4DPmFlhHNDGcNil1Dtwxxnq
-+					iO4T6iNZOWWnnGy3WprLlO9hN6eZvC3c0jio
-+					uDynQyHytpwNIUtLSiHEqhNZUUt2f4BK0C6o
-+					oMFepT/+dKBuyK+FWWkjVswrhmPbpTvnKUOh
-+					ob2ONOh1UcOhjtTjl8kr51DnDe6/xOACCi4L
-+					a8UvTLRROvWUoQt4U7A8n4svrc7oYTh+lIfb
-+					I/6NYX6loVa9g1hiipx+Kn7VkcGGSTWP5lFv
-+					jx3nl9QyrqZYUMeCyF4FgYv2R029bxRJM4xN
-+					e03+Kwof3LuK6RiRhg== )
-+ANUH4A3TCIVO884LMD5SA3S1563VKCOG.example.sec. 604800 IN	NSEC3 1 0 1 94CD B23STANUG8J6J7Q86S978IDEOHR9SKOK NS SOA RRSIG DNSKEY NSEC3PARAM
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					z8HofxVlX+519QE5aW0uywdOA6O+YP8y5Yr5
-+					wJlyyLefw5Fti0dmU7qGzR5NoOxTfyH+lJDb
-+					7IPB5DaA4OI3wA6XCHJ1CVrNZJ7kKOt35L0N
-+					vR1cq89V0wISlfVSMa4Lh6qOvfjEFcpZOziQ
-+					+G9s2hYdKQIxHEAmX35H+ZK3yDuWKgGvZCiP
-+					wARqDipOzAbsgMUXUFT4/q1YhXENU44yxMGv
-+					QoZWskJ5bfrHWvZY/PDPQX18JziMM5zkL+sJ
-+					32HtIl2Ji3bPboqbGKrfXg35v6LR2oNl56Bq
-+					TTFFmGwUr0GOhJhtJOHxtxJ7gc6JBkn6MdG0
-+					Rm41tHPCdsJqi2eYZA== )
-+B48FHI6PGSEKSCPQHI53K69GG9QPT86F.example.sec. 604800 IN	NSEC3 1 0 1 94CD BUA7DPQPLLPMOFP3570HUGOCO0PMK9TI
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					ByAqe7JjTyKwuudzVHqZTQCtJLT3NSlKVGvQ
-+					EcpOVPr6f4VXHCpJ2U0uw1SgdzZgw/trIo0z
-+					MWY0MU94NDPZ0jt0G4Bz9CXF+MJSOmXF/G8D
-+					+DEvC0rdeAi3tMupIGMyAkkeL3hLiyo7FCBx
-+					SsuqWu0FQ5Gd2PTYUXiSX3ZG9NlTtDgjHtPS
-+					doAfO5ZtIJyLXUK6hWgEdNrfJOM/yDh7AS0y
-+					L7oHhk7xoGz+6U2ZoiScEIZ/wg2Ry02fvRgl
-+					CdkfQUAWctgpeBybCkImdlE18Ww3jPmknTcw
-+					fFpIsMGvdHW/yh7YMPibf9brn+l53DC52wQF
-+					hXENXf1Igy5KfMIgDQ== )
-+B23STANUG8J6J7Q86S978IDEOHR9SKOK.example.sec. 604800 IN	NSEC3 1 0 1 94CD B48FHI6PGSEKSCPQHI53K69GG9QPT86F
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					YpjhuKP/CxZi1+/xsnYlq3Hb6KmxjXu7NaZ7
-+					wL2+m1f5ffB8cu+1VMdMjXd9rA87KM+nZmIH
-+					ZgkM13BjscZYfZrD1QxTHZOpK98DsP0BVjab
-+					V3YxS99SrpWIWbsSGSnGuVnTIFg4Rc2Q7UY0
-+					cPz2aPbTSjaYtmE+b4DS5KtZpsQUOc/mlPU5
-+					1RiMkMOJqSnflQY922C43Xg/DaywBWaI18b1
-+					gyL5wMyZ2OU+I1EVK1e/Hgp3xTU+VZFfH981
-+					ooZvbHxTqvR2RPN/CiRmkb1j8OR8rtzQlAUq
-+					zE/N2G225694CXjbhnuxtMQDnARZ+YY59efI
-+					qRVe3R3RVwiIvnxubQ== )
-+1F02V227102AEBUICGPQNPFSMSQ56UNC.example.sec. 604800 IN	NSEC3 1 0 1 94CD 4H7F6LT6O2L8EJJEK17S0MPTF3G1GMS3
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					Sl0o9shH2wSZ11t342nNF8umWjmCc6aFTPab
-+					mhRnFDzzG2d++Cx4dXMsasDtUVspKQheiowA
-+					j6HZZSGYEQfmW8XFs5Hf4h0NVkQ83i3euXGl
-+					S1zbM0DiaGbNueIPSEyUBOyR1zzaBjzyhf6P
-+					axvora+y5Yb/UeiFQgvZY6JKBib9RHT61Dpk
-+					8C30CK+KpBRIAa3nu+oESqP+qe+UDF6Gia8t
-+					Mn/8BMP+j070A38lrMFjfGmKq5QzMKP86Jnl
-+					dG88wXSmUe1EzvUM7Y/djimPvGfSfIFl7J8t
-+					rhQ3Cfs/Etu92HfQEqAhCg94BCv95RJXf9rj
-+					6P2IRl7fn7tz8DPtcg== )
-+71FH7088MFQ3GHCT8F0NKT9PF3BT46CC.example.sec. 604800 IN	NSEC3 1 0 1 94CD ANUH4A3TCIVO884LMD5SA3S1563VKCOG
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					bFgJbtvnx6+ICYygvHrxhuCgZxcgUFA24pQl
-+					XwVUJqVgP+t8AfJ0GNURvoli4sxAa1ujJH/1
-+					pdDrSTUSswqBClKM+n0C5Z1ZVEDdGLMsjxfH
-+					hRcnUaup5dwC2gwvxUg7ZYxUjxeCiLOc2UEA
-+					7A/ASY/qwtMunGeXKFycY93k0F6udeFqnIFG
-+					jqR2yAoi271PbTkj7osSIJZJGi5bGIGlKDpu
-+					ht30LBfG243IlZeAm2nxg2vE9d4Nd+ZRlMJ0
-+					8H9vahBubbT0yfJiREnILL14i4FvST++5i1y
-+					iaSRJPH2rMUp4oSsTvh8W07LjiytOG8IJkyY
-+					T1A2UFL/DOBxD2O8nw== )
-+IR5OEOOO61L2NLSFRK4OLKUJ6FEARD1Q.example.sec. 604800 IN	NSEC3 1 0 1 94CD K9KP0QD9J3T0F3DH2LQPPB37CPPNP3PF
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					scrCa9zRBY4h4gHoe/esvDALkI7c6x6vXY4F
-+					pA7AnTb+L5WCrfp6tXiINwQ1Uvv16Olut162
-+					QHdAe7GW1XQGdbuJ8tzBtQ9YkS6DvArSYYjb
-+					KiHMFND1dvy5UBc7BWJwM7ysLwdjEfiYkKBs
-+					WIZ/bfE3MbT3qRou/Kv8WQa33ELlkZ7x6sEs
-+					5Era4soZ7SRzN4jba5r9TBwJoP9VQn7uNl2r
-+					h0hFclD4grfUcMZRcun3voVoVmpY/72xStsc
-+					r7btSUfDrzbcJP9W1WYcPDbsmyobY4QrYSCO
-+					VUzBP17DjEzIMztg+u5R7FhClb9lZ6qhrikW
-+					KtcOq3+nKs2JauRM4Q== )
-+BUA7DPQPLLPMOFP3570HUGOCO0PMK9TI.example.sec. 604800 IN	NSEC3 1 0 1 94CD DGRBPEHGU29PPOAAQS0TK0K8KJLI60CF NS
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					EveB6krVUhecm3eWRh55oiDuHOfceimuJSAy
-+					4KNd59B/+8FBB7U6KyaLm9YGZDP5d3wyP5Py
-+					4G8z6j7vdTGbLTFsHyOxHwU1MGEqZU4vIB7N
-+					LX3P42CjD9FKFfTLS8ig0HJaxa/wYRMoxvxa
-+					fIPZZxuC/NR6ULLr6t7YIWp+rktew0vXAaPP
-+					tgmfEU9zAMqYsnKhyTttTT543btuXfHBg9th
-+					csf9dEz+p/lq1WZbyTTR4hs7ZkRYLA6TCI9q
-+					vxee5Hsfhjv2k1B7YA1AFCikAt3xqbxcuhir
-+					KpW66JXjbrp5ZxONejbYb3SLdY3PpWg2Al2W
-+					WHSV6e0cVZ47QsIFzw== )
-+K9KP0QD9J3T0F3DH2LQPPB37CPPNP3PF.example.sec. 604800 IN	NSEC3 1 0 1 94CD MQAMDNGOIK8QUBPB4GDEG0EVOK91DQJ6
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					UFg9mb+GA3lmzuN/bJUdHf1o65i729zK0NUZ
-+					wQGscZD8q6vY+cPuaCGZxPBdIe0Jaf2XXzjp
-+					rJVyLwbdYVIR4IuoUZJLQbCfGOrBxp5BHTf8
-+					ybft2+7foWAAQc8GNvhYKkmEpHdyfUWLrj8x
-+					Z4U+NP1fdBvO43TN0upQyeYTNa6E4umgQtYa
-+					zkMXeeQWf4+vf0Ue14rCEtCOFN2BDksL4mJF
-+					c93c1MfRMkTYX/2L7dtAfDgwcywdU+ndqXJv
-+					XC60MFEJfj/7oHO3LUQd1XdkNqg4gnyx6TgN
-+					zBcUXgN40FUZzRTHf5sXikmhm1Jm5Akaaune
-+					NB0mJ4DVzw8XLdDy2A== )
-+MQAMDNGOIK8QUBPB4GDEG0EVOK91DQJ6.example.sec. 604800 IN	NSEC3 1 0 1 94CD PFQHTQGF3T3O7NQ37E7APPJS4E7G6FQI
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					aREhBMyCg3PaF9cbN2jS8Imj3GrfwrM2C3gU
-+					zVcJqD1SxPOGwr0UQq+IJxp2jf/4gKyGIU1V
-+					TQ2jFkdNLuF4tHtu4OQCAYwG7ngtawm/bT5J
-+					R7ecSVRQOmowEZa9/VbF8qN8EuTmB7L9wB2W
-+					2Efj6moE/Yt0SLJ5UIbRoKN5mJZaxjzWOif5
-+					F+xE7yi2JVOve4mbAkxV/cqYInksWedvrKZt
-+					SMBkIYbritHml3EHhI4MkDzAyDhw6rgY6P8I
-+					tWCgVZf/8NSTW8J89hon9y4Z5CZuQHZigdkx
-+					DVmcd6tsNyPlTP8HT4D+z5SaSD1GFKONjk5Z
-+					vYu3LXMlw2OT+8UsXA== )
-+6MMR4M238C6KQ7OL4J0HD33VSF2RBFE6.example.sec. 604800 IN	NSEC3 1 0 1 94CD 71FH7088MFQ3GHCT8F0NKT9PF3BT46CC NS
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					gH3QQQEbhWs3lNZn7yL+BMg8jOeILxZCMW4e
-+					0iOBAfWpMxyxgvv9Jy3X9SQxui3zso6CfaoU
-+					av6bMupDNYvGsRb2e9I9K3KQKv48wI8Z7UN+
-+					/z1RqXy7izL4MX7Df4EYnKvhi0eLGI4hBJLq
-+					my2AR4wswQiPG1tnBDa7lbx+o85GtHlX62lO
-+					MD8lS5CvkSxDMBb5bChR5DYl8NChdtaSMxRD
-+					yH7DZ6CI6t7ICUTKQs2aV8S6OTHmUQvDyA3U
-+					KThFvxPdSv9Cf+FAQzN9kwNSGC4gxjJYQtjA
-+					XjEIc+2ZPtOYI8+YJpAlNtR0kcy9TO5M9ioZ
-+					tEvquxTTQooWNuxdTQ== )
-+DGRBPEHGU29PPOAAQS0TK0K8KJLI60CF.example.sec. 604800 IN	NSEC3 1 0 1 94CD E7Q5FM6A5MAMV8HQ7O6A8F5RIF1VJGMO
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					xH7j5GQt3bah8ezTmXZ7/LsWLHw2PDCrmBtA
-+					bEuqpKS/O7HvwVkQ1tQp1xznzpifDye2TqKH
-+					tnEY6sWJ+hbByDrP87j5oP6ZuRTnzCtwUU6c
-+					qqfEUV0JrAptkx+kxC4kLGjdB1OvaAiXvRg0
-+					fhBaY458MLwQh7AxFsqv9Jd4KtJeVtm7PcWK
-+					VoHPckh2LdZJQyiUl7+5zUKhsGBzEqU7BZck
-+					OLPd6ccVJrNkOXfyrsYHj5NXILFtjJ/+avaY
-+					kiTYYp8ix9bSLG6LBbWuaDNcjgGV3hI2Woo2
-+					onBRmHmuklKgmmmbZ+YRT94FZnkrQRtUlRo1
-+					nRLQN21PBXCOfwYQAA== )
-+GGTEST9KCG7P1MNV2U653M6CIGD9Q6UJ.example.sec. 604800 IN	NSEC3 1 0 1 94CD IR5OEOOO61L2NLSFRK4OLKUJ6FEARD1Q A RRSIG
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					vAQghXrUpaoGUONOUjKRSxBIno5udi5R9GhP
-+					L/ocMnuUYtIjtkPqFNmuIFpqMKOy34aox/TD
-+					SPuZjfb4+OMcdHw0Zz9FT6U/jw2B2aAWcrDf
-+					oU6HasH3e2lCUZizwiaCPPhFMuBdZjuwMqHN
-+					BMCW9JfsJ9ohKl+OJ7i/eS0MgAWU7/o/hmAl
-+					NRA4Q9fCUlivMQ+ZW+GUBLDzZh3tDMsIXhTK
-+					EenhqSZdL563ZmRnxe9hg2+rjp7T42UxtzUu
-+					MCt71MGnp+Q4ki8RjubLyDsjNbW9oXs02EwT
-+					B7Exydd4GHGXBiYdUt2fFHp1pJ5sgObvSoue
-+					FTw3xBWZ+TCnuohK/A== )
-+E7Q5FM6A5MAMV8HQ7O6A8F5RIF1VJGMO.example.sec. 604800 IN	NSEC3 1 0 1 94CD GGTEST9KCG7P1MNV2U653M6CIGD9Q6UJ
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					NtTit77tk2WR/L0n3LcBnzceSfceR0y8bJjx
-+					65oUXd+y+nu+c8I+OxmRDeoZHcHFvjH7TOpK
-+					/bET+/KUbs/43wMYsq5pIRAq6iY+pNZnnkOQ
-+					8P4lhKm15dpFb4dO1y3rXQxhT278BMoRDrMH
-+					sOTveerXFOVI7hi7dSXsZp34to7hhdVrsF36
-+					u00ogWJERVIZll3sCQOvKWyfFI8f8M69vWw1
-+					o0U4OR3iWmz9L0zgIgxxSHHKnBZmW7cP+zW9
-+					D746pMchP2TAYB43LZAMotU6jPLgWCcF0olz
-+					73KJdziRJnko4ARx+iMgiWOUw0ujvCwK5kDo
-+					lTmrDPe6/z8aXM/roQ== )
-+VJ5SSNKSNS2CP5O6DCDDHK8HLH6N7CVC.example.sec. 604800 IN	NSEC3 1 0 1 94CD 0A8475SNU6T5P84AMC4I7KAEAMKCMIAF
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					nP9dmjAs6A4GdtsD9Xk3S0WOt5Tg9cSXJQDT
-+					Ff+bd95AJKUeDRk0L71iUa60CYAHfDLI60gp
-+					M5JgO0YgCloLzV9UFvkDj7Fe+v7Ptyl9mdEk
-+					e7KwLBSVJyRsKMbgB+BgvenXEOH9hIiG+8CE
-+					uokdOvUEERaUYk3zaoA5SScFGoVy6v9GwCcq
-+					adUC16d5/WyNuaO2InVl2ug8dX1WtnZzdl09
-+					evjhKiDiLABJ4Z1sLvkJsaNrwFpYn+Xkdv/W
-+					MIb08A9FypXXavAV3zJJZyB2eyQG2Ae8ozNs
-+					r7H06agUsiZKKMYtusq8FI7ISmgHPKbOu3ZZ
-+					dT6l4pFLmuXimm5LmQ== )
-+PFQHTQGF3T3O7NQ37E7APPJS4E7G6FQI.example.sec. 604800 IN	NSEC3 1 0 1 94CD PII3ACEVPP84TH3B1FCEUBN9E8R1PQT6
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					t3PvXIfG9zqm90xrzWhYYcvSB8ZO26ia3c71
-+					uXs+3XS94BJF8cnvecAq26YTmbwCkm4y6AQg
-+					1P3VmM5fZqHHq5eGthdSMgACpGYk/1KL+ZtU
-+					qJ08LbtGFLS/Ai1YNOu+xVFj7Z1D27rAghGb
-+					30z+qjkkgNKgF8RrtUrQtuZZHYljjypJ0bhU
-+					ehZitu87s0tLIGZIK8EvZ1lkAr+RcdOau37x
-+					HGIYSX262YOd7QZ/XytwhpnxjU6z99EefOKf
-+					sP9e5U1Q76czO9iptn8m17lkEKIFEEP8jUtF
-+					KGR1Qsb6PgDkAV82giZDxgFlq4WarIk6olu0
-+					K03HV9skBS5BV2HqOg== )
-+PII3ACEVPP84TH3B1FCEUBN9E8R1PQT6.example.sec. 604800 IN	NSEC3 1 0 1 94CD UB3H790SAMOQSDHHGOFHG1SBHU35K00O
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					0RfXq4uTIqZJQzcGQ4s1FzIyafMn8Y9gO7zp
-+					Lf59a81Wr7feYG+KuOXc9sJC8Kk1Aerd1bSv
-+					bAmskxHxBI2cjjI4S8JDSGVezymeqMsopoEH
-+					c8jiACBjc9rCx2Z97YcXElo8PxE9AkC/a6/V
-+					PHXGr0aS3P6QB1O9AHE1rIv5t9mrATJkE1TF
-+					CH/ravS0ZaSZKPCLw7zSDObT9K4OazvRJHFO
-+					VAqd1rX8J5SHBs3ss9p3kBfnedaMNb2GLfjo
-+					Tky+WTIYoHexC2s4Kxdfj/8wWqlhw6JIcO9X
-+					g7Tc500A4/58YU7JqmLfu7a3H0kVF2oXwxkA
-+					KPlfulSsPGFYjB+5ng== )
-+UB3H790SAMOQSDHHGOFHG1SBHU35K00O.example.sec. 604800 IN	NSEC3 1 0 1 94CD VJ5SSNKSNS2CP5O6DCDDHK8HLH6N7CVC
-+			604800	RRSIG	NSEC3 8 3 604800 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					kWKeBzW7N07cmtm7TtqzJfPJOcxNHqr7nQpJ
-+					XqyRe2SvNlaUJpxqgTOQn3SjrsG4GUA5+j6Y
-+					Y/MjScGeSME0xIWiPV1ZBGnm/9mB8FEePK58
-+					PvBLa7SlKj2v3mvlMlZQzJa657NtV5hbaVcx
-+					JP8YbK2W4zTGS8htg2VZMvRSfSV8gQwgKQlB
-+					BGeIeM+xfYkrxvklRfLl6+ogZlJVfPH71SLO
-+					PiEXrvfxU0HWbvej1HsNXdQDjv3Ix5vd8xZ9
-+					QW4pyl+BHe22+Dx/TpAAoSXGdntuKuZqPF6P
-+					bpBZrMZcqdPlODnEUBgzGB3ChaZvaf4BlHzs
-+					vYqwsj87D5atXL3pOQ== )
-+bebe.meme.example.sec.	86400	IN A	1.2.3.4
-+			86400	RRSIG	A 8 4 86400 20120923133353 (
-+					20120824133353 48381 example.sec.
-+					vIeL1Bu8xiDbEn25Uard5kbWnI44qm7zMm7c
-+					ZRTHlvfBlEfo0uAqdOEsABmIDuj6bYfqifHC
-+					6YpsPU246RKOLwZ+FGZn9hTiWkixCu4gi/Cg
-+					ynKCgRNprJdvRTiGTQ5glS2q0wNwn6SSgBAD
-+					F5W6wu/R6k2MHCzJHoR45xLwwsDBqPAvPMlB
-+					NgrtQh+L++zhvC5bw78WBnLY6h2wxlgby/6O
-+					qwiYbHborqhQLzIYmneOluceptx5gk9F5B10
-+					8QTG8wDtACj2TcKUT5vQ8+ZzmC8l3CNKVoKO
-+					B2PrrtfNEaCNfYIjfW5d9feZkjxxqLSzrMTg
-+					FZT6ntGLpEOxDRgYxw== )
-diff --git a/t/issues/24-delegated-nsec3/Kexample.sec.+008+48381.key b/t/issues/24-delegated-nsec3/Kexample.sec.+008+48381.key
-new file mode 100644
-index 0000000..e9cd610
---- /dev/null
-+++ b/t/issues/24-delegated-nsec3/Kexample.sec.+008+48381.key
-@@ -0,0 +1 @@
-+example.sec. IN DNSKEY 256 3 8 AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg273Tp4oRpnmnmgizDFtLQh nIv1Mr3AuwSWVIDeavuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90yQwf C53hxyH10GzGnAx4Sutrdkh1w4HM1nMBdlTMa0g9yxjJ0vm/T7qHzj+3 dTUi84s8Du2mfMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB/QUuoY2F yThfidT+nhOQpzftVtLcta0E0Uv3PcVDp1d7vBXsAEYGHr54r2vb3eXd OTmoFyh/byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01u8SJYP6ULwx0 mZ0p5BmoMH8=
-diff --git a/t/issues/24-delegated-nsec3/Kexample.sec.+008+48381.private b/t/issues/24-delegated-nsec3/Kexample.sec.+008+48381.private
-new file mode 100644
-index 0000000..5beec83
---- /dev/null
-+++ b/t/issues/24-delegated-nsec3/Kexample.sec.+008+48381.private
-@@ -0,0 +1,10 @@
-+Private-key-format: v1.2
-+Algorithm: 8 (RSASHA256)
-+Modulus: 1k6+cu1N1CN90iqofey1vu8jpsmWDbvdOnihGmeaeaCLMMW0tCGci/UyvcC7BJZUgN5q+6LJYgC1+/DLR/cRgi/xizmQOIqzw8TWT3TJDB8LneHHIfXQbMacDHhK62t2SHXDgczWcwF2VMxrSD3LGMnS+b9PuofOP7d1NSLzizwO7aZ8wPqejL6V5nYi5fuUVxrxLMM2aFQ9ORe4WsH9BS6hjYXJOF+J1P6eE5CnN+1W0ty1rQTRS/c9xUOnV3u8FewARgYevniva9vd5d05OagXKH9vJ6FSU+rWAMQfSYFGVZtQepsacrKiXPR1HTW7xIlg/pQvDHSZnSnkGagwfw==
-+PublicExponent: AQAB
-+PrivateExponent: LOxwy9Km3/NYqre6fjsilhW3GX1kcRiSdXFYBBr3rMtUojKvgJsTH9uUeWZvTbTdne4B6yHiqSKRA3Eki79k8i9uqMq2SsP4ju8yJZHLmzjezIfJoHrQ6BxyFcMZoWPzdZkKFKmFwrHpxjjbvFcHvfiAu025Pta9C2o/rZXYC7V3BWQowqYBfukdpZkCEhzFzEtC1ROXN4jPJBwNIma52QTLH6jK5BOfOJ5DhS1SF+r/EkuvXnylApVfjPfUIC8ocVvpn5WLoabWL+eURIi6MvVT59ppzc6WRUT2PxDskT2WUWfw3zq5B7JCM8/qfYIDUHvt1h6JcJHTAOz9Hr2f4Q==
-+Prime1: 8UNey2U7voMhZmVUMpH5C8q7+hp6PQ6dUYd+hjaQVnsDOLPBT+zZf8R3str7pY/xlOOHy+DxYmZ0e17OumSOXTeQR4VSdsr/tpWc/qd2jd1I5N58R4G/yZHgTm8pm6VRb7NwZ7Eg6o2z0G2UEykFeberyg4U6SHBDP6DZNvGrQk=
-+Prime2: 42XeoQUBshFkTYekdeqPfGqC1YXsK0URLGAbPbk8HlOiG7ueVmUnsAS47lyuEJPzIUgqqBbDM+CCdW8AvPJFDXa09l4akfCrLRyAdkreGj3bgmUs5wUFbDZyOHvRFSxdUI8LOcAhXthy86l+wErKwm6sWfd1oPGvMmC1qiSsW0c=
-+Exponent1: JpdjK1+3DcNF7W4Z6LjmwFceeGQR14Bl86ubtnY14k9s9X3zVwiIxeI0T1yt0g7TUsCOcTM7CUVgLne8053QE+MWZgpSZYQVISyPX0CEOy8BQPLBqGJ9vg1idslbO3VXMGngegWgQUSHVbihbesq4AxcI0bbW2s1yRFRDSoGfpk=
-+Exponent2: NbR7bd/21I1S+RSN/ONW2/VzzOYCLv3y3l4cUOmMj0UFRjN7Y8AkLWgQHQt6eKPYigW3PVeS5o+hgAalT/qP4GwmtQDomYsTgmX22Pk5l00AqL0oa6895p69PyXO7Yc6yqnd5te/idzo2S8wpk2DsYPd5KmS+F3cGLPKc9KRekU=
-+Coefficient: ev+8Aj3u6mICRe6Y0NqYTGrXSBMDXf92dI4+CZtwy43cyTvvZSABWvlLTTXf8XAlnnPxszSpG7+e8bQk4A7ZIagcDFSUjzwtVoLqKqbyLPMNjJKqvGW2iTwfpXAHTadd9EmvTPsEVCJnZAvkyn9XQ49phL9IkFzj9kmSrGqnN4Q=
-diff --git a/t/issues/24-delegated-nsec3/dsset-example.sec. b/t/issues/24-delegated-nsec3/dsset-example.sec.
-new file mode 100644
-index 0000000..b4019ef
---- /dev/null
-+++ b/t/issues/24-delegated-nsec3/dsset-example.sec.
-@@ -0,0 +1,2 @@
-+example.sec.		IN DS 48381 8 1 99477B577BF885AB2512B8DCA052D7B71DD968BA
-+example.sec.		IN DS 48381 8 2 E5411AAE0758711B164730F9069CCFA3CAB00391FDD76D04EB3E8610 CAA09E93
-diff --git a/t/issues/24-delegated-nsec3/example.sec b/t/issues/24-delegated-nsec3/example.sec
-new file mode 100644
-index 0000000..659c640
---- /dev/null
-+++ b/t/issues/24-delegated-nsec3/example.sec
-@@ -0,0 +1,15 @@
-+$TTL    1d
-+$INCLUDE Kexample.sec.+008+48381.key
-+@       IN      SOA     ns.example.sec. hostmaster.example.sec. (
-+                              1         ; Serial
-+                         604800         ; Refresh
-+                          86400         ; Retry
-+                        2419200         ; Expire
-+                         604800 )       ; Negative Cache TTL
-+
-+                IN      NS      ns1.example.net.
-+sub             IN      NS      ns1.example.net.
-+test.sub        IN      A       127.0.0.1
-+
-+sub2	IN	NS	ns1.sub2
-+ns1.sub2	IN	A	1.2.3.4
-diff --git a/t/issues/24-delegated-nsec3/example.sec.signed b/t/issues/24-delegated-nsec3/example.sec.signed
-new file mode 100644
-index 0000000..0994375
---- /dev/null
-+++ b/t/issues/24-delegated-nsec3/example.sec.signed
-@@ -0,0 +1,114 @@
-+; File written on Fri Aug 24 16:21:37 2012
-+; dnssec_signzone version 9.8.3
-+example.sec.		86400	IN SOA	ns.example.sec. hostmaster.example.sec. (
-+					1          ; serial
-+					604800     ; refresh (1 week)
-+					86400      ; retry (1 day)
-+					2419200    ; expire (4 weeks)
-+					604800     ; minimum (1 week)
-+					)
-+			86400	RRSIG	SOA 8 2 86400 20120923132137 (
-+					20120824132137 48381 example.sec.
-+					tbjigL7HBI1uY1R5m/QrGVGYv0pWNz0TJiMl
-+					5s600fiDV/0t4eZO0sLsa14gNWSycaHzZpeH
-+					AA29ZV07g+i/WE2BrNj00JzqfGeX3r8hd+LP
-+					vTF7pHAG4syGweqokn9F0ePG/HvW3263i3eN
-+					OuFJS7yeo1ey0REsCpkaMvmiTGYy4Ns/J3ft
-+					kIT92X7p9Ok4ECm2jvYUykXSa8oChWK65EIQ
-+					3VbMn+X7od686gw8disrBIgHYSlWO5cPHIe+
-+					T60PqGB9RM6INT+8x8t1hyYDgZcWlL9J0bM+
-+					QNp24ug1E3nKNgtg8Uf9jvA4HGzRxuB4L0PH
-+					RCLY5Mv64LoNcuGmPA== )
-+			86400	NS	ns1.example.net.
-+			86400	RRSIG	NS 8 2 86400 20120923132137 (
-+					20120824132137 48381 example.sec.
-+					uZ3XcCp2Ko/NqC184GE+3Vl0kaxFRs1QkpAB
-+					cZRS3DvTlFTJQFpAOpBD3YBiP4QTz6weJh9W
-+					seg0/ykNlfxzRJjLTMijsAK5M3CEIfIA+1hV
-+					5AiqEXIsD1VvwB4bmeMZY2HgYteyfP9waNmS
-+					KE6hZG4VV4lHMdfxy6ovsi6UOGQrfA6+RdZ4
-+					rRbMrQy4TofLPYWFA18TwcJRND+KMiLrbEB0
-+					nsE7wtw09E6Fo/p9rfOJSId9zpkivSywvN60
-+					dx5lH3RDM7dRKedLT26uWodoc+sm5ksma4b3
-+					lVpkvVuRYsjx5380MC6Q3Ffi5lgGg+S6U+0x
-+					BNsl65g/cBi52Mx3sg== )
-+			86400	DNSKEY	256 3 8 (
-+					AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27
-+					3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe
-+					avuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90
-+					yQwfC53hxyH10GzGnAx4Sutrdkh1w4HM1nMB
-+					dlTMa0g9yxjJ0vm/T7qHzj+3dTUi84s8Du2m
-+					fMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB
-+					/QUuoY2FyThfidT+nhOQpzftVtLcta0E0Uv3
-+					PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/
-+					byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01
-+					u8SJYP6ULwx0mZ0p5BmoMH8=
-+					) ; key id = 48381
-+			86400	RRSIG	DNSKEY 8 2 86400 20120923132137 (
-+					20120824132137 48381 example.sec.
-+					vMI5/h3OOEYXPyz2EuTd1UTuOXArx80fDXR3
-+					aqAg0VXxuDj5aCNNtrumGac8VQJSbcOFS6en
-+					zavsQbdF4GynuqVouq0+Cg+AKqbkf91mwoRo
-+					9FfYjD+FiCH3AsTgY1sivgx96jxbUJrwlheV
-+					Aq0sRNt25oejEnytF7zkxg4gfAmwszym2iy9
-+					eYUCo5J7lMd5PGWOeTaWM6B1dhTu3db70GNg
-+					s994rEqv9OM87d4XS9U+CrCbwQbj8VtHjUWv
-+					ne5eSVqIh0RgMkPaLISYE2MUG2JNcs6eqYuq
-+					z4LgGJAK3EE4QzsMGs5tmIK7rLbdIwUpLhlH
-+					gwW2y4E10Hz7KLOjAA== )
-+			0	NSEC3PARAM 1 0 1 94CD
-+			0	RRSIG	NSEC3PARAM 8 2 0 20120923132137 (
-+					20120824132137 48381 example.sec.
-+					TMvS8oUX2NkG/VZ1/LFh5NzGNgmuj1KORpjQ
-+					6xLuuZ5EFvV97L5lG/QIeqDYBaeYbbxx6PuO
-+					q35aV3BRxcGkoDlWRC2cFyR3RNzeTjj1q50n
-+					o3RgqtMkvJE/gyl1/oXL4IjSnlw5xYdYGa7n
-+					G2mGQdc/0vh/De8VMh/n0Dq2WbuJ6vqsv3+i
-+					M3oiMrapG91EYnAcFB4ymBbkbuBqTwu4Gwkf
-+					dkweQRkufWI/d0WP8ziP6g3pX6uqJjwvDd4h
-+					wcLgQgajZ7wOzfnsqS/v+CMc1Hu4B44PN7BB
-+					50IKaviAkYCftfyTIy1FSYnAt4MHFrrQBKzX
-+					c9ymqDL681D6zTNQtg== )
-+test.sub.example.sec.	86400	IN A	127.0.0.1
-+ns1.sub2.example.sec.	86400	IN A	1.2.3.4
-+sub.example.sec.	86400	IN NS	ns1.example.net.
-+sub2.example.sec.	86400	IN NS	ns1.sub2.example.sec.
-+VT6TVPSQUE085J73EUKCPVB32N894AUB.example.sec. 604800 IN	NSEC3 1 0 1 94CD ANUH4A3TCIVO884LMD5SA3S1563VKCOG NS
-+			604800	RRSIG	NSEC3 8 3 604800 20120923132137 (
-+					20120824132137 48381 example.sec.
-+					eaQxYQX+q0DDG03cLYyG9L+WmleExeZWQLb4
-+					rBCuJO1rRkzxtC3SAD6MLQ2NVpiv9c0IbbNQ
-+					EUCDXaA4/McY+CemogZV0pumI/xhzJ5Pd5k8
-+					s8jxY0JNaaQ5cHDpUjyu6sWOTn4BwcZJaPtn
-+					fBESTP7cy6uVQWRXiT5TJ33bBk2CeFCgMxD9
-+					x5yvl5fWH+ZBl7AVYXamh4TsU5l8kL+HD19v
-+					vauj4kQVEapBaaUEN3oS7S5lkUJ01ANHf39L
-+					D36sRF6cZ2BEjiv3axl5IW4uQVnmo46XSP9Y
-+					dX+0gjLFwfzUnt6bKO59pfZ1kAQnkpjvXC/h
-+					DFcnQ1TZMn+MjSimNg== )
-+L2BLRUARIR23VEOTUN998OLLATNAI6EE.example.sec. 604800 IN	NSEC3 1 0 1 94CD VT6TVPSQUE085J73EUKCPVB32N894AUB NS
-+			604800	RRSIG	NSEC3 8 3 604800 20120923132137 (
-+					20120824132137 48381 example.sec.
-+					AU3924oCXsSm2yxkSzikdMHrKBgOCnTPQ8QQ
-+					Cv/+ROYGWedvkf5jivUuqRi4wqsx+dK6UAPB
-+					cmxb3zmebGfbzZtO1FI51z9tGSFPvahvTVcK
-+					LkMlbzDmdcNFUpl/npagQLz5FTumi8gD2Ozl
-+					dCdPATDlpoL1Won8t2rBIqPGaClahCHeub+2
-+					FwAuWzjiNMsSAqUpIwHbUrf03AEYafVsacnI
-+					1t6qELwFMIa2UUDXGsFSR4BIfAvDK3wFq/Pb
-+					i4nzKyINGmCPTaUphh2+uLQ8CIUAArVtgAj3
-+					WcIGO8p8fHE3R9CneWANo6jPEjURzMxFLUjA
-+					RD31yV95Xj5SLwAGSg== )
-+ANUH4A3TCIVO884LMD5SA3S1563VKCOG.example.sec. 604800 IN	NSEC3 1 0 1 94CD L2BLRUARIR23VEOTUN998OLLATNAI6EE NS SOA RRSIG DNSKEY NSEC3PARAM
-+			604800	RRSIG	NSEC3 8 3 604800 20120923132137 (
-+					20120824132137 48381 example.sec.
-+					kTRt2QfhcT+N+2MyDWz1kFpu0fpqa8AyXH7l
-+					GDgMUjILF6dSwSTH6OCYYk9HIrdleNwq352I
-+					LerDlaOOszwVrdyGnSFnyT0MYhXFEFUVDibl
-+					svZlpePqbHnMkCEWMGmZHa9k10xNa8e6lUd+
-+					8lpUhuNSdi7GihEmYo0ZNlDv3913cz7iqNmg
-+					0dZk1Vs5GFZGZp5R5y36zBgS8TS+OiYNXL+9
-+					YSsJukXnW93WcEUSvT5saUoxWD24rP41w6ro
-+					9n9J5XUgNmfaLMFj0AiaAtlVz30q3Nbv5v2T
-+					w18A7ybrH2AiuSoRvL8ISQyIrA8P0pDIyftA
-+					5e4wKXX9LZ/1E9laWw== )
-diff --git a/t/issues/25-nsec/Kexample.sec.+008+48381.key b/t/issues/25-nsec/Kexample.sec.+008+48381.key
-new file mode 100644
-index 0000000..e9cd610
---- /dev/null
-+++ b/t/issues/25-nsec/Kexample.sec.+008+48381.key
-@@ -0,0 +1 @@
-+example.sec. IN DNSKEY 256 3 8 AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg273Tp4oRpnmnmgizDFtLQh nIv1Mr3AuwSWVIDeavuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90yQwf C53hxyH10GzGnAx4Sutrdkh1w4HM1nMBdlTMa0g9yxjJ0vm/T7qHzj+3 dTUi84s8Du2mfMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB/QUuoY2F yThfidT+nhOQpzftVtLcta0E0Uv3PcVDp1d7vBXsAEYGHr54r2vb3eXd OTmoFyh/byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01u8SJYP6ULwx0 mZ0p5BmoMH8=
-diff --git a/t/issues/25-nsec/Kexample.sec.+008+48381.private b/t/issues/25-nsec/Kexample.sec.+008+48381.private
-new file mode 100644
-index 0000000..5beec83
---- /dev/null
-+++ b/t/issues/25-nsec/Kexample.sec.+008+48381.private
-@@ -0,0 +1,10 @@
-+Private-key-format: v1.2
-+Algorithm: 8 (RSASHA256)
-+Modulus: 1k6+cu1N1CN90iqofey1vu8jpsmWDbvdOnihGmeaeaCLMMW0tCGci/UyvcC7BJZUgN5q+6LJYgC1+/DLR/cRgi/xizmQOIqzw8TWT3TJDB8LneHHIfXQbMacDHhK62t2SHXDgczWcwF2VMxrSD3LGMnS+b9PuofOP7d1NSLzizwO7aZ8wPqejL6V5nYi5fuUVxrxLMM2aFQ9ORe4WsH9BS6hjYXJOF+J1P6eE5CnN+1W0ty1rQTRS/c9xUOnV3u8FewARgYevniva9vd5d05OagXKH9vJ6FSU+rWAMQfSYFGVZtQepsacrKiXPR1HTW7xIlg/pQvDHSZnSnkGagwfw==
-+PublicExponent: AQAB
-+PrivateExponent: LOxwy9Km3/NYqre6fjsilhW3GX1kcRiSdXFYBBr3rMtUojKvgJsTH9uUeWZvTbTdne4B6yHiqSKRA3Eki79k8i9uqMq2SsP4ju8yJZHLmzjezIfJoHrQ6BxyFcMZoWPzdZkKFKmFwrHpxjjbvFcHvfiAu025Pta9C2o/rZXYC7V3BWQowqYBfukdpZkCEhzFzEtC1ROXN4jPJBwNIma52QTLH6jK5BOfOJ5DhS1SF+r/EkuvXnylApVfjPfUIC8ocVvpn5WLoabWL+eURIi6MvVT59ppzc6WRUT2PxDskT2WUWfw3zq5B7JCM8/qfYIDUHvt1h6JcJHTAOz9Hr2f4Q==
-+Prime1: 8UNey2U7voMhZmVUMpH5C8q7+hp6PQ6dUYd+hjaQVnsDOLPBT+zZf8R3str7pY/xlOOHy+DxYmZ0e17OumSOXTeQR4VSdsr/tpWc/qd2jd1I5N58R4G/yZHgTm8pm6VRb7NwZ7Eg6o2z0G2UEykFeberyg4U6SHBDP6DZNvGrQk=
-+Prime2: 42XeoQUBshFkTYekdeqPfGqC1YXsK0URLGAbPbk8HlOiG7ueVmUnsAS47lyuEJPzIUgqqBbDM+CCdW8AvPJFDXa09l4akfCrLRyAdkreGj3bgmUs5wUFbDZyOHvRFSxdUI8LOcAhXthy86l+wErKwm6sWfd1oPGvMmC1qiSsW0c=
-+Exponent1: JpdjK1+3DcNF7W4Z6LjmwFceeGQR14Bl86ubtnY14k9s9X3zVwiIxeI0T1yt0g7TUsCOcTM7CUVgLne8053QE+MWZgpSZYQVISyPX0CEOy8BQPLBqGJ9vg1idslbO3VXMGngegWgQUSHVbihbesq4AxcI0bbW2s1yRFRDSoGfpk=
-+Exponent2: NbR7bd/21I1S+RSN/ONW2/VzzOYCLv3y3l4cUOmMj0UFRjN7Y8AkLWgQHQt6eKPYigW3PVeS5o+hgAalT/qP4GwmtQDomYsTgmX22Pk5l00AqL0oa6895p69PyXO7Yc6yqnd5te/idzo2S8wpk2DsYPd5KmS+F3cGLPKc9KRekU=
-+Coefficient: ev+8Aj3u6mICRe6Y0NqYTGrXSBMDXf92dI4+CZtwy43cyTvvZSABWvlLTTXf8XAlnnPxszSpG7+e8bQk4A7ZIagcDFSUjzwtVoLqKqbyLPMNjJKqvGW2iTwfpXAHTadd9EmvTPsEVCJnZAvkyn9XQ49phL9IkFzj9kmSrGqnN4Q=
-diff --git a/t/issues/25-nsec/dsset-example.sec. b/t/issues/25-nsec/dsset-example.sec.
-new file mode 100644
-index 0000000..b4019ef
---- /dev/null
-+++ b/t/issues/25-nsec/dsset-example.sec.
-@@ -0,0 +1,2 @@
-+example.sec.		IN DS 48381 8 1 99477B577BF885AB2512B8DCA052D7B71DD968BA
-+example.sec.		IN DS 48381 8 2 E5411AAE0758711B164730F9069CCFA3CAB00391FDD76D04EB3E8610 CAA09E93
-diff --git a/t/issues/25-nsec/example.sec b/t/issues/25-nsec/example.sec
-new file mode 100644
-index 0000000..76922f5
---- /dev/null
-+++ b/t/issues/25-nsec/example.sec
-@@ -0,0 +1,13 @@
-+$TTL    1d
-+$INCLUDE Kexample.sec.+008+48381.key
-+@       IN      SOA     ns.example.sec. hostmaster.example.sec. (
-+                              1         ; Serial
-+                         604800         ; Refresh
-+                          86400         ; Retry
-+                        2419200         ; Expire
-+                         604800 )       ; Negative Cache TTL
-+                IN      NS      ns1.example.net.
-+subA            IN      NS      ns1.example.net.
-+subb            IN      NS      ns1.example.net.
-+subC            IN      NS      ns1.example.net.
-+myMX	IN	MX 5 mx.example.net.
-diff --git a/t/issues/25-nsec/example.sec.signed b/t/issues/25-nsec/example.sec.signed
-new file mode 100644
-index 0000000..d51f828
---- /dev/null
-+++ b/t/issues/25-nsec/example.sec.signed
-@@ -0,0 +1,139 @@
-+; File written on Fri Aug 24 15:30:38 2012
-+; dnssec_signzone version 9.8.3-P2
-+example.sec.		86400	IN SOA	ns.example.sec. hostmaster.example.sec. (
-+					1          ; serial
-+					604800     ; refresh (1 week)
-+					86400      ; retry (1 day)
-+					2419200    ; expire (4 weeks)
-+					604800     ; minimum (1 week)
-+					)
-+			86400	RRSIG	SOA 8 2 86400 20121220000000 (
-+					20120820000000 48381 example.sec.
-+					qzY4pxbPjaFEQyE960A1GD918TUlhq4RoJ+B
-+					QT5pkYo8RvqsN5g2MnfCegfe6ZS2/kwTMmWC
-+					XLFyP4bglatyq6YpSb/nCNLsp7GHvkA1lkzb
-+					VhvenUbYIvOjUXx6ME165fZbpP0NaUETvG6P
-+					LKncqB2ts+Ru7ZsXZqBeAokxvc0Nf3q7JKHO
-+					SHIV97zEeGxEbUqnbAVkjJzDeaUuIK6BBL0d
-+					2cRpi385lVcAbDk0byH9l7nVzVeSf7NO06lX
-+					j4Nr7kWvDrp3+8G0ArawsjwuSf8++B8fqxPH
-+					hjvfw5hpvsKt99muko/gTsL/N3x7bAH9QQRe
-+					U+jSnD27HBChCJSFXg== )
-+			86400	NS	ns1.example.net.
-+			86400	RRSIG	NS 8 2 86400 20121220000000 (
-+					20120820000000 48381 example.sec.
-+					thEwFRgijT/clJZq37540NFYrb/qPEMXdiuM
-+					z1QsNXzNumsuVmPyxTwv0YFOEh1yMesFQGhf
-+					AEVS+V9AoE+xA/r+eM64p+OMrxHmd476jyAi
-+					eEGUOiNx9sZBEIYXB8tr0RRadWzoRtovpJ72
-+					S6mJ2vBT9BIHFt14BVbQayLwf9mqpD4zQ5MU
-+					gL33OxNXRdSsxRIxTyeC9RSSUd5hmCkNxjdX
-+					k2ZbY4AlCZPcFOcdI8ZhLWd1mBD+e3xBwPwn
-+					OILFQ/VpL5BCTB8Zw4yGAX8W0O2g7eXITD1p
-+					/WVKj8ssLW8mlEjBvTC7SBPiPo0T+wt7jJUT
-+					kcQz/cwfgGcGBgY0oQ== )
-+			604800	NSEC	myMX.example.sec. NS SOA RRSIG NSEC DNSKEY
-+			604800	RRSIG	NSEC 8 2 604800 20121220000000 (
-+					20120820000000 48381 example.sec.
-+					m3GzdLzAPvf5ZUUWISV5cKGyNgDUZSbtKm2K
-+					vZ3Pm0vcBTvanrVsi4cyG9lpr0P+LnrRUgZ+
-+					KgoBK3WG24vtLmPRHxdmRctYQ0HsxfEq474N
-+					ifwQzaHenv70OTy4luViH1fbBtyUUH1AFeJ7
-+					28Jj9gf6bJ0ZdUNPg0nU5uxqUiP98dEHn6JX
-+					MMBGRMWrKzLM0QF8BP5P2BQ89JHnHVxDrzog
-+					CzG9Uf1+bbd4j4QVvWjk3m7Wqf4Cb/fezMsm
-+					lyme5u4yo3phrPgYCWWCgd+IssU7dNaxMnWE
-+					uaycDuVSRmBotgfm03ANUiEbKb9arcfukSbg
-+					IgGDyvfpvTzcpYi7cQ== )
-+			86400	DNSKEY	256 3 8 (
-+					AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27
-+					3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe
-+					avuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90
-+					yQwfC53hxyH10GzGnAx4Sutrdkh1w4HM1nMB
-+					dlTMa0g9yxjJ0vm/T7qHzj+3dTUi84s8Du2m
-+					fMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB
-+					/QUuoY2FyThfidT+nhOQpzftVtLcta0E0Uv3
-+					PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/
-+					byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01
-+					u8SJYP6ULwx0mZ0p5BmoMH8=
-+					) ; key id = 48381
-+			86400	RRSIG	DNSKEY 8 2 86400 20121220000000 (
-+					20120820000000 48381 example.sec.
-+					G2GT1BOwgV/uTbJf93jmUvl7bmu9I9gaV3B9
-+					Iol/FeOE8/GQhpKYCM6zF6gT8iZtFJ37IYgD
-+					tF5Zi+9nWE6HfvVtB6cltAL5Ud0Tkzuwf2XY
-+					XsqnwiBmFlkJJgzNG7po0gkCWWrUpv+kg0Mn
-+					0JJfmSOvo3srOyEg42pAWcEJ7dvAz/DgcOCk
-+					ef9i4cxlRRtgWE4a4QkHH/V7pFDAOEvWkXg3
-+					RUih5VIFM0POxnqgS/QRbca2Zm6FyCgkbHR1
-+					QF+ojRSKGVKkE2VbIcPX7yUcBagg6WdkWjri
-+					ZHZlwgF0bzbBNTc61MYiSK/PyDQpS1/m2JPd
-+					OVidiTu6ajWJpUo6jQ== )
-+myMX.example.sec.	86400	IN MX	5 mx.example.net.
-+			86400	RRSIG	MX 8 3 86400 20121220000000 (
-+					20120820000000 48381 example.sec.
-+					iDUsHGQ4Zj9vEDUsojq08tVxOG6s+wjs3Qtf
-+					DFXVPeqXmThdaMIVALzUyJYwnU0a4RNaM0lQ
-+					FcFiK3y8fGuvMYQVUhheKBDLc0MmAht9CjJi
-+					faUNJaNSTw/rjWtduJidzEaWUk5lh75YV3hc
-+					YPk54jEbgTYTEJKCbfgDfRVShxAk64TM++Sh
-+					xKSSW+4s2jKr98coYCcWYsHE6WlJXi0EJuDb
-+					o84YG0MKoaURNcvEwWBwHhpxLnzT+7Yg7/AN
-+					2bmogQLy40Yr8bS9DiyBZikXJt01Bj+2sTrw
-+					t4JIxBPCPy08YayZzYcMLJ2M4FL0f633bWzX
-+					4CPKb0ZLimqsAPXbPQ== )
-+			604800	NSEC	subA.example.sec. MX RRSIG NSEC
-+			604800	RRSIG	NSEC 8 3 604800 20121220000000 (
-+					20120820000000 48381 example.sec.
-+					ljtWqo0kh1F5NZ1vNGaLipgKCxEQ+c5deq0I
-+					0wK8xOUSCjT5q8Ac8tIX6B50NIjw65YpOfQu
-+					wzPVJM8PSsBA6eZuKIBKKy0MzD+X+eirunvS
-+					wpJ6PHix8C4/eChrNZlEJs4AX6Q6nVuCH4b4
-+					rIDClNiOTC7cXiWSK3FWgCzWpgWpG5yusRdb
-+					EzDCyb5UTfnzcCZdjBRjXRA1c22nODgIlgS2
-+					rqEJqn2o79CU8bYMx/LCQ96CO9y4XyVwAayK
-+					ekSo6f7w7YPcwb9aFURN2mQ7ZP1sGxWUifVx
-+					zpLE7aqM4fhlanG8OGEyvCZd2uXbtkdlw2m9
-+					LGN/2omLoKgBK77JCg== )
-+subA.example.sec.	86400	IN NS	ns1.example.net.
-+			604800	NSEC	subb.example.sec. NS RRSIG NSEC
-+			604800	RRSIG	NSEC 8 3 604800 20121220000000 (
-+					20120820000000 48381 example.sec.
-+					t68GfTtpxY7WZ8TVWBEEQdcsORVdG8a7hgL2
-+					MMQgMW5K2DmdURAW3mEf8m8uXU2AwKJ+xCWL
-+					/LXVfkxqFMVI4dyn6YGLbCyVv8RggATIt6b1
-+					saEFTvByo2WThWnJU3r8Sq4LV35NurjruZ/o
-+					DJVhTc//zPSSIQpUrz2kuUcOsL+djG3hJi+/
-+					TB7CsrLGdEaD9elTwwAk9lvy0ZvfVhN63w0Q
-+					BPMtSRPkARNfsHLJS6m8zutcUIbAPBF7FZDp
-+					PUly5LNvZYbUQvFwo7A8JaZBUOBjFZ1apagt
-+					FV3dBVtRXuBIBraFwJjUuKIApX177uYpxD8l
-+					kDTfWeD/JD95z3a9Gg== )
-+subb.example.sec.	86400	IN NS	ns1.example.net.
-+			604800	NSEC	subC.example.sec. NS RRSIG NSEC
-+			604800	RRSIG	NSEC 8 3 604800 20121220000000 (
-+					20120820000000 48381 example.sec.
-+					LJZFwPB4Aw4dLfqUnjmv3zeoKm/3ZZyHRusN
-+					NniNNct8zaH7rqfTZHQoSBMH//YyyeJwQ7uO
-+					7YIRIJvIi3z1iM2FpxuHihtUE9fIHPOGpjo/
-+					t42bh611Lod+OReiukOaUOkhavg0wMfYEX99
-+					Bw2V+Sk5z4UrLwJd/slQYjow4ZnFIubpJhqt
-+					gw0fsygW6wb3XN9zs+nNo0XD1ksdQOyKu4tA
-+					ZmYXWYCEbw/BIg8BDw3TnqUxbV44namLTSUg
-+					97rA/90Nh/s1tsDQ3RbL7iaCbBH8ylSyCz5m
-+					av1L+WK51LUJNgzm/fNJvI9kFzUG8s9oespe
-+					f+r2hqgomotK4WdxMQ== )
-+subC.example.sec.	86400	IN NS	ns1.example.net.
-+			604800	NSEC	example.sec. NS RRSIG NSEC
-+			604800	RRSIG	NSEC 8 3 604800 20121220000000 (
-+					20120820000000 48381 example.sec.
-+					twkPkw069EOqYcUugvM2qD7+/Yk51+91WRnz
-+					Cq8AR8P4KlaBvahWg997haey4q8wV1rXsAXu
-+					lMc9iNgmX6TaIiHoq9kMXumELWzE8Oxa/ymH
-+					vvQnMOk2j0zcKh/7lyGeTX7cpSvXhz450XH3
-+					3EfQeb6BLzlwyXgfnx/kGLS/lIez66Py/92v
-+					2M87By7Gx69dv1vbBleeVxsYKmKe+sal7Ayl
-+					ZPP9+NlOqZqDBrCXvwOmn+ScfCbeYxgMzmcf
-+					2LMBEGxpDHRfBuV35hOzOVCce47CCip1Xian
-+					Jmnh1A3dqZJXCrxFZidvAYVm7jEtAI8FS1OL
-+					VjBf8zzsLfQKiMpeGA== )
-diff --git a/t/test.pl b/t/test.pl
-index 8ba2a66..29ff525 100644
---- a/t/test.pl
-+++ b/t/test.pl
-@@ -75,6 +75,26 @@ like(shift @e, qr/IPv6 address is not valid/, "not an IP in AAAA");
- like(shift @e, qr/MX preference expected/, "empty MX");
- like(shift @e, qr/MX exchange expected/, "MX without exchange");
- like(shift @e, qr/garbage after valid MX data/, "bad MX");
-+
-+like(shift @e, qr/bad SHA-256 hash length/, "TLSA SHA-256");
-+like(shift @e, qr/bad SHA-512 hash length/, "TLSA SHA-512");
-+like(shift @e, qr/certificate association data: hex data does not represent whole number of bytes/, "TLSA nibbles");
-+
-+like(shift @e, qr/bad certificate usage field/, "TLSA certificate usage");
-+like(shift @e, qr/TTL is not valid/, "TLSA certificate usage fallout");
-+like(shift @e, qr/certificate usage field expected/, "TLSA certificate usage");
-+like(shift @e, qr/TTL is not valid/, "TLSA certificate usage fallout");
-+
-+like(shift @e, qr/bad selector field/, "TLSA selector");
-+like(shift @e, qr/TTL is not valid/, "TLSA selector fallout");
-+like(shift @e, qr/selector field expected/, "TLSA selector");
-+like(shift @e, qr/TTL is not valid/, "TLSA selector fallout");
-+
-+like(shift @e, qr/bad matching type field/, "TLSA matching type");
-+like(shift @e, qr/TTL is not valid/, "TLSA matching type fallout");
-+like(shift @e, qr/matching type field expected/, "TLSA matching type");
-+like(shift @e, qr/TTL is not valid/, "TLSA matching type fallout");
-+
- like(shift @e, qr/outside.org. does not belong to zone galaxyplus.org./, "outsider");
- like(shift @e, qr/long.outside.org. does not belong to zone galaxyplus.org./, "long outsider");
- like(shift @e, qr/outsidegalaxyplus.org. does not belong to zone galaxyplus.org./, "tricky outsider");
-@@ -97,6 +117,9 @@ like(shift @e, qr/garbage after valid DNAME data/, "DNAME garbage");
- like(shift @e, qr/CNAME and other data/, "CNAME+CNAME");
- like(shift @e, qr/CNAME and other data/, "CNAME+something else");
- like(shift @e, qr/there should be at least two NS records/, "NS limit");
-+like(shift @e, qr/not a proper prefixed DNS domain name/, "TLSA host 1");
-+like(shift @e, qr/not a proper prefixed DNS domain name/, "TLSA host 2");
-+
- like(shift @e, qr/TTL values differ within an RR set/, "TTL conflict");
- like(shift @e, qr/multiple DNAMEs/, "Multiple DNAMEs");
- like(shift @e, qr/DNAME must not have any children \(but something.zzzz3.galaxyplus.org. exists\)/, "DNAME with children");
-@@ -191,6 +214,19 @@ isnt(rc, 0, 'dnskey extra checks fail');
- like(shift @e, qr/leading zero octets in public key exponent/, "leading zeroes in exponent 1");
- like(shift @e, qr/leading zero octets in public key exponent/, "leading zeroes in exponent 2");
- is(+@e, 0, "no unaccounted errors for DNSKEY policy checks");
-+
-+# issue 21: https://github.com/tobez/validns/issues/21
-+run('./validns', @threads, '-t1345815800', 't/issues/21-nsec3-without-corresponding/example.sec.signed');
-+is(rc, 0, 'issue 21 did not come back');
-+
-+# issue 24: https://github.com/tobez/validns/issues/24
-+run('./validns', @threads, '-t1345815800', 't/issues/24-delegated-nsec3/example.sec.signed');
-+is(rc, 0, 'issue 24 did not come back');
-+
-+# issue 25: https://github.com/tobez/validns/issues/25
-+run('./validns', @threads, '-t1345815800', 't/issues/25-nsec/example.sec.signed');
-+is(rc, 0, 'issue 25 did not come back');
-+
- }
- 
- done_testing;
-diff --git a/t/zones/example.sec b/t/zones/example.sec
-index fe4b300..e361a4d 100644
---- a/t/zones/example.sec
-+++ b/t/zones/example.sec
-@@ -20,6 +20,19 @@ ns2		A	5.6.7.8
- mail	A	2.3.4.5
- www     CNAME example.sec.
- 
-+_443._tcp.www IN TLSA (
-+      0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
-+            7983a1d16e8a410e4561cb106618e971 )
-+
-+_8443._tcp.www.example.sec. IN TLSA (
-+      1 1 2 92003ba34942dc74152e2f2c408d29ec
-+            a5a520e7f2e06bb944f4dca346baf63c
-+            1b177615d466f6c4b71c216a50292bd5
-+            8c9ebdd2f74e38fe51ffd48c43326cbc )
-+
-+_25._tcp.mail IN TLSA (
-+      3 0 0 30820307308201efa003020102020123 )
-+
- delegation NS ns1
- delegation NS ns2
- delegation DS 60485 5 1 ( 2BB183AF5F22588179A53B0A
-@@ -51,3 +64,18 @@ cert	CERT URI 0 0 V2Ugc2hhbGwgbmVlZCBhIG51bWJlciBvZiBtYXRoZW1hdGljYWwgaWRlYXMgYW
- 
- alias DNAME anotherone.sec.
- 
-+host1	IN NID 10 0014:4fff:ff20:ee64
-+host1	IN NID 20 0015:5fff:ff21:ee65
-+host2	IN NID 10 0016:6fff:ff22:ee66
-+
-+host1	IN L32 10 10.1.02.0
-+host1	IN L32 20 10.1.04.0
-+host2	IN L32 10 10.1.08.0
-+
-+host1	IN L64 10 2001:0DB8:1140:1000
-+host1	IN L64 20 2001:0DB8:2140:2000
-+host2	IN L64 10 2001:0DB8:4140:4000
-+
-+host1	IN LP 10 l64-subnet1.example.com.
-+host1	IN LP 10 l64-subnet2.example.com.
-+host1	IN LP 20 l32-subnet1.example.com.
-diff --git a/t/zones/example.sec.signed b/t/zones/example.sec.signed
-index 38d9732..5bb8b0c 100644
---- a/t/zones/example.sec.signed
-+++ b/t/zones/example.sec.signed
-@@ -1,5 +1,5 @@
--; File written on Thu Mar 22 15:19:14 2012
--; dnssec_signzone version 9.8.1-P1
-+; File written on Tue Jul 17 12:11:38 2012
-+; dnssec_signzone version 9.8.3
- example.sec.		300	IN SOA	ns1.example.sec. hostmaster.example.sec. (
- 					42         ; serial
- 					3600       ; refresh (1 hour)
-@@ -372,39 +372,271 @@ delegation4.example.sec. 300	IN NS	delegation4.example.sec.
- 					gFnrAa3A1fLKuUf4G53MjTlu6BKYJQtEqxwo
- 					0yE/8rePwZLK8Itgy3Io2V8MvHlU5NmUEWLq
- 					At4YSicAUv2CpVOcqw== )
--delegation2.example.sec. 300	IN NS	a.ns.delegation2.example.sec.
--			300	NSEC	delegation3.example.sec. NS RRSIG NSEC
-+delegation.example.sec.	300	IN NS	ns1.example.sec.
-+			300	IN NS	ns2.example.sec.
-+			300	DS	60485 5 1 (
-+					2BB183AF5F22588179A53B0A98631FAD1A29
-+					2118 )
-+			300	RRSIG	DS 5 3 300 20121212121212 (
-+					20111010101010 516 example.sec.
-+					uEf2xsca1/OJwovwMVGyFB4/6OUmutAWlWvG
-+					qM9JDtvUPMhUV8dzRRiwpWfz3YkPU60Hqn8n
-+					QX981RtNc23oiwjmo1ehp1DW7R9dqcqxH4KM
-+					5gYrdJT+lJAoN3ii43rQNl0N7OfObYxlZj+N
-+					K7aMVBHESqQd5ZaRfkiut8XW49M= )
-+			300	RRSIG	DS 5 3 300 20121212121212 (
-+					20111010101010 44427 example.sec.
-+					GIx0C0s5HJdizOCjIFnqf3BvhIwKaJZW9id0
-+					vcQAyd3qzbiiuWecM5pdyiJahFpnKmGxTdLM
-+					ZCEwNczhZZf+RE6SlOu8j/VcFujTlaq47JMZ
-+					uaU2KETUVZzOhFP6Vrddax35icNcO1Qfu2US
-+					B501hzVzyAjr4QL9j0KKlYBe3n3/349dHIiT
-+					trruNmkB0c/M8KOkApnUbO8/42Xaz5QCBvXT
-+					nyx3jp2WHTCCLLC2o0LTD++w6LkqhTXvWcbo
-+					oIMBUXD9hXm/NnYjPxR5+8IhIzPjgjL1vzw7
-+					RZrtCBVuI6PIsCRhyXxJ2XoxB293M0GxOmnh
-+					VBZ0feqy7wVmo+hklw== )
-+			300	RRSIG	DS 8 3 300 20121212121212 (
-+					20111010101010 48381 example.sec.
-+					D6eEY7RttRgccoDGLh1/JJ2Q8Xt8fbnNVzXG
-+					WhLlMMeEc1S1FzJG8/SKUrvYVKtrU8wPZpLq
-+					qV/2jEjHk81vOqj4S+NZh3hV94h5p27Pngqf
-+					3fNzd0aO940zkFC30aAiz0BBd7MX28AOowLL
-+					1UWoiTCuERpPAQTuRQRbAR2zf+205PJLjbU2
-+					764FVJYEzp6Kal66lWOYlB2EqGWdrv3irPpJ
-+					lyTYMaFpNvh4qOkRaBgmT06lzGQuG6E/tUmF
-+					nR6tQA4oFaGMs4QGWv05iMYYKleBBNlC6OYM
-+					0At5mmxZIfiC1viIGDTGvHaKDS3YjWO2YLIq
-+					4EQZCBQJAnbb3rHmWA== )
-+			300	NSEC	delegation2.example.sec. NS DS RRSIG NSEC
- 			300	RRSIG	NSEC 5 3 300 20121212121212 (
- 					20111010101010 516 example.sec.
--					alXox/n3U8q3S7BezOkumPPVxQekZSPZ34nY
--					w9JL0qX5h1NOuAR7SG0B/sKz8XKe1gpoTpZ6
--					oCYSZ/4LAw1oWryRe1W4+K63fNHy1BpZJMGn
--					0toviZnfH8DrmTnwcDAXkPd6IhdX2Ok7ztef
--					M3yeP8heSWCvyBukpa4EBvwv5mA= )
-+					iG8wud8jrvX0STdk/BPdIHUCMgeIExOklQEO
-+					Ah+K6e4LJakFKjuI+G1tTLdHOP2GauWkb3GQ
-+					0Ozj8r7+jQEz886ZQmCR8RigqW5/CsnwPc9V
-+					oc7TbNntOs+M4NyOiqC9NfmafrpqIrmbLMBW
-+					THN6XGPUMdc5riMr8miTKtLDMF0= )
- 			300	RRSIG	NSEC 5 3 300 20121212121212 (
- 					20111010101010 44427 example.sec.
--					5e7KvcXLAy5uVdD/hAZuNl7mC+qITTiihlmU
--					dh/KIachaEFMMqRoDsY61kjY+cSpkn/n2dp9
--					OozcWUFfhfXY2D5EFaRmkWKtP4N37ryVWZUw
--					maJ5ZDCLcRa/vWfJGWlTrG108ijGkfUPE3lE
--					euYkc0d00yjmbcz72uAW8NUmixRUU+3Payly
--					GZSDVcG7vZ/qaf1dXG6cToY2n0DDIf/526eC
--					xH5NhhDJgq6O1ZCEtS9r6Hb9vpR9Ed9wJvgt
--					a7VZltV0TlLaiFGSGZA+OgZV9l0HerOCh8uW
--					nn3L8d+jMAOmrk8/Jn47uTpZub1/j8eZo5pA
--					jFyHUZ1b0h957vC6XQ== )
-+					Hw2H90l/QMOJYJPO+B1eCpGQXJGXOd5MoUfR
-+					Fc4budW2eesImgWQ6TR8Bvwjz95niA8lpGyq
-+					QEXjJ6cEf5JEKYw/4xOVlmFNDHyG//iQ1kpf
-+					2+aT8IuiM0evbBgiej/VhYZFScUQ4Ibslna/
-+					BFMyoJ7ugLmLelYiolB9g30a3q/3ULYwfn1j
-+					OKUbYUeWClKQ+l+i37wRuBIPX6aT6//CetOX
-+					uCecmaDTXl94NKi2pw+fZKs504Ed7xT6FtJF
-+					9FYJAlsFloV7T6epZ/d5pl82QYaEshZpMePa
-+					nqah+amBETh/kd3vokG1lzzFzSbwrWjxgtq8
-+					XYCG9CbCOcJz1N0bXg== )
- 			300	RRSIG	NSEC 8 3 300 20121212121212 (
- 					20111010101010 48381 example.sec.
--					rQwfcCjBLlYDpe6DC2d1w2qVYAUYFqcfbwHy
--					gbjXT4RI2nV4E5q34jwEgi3TFb5OmYZviGwF
--					cJvyii25oYSt2qcKPlTGGnrD3vAMb9lgX9L2
--					hyeHWcmOfB397CySJKMXNbWtZz2YLu4YLrc9
--					K1e+2eQD9MZbVIBrn2f5Krf306FMNd9L4n/p
--					yNrW/6EUfHmRtFsD5vGYytoRRBKoPv5Rxfoj
--					pbhhuyC8MlntVH0IhDe1zvKAmzlBj6E6oB93
--					zG8SqT/gNIuTUpa/qw37tcOw3fCRh7uG3TBk
--					+ylUmRz+hcTUxjSqoQKxVT61hXcrKAogspaY
--					QZ3Mctyg3Se9NhUd6A== )
-+					yc2VoV4VVT+Wo/rVo6brdb7LfxMOslatW8Lo
-+					ldBOGkVuiz21DskK5LUMGkH/4+NZ2L/aaDCt
-+					JyiARZXabIqeMMY47QbNB1DouT1yKvR1Bc4D
-+					Hgo7vK3eL4nf+3x0AXxTOdmdq6ZifxBkI5V/
-+					fFKADNX1Mj1Xh1yVelJnXPLU/ZkAvtakWmJ5
-+					Dj2I2EETshpkC19lqOP8i97jMR0OWfTCjbzT
-+					SL8t0AcbDEWo/TFRXkMP0MaC8NMXmWtkSMH0
-+					96nYIS3YA35OeV+gr6LtEb0VJd6E0c+FnM2s
-+					T3Up4g+99W8Fs+FIYxYisan296LXff0eNCgQ
-+					fNw1Tj+4tWl4lh333w== )
-+cert.example.sec.	300	IN CERT	URI 0 0 (
-+					V2Ugc2hhbGwgbmVlZCBhIG51bWJlciBvZiBt
-+					YXRoZW1hdGljYWwgaWRlYXMgYW5kIG5vdGF0
-+					aW9ucyBjb25jZXJuaW5nIGZ1bmN0aW9ucyBp
-+					biBnZW5lcmFsLg== )
-+			300	RRSIG	CERT 5 3 300 20121212121212 (
-+					20111010101010 516 example.sec.
-+					kTmXaHROKWMOssXq+UTQZM8FOVyhgtqyZm81
-+					LUHbIForbI6FSvZG5yw1U8us1WttnJ4w1oBI
-+					m7gZjRD4O3RKgnD2PkV0JDS4y/itMeJ49Z5E
-+					sLXSaPwkwuMJK81HfsmwTF1Mglzk0KgXOrBi
-+					sdd5yLxCnngdncLqKIkLiYob+iA= )
-+			300	RRSIG	CERT 5 3 300 20121212121212 (
-+					20111010101010 44427 example.sec.
-+					rc8pVuuLiLEOiyR1SrD+Vos+1JEcqBUCVdaU
-+					NtOU4jOM9jhJqEjfO6iRTPG5b+nIQcYX+4gw
-+					MOsQwwsLHVtVmWnKZ1jml+M6npi/W+NmKy3I
-+					Y2jOJz1I+JIFjlLu1UsEzxeV0tScIlyUCxx9
-+					tMN/bUE2wNHnjZTLaJ+pmt5EvaK0VDulSKoD
-+					PF6ThirWFt+K2W3oNtQATL3XjTNprhzgtRYX
-+					Y4nfbHUOA3isbuP3jsH2Lp3IZfN+s2lg07mr
-+					GaVkrYLNbgYaCGa6TM10cvTbrwgH4+c4ZjZ6
-+					cBkrNa4LRh4cDEJEKgWqPQlRf5LGEiH+rrqv
-+					KMtGiXSbW+4sVUCfFQ== )
-+			300	RRSIG	CERT 8 3 300 20121212121212 (
-+					20111010101010 48381 example.sec.
-+					Lmg2cuJHEQYh3JxJUT51BNu1ytK2AdHSo+Rj
-+					cu7CTSgNv+JSv4JbhMLgEEOTN6nwL4uI9ZPa
-+					TqdKUG4c0Ae8LF1LgDzbkpbpGpVaq0aaXMJf
-+					EZuL8SvIANMm2mNItlrnU1cj5d3EVB1Rewj+
-+					4zuQawhJPNwbTkeVsj8TdUUr5VuBb7EbJ0JS
-+					J8g/NS3SmL4L2Ifi25CxURcKr5pzcl/FDANL
-+					BmTL1VE9vlqhjWbUTuiKhz2T7oQd/y139feA
-+					oATbSx/6lel9pDVhxOXhf1kTDx3FdY3PS1Wh
-+					W/FPUQkKQaxIGNkZH9dkKEEgNhnY5fVaP2MV
-+					e9QK6ZMvhhx3IABwvA== )
-+			300	NSEC	delegation.example.sec. CERT RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 20121212121212 (
-+					20111010101010 516 example.sec.
-+					aCbWibwSZKkYONdUM5Uu6rYkUtPKARhA3LsP
-+					yWRLhFYIVXcHpa5gG7mv8QD0jVqAAd7530tF
-+					c/fdmoCri7qqELICwZz09FwRNhtgSj6wRCaF
-+					vKGt7mPM4ODWKGpUvo/0Sf3l9PtWCV3QmcBi
-+					OZbRi6V/znv3bwwXF7jpkVuEors= )
-+			300	RRSIG	NSEC 5 3 300 20121212121212 (
-+					20111010101010 44427 example.sec.
-+					vGaDvMuBuy18IzuDR17zAtYpDTDHaA8ZQe4R
-+					9pxpDdvLzzXAWHEnXaTmsDrNBHaD6a7lWpMd
-+					ONWZH7l8iUSTQGTXsqCQPoQXGcVPdBJwojT0
-+					Dk8CG+Hp7pbKututKnnQpZdxy6OTdxc43K+h
-+					IZYgn+pS3i+NloM5eQQXvAoL0V05fDYTC+Z6
-+					igN2b66Fc5jxG9Snu4VjbNKLn+3H41WiGm9S
-+					YrmoLLMdHHxTnRggfOtxD43G3RM/sMjAelF4
-+					vXqAetGWwoNWtt5fpC7IA8Vxbp2FYAa6dZ21
-+					nCPaveB2Bo4V1tFwkn9C972NZ74+pWngOFSw
-+					L6jY4rtMUyNQCALy+A== )
-+			300	RRSIG	NSEC 8 3 300 20121212121212 (
-+					20111010101010 48381 example.sec.
-+					xga8+N3U/2hEz/HkOL/paiHSYSK1tyFOSqIe
-+					FbafrJB696y4lxf8IC6VMyop6gmVkYXPZD5m
-+					v0ngdjQsfLqCz7nOlHmcvaW1SCQ1m0qN2Flp
-+					tCMmhi6+baN59SYtP7iB/Kk9b1xi5M+y4eS3
-+					pb0+Z9lZgD7C28oBcO0lzdxNr1Suz0sugiHN
-+					tDG2tfodUKxsCbT6jortxAwX7D3gcJuNg5sW
-+					RlFTfCfAWU45QKAqvIrjau4DgOSWWYLPpA3C
-+					POF1Qx4+vM0VXvE21jIDQAehGeNXl092FHI3
-+					NmFvnaCcVmYdC1Qbmuh0kk/jWChLK10Puhdr
-+					bKqFTWsOUIdc83q8/A== )
-+ns1.example.sec.	300	IN A	1.2.3.4
-+			300	RRSIG	A 5 3 300 20121212121212 (
-+					20111010101010 516 example.sec.
-+					Jz66qNND9eWmodjPcTD9VNb4G5BIqd1MPcMb
-+					9g+J69b1T21cNqAuIom5Y4cECyz/zNJOno89
-+					b7KKcpItUnsdyBHb5WuDeJapT1s4FyEYDEms
-+					diPzaEDEJCTmjyOx/5ADZ5L6I8EN8a3V+iWh
-+					A2YMtWWWjZykqXHeVLPZwqbMJS8= )
-+			300	RRSIG	A 5 3 300 20121212121212 (
-+					20111010101010 44427 example.sec.
-+					RzfNZ0Pu4Vxk5xpCycv3ZSDDMViw+h6nR1uY
-+					Jls1+oSygJfeQn0xeTcVzaZQvvZc0gtnecHT
-+					5UopyFB36R/qeNkPp5fFHGb+ZpMAaNmjrxGI
-+					/1OhxvES4jwTaihetjVWEQyN0M0+Pgw0BNsN
-+					tbz92zBczpUFTbe8FxldePwLcJFZ5CAvp8NC
-+					VuzqAHVMGAt7DYvr9qTknrW/X8wszxwUuL0H
-+					mwitcRF397E6H9SA06uDNum/s8RST9lsV1A2
-+					GsssmglqqKICY8+g89SDqkSuxk1bsFJ+dvFx
-+					kfXRlzBBvpuFt8sORt6LPJXSlFy/tgtRI1lq
-+					oJi9S51V6XElb0vu1Q== )
-+			300	RRSIG	A 8 3 300 20121212121212 (
-+					20111010101010 48381 example.sec.
-+					Q2LBOCx0Ol+UX8yBrpWvoZEPu4bGDJfznS6d
-+					uYWDHZc70kjSBipMO+vmzHTPXiax4LTXXznm
-+					u6gtzSh05FTmQUx2QPctCwwLW3Lfa4xRBnQw
-+					KV+HH0AyXUlKy8gNRBNgJmcQyvyKLr5T8UhP
-+					PYQI60UZxU+vCa8Z38Wffy3X0+AraXFwMc3M
-+					YClGU7HFn7cCKeIrdWl50PEYpa8qUj4ec5XS
-+					1QYZu2v8LE6GmChCCFIJsdkU+JzUJ9mOGYrr
-+					l/aI8G+DPa17NxKwihgzQ6fQIS/AXOx0rUNq
-+					ObP7mpqqn76X6BnfJFTGs9BUCms4W/sVNvra
-+					hbAKFCLCNJAz9EO9Xw== )
-+			300	NSEC	ns2.example.sec. A RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 20121212121212 (
-+					20111010101010 516 example.sec.
-+					MPFeioCIJDe03C9RD6Kux0g08JgJYH7xtyFF
-+					4OOOZVHD1mrI+BmjxtWwhb1c7Uqd8+/J9NLF
-+					qywR/OzLW58FsNjznhl3Btr6HsfIfLrEOrTf
-+					kbFlOOSP7gA5ngsC4nMqrWDPjSJwjJ5b3XIT
-+					12C2Efq87MFneqOEzUzIpqDeSdM= )
-+			300	RRSIG	NSEC 5 3 300 20121212121212 (
-+					20111010101010 44427 example.sec.
-+					kUQ26M/bdHkAbREgxC8kBkgxEpnXkQldxwki
-+					0S9mvnmJToiGjnvBIkDixX9BWrx2s8Nzt5tc
-+					xfWqmzlbdbea+BitXMN2o9hnAWNJ0uFmQFaN
-+					M2li2EH5FlCFPpN40w9hazRY25cBvciUJzNE
-+					CaMTtDPRB9GUmZKjE/ZP0N4QnrxvrOqIMJlu
-+					dCsLQ3of+NyBWYpsQQfQvbAvx2WNpolOjqMt
-+					woCsfZhjvedlAAszdaNKCm2qcxYuSKvkw9hl
-+					n9RuZkgYCf+4o0k/DRP6zSwacMo1Rcb6S1D3
-+					b/AXMhBxwtytfaKPh0gAFB2fWck0TLpc/5EG
-+					AuCcy6aJR66j0frDBg== )
-+			300	RRSIG	NSEC 8 3 300 20121212121212 (
-+					20111010101010 48381 example.sec.
-+					Rktfcj5WkoW+7lt1iMFsQXr70zjRdHCUBDf5
-+					zqet9JtQU6r9HSdto4gJAXwwH+gYVWU1zMAo
-+					ZrurdsYhkCrUnUYdO/g6Q+xDIdvPQY4UeUaq
-+					1lZbumzCGAQD21l+nrjxwkD3kvyDtfnAnxU0
-+					eL+/8TqZ/Oo/2cEf2hkuQbOfQqpXImig0n88
-+					e1+xBTJV+fPeORGxnAVL0QMRRabTyOqCPiwj
-+					rcuXpIxRjKWOAEseoFHJbdvFc3MNGwfBC/BR
-+					qI5xzREGVG3yUpY6o1EVkJTNMHdtahZsMOWl
-+					hb1dFARcQSFHUdEEwZwc1gtIa4snPxpplgCd
-+					ZetiK9mOJTMhVhGQSA== )
-+_25._tcp.mail.example.sec. 300	IN NSEC	ns1.example.sec. RRSIG NSEC TLSA
-+			300	RRSIG	NSEC 5 5 300 20121212121212 (
-+					20111010101010 516 example.sec.
-+					br40QG5xW5g8hBGCPt2SJ7LPYfthNcwWVyHB
-+					B7XLb3DyWsPIJgL53OmkBugwGGgDDEKHXz2O
-+					mHcDEVk+ACBbswG0DFJfqM9uPPXoMbLl7k8P
-+					L0E1dKO8eYZeyqE54O9xfYDWHx4nLwGP1vGp
-+					tOIRXnuthA3HvEiNVNtRE7095S0= )
-+			300	RRSIG	NSEC 5 5 300 20121212121212 (
-+					20111010101010 44427 example.sec.
-+					xaRKCccf5698Uyq6+4qDG0IOGJRFP75JkQSz
-+					BFbPQL48FS16pj1UdIjApO/a0zQZsqzOdZyM
-+					ts4MK7g+qpzbCdi16OCQIoqN4PjtM6jGOjNw
-+					Hnpq4qt1fE7FiVdW9g6vgmd3lqAtZxuDsyyJ
-+					3X116mOrLZhhO7TwuLhxTTip5IzHA5VVhXjH
-+					7MbhqN+P83180ghqpzXsu441rr+Xsk/aRfOy
-+					/5/Ll0VzvO5842y8li8qfCnO2Bo6yXqZPDms
-+					UTYQwlHPSux5L9Wng/Fxg5kCyzi+gvOuOJeT
-+					5xHerZUjG4OUdshMIisogVGp/HLO9T+4gTbR
-+					CHgOG8y2yscno+R3sg== )
-+			300	RRSIG	NSEC 8 5 300 20121212121212 (
-+					20111010101010 48381 example.sec.
-+					xbsJoGws3mKDuU4TutUK/ewddXv34FKBGjg9
-+					D8/96yj9eVjLUBhAwLZRS0KhH4Dg6PPsAIAJ
-+					huvAd70rf/Ph6Zp3We7QjWAtZqyDAXA+4Fao
-+					165XRD/5ilnBNgvIaANDWWsxPUK61g7aoR4O
-+					eTl09w/bxFt26w+zT+oDx85r19fDfH4F9iqE
-+					koU/bMphpvCNIGEvLCe2fqGlI3wE5a8J3QXP
-+					36mizyKQQNcWS3ahujzpoEijESbizUSVMa29
-+					bvhacwNS4afL7WgF3espHPknv1zmvowgsc7I
-+					Y7LpC4nfxtmiUHP9kLvs7q1SkVoX2LBKdO6i
-+					Df2mF2J6liXDNFdtQQ== )
-+			300	TLSA	3 0 0 (
-+					30820307308201EFA003020102020123 )
-+			300	RRSIG	TLSA 5 5 300 20121212121212 (
-+					20111010101010 516 example.sec.
-+					DnP6DjlWI+yDT0V/X+yDt09WWl+NYtDxPhD7
-+					STjsEIXqSCr1v0IFykeAaqZ/GJP3vOQEh3Nb
-+					g+5kjv51Bmc+Ax9IVGUhYTUyx7fVk7VaaCpq
-+					Rhc0GgjMn+JtwkQT/PJ/jtwGubRW6tWQjjwu
-+					RfMpVC1cWRJ/2hKMmRTHn9Y8ysI= )
-+			300	RRSIG	TLSA 5 5 300 20121212121212 (
-+					20111010101010 44427 example.sec.
-+					Dez59FOkjLV3Kbhwf5P8qxoVM20ibxQAdf/D
-+					PH8FM5TqHpkFv/BZKzaMMuK5V/lUOG84t9Hh
-+					MvoUSZoWXdFvS2emNJPCiMne2+ZjALLX8T0p
-+					1rN3OtowrDCejBWAK021dxqSEdHax/s0vLgG
-+					NJvYp2pGt3zVSnKSU9+7lNHzJ/cVk1qtrdmG
-+					FY8o7ifHXcmktVMq67L9rqC/DtYRR8kDBioG
-+					NCBly0XfkUllftfdtaLC6RvsF0f0OTPndWwx
-+					um7CeBOsGC28yFqnS1bW8p3icMqqEpg/UB3Q
-+					8s0tmItraLSW9NZzKhT5rqBDDr/05ZYzx6Pf
-+					AY43VJ/OR0AY7LXWHg== )
-+			300	RRSIG	TLSA 8 5 300 20121212121212 (
-+					20111010101010 48381 example.sec.
-+					nRVrRC3Pqm4VD+j0n7syYhGB5uvxl2Y1rM1f
-+					B9Tz933zRZP041JGLbWmZV6v2PaKzmF4C0Mr
-+					WsLykDX2dCIKdvysgxcFKzkmHtXn9yommvaa
-+					sVMAg/cKOwYfJgQYBi2R/bkiBdjRokyCxH+/
-+					BB6hHNX8W1OgjNavsI5u/y2P7d2n3TBRNAkL
-+					kzujqfwJZ+e2bLJ7Dbya22hzSr0ARmC1tufX
-+					UfZTzV8BnPJpXwo1j+NNuX7u7kQ+UJpXJdsX
-+					xRXq0Hq6dSeMwTDldHmy37rLCamtcY2MYrqw
-+					j5mKV1c7Ag22KMq3yyQbNnk0FsgBbrUauiKz
-+					UlUdXq/ySQnilm2SrA== )
- alias.example.sec.	300	IN DNAME anotherone.sec.
- 			300	RRSIG	DNAME 5 3 300 20121212121212 (
- 					20111010101010 516 example.sec.
-@@ -469,6 +701,139 @@ alias.example.sec.	300	IN DNAME anotherone.sec.
- 					enVIAG19JVA4/Zjqr59BC0+6qCNaFIlf6P+s
- 					Tus52Ixc5MnPO3UuAah55oNwfvL0AU1Dl1al
- 					ylAwck7ZX/jjQavikg== )
-+_443._tcp.www.example.sec. 300	IN NSEC	_8443._tcp.www.example.sec. RRSIG NSEC TLSA
-+			300	RRSIG	NSEC 5 5 300 20121212121212 (
-+					20111010101010 516 example.sec.
-+					DmW/7Gx7EvvU9gsoOxQssn9I5zBNq5gwGm+F
-+					zwWZPfUxd+OeZFwfd+qCLXMpvWMN/JR5nu1p
-+					Y68t+hqxAuiyLLwNF2D/wf69dSTunWPHKaXz
-+					F1uMUkLmVDTaG11DtD5rz1Pfd/Mt8BX2/8OW
-+					fXyqo53geg6GCfjAJv4pmY7BNZ4= )
-+			300	RRSIG	NSEC 5 5 300 20121212121212 (
-+					20111010101010 44427 example.sec.
-+					1djWB8e86bYcMlr32K9gaAjFoiv3isY7mADC
-+					FdJGu+AkyMG0qCR34qaDaK7EdM6fIMTVFdnE
-+					FqF9OELcV1g/LhTKKHnLAoKrE0zHvrZktwMv
-+					n5qh9j75eT8uf+6l0MtPhAcc/u74hcnDMz9f
-+					hZvjbnpHBm3T9LGKVUeo2oX4n+Axh6N54cl1
-+					47y/dR6PoPbKb6Wg8BkUyfAIWkv2mBCWYDGJ
-+					W4Du6oiQLdBOAxvieafX9Xk1PwBe5CxV6X86
-+					OSIemzLcHDA+E892UaT+e9TegKNWjL1UX1OL
-+					NJdV6gsajNbeghLPwMdgwMVmxjmI4uQBgraw
-+					NbR4OrdbLRw0dSr1JA== )
-+			300	RRSIG	NSEC 8 5 300 20121212121212 (
-+					20111010101010 48381 example.sec.
-+					i+EVPPdKeaZAlNq9HPXz437Fs7PiCxHKKKFR
-+					zVDf6M0UF0W7Wcl5jlnqllb6TwsB53Upf38v
-+					PMJk/y7vE48On5wAb/XLmTUlBU+p+NJ2NiTP
-+					5/x8dklBdzS+6v2iF4yTpLfD3K970sB2j5oe
-+					+GysOWnA5dJWzBHZPKY1V5SHbEH7Tann4Gll
-+					c4F9A7PgY0t6jUfpckW5YuWKaV6p/5dqMWuP
-+					SDctW12paRW5cqkZ4bIQn0ei3R/Y+DNcPeD8
-+					XVK2mt6lRDipcp0LlCyXtFDtBrTjlyujbm62
-+					MktmWWiZK4A1BfUY44ZFdQEzr01CxoSwCEuF
-+					WdLSfG6b12XfNNQa6g== )
-+			300	TLSA	0 0 1 (
-+					D2ABDE240D7CD3EE6B4B28C54DF034B97983
-+					A1D16E8A410E4561CB106618E971 )
-+			300	RRSIG	TLSA 5 5 300 20121212121212 (
-+					20111010101010 516 example.sec.
-+					EFJLOkZjiBVrGSxCbNc5k0ip1Mc1se72wFsr
-+					0TYHg9TMpHRAB+8SU11r8f5V1KP5KXzF78kr
-+					MDVrnp8ySCwCsYr++V9zh/Wt235OQ4KM8xMv
-+					UfTiknkYuaVJkFnbS9C7CIVLxlThE+3vVg7l
-+					sNiJIfUDh7SsD0+vO9N+00xIdlM= )
-+			300	RRSIG	TLSA 5 5 300 20121212121212 (
-+					20111010101010 44427 example.sec.
-+					mpxahn8nXkV7k4xWIDAGT2/kVir3Z4WaKJqI
-+					X6kKnsR0gbgJq0T1OIbA6WP4xyiAaqM3q/sO
-+					Q/6Y6Z4JhwnJZXdPAMmmWfVbKc52sV/tMp7d
-+					L4h98ND9QugIffpW9WEMVGBZhrPiiAE7w3Ri
-+					GOwluu3K6yfGZvHg7eTr4tYmALWCnU4f6JaG
-+					Ye1bvo4IGi8AlE2qxg0sduzSRtc4+FmCiWj0
-+					mhPiNmnQObonkGA3xpuPqRPtcaga95ecbfmT
-+					P0QVV3yJoswaO0kaQjxo7Prmiev5xk/fdwko
-+					WgONMbgkKzLoeAgKlsQWJ6FgNOD7g1ZIZnCw
-+					YVAVgzyaHGPO62g4PQ== )
-+			300	RRSIG	TLSA 8 5 300 20121212121212 (
-+					20111010101010 48381 example.sec.
-+					pTd0fMqEiuKey73dCne7FCxjowMMuehhQ7dM
-+					VRoPiuW51D33ay2gb6qisLoNUf8I5lUQPag1
-+					Ia/7ArCJQr12aYhsoeQKU/3BqrMwkA+kpmhB
-+					m5G+Lj6h+jtJ8LnqjYV5pPHL317abWiQN4th
-+					mypwHhS9g9zu/RKExzzhHtmCJpH6R3exNOmx
-+					S50REX6rvrTXiigRiI0D8yrRnJHfmeustTiG
-+					OKdU+JNn21P7LDBYIT+C5gDfJ31zOejKEIpw
-+					PX+XPdAZlWFtj8PEi9KerTyqLphhWCgxSM0z
-+					8KqGLri2YUt2JeQkZ/zaHvtvjdpB9zWGT42d
-+					vFIOdbcFli55DAmW2A== )
-+delegation2.example.sec. 300	IN NS	a.ns.delegation2.example.sec.
-+			300	NSEC	delegation3.example.sec. NS RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 20121212121212 (
-+					20111010101010 516 example.sec.
-+					alXox/n3U8q3S7BezOkumPPVxQekZSPZ34nY
-+					w9JL0qX5h1NOuAR7SG0B/sKz8XKe1gpoTpZ6
-+					oCYSZ/4LAw1oWryRe1W4+K63fNHy1BpZJMGn
-+					0toviZnfH8DrmTnwcDAXkPd6IhdX2Ok7ztef
-+					M3yeP8heSWCvyBukpa4EBvwv5mA= )
-+			300	RRSIG	NSEC 5 3 300 20121212121212 (
-+					20111010101010 44427 example.sec.
-+					5e7KvcXLAy5uVdD/hAZuNl7mC+qITTiihlmU
-+					dh/KIachaEFMMqRoDsY61kjY+cSpkn/n2dp9
-+					OozcWUFfhfXY2D5EFaRmkWKtP4N37ryVWZUw
-+					maJ5ZDCLcRa/vWfJGWlTrG108ijGkfUPE3lE
-+					euYkc0d00yjmbcz72uAW8NUmixRUU+3Payly
-+					GZSDVcG7vZ/qaf1dXG6cToY2n0DDIf/526eC
-+					xH5NhhDJgq6O1ZCEtS9r6Hb9vpR9Ed9wJvgt
-+					a7VZltV0TlLaiFGSGZA+OgZV9l0HerOCh8uW
-+					nn3L8d+jMAOmrk8/Jn47uTpZub1/j8eZo5pA
-+					jFyHUZ1b0h957vC6XQ== )
-+			300	RRSIG	NSEC 8 3 300 20121212121212 (
-+					20111010101010 48381 example.sec.
-+					rQwfcCjBLlYDpe6DC2d1w2qVYAUYFqcfbwHy
-+					gbjXT4RI2nV4E5q34jwEgi3TFb5OmYZviGwF
-+					cJvyii25oYSt2qcKPlTGGnrD3vAMb9lgX9L2
-+					hyeHWcmOfB397CySJKMXNbWtZz2YLu4YLrc9
-+					K1e+2eQD9MZbVIBrn2f5Krf306FMNd9L4n/p
-+					yNrW/6EUfHmRtFsD5vGYytoRRBKoPv5Rxfoj
-+					pbhhuyC8MlntVH0IhDe1zvKAmzlBj6E6oB93
-+					zG8SqT/gNIuTUpa/qw37tcOw3fCRh7uG3TBk
-+					+ylUmRz+hcTUxjSqoQKxVT61hXcrKAogspaY
-+					QZ3Mctyg3Se9NhUd6A== )
-+delegation3.example.sec. 300	IN NS	delegation3.example.sec.
-+			300	A	1.2.9.253
-+			300	NSEC	delegation4.example.sec. NS RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 20121212121212 (
-+					20111010101010 516 example.sec.
-+					WuuwTT692DQs9iSoi8mMe3/r8IIrnKaKisRF
-+					UZ5aC6qTb54FydtNsgWAOOwzN21EI/ucU0kX
-+					iXRcaJ0jvNG30ICWk8oI3By1dXDhpMrZerZt
-+					hMDvnitwa851ZjxGeDtyJsMf2NfAuN0p7V3W
-+					UxEGVpiru6ZDNO2rqfwAd35+ixc= )
-+			300	RRSIG	NSEC 5 3 300 20121212121212 (
-+					20111010101010 44427 example.sec.
-+					Vt/wOn+RgrH7e1m/E7XqhoF85i3q1JMnZ96K
-+					E0WMA40MOmClX4+1oHwmdfeu/9U8dqxp4mJf
-+					iJ2nz8tMoYYcJwa/NhOZs8UZSILUV+ACyhOR
-+					g923yYViY41pyV4DCXxa17Cbc1GWizqDPvZl
-+					yksNQTjGfVslH3IXlkGS6OPHY8HImnPKK0HZ
-+					M4si1bZjFg+SU447VokQvz4gKxVHca20R3wD
-+					8A9ZwPHN/97A8rQJzRBlEfAP0EqG8cjt7s5g
-+					ku+ZoeK/sjeQoq3VGUxJWEZU2lXVYwCAv8Yh
-+					9M+6PZ+O1pG2nfIgqpR+MGHJ79LAdTdRe6MJ
-+					nrnROvz2DumLzi9kcg== )
-+			300	RRSIG	NSEC 8 3 300 20121212121212 (
-+					20111010101010 48381 example.sec.
-+					bH5sNx6a1xTa4fafzO+Ur2CCz7W+RU8EiYhu
-+					mRltM1GcqQ0Cz0k9VQyRzkCE9HGPkzb9lDIp
-+					HiQS6zf70m5YyXVgMG3WBN0MteVb0/1ut3jq
-+					JDkQkSMtjyYnJdZ363lpfI363eAI6c1l+XlN
-+					mvEZrUbUWn6entMRj6ZQas2r/7dp61tkZj/x
-+					PU+4SZeVZZPJIZdDf3QLzak+tXG/fs4OCDih
-+					47F8MhlJ3i+L11FawFVoGXVo2NZ/SOhLoh85
-+					aEGPu6j/whxLR6pw6JueK0euQWEeH6nDfXgB
-+					PA1IYI06aExyLN+n4R1wC0q5iAS0ssA+MY/Z
-+					cXye1Yt7SWn5oGXE/Q== )
- jumphost.example.sec.	300	IN SSHFP 2 1 (
- 					123456789ABCDEF67890123456789ABCDEF6
- 					7890 )
-@@ -535,142 +900,202 @@ jumphost.example.sec.	300	IN SSHFP 2 1 (
- 					8ijIr6Y/6vXt3/VjdLHI27nqtl5OIoB6ULtA
- 					/GlkqlibigOI/isMnNhHRzb1IxmpvuhziqpC
- 					m5cVXQkmoD9ubPphkA== )
--cert.example.sec.	300	IN CERT	URI 0 0 (
--					V2Ugc2hhbGwgbmVlZCBhIG51bWJlciBvZiBt
--					YXRoZW1hdGljYWwgaWRlYXMgYW5kIG5vdGF0
--					aW9ucyBjb25jZXJuaW5nIGZ1bmN0aW9ucyBp
--					biBnZW5lcmFsLg== )
--			300	RRSIG	CERT 5 3 300 20121212121212 (
-+mail.example.sec.	300	IN A	2.3.4.5
-+			300	RRSIG	A 5 3 300 20121212121212 (
- 					20111010101010 516 example.sec.
--					kTmXaHROKWMOssXq+UTQZM8FOVyhgtqyZm81
--					LUHbIForbI6FSvZG5yw1U8us1WttnJ4w1oBI
--					m7gZjRD4O3RKgnD2PkV0JDS4y/itMeJ49Z5E
--					sLXSaPwkwuMJK81HfsmwTF1Mglzk0KgXOrBi
--					sdd5yLxCnngdncLqKIkLiYob+iA= )
--			300	RRSIG	CERT 5 3 300 20121212121212 (
-+					LxovxXszIrJ0WqC4lryebK8Png85a1l62jvj
-+					JHLNs25OP3I/CpsfLXmE2o+bGXdCoppA6k+u
-+					+d0BmWG32UmOXQOkcu3haT5J8rJWPV1xynhJ
-+					IsBCmF/UbEXp6PoAniCcytS4ZsHqrm31KBNI
-+					i/ZXtU93D2CGrTDMpwX13xT4scE= )
-+			300	RRSIG	A 5 3 300 20121212121212 (
- 					20111010101010 44427 example.sec.
--					rc8pVuuLiLEOiyR1SrD+Vos+1JEcqBUCVdaU
--					NtOU4jOM9jhJqEjfO6iRTPG5b+nIQcYX+4gw
--					MOsQwwsLHVtVmWnKZ1jml+M6npi/W+NmKy3I
--					Y2jOJz1I+JIFjlLu1UsEzxeV0tScIlyUCxx9
--					tMN/bUE2wNHnjZTLaJ+pmt5EvaK0VDulSKoD
--					PF6ThirWFt+K2W3oNtQATL3XjTNprhzgtRYX
--					Y4nfbHUOA3isbuP3jsH2Lp3IZfN+s2lg07mr
--					GaVkrYLNbgYaCGa6TM10cvTbrwgH4+c4ZjZ6
--					cBkrNa4LRh4cDEJEKgWqPQlRf5LGEiH+rrqv
--					KMtGiXSbW+4sVUCfFQ== )
--			300	RRSIG	CERT 8 3 300 20121212121212 (
-+					LNe6/SJmAkohBYlRtofW0wYMPDVJ2ZTCmOwe
-+					hwZBKvNrcxc8uYlzqSBqjD6Vtq4GpJSl+MV0
-+					KY0GpsE2jz49l4ayUi5QIC8wRaJ1NeTDiwBp
-+					EbA5ycNdzSpGtLFNs0qzDQntdrZdtvoaFCcV
-+					WDPNGP4rvhvTMXfriPJuYJ2W5ZxmXp3DYNDZ
-+					E+1xgJ3hvr6pdAy7UdROrhsOp3ohP15sE8/H
-+					+sU/hmZ9hfBeodpGHhWYIc6FSMOca3pEBwQL
-+					ifVL2Q06ijnqbh6iuJqJnqI++ZadCHIqEYNT
-+					Tn96mylS3XQ4S3FZPPrXXhuM9HvKKxnDvvWX
-+					ALsm728QZQi2keAKkg== )
-+			300	RRSIG	A 8 3 300 20121212121212 (
- 					20111010101010 48381 example.sec.
--					Lmg2cuJHEQYh3JxJUT51BNu1ytK2AdHSo+Rj
--					cu7CTSgNv+JSv4JbhMLgEEOTN6nwL4uI9ZPa
--					TqdKUG4c0Ae8LF1LgDzbkpbpGpVaq0aaXMJf
--					EZuL8SvIANMm2mNItlrnU1cj5d3EVB1Rewj+
--					4zuQawhJPNwbTkeVsj8TdUUr5VuBb7EbJ0JS
--					J8g/NS3SmL4L2Ifi25CxURcKr5pzcl/FDANL
--					BmTL1VE9vlqhjWbUTuiKhz2T7oQd/y139feA
--					oATbSx/6lel9pDVhxOXhf1kTDx3FdY3PS1Wh
--					W/FPUQkKQaxIGNkZH9dkKEEgNhnY5fVaP2MV
--					e9QK6ZMvhhx3IABwvA== )
--			300	NSEC	delegation.example.sec. CERT RRSIG NSEC
-+					tyz/WG3TB1pdIqpToluADGocPccrMuT7v/a5
-+					sQ9RY6QKAzdf9YU/ikEH2SeEPkC4EwD2pPp8
-+					RmURKjzSvSc3D8Q6b1KbC6IHEy7+MDUouZCX
-+					xbQSqRPxLvUQLc2WvK+M6CzpnoqVpOTNqouU
-+					XbwrNA9FyXsHGKOURAGQ9Viu97VNaWUyAkzV
-+					9RoC2T5Y7C2T+Vd/pkhCdi8nvHWOvUxixyXA
-+					mYekLx+TeEx1Ntr+Z7aT9kN1Hv0NsR19o5F7
-+					JAwRTWZvYk/HpRavqbHTw76f1d0jOPq3WOKp
-+					VtvqrklUy9GgPranPH8j7lplg6c1c0H5/7BQ
-+					nFp6xgW2OVH137Hdwg== )
-+			300	NSEC	_25._tcp.mail.example.sec. A RRSIG NSEC
- 			300	RRSIG	NSEC 5 3 300 20121212121212 (
- 					20111010101010 516 example.sec.
--					aCbWibwSZKkYONdUM5Uu6rYkUtPKARhA3LsP
--					yWRLhFYIVXcHpa5gG7mv8QD0jVqAAd7530tF
--					c/fdmoCri7qqELICwZz09FwRNhtgSj6wRCaF
--					vKGt7mPM4ODWKGpUvo/0Sf3l9PtWCV3QmcBi
--					OZbRi6V/znv3bwwXF7jpkVuEors= )
-+					Vz4HOiryi66iURI6LgU9qFqv9a0X9U++uPJ8
-+					Owp3vZivOaYm2rAc10WqsjV1Fb2qJeQL8ips
-+					bSuwhhEOQgBBeez+tfJSOjusfAY9SpwGN5D7
-+					1zoLJl5VN6AAw7OLyEwrom0eO+8fltipfAUN
-+					Ebff1fBbKiWta7Lk4ax6MowUSnI= )
- 			300	RRSIG	NSEC 5 3 300 20121212121212 (
- 					20111010101010 44427 example.sec.
--					vGaDvMuBuy18IzuDR17zAtYpDTDHaA8ZQe4R
--					9pxpDdvLzzXAWHEnXaTmsDrNBHaD6a7lWpMd
--					ONWZH7l8iUSTQGTXsqCQPoQXGcVPdBJwojT0
--					Dk8CG+Hp7pbKututKnnQpZdxy6OTdxc43K+h
--					IZYgn+pS3i+NloM5eQQXvAoL0V05fDYTC+Z6
--					igN2b66Fc5jxG9Snu4VjbNKLn+3H41WiGm9S
--					YrmoLLMdHHxTnRggfOtxD43G3RM/sMjAelF4
--					vXqAetGWwoNWtt5fpC7IA8Vxbp2FYAa6dZ21
--					nCPaveB2Bo4V1tFwkn9C972NZ74+pWngOFSw
--					L6jY4rtMUyNQCALy+A== )
-+					fmn/QXc743TR/J5qs6DI+E+Kx3aq1KpQP/Gv
-+					d2WleTSj0XFIyMwEjonZxmpSavFsLRqn8pl2
-+					OFMe2q1aJxWUKFw2PUC/NfDVeJGqw/LwKjnv
-+					Tz8V1Etn4feyidTB5W/fFNfCmXydgNaVcV5A
-+					4yd88QdXwm/Tz1JYPKUSpEaLsM8niO8CamGU
-+					/6mvS2Ek3Akn57MmiqxKa2JfJuHZpBKHSJdU
-+					RAlrkpf/pjIlEgyD/7vEHhwCC189T+YTz3mE
-+					+jtDNMTH21cE20YVBvWC7gXbTc+UUa6UhRxM
-+					VuVkH32PIsa+/GJlcCckDU1s7kX97hL6BNo5
-+					HCVGRqXBxrsODj8qjQ== )
- 			300	RRSIG	NSEC 8 3 300 20121212121212 (
- 					20111010101010 48381 example.sec.
--					xga8+N3U/2hEz/HkOL/paiHSYSK1tyFOSqIe
--					FbafrJB696y4lxf8IC6VMyop6gmVkYXPZD5m
--					v0ngdjQsfLqCz7nOlHmcvaW1SCQ1m0qN2Flp
--					tCMmhi6+baN59SYtP7iB/Kk9b1xi5M+y4eS3
--					pb0+Z9lZgD7C28oBcO0lzdxNr1Suz0sugiHN
--					tDG2tfodUKxsCbT6jortxAwX7D3gcJuNg5sW
--					RlFTfCfAWU45QKAqvIrjau4DgOSWWYLPpA3C
--					POF1Qx4+vM0VXvE21jIDQAehGeNXl092FHI3
--					NmFvnaCcVmYdC1Qbmuh0kk/jWChLK10Puhdr
--					bKqFTWsOUIdc83q8/A== )
--delegation.example.sec.	300	IN NS	ns1.example.sec.
--			300	IN NS	ns2.example.sec.
--			300	DS	60485 5 1 (
--					2BB183AF5F22588179A53B0A98631FAD1A29
--					2118 )
--			300	RRSIG	DS 5 3 300 20121212121212 (
-+					vGM8jJKJ+F7wnp5fadGlI1DR6uoa6pissW2z
-+					by1iA3eLY+yVTCd2ZD0dxBEke3zVZ0ML8sAN
-+					69RoCXctvw1M9RR3ELUvNlebotQSl21NcwUS
-+					KZYgv1/0QBa51EU/kCwJ9jsfLgFhvZRNKzSr
-+					vdj/UTDp8vBsJXJ5KfdqMz2oOqz3dr1aSBuA
-+					QYKzcIxkKI7pUpD6wWpl2BIHQNbavN58EvY8
-+					ADz0KW8BRYMPuDmjSmRdWxQ5RrA2SSWnZpfL
-+					Z7Z1EyrLU0lXD8ksviVQON1g/vD2iFK227iu
-+					+0Poh9/WeiioJykRM9UJwHxwmzzXVU+nokUl
-+					zc7nYxTMrxNvxFTvZg== )
-+ns2.example.sec.	300	IN A	5.6.7.8
-+			300	RRSIG	A 5 3 300 20121212121212 (
- 					20111010101010 516 example.sec.
--					uEf2xsca1/OJwovwMVGyFB4/6OUmutAWlWvG
--					qM9JDtvUPMhUV8dzRRiwpWfz3YkPU60Hqn8n
--					QX981RtNc23oiwjmo1ehp1DW7R9dqcqxH4KM
--					5gYrdJT+lJAoN3ii43rQNl0N7OfObYxlZj+N
--					K7aMVBHESqQd5ZaRfkiut8XW49M= )
--			300	RRSIG	DS 5 3 300 20121212121212 (
-+					kDQQNP+l0TqJq8Kfn8VU7HqED4wX+CVswCEH
-+					TCSo+ByoaMhG7cWfIzV9d7euMtDWbLvnp/5p
-+					qmmDkhlWjmh8/jDH0eoM5LsYJG+hQfoDGBmt
-+					L/2eEBHcdwahbr5zzgE/z1Kvk4cLInp8iveq
-+					Nlh1br2rMpLuIWZtYYjkOziqKC0= )
-+			300	RRSIG	A 5 3 300 20121212121212 (
- 					20111010101010 44427 example.sec.
--					GIx0C0s5HJdizOCjIFnqf3BvhIwKaJZW9id0
--					vcQAyd3qzbiiuWecM5pdyiJahFpnKmGxTdLM
--					ZCEwNczhZZf+RE6SlOu8j/VcFujTlaq47JMZ
--					uaU2KETUVZzOhFP6Vrddax35icNcO1Qfu2US
--					B501hzVzyAjr4QL9j0KKlYBe3n3/349dHIiT
--					trruNmkB0c/M8KOkApnUbO8/42Xaz5QCBvXT
--					nyx3jp2WHTCCLLC2o0LTD++w6LkqhTXvWcbo
--					oIMBUXD9hXm/NnYjPxR5+8IhIzPjgjL1vzw7
--					RZrtCBVuI6PIsCRhyXxJ2XoxB293M0GxOmnh
--					VBZ0feqy7wVmo+hklw== )
--			300	RRSIG	DS 8 3 300 20121212121212 (
-+					G3ZnC5ZXkcqBbBXM7jDtZ3zLggKW8P++ryWA
-+					McqvywLUWXNGqu1VB+/mcyaEoi66T74hQV4+
-+					bsWhQRNU1zXmPyoKYVoDeLgtnNymQEUi7TFB
-+					mp0iBGGdW/tcZKP+UxrKmtR9nQoo/wuz/RKD
-+					cWGHVAEjnK9DCPIhNwHG3frFimVoc+eoBG/r
-+					okHgI9IWQMJ4z+GGxKwHZ+qIvPTaIXJpBWl0
-+					tiJhj15B+QeShvGK0Au8KvafqXgUEB7o0oh5
-+					KiHTeTx00i7lP+ieneccJNGONhi1grVuarum
-+					cqNrVR1ddGLjz5yvkmzxXtRBCZmcqgRaCzkD
-+					Yr0pMzvhxNzSfQ03pw== )
-+			300	RRSIG	A 8 3 300 20121212121212 (
- 					20111010101010 48381 example.sec.
--					D6eEY7RttRgccoDGLh1/JJ2Q8Xt8fbnNVzXG
--					WhLlMMeEc1S1FzJG8/SKUrvYVKtrU8wPZpLq
--					qV/2jEjHk81vOqj4S+NZh3hV94h5p27Pngqf
--					3fNzd0aO940zkFC30aAiz0BBd7MX28AOowLL
--					1UWoiTCuERpPAQTuRQRbAR2zf+205PJLjbU2
--					764FVJYEzp6Kal66lWOYlB2EqGWdrv3irPpJ
--					lyTYMaFpNvh4qOkRaBgmT06lzGQuG6E/tUmF
--					nR6tQA4oFaGMs4QGWv05iMYYKleBBNlC6OYM
--					0At5mmxZIfiC1viIGDTGvHaKDS3YjWO2YLIq
--					4EQZCBQJAnbb3rHmWA== )
--			300	NSEC	delegation2.example.sec. NS DS RRSIG NSEC
-+					WY7f+CDmncZvjqYEGlrgeRGuf06NZNc4vQ5h
-+					1j3Ux1yjTY22CTCaQafETI8+e8W35l0FPTgm
-+					sTKVnTMD9nloIgghiwMBhbuTgQZjAmatj5TV
-+					ymcNkz1vIWOB7J7eYA1eLdNQ9NARk1N9NrSE
-+					X6pfGzjWydsAhRSQVig779Mz/PPAxG/7rBXM
-+					j3g6+GZwFvbaMJata9HuKP9zgIbf19CG5MLe
-+					nGSzquzAJEIvPXvwvddSQCGg6ADuHppYwOJq
-+					rkqsKga2T73Nrn5k9KrCrt+1iC1LJvbws2R8
-+					jkB/N+49IlkzZOZXtI/KgL9riaOnbFCyI3iI
-+					lJB/LXjunEB1h1Nr2A== )
-+			300	NSEC	public.example.sec. A RRSIG NSEC
- 			300	RRSIG	NSEC 5 3 300 20121212121212 (
- 					20111010101010 516 example.sec.
--					iG8wud8jrvX0STdk/BPdIHUCMgeIExOklQEO
--					Ah+K6e4LJakFKjuI+G1tTLdHOP2GauWkb3GQ
--					0Ozj8r7+jQEz886ZQmCR8RigqW5/CsnwPc9V
--					oc7TbNntOs+M4NyOiqC9NfmafrpqIrmbLMBW
--					THN6XGPUMdc5riMr8miTKtLDMF0= )
-+					RLH4xaCk4HFnbQOEGFM8xTBllDyNolLE6u6W
-+					5loi7NdPv+6F80w12oYENwVYRXC4cXa4x47l
-+					aTAOTXEEf1LJeP6GT5hRUhRj3oTMC6InVlHq
-+					ZfPONJgzsyaX958ha91Z2VkP8t1eliUA1mSc
-+					PxbVOMzAsUkPbkHp8D2CRzHwMCo= )
- 			300	RRSIG	NSEC 5 3 300 20121212121212 (
- 					20111010101010 44427 example.sec.
--					Hw2H90l/QMOJYJPO+B1eCpGQXJGXOd5MoUfR
--					Fc4budW2eesImgWQ6TR8Bvwjz95niA8lpGyq
--					QEXjJ6cEf5JEKYw/4xOVlmFNDHyG//iQ1kpf
--					2+aT8IuiM0evbBgiej/VhYZFScUQ4Ibslna/
--					BFMyoJ7ugLmLelYiolB9g30a3q/3ULYwfn1j
--					OKUbYUeWClKQ+l+i37wRuBIPX6aT6//CetOX
--					uCecmaDTXl94NKi2pw+fZKs504Ed7xT6FtJF
--					9FYJAlsFloV7T6epZ/d5pl82QYaEshZpMePa
--					nqah+amBETh/kd3vokG1lzzFzSbwrWjxgtq8
--					XYCG9CbCOcJz1N0bXg== )
-+					zl2+IlLPn/ab3nK68sCXibCB+lu8EES0wgzd
-+					Vs9FyyP62V4sqjCrPaiGHHeoq/wS+gQwwBQo
-+					6mRZ/gT0Y45RoQER4XgDi/HQWX7zaCeMJ4aH
-+					P0qs9YfJ2odYPAYJbcV4uSRB25zxx+xPUtGQ
-+					gIRKdyUTeXxjBujcraFxdDGMi4HGqFKS/qDg
-+					9x3YnQW4DeA8VQuSCdIoH0zWARyJLfaN01Yc
-+					iAvRGt4QLzvE6Wb3YqxbOMinsLkrnMPTaUjq
-+					gSiM3pvopj6HVI9ElQVQFb0SFmc4IOusc/1u
-+					F1nYngdhGjS+8LVcCPdXJajqiozkGTGN5ISJ
-+					KgWWmA7G51peHjXXzg== )
- 			300	RRSIG	NSEC 8 3 300 20121212121212 (
- 					20111010101010 48381 example.sec.
--					yc2VoV4VVT+Wo/rVo6brdb7LfxMOslatW8Lo
--					ldBOGkVuiz21DskK5LUMGkH/4+NZ2L/aaDCt
--					JyiARZXabIqeMMY47QbNB1DouT1yKvR1Bc4D
--					Hgo7vK3eL4nf+3x0AXxTOdmdq6ZifxBkI5V/
--					fFKADNX1Mj1Xh1yVelJnXPLU/ZkAvtakWmJ5
--					Dj2I2EETshpkC19lqOP8i97jMR0OWfTCjbzT
--					SL8t0AcbDEWo/TFRXkMP0MaC8NMXmWtkSMH0
--					96nYIS3YA35OeV+gr6LtEb0VJd6E0c+FnM2s
--					T3Up4g+99W8Fs+FIYxYisan296LXff0eNCgQ
--					fNw1Tj+4tWl4lh333w== )
-+					F9HM6TzOjWpVtiDblqGvcDDcpU5/flAM8OLR
-+					YEIVoAqTiMGwGKMQ5Mqs0Fvnlk6+fTnQu75c
-+					OYvGM4JGucdyWNmzyIQ03L9qonEbBFm3FewR
-+					fL/0COs1GJGeglcHFW9dBIK2Elo4Q9q5mtxY
-+					JCseGHbmjZIs1busGdm/W+JyaCYiHBPJi8xf
-+					ijfk06miRoGaLS7/CraajQmGQLF3iF94DzEU
-+					OuOdWZX2z81VrbI2DbCVRYlokjKz7cc3mm+d
-+					zhJAKHcMXN4PTqcWg5mgdulkGvqL2qFgi5e2
-+					WJxUFZxEDn1Zbqte40CZHVqMdv4I76f8mSns
-+					dFXZVw7n478EjuVj2Q== )
-+_8443._tcp.www.example.sec. 300	IN NSEC	example.sec. RRSIG NSEC TLSA
-+			300	RRSIG	NSEC 5 5 300 20121212121212 (
-+					20111010101010 516 example.sec.
-+					fnXPjf7r3kCoArvAvDDS3auZjPpx73h0J+DP
-+					4vcoRLlnw/EO22p637vl4qkr569ri5hgnfCp
-+					5by0mEHIwvuQkmthglMC18BUAZfFUIV1VMdS
-+					6ZSnRgalGiuUuisaVM1KzuGxrMiVdE3nUtBf
-+					wL6eDaKZVje8bEKiyIx0k8b8RJU= )
-+			300	RRSIG	NSEC 5 5 300 20121212121212 (
-+					20111010101010 44427 example.sec.
-+					5UlBCjG/8+046HNSKZnHLcMjdYsaghyD5nUy
-+					kjzh4kg+hFw6buTLpCHEL9nun/912/2r75pw
-+					kYQyRWeg37c1KAJg2j9V2c7zh5fqDHHPbpid
-+					7edtFcqE4UaC/x20/QO4F0l+kmhY7R0/fjvz
-+					9eDlnPpxBqVmYULgC4YGT0i003vQmB8zsASF
-+					7nKjSk3/a1zLG/SkEGD5ioG4ZcZc7WxW47ns
-+					qEWKmtnuZScK/G4VmgrajiLst9/q3Pouoct1
-+					OB7MHv5dOYFhQv0/hxhSqeDXrvGNJ93Vvd8J
-+					qTm+6SgovkyJ/rYLAprb3pV1Ahlni3zP832O
-+					4Ulj151/xqih/93P1w== )
-+			300	RRSIG	NSEC 8 5 300 20121212121212 (
-+					20111010101010 48381 example.sec.
-+					RMag/BsXGLEMs7IgVCmcqhfImK0BFlRyzHMW
-+					REcuYTvZVgmvUd+Yziiy960kXYFEbUEconb1
-+					6U57kpCYEnhQMb9hGDBUYlnt98jbFwBe/XN/
-+					u7vxVQsojsD3MY7t9epqPaQ8CHfb55ldVuTK
-+					p9GTOiAin3cwZoHN+t+wzLc+SI7O3ii1w84A
-+					ZhCaugQlYtgCI/1WsGb0UitBtevcvDWK/u+6
-+					3wWlWnyR4rXhpz0Z1UJtqEk+r3W0dbSmwodk
-+					4zrkClRqM0ysE28mnoo8FFnlNa876dP2ErWv
-+					hpeVPa30BD1hxwtdShL25VbDQ9lqJOmmYVuo
-+					fQmf9uKqnvX+WS/lRg== )
-+			300	TLSA	1 1 2 (
-+					92003BA34942DC74152E2F2C408D29ECA5A5
-+					20E7F2E06BB944F4DCA346BAF63C1B177615
-+					D466F6C4B71C216A50292BD58C9EBDD2F74E
-+					38FE51FFD48C43326CBC )
-+			300	RRSIG	TLSA 5 5 300 20121212121212 (
-+					20111010101010 516 example.sec.
-+					lkKqiYh4cunZ61uN4dW+LvCxh2ILzzlBLEdf
-+					IQv4PCVZLzhbWheZBBSQWPPp9wEzTo/40/kZ
-+					pqfer7aUu5cyHBxB5pGJDbfbPamlEgAa7fLE
-+					t9mMJ6cAp27mu4D68t+cp8fialXk+fe5DByU
-+					47d6K5NMVoeQZTU4yv6L/sKAARc= )
-+			300	RRSIG	TLSA 5 5 300 20121212121212 (
-+					20111010101010 44427 example.sec.
-+					YDul3IDmxdIt5XSBV3lGDIVCIEtHto5lfVM/
-+					1+nYUd/z/LGvkoAMNieI7OFB+3/wEaDNGBzX
-+					tZYPsCSGFZ3GGmI/FtOQ95LMC5zFEFkN7Run
-+					xYokbrFrWeW78QkfiwbXsLWDewVxzJXEYo1H
-+					1TtjGdhAVq4R8khRdlAytLQfmQvZCZtryYKp
-+					KOCqU6tdilKNG/WF8lhG27hDDUYj5J6+QFp3
-+					1x+Swah1biitJwQosXVVo+tUFquPQ0RJqWkr
-+					zPVAgrb5FbtSieR5c5cP0usosUZaOpHzc2sJ
-+					FepzF6xhdmgyDqaUqLnos8q3DyIHqM4Kaln3
-+					Me4jWC1HRBnYaWecFw== )
-+			300	RRSIG	TLSA 8 5 300 20121212121212 (
-+					20111010101010 48381 example.sec.
-+					r9ehTiWmpcAfojfJWBruAfd2B5WXYVswI8bz
-+					Xt0j7ELVPnXKM15oDFpYYmKSREoiyrM6Q+1M
-+					mITFsJwsGt7UmrHn8lVxXxTmWpvA7C/v+/Zt
-+					kUZQsRWSPtVOrEu50plnscsRZcV5PIqqaPgC
-+					S/066uLAaWiT4mWV53ZRDebaXnAvQ10VQ//k
-+					HkVJeJMGHJdJyyfYZfotPTetJJN0JccJpx0B
-+					3N/VSFlxWIyRZVn8VK2z4RADHuqzkXklynmM
-+					6feVrOi91YywFcSFNmOs84lr7UYKFFf2pKTZ
-+					/RDbD0xCIQV+cKqizp2NI4v1FTbdBzsqTRoN
-+					/DwAW5qleHlQb9TqNQ== )
- ghost.example.sec.	300	IN NS	ns1.example.sec.
- 			300	IN NS	ns2.example.sec.
- 			300	DS	50458 12 3 (
-@@ -835,168 +1260,6 @@ public.example.sec.	300	IN HINFO "i386" "FreeBSD"
- 					DLIOZ1682IAviJ+htzGmCYTl6iZMlt8wJ5LO
- 					Yfkzvd9UUt4w0OlOe26Kc/mBoVy2Lk3mn9BW
- 					Ba3V48bTYWHHbIgOTQ== )
--mail.example.sec.	300	IN A	2.3.4.5
--			300	RRSIG	A 5 3 300 20121212121212 (
--					20111010101010 516 example.sec.
--					LxovxXszIrJ0WqC4lryebK8Png85a1l62jvj
--					JHLNs25OP3I/CpsfLXmE2o+bGXdCoppA6k+u
--					+d0BmWG32UmOXQOkcu3haT5J8rJWPV1xynhJ
--					IsBCmF/UbEXp6PoAniCcytS4ZsHqrm31KBNI
--					i/ZXtU93D2CGrTDMpwX13xT4scE= )
--			300	RRSIG	A 5 3 300 20121212121212 (
--					20111010101010 44427 example.sec.
--					LNe6/SJmAkohBYlRtofW0wYMPDVJ2ZTCmOwe
--					hwZBKvNrcxc8uYlzqSBqjD6Vtq4GpJSl+MV0
--					KY0GpsE2jz49l4ayUi5QIC8wRaJ1NeTDiwBp
--					EbA5ycNdzSpGtLFNs0qzDQntdrZdtvoaFCcV
--					WDPNGP4rvhvTMXfriPJuYJ2W5ZxmXp3DYNDZ
--					E+1xgJ3hvr6pdAy7UdROrhsOp3ohP15sE8/H
--					+sU/hmZ9hfBeodpGHhWYIc6FSMOca3pEBwQL
--					ifVL2Q06ijnqbh6iuJqJnqI++ZadCHIqEYNT
--					Tn96mylS3XQ4S3FZPPrXXhuM9HvKKxnDvvWX
--					ALsm728QZQi2keAKkg== )
--			300	RRSIG	A 8 3 300 20121212121212 (
--					20111010101010 48381 example.sec.
--					tyz/WG3TB1pdIqpToluADGocPccrMuT7v/a5
--					sQ9RY6QKAzdf9YU/ikEH2SeEPkC4EwD2pPp8
--					RmURKjzSvSc3D8Q6b1KbC6IHEy7+MDUouZCX
--					xbQSqRPxLvUQLc2WvK+M6CzpnoqVpOTNqouU
--					XbwrNA9FyXsHGKOURAGQ9Viu97VNaWUyAkzV
--					9RoC2T5Y7C2T+Vd/pkhCdi8nvHWOvUxixyXA
--					mYekLx+TeEx1Ntr+Z7aT9kN1Hv0NsR19o5F7
--					JAwRTWZvYk/HpRavqbHTw76f1d0jOPq3WOKp
--					VtvqrklUy9GgPranPH8j7lplg6c1c0H5/7BQ
--					nFp6xgW2OVH137Hdwg== )
--			300	NSEC	ns1.example.sec. A RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20121212121212 (
--					20111010101010 516 example.sec.
--					CQt3t9eRRTC5mv5c46WsRDX6aZk4jW4RqsEg
--					LWY5zSxShOBKsek/RiUzpcN+N+fu46NGKzpb
--					Gmgu8Q6LfO49hIWv8Ng4VvAqPqTO6wXC+kIY
--					p7VuVydrdHNI4lrz1Vb4Kb8B9x9bqopd7SDq
--					w05X4E3NEnuEZpO4IBx0dq6WVtA= )
--			300	RRSIG	NSEC 5 3 300 20121212121212 (
--					20111010101010 44427 example.sec.
--					yg7PqCc01WBqcyCjmsdoeaThprboseA5DA5u
--					N++BVVcX9fqLHRe3gEdPQjrhaSIcOD3mK1xi
--					l5v7g+33R483h6yliN6u8SCYxao7o0sBNIub
--					ZFyneOyaJYkL83I72sTkARovPIymfJ9n4gZu
--					SGl2opcJunj1eQAa+vKuhc3RUvZrgOpH1dMr
--					TXYHUpxMl7IO+o5x90rVbSSU2QImuxwitQ5b
--					Mt6wrM5uAdFtsRC/wequhP1uARE52ZEh7u22
--					zUqd8xyjfIdKFmSCIMLBCzIimuNuXaAqT4Hw
--					gYtrTcinj1GPo0OcaBHcGc0DI99pwatUv6ds
--					CqJNUumYaNeGf85jWg== )
--			300	RRSIG	NSEC 8 3 300 20121212121212 (
--					20111010101010 48381 example.sec.
--					acXn4lWozO7QD3vfPy+OV+WDFBUJXf1WGAl2
--					FCWDf2IsOCHhlUNHEAwiHkORMY2AVlfZS9hG
--					Z+RRW7b0uelYsmLPmfwZtN+9IsehcCjYg5F7
--					ZfqiTXNGs9Er8IjV6Ogic9CiOYwWRHn+X2DP
--					haE6UP4LYEqP2eFPTMVN/E5smm6SI4HVNrZW
--					W9MgzvHdUl4RurWQYl8KyOTve1ElyJt+a2tw
--					ydanT1Ncbi/limS5f61U4WckBMfyZ5vH+SfK
--					fxMyIwpz9mWLGzy9wyBMYBLfSdNX0vI+wvR+
--					/b0D0SDz11F1le+cERJhO4CBxEFEiVqQHpKG
--					sR8RStNy8Bq0o6mpmw== )
--ns2.example.sec.	300	IN A	5.6.7.8
--			300	RRSIG	A 5 3 300 20121212121212 (
--					20111010101010 516 example.sec.
--					kDQQNP+l0TqJq8Kfn8VU7HqED4wX+CVswCEH
--					TCSo+ByoaMhG7cWfIzV9d7euMtDWbLvnp/5p
--					qmmDkhlWjmh8/jDH0eoM5LsYJG+hQfoDGBmt
--					L/2eEBHcdwahbr5zzgE/z1Kvk4cLInp8iveq
--					Nlh1br2rMpLuIWZtYYjkOziqKC0= )
--			300	RRSIG	A 5 3 300 20121212121212 (
--					20111010101010 44427 example.sec.
--					G3ZnC5ZXkcqBbBXM7jDtZ3zLggKW8P++ryWA
--					McqvywLUWXNGqu1VB+/mcyaEoi66T74hQV4+
--					bsWhQRNU1zXmPyoKYVoDeLgtnNymQEUi7TFB
--					mp0iBGGdW/tcZKP+UxrKmtR9nQoo/wuz/RKD
--					cWGHVAEjnK9DCPIhNwHG3frFimVoc+eoBG/r
--					okHgI9IWQMJ4z+GGxKwHZ+qIvPTaIXJpBWl0
--					tiJhj15B+QeShvGK0Au8KvafqXgUEB7o0oh5
--					KiHTeTx00i7lP+ieneccJNGONhi1grVuarum
--					cqNrVR1ddGLjz5yvkmzxXtRBCZmcqgRaCzkD
--					Yr0pMzvhxNzSfQ03pw== )
--			300	RRSIG	A 8 3 300 20121212121212 (
--					20111010101010 48381 example.sec.
--					WY7f+CDmncZvjqYEGlrgeRGuf06NZNc4vQ5h
--					1j3Ux1yjTY22CTCaQafETI8+e8W35l0FPTgm
--					sTKVnTMD9nloIgghiwMBhbuTgQZjAmatj5TV
--					ymcNkz1vIWOB7J7eYA1eLdNQ9NARk1N9NrSE
--					X6pfGzjWydsAhRSQVig779Mz/PPAxG/7rBXM
--					j3g6+GZwFvbaMJata9HuKP9zgIbf19CG5MLe
--					nGSzquzAJEIvPXvwvddSQCGg6ADuHppYwOJq
--					rkqsKga2T73Nrn5k9KrCrt+1iC1LJvbws2R8
--					jkB/N+49IlkzZOZXtI/KgL9riaOnbFCyI3iI
--					lJB/LXjunEB1h1Nr2A== )
--			300	NSEC	public.example.sec. A RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20121212121212 (
--					20111010101010 516 example.sec.
--					RLH4xaCk4HFnbQOEGFM8xTBllDyNolLE6u6W
--					5loi7NdPv+6F80w12oYENwVYRXC4cXa4x47l
--					aTAOTXEEf1LJeP6GT5hRUhRj3oTMC6InVlHq
--					ZfPONJgzsyaX958ha91Z2VkP8t1eliUA1mSc
--					PxbVOMzAsUkPbkHp8D2CRzHwMCo= )
--			300	RRSIG	NSEC 5 3 300 20121212121212 (
--					20111010101010 44427 example.sec.
--					zl2+IlLPn/ab3nK68sCXibCB+lu8EES0wgzd
--					Vs9FyyP62V4sqjCrPaiGHHeoq/wS+gQwwBQo
--					6mRZ/gT0Y45RoQER4XgDi/HQWX7zaCeMJ4aH
--					P0qs9YfJ2odYPAYJbcV4uSRB25zxx+xPUtGQ
--					gIRKdyUTeXxjBujcraFxdDGMi4HGqFKS/qDg
--					9x3YnQW4DeA8VQuSCdIoH0zWARyJLfaN01Yc
--					iAvRGt4QLzvE6Wb3YqxbOMinsLkrnMPTaUjq
--					gSiM3pvopj6HVI9ElQVQFb0SFmc4IOusc/1u
--					F1nYngdhGjS+8LVcCPdXJajqiozkGTGN5ISJ
--					KgWWmA7G51peHjXXzg== )
--			300	RRSIG	NSEC 8 3 300 20121212121212 (
--					20111010101010 48381 example.sec.
--					F9HM6TzOjWpVtiDblqGvcDDcpU5/flAM8OLR
--					YEIVoAqTiMGwGKMQ5Mqs0Fvnlk6+fTnQu75c
--					OYvGM4JGucdyWNmzyIQ03L9qonEbBFm3FewR
--					fL/0COs1GJGeglcHFW9dBIK2Elo4Q9q5mtxY
--					JCseGHbmjZIs1busGdm/W+JyaCYiHBPJi8xf
--					ijfk06miRoGaLS7/CraajQmGQLF3iF94DzEU
--					OuOdWZX2z81VrbI2DbCVRYlokjKz7cc3mm+d
--					zhJAKHcMXN4PTqcWg5mgdulkGvqL2qFgi5e2
--					WJxUFZxEDn1Zbqte40CZHVqMdv4I76f8mSns
--					dFXZVw7n478EjuVj2Q== )
--delegation3.example.sec. 300	IN NS	delegation3.example.sec.
--			300	A	1.2.9.253
--			300	NSEC	delegation4.example.sec. NS RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20121212121212 (
--					20111010101010 516 example.sec.
--					WuuwTT692DQs9iSoi8mMe3/r8IIrnKaKisRF
--					UZ5aC6qTb54FydtNsgWAOOwzN21EI/ucU0kX
--					iXRcaJ0jvNG30ICWk8oI3By1dXDhpMrZerZt
--					hMDvnitwa851ZjxGeDtyJsMf2NfAuN0p7V3W
--					UxEGVpiru6ZDNO2rqfwAd35+ixc= )
--			300	RRSIG	NSEC 5 3 300 20121212121212 (
--					20111010101010 44427 example.sec.
--					Vt/wOn+RgrH7e1m/E7XqhoF85i3q1JMnZ96K
--					E0WMA40MOmClX4+1oHwmdfeu/9U8dqxp4mJf
--					iJ2nz8tMoYYcJwa/NhOZs8UZSILUV+ACyhOR
--					g923yYViY41pyV4DCXxa17Cbc1GWizqDPvZl
--					yksNQTjGfVslH3IXlkGS6OPHY8HImnPKK0HZ
--					M4si1bZjFg+SU447VokQvz4gKxVHca20R3wD
--					8A9ZwPHN/97A8rQJzRBlEfAP0EqG8cjt7s5g
--					ku+ZoeK/sjeQoq3VGUxJWEZU2lXVYwCAv8Yh
--					9M+6PZ+O1pG2nfIgqpR+MGHJ79LAdTdRe6MJ
--					nrnROvz2DumLzi9kcg== )
--			300	RRSIG	NSEC 8 3 300 20121212121212 (
--					20111010101010 48381 example.sec.
--					bH5sNx6a1xTa4fafzO+Ur2CCz7W+RU8EiYhu
--					mRltM1GcqQ0Cz0k9VQyRzkCE9HGPkzb9lDIp
--					HiQS6zf70m5YyXVgMG3WBN0MteVb0/1ut3jq
--					JDkQkSMtjyYnJdZ363lpfI363eAI6c1l+XlN
--					mvEZrUbUWn6entMRj6ZQas2r/7dp61tkZj/x
--					PU+4SZeVZZPJIZdDf3QLzak+tXG/fs4OCDih
--					47F8MhlJ3i+L11FawFVoGXVo2NZ/SOhLoh85
--					aEGPu6j/whxLR6pw6JueK0euQWEeH6nDfXgB
--					PA1IYI06aExyLN+n4R1wC0q5iAS0ssA+MY/Z
--					cXye1Yt7SWn5oGXE/Q== )
- www.example.sec.	300	IN CNAME example.sec.
- 			300	RRSIG	CNAME 5 3 300 20121212121212 (
- 					20111010101010 516 example.sec.
-@@ -1029,38 +1292,38 @@ www.example.sec.	300	IN CNAME example.sec.
- 					8v9ej2F+rRBiwmJX5Td100sttLkHbQT+ltZr
- 					Kp/IDck6EptYFdrTSiB9fnz4wiRWgMULdF8Y
- 					Xo4310RHDB0R58Axew== )
--			300	NSEC	example.sec. CNAME RRSIG NSEC
-+			300	NSEC	_443._tcp.www.example.sec. CNAME RRSIG NSEC
- 			300	RRSIG	NSEC 5 3 300 20121212121212 (
- 					20111010101010 516 example.sec.
--					EIvFwBTbyqOgIVQNRFVpEiDCdOO9yB1Kw8li
--					7arpp2EC38D3cZh7fjf20cwrLNGjCL7s8UDH
--					v5v5uE8iLm/nCTIBHjuKVlsAtuC8+cbBThhh
--					S1ZO+lDraBcwBSjvZIClmzi9mcCy47z2jeEv
--					xpmD8piD7LPObFZkocxp7x9wdYc= )
-+					lC6797IgsOeBVWiBPVtc+BCFsk7uyFHLVlPm
-+					Zi0T+3LkX7EeKKB3daEbYqIlEL9zzLDwzYTB
-+					j2gXJ7+p5fMr/FsGKNvnCLTuY893GkZ7M+Fh
-+					VjEIWQ0XsaFdsz3qHzaUUAF8ZXiGwGX9MV1u
-+					Di6M3Kh69Hiu4vYeCoLBTwhIuO4= )
- 			300	RRSIG	NSEC 5 3 300 20121212121212 (
- 					20111010101010 44427 example.sec.
--					bsb5tRHbvH1amKiZvpbSjglaqY+5mOS1mA2z
--					eeauX7TgvgS+mXys3ywGxTtT9V5zG78luWL5
--					ux4TtBabLhOOcr+qXqWLcMDa8XcIYDwGeBHb
--					nAbaHfG6yvudd5syQh3B87m7/IATqB5kwr1X
--					S/37XceeD4NGZtPkryakR6t3pEQMIaKAEO8H
--					Y5K2p+uXAJGLUdRqS43UBz6E5YfHUdQQiM4x
--					BWJDG5lyQlAiAFQb3UWfarFFVh0eFXCFxHRK
--					k55VMk/b8R4DsbAiXlhtmmz3s346UTOjV0Ae
--					Fn03PRMsCm7sI7OAXef9lzA5zjwxY1+a/Vzw
--					VREjp174PHtOcpAY+Q== )
-+					tiaAXshAPsCWzGS8dNxZ1Odh6jt/mim39w7B
-+					mQTyKpzYwrux8HBPeg+N8ko7gGblVKexL56b
-+					dHOfhkh2qIHIhg73sMEVaVd8epRfpDcrpzZN
-+					+o+haVN8/8RbqbY/9DbMiuUKwG9m3iWCAkeo
-+					OhN6wNMRO6ijJ4nmoCOa2wzqKDLoTBjoUKMT
-+					zG5HbuUMSZbBA6TRqv3Fe6gyZiS7iusYvq5/
-+					Hu2m8r9tSfhLLSjbZNhDE/fvYMYak3auOdfm
-+					7idAue2oy1nsw131S4klMG2XlXm0pBKU4PVx
-+					t0hELXyUVm99sO8hg2qKvdupWaxIQ0CC+hBK
-+					kUc6BTdj/eEBMvLnaA== )
- 			300	RRSIG	NSEC 8 3 300 20121212121212 (
- 					20111010101010 48381 example.sec.
--					p3+B5Ye7vtdxqVC5WgxrSC5sRb3/4vLLpVcT
--					SDKcHtT7TA30Xp2zO113pDiknKzUZMhQj0dY
--					ZfmsMnqH7YEKR6auvZ1gkgsIAetk7D20rbgM
--					yogDZaueIIS5PVqcrzw49P4XeIAPGevyq3Cp
--					kB03H/oLvFYh50qIk7+CvP+G2uaUkv1AUwwJ
--					vYjQVh13JK0lWvqUDoJbtpFGcEixH/Gr0A2y
--					rkkv0B6kDUNYuZ8UGywrzOBVHS+2oGMKFKoS
--					nzrIEt6gDdPxVwITa0mFHwBvEtmKjXSPS+gO
--					z5dS/fmdVn0IjvZWZsHviaXB2cCJesJTxZZg
--					OtZaIgJVIwQlKosFRA== )
-+					ncNaPn7TqvJUjiW3N5ETQXo5Lu0+I215t6r5
-+					0fRAvh4FwZAgkbxzpKcHpobp3z4NVoMOZk21
-+					4SoX8WxQhrNTyfmmzMzJ6+t4xA7Uu2H0Zul+
-+					nGQHg4xPUWuMFymkKc514ycn3EsSmeCgZQXi
-+					i7+x/R6GlGQNIx83VYJ3LOEd7OEUvJizv59n
-+					+jTdekurwD/foWdf2CqDj5HRpTT52Ki5Zvze
-+					b3VLrHuQiojyLiBOeoC1NTyrZHS/PNHA2b5v
-+					ZOweSzrOywMwS99STlwZ4dPYE4AUL05KEmF5
-+					jJ35+UI8vPozKHN2T68cdTkGKtKR7eFuJ/PY
-+					bHm0zQxDhf+zGbiX5Q== )
- lets.introduce.some.empty.terminals.example.sec. 300 IN	CNAME example.sec.
- 			300	RRSIG	CNAME 5 7 300 20121212121212 (
- 					20111010101010 516 example.sec.
-@@ -1125,67 +1388,3 @@ lets.introduce.some.empty.terminals.example.sec. 300 IN	CNAME example.sec.
- 					+EFtzyZVGt0DrFpEQHKmq8L5cjjleMsfJRPx
- 					2+K170ejOuPI7bCWmdZ1uyqxrUCNEu4UlR3z
- 					9anMEzjdb2UGUcCRCg== )
--ns1.example.sec.	300	IN A	1.2.3.4
--			300	RRSIG	A 5 3 300 20121212121212 (
--					20111010101010 516 example.sec.
--					Jz66qNND9eWmodjPcTD9VNb4G5BIqd1MPcMb
--					9g+J69b1T21cNqAuIom5Y4cECyz/zNJOno89
--					b7KKcpItUnsdyBHb5WuDeJapT1s4FyEYDEms
--					diPzaEDEJCTmjyOx/5ADZ5L6I8EN8a3V+iWh
--					A2YMtWWWjZykqXHeVLPZwqbMJS8= )
--			300	RRSIG	A 5 3 300 20121212121212 (
--					20111010101010 44427 example.sec.
--					RzfNZ0Pu4Vxk5xpCycv3ZSDDMViw+h6nR1uY
--					Jls1+oSygJfeQn0xeTcVzaZQvvZc0gtnecHT
--					5UopyFB36R/qeNkPp5fFHGb+ZpMAaNmjrxGI
--					/1OhxvES4jwTaihetjVWEQyN0M0+Pgw0BNsN
--					tbz92zBczpUFTbe8FxldePwLcJFZ5CAvp8NC
--					VuzqAHVMGAt7DYvr9qTknrW/X8wszxwUuL0H
--					mwitcRF397E6H9SA06uDNum/s8RST9lsV1A2
--					GsssmglqqKICY8+g89SDqkSuxk1bsFJ+dvFx
--					kfXRlzBBvpuFt8sORt6LPJXSlFy/tgtRI1lq
--					oJi9S51V6XElb0vu1Q== )
--			300	RRSIG	A 8 3 300 20121212121212 (
--					20111010101010 48381 example.sec.
--					Q2LBOCx0Ol+UX8yBrpWvoZEPu4bGDJfznS6d
--					uYWDHZc70kjSBipMO+vmzHTPXiax4LTXXznm
--					u6gtzSh05FTmQUx2QPctCwwLW3Lfa4xRBnQw
--					KV+HH0AyXUlKy8gNRBNgJmcQyvyKLr5T8UhP
--					PYQI60UZxU+vCa8Z38Wffy3X0+AraXFwMc3M
--					YClGU7HFn7cCKeIrdWl50PEYpa8qUj4ec5XS
--					1QYZu2v8LE6GmChCCFIJsdkU+JzUJ9mOGYrr
--					l/aI8G+DPa17NxKwihgzQ6fQIS/AXOx0rUNq
--					ObP7mpqqn76X6BnfJFTGs9BUCms4W/sVNvra
--					hbAKFCLCNJAz9EO9Xw== )
--			300	NSEC	ns2.example.sec. A RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20121212121212 (
--					20111010101010 516 example.sec.
--					MPFeioCIJDe03C9RD6Kux0g08JgJYH7xtyFF
--					4OOOZVHD1mrI+BmjxtWwhb1c7Uqd8+/J9NLF
--					qywR/OzLW58FsNjznhl3Btr6HsfIfLrEOrTf
--					kbFlOOSP7gA5ngsC4nMqrWDPjSJwjJ5b3XIT
--					12C2Efq87MFneqOEzUzIpqDeSdM= )
--			300	RRSIG	NSEC 5 3 300 20121212121212 (
--					20111010101010 44427 example.sec.
--					kUQ26M/bdHkAbREgxC8kBkgxEpnXkQldxwki
--					0S9mvnmJToiGjnvBIkDixX9BWrx2s8Nzt5tc
--					xfWqmzlbdbea+BitXMN2o9hnAWNJ0uFmQFaN
--					M2li2EH5FlCFPpN40w9hazRY25cBvciUJzNE
--					CaMTtDPRB9GUmZKjE/ZP0N4QnrxvrOqIMJlu
--					dCsLQ3of+NyBWYpsQQfQvbAvx2WNpolOjqMt
--					woCsfZhjvedlAAszdaNKCm2qcxYuSKvkw9hl
--					n9RuZkgYCf+4o0k/DRP6zSwacMo1Rcb6S1D3
--					b/AXMhBxwtytfaKPh0gAFB2fWck0TLpc/5EG
--					AuCcy6aJR66j0frDBg== )
--			300	RRSIG	NSEC 8 3 300 20121212121212 (
--					20111010101010 48381 example.sec.
--					Rktfcj5WkoW+7lt1iMFsQXr70zjRdHCUBDf5
--					zqet9JtQU6r9HSdto4gJAXwwH+gYVWU1zMAo
--					ZrurdsYhkCrUnUYdO/g6Q+xDIdvPQY4UeUaq
--					1lZbumzCGAQD21l+nrjxwkD3kvyDtfnAnxU0
--					eL+/8TqZ/Oo/2cEf2hkuQbOfQqpXImig0n88
--					e1+xBTJV+fPeORGxnAVL0QMRRabTyOqCPiwj
--					rcuXpIxRjKWOAEseoFHJbdvFc3MNGwfBC/BR
--					qI5xzREGVG3yUpY6o1EVkJTNMHdtahZsMOWl
--					hb1dFARcQSFHUdEEwZwc1gtIa4snPxpplgCd
--					ZetiK9mOJTMhVhGQSA== )
-diff --git a/t/zones/manyerrors.zone b/t/zones/manyerrors.zone
-index 79aa287..6682983 100644
---- a/t/zones/manyerrors.zone
-+++ b/t/zones/manyerrors.zone
-@@ -64,6 +64,54 @@ singlens	NS x.y.z
- xy IN 300 A 194.28.255.11
- xy IN 400 A 194.28.255.12
- 
-+; bad length for SHA-256
-+_443._tcp.www IN TLSA (
-+      0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
-+            7983a1d16e8a410e4561cb106618e9 )
-+
-+; bad length for SHA-512
-+_8443._tcp.www IN TLSA (
-+      1 1 2 92003ba34942dc74152e2f2c408d29ec
-+            a5a520e7f2e06bb944f4dca346baf63c
-+            1b177615d466f6c4b71c216a50292bd5
-+            8c9ebdd2f74e38fe51ffd48c43326cbcaa )
-+
-+; bad hex encoding
-+_25._tcp.mail IN TLSA (
-+      3 0 0 30820307308201efa003020102020 )
-+
-+; bad certificate usage
-+_1._tcp.www IN TLSA (
-+      4 0 1 d2abde240d7cd3ee6b4b28c54df034b9
-+            7983a1d16e8a410e4561cb106618e9 )
-+_10._tcp.www IN TLSA (
-+      x 0 1 d2abde240d7cd3ee6b4b28c54df034b9
-+            7983a1d16e8a410e4561cb106618e9 )
-+
-+; bad selector
-+_2._tcp.www IN TLSA (
-+      0 2 1 d2abde240d7cd3ee6b4b28c54df034b9
-+            7983a1d16e8a410e4561cb106618e9 )
-+_20._tcp.www IN TLSA (
-+      0 x 1 d2abde240d7cd3ee6b4b28c54df034b9
-+            7983a1d16e8a410e4561cb106618e9 )
-+
-+; bad matching type
-+_3._tcp.www IN TLSA (
-+      0 0 3 d2abde240d7cd3ee6b4b28c54df034b9
-+            7983a1d16e8a410e4561cb106618e9 )
-+_30._tcp.www IN TLSA (
-+      0 0 x d2abde240d7cd3ee6b4b28c54df034b9
-+            7983a1d16e8a410e4561cb106618e9 )
-+
-+; policy  bad domain name for TLSA
-+tlsa IN TLSA (
-+      0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
-+            7983a1d16e8a410e4561cb106618e9aa )
-+_30._xtp.www IN TLSA (
-+      0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
-+            7983a1d16e8a410e4561cb106618e9aa )
-+
- outside.org. A 194.28.255.11
- long.outside.org. A 194.28.255.11
- outsidegalaxyplus.org. A 194.28.255.11
-diff --git a/textparse.c b/textparse.c
-index dc92ac2..78ab943 100644
---- a/textparse.c
-+++ b/textparse.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -69,7 +69,7 @@ char *skip_white_space(char *s)
- 	return s;
- }
- 
--static char *extract_name_slow(char **input, char *what)
-+static char *extract_name_slow(char **input, char *what, int options)
- {
- 	char buf[1024];
- 	char *t = buf;
-@@ -152,17 +152,19 @@ static char *extract_name_slow(char **input, char *what)
- 	*input = skip_white_space(s);
- 	if (!*input)
- 		return NULL;  /* bitching's done elsewhere */
--	t = buf;
--	while (*t) {
--		*t = tolower(*t);
--		t++;
-+	if (!(options & KEEP_CAPITALIZATION)) {
-+		t = buf;
-+		while (*t) {
-+			*t = tolower(*t);
-+			t++;
-+		}
- 	}
- 
- 	t = quickstrdup(buf);
- 	return t;
- }
- 
--char *extract_name(char **input, char *what)
-+char *extract_name(char **input, char *what, int options)
- {
- 	char *s = *input;
- 	char *r = NULL;
-@@ -185,7 +187,7 @@ char *extract_name(char **input, char *what)
- 				wildcard = 1;
- 			} else {
- 				if (*s == '\\')
--					return extract_name_slow(input, what);
-+					return extract_name_slow(input, what, options);
- 				return bitch("%s expected", what);
- 			}
- 		}
-@@ -194,7 +196,7 @@ char *extract_name(char **input, char *what)
- 			s++;
- 		if (*s && !isspace(*s) && *s != ';' && *s != ')') {
- 			if (*s == '\\')
--				return extract_name_slow(input, what);
-+				return extract_name_slow(input, what, options);
- 			return bitch("%s is not valid", what);
- 		}
- 		if (!*s)	end = s;
-@@ -222,10 +224,12 @@ char *extract_name(char **input, char *what)
- 		if (!*input)
- 			return NULL;  /* bitching's done elsewhere */
- 	}
--	s = r;
--	while (*s) {
--		*s = tolower(*s);
--		s++;
-+	if (!(options & KEEP_CAPITALIZATION)) {
-+		s = r;
-+		while (*s) {
-+			*s = tolower(*s);
-+			s++;
-+		}
- 	}
- 	if (wildcard && r[1] != '.') {
- 		return bitch("%s: bad wildcard", what);
-@@ -570,6 +574,47 @@ int extract_ipv6(char **input, char *what, struct in6_addr *addr)
- 	return 1;
- }
- 
-+int extract_u64(char **input, char *what, uint64_t *r)
-+{
-+	char *s = *input;
-+	uint8_t result = 0;
-+	unsigned u;
-+
-+	#define GETHEXBLOCK if (!isxdigit(*s)) { bitch("%s is not valid", what); return -1; } \
-+		u = 0; \
-+		while (isxdigit(*s)) { \
-+			if (isdigit(*s)) { \
-+				u = (u << 4) | (*s - '0'); \
-+			} else if (*s >= 'a' && *s <= 'f') { \
-+				u = (u << 4) | (*s - 'a' + 10); \
-+			} else { \
-+				u = (u << 4) | (*s - 'A' + 10); \
-+			} \
-+			s++; \
-+		} \
-+		result = (result << 16) | u;
-+	#define SKIPCOLON if (*s != ':') { bitch("%s is not valid", what); return -1; } s++;
-+
-+	GETHEXBLOCK; SKIPCOLON;
-+	GETHEXBLOCK; SKIPCOLON;
-+	GETHEXBLOCK; SKIPCOLON;
-+	GETHEXBLOCK;
-+	*r = result;
-+
-+	#undef GETHEXBLOCK
-+	#undef SKIPCOLON
-+
-+	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+		bitch("%s is not valid", what);
-+		return -1;
-+	}
-+	*input = skip_white_space(s);
-+	if (!*input) {
-+		return -1;  /* bitching's done elsewhere */
-+	}
-+	return 1;
-+}
-+
- struct binary_data bad_binary_data(void)
- {
- 	struct binary_data r;
-@@ -759,16 +804,18 @@ struct binary_data extract_hex_binary_data(char **input, char *what, int eat_whi
- 		}
- 		*input = s;
- 	} else {
--		bitch("%s: internal: invalid eat_whitespace");
-+		bitch("%s: internal: invalid eat_whitespace", what);
- 	}
- 
- 	if (!*input)
- 		return r;  /* bitching's done elsewhere */
- 
-+	hb = hl % 2 ? 1 : 0;
-+	if (hb == 0)
-+		bitch("%s: hex data does not represent whole number of bytes", what);
- 	r.data = getmem(hl/2);
- 	r.length = hl/2;
- 	bzero(r.data, r.length);
--	hb = hl % 2 ? 1 : 0;
- 	for (hi = 0; hi < hl-hb; hi++) {
- 		r.data[hi/2] <<= 4;
- 		r.data[hi/2] |= 0x0f & (isdigit(hex[hi+hb]) ? hex[hi+hb] - '0' : tolower(hex[hi+hb]) - 'a' + 10);
-@@ -840,6 +887,7 @@ struct binary_data compose_binary_data(const char *fmt, int tmp, ...)
- 	uint8_t b1;
- 	uint16_t b2;
- 	uint32_t b4;
-+	uint64_t b8;
- 
- 	va_start(ap, tmp);
- 	args = fmt;
-@@ -858,6 +906,10 @@ struct binary_data compose_binary_data(const char *fmt, int tmp, ...)
- 			va_arg(ap, unsigned int);
- 			sz += 4;
- 			break;
-+		case '8':
-+			va_arg(ap, uint64_t);
-+			sz += 8;
-+			break;
- 		case 'd':
- 			bd = va_arg(ap, struct binary_data);
- 			sz += bd.length;
-@@ -902,6 +954,11 @@ struct binary_data compose_binary_data(const char *fmt, int tmp, ...)
- 			memcpy(t, &b4, 4);
- 			t += 4;
- 			break;
-+		case '8':
-+			b8 = htonl(va_arg(ap, uint64_t));
-+			memcpy(t, &b8, 8);
-+			t += 8;
-+			break;
- 		case 'd':
- 			bd = va_arg(ap, struct binary_data);
- 			memcpy(t, bd.data, bd.length);
-diff --git a/textparse.h b/textparse.h
-index b4f647a..3fe802f 100644
---- a/textparse.h
-+++ b/textparse.h
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-@@ -9,6 +9,8 @@
- #ifndef _TEXTPARSE_H_
- #define _TEXTPARSE_H_
- 
-+#include <sys/types.h>
-+
- struct binary_data {
- 	int length;
- 	char *data;
-@@ -30,15 +32,18 @@ struct binary_data compose_binary_data(const char *fmt, int tmp, ...);
-  *
-  */
- 
-+#define KEEP_CAPITALIZATION 32
-+
- int empty_line_or_comment(char *s);
- char *skip_white_space(char *s);
--char *extract_name(char **input, char *what);
-+char *extract_name(char **input, char *what, int options);
- char *extract_label(char **input, char *what, void *is_temporary);
- long long extract_integer(char **input, char *what);
- long extract_timevalue(char **input, char *what);
- long long extract_timestamp(char **input, char *what);
- int extract_ipv4(char **input, char *what, struct in_addr *addr);
- int extract_ipv6(char **input, char *what, struct in6_addr *addr);
-+int extract_u64(char **input, char *what, uint64_t *r);
- int extract_double(char **input, char *what, double *val, int skip_m);
- struct binary_data extract_base32hex_binary_data(char **input, char *what);
- struct binary_data extract_base64_binary_data(char **input, char *what);
-diff --git a/tlsa.c b/tlsa.c
-new file mode 100644
-index 0000000..d4cc53e
---- /dev/null
-+++ b/tlsa.c
-@@ -0,0 +1,121 @@
-+/*
-+ * Part of DNS zone file validator `validns`.
-+ *
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-+ * Modified BSD license.
-+ * (See LICENSE file in the distribution.)
-+ *
-+ */
-+#include <sys/types.h>
-+#include <stdio.h>
-+#include <netinet/in.h>
-+#include <arpa/inet.h>
-+#include <string.h>
-+#include <ctype.h>
-+
-+#include "common.h"
-+#include "textparse.h"
-+#include "mempool.h"
-+#include "carp.h"
-+#include "rr.h"
-+
-+/* See http://www.rfc-editor.org/internet-drafts/draft-ietf-dane-protocol-23.txt
-+ * for TLSA description.
-+ */
-+
-+static struct rr* tlsa_parse(char *name, long ttl, int type, char *s)
-+{
-+	struct rr_tlsa *rr = getmem(sizeof(*rr));
-+	int cert_usage, selector, matching_type;
-+
-+	cert_usage = extract_integer(&s, "certificate usage field");
-+	if (cert_usage < 0)	return NULL;
-+	if (cert_usage > 3)
-+		return bitch("bad certificate usage field");
-+	rr->cert_usage = cert_usage;
-+
-+	selector = extract_integer(&s, "selector field");
-+	if (selector < 0)	return NULL;
-+	if (selector > 1)
-+		return bitch("bad selector field");
-+	rr->selector = selector;
-+
-+	matching_type = extract_integer(&s, "matching type field");
-+	if (matching_type < 0)	return NULL;
-+	if (matching_type > 2)
-+		return bitch("bad matching type field");
-+	rr->matching_type = matching_type;
-+
-+	rr->association_data = extract_hex_binary_data(&s, "certificate association data", EXTRACT_EAT_WHITESPACE);
-+	if (rr->association_data.length < 0)	return NULL;
-+	switch (rr->matching_type) {
-+	case 1:
-+		if (rr->association_data.length != SHA256_BYTES)
-+			return bitch("bad SHA-256 hash length");
-+		break;
-+	case 2:
-+		if (rr->association_data.length != SHA512_BYTES)
-+			return bitch("bad SHA-512 hash length");
-+		break;
-+	}
-+
-+	if (*s) {
-+		return bitch("garbage after valid TLSA data");
-+	}
-+	return store_record(type, name, ttl, rr);
-+}
-+
-+static char* tlsa_human(struct rr *rrv)
-+{
-+	RRCAST(tlsa);
-+    char s[1024];
-+
-+    snprintf(s, 1024, "%d %d %d ...",
-+		rr->cert_usage, rr->selector, rr->matching_type);
-+    return quickstrdup_temp(s);
-+}
-+
-+static struct binary_data tlsa_wirerdata(struct rr *rrv)
-+{
-+	RRCAST(tlsa);
-+
-+	return compose_binary_data("111d", 1,
-+		rr->cert_usage, rr->selector, rr->matching_type,
-+		rr->association_data);
-+}
-+
-+static void* tlsa_validate_set(struct rr_set *rr_set)
-+{
-+	struct rr *rr;
-+	struct named_rr *named_rr;
-+	char *s;
-+	int port = 0;
-+	int len;
-+
-+	if (G.opt.policy_checks[POLICY_TLSA_HOST]) {
-+		rr = rr_set->tail;
-+		named_rr = rr_set->named_rr;
-+
-+		/* _25._tcp.mail.example.com. */
-+		s = named_rr->name;
-+		if (*s != '_') {
-+not_a_prefixed_domain_name:
-+			return moan(rr->file_name, rr->line, "not a proper prefixed DNS domain name");
-+		}
-+		s++;
-+		while (isdigit(*s)) {
-+			port = port * 10  + *s - '0';
-+			s++;
-+		}
-+		if (port <= 0 || port > 65535)	goto not_a_prefixed_domain_name;
-+		if (*s++ != '.')	goto not_a_prefixed_domain_name;
-+		len = strlen(s);
-+		if (len < 6)	goto not_a_prefixed_domain_name;
-+		if (memcmp(s, "_tcp.", 5) != 0 &&
-+			memcmp(s, "_udp.", 5) != 0 &&
-+			memcmp(s, "_sctp.", 6) != 0)	goto not_a_prefixed_domain_name;
-+	}
-+	return NULL;
-+}
-+
-+struct rr_methods tlsa_methods = { tlsa_parse, tlsa_human, tlsa_wirerdata, tlsa_validate_set, NULL };
-diff --git a/txt.c b/txt.c
-index 188d768..a26fe56 100644
---- a/txt.c
-+++ b/txt.c
-@@ -1,7 +1,7 @@
- /*
-  * Part of DNS zone file validator `validns`.
-  *
-- * Copyright 2011, Anton Berezin <tobez@tobez.org>
-+ * Copyright 2011, 2012 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-  * (See LICENSE file in the distribution.)
-  *
-diff --git a/usage.mdwn b/usage.mdwn
-index 33c0746..30a48c6 100644
---- a/usage.mdwn
-+++ b/usage.mdwn
-@@ -47,6 +47,7 @@ Coming soon.
- 	- mx-alias
- 	- ns-alias
- 	- rp-txt-exists
-+	- tlsa-host
- 	- all
- 
- -n *N*
-@@ -125,6 +126,7 @@ Other basic checks include:
- - NS nsdname should not be an alias
- - TXT domain name mentioned in RP record must have
-   a corresponding TXT record if it is within the zone
-+- domain name of a TLSA record must be a proper prefixed DNS name
- 
- # BUGS
- 
-@@ -143,3 +145,31 @@ every unsigned delegation.
- If this assumption is wrong for a zone,
- `validns` will produce spurious validation
- errors.
-+
-+# ACKNOWLEDGEMENTS
-+
-+Thanks go to
-+Andy Holdaway,
-+Daniel Stirnimann,
-+Dennis Kjaer Jensen,
-+Goran Bengtson,
-+Hirohisa Yamaguchi,
-+Hugo Salgado,
-+Jakob Schlyter,
-+Koh-ichi Ito,
-+Mathieu Arnold,
-+Miek Gieben,
-+Patrik Wallstrom,
-+Paul Wouters,
-+Ryan Eby,
-+Tony Finch,
-+Willem Toorop,
-+and YAMAGUCHI Takanori
-+for bug reports, testing, discussions,
-+and occasional patches.
-+
-+Special thanks to
-+Stephane Bortzmeyer and Phil Regnauld.
-+
-+Thanks for AFNIC which funded major portion of the development.
-+
-diff --git a/validns.1 b/validns.1
-index f6beb4f..ef645a6 100644
---- a/validns.1
-+++ b/validns.1
-@@ -51,6 +51,8 @@ ns-alias
- .IP \[bu] 2
- rp-txt-exists
- .IP \[bu] 2
-+tlsa-host
-+.IP \[bu] 2
- all
- .RE
- .TP
-@@ -172,6 +174,8 @@ NS nsdname should not be an alias
- .IP \[bu] 2
- TXT domain name mentioned in RP record must have a corresponding TXT
- record if it is within the zone
-+.IP \[bu] 2
-+domain name of a TLSA record must be a proper prefixed DNS name
- .SH BUGS
- .IP \[bu] 2
- textual segments in \f[I]TXT\f[] and \f[I]HINFO\f[] must be enclosed in
-@@ -190,5 +194,16 @@ This is done for reasons of efficiency, to avoid calculating
- cryptographic hashes of every unsigned delegation.
- If this assumption is wrong for a zone, \f[C]validns\f[] will produce
- spurious validation errors.
-+.SH ACKNOWLEDGEMENTS
-+.PP
-+Thanks go to Andy Holdaway, Daniel Stirnimann, Dennis Kjaer Jensen,
-+Goran Bengtson, Hirohisa Yamaguchi, Hugo Salgado, Jakob Schlyter,
-+Koh-ichi Ito, Mathieu Arnold, Miek Gieben, Patrik Wallstrom, Paul
-+Wouters, Ryan Eby, Tony Finch, Willem Toorop, and YAMAGUCHI Takanori for
-+bug reports, testing, discussions, and occasional patches.
-+.PP
-+Special thanks to Stephane Bortzmeyer and Phil Regnauld.
-+.PP
-+Thanks for AFNIC which funded major portion of the development.
- .SH AUTHORS
- Anton Berezin.
diff --git a/validns-0.6-timing.patch b/validns-0.6-timing.patch
deleted file mode 100644
index a65d6f5..0000000
--- a/validns-0.6-timing.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-diff -Naur validns-0.6-orig/common.h validns-0.6/common.h
---- validns-0.6-orig/common.h	2012-08-13 05:37:10.000000000 -0400
-+++ validns-0.6/common.h	2012-10-11 22:56:19.744337127 -0400
-@@ -51,6 +51,7 @@
- 		int die_on_first_error;
- 		int no_output;
- 		int summary;
-+		int notiming;
- 		int verbose;
- 		char *include_path;
- 		char *current_origin;
-diff -Naur validns-0.6-orig/main.c validns-0.6/main.c
---- validns-0.6-orig/main.c	2012-10-04 06:52:25.000000000 -0400
-+++ validns-0.6/main.c	2012-10-11 22:57:32.759118220 -0400
-@@ -251,6 +251,7 @@
- 	fprintf(stderr, "\t-n N\t\tuse N worker threads\n");
- 	fprintf(stderr, "\t-q\t\tquiet - do not produce any output\n");
- 	fprintf(stderr, "\t-s\t\tprint validation summary/stats\n");
-+	fprintf(stderr, "\t-x\t\tskip printing 'time taken' entry in summary/stats\n");
- 	fprintf(stderr, "\t-v\t\tbe extra verbose\n");
- 	fprintf(stderr, "\t-I path\tuse this path for $INCLUDE files\n");
- 	fprintf(stderr, "\t-z origin\tuse this origin as initial $ORIGIN\n");
-@@ -311,7 +312,7 @@
- 	initialize_globals();
- 	struct timeval start, stop;
- 
--	while ((o = getopt(argc, argv, "fhqsvI:z:t:p:n:")) != -1) {
-+	while ((o = getopt(argc, argv, "fhqsxvI:z:t:p:n:")) != -1) {
- 		switch(o) {
- 		case 'h':
- 			usage(NULL);
-@@ -325,6 +326,9 @@
- 		case 's':
- 			G.opt.summary = 1;
- 			break;
-+		case 'x':
-+			G.opt.notiming = 1;
-+			break;
- 		case 'v':
- 			G.opt.verbose = 1;
- 			break;
-@@ -412,8 +416,11 @@
- 			   "                     %d\n", G.stats.not_authoritative);
- 		printf("validation errors:   %d\n", G.stats.error_count);
- 		printf("signatures verified: %d\n", G.stats.signatures_verified);
--		printf("time taken:          %.3fs\n",
-+
-+		if (!G.opt.notiming) {
-+			printf("time taken:          %.3fs\n",
- 			   stop.tv_sec - start.tv_sec + (stop.tv_usec - start.tv_usec)/1000000.);
-+		}
- 	}
- 	return G.exit_code;
- }
-diff -Naur validns-0.6-orig/usage.mdwn validns-0.6/usage.mdwn
---- validns-0.6-orig/usage.mdwn	2012-10-04 10:52:43.000000000 -0400
-+++ validns-0.6/usage.mdwn	2012-10-11 22:58:30.330728403 -0400
-@@ -61,6 +61,9 @@
- -s
- :   print validation summary/stats
- 
-+-x
-+:   skip printing 'time taken' in summary/stats
-+
- -v
- :   be extra verbose
- 
-diff -Naur validns-0.6-orig/validns.1 validns-0.6/validns.1
---- validns-0.6-orig/validns.1	2012-10-04 10:53:32.000000000 -0400
-+++ validns-0.6/validns.1	2012-10-11 23:00:20.511885836 -0400
-@@ -73,6 +73,11 @@
- .RS
- .RE
- .TP
-+.B -x
-+skip printing timing summary/stats
-+.RS
-+.RE
-+.TP
- .B -v
- be extra verbose
- .RS
diff --git a/validns-0.7-timing.patch b/validns-0.7-timing.patch
deleted file mode 100644
index 77710c8..0000000
--- a/validns-0.7-timing.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-diff -Naur validns-0.7-orig/common.h validns-0.7/common.h
---- validns-0.7-orig/common.h	2013-02-21 09:36:04.000000000 -0500
-+++ validns-0.7/common.h	2013-04-16 12:49:00.211645012 -0400
-@@ -51,6 +51,7 @@
- 		int die_on_first_error;
- 		int no_output;
- 		int summary;
-+		int notiming;
- 		int verbose;
- 		char *include_path;
- 		char *current_origin;
-diff -Naur validns-0.7-orig/main.c validns-0.7/main.c
---- validns-0.7-orig/main.c	2013-04-11 14:33:53.000000000 -0400
-+++ validns-0.7/main.c	2013-04-16 12:50:46.210022408 -0400
-@@ -251,6 +251,7 @@
- 	fprintf(stderr, "\t-n N\t\tuse N worker threads\n");
- 	fprintf(stderr, "\t-q\t\tquiet - do not produce any output\n");
- 	fprintf(stderr, "\t-s\t\tprint validation summary/stats\n");
-+	fprintf(stderr, "\t-x\t\tskip printing 'time taken' entry in summary/stats\n");
- 	fprintf(stderr, "\t-v\t\tbe extra verbose\n");
- 	fprintf(stderr, "\t-I path\tuse this path for $INCLUDE files\n");
- 	fprintf(stderr, "\t-z origin\tuse this origin as initial $ORIGIN\n");
-@@ -325,7 +326,7 @@
- 	struct timeval start, stop;
- 
- 	initialize_globals();
--	while ((o = getopt(argc, argv, "fhqsvI:z:t:p:n:")) != -1) {
-+	while ((o = getopt(argc, argv, "fhqsxvI:z:t:p:n:")) != -1) {
- 		switch(o) {
- 		case 'h':
- 			usage(NULL);
-@@ -339,6 +340,9 @@
- 		case 's':
- 			G.opt.summary = 1;
- 			break;
-+		case 'x':
-+			G.opt.notiming = 1;
-+			break;
- 		case 'v':
- 			G.opt.verbose = 1;
- 			break;
-@@ -426,8 +430,10 @@
- 			   "                     %d\n", G.stats.not_authoritative);
- 		printf("validation errors:   %d\n", G.stats.error_count);
- 		printf("signatures verified: %d\n", G.stats.signatures_verified);
--		printf("time taken:          %.3fs\n",
-+		if (!G.opt.notiming) {
-+			printf("time taken:          %.3fs\n",
- 			   stop.tv_sec - start.tv_sec + (stop.tv_usec - start.tv_usec)/1000000.);
-+		}
- 	}
- 	return G.exit_code;
- }
-diff -Naur validns-0.7-orig/usage.mdwn validns-0.7/usage.mdwn
---- validns-0.7-orig/usage.mdwn	2013-04-16 06:36:45.000000000 -0400
-+++ validns-0.7/usage.mdwn	2013-04-16 12:51:12.528364293 -0400
-@@ -61,6 +61,9 @@
- -s
- :   print validation summary/stats
- 
-+-x
-+:   skip printing 'time taken' in summary/stats
-+
- -v
- :   be extra verbose
- 
-diff -Naur validns-0.7-orig/validns.1 validns-0.7/validns.1
---- validns-0.7-orig/validns.1	2013-04-16 06:36:58.000000000 -0400
-+++ validns-0.7/validns.1	2013-04-16 12:51:36.963681678 -0400
-@@ -73,6 +73,11 @@
- .RS
- .RE
- .TP
-+.B -x
-+skip printing timing summary/stats
-+.RS
-+.RE
-+.TP
- .B -v
- be extra verbose
- .RS
diff --git a/validns-0.8-Makefile.patch b/validns-0.8-Makefile.patch
deleted file mode 100644
index b7fc38b..0000000
--- a/validns-0.8-Makefile.patch
+++ /dev/null
@@ -1,250 +0,0 @@
-Don't override CFLAGS and CPPFLAGS from the environment (needed for http://wiki.debian.org/Hardening).
-Also respect LDFLAGS.
-
---- a/Makefile
-+++ b/Makefile
-@@ -1,7 +1,7 @@
- # The following options seem to work fine on Linux, FreeBSD, and Darwin
--OPTIMIZE=-O2 -g
--CFLAGS=-Wall -Werror -pthread -fno-strict-aliasing
--INCPATH=-I/usr/local/include -I/opt/local/include -I/usr/local/ssl/include
-+OPTIMIZE+=-O2 -g
-+CFLAGS+=-Wall -Werror -pthread -fno-strict-aliasing
-+INCPATH+=-I/usr/local/include -I/opt/local/include -I/usr/local/ssl/include
- CC?=cc
- 
- # These additional options work on Solaris/gcc to which I have an access
-@@ -28,7 +28,7 @@
- 	ipseckey.o cbtree.o mb.o mg.o mr.o minfo.o \
- 	afsdb.o x25.o isdn.o rt.o px.o kx.o \
- 	dlv.o dhcid.o nsap.o
--	$(CC) $(CFLAGS) $(OPTIMIZE) -o validns \
-+	$(CC) $(LDFLAGS) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -o validns \
- 	    main.o carp.o mempool.o textparse.o base64.o base32hex.o \
- 	    rr.o soa.o a.o cname.o mx.o ns.o \
- 	    rrsig.o nsec.o dnskey.o txt.o aaaa.o \
-@@ -58,160 +58,160 @@
- 	@echo ':-)'
- 
- main.o: main.c common.h carp.h mempool.h textparse.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o main.o main.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o main.o main.c $(INCPATH)
- 
- carp.o: carp.c carp.h common.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o carp.o carp.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o carp.o carp.c $(INCPATH)
- 
- mempool.o: mempool.c mempool.h carp.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o mempool.o mempool.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mempool.o mempool.c $(INCPATH)
- 
- textparse.o: textparse.c common.h carp.h mempool.h textparse.h base64.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o textparse.o textparse.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o textparse.o textparse.c $(INCPATH)
- 
- base64.o: base64.c base64.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o base64.o base64.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o base64.o base64.c $(INCPATH)
- 
- base32hex.o: base32hex.c base32hex.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o base32hex.o base32hex.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o base32hex.o base32hex.c $(INCPATH)
- 
- rr.o: rr.c common.h mempool.h carp.h textparse.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o rr.o rr.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o rr.o rr.c $(INCPATH)
- 
- soa.o: soa.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o soa.o soa.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o soa.o soa.c $(INCPATH)
- 
- a.o: a.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o a.o a.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o a.o a.c $(INCPATH)
- 
- cname.o: cname.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o cname.o cname.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o cname.o cname.c $(INCPATH)
- 
- mb.o: mb.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o mb.o mb.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mb.o mb.c $(INCPATH)
- 
- mg.o: mg.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o mg.o mg.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mg.o mg.c $(INCPATH)
- 
- minfo.o: minfo.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o minfo.o minfo.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o minfo.o minfo.c $(INCPATH)
- 
- mr.o: mr.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o mr.o mr.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mr.o mr.c $(INCPATH)
- 
- mx.o: mx.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o mx.o mx.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o mx.o mx.c $(INCPATH)
- 
- afsdb.o: afsdb.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o afsdb.o afsdb.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o afsdb.o afsdb.c $(INCPATH)
- 
- x25.o: x25.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o x25.o x25.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o x25.o x25.c $(INCPATH)
- 
- isdn.o: isdn.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o isdn.o isdn.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o isdn.o isdn.c $(INCPATH)
- 
- rt.o: rt.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o rt.o rt.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o rt.o rt.c $(INCPATH)
- 
- px.o: px.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o px.o px.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o px.o px.c $(INCPATH)
- 
- kx.o: kx.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o kx.o kx.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o kx.o kx.c $(INCPATH)
- 
- dlv.o: dlv.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o dlv.o dlv.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o dlv.o dlv.c $(INCPATH)
- 
- dhcid.o: dhcid.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o dhcid.o dhcid.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o dhcid.o dhcid.c $(INCPATH)
- 
- nsap.o: nsap.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsap.o nsap.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsap.o nsap.c $(INCPATH)
- 
- ns.o: ns.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o ns.o ns.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o ns.o ns.c $(INCPATH)
- 
- rrsig.o: rrsig.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o rrsig.o rrsig.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o rrsig.o rrsig.c $(INCPATH)
- 
- nsec.o: nsec.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsec.o nsec.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsec.o nsec.c $(INCPATH)
- 
- dnskey.o: dnskey.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o dnskey.o dnskey.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o dnskey.o dnskey.c $(INCPATH)
- 
- txt.o: txt.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o txt.o txt.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o txt.o txt.c $(INCPATH)
- 
- aaaa.o: aaaa.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o aaaa.o aaaa.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o aaaa.o aaaa.c $(INCPATH)
- 
- naptr.o: naptr.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o naptr.o naptr.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o naptr.o naptr.c $(INCPATH)
- 
- srv.o: srv.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o srv.o srv.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o srv.o srv.c $(INCPATH)
- 
- nsec3param.o: nsec3param.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsec3param.o nsec3param.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsec3param.o nsec3param.c $(INCPATH)
- 
- nsec3.o: nsec3.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsec3.o nsec3.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsec3.o nsec3.c $(INCPATH)
- 
- ds.o: ds.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o ds.o ds.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o ds.o ds.c $(INCPATH)
- 
- hinfo.o: hinfo.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o hinfo.o hinfo.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o hinfo.o hinfo.c $(INCPATH)
- 
- loc.o: loc.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o loc.o loc.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o loc.o loc.c $(INCPATH)
- 
- nsec3checks.o: nsec3checks.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o nsec3checks.o nsec3checks.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nsec3checks.o nsec3checks.c $(INCPATH)
- 
- ptr.o: ptr.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o ptr.o ptr.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o ptr.o ptr.c $(INCPATH)
- 
- sshfp.o: sshfp.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o sshfp.o sshfp.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o sshfp.o sshfp.c $(INCPATH)
- 
- rp.o: rp.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o rp.o rp.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o rp.o rp.c $(INCPATH)
- 
- spf.o: spf.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o spf.o spf.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o spf.o spf.c $(INCPATH)
- 
- cert.o: cert.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o cert.o cert.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o cert.o cert.c $(INCPATH)
- 
- dname.o: dname.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o dname.o dname.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o dname.o dname.c $(INCPATH)
- 
- tlsa.o: tlsa.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o tlsa.o tlsa.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o tlsa.o tlsa.c $(INCPATH)
- 
- nid.o: nid.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o nid.o nid.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o nid.o nid.c $(INCPATH)
- 
- l32.o: l32.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o l32.o l32.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o l32.o l32.c $(INCPATH)
- 
- l64.o: l64.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o l64.o l64.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o l64.o l64.c $(INCPATH)
- 
- lp.o: lp.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o lp.o lp.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o lp.o lp.c $(INCPATH)
- 
- ipseckey.o: ipseckey.c common.h textparse.h mempool.h carp.h rr.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o ipseckey.o ipseckey.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o ipseckey.o ipseckey.c $(INCPATH)
- 
- cbtree.o: cbtree.c cbtree.h
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o cbtree.o cbtree.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o cbtree.o cbtree.c $(INCPATH)
- 
- threads.o: threads.c
--	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o threads.o threads.c $(INCPATH)
-+	$(CC) $(CPPFLAGS) $(CFLAGS) $(OPTIMIZE) -c -o threads.o threads.c $(INCPATH)
- 
- test: validns
- 	perl -MTest::Harness -e 'runtests("t/test.pl")'
-@@ -220,9 +220,9 @@
- 	perl t/test.pl
- 
- test64:
--	$(CC) -Wall -O2 -o base64-test base64.c -DTEST_PROGRAM
-+	$(CC) $(LDFLAGS) $(CPPFLAGS) $(CFLAGS)  -Wall -O2 -o base64-test base64.c -DTEST_PROGRAM
- 	./base64-test
- 
- test32hex:
--	$(CC) -Wall -O2 -o base32hex-test base32hex.c -DTEST_PROGRAM
-+	$(CC) $(LDFLAGS) $(CPPFLAGS) $(CFLAGS) -Wall -O2 -o base32hex-test base32hex.c -DTEST_PROGRAM
- 	./base32hex-test
diff --git a/validns-0.8-Wformat-truncation.patch b/validns-0.8-Wformat-truncation.patch
deleted file mode 100644
index e674992..0000000
--- a/validns-0.8-Wformat-truncation.patch
+++ /dev/null
@@ -1,24 +0,0 @@
---- validns-0.8-orig/ipseckey.c	2014-02-11 18:46:25.000000000 -0200
-+++ validns-0.8/ipseckey.c	2018-02-11 04:54:42.167467112 -0200
-@@ -100,10 +100,10 @@
- 		strcpy(gw, rr->gateway.gateway_none);
- 		break;
- 	case 1:
--		inet_ntop(AF_INET, &rr->gateway.gateway_ipv4, gw, 1024);
-+		inet_ntop(AF_INET, &rr->gateway.gateway_ipv4, gw, 2048);
- 		break;
- 	case 2:
--		inet_ntop(AF_INET6, &rr->gateway.gateway_ipv6, gw, 1024);
-+		inet_ntop(AF_INET6, &rr->gateway.gateway_ipv6, gw, 2048);
- 		break;
- 	case 3:
- 		strcpy(gw, rr->gateway.gateway_name);
-@@ -111,7 +111,7 @@
- 	default:
- 		strcpy(gw, "??");
- 	}
--    snprintf(s, 1024, "( %d %d %d %s ... )",
-+    snprintf(s, 2048, "( %d %d %d %s ... )",
- 	     rr->precedence, rr->gateway_type, rr->algorithm, gw);
-     return quickstrdup_temp(s);
- }
diff --git a/validns-0.8-git20160720.patch b/validns-0.8-git20160720.patch
deleted file mode 100644
index 20e3415..0000000
--- a/validns-0.8-git20160720.patch
+++ /dev/null
@@ -1,1719 +0,0 @@
-diff -Naur validns-0.8/afsdb.c validns-0.8_git20160720/afsdb.c
---- validns-0.8/afsdb.c	2014-02-11 15:46:27.000000000 -0500
-+++ validns-0.8_git20160720/afsdb.c	2016-02-04 09:14:15.000000000 -0500
-@@ -21,7 +21,7 @@
- {
- 	struct rr_afsdb *rr = getmem(sizeof(*rr));
- 
--	rr->subtype = extract_integer(&s, "AFSDB subtype");
-+	rr->subtype = extract_integer(&s, "AFSDB subtype", NULL);
- 	if (rr->subtype < 0)
- 		return NULL;
- 
-diff -Naur validns-0.8/cert.c validns-0.8_git20160720/cert.c
---- validns-0.8/cert.c	2014-02-11 15:46:12.000000000 -0500
-+++ validns-0.8_git20160720/cert.c	2016-02-04 09:14:15.000000000 -0500
-@@ -30,7 +30,7 @@
- 	char *str_type;
- 
- 	if (isdigit(**s)) {
--		type = extract_integer(s, what);
-+		type = extract_integer(s, what, NULL);
- 		if (type >= 1 && type <= 8)
- 			return type;
- 		if (type == 253 || type == 254)
-@@ -84,14 +84,14 @@
- 	if (cert_type < 0)	return NULL;
- 	rr->type = cert_type;
- 
--	key_tag = extract_integer(&s, "key tag");
-+	key_tag = extract_integer(&s, "key tag", NULL);
- 	if (key_tag < 0)	return NULL;
- 	if (key_tag > 65535)
- 		return bitch("bad key tag");
- 	rr->key_tag = key_tag;
- 
- 	if (isdigit(*s)) {
--		alg = extract_integer(&s, "algorithm");
-+		alg = extract_integer(&s, "algorithm", NULL);
- 		if (alg < 0)	return NULL;
- 		if (alg > 255)	return bitch("bad algorithm");
- 		if (alg != 0) {  /* 0 is just fine */
-diff -Naur validns-0.8/common.h validns-0.8_git20160720/common.h
---- validns-0.8/common.h	2014-02-11 15:45:02.000000000 -0500
-+++ validns-0.8_git20160720/common.h	2016-02-04 09:14:15.000000000 -0500
-@@ -9,19 +9,37 @@
- #ifndef _COMMON_H_
- #define _COMMON_H_ 1
- 
-+struct generate_template_piece;
-+struct generate_template_piece
-+{
-+	char *constant_string;
-+	struct generate_template_piece *next;
-+};
-+
-+#define LINEBUFSZ 2048
-+
- struct file_info
- {
- 	struct file_info *next;
- 	FILE *file;
- 	int  line;
- 	int  paren_mode;
--	char buf[2048];
-+	char buf[LINEBUFSZ];
-+	char *current_origin;
-+
-+	int generate_cur;
-+	int generate_lim;
-+	char *generate_type;
-+	struct generate_template_piece *generate_lhs;
-+	struct generate_template_piece *generate_rhs;
-+
-+	/* must be last struct member */
- 	char name[0];
- };
- 
- extern struct file_info *file_info;
- 
--#define N_POLICY_CHECKS 9
-+#define N_POLICY_CHECKS 10
- 
- #define POLICY_SINGLE_NS 0
- #define POLICY_CNAME_OTHER_DATA 1
-@@ -32,6 +50,7 @@
- #define POLICY_DNAME 6
- #define POLICY_DNSKEY 7
- #define POLICY_TLSA_HOST 8
-+#define POLICY_KSK_EXISTS 9
- 
- #define MAX_TIMES_TO_CHECK 32
- 
-@@ -55,11 +74,13 @@
- 		int summary;
- 		int verbose;
- 		char *include_path;
--		char *current_origin;
-+		int include_path_specified;
-+		char *first_origin;
- 		int n_times_to_check;
- 		uint32_t times_to_check[MAX_TIMES_TO_CHECK];
- 		char policy_checks[N_POLICY_CHECKS];
- 		int n_threads;
-+		int soa_minttl_as_default_ttl;
- 	} opt;
- 	int exit_code;
- 	long default_ttl;
-diff -Naur validns-0.8/dlv.c validns-0.8_git20160720/dlv.c
---- validns-0.8/dlv.c	2014-02-11 15:46:32.000000000 -0500
-+++ validns-0.8_git20160720/dlv.c	2016-02-04 09:14:15.000000000 -0500
-@@ -22,7 +22,7 @@
- 	struct rr_dlv *rr = getmem(sizeof(*rr));
- 	int key_tag, algorithm, digest_type;
- 
--	key_tag = extract_integer(&s, "key tag");
-+	key_tag = extract_integer(&s, "key tag", NULL);
- 	if (key_tag < 0)	return NULL;
- 	rr->key_tag = key_tag;
- 
-@@ -30,7 +30,7 @@
- 	if (algorithm == ALG_UNSUPPORTED)	return NULL;
- 	rr->algorithm = algorithm;
- 
--	digest_type = extract_integer(&s, "digest type");
-+	digest_type = extract_integer(&s, "digest type", NULL);
- 	if (digest_type < 0)	return NULL;
- 	rr->digest_type = digest_type;
- 
-diff -Naur validns-0.8/dnskey.c validns-0.8_git20160720/dnskey.c
---- validns-0.8/dnskey.c	2014-02-11 15:45:11.000000000 -0500
-+++ validns-0.8_git20160720/dnskey.c	2016-02-04 09:14:15.000000000 -0500
-@@ -20,6 +20,8 @@
- #include "carp.h"
- #include "rr.h"
- 
-+static struct rr_dnskey *all_dns_keys = NULL;
-+
- static struct rr* dnskey_parse(char *name, long ttl, int type, char *s)
- {
- 	struct rr_dnskey *rr = getmem(sizeof(*rr));
-@@ -27,10 +29,11 @@
- 	int flags, proto, algorithm;
- 	unsigned int ac;
- 	int i;
-+	static struct rr *result;
- 
--	flags = extract_integer(&s, "flags");
-+	flags = extract_integer(&s, "flags", NULL);
- 	if (flags < 0) return NULL;
--	if (flags & 0xfefe)
-+	if (flags & 0xfe7e)
- 		return bitch("reserved flags bits are set");
- 	if (flags & 0x0001 && !(flags & 0x0100))
- 		return bitch("SEP bit is set but Zone Key bit is unset");
-@@ -38,7 +41,7 @@
- 
- 	/* TODO validate that `name` is the name of the zone if flags have Zone Key bit set */
- 
--	proto = extract_integer(&s, "protocol");
-+	proto = extract_integer(&s, "protocol", NULL);
- 	if (proto < 0) return NULL;
- 	if (proto != 3)
- 		return bitch("bad protocol value");
-@@ -68,11 +71,17 @@
- 
- 	rr->pkey_built = 0;
- 	rr->pkey = NULL;
-+	rr->key_type = KEY_TYPE_UNUSED;
- 
- 	if (*s) {
- 		return bitch("garbage after valid DNSKEY data");
- 	}
--	return store_record(type, name, ttl, rr);
-+	result = store_record(type, name, ttl, rr);
-+	if (result) {
-+		rr->next_key = all_dns_keys;
-+		all_dns_keys = rr;
-+	}
-+	return result;
- }
- 
- static char* dnskey_human(struct rr *rrv)
-@@ -187,3 +196,18 @@
- 	return rr->pkey ? 1 : 0;
- }
- 
-+void
-+dnskey_ksk_policy_check(void)
-+{
-+	struct rr_dnskey *rr = all_dns_keys;
-+	int ksk_found = 0;
-+
-+	while (rr) {
-+		if (rr->key_type == KEY_TYPE_KSK)
-+			ksk_found = 1;
-+		rr = rr->next_key;
-+	}
-+	if (!ksk_found)
-+		moan(all_dns_keys->rr.file_name, all_dns_keys->rr.line, "No KSK found");
-+}
-+
-diff -Naur validns-0.8/ds.c validns-0.8_git20160720/ds.c
---- validns-0.8/ds.c	2014-02-11 15:44:59.000000000 -0500
-+++ validns-0.8_git20160720/ds.c	2016-02-04 09:14:15.000000000 -0500
-@@ -22,7 +22,7 @@
- 	struct rr_ds *rr = getmem(sizeof(*rr));
- 	int key_tag, algorithm, digest_type;
- 
--	key_tag = extract_integer(&s, "key tag");
-+	key_tag = extract_integer(&s, "key tag", NULL);
- 	if (key_tag < 0)	return NULL;
- 	rr->key_tag = key_tag;
- 
-@@ -30,7 +30,7 @@
- 	if (algorithm == ALG_UNSUPPORTED)	return NULL;
- 	rr->algorithm = algorithm;
- 
--	digest_type = extract_integer(&s, "digest type");
-+	digest_type = extract_integer(&s, "digest type", NULL);
- 	if (digest_type < 0)	return NULL;
- 	rr->digest_type = digest_type;
- 
-diff -Naur validns-0.8/ipseckey.c validns-0.8_git20160720/ipseckey.c
---- validns-0.8/ipseckey.c	2014-02-11 15:46:25.000000000 -0500
-+++ validns-0.8_git20160720/ipseckey.c	2016-02-04 09:14:15.000000000 -0500
-@@ -24,15 +24,15 @@
- 	struct rr_ipseckey *rr = getmem(sizeof(*rr));
- 	int i;
- 
--	rr->precedence = i = extract_integer(&s, "precedence");
-+	rr->precedence = i = extract_integer(&s, "precedence", NULL);
- 	if (i < 0)    return NULL;
- 	if (i >= 256) return bitch("precedence range is not valid");
- 
--	rr->gateway_type = i = extract_integer(&s, "gateway type");
-+	rr->gateway_type = i = extract_integer(&s, "gateway type", NULL);
- 	if (i < 0) return NULL;
- 	if (i > 3) return bitch("gateway type is not valid");
- 
--	rr->algorithm = i = extract_integer(&s, "algorithm");
-+	rr->algorithm = i = extract_integer(&s, "algorithm", NULL);
- 	if (i < 0) return NULL;
- 	if (i > 2) return bitch("algorithm is not valid");
- 
-diff -Naur validns-0.8/kx.c validns-0.8_git20160720/kx.c
---- validns-0.8/kx.c	2014-02-11 15:46:36.000000000 -0500
-+++ validns-0.8_git20160720/kx.c	2016-02-04 09:14:15.000000000 -0500
-@@ -21,7 +21,7 @@
- {
- 	struct rr_kx *rr = getmem(sizeof(*rr));
- 
--	rr->preference = extract_integer(&s, "KX preference");
-+	rr->preference = extract_integer(&s, "KX preference", NULL);
- 	if (rr->preference < 0)
- 		return NULL;
- 
-diff -Naur validns-0.8/l32.c validns-0.8_git20160720/l32.c
---- validns-0.8/l32.c	2014-02-11 15:46:17.000000000 -0500
-+++ validns-0.8_git20160720/l32.c	2016-02-04 09:14:15.000000000 -0500
-@@ -23,7 +23,7 @@
- 	struct in_addr ipv4_like;
- 	int preference;
- 
--	rr->preference = preference = extract_integer(&s, "L32 preference");
-+	rr->preference = preference = extract_integer(&s, "L32 preference", NULL);
- 	if (preference < 0)
- 		return NULL;
- 	if (extract_ipv4(&s, "Locator32", &ipv4_like) <= 0)
-diff -Naur validns-0.8/l64.c validns-0.8_git20160720/l64.c
---- validns-0.8/l64.c	2014-02-11 15:46:18.000000000 -0500
-+++ validns-0.8_git20160720/l64.c	2016-02-04 09:14:15.000000000 -0500
-@@ -22,7 +22,7 @@
- 	struct rr_l64 *rr = getmem(sizeof(*rr));
- 	int preference;
- 
--	rr->preference = preference = extract_integer(&s, "L64 preference");
-+	rr->preference = preference = extract_integer(&s, "L64 preference", NULL);
- 	if (preference < 0)
- 		return NULL;
- 	if (extract_u64(&s, "Locator64", &rr->locator64) < 0)
-diff -Naur validns-0.8/loc.c validns-0.8_git20160720/loc.c
---- validns-0.8/loc.c	2014-02-11 15:45:16.000000000 -0500
-+++ validns-0.8_git20160720/loc.c	2016-02-04 09:14:15.000000000 -0500
-@@ -56,7 +56,7 @@
- 	rr->version = 0;
- 
- 	/* latitude block */
--	i = extract_integer(&s, "degrees latitude");
-+	i = extract_integer(&s, "degrees latitude", NULL);
- 	if (i < 0)
- 		return NULL;
- 	if (i > 90)
-@@ -65,7 +65,7 @@
- 	min = 0;
- 	sec = 0;
- 	if (isdigit(*s)) {
--		i = extract_integer(&s, "minutes latitude");
-+		i = extract_integer(&s, "minutes latitude", NULL);
- 		if (i < 0)
- 			return NULL;
- 		if (i > 59)
-@@ -96,7 +96,7 @@
- 	if (!s) return NULL;
- 
- 	/* longitude block */
--	i = extract_integer(&s, "degrees longitude");
-+	i = extract_integer(&s, "degrees longitude", NULL);
- 	if (i < 0)
- 		return NULL;
- 	if (i > 180)
-@@ -105,7 +105,7 @@
- 	min = 0;
- 	sec = 0;
- 	if (isdigit(*s)) {
--		i = extract_integer(&s, "minutes longitude");
-+		i = extract_integer(&s, "minutes longitude", NULL);
- 		if (i < 0)
- 			return NULL;
- 		if (i > 59)
-diff -Naur validns-0.8/lp.c validns-0.8_git20160720/lp.c
---- validns-0.8/lp.c	2014-02-11 15:45:55.000000000 -0500
-+++ validns-0.8_git20160720/lp.c	2016-02-04 09:14:15.000000000 -0500
-@@ -23,7 +23,7 @@
- 	struct rr_lp *rr = getmem(sizeof(*rr));
- 	int preference;
- 
--	rr->preference = preference = extract_integer(&s, "LP preference");
-+	rr->preference = preference = extract_integer(&s, "LP preference", NULL);
- 	if (preference < 0)
- 		return NULL;
- 	rr->fqdn = extract_name(&s, "LP fqdn", 0);
-diff -Naur validns-0.8/main.c validns-0.8_git20160720/main.c
---- validns-0.8/main.c	2014-02-11 15:47:10.000000000 -0500
-+++ validns-0.8_git20160720/main.c	2016-02-04 09:14:15.000000000 -0500
-@@ -17,6 +17,7 @@
- #include <time.h>
- #include <netinet/in.h>
- #include <arpa/inet.h>
-+#include <libgen.h>
- 
- #include "common.h"
- #include "carp.h"
-@@ -27,8 +28,80 @@
- struct globals G;
- struct file_info *file_info = NULL;
- 
--int
--read_zone_file(void);
-+int read_zone_file(void);
-+void open_zone_file(char *fname);
-+
-+static void
-+concat_generate_template(char *buf, int bufsz, int val, struct generate_template_piece *t)
-+{
-+	char sval[40];
-+
-+	while (t) {
-+		if (t->constant_string) {
-+			mystrlcat(buf, t->constant_string, bufsz);
-+		} else {
-+			snprintf(sval, 40, "%d", val);
-+			mystrlcat(buf, sval, bufsz);
-+		}
-+		t = t->next;
-+	}
-+}
-+
-+static struct generate_template_piece *
-+free_generate_template(struct generate_template_piece *t)
-+{
-+	struct generate_template_piece *n;
-+	while (t) {
-+		n = t->next;
-+		free(t);
-+		t = n;
-+	}
-+	return NULL;
-+}
-+
-+static void
-+create_generate_template_piece(struct generate_template_piece **generate_template, char *s)
-+{
-+	if (s && *s == 0)
-+		return;
-+
-+	struct generate_template_piece *p = malloc(sizeof(struct generate_template_piece));
-+
-+	p->constant_string = s;
-+	p->next = NULL;
-+
-+	if (*generate_template) {
-+		struct generate_template_piece *t = *generate_template;
-+		while (t->next)
-+			t = t->next;
-+		t->next = p;
-+	} else {
-+		*generate_template = p;
-+	}
-+}
-+
-+static struct generate_template_piece *
-+prepare_generate_template(char *t)
-+{
-+	char *s = t;
-+	struct generate_template_piece *r = NULL;
-+
-+	while (1) {
-+		while (*t && *t != '$') t++;
-+		if (!*t) {
-+			create_generate_template_piece(&r, s);
-+			break;
-+		} else {
-+			*t = 0;
-+			create_generate_template_piece(&r, s);
-+			create_generate_template_piece(&r, NULL);
-+			t++;
-+			s = t;
-+		}
-+	}
-+
-+	return r;
-+}
- 
- static char *process_directive(char *s)
- {
-@@ -48,7 +121,7 @@
- 		if (*s) {
- 			return bitch("garbage after valid $ORIGIN directive");
- 		}
--		G.opt.current_origin = o;
-+		file_info->current_origin = o;
- 		if (G.opt.verbose) {
- 			fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
- 			fprintf(stderr, "origin is now %s\n", o);
-@@ -71,14 +144,80 @@
- 			fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
- 			fprintf(stderr, "default ttl is now %ld\n", G.default_ttl);
- 		}
-+	} else if (*(s+1) == 'G' && strncmp(s, "$GENERATE", 9) == 0) {
-+		int from, to;
-+		char *lhs, *rdtype;
-+
-+		s += 9;
-+		if (!isspace(*s)) {
-+			if (isalnum(*s)) goto unrecognized_directive;
-+			return bitch("bad $GENERATE format");
-+		}
-+		s = skip_white_space(s);
-+
-+		from = extract_integer(&s, "generate-from", "-");
-+		if (from < 0)
-+			return NULL;
-+		if (*s != '-')
-+			return bitch("'-' between generate-from and generate-to is expected");
-+		s++;
-+		to = extract_integer(&s, "generate-to", "-");
-+		if (to < 0)
-+			return NULL;
-+
-+		if (*s == '/')
-+			return bitch("generate-step is unsupported for now");
-+
-+		lhs = extract_name(&s, "generate-lhs", KEEP_CAPITALIZATION | DOLLAR_OK_IN_NAMES);
-+		if (!lhs)
-+			return NULL;
-+
-+		if (*s == '{')
-+			return bitch("{offset,width,type} is unsupported for now");
-+
-+		rdtype = extract_label(&s, "type", NULL);
-+		if (!rdtype)
-+			return NULL;
-+
-+		file_info->generate_cur  = from;
-+		file_info->generate_lim  = to;
-+		file_info->generate_type = rdtype;
-+		file_info->generate_lhs = prepare_generate_template(lhs);
-+		file_info->generate_rhs = prepare_generate_template(quickstrdup(s));
-+
-+		return s;
- 	} else if (*(s+1) == 'I' && strncmp(s, "$INCLUDE", 8) == 0) {
-+		char *p, *f;
-+		char c;
- 		s += 8;
- 		if (!isspace(*s)) {
- 			if (isalnum(*s)) goto unrecognized_directive;
- 			return bitch("bad $INCLUDE format");
- 		}
- 		s = skip_white_space(s);
--		return bitch("XXX include support is not implemented");
-+		p = s;
-+		while (*s && !isspace(*s) && *s != ';')
-+			s++;
-+		c = *s;
-+		*s = '\0';
-+		if (!*p) {
-+			return bitch("$INCLUDE directive with empty file name");
-+		}
-+		f = quickstrdup_temp(p);
-+		*s = c;
-+		s = skip_white_space(s);
-+
-+		if (*s) {
-+			return bitch("garbage after valid $INCLUDE directive");
-+		}
-+		if (*f == '/') {
-+			open_zone_file(f);
-+		} else {
-+			char buf[1024];
-+
-+			snprintf(buf, 1024, "%s/%s", G.opt.include_path, f);
-+			open_zone_file(buf);
-+		}
- 	} else {
- unrecognized_directive:
- 		s = d-1;
-@@ -89,6 +228,39 @@
- 	return s;
- }
- 
-+char *
-+read_zone_line(void)
-+{
-+	char *r;
-+
-+	if (file_info->generate_lhs) {
-+		if (file_info->generate_cur <= file_info->generate_lim) {
-+			file_info->buf[0] = 0;
-+			concat_generate_template(file_info->buf, LINEBUFSZ, file_info->generate_cur, file_info->generate_lhs);
-+			mystrlcat(file_info->buf, " ", LINEBUFSZ);
-+			mystrlcat(file_info->buf, file_info->generate_type, LINEBUFSZ);
-+			mystrlcat(file_info->buf, " ", LINEBUFSZ);
-+			concat_generate_template(file_info->buf, LINEBUFSZ, file_info->generate_cur, file_info->generate_rhs);
-+			file_info->generate_cur++;
-+			return file_info->buf;
-+		} else {
-+			/* Done with this $GENERATE */
-+			file_info->generate_cur = 0;
-+			file_info->generate_lim = 0;
-+			file_info->generate_type = NULL;
-+			file_info->generate_lhs = NULL;
-+			free_generate_template(file_info->generate_lhs);
-+			free_generate_template(file_info->generate_rhs);
-+			file_info->generate_rhs = NULL;
-+		}
-+	}
-+
-+	r = fgets(file_info->buf, LINEBUFSZ, file_info->file);
-+	if (r)
-+		file_info->line++;
-+	return r;
-+}
-+
- int
- read_zone_file(void)
- {
-@@ -96,9 +268,8 @@
- 	char *name = NULL, *class, *rdtype;
- 	long ttl = -1;
- 	while (file_info) {
--		while (fgets(file_info->buf, 2048, file_info->file)) {
-+		while (read_zone_line()) {
- 			freeall_temp();
--			file_info->line++;
- 			file_info->paren_mode = 0;
- 			rdtype = NULL;
- 			if (empty_line_or_comment(file_info->buf))
-@@ -179,23 +350,36 @@
- 			if (ttl < 0) {
- 				ttl = G.default_ttl;
- 			}
--			if (ttl < 0) {
--				bitch("ttl not specified and default is not known");
--				continue;
--			}
- 
- 			{
- 				int is_generic;
- 				int type = str2rdtype(rdtype, &is_generic);
-+				struct rr *rr;
-+
- 				if (type <= 0) continue;
-+
-+				if (ttl < 0 && !(G.opt.soa_minttl_as_default_ttl && type == T_SOA)) {
-+					bitch("ttl not specified and default is not known");
-+					continue;
-+				}
-+
- 				if (is_generic)
--					rr_parse_any(name, ttl, type, s);
-+					rr = rr_parse_any(name, ttl, type, s);
- 				else if (type > T_MAX)
--					rr_parse_any(name, ttl, type, s);
-+					rr = rr_parse_any(name, ttl, type, s);
- 				else if (rr_methods[type].rr_parse)
--					rr_methods[type].rr_parse(name, ttl, type, s);
-+					rr = rr_methods[type].rr_parse(name, ttl, type, s);
- 				else
--					rr_parse_any(name, ttl, type, s);
-+					rr = rr_parse_any(name, ttl, type, s);
-+
-+				if (type == T_SOA && ttl < 0 && rr) {
-+					struct rr_soa *soa = (struct rr_soa *) rr;
-+					soa->rr.ttl = G.default_ttl = soa->minimum;
-+					if (G.opt.verbose) {
-+						fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
-+						fprintf(stderr, "no ttl specified; using SOA MINTTL (%ld) instead\n", G.default_ttl);
-+					}
-+				}
- 			}
- 		}
- 		if (ferror(file_info->file))
-@@ -216,6 +400,9 @@
- 		fname = "stdin";
- 	} else {
- 		f = fopen(fname, "r");
-+		if (!file_info && !G.opt.include_path_specified) {
-+			G.opt.include_path = quickstrdup(dirname(quickstrdup_temp(fname)));
-+		}
- 	}
- 	if (!f)
- 		croak(1, "open %s", fname);
-@@ -226,6 +413,11 @@
- 	new_file_info->file = f;
- 	new_file_info->line = 0;
- 	strcpy(new_file_info->name, fname);
-+	if (file_info) {
-+		new_file_info->current_origin = file_info->current_origin;
-+	} else {
-+		new_file_info->current_origin = G.opt.first_origin;
-+	}
- 	file_info = new_file_info;
- }
- 
-@@ -248,6 +440,8 @@
- 	fprintf(stderr, "\t\t\tmx-alias\n");
- 	fprintf(stderr, "\t\t\tns-alias\n");
- 	fprintf(stderr, "\t\t\trp-txt-exists\n");
-+	fprintf(stderr, "\t\t\ttlsa-host\n");
-+	fprintf(stderr, "\t\t\tksk-exists\n");
- 	fprintf(stderr, "\t\t\tall\n");
- 
- 	fprintf(stderr, "\t-n N\t\tuse N worker threads\n");
-@@ -273,6 +467,7 @@
- 	G.default_ttl = -1; /* XXX orly? */
- 	G.opt.times_to_check[0] = time(NULL);
- 	G.opt.n_times_to_check = 0;
-+	G.opt.include_path = ".";
- 
- 	for (i = 0; i <= T_MAX; i++) {
- 		rr_methods[i] = unknown_methods;
-@@ -328,7 +523,7 @@
- 	struct timeval start, stop;
- 
- 	initialize_globals();
--	while ((o = getopt(argc, argv, "fhqsvI:z:t:p:n:")) != -1) {
-+	while ((o = getopt(argc, argv, "fhMqsvI:z:t:p:n:")) != -1) {
- 		switch(o) {
- 		case 'h':
- 			usage(NULL);
-@@ -336,6 +531,9 @@
- 		case 'f':
- 			G.opt.die_on_first_error = 1;
- 			break;
-+		case 'M':
-+			G.opt.soa_minttl_as_default_ttl = 1;
-+			break;
- 		case 'q':
- 			G.opt.no_output = 1;
- 			break;
-@@ -369,19 +567,22 @@
- 				G.opt.policy_checks[POLICY_RP_TXT_EXISTS] = 1;
- 			} else if (strcmp(optarg, "tlsa-host") == 0) {
- 				G.opt.policy_checks[POLICY_TLSA_HOST] = 1;
-+			} else if (strcmp(optarg, "ksk-exists") == 0) {
-+				G.opt.policy_checks[POLICY_KSK_EXISTS] = 1;
- 			} else {
- 				usage("unknown policy name");
- 			}
- 			break;
- 		case 'I':
- 			G.opt.include_path = optarg;
-+			G.opt.include_path_specified = 1;
- 			break;
- 		case 'z':
- 			if (strlen(optarg) && *(optarg+strlen(optarg)-1) == '.') {
--				G.opt.current_origin = optarg;
-+				G.opt.first_origin = optarg;
- 			} else if (strlen(optarg)) {
--				G.opt.current_origin = getmem(strlen(optarg)+2);
--				strcpy(mystpcpy(G.opt.current_origin, optarg), ".");
-+				G.opt.first_origin = getmem(strlen(optarg)+2);
-+				strcpy(mystpcpy(G.opt.first_origin, optarg), ".");
- 			} else {
- 				usage("origin must not be empty");
- 			}
-@@ -417,6 +618,9 @@
- 		if (first_nsec3) nsec3_validate(&first_nsec3->rr);
- 		perform_remaining_nsec3checks();
- 	}
-+	if (G.dnssec_active && G.opt.policy_checks[POLICY_KSK_EXISTS]) {
-+		dnskey_ksk_policy_check();
-+	}
- 	gettimeofday(&stop, NULL);
- 	if (G.opt.summary) {
- 		printf("records found:       %d\n", G.stats.rr_count);
-diff -Naur validns-0.8/mx.c validns-0.8_git20160720/mx.c
---- validns-0.8/mx.c	2014-02-11 15:45:19.000000000 -0500
-+++ validns-0.8_git20160720/mx.c	2016-02-04 09:14:15.000000000 -0500
-@@ -21,7 +21,7 @@
- {
- 	struct rr_mx *rr = getmem(sizeof(*rr));
- 
--	rr->preference = extract_integer(&s, "MX preference");
-+	rr->preference = extract_integer(&s, "MX preference", NULL);
- 	if (rr->preference < 0)
- 		return NULL;
- 	/* XXX preference range check */
-diff -Naur validns-0.8/naptr.c validns-0.8_git20160720/naptr.c
---- validns-0.8/naptr.c	2014-02-11 15:45:22.000000000 -0500
-+++ validns-0.8_git20160720/naptr.c	2016-02-04 09:14:15.000000000 -0500
-@@ -24,14 +24,14 @@
- 	int i;
- 	struct binary_data text;
- 
--	i = extract_integer(&s, "order");
-+	i = extract_integer(&s, "order", NULL);
- 	if (i < 0)
- 		return NULL;
- 	if (i >= 65536)
- 		return bitch("order range is not valid");
- 	rr->order = i;
- 
--	i = extract_integer(&s, "preference");
-+	i = extract_integer(&s, "preference", NULL);
- 	if (i < 0)
- 		return NULL;
- 	if (i >= 65536)
-diff -Naur validns-0.8/nid.c validns-0.8_git20160720/nid.c
---- validns-0.8/nid.c	2014-02-11 15:46:20.000000000 -0500
-+++ validns-0.8_git20160720/nid.c	2016-02-04 09:14:15.000000000 -0500
-@@ -22,7 +22,7 @@
- 	struct rr_nid *rr = getmem(sizeof(*rr));
- 	int preference;
- 
--	rr->preference = preference = extract_integer(&s, "NID preference");
-+	rr->preference = preference = extract_integer(&s, "NID preference", NULL);
- 	if (preference < 0)
- 		return NULL;
- 	if (extract_u64(&s, "NodeID", &rr->node_id) < 0)
-diff -Naur validns-0.8/nsec3.c validns-0.8_git20160720/nsec3.c
---- validns-0.8/nsec3.c	2014-02-11 15:45:31.000000000 -0500
-+++ validns-0.8_git20160720/nsec3.c	2016-02-04 09:14:15.000000000 -0500
-@@ -31,7 +31,7 @@
- 	char *str_type = NULL;
- 	int ltype;
- 
--	i = extract_integer(&s, "hash algorithm");
-+	i = extract_integer(&s, "hash algorithm", NULL);
- 	if (i < 0)
- 		return NULL;
- 	if (i > 255)
-@@ -40,7 +40,7 @@
- 		return bitch("unrecognized or unsupported hash algorithm");
- 	rr->hash_algorithm = i;
- 
--	i = extract_integer(&s, "flags");
-+	i = extract_integer(&s, "flags", NULL);
- 	if (i < 0)
- 		return NULL;
- 	if (i > 255)
-@@ -52,7 +52,7 @@
- 		opt_out = 1;
- 	rr->flags = i;
- 
--	i = extract_integer(&s, "iterations");
-+	i = extract_integer(&s, "iterations", NULL);
- 	if (i < 0)
- 		return NULL;
- 	if (i > 2500)
-diff -Naur validns-0.8/nsec3param.c validns-0.8_git20160720/nsec3param.c
---- validns-0.8/nsec3param.c	2014-02-11 15:45:41.000000000 -0500
-+++ validns-0.8_git20160720/nsec3param.c	2016-02-04 09:14:15.000000000 -0500
-@@ -27,7 +27,7 @@
- 	struct rr *ret_rr;
- 	int i;
- 
--	i = extract_integer(&s, "hash algorithm");
-+	i = extract_integer(&s, "hash algorithm", NULL);
- 	if (i < 0)
- 		return NULL;
- 	if (i > 255)
-@@ -36,7 +36,7 @@
- 		return bitch("unrecognized or unsupported hash algorithm");
- 	rr->hash_algorithm = i;
- 
--	i = extract_integer(&s, "flags");
-+	i = extract_integer(&s, "flags", NULL);
- 	if (i < 0)
- 		return NULL;
- 	if (i > 255)
-@@ -45,7 +45,7 @@
- 		return bitch("flags is supposed to be 0 for NSEC3PARAM");
- 	rr->flags = i;
- 
--	i = extract_integer(&s, "iterations");
-+	i = extract_integer(&s, "iterations", NULL);
- 	if (i < 0)
- 		return NULL;
- 	if (i > 2500)
-diff -Naur validns-0.8/px.c validns-0.8_git20160720/px.c
---- validns-0.8/px.c	2014-02-11 15:46:50.000000000 -0500
-+++ validns-0.8_git20160720/px.c	2016-02-04 09:14:15.000000000 -0500
-@@ -21,7 +21,7 @@
- {
- 	struct rr_px *rr = getmem(sizeof(*rr));
- 
--	rr->preference = extract_integer(&s, "PX preference");
-+	rr->preference = extract_integer(&s, "PX preference", NULL);
- 	if (rr->preference < 0)
- 		return NULL;
- 
-diff -Naur validns-0.8/rr.c validns-0.8_git20160720/rr.c
---- validns-0.8/rr.c	2014-02-11 15:45:34.000000000 -0500
-+++ validns-0.8_git20160720/rr.c	2016-02-04 09:14:15.000000000 -0500
-@@ -432,7 +432,7 @@
- 	s = skip_white_space(s);
- 	if (!s)	return NULL;
- 
--	len = extract_integer(&s, "custom data size");
-+	len = extract_integer(&s, "custom data size", NULL);
- 	if (len < 0) return NULL;
- 	if (len > 65535) goto invalid;
- 
-@@ -810,7 +810,7 @@
- 	char *str_alg;
- 
- 	if (isdigit(**s)) {
--		alg = extract_integer(s, what);
-+		alg = extract_integer(s, what, NULL);
- 		if (algorithm_type(alg) == ALG_UNSUPPORTED) {
- 			bitch("bad or unsupported algorithm %d", alg);
- 			return ALG_UNSUPPORTED;
-diff -Naur validns-0.8/rr.h validns-0.8_git20160720/rr.h
---- validns-0.8/rr.h	2014-02-11 15:46:57.000000000 -0500
-+++ validns-0.8_git20160720/rr.h	2016-02-04 09:14:15.000000000 -0500
-@@ -201,11 +201,15 @@
- };
- extern struct rr_methods dhcid_methods;
- 
-+struct rr_txt_segment {
-+	struct binary_data txt;
-+	struct rr_txt_segment *next;
-+};
- struct rr_txt
- {
-     struct rr rr;
-     int count;
--    struct binary_data txt[1];
-+	struct rr_txt_segment *txt;
- };
- extern struct rr_methods txt_methods;
- 
-@@ -458,10 +462,18 @@
- 	uint16_t key_tag;
- 	int pkey_built;
- 	void *pkey;
-+	/* extras */
-+	int key_type;
-+	struct rr_dnskey *next_key;
- };
- extern struct rr_methods dnskey_methods;
- 
-+#define KEY_TYPE_UNUSED 0
-+#define KEY_TYPE_KSK    1
-+#define KEY_TYPE_ZSK    2
-+
- int dnskey_build_pkey(struct rr_dnskey *rr);
-+void dnskey_ksk_policy_check(void);
- 
- struct rr_ds
- {
-diff -Naur validns-0.8/rrsig.c validns-0.8_git20160720/rrsig.c
---- validns-0.8/rrsig.c	2014-02-11 15:45:39.000000000 -0500
-+++ validns-0.8_git20160720/rrsig.c	2016-02-04 09:14:15.000000000 -0500
-@@ -64,7 +64,7 @@
- 		return bitch("private algorithms are not supported in RRSIG");
- 	}
- 
--	rr->labels = extract_integer(&s, "labels");
-+	rr->labels = extract_integer(&s, "labels", NULL);
- 	if (rr->labels < 0)	return NULL;
- 	/* TODO validate labels, see http://tools.ietf.org/html/rfc4034#section-3.1.3 */
- 
-@@ -79,7 +79,7 @@
- 	if (ts < 0) return NULL;
- 	rr->sig_inception = ts;
- 
--	key_tag = extract_integer(&s, "key tag");
-+	key_tag = extract_integer(&s, "key tag", NULL);
- 	if (key_tag < 0)	return NULL;
- 	rr->key_tag = key_tag;
- 
-@@ -434,6 +434,12 @@
- 		unsigned long e = 0;
- 		for (i = 0; i < k->n_keys; i++) {
- 			if (k->to_verify[i].ok) {
-+				if (k->to_verify[i].rr->rr.rr_set->named_rr->flags & NAME_FLAG_APEX) {
-+					if (k->to_verify[i].key->key_type == KEY_TYPE_UNUSED)
-+						k->to_verify[i].key->key_type = KEY_TYPE_KSK;
-+				} else {
-+					k->to_verify[i].key->key_type = KEY_TYPE_ZSK;
-+				}
- 				ok = 1;
- 				break;
- 			} else {
-diff -Naur validns-0.8/rt.c validns-0.8_git20160720/rt.c
---- validns-0.8/rt.c	2014-02-11 15:46:53.000000000 -0500
-+++ validns-0.8_git20160720/rt.c	2016-02-04 09:14:15.000000000 -0500
-@@ -21,7 +21,7 @@
- {
- 	struct rr_rt *rr = getmem(sizeof(*rr));
- 
--	rr->preference = extract_integer(&s, "RT preference");
-+	rr->preference = extract_integer(&s, "RT preference", NULL);
- 	if (rr->preference < 0)
- 		return NULL;
- 
-diff -Naur validns-0.8/soa.c validns-0.8_git20160720/soa.c
---- validns-0.8/soa.c	2014-02-11 15:45:26.000000000 -0500
-+++ validns-0.8_git20160720/soa.c	2016-02-04 09:14:15.000000000 -0500
-@@ -27,7 +27,7 @@
- 	if (!rr->mname) return NULL;
- 	rr->rname = extract_name(&s, "rname", 0);
- 	if (!rr->rname) return NULL;
--	i = extract_integer(&s, "serial");
-+	i = extract_integer(&s, "serial", NULL);
- 	if (i < 0) return NULL;
- 	if (i > 4294967295UL) return bitch("serial is out of range");
- 	rr->serial = i;
-@@ -39,6 +39,9 @@
- 	if (rr->expire < 0) return NULL;
- 	rr->minimum = extract_timevalue(&s, "minimum");
- 	if (rr->minimum < 0) return NULL;
-+	if (ttl < 0 && G.opt.soa_minttl_as_default_ttl) {
-+		ttl = rr->minimum;
-+	}
- 	if (*s) {
- 		return bitch("garbage after valid SOA data");
- 	}
-diff -Naur validns-0.8/srv.c validns-0.8_git20160720/srv.c
---- validns-0.8/srv.c	2014-02-11 15:45:48.000000000 -0500
-+++ validns-0.8_git20160720/srv.c	2016-02-04 09:14:15.000000000 -0500
-@@ -24,21 +24,21 @@
- 
- 	/* TODO validate `name` (underscores etc) http://tools.ietf.org/html/rfc2782 */
- 
--	i = extract_integer(&s, "priority");
-+	i = extract_integer(&s, "priority", NULL);
- 	if (i < 0)
- 		return NULL;
- 	if (i >= 65536)
- 		return bitch("priority range is not valid");
- 	rr->priority = i;
- 
--	i = extract_integer(&s, "weight");
-+	i = extract_integer(&s, "weight", NULL);
- 	if (i < 0)
- 		return NULL;
- 	if (i >= 65536)
- 		return bitch("weight range is not valid");
- 	rr->weight = i;
- 
--	i = extract_integer(&s, "port");
-+	i = extract_integer(&s, "port", NULL);
- 	if (i < 0)
- 		return NULL;
- 	if (i >= 65536)
-diff -Naur validns-0.8/sshfp.c validns-0.8_git20160720/sshfp.c
---- validns-0.8/sshfp.c	2014-02-11 15:45:51.000000000 -0500
-+++ validns-0.8_git20160720/sshfp.c	2016-02-04 09:14:15.000000000 -0500
-@@ -22,13 +22,13 @@
- 	struct rr_sshfp *rr = getmem(sizeof(*rr));
- 	int algorithm, fp_type;
- 
--	algorithm = extract_integer(&s, "algorithm");
-+	algorithm = extract_integer(&s, "algorithm", NULL);
- 	if (algorithm < 0)	return NULL;
--	if (algorithm != 1 && algorithm != 2 && algorithm != 3)
-+	if (algorithm != 1 && algorithm != 2 && algorithm != 3 && algorithm != 4)
- 		return bitch("unsupported algorithm");
- 	rr->algorithm = algorithm;
- 
--	fp_type = extract_integer(&s, "fp type");
-+	fp_type = extract_integer(&s, "fp type", NULL);
- 	if (fp_type < 0)	return NULL;
- 	if (fp_type != 1 && fp_type != 2)
- 		return bitch("unsupported fp_type");
-diff -Naur validns-0.8/t/issues/36-include/empty-include.zone validns-0.8_git20160720/t/issues/36-include/empty-include.zone
---- validns-0.8/t/issues/36-include/empty-include.zone	1969-12-31 19:00:00.000000000 -0500
-+++ validns-0.8_git20160720/t/issues/36-include/empty-include.zone	2016-02-04 09:14:15.000000000 -0500
-@@ -0,0 +1,4 @@
-+$ORIGIN example.com.
-+@       IN  200    SOA     ns hostmaster 1 10800 3600 2592000 1200
-+        IN      NS      ns
-+$INCLUDE ; there is no include, and it is wrong
-diff -Naur validns-0.8/t/issues/36-include/inc2.inc validns-0.8_git20160720/t/issues/36-include/inc2.inc
---- validns-0.8/t/issues/36-include/inc2.inc	1969-12-31 19:00:00.000000000 -0500
-+++ validns-0.8_git20160720/t/issues/36-include/inc2.inc	2016-02-04 09:14:15.000000000 -0500
-@@ -0,0 +1,2 @@
-+$ORIGIN inc2 ; i.e., inc2.inc1.example.com.
-+@ A 55.55.55.55
-diff -Naur validns-0.8/t/issues/36-include/include.zone validns-0.8_git20160720/t/issues/36-include/include.zone
---- validns-0.8/t/issues/36-include/include.zone	1969-12-31 19:00:00.000000000 -0500
-+++ validns-0.8_git20160720/t/issues/36-include/include.zone	2016-02-04 09:14:15.000000000 -0500
-@@ -0,0 +1,6 @@
-+$ORIGIN example.com.
-+@       IN  200    SOA     ns hostmaster 1 10800 3600 2592000 1200
-+        IN      NS      ns
-+$INCLUDE reldir/inc1.inc ; relative to the zone file
-+; here we should be back to our origin
-+@ IN A 99.99.99.99
-diff -Naur validns-0.8/t/issues/36-include/missing-include.zone validns-0.8_git20160720/t/issues/36-include/missing-include.zone
---- validns-0.8/t/issues/36-include/missing-include.zone	1969-12-31 19:00:00.000000000 -0500
-+++ validns-0.8_git20160720/t/issues/36-include/missing-include.zone	2016-02-04 09:14:15.000000000 -0500
-@@ -0,0 +1,4 @@
-+$ORIGIN example.com.
-+@       IN  200    SOA     ns hostmaster 1 10800 3600 2592000 1200
-+        IN      NS      ns
-+$INCLUDE nosuch.inc
-diff -Naur validns-0.8/t/issues/36-include/reldir/inc1.inc validns-0.8_git20160720/t/issues/36-include/reldir/inc1.inc
---- validns-0.8/t/issues/36-include/reldir/inc1.inc	1969-12-31 19:00:00.000000000 -0500
-+++ validns-0.8_git20160720/t/issues/36-include/reldir/inc1.inc	2016-02-04 09:14:15.000000000 -0500
-@@ -0,0 +1,5 @@
-+$ORIGIN inc1 ; i.e., inc1.example.com.
-+@ A 11.11.11.11
-+$INCLUDE inc2.inc ; still relative to the zone file, not to this dir
-+; should be back to this origin
-+@ AAAA 1111::1111
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/dsset-example.sec. validns-0.8_git20160720/t/issues/41-ksk-policy-check/dsset-example.sec.
---- validns-0.8/t/issues/41-ksk-policy-check/dsset-example.sec.	1969-12-31 19:00:00.000000000 -0500
-+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/dsset-example.sec.	2016-02-04 09:14:15.000000000 -0500
-@@ -0,0 +1,2 @@
-+example.sec.		IN DS 7686 7 1 51B9CD8F901235705C6D353ADA23736AE954B4DE
-+example.sec.		IN DS 7686 7 2 9EC80B8BAD67C66954B8FE726E06CA7840282C7F444BE51A916ED11C 36908A3F
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/example.sec validns-0.8_git20160720/t/issues/41-ksk-policy-check/example.sec
---- validns-0.8/t/issues/41-ksk-policy-check/example.sec	1969-12-31 19:00:00.000000000 -0500
-+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/example.sec	2016-02-04 09:14:15.000000000 -0500
-@@ -0,0 +1,12 @@
-+$TTL    1d
-+@       IN      SOA     ns.example.sec. hostmaster.example.sec. (
-+                              1         ; Serial
-+                         604800         ; Refresh
-+                          86400         ; Retry
-+                        2419200         ; Expire
-+                         604800 )       ; Negative Cache TTL
-+                IN      NS      ns1.example.net.
-+subA            IN      NS      ns1.example.net.
-+subb            IN      NS      ns1.example.net.
-+subC            IN      NS      ns1.example.net.
-+myMX	IN	MX 5 mx.example.net.
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/example.sec.signed validns-0.8_git20160720/t/issues/41-ksk-policy-check/example.sec.signed
---- validns-0.8/t/issues/41-ksk-policy-check/example.sec.signed	1969-12-31 19:00:00.000000000 -0500
-+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/example.sec.signed	2016-02-04 09:14:15.000000000 -0500
-@@ -0,0 +1,131 @@
-+; File written on Tue Jun 30 15:31:27 2015
-+; dnssec_signzone version 9.9.7
-+example.sec.		86400	IN SOA	ns.example.sec. hostmaster.example.sec. (
-+					1          ; serial
-+					604800     ; refresh (1 week)
-+					86400      ; retry (1 day)
-+					2419200    ; expire (4 weeks)
-+					604800     ; minimum (1 week)
-+					)
-+			86400	RRSIG	SOA 7 2 86400 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					b1Qs5d/0a4IDAvFPVvDKqWpir4189XoPOD4E
-+					804eiNXRLP2ShkEUBPil44+6Ikwup5Im24XU
-+					PLnmStjUFHVniicvwbwT/IY4etXR4xNoBHUc
-+					BU8LiADPpZGfJ1tC/s/IHLcPbX21OltyYzi0
-+					++z9gxZGy4vCG5gYCH0vm+Q96fY= )
-+			86400	NS	ns1.example.net.
-+			86400	RRSIG	NS 7 2 86400 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					gyqsk3xSnKefnjTOVzJS4sdDFiJ5cPEupSkP
-+					+LGXGRDGrclY6V9mkfddQz3MkeCCjujvQNAi
-+					NpZllyzFj221se5bHLAVydkT0jhl2jgp8bsL
-+					DBk15FGa7SXcwtpXn5rkDvR1/wmS7M/aYnrY
-+					3j5dTSSsOlZQLENWBEtct9QSNbU= )
-+			86400	DNSKEY	256 3 7 (
-+					AwEAAaMBYu1QXBi6AII33FKwWpHhOkGMhcVc
-+					IWJ73npEFjvDe0jJfLjkghnij4tMfDI8MPIZ
-+					6xwVLYsEshxsDNEJJGdZ1dUvfJDxSCv8Wp0a
-+					2IffxQ5NDRHSpUw27yJoQfI5gUqvor+wGTNC
-+					UWx2OU0Y1BOy1whHtVbDl1gt1R6/8mOZ
-+					) ; ZSK; alg = NSEC3RSASHA1; key id = 64232
-+			86400	DNSKEY	257 3 7 (
-+					AwEAAciLWglw17dt8EDAN88BrQYCIaGPifC4
-+					pxrizfz3S1cC4XbSyRW5loj5SSHVveUmmIV9
-+					0MTEOhGCDUVq/qiYG7NgTNHn3YiqyRU3sirw
-+					4SACFiwln/ejxFDpQkeAbZMCzU8FQhTIB1K9
-+					y7QRiLacI6naULzgP3h4PsdQSQmw3/TWy973
-+					M+lHzwkgVq6ML42L18rGG0sn1KQDNSs/6sd9
-+					dcRjPo7uJ2OuUsnbu/5N3vWYLciSBUnY27FU
-+					vbFLkVIq072wjUMIb0Xc2EgYGRFKyV2MMckL
-+					voD7vPclBE0Krv9fO/B2/KXsbObTgz4m5iQN
-+					F45QLU02kmvwB4iyIzIk9O0=
-+					) ; KSK; alg = NSEC3RSASHA1; key id = 7686
-+			86400	RRSIG	DNSKEY 7 2 86400 (
-+					20150730123127 20150630123127 7686 example.sec.
-+					YQ42WBCr7e4MR51W+d6Awkxdff7tTNiA1qfJ
-+					wsst0UiNXKAv504YRcS6B34u4CfG59lWWtcd
-+					+xBHU7Zuox5nehsLEkFAneD1YrJLkgVw03nZ
-+					NzDNWFvlxfQ2/tJ7vGbjKG2cEwUnbJKl+Kcl
-+					JTAc5JzZegfM75M0Z4Yi9NiDjicpHbaICtKJ
-+					5WZ6T5nVFo1nl2xCq2CiXiR1+jGKARUW+btO
-+					NzHMApLQszDo7CMgvYJoHy0CHAV1Uc7Ka4zO
-+					P3dVYkwu1Puk+gixhNUqo+UhKgLB2JUYdci7
-+					cQ1JR9RzqEXzyZgGpLmXCOEOc8KD2c2dDN5L
-+					uvOV40OrWhST/bAQ+Q== )
-+			86400	RRSIG	DNSKEY 7 2 86400 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					lKX35bocQ1iR4VTW0Es+2bZ2qX1ON7OGU1fO
-+					Pb0ZqueG2GYgI63VE4Jv3WeOmGg/Tkjvsdb6
-+					bMHVuVpxHvQKRqqzfaQmY7nzoDe53LfSJewj
-+					p2TvdhvpPRroEZGXXPmVl46R/p+jlYMJd47T
-+					o0oqB/BvQPUS61a5NThagGq6vJM= )
-+			0	NSEC3PARAM 1 0 10 -
-+			0	RRSIG	NSEC3PARAM 7 2 0 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					hNJlc3JuGYBpnYEZQrhqNwrIL2fBegnnR4ii
-+					TOW+0Km2maqF5ZZMxBZ7x54gW4T0amXXz89+
-+					uE+l02eknf/FgM81FFOrQvJul0toOzKW9g67
-+					e2VwQAwcw7g6H06cSsypXM/h9wvsNQpoSdx0
-+					rq6qU2ruYM9NmJf+xUzUk38AFUw= )
-+subA.example.sec.	86400	IN NS	ns1.example.net.
-+subb.example.sec.	86400	IN NS	ns1.example.net.
-+subC.example.sec.	86400	IN NS	ns1.example.net.
-+93GL7KF6D2G7J2PSLEO2CIA70A3MM4KQ.example.sec. 604800 IN	NSEC3 1 0 10 - (
-+					CSLD6RFNKVSKA73DGNI0EOM95Q8DKGBQ
-+					NS )
-+			604800	RRSIG	NSEC3 7 3 604800 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					JRhyC3PbmnvYBkXzV5GmIBnj5LJTnrVeC1t3
-+					v6t6o+3udfPZRecHw2cApf/Oed8H9jCeox77
-+					vA13/fLXui635CYAcqXYxVgO4g0au1d1S6lo
-+					N2Pw96JXDNhIqyVBVj1Ii2ZOQLWXZ8YgZRQ6
-+					lxgww8m0QGC8FjEnzR8z2liSG88= )
-+3ED4GMVJJ0FT4TCFDKNFQ5EPEFSDBPNM.example.sec. 604800 IN	NSEC3 1 0 10 - (
-+					93GL7KF6D2G7J2PSLEO2CIA70A3MM4KQ
-+					NS )
-+			604800	RRSIG	NSEC3 7 3 604800 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					B9L5NrHjO/J6FDmv7DjT1xq/f8jiB2WTEXSl
-+					bFeUVcTivoyvdyfNNTH+YlzJesqTtQ9GaEPQ
-+					ouzw7XbdyvtJ//GD+vrO/7XwfrVmkckQgEVl
-+					zPm70TksAkwLzj0uY6WBIGIPq/KJMM14f6El
-+					ct5w2KtgvF9sazFP+KMchU5Be3Q= )
-+myMX.example.sec.	86400	IN MX	5 mx.example.net.
-+			86400	RRSIG	MX 7 3 86400 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					lh8vFwFg77gLtLyXbzqzYSlebkzn3yAlXHU2
-+					/hgiyUWYcuZa5E33Ul+ZrUJPCGLaUQs3X+yL
-+					p/uk6LP2dnMaf/X1mow/tyYNtIdn0MhTYNqs
-+					WmYV1Ga/NSoErtoHYoNgeqV1w0Q/nfhipMdX
-+					RekpxVR6RUUt2d3LS8UIH+pEYd8= )
-+CSLD6RFNKVSKA73DGNI0EOM95Q8DKGBQ.example.sec. 604800 IN	NSEC3 1 0 10 - (
-+					JC1M8I9IPBEENK9RDGMN9LQKAMMSQEVV
-+					MX RRSIG )
-+			604800	RRSIG	NSEC3 7 3 604800 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					menCNV7RkbVWmfhuPfoYHfHCEtvQmVb3+p/x
-+					WYVymu5hXUPQ2+K4Ns0jQ+om4GuTmXmm1DYY
-+					IjIXv4jthJoD6jydqN6Hr+tr0ewxr6mHXj3I
-+					RizTBuw4zcgPUrIRVQStkMtwyjN4Nlznhg7I
-+					txZ14uH1G4U1DgkR2oC6YZsSqi8= )
-+JC1M8I9IPBEENK9RDGMN9LQKAMMSQEVV.example.sec. 604800 IN	NSEC3 1 0 10 - (
-+					NLF2NKFTCGVVRC4C941FOOCD00TPI9DV
-+					NS SOA RRSIG DNSKEY NSEC3PARAM )
-+			604800	RRSIG	NSEC3 7 3 604800 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					ggLIoKQYmI9GeBkSccVdE87G1QQwGGO0HlrN
-+					dg9Ah5QiWWjZ5icSOU4vyEm0XiqkFCrGEAq0
-+					9L4HMOFuELMa28dAhVxOvZldbXizXUSCbWCS
-+					miYFLOIKcQ9IcmzeEgg+uJzHdAyYSSK2Jb+0
-+					YYuoXOhiZwzluj+u2i6kbf6wDY4= )
-+NLF2NKFTCGVVRC4C941FOOCD00TPI9DV.example.sec. 604800 IN	NSEC3 1 0 10 - (
-+					3ED4GMVJJ0FT4TCFDKNFQ5EPEFSDBPNM
-+					NS )
-+			604800	RRSIG	NSEC3 7 3 604800 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					buRQJjfJDIbRFZFr8s7odGSxqnrSHXXN/AAu
-+					tbG1k2L7WD+DGYFiRnR5Uia/C2oL186PqBtT
-+					R8oDKf/4zr5qOsZz9xYabaBqG98JVXwPTiFk
-+					JBoc7sFcwGJ16hj9Zey05aNs1h5RZm6BL8W0
-+					9bRF3qIezckG0VA+U7ASTLNH4ME= )
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key
---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key	1969-12-31 19:00:00.000000000 -0500
-+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key	2016-02-04 09:14:15.000000000 -0500
-@@ -0,0 +1,5 @@
-+; This is a key-signing key, keyid 7686, for example.sec.
-+; Created: 20150630133112 (Tue Jun 30 15:31:12 2015)
-+; Publish: 20150630133112 (Tue Jun 30 15:31:12 2015)
-+; Activate: 20150630133112 (Tue Jun 30 15:31:12 2015)
-+example.sec. IN DNSKEY 257 3 7 AwEAAciLWglw17dt8EDAN88BrQYCIaGPifC4pxrizfz3S1cC4XbSyRW5 loj5SSHVveUmmIV90MTEOhGCDUVq/qiYG7NgTNHn3YiqyRU3sirw4SAC Fiwln/ejxFDpQkeAbZMCzU8FQhTIB1K9y7QRiLacI6naULzgP3h4PsdQ SQmw3/TWy973M+lHzwkgVq6ML42L18rGG0sn1KQDNSs/6sd9dcRjPo7u J2OuUsnbu/5N3vWYLciSBUnY27FUvbFLkVIq072wjUMIb0Xc2EgYGRFK yV2MMckLvoD7vPclBE0Krv9fO/B2/KXsbObTgz4m5iQNF45QLU02kmvw B4iyIzIk9O0=
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private
---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private	1969-12-31 19:00:00.000000000 -0500
-+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private	2016-02-04 09:14:15.000000000 -0500
-@@ -0,0 +1,13 @@
-+Private-key-format: v1.3
-+Algorithm: 7 (NSEC3RSASHA1)
-+Modulus: yItaCXDXt23wQMA3zwGtBgIhoY+J8LinGuLN/PdLVwLhdtLJFbmWiPlJIdW95SaYhX3QxMQ6EYINRWr+qJgbs2BM0efdiKrJFTeyKvDhIAIWLCWf96PEUOlCR4BtkwLNTwVCFMgHUr3LtBGItpwjqdpQvOA/eHg+x1BJCbDf9NbL3vcz6UfPCSBWrowvjYvXysYbSyfUpAM1Kz/qx311xGM+ju4nY65Sydu7/k3e9ZgtyJIFSdjbsVS9sUuRUirTvbCNQwhvRdzYSBgZEUrJXYwxyQu+gPu89yUETQqu/1878Hb8pexs5tODPibmJA0XjlAtTTaSa/AHiLIjMiT07Q==
-+PublicExponent: AQAB
-+PrivateExponent: d5kDfRXaz/20hikcH0v0j9y9icg8j17P6WzRQ8eHGsERDPfwDBC+AboJLzB1Ky+1TgcWdgJATyisGXYRoSH1gygvKA+LQnH3sbuheZJl79zOtE1L9TepYEd7y4B/2GiXYETWf+Y619Fwpla+nYjIjAcylzF1KLctWVg79peROEXC0zb+IxWQFIBpe7OzTZ1qxG8ymm6uiu9KXH6qQi3BLSarxj5rY+tO8oj0qQNOGkbSVsXFax0arZ0qMRFT5UooOm+2Yl8Q9Z/PC52qwNqkSDZ2QeoYTJx5tDFhuVJxXhioxGIueA4QuCRA4cRL2U5ZnCYcQa10JFE2O4N990eLUQ==
-+Prime1: 5LW1fl8ky4bBaIPg48Cq8bXQIvaK5syFTvzzMopuTeD6PGwOByuzc4u9KLVrDRebjeYfNVkqXIJAHMjolOr4jURWp2Q3FUrewqdgyY2ULSLMmQo0+dHkvjJIs2A/6vNme+MtFms6msJjyzj3EhLf32djvCH+jWStP3Vb/jopYWs=
-+Prime2: 4HlJJB25JSLygHd0GWi8yu0z3FaYhWXnIs8bwpT8er1lH+tsBeYI8ughuX9h19STMRnBhAh0ZlQaKHOrPTsdVOFQJWr6aUbWIAhv5m+ij1IFsQ58DKnsYP0DXiNkR7K4pXO8yzPTo9UfaMCJAKYipENTgpfb43sVBQnDIGr9oQc=
-+Exponent1: aJpK9g9h7swlLT4T31bBWGeFWFhWUxT7a5L5UAZMSMY67OOmztTH8HLbAwFmgshnVtEHOQkc/M59sCybY3DMWSAGWezV3KEvnOucstJUEQi3ds9aR2AeNHcfFRtSYI0ONF9EwdotJZb+uXXGWrfTOIQ681LA7746FqoAdxf20R0=
-+Exponent2: QlFS3Iqzglc60d14vXEGJeXCZpxm3zJmARCzIN+nYBPIZo/FEFEP38PZAtaxb3RsMBtt4rYkvX6nY8AYnTRzy/ntFcDvTl8RL9GOTcQ5gKI48EBZQdyJ63WUoyFNpSkWCDuTUW10X3i9mNMZJsnufh0t9O0sl55rbVue/Frfp80=
-+Coefficient: aLnGdfeRJ3nSjmbby8IDkJ+W+gFGOHd3XAMDSNP9D8kn6B3JyAfY6FDSg0+Bh+F80PFNGsESkYimXlWr3B6NlC0Gq99hPSV8yU2pYHq3TPVB0tWOAkNVIXM9icEH9wshCQH7wD7cPDWvhhgcgo64nYOGYeK6sjTL7XDtRanvbP8=
-+Created: 20150630133112
-+Publish: 20150630133112
-+Activate: 20150630133112
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key
---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key	1969-12-31 19:00:00.000000000 -0500
-+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key	2016-02-04 09:14:15.000000000 -0500
-@@ -0,0 +1,5 @@
-+; This is a zone-signing key, keyid 64232, for example.sec.
-+; Created: 20150630133105 (Tue Jun 30 15:31:05 2015)
-+; Publish: 20150630133105 (Tue Jun 30 15:31:05 2015)
-+; Activate: 20150630133105 (Tue Jun 30 15:31:05 2015)
-+example.sec. IN DNSKEY 256 3 7 AwEAAaMBYu1QXBi6AII33FKwWpHhOkGMhcVcIWJ73npEFjvDe0jJfLjk ghnij4tMfDI8MPIZ6xwVLYsEshxsDNEJJGdZ1dUvfJDxSCv8Wp0a2Iff xQ5NDRHSpUw27yJoQfI5gUqvor+wGTNCUWx2OU0Y1BOy1whHtVbDl1gt 1R6/8mOZ
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private
---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private	1969-12-31 19:00:00.000000000 -0500
-+++ validns-0.8_git20160720/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private	2016-02-04 09:14:15.000000000 -0500
-@@ -0,0 +1,13 @@
-+Private-key-format: v1.3
-+Algorithm: 7 (NSEC3RSASHA1)
-+Modulus: owFi7VBcGLoAgjfcUrBakeE6QYyFxVwhYnveekQWO8N7SMl8uOSCGeKPi0x8Mjww8hnrHBUtiwSyHGwM0QkkZ1nV1S98kPFIK/xanRrYh9/FDk0NEdKlTDbvImhB8jmBSq+iv7AZM0JRbHY5TRjUE7LXCEe1VsOXWC3VHr/yY5k=
-+PublicExponent: AQAB
-+PrivateExponent: ATf/b1rMdXreihq00QF0i+atMtREI8eekEfwz+U2bVf20gJ/pjo/JsZk4FvACfgdPZIoCdu2rXVph4DfT6jL1t7sDY/9mfcMd2Zge6eB8Kat3QpdDu4qClgkXFTYFLj2lQ5Bm/b+YbQ8fiPlZovp7YGFodmsjfnNvbT7UiOiSKE=
-+Prime1: 1wNWdr5FIrew1NTzpbeClZr5NIIoRBpEPsSDCBZpbRDZ944LcjWgrJpVlG1klkp/cR/zcSzrq+637rva30jglQ==
-+Prime2: whQSB4wqB87wyYrewJLU5qFY5Up/YiZ0iyD4m4OIQMk/K7eXtuqFuSOP4xTR4WAWHIyRixa1F85/eh7y6+9h9Q==
-+Exponent1: XjHZJEYw9Yex0VvFrdjaPX5aJJXM3CEButnOabGf2Cckxl4VR6CU1mj6iv7trSXP9RhBR1idmoIHVHA57832jQ==
-+Exponent2: dtzn9etoSoP5gNYmevbyoZWr5jJsNeardhJpcIVsS5F1uQamSob0A2G+XCuCJ3A72pxU/0SXAM+dz2NpEAr6iQ==
-+Coefficient: egVfeiBCmggrVDolCSvAIg+XEb+YmLcD1SLT5qFLuqCtPKWGDx9lGMbqbx5s2gzeeoAPL1r34pohHNLMCqCNdw==
-+Created: 20150630133105
-+Publish: 20150630133105
-+Activate: 20150630133105
-diff -Naur validns-0.8/t/test.pl validns-0.8_git20160720/t/test.pl
---- validns-0.8/t/test.pl	2014-02-11 15:08:39.000000000 -0500
-+++ validns-0.8_git20160720/t/test.pl	2016-02-04 09:14:15.000000000 -0500
-@@ -215,6 +215,35 @@
- like(shift @e, qr/leading zero octets in public key exponent/, "leading zeroes in exponent 2");
- is(+@e, 0, "no unaccounted errors for DNSKEY policy checks");
- 
-+# issue 36: https://github.com/tobez/validns/issues/36 - $include implementation
-+run('./validns', @threads, 't/issues/36-include/empty-include.zone');
-+isnt(rc, 0, 'empty include detected');
-+@e = split /\n/, stderr;
-+like(shift @e, qr/\bINCLUDE directive with empty file name\b/, "Expected error with empty INCLUDE");
-+is(+@e, 0, "no unaccounted errors for empty include");
-+
-+run('./validns', @threads, 't/issues/36-include/missing-include.zone');
-+isnt(rc, 0, 'missing include detected');
-+@e = split /\n/, stderr;
-+like(shift @e, qr/\bNo such file or directory\b/, "Expected error with missing INCLUDE file");
-+is(+@e, 0, "no unaccounted errors for missing include");
-+
-+run('./validns', @threads, '-v', 't/issues/36-include/include.zone');
-+is(rc, 0, 'zone with nested includes parses ok');
-+@e = split /\n/, stderr;
-+for my $rx ((qr/\d:\s+example\.com\.\s+IN\s+\d+\s+NS\s+ns\.example\.com\./,
-+			 qr/\d:\s+inc1\.example\.com\.\s+IN\s+\d+\s+A\s+11\.11\.11\.11/,
-+			 qr/\d:\s+inc2\.inc1\.example\.com\.\s+IN\s+\d+\s+A\s+55\.55\.55\.55/,
-+			 qr/\d:\s+inc1\.example\.com\.\s+IN\s+\d+\s+AAAA\s+1111::1111/,
-+			 qr/\d:\s+example\.com\.\s+IN\s+\d+\s+A\s+99\.99\.99\.99/))
-+{
-+	my $ok = 0;
-+	for my $e (@e) {
-+		$ok = 1 if $e =~ $rx;
-+	}
-+	is($ok, 1, "found expected record with correct ORIGIN tracked across INCLUDEs");
-+}
-+
- # issue 21: https://github.com/tobez/validns/issues/21
- run('./validns', @threads, '-t1345815800', 't/issues/21-nsec3-without-corresponding/example.sec.signed');
- is(rc, 0, 'issue 21 did not come back');
-@@ -227,6 +256,19 @@
- run('./validns', @threads, '-t1345815800', 't/issues/25-nsec/example.sec.signed');
- is(rc, 0, 'issue 25 did not come back');
- 
-+# issue 41: https://github.com/tobez/validns/issues/41
-+run('./validns', @threads, '-t1345815800', '-pksk-exists', 't/issues/25-nsec/example.sec.signed');
-+isnt(rc, 0, 'KSK policy check fails');
-+@e = split /\n/, stderr;
-+like(shift @e, qr/\bNo KSK found\b/, "KSK policy check produces expected error output");
-+is(+@e, 0, "no unaccounted errors for KSK policy check");
-+
-+run('./validns', @threads, '-t1435671103', '-pksk-exists', 't/issues/41-ksk-policy-check/example.sec.signed');
-+is(rc, 0, 'signed zone with KSK parses ok when KSK policy check is active');
-+
-+run('./validns', @threads, '-pksk-exists', 't/zones/galaxyplus.org');
-+is(rc, 0, 'unsigned zone ignores KSK policy checks');
-+
- # issue 26: https://github.com/tobez/validns/issues/26
- run('./validns', @threads, '-t1349357570', 't/issues/26-spurios-glue/example.sec.signed.no-optout');
- is(rc, 0, 'issue 26 did not come back (NSEC3 NO optout)');
-diff -Naur validns-0.8/t/zones/galaxyplus.org validns-0.8_git20160720/t/zones/galaxyplus.org
---- validns-0.8/t/zones/galaxyplus.org	2011-05-16 15:42:03.000000000 -0400
-+++ validns-0.8_git20160720/t/zones/galaxyplus.org	2016-02-04 09:14:15.000000000 -0500
-@@ -18,4 +18,5 @@
- cvs     A 194.28.255.11
- v6		AAAA 2001:2010:1::feef
- text	TXT	"text1" "Another text" "One more"
-+bigtext	TXT	"1" "2" "3" "4" "5" "6" "7" "8" "9" "10" "11" "12" "13" "14" "15" "16" "17" "18" "19" "20" "21" "22" "what is the meaning of this"
- *.meow	CNAME www
-diff -Naur validns-0.8/textparse.c validns-0.8_git20160720/textparse.c
---- validns-0.8/textparse.c	2014-02-11 15:44:53.000000000 -0500
-+++ validns-0.8_git20160720/textparse.c	2016-02-04 09:14:15.000000000 -0500
-@@ -40,8 +40,7 @@
- 	}
- 	if (*s == 0) {
- 		if (file_info->paren_mode) {
--			if (fgets(file_info->buf, 2048, file_info->file)) {
--				file_info->line++;
-+			if (read_zone_line()) {
- 				return skip_white_space(file_info->buf);
- 			} else {
- 				return bitch("unexpected end of file");
-@@ -77,7 +76,7 @@
- 	int d, l, ol;
- 
- 	while (1) {
--		if (isalnum(*s) || *s == '_' || *s == '.' || *s == '-' || *s == '/') {
-+		if (isalnum(*s) || *s == '_' || *s == '.' || *s == '-' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$')) {
- 			if (t-buf >= 1022)
- 				return bitch("name too long");
- 			*t++ = *s++;
-@@ -125,19 +124,19 @@
- 		return bitch("%s should not be empty", what);
- 
- 	if (buf[l-1] != '.') {
--		if (!G.opt.current_origin) {
-+		if (!file_info->current_origin) {
- 			return bitch("do not know origin to determine %s", what);
- 		}
--		ol = strlen(G.opt.current_origin);
--		if (G.opt.current_origin[0] == '.') {
-+		ol = strlen(file_info->current_origin);
-+		if (file_info->current_origin[0] == '.') {
- 			if (l + ol >= 1023)
- 				return bitch("name too long");
--			strcat(buf, G.opt.current_origin);
-+			strcat(buf, file_info->current_origin);
- 		} else {
- 			if (l + ol >= 1022)
- 				return bitch("name too long");
- 			strcat(buf, ".");
--			strcat(buf, G.opt.current_origin);
-+			strcat(buf, file_info->current_origin);
- 		}
- 	}
- 
-@@ -177,12 +176,12 @@
- 		if (*s && !isspace(*s) && *s != ';' && *s != ')') {
- 			return bitch("literal @ in %s is not all by itself", what);
- 		}
--		if (!G.opt.current_origin) {
-+		if (!file_info->current_origin) {
- 			return bitch("do not know origin to expand @ in %s", what);
- 		}
--		r = quickstrdup(G.opt.current_origin);
-+		r = quickstrdup(file_info->current_origin);
- 	} else {
--		if (!(isalnum(*s) || *s == '_' || *s == '.' || *s == '/')) {
-+		if (!(isalnum(*s) || *s == '_' || *s == '.' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$'))) {
- 			if (*s == '*') {
- 				wildcard = 1;
- 			} else {
-@@ -192,7 +191,7 @@
- 			}
- 		}
- 		s++;
--		while (isalnum(*s) || *s == '.' || *s == '-' || *s == '_' || *s == '/')
-+		while (isalnum(*s) || *s == '.' || *s == '-' || *s == '_' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$'))
- 			s++;
- 		if (*s && !isspace(*s) && *s != ';' && *s != ')') {
- 			if (*s == '\\')
-@@ -205,14 +204,14 @@
- 		if (*(s-1) == '.') {
- 			r = quickstrdup(*input);
- 		} else {
--			if (!G.opt.current_origin) {
-+			if (!file_info->current_origin) {
- 				return bitch("do not know origin to determine %s", what);
- 			}
--			r = getmem(strlen(*input) + 1 + strlen(G.opt.current_origin) + 1);
--			if (G.opt.current_origin[0] == '.') {
--				strcpy(mystpcpy(r, *input), G.opt.current_origin);
-+			r = getmem(strlen(*input) + 1 + strlen(file_info->current_origin) + 1);
-+			if (file_info->current_origin[0] == '.') {
-+				strcpy(mystpcpy(r, *input), file_info->current_origin);
- 			} else {
--				strcpy(mystpcpy(mystpcpy(r, *input), "."), G.opt.current_origin);
-+				strcpy(mystpcpy(mystpcpy(r, *input), "."), file_info->current_origin);
- 			}
- 		}
- 		*s = c;
-@@ -277,7 +276,7 @@
- 	return r;
- }
- 
--long long extract_integer(char **input, char *what)
-+long long extract_integer(char **input, char *what, const char *extra_delimiters)
- {
- 	char *s = *input;
- 	long long r = -1;
-@@ -292,8 +291,10 @@
- 	while (isdigit(*s))
- 		s++;
- 	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--		bitch("%s is not valid", what);
--		return -1;
-+		if (!extra_delimiters || strchr(extra_delimiters, *s) == NULL) {
-+			bitch("%s is not valid", what);
-+			return -1;
-+		}
- 	}
- 	if (!*s)	end = s;
- 	c = *s;
-@@ -708,7 +709,17 @@
- 	int c;
- 
- 	if (*s != '"') {
--		bitch("for now, %s must be put in double quotes", what);
-+		while (*s && !isspace(*s)) {
-+			o[l++] = *s++;
-+		}
-+		*input = skip_white_space(s);
-+		if (!*input)
-+			return r;  /* bitching's done elsewhere */
-+
-+		o[l] = 0;
-+		r.data = getmem(l+1);
-+		r.length = l;
-+		memcpy(r.data, o, l+1);
- 		return r;
- 	}
- 	s++;
-@@ -742,8 +753,7 @@
- 		}
- 	}
- 	if (!*s) {
--		if (fgets(file_info->buf, 2048, file_info->file)) {
--			file_info->line++;
-+		if (read_zone_line()) {
- 			s = file_info->buf;
- 			goto more_text;
- 		} else {
-@@ -998,3 +1008,32 @@
- 	for (; (*to = *from); ++from, ++to);
- 	return(to);
- }
-+
-+size_t
-+mystrlcat(char *dst, const char *src, size_t siz)
-+{
-+	char *d = dst;
-+	const char *s = src;
-+	size_t n = siz;
-+	size_t dlen;
-+
-+	/* Find the end of dst and adjust bytes left but don't go past end */
-+	while (n-- != 0 && *d != '\0')
-+		d++;
-+	dlen = d - dst;
-+	n = siz - dlen;
-+
-+	if (n == 0)
-+		return(dlen + strlen(s));
-+	while (*s != '\0') {
-+		if (n != 1) {
-+			*d++ = *s;
-+			n--;
-+		}
-+		s++;
-+	}
-+	*d = '\0';
-+
-+	return(dlen + (s - src));       /* count does not include NUL */
-+}
-+
-diff -Naur validns-0.8/textparse.h validns-0.8_git20160720/textparse.h
---- validns-0.8/textparse.h	2014-02-11 15:45:46.000000000 -0500
-+++ validns-0.8_git20160720/textparse.h	2016-02-04 09:14:15.000000000 -0500
-@@ -33,12 +33,13 @@
-  */
- 
- #define KEEP_CAPITALIZATION 32
-+#define DOLLAR_OK_IN_NAMES  64
- 
- int empty_line_or_comment(char *s);
- char *skip_white_space(char *s);
- char *extract_name(char **input, char *what, int options);
- char *extract_label(char **input, char *what, void *is_temporary);
--long long extract_integer(char **input, char *what);
-+long long extract_integer(char **input, char *what, const char *extra_delimiters);
- long extract_timevalue(char **input, char *what);
- long long extract_timestamp(char **input, char *what);
- int extract_ipv4(char **input, char *what, struct in_addr *addr);
-@@ -59,7 +60,9 @@
- void add_bit_to_set(struct binary_data *set, int bit);
- struct binary_data compressed_set(struct binary_data *set);
- 
--/* stpcpy(3) is not available everywhere */
--char *mystpcpy(char *to, const char *from);
-+char *mystpcpy(char *to, const char *from); /* stpcpy(3) is not available everywhere */
-+size_t mystrlcat(char *dst, const char *src, size_t siz); /* so is strlcat */
-+
-+char *read_zone_line(void);
- 
- #endif
-diff -Naur validns-0.8/tlsa.c validns-0.8_git20160720/tlsa.c
---- validns-0.8/tlsa.c	2014-02-11 15:46:23.000000000 -0500
-+++ validns-0.8_git20160720/tlsa.c	2016-02-04 09:14:15.000000000 -0500
-@@ -28,19 +28,19 @@
- 	struct rr_tlsa *rr = getmem(sizeof(*rr));
- 	int cert_usage, selector, matching_type;
- 
--	cert_usage = extract_integer(&s, "certificate usage field");
-+	cert_usage = extract_integer(&s, "certificate usage field", NULL);
- 	if (cert_usage < 0)	return NULL;
- 	if (cert_usage > 3)
- 		return bitch("bad certificate usage field");
- 	rr->cert_usage = cert_usage;
- 
--	selector = extract_integer(&s, "selector field");
-+	selector = extract_integer(&s, "selector field", NULL);
- 	if (selector < 0)	return NULL;
- 	if (selector > 1)
- 		return bitch("bad selector field");
- 	rr->selector = selector;
- 
--	matching_type = extract_integer(&s, "matching type field");
-+	matching_type = extract_integer(&s, "matching type field", NULL);
- 	if (matching_type < 0)	return NULL;
- 	if (matching_type > 2)
- 		return bitch("bad matching type field");
-diff -Naur validns-0.8/txt.c validns-0.8_git20160720/txt.c
---- validns-0.8/txt.c	2014-02-11 15:45:53.000000000 -0500
-+++ validns-0.8_git20160720/txt.c	2016-02-04 09:14:15.000000000 -0500
-@@ -23,28 +23,36 @@
- static struct rr *txt_parse(char *name, long ttl, int type, char *s)
- {
- 	struct rr_txt *rr;
--	struct binary_data txt[20];
-+	struct binary_data txt;
-+	struct rr_txt_segment *first = NULL;
-+	struct rr_txt_segment *last  = NULL;
-+	struct rr_txt_segment *cur   = NULL;
- 	int i;
- 
- 	i = 0;
- 	while (*s) {
--		if (i >= 20)
--			return bitch("program limit: too many text segments");
--		txt[i] = extract_text(&s, "text segment");
--		if (txt[i].length < 0)
-+		freeall_temp();
-+		txt = extract_text(&s, "text segment");
-+		if (txt.length < 0)
- 			return NULL;
--		if (txt[i].length > 255)
-+		if (txt.length > 255)
- 			return bitch("TXT segment too long");
- 		i++;
-+		cur = getmem(sizeof(*cur));
-+		cur->txt = txt;
-+		cur->next = NULL;
-+		if (!first)
-+			first = cur;
-+		if (last)
-+			last->next = cur;
-+		last = cur;
- 	}
- 	if (i == 0)
- 		return bitch("empty text record");
- 
--   	rr = getmem(sizeof(*rr) + sizeof(struct binary_data) * (i-1));
-+   	rr = getmem(sizeof(*rr));
- 	rr->count = i;
--	for (i = 0; i < rr->count; i++) {
--		rr->txt[i] = txt[i];
--	}
-+	rr->txt = first;
- 
- 	return store_record(type, name, ttl, rr);
- }
-@@ -53,14 +61,15 @@
- {
- 	RRCAST(txt);
-     char ss[1024];
--	int i;
- 	char *s = ss;
- 	int l;
-+	struct rr_txt_segment *seg = rr->txt;
- 
--	for (i = 0; i < rr->count; i++) {
-+	while (seg) {
- 		/* XXX would be nice to escape " with \ in strings */
--		l = snprintf(s, 1024-(s-ss), "\"%s\" ", rr->txt[i].data);
-+		l = snprintf(s, 1024-(s-ss), "\"%s\" ", seg->txt.data);
- 		s += l;
-+		seg = seg->next;
- 	}
-     return quickstrdup_temp(ss);
- }
-@@ -69,14 +78,15 @@
- {
- 	RRCAST(txt);
- 	struct binary_data r, t;
--	int i;
-+	struct rr_txt_segment *seg = rr->txt;
- 
- 	r = bad_binary_data();
- 	t.length = 0;
- 	t.data = NULL;
--	for (i = 0; i < rr->count; i++) {
--		r = compose_binary_data("db", 1, t, rr->txt[i]);
-+	while (seg) {
-+		r = compose_binary_data("db", 1, t, seg->txt);
- 		t = r;
-+		seg = seg->next;
- 	}
-     return r;
- }
-diff -Naur validns-0.8/usage.mdwn validns-0.8_git20160720/usage.mdwn
---- validns-0.8/usage.mdwn	2014-02-11 15:42:32.000000000 -0500
-+++ validns-0.8_git20160720/usage.mdwn	2016-02-04 09:14:15.000000000 -0500
-@@ -48,6 +48,7 @@
- 	- ns-alias
- 	- rp-txt-exists
- 	- tlsa-host
-+	- ksk-exists
- 	- all
- 
- -n *N*
-@@ -64,6 +65,9 @@
- -v
- :   be extra verbose
- 
-+-M
-+:   use SOA MINTTL as the default TTL when no TTL specified
-+
- -I *path*
- :   use this path for $INCLUDE files
- 
-@@ -130,12 +134,11 @@
- - TXT domain name mentioned in RP record must have
-   a corresponding TXT record if it is within the zone
- - domain name of a TLSA record must be a proper prefixed DNS name
-+- a KSK key must exist in a signed zone
- 
- # BUGS
- 
- - textual segments in *TXT* and *HINFO* must be enclosed in double quotes;
--- there cannot be more than 20 textual segments in a *TXT* record;
--- *$INCLUDE* directive is not implemented;
- - a dot within a label is not currently supported;
- 
- If at least one NSEC3 record uses opt-out flag,
-diff -Naur validns-0.8/validns.1 validns-0.8_git20160720/validns.1
---- validns-0.8/validns.1	2014-02-11 15:43:21.000000000 -0500
-+++ validns-0.8_git20160720/validns.1	2016-02-04 09:14:15.000000000 -0500
-@@ -1,4 +1,4 @@
--.TH VALIDNS 1 "April 2011" 
-+.TH "VALIDNS" "1" "April 2011" "" ""
- .SH NAME
- .PP
- validns \- DNS and DSNSEC zone file validator
-@@ -53,6 +53,8 @@
- .IP \[bu] 2
- tlsa\-host
- .IP \[bu] 2
-+ksk\-exists
-+.IP \[bu] 2
- all
- .RE
- .TP
-@@ -78,6 +80,11 @@
- .RS
- .RE
- .TP
-+.B \-M
-+use SOA MINTTL as the default TTL when no TTL specified
-+.RS
-+.RE
-+.TP
- .B \-I \f[I]path\f[]
- use this path for $INCLUDE files
- .RS
-@@ -178,15 +185,13 @@
- record if it is within the zone
- .IP \[bu] 2
- domain name of a TLSA record must be a proper prefixed DNS name
-+.IP \[bu] 2
-+a KSK key must exist in a signed zone
- .SH BUGS
- .IP \[bu] 2
- textual segments in \f[I]TXT\f[] and \f[I]HINFO\f[] must be enclosed in
- double quotes;
- .IP \[bu] 2
--there cannot be more than 20 textual segments in a \f[I]TXT\f[] record;
--.IP \[bu] 2
--\f[I]$INCLUDE\f[] directive is not implemented;
--.IP \[bu] 2
- a dot within a label is not currently supported;
- .PP
- If at least one NSEC3 record uses opt\-out flag, \f[C]validns\f[]
diff --git a/validns-0.8-githead.patch b/validns-0.8-githead.patch
deleted file mode 100644
index 0947b9d..0000000
--- a/validns-0.8-githead.patch
+++ /dev/null
@@ -1,21091 +0,0 @@
-diff -Naur validns-0.8/aaaa.c validns/aaaa.c
---- validns-0.8/aaaa.c	2014-02-11 15:47:05.000000000 -0500
-+++ validns/aaaa.c	2020-10-05 16:59:29.353681351 -0400
-@@ -20,44 +20,44 @@
- 
- static struct rr *aaaa_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_aaaa *rr = getmem(sizeof(*rr));
-+    struct rr_aaaa *rr = getmem(sizeof(*rr));
- 
--	if (extract_ipv6(&s, "IPv6 address", &rr->address) <= 0)
--		return NULL;
--	if (*s) {
--		return bitch("garbage after valid AAAA data");
--	}
-+    if (extract_ipv6(&s, "IPv6 address", &rr->address) <= 0)
-+        return NULL;
-+    if (*s) {
-+        return bitch("garbage after valid AAAA data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* aaaa_human(struct rr *rrv)
- {
--	RRCAST(aaaa);
-+    RRCAST(aaaa);
-     char s[1024];
- 
--	if (inet_ntop(AF_INET6, &rr->address, s, 1024))
--		return quickstrdup_temp(s);
--	return "????";
-+    if (inet_ntop(AF_INET6, &rr->address, s, 1024))
-+        return quickstrdup_temp(s);
-+    return "????";
- }
- 
- static struct binary_data aaaa_wirerdata(struct rr *rrv)
- {
--	RRCAST(aaaa);
--	struct binary_data r;
-+    RRCAST(aaaa);
-+    struct binary_data r;
- 
--	r.length = sizeof(rr->address);
--	r.data = (void *)&rr->address;
--	return r;
-+    r.length = sizeof(rr->address);
-+    r.data = (void *)&rr->address;
-+    return r;
- }
- 
- static void* aaaa_validate_set(struct rr_set *rr_set)
- {
--	if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) {
--		struct rr *rr = rr_set->tail;
--		return moan(rr->file_name, rr->line, "host name contains '/'");
--	}
--	return NULL;
-+    if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) {
-+        struct rr *rr = rr_set->tail;
-+        return moan(rr->file_name, rr->line, "host name contains '/'");
-+    }
-+    return NULL;
- }
- 
- struct rr_methods aaaa_methods = { aaaa_parse, aaaa_human, aaaa_wirerdata, aaaa_validate_set, NULL };
-diff -Naur validns-0.8/a.c validns/a.c
---- validns-0.8/a.c	2014-02-11 15:47:08.000000000 -0500
-+++ validns/a.c	2020-10-05 16:59:29.353681351 -0400
-@@ -20,44 +20,44 @@
- 
- static struct rr *a_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_a *rr = getmem(sizeof(*rr));
-+    struct rr_a *rr = getmem(sizeof(*rr));
- 
--	if (extract_ipv4(&s, "IPv4 address", &rr->address) <= 0)
--		return NULL;
--	if (*s) {
--		return bitch("garbage after valid A data");
--	}
-+    if (extract_ipv4(&s, "IPv4 address", &rr->address) <= 0)
-+        return NULL;
-+    if (*s) {
-+        return bitch("garbage after valid A data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* a_human(struct rr *rrv)
- {
--	RRCAST(a);
--	char s[1024];
-+    RRCAST(a);
-+    char s[1024];
- 
--	if (inet_ntop(AF_INET, &rr->address, s, 1024))
--		return quickstrdup_temp(s);
--	return "????";
-+    if (inet_ntop(AF_INET, &rr->address, s, 1024))
-+        return quickstrdup_temp(s);
-+    return "????";
- }
- 
- static struct binary_data a_wirerdata(struct rr *rrv)
- {
--	RRCAST(a);
--	struct binary_data r;
-+    RRCAST(a);
-+    struct binary_data r;
- 
--	r.length = sizeof(rr->address);
--	r.data = (void *)&rr->address;
--	return r;
-+    r.length = sizeof(rr->address);
-+    r.data = (void *)&rr->address;
-+    return r;
- }
- 
- static void* a_validate_set(struct rr_set *rr_set)
- {
--	if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) {
--		struct rr *rr = rr_set->tail;
--		return moan(rr->file_name, rr->line, "host name contains '/'");
--	}
--	return NULL;
-+    if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) {
-+        struct rr *rr = rr_set->tail;
-+        return moan(rr->file_name, rr->line, "host name contains '/'");
-+    }
-+    return NULL;
- }
- 
- struct rr_methods a_methods = { a_parse, a_human, a_wirerdata, a_validate_set, NULL };
-diff -Naur validns-0.8/afsdb.c validns/afsdb.c
---- validns-0.8/afsdb.c	2014-02-11 15:46:27.000000000 -0500
-+++ validns/afsdb.c	2020-10-05 16:59:29.353681351 -0400
-@@ -19,42 +19,42 @@
- 
- static struct rr *afsdb_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_afsdb *rr = getmem(sizeof(*rr));
-+    struct rr_afsdb *rr = getmem(sizeof(*rr));
- 
--	rr->subtype = extract_integer(&s, "AFSDB subtype");
--	if (rr->subtype < 0)
--		return NULL;
-+    rr->subtype = extract_integer(&s, "AFSDB subtype", NULL);
-+    if (rr->subtype < 0)
-+        return NULL;
- 
--	if (rr->subtype != 1 && rr->subtype != 2)
--		return bitch("unknown AFSDB subtype");
-+    if (rr->subtype != 1 && rr->subtype != 2)
-+        return bitch("unknown AFSDB subtype");
- 
--	rr->hostname = extract_name(&s, "AFSDB hostname", 0);
--	if (!rr->hostname)
--		return NULL;
-+    rr->hostname = extract_name(&s, "AFSDB hostname", 0);
-+    if (!rr->hostname)
-+        return NULL;
- 
--	if (*s) {
--		return bitch("garbage after valid AFSDB data");
--	}
-+    if (*s) {
-+        return bitch("garbage after valid AFSDB data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* afsdb_human(struct rr *rrv)
- {
--	RRCAST(afsdb);
-+    RRCAST(afsdb);
-     char s[1024];
- 
-     snprintf(s, 1024, "%d %s",
--	     rr->subtype, rr->hostname);
-+         rr->subtype, rr->hostname);
-     return quickstrdup_temp(s);
- }
- 
- static struct binary_data afsdb_wirerdata(struct rr *rrv)
- {
--	RRCAST(afsdb);
-+    RRCAST(afsdb);
- 
-     return compose_binary_data("2d", 1,
--		rr->subtype, name2wire_name(rr->hostname));
-+        rr->subtype, name2wire_name(rr->hostname));
- }
- 
- struct rr_methods afsdb_methods = { afsdb_parse, afsdb_human, afsdb_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/base32hex.c validns/base32hex.c
---- validns-0.8/base32hex.c	2014-02-11 15:44:11.000000000 -0500
-+++ validns/base32hex.c	2020-10-05 16:59:29.353681351 -0400
-@@ -36,319 +36,319 @@
- int
- decode_base32hex(void *dest, char *src, size_t dstsize)
- {
--	size_t processed = 0;
--	int full_bytes = 0;
--	unsigned char *dst = dest;
--
--	while (*src) {
--		int v;
--		if (*src >= 'A' && *src <= 'V')
--			v = *src - 'A' + 10;
--		else if (*src >= 'a' && *src <= 'v')
--			v = *src - 'a' + 10;
--		else if (*src >= '0' && *src <= '9')
--			v = *src - '0';
--		else if (isspace(*src) || *src == '=') {
--			src++;
--			continue;
--		} else {
--			/* any junk chars means input is corrupted */
--			errno = EINVAL;
--			return -1;
--		}
--		src++;
--		if (processed % 8 == 0) {
--			if (dstsize <= 0) {
--				errno = EINVAL;
--				return -1;
--			}
--			dst[0] &= 0x07;
--			dst[0] |= (v << 3) & 0xF8;
--			processed++;
--		} else if (processed % 8 == 1) {
--			if (dstsize < 1) {
--				errno = EINVAL;
--				return -1;
--			}
--			dst[0] &= 0xF8;
--			dst[0] |= (v >> 2) & 0x07;
--			if (dstsize >= 2) {
--				dst[1] &= 0x3F;
--				dst[1] |= (v << 6) & 0xC0;
--			}
--			processed++;
--			full_bytes++;
--		} else if (processed % 8 == 2) {
--			if (dstsize < 2) {
--				errno = EINVAL;
--				return -1;
--			}
--			dst[1] &= 0xC1;
--			dst[1] |= (v << 1) & 0x3E;
--			processed++;
--		} else if (processed % 8 == 3) {
--			if (dstsize < 2) {
--				errno = EINVAL;
--				return -1;
--			}
--			dst[1] &= 0xFE;
--			dst[1] |= (v >> 4) & 0x01;
--			if (dstsize >= 3) {
--				dst[2] &= 0x0F;
--				dst[2] |= (v << 4) & 0xF0;
--			}
--			processed++;
--			full_bytes++;
--		} else if (processed % 8 == 4) {
--			if (dstsize < 3) {
--				errno = EINVAL;
--				return -1;
--			}
--			dst[2] &= 0xF0;
--			dst[2] |= (v >> 1) & 0x0F;
--			if (dstsize >= 4) {
--				dst[3] &= 0x7F;
--				dst[3] |= (v << 7) & 0x80;
--			}
--			processed++;
--			full_bytes++;
--		} else if (processed % 8 == 5) {
--			if (dstsize < 4) {
--				errno = EINVAL;
--				return -1;
--			}
--			dst[3] &= 0x83;
--			dst[3] |= (v << 2) & 0x7C;
--			processed++;
--		} else if (processed % 8 == 6) {
--			if (dstsize < 4) {
--				errno = EINVAL;
--				return -1;
--			}
--			dst[3] &= 0xFC;
--			dst[3] |= (v >> 3) & 0x03;
--			if (dstsize >= 5) {
--				dst[4] &= 0x1F;
--				dst[4] |= (v << 5) & 0xE0;
--			}
--			processed++;
--			full_bytes++;
--		} else {
--			if (dstsize < 5) {
--				errno = EINVAL;
--				return -1;
--			}
--			dst[4] &= 0xE0;
--			dst[4] |= v & 0x1F;
--			processed++;
--			dst += 5;
--			dstsize -= 5;
--			full_bytes++;
--		}
--	}
--	return full_bytes;
-+    size_t processed = 0;
-+    int full_bytes = 0;
-+    unsigned char *dst = dest;
-+
-+    while (*src) {
-+        int v;
-+        if (*src >= 'A' && *src <= 'V')
-+            v = *src - 'A' + 10;
-+        else if (*src >= 'a' && *src <= 'v')
-+            v = *src - 'a' + 10;
-+        else if (*src >= '0' && *src <= '9')
-+            v = *src - '0';
-+        else if (isspace(*src) || *src == '=') {
-+            src++;
-+            continue;
-+        } else {
-+            /* any junk chars means input is corrupted */
-+            errno = EINVAL;
-+            return -1;
-+        }
-+        src++;
-+        if (processed % 8 == 0) {
-+            if (dstsize <= 0) {
-+                errno = EINVAL;
-+                return -1;
-+            }
-+            dst[0] &= 0x07;
-+            dst[0] |= (v << 3) & 0xF8;
-+            processed++;
-+        } else if (processed % 8 == 1) {
-+            if (dstsize < 1) {
-+                errno = EINVAL;
-+                return -1;
-+            }
-+            dst[0] &= 0xF8;
-+            dst[0] |= (v >> 2) & 0x07;
-+            if (dstsize >= 2) {
-+                dst[1] &= 0x3F;
-+                dst[1] |= (v << 6) & 0xC0;
-+            }
-+            processed++;
-+            full_bytes++;
-+        } else if (processed % 8 == 2) {
-+            if (dstsize < 2) {
-+                errno = EINVAL;
-+                return -1;
-+            }
-+            dst[1] &= 0xC1;
-+            dst[1] |= (v << 1) & 0x3E;
-+            processed++;
-+        } else if (processed % 8 == 3) {
-+            if (dstsize < 2) {
-+                errno = EINVAL;
-+                return -1;
-+            }
-+            dst[1] &= 0xFE;
-+            dst[1] |= (v >> 4) & 0x01;
-+            if (dstsize >= 3) {
-+                dst[2] &= 0x0F;
-+                dst[2] |= (v << 4) & 0xF0;
-+            }
-+            processed++;
-+            full_bytes++;
-+        } else if (processed % 8 == 4) {
-+            if (dstsize < 3) {
-+                errno = EINVAL;
-+                return -1;
-+            }
-+            dst[2] &= 0xF0;
-+            dst[2] |= (v >> 1) & 0x0F;
-+            if (dstsize >= 4) {
-+                dst[3] &= 0x7F;
-+                dst[3] |= (v << 7) & 0x80;
-+            }
-+            processed++;
-+            full_bytes++;
-+        } else if (processed % 8 == 5) {
-+            if (dstsize < 4) {
-+                errno = EINVAL;
-+                return -1;
-+            }
-+            dst[3] &= 0x83;
-+            dst[3] |= (v << 2) & 0x7C;
-+            processed++;
-+        } else if (processed % 8 == 6) {
-+            if (dstsize < 4) {
-+                errno = EINVAL;
-+                return -1;
-+            }
-+            dst[3] &= 0xFC;
-+            dst[3] |= (v >> 3) & 0x03;
-+            if (dstsize >= 5) {
-+                dst[4] &= 0x1F;
-+                dst[4] |= (v << 5) & 0xE0;
-+            }
-+            processed++;
-+            full_bytes++;
-+        } else {
-+            if (dstsize < 5) {
-+                errno = EINVAL;
-+                return -1;
-+            }
-+            dst[4] &= 0xE0;
-+            dst[4] |= v & 0x1F;
-+            processed++;
-+            dst += 5;
-+            dstsize -= 5;
-+            full_bytes++;
-+        }
-+    }
-+    return full_bytes;
- }
- 
- int
- encode_base32hex(void *dest, size_t dstsize, void *source, size_t srclength)
- {
--	size_t need_dstsize;
--	int byte = 0;
--	unsigned char *dst = dest;
--	unsigned char *src = source;
--	int i;
--
--	need_dstsize = 8*(srclength / 5);
--	switch (srclength % 5) {
--	case 1: need_dstsize += 2; break;
--	case 2: need_dstsize += 4; break;
--	case 3: need_dstsize += 5; break;
--	case 4: need_dstsize += 7; break;
--	}
--	if (dstsize < need_dstsize) {
--		errno = EINVAL;
--		return -1;
--	}
--	while (srclength) {
--		switch (byte) {
--		case 0:
--			dst[0] = *src >> 3;
--			dst[1] = (*src & 0x07) << 2;
--			break;
--		case 1:
--			dst[1] |= (*src >> 6) & 0x03;
--			dst[2] = (*src >> 1) & 0x1f;
--			dst[3] = (*src & 0x01) << 4;
--			break;
--		case 2:
--			dst[3] |= (*src >> 4) & 0x0f;
--			dst[4] = (*src & 0x0f) << 1;
--			break;
--		case 3:
--			dst[4] |= (*src >> 7) & 0x01;
--			dst[5] = (*src >> 2) & 0x1f;
--			dst[6] = (*src & 0x03) << 3;
--			break;
--		case 4:
--			dst[6] |= (*src >> 5) & 0x07;
--			dst[7] = *src & 0x1f;
--			break;
--		}
--
--		srclength--;
--		src++;
--		byte++;
--		if (byte == 5) {
--			dst += 8;
--			byte = 0;
--		}
--	}
--	dst = dest;
--	for (i = 0; i < need_dstsize; i++) {
--		if (*dst < 10)
--			*dst = *dst +'0';
--		else if (*dst < 32)
--			*dst = *dst - 10 + 'a';
--		else
--			*dst = '?';
--		dst++;
--	}
--	return need_dstsize;
-+    size_t need_dstsize;
-+    int byte = 0;
-+    unsigned char *dst = dest;
-+    unsigned char *src = source;
-+    int i;
-+
-+    need_dstsize = 8*(srclength / 5);
-+    switch (srclength % 5) {
-+    case 1: need_dstsize += 2; break;
-+    case 2: need_dstsize += 4; break;
-+    case 3: need_dstsize += 5; break;
-+    case 4: need_dstsize += 7; break;
-+    }
-+    if (dstsize < need_dstsize) {
-+        errno = EINVAL;
-+        return -1;
-+    }
-+    while (srclength) {
-+        switch (byte) {
-+        case 0:
-+            dst[0] = *src >> 3;
-+            dst[1] = (*src & 0x07) << 2;
-+            break;
-+        case 1:
-+            dst[1] |= (*src >> 6) & 0x03;
-+            dst[2] = (*src >> 1) & 0x1f;
-+            dst[3] = (*src & 0x01) << 4;
-+            break;
-+        case 2:
-+            dst[3] |= (*src >> 4) & 0x0f;
-+            dst[4] = (*src & 0x0f) << 1;
-+            break;
-+        case 3:
-+            dst[4] |= (*src >> 7) & 0x01;
-+            dst[5] = (*src >> 2) & 0x1f;
-+            dst[6] = (*src & 0x03) << 3;
-+            break;
-+        case 4:
-+            dst[6] |= (*src >> 5) & 0x07;
-+            dst[7] = *src & 0x1f;
-+            break;
-+        }
-+
-+        srclength--;
-+        src++;
-+        byte++;
-+        if (byte == 5) {
-+            dst += 8;
-+            byte = 0;
-+        }
-+    }
-+    dst = dest;
-+    for (i = 0; i < need_dstsize; i++) {
-+        if (*dst < 10)
-+            *dst = *dst +'0';
-+        else if (*dst < 32)
-+            *dst = *dst - 10 + 'a';
-+        else
-+            *dst = '?';
-+        dst++;
-+    }
-+    return need_dstsize;
- }
- 
- #ifdef TEST_PROGRAM
- 
- static int ok_string_test(int testnum, char *src, char *expect)
- {
--	unsigned char dstbuf[512];
--	unsigned char reverse_buf[1024];
--	int r, r0, i;
--	int expect_sz = strlen(expect);
--	int expect_reverse;
--	char *s, *d;
--
--	if (expect_sz >= 512) {
--		printf("test %d: NOT OK: internal *test* error, buffer too small for proper testing, FIXME\n", testnum);
--		return 1;
--	}
--	memset(dstbuf, 0xAA, 512);
--	r = decode_base32hex(dstbuf, src, expect_sz);
--	if (r != expect_sz) {
--		printf("test %d: NOT OK: expect size %d, got %d\n", testnum, expect_sz, r);
--		return 1;
--	} else if (memcmp(dstbuf, expect, r) != 0) {
--		printf("test %d: NOT OK: unexpected buffer content\n", testnum);
--		return 1;
--	}
--	if (dstbuf[expect_sz] != 0xAA) {
--		printf("test %d: NOT OK: corrupts memory with \"just enough\" bufsize\n", testnum);
--		return 1;
--	}
--	r = encode_base32hex(reverse_buf, 1024, dstbuf, expect_sz);
--	s = src;  d = (char*)dstbuf;
--	expect_reverse = 0;
--	while (*s) {
--		if (*s != ' ' && *s != '=') {
--			*d++ = tolower(*s);
--			expect_reverse++;
--		}
--		s++;
--	}
--	if (r != expect_reverse) {
--		printf("test %d: NOT OK: REVERSE: expect size %d, got %d\n", testnum, expect_reverse, r);
--		return 1;
--	} else if (memcmp(reverse_buf, dstbuf, r) != 0) {
--		printf("test %d: NOT OK: REVERSE: unexpected buffer content\n", testnum);
--		return 1;
--	}
--	memset(dstbuf, 0xAA, 512);
--	for (i = 0; i < expect_sz; i++) {
--		r0 = decode_base32hex(dstbuf, src, i);
--		if (r0 > 0) {
--			printf("test %d: NOT OK: buffer size %d should not be enough\n", testnum, i);
--			return 1;
--		}
--		if (dstbuf[i] != 0xAA) {
--			printf("test %d: NOT OK: corrupts memory with bufsize %d\n", testnum, i);
--			return 1;
--		}
--	}
--	printf("test %d: ok\n", testnum);
--	return 0;
-+    unsigned char dstbuf[512];
-+    unsigned char reverse_buf[1024];
-+    int r, r0, i;
-+    int expect_sz = strlen(expect);
-+    int expect_reverse;
-+    char *s, *d;
-+
-+    if (expect_sz >= 512) {
-+        printf("test %d: NOT OK: internal *test* error, buffer too small for proper testing, FIXME\n", testnum);
-+        return 1;
-+    }
-+    memset(dstbuf, 0xAA, 512);
-+    r = decode_base32hex(dstbuf, src, expect_sz);
-+    if (r != expect_sz) {
-+        printf("test %d: NOT OK: expect size %d, got %d\n", testnum, expect_sz, r);
-+        return 1;
-+    } else if (memcmp(dstbuf, expect, r) != 0) {
-+        printf("test %d: NOT OK: unexpected buffer content\n", testnum);
-+        return 1;
-+    }
-+    if (dstbuf[expect_sz] != 0xAA) {
-+        printf("test %d: NOT OK: corrupts memory with \"just enough\" bufsize\n", testnum);
-+        return 1;
-+    }
-+    r = encode_base32hex(reverse_buf, 1024, dstbuf, expect_sz);
-+    s = src;  d = (char*)dstbuf;
-+    expect_reverse = 0;
-+    while (*s) {
-+        if (*s != ' ' && *s != '=') {
-+            *d++ = tolower(*s);
-+            expect_reverse++;
-+        }
-+        s++;
-+    }
-+    if (r != expect_reverse) {
-+        printf("test %d: NOT OK: REVERSE: expect size %d, got %d\n", testnum, expect_reverse, r);
-+        return 1;
-+    } else if (memcmp(reverse_buf, dstbuf, r) != 0) {
-+        printf("test %d: NOT OK: REVERSE: unexpected buffer content\n", testnum);
-+        return 1;
-+    }
-+    memset(dstbuf, 0xAA, 512);
-+    for (i = 0; i < expect_sz; i++) {
-+        r0 = decode_base32hex(dstbuf, src, i);
-+        if (r0 > 0) {
-+            printf("test %d: NOT OK: buffer size %d should not be enough\n", testnum, i);
-+            return 1;
-+        }
-+        if (dstbuf[i] != 0xAA) {
-+            printf("test %d: NOT OK: corrupts memory with bufsize %d\n", testnum, i);
-+            return 1;
-+        }
-+    }
-+    printf("test %d: ok\n", testnum);
-+    return 0;
- }
- 
- static int expect_junk_error(int testnum, char *src)
- {
--	char *buf[20];
--	int r;
-+    char *buf[20];
-+    int r;
- 
--	r = decode_base32hex(buf, src, 20);
--	if (r != -1) {
--		printf("test %d: NOT OK: junk input not recognized\n", testnum);
--		return 1;
--	}
--	printf("test %d: ok\n", testnum);
--	return 0;
-+    r = decode_base32hex(buf, src, 20);
-+    if (r != -1) {
-+        printf("test %d: NOT OK: junk input not recognized\n", testnum);
-+        return 1;
-+    }
-+    printf("test %d: ok\n", testnum);
-+    return 0;
- }
- 
- int main(void)
- {
--	int ret = 0;
--	int t = 1;
-+    int ret = 0;
-+    int t = 1;
- 
--	/* from http://tools.ietf.org/html/rfc4648#section-10 */
--	ret |= ok_string_test(t++, "", "");
--	ret |= ok_string_test(t++, "CO======", "f");
--	ret |= ok_string_test(t++, "Co=====", "f");
--	ret |= ok_string_test(t++, "cO====", "f");
--	ret |= ok_string_test(t++, "co===", "f");
--	ret |= ok_string_test(t++, "CO==", "f");
--	ret |= ok_string_test(t++, "CO=", "f");
--	ret |= ok_string_test(t++, "CO", "f");
--
--	ret |= ok_string_test(t++, "CPNG====", "fo");
--	ret |= ok_string_test(t++, "cPNG===", "fo");
--	ret |= ok_string_test(t++, "cpNG==", "fo");
--	ret |= ok_string_test(t++, "cpnG=", "fo");
--	ret |= ok_string_test(t++, "cpng", "fo");
--
--	ret |= ok_string_test(t++, "CPNMU===", "foo");
--	ret |= ok_string_test(t++, "CPnMU==", "foo");
--	ret |= ok_string_test(t++, "CPnmu=", "foo");
--	ret |= ok_string_test(t++, "cpNMU", "foo");
--
--	ret |= ok_string_test(t++, "CPNMUOG=", "foob");
--	ret |= ok_string_test(t++, "CPNMUoG", "foob");
--
--	ret |= ok_string_test(t++, "CPNMUOJ1", "fooba");
--	ret |= ok_string_test(t++, "cPnMuOj1", "fooba");
--	ret |= ok_string_test(t++, "CpNmUoJ1", "fooba");
--	ret |= ok_string_test(t++, "CpNm   UoJ1", "fooba");
--
--	ret |= ok_string_test(t++, "CPNMUOJ1E8======", "foobar");
--	ret |= ok_string_test(t++, "CPNMuOJ1E8=====", "foobar");
--	ret |= ok_string_test(t++, "CpNMuOJ1E8====", "foobar");
--	ret |= ok_string_test(t++, "CpNMuOJ1e8===", "foobar");
--	ret |= ok_string_test(t++, "CpNmuOJ 1e8==", "foobar");
--	ret |= ok_string_test(t++, "CpnmuOJ 1e8=", "foobar");
--	ret |= ok_string_test(t++, "Cpn muOj 1e8", "foobar");
--
--	ret |= expect_junk_error(t++, "?m9vmF");
--	ret |= expect_junk_error(t++, "%m9vmF");
--	ret |= expect_junk_error(t++, "m&9vmF");
--	ret |= expect_junk_error(t++, "m9-vmF");
--	ret |= expect_junk_error(t++, "m9v*mF");
--	ret |= expect_junk_error(t++, "m9v#mF");
--	ret |= expect_junk_error(t++, "m9vm\x01F");
--	ret |= expect_junk_error(t++, "m9vmF!");
--	ret |= expect_junk_error(t++, "m9vmF.");
--	ret |= expect_junk_error(t++, "CpnmuOj/1e8x");
--	ret |= expect_junk_error(t++, "CpnYmuOj1e8");
--	ret |= expect_junk_error(t++, "CZpnmuOj1e8");
--	ret |= expect_junk_error(t++, "CzpnmuOj1e8");
-+    /* from http://tools.ietf.org/html/rfc4648#section-10 */
-+    ret |= ok_string_test(t++, "", "");
-+    ret |= ok_string_test(t++, "CO======", "f");
-+    ret |= ok_string_test(t++, "Co=====", "f");
-+    ret |= ok_string_test(t++, "cO====", "f");
-+    ret |= ok_string_test(t++, "co===", "f");
-+    ret |= ok_string_test(t++, "CO==", "f");
-+    ret |= ok_string_test(t++, "CO=", "f");
-+    ret |= ok_string_test(t++, "CO", "f");
-+
-+    ret |= ok_string_test(t++, "CPNG====", "fo");
-+    ret |= ok_string_test(t++, "cPNG===", "fo");
-+    ret |= ok_string_test(t++, "cpNG==", "fo");
-+    ret |= ok_string_test(t++, "cpnG=", "fo");
-+    ret |= ok_string_test(t++, "cpng", "fo");
-+
-+    ret |= ok_string_test(t++, "CPNMU===", "foo");
-+    ret |= ok_string_test(t++, "CPnMU==", "foo");
-+    ret |= ok_string_test(t++, "CPnmu=", "foo");
-+    ret |= ok_string_test(t++, "cpNMU", "foo");
-+
-+    ret |= ok_string_test(t++, "CPNMUOG=", "foob");
-+    ret |= ok_string_test(t++, "CPNMUoG", "foob");
-+
-+    ret |= ok_string_test(t++, "CPNMUOJ1", "fooba");
-+    ret |= ok_string_test(t++, "cPnMuOj1", "fooba");
-+    ret |= ok_string_test(t++, "CpNmUoJ1", "fooba");
-+    ret |= ok_string_test(t++, "CpNm   UoJ1", "fooba");
-+
-+    ret |= ok_string_test(t++, "CPNMUOJ1E8======", "foobar");
-+    ret |= ok_string_test(t++, "CPNMuOJ1E8=====", "foobar");
-+    ret |= ok_string_test(t++, "CpNMuOJ1E8====", "foobar");
-+    ret |= ok_string_test(t++, "CpNMuOJ1e8===", "foobar");
-+    ret |= ok_string_test(t++, "CpNmuOJ 1e8==", "foobar");
-+    ret |= ok_string_test(t++, "CpnmuOJ 1e8=", "foobar");
-+    ret |= ok_string_test(t++, "Cpn muOj 1e8", "foobar");
-+
-+    ret |= expect_junk_error(t++, "?m9vmF");
-+    ret |= expect_junk_error(t++, "%m9vmF");
-+    ret |= expect_junk_error(t++, "m&9vmF");
-+    ret |= expect_junk_error(t++, "m9-vmF");
-+    ret |= expect_junk_error(t++, "m9v*mF");
-+    ret |= expect_junk_error(t++, "m9v#mF");
-+    ret |= expect_junk_error(t++, "m9vm\x01F");
-+    ret |= expect_junk_error(t++, "m9vmF!");
-+    ret |= expect_junk_error(t++, "m9vmF.");
-+    ret |= expect_junk_error(t++, "CpnmuOj/1e8x");
-+    ret |= expect_junk_error(t++, "CpnYmuOj1e8");
-+    ret |= expect_junk_error(t++, "CZpnmuOj1e8");
-+    ret |= expect_junk_error(t++, "CzpnmuOj1e8");
- 
--	ret |= ok_string_test(t++, "MEQIMI6FJE5NI47PJAHV5QIGU1LV3JLJ", "\xb3\xb5\x2b\x48\xcf\x9b\x8b\x79\x10\xf9\x9a\xa3\xf2\xea\x50\xf0\x6b\xf1\xce\xb3");
-+    ret |= ok_string_test(t++, "MEQIMI6FJE5NI47PJAHV5QIGU1LV3JLJ", "\xb3\xb5\x2b\x48\xcf\x9b\x8b\x79\x10\xf9\x9a\xa3\xf2\xea\x50\xf0\x6b\xf1\xce\xb3");
- 
--	return ret;
-+    return ret;
- }
- #endif
-diff -Naur validns-0.8/base64.c validns/base64.c
---- validns-0.8/base64.c	2014-02-11 15:45:08.000000000 -0500
-+++ validns/base64.c	2020-10-05 16:59:29.353681351 -0400
-@@ -23,180 +23,180 @@
- int
- decode_base64(void *dest, char *src, size_t dstsize)
- {
--	size_t processed = 0;
--	int full_bytes = 0;
--	unsigned char *dst = dest;
--
--	while (*src) {
--		int v;
--		if (*src >= 'A' && *src <= 'Z')
--			v = *src - 'A';
--		else if (*src >= 'a' && *src <= 'z')
--			v = 26 + *src - 'a';
--		else if (*src >= '0' && *src <= '9')
--			v = 52 + *src - '0';
--		else if (*src == '+')
--			v = 62;
--		else if (*src == '/')
--			v = 63;
--		else if (isspace(*src) || *src == '=') {
--			src++;
--			continue;
--		} else {
--			/* any junk chars means input is corrupted */
--			errno = EINVAL;
--			return -1;
--		}
--		src++;
--		if (processed % 4 == 0) {
--			if (dstsize <= 0) {
--				errno = EINVAL;
--				return -1;
--			}
--			dst[0] &= 0x03;
--			dst[0] |= (v << 2) & 0xFC;
--			processed++;
--		} else if (processed % 4 == 1) {
--			if (dstsize < 1) {
--				errno = EINVAL;
--				return -1;
--			}
--			dst[0] &= 0xFC;
--			dst[0] |= (v >> 4) & 0x03;
--			if (dstsize >= 2) {
--				dst[1] &= 0x0F;
--				dst[1] |= (v << 4) & 0xF0;
--			}
--			processed++;
--			full_bytes++;
--		} else if (processed % 4 == 2) {
--			if (dstsize < 2) {
--				errno = EINVAL;
--				return -1;
--			}
--			dst[1] &= 0xF0;
--			dst[1] |= (v >> 2) & 0x0F;
--			if (dstsize >= 3) {
--				dst[2] &= 0x3F;
--				dst[2] |= (v << 6) & 0xC0;
--			}
--			processed++;
--			full_bytes++;
--		} else {
--			if (dstsize <= 2) {
--				errno = EINVAL;
--				return -1;
--			}
--			dst[2] &= 0xC0;
--			dst[2] |= v & 0x3F;
--			processed++;
--			dst += 3;
--			dstsize -= 3;
--			full_bytes++;
--		}
--	}
--	return full_bytes;
-+    size_t processed = 0;
-+    int full_bytes = 0;
-+    unsigned char *dst = dest;
-+
-+    while (*src) {
-+        int v;
-+        if (*src >= 'A' && *src <= 'Z')
-+            v = *src - 'A';
-+        else if (*src >= 'a' && *src <= 'z')
-+            v = 26 + *src - 'a';
-+        else if (*src >= '0' && *src <= '9')
-+            v = 52 + *src - '0';
-+        else if (*src == '+')
-+            v = 62;
-+        else if (*src == '/')
-+            v = 63;
-+        else if (isspace(*src) || *src == '=') {
-+            src++;
-+            continue;
-+        } else {
-+            /* any junk chars means input is corrupted */
-+            errno = EINVAL;
-+            return -1;
-+        }
-+        src++;
-+        if (processed % 4 == 0) {
-+            if (dstsize <= 0) {
-+                errno = EINVAL;
-+                return -1;
-+            }
-+            dst[0] &= 0x03;
-+            dst[0] |= (v << 2) & 0xFC;
-+            processed++;
-+        } else if (processed % 4 == 1) {
-+            if (dstsize < 1) {
-+                errno = EINVAL;
-+                return -1;
-+            }
-+            dst[0] &= 0xFC;
-+            dst[0] |= (v >> 4) & 0x03;
-+            if (dstsize >= 2) {
-+                dst[1] &= 0x0F;
-+                dst[1] |= (v << 4) & 0xF0;
-+            }
-+            processed++;
-+            full_bytes++;
-+        } else if (processed % 4 == 2) {
-+            if (dstsize < 2) {
-+                errno = EINVAL;
-+                return -1;
-+            }
-+            dst[1] &= 0xF0;
-+            dst[1] |= (v >> 2) & 0x0F;
-+            if (dstsize >= 3) {
-+                dst[2] &= 0x3F;
-+                dst[2] |= (v << 6) & 0xC0;
-+            }
-+            processed++;
-+            full_bytes++;
-+        } else {
-+            if (dstsize <= 2) {
-+                errno = EINVAL;
-+                return -1;
-+            }
-+            dst[2] &= 0xC0;
-+            dst[2] |= v & 0x3F;
-+            processed++;
-+            dst += 3;
-+            dstsize -= 3;
-+            full_bytes++;
-+        }
-+    }
-+    return full_bytes;
- }
- 
- #ifdef TEST_PROGRAM
- 
- static int ok_string_test(int testnum, char *src, char *expect)
- {
--	unsigned char dstbuf[512];
--	int r, r0, i;
--	int expect_sz = strlen(expect);
--
--	if (expect_sz >= 512) {
--		printf("test %d: NOT OK: internal *test* error, buffer too small for proper testing, FIXME\n", testnum);
--		return 1;
--	}
--	memset(dstbuf, 0xAA, 512);
--	r = decode_base64(dstbuf, src, expect_sz);
--	if (r != expect_sz) {
--		printf("test %d: NOT OK: expect size %d, got %d\n", testnum, expect_sz, r);
--		return 1;
--	} else if (memcmp(dstbuf, expect, r) != 0) {
--		printf("test %d: NOT OK: unexpected buffer content\n", testnum);
--		return 1;
--	}
--	if (dstbuf[expect_sz] != 0xAA) {
--		printf("test %d: NOT OK: corrupts memory with \"just enough\" bufsize\n", testnum);
--		return 1;
--	}
--	memset(dstbuf, 0xAA, 512);
--	for (i = 0; i < expect_sz; i++) {
--		r0 = decode_base64(dstbuf, src, i);
--		if (r0 > 0) {
--			printf("test %d: NOT OK: buffer size %d should not be enough\n", testnum, i);
--			return 1;
--		}
--		if (dstbuf[i] != 0xAA) {
--			printf("test %d: NOT OK: corrupts memory with bufsize %d\n", testnum, i);
--			return 1;
--		}
--	}
--	printf("test %d: ok\n", testnum);
--	return 0;
-+    unsigned char dstbuf[512];
-+    int r, r0, i;
-+    int expect_sz = strlen(expect);
-+
-+    if (expect_sz >= 512) {
-+        printf("test %d: NOT OK: internal *test* error, buffer too small for proper testing, FIXME\n", testnum);
-+        return 1;
-+    }
-+    memset(dstbuf, 0xAA, 512);
-+    r = decode_base64(dstbuf, src, expect_sz);
-+    if (r != expect_sz) {
-+        printf("test %d: NOT OK: expect size %d, got %d\n", testnum, expect_sz, r);
-+        return 1;
-+    } else if (memcmp(dstbuf, expect, r) != 0) {
-+        printf("test %d: NOT OK: unexpected buffer content\n", testnum);
-+        return 1;
-+    }
-+    if (dstbuf[expect_sz] != 0xAA) {
-+        printf("test %d: NOT OK: corrupts memory with \"just enough\" bufsize\n", testnum);
-+        return 1;
-+    }
-+    memset(dstbuf, 0xAA, 512);
-+    for (i = 0; i < expect_sz; i++) {
-+        r0 = decode_base64(dstbuf, src, i);
-+        if (r0 > 0) {
-+            printf("test %d: NOT OK: buffer size %d should not be enough\n", testnum, i);
-+            return 1;
-+        }
-+        if (dstbuf[i] != 0xAA) {
-+            printf("test %d: NOT OK: corrupts memory with bufsize %d\n", testnum, i);
-+            return 1;
-+        }
-+    }
-+    printf("test %d: ok\n", testnum);
-+    return 0;
- }
- 
- static int expect_junk_error(int testnum, char *src)
- {
--	char *buf[20];
--	int r;
-+    char *buf[20];
-+    int r;
- 
--	r = decode_base64(buf, src, 20);
--	if (r != -1) {
--		printf("test %d: NOT OK: junk input not recognized\n", testnum);
--		return 1;
--	}
--	printf("test %d: ok\n", testnum);
--	return 0;
-+    r = decode_base64(buf, src, 20);
-+    if (r != -1) {
-+        printf("test %d: NOT OK: junk input not recognized\n", testnum);
-+        return 1;
-+    }
-+    printf("test %d: ok\n", testnum);
-+    return 0;
- }
- 
- int main(void)
- {
--	int ret = 0;
-+    int ret = 0;
- 
--	/* from http://en.wikipedia.org/wiki/Base64 */
--	ret |= ok_string_test(1, "bGVhc3VyZS4=", "leasure.");
--	ret |= ok_string_test(2, "bGVhc3VyZS4", "leasure.");
--	ret |= ok_string_test(3, "ZWFzdXJlLg==", "easure.");
--	ret |= ok_string_test(4, "ZWFzdXJlLg=", "easure.");
--	ret |= ok_string_test(5, "ZWFzdXJlLg", "easure.");
--	ret |= ok_string_test(6, "YXN1cmUu", "asure.");
--	ret |= ok_string_test(7, "c3VyZS4=", "sure.");
--	ret |= ok_string_test(8, "c3VyZS4", "sure.");
--	ret |= ok_string_test(9, "TWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZWFzb24sIGJ1dCBieSB0aGlz\n"
--		"IHNpbmd1bGFyIHBhc3Npb24gZnJvbSBvdGhlciBhbmltYWxzLCB3aGljaCBpcyBhIGx1c3Qgb2Yg\n"
--		"dGhlIG1pbmQsIHRoYXQgYnkgYSBwZXJzZXZlcmFuY2Ugb2YgZGVsaWdodCBpbiB0aGUgY29udGlu\n"
--		"dWVkIGFuZCBpbmRlZmF0aWdhYmxlIGdlbmVyYXRpb24gb2Yga25vd2xlZGdlLCBleGNlZWRzIHRo\n"
--		"ZSBzaG9ydCB2ZWhlbWVuY2Ugb2YgYW55IGNhcm5hbCBwbGVhc3VyZS4=",
--		"Man is distinguished, not only by his reason, but by this singular passion from other animals, which is a lust of the mind, that by a perseverance of delight in the continued and indefatigable generation of knowledge, exceeds the short vehemence of any carnal pleasure.");
--	/* from http://tools.ietf.org/html/rfc4648#section-10 */
--	ret |= ok_string_test(10, "", "");
--	ret |= ok_string_test(11, "Zg==", "f");
--	ret |= ok_string_test(12, "Zg=", "f");
--	ret |= ok_string_test(13, "Zg", "f");
--	ret |= ok_string_test(14, "Zm8=", "fo");
--	ret |= ok_string_test(15, "Zm8", "fo");
--	ret |= ok_string_test(16, "Zm9v", "foo");
--	ret |= ok_string_test(17, "Zm9vYg==", "foob");
--	ret |= ok_string_test(18, "Zm9vYg=", "foob");
--	ret |= ok_string_test(19, "Zm9vYg", "foob");
--	ret |= ok_string_test(20, "Zm9vYmE=", "fooba");
--	ret |= ok_string_test(21, "Zm9vYmE", "fooba");
--	ret |= ok_string_test(22, "Zm9vYmFy", "foobar");
--
--	ret |= expect_junk_error(23, "?Zm9vYmFy");
--	ret |= expect_junk_error(24, "Z%m9vYmFy");
--	ret |= expect_junk_error(25, "Zm&9vYmFy");
--	ret |= expect_junk_error(26, "Zm9-vYmFy");
--	ret |= expect_junk_error(27, "Zm9v*YmFy");
--	ret |= expect_junk_error(28, "Zm9vY#mFy");
--	ret |= expect_junk_error(29, "Zm9vYm\x01Fy");
--	ret |= expect_junk_error(30, "Zm9vYmF!y");
--	ret |= expect_junk_error(31, "Zm9vYmFy.");
-+    /* from http://en.wikipedia.org/wiki/Base64 */
-+    ret |= ok_string_test(1, "bGVhc3VyZS4=", "leasure.");
-+    ret |= ok_string_test(2, "bGVhc3VyZS4", "leasure.");
-+    ret |= ok_string_test(3, "ZWFzdXJlLg==", "easure.");
-+    ret |= ok_string_test(4, "ZWFzdXJlLg=", "easure.");
-+    ret |= ok_string_test(5, "ZWFzdXJlLg", "easure.");
-+    ret |= ok_string_test(6, "YXN1cmUu", "asure.");
-+    ret |= ok_string_test(7, "c3VyZS4=", "sure.");
-+    ret |= ok_string_test(8, "c3VyZS4", "sure.");
-+    ret |= ok_string_test(9, "TWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZWFzb24sIGJ1dCBieSB0aGlz\n"
-+        "IHNpbmd1bGFyIHBhc3Npb24gZnJvbSBvdGhlciBhbmltYWxzLCB3aGljaCBpcyBhIGx1c3Qgb2Yg\n"
-+        "dGhlIG1pbmQsIHRoYXQgYnkgYSBwZXJzZXZlcmFuY2Ugb2YgZGVsaWdodCBpbiB0aGUgY29udGlu\n"
-+        "dWVkIGFuZCBpbmRlZmF0aWdhYmxlIGdlbmVyYXRpb24gb2Yga25vd2xlZGdlLCBleGNlZWRzIHRo\n"
-+        "ZSBzaG9ydCB2ZWhlbWVuY2Ugb2YgYW55IGNhcm5hbCBwbGVhc3VyZS4=",
-+        "Man is distinguished, not only by his reason, but by this singular passion from other animals, which is a lust of the mind, that by a perseverance of delight in the continued and indefatigable generation of knowledge, exceeds the short vehemence of any carnal pleasure.");
-+    /* from http://tools.ietf.org/html/rfc4648#section-10 */
-+    ret |= ok_string_test(10, "", "");
-+    ret |= ok_string_test(11, "Zg==", "f");
-+    ret |= ok_string_test(12, "Zg=", "f");
-+    ret |= ok_string_test(13, "Zg", "f");
-+    ret |= ok_string_test(14, "Zm8=", "fo");
-+    ret |= ok_string_test(15, "Zm8", "fo");
-+    ret |= ok_string_test(16, "Zm9v", "foo");
-+    ret |= ok_string_test(17, "Zm9vYg==", "foob");
-+    ret |= ok_string_test(18, "Zm9vYg=", "foob");
-+    ret |= ok_string_test(19, "Zm9vYg", "foob");
-+    ret |= ok_string_test(20, "Zm9vYmE=", "fooba");
-+    ret |= ok_string_test(21, "Zm9vYmE", "fooba");
-+    ret |= ok_string_test(22, "Zm9vYmFy", "foobar");
-+
-+    ret |= expect_junk_error(23, "?Zm9vYmFy");
-+    ret |= expect_junk_error(24, "Z%m9vYmFy");
-+    ret |= expect_junk_error(25, "Zm&9vYmFy");
-+    ret |= expect_junk_error(26, "Zm9-vYmFy");
-+    ret |= expect_junk_error(27, "Zm9v*YmFy");
-+    ret |= expect_junk_error(28, "Zm9vY#mFy");
-+    ret |= expect_junk_error(29, "Zm9vYm\x01Fy");
-+    ret |= expect_junk_error(30, "Zm9vYmF!y");
-+    ret |= expect_junk_error(31, "Zm9vYmFy.");
- 
--	return ret;
-+    return ret;
- }
- #endif
-diff -Naur validns-0.8/caa.c validns/caa.c
---- validns-0.8/caa.c	1969-12-31 19:00:00.000000000 -0500
-+++ validns/caa.c	2020-10-05 16:59:29.353681351 -0400
-@@ -0,0 +1,90 @@
-+/*
-+ * Part of DNS zone file validator `validns`.
-+ *
-+ * Copyright 2011-2017 Anton Berezin <tobez@tobez.org>
-+ * Modified BSD license.
-+ * (See LICENSE file in the distribution.)
-+ *
-+ */
-+#include <sys/types.h>
-+#include <stdio.h>
-+#include <netinet/in.h>
-+#include <arpa/inet.h>
-+#include <string.h>
-+
-+#include "common.h"
-+#include "textparse.h"
-+#include "mempool.h"
-+#include "carp.h"
-+#include "rr.h"
-+
-+static struct rr* caa_parse(char *name, long ttl, int type, char *s)
-+{
-+    struct rr_caa *rr = getmem(sizeof(*rr));
-+    int flags;
-+    char *str_tag;
-+
-+    flags = extract_integer(&s, "CAA flags", NULL);
-+    if (flags < 0)  return NULL;
-+    if (flags != 0 && flags != 128)
-+        return bitch("CAA unrecognized flags value");
-+    rr->flags = flags;
-+
-+    str_tag = extract_label(&s, "CAA tag", "temporary");
-+    if (!str_tag) return NULL;
-+
-+    if (strcmp(str_tag, "issue") == 0) {
-+        /* ok */
-+    } else if (strcmp(str_tag, "issuewild") == 0) {
-+        /* ok */
-+    } else if (strcmp(str_tag, "iodef") == 0) {
-+        /* ok */
-+    } else if (strcmp(str_tag, "auth") == 0)
-+        return bitch("CAA reserved tag name");
-+    else if (strcmp(str_tag, "path") == 0)
-+        return bitch("CAA reserved tag name");
-+    else if (strcmp(str_tag, "policy") == 0)
-+        return bitch("CAA reserved tag name");
-+    else
-+        return bitch("CAA unrecognized tag name");
-+
-+    rr->tag = compose_binary_data("s", 0, str_tag);
-+    rr->value = extract_text(&s, "CAA tag value");
-+    if (rr->value.length <= 0)
-+        return bitch("CAA missing tag value");
-+
-+    if (*s) {
-+        return bitch("garbage after valid CAA data");
-+    }
-+    return store_record(type, name, ttl, rr);
-+}
-+
-+static char* caa_human(struct rr *rrv)
-+{
-+    RRCAST(caa);
-+    char ss[4096];
-+    char *s = ss;
-+    int l;
-+
-+    /* incomplete */
-+    l = snprintf(s, 4096, "%u", rr->flags);
-+    s += l;
-+    return quickstrdup_temp(ss);
-+}
-+
-+static struct binary_data caa_wirerdata(struct rr *rrv)
-+{
-+    RRCAST(caa);
-+
-+    return compose_binary_data("1dd", 1, rr->flags, rr->tag, rr->value);
-+}
-+
-+/*
-+static void *caa_validate(struct rr *rrv)
-+{
-+    dump_binary_data(stderr, call_get_wired(rrv));
-+    return NULL;
-+}
-+*/
-+
-+struct rr_methods caa_methods = { caa_parse, caa_human, caa_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/carp.c validns/carp.c
---- validns-0.8/carp.c	2014-02-11 15:47:14.000000000 -0500
-+++ validns/carp.c	2020-10-05 16:59:29.353681351 -0400
-@@ -23,77 +23,77 @@
- void
- croak(int exit_code, const char *fmt, ...)
- {
--	va_list ap;
--	va_start(ap, fmt);
--	v(1, errno, exit_code, fmt, ap);
--	va_end(ap);
-+    va_list ap;
-+    va_start(ap, fmt);
-+    v(1, errno, exit_code, fmt, ap);
-+    va_end(ap);
- }
- 
- void
- croakx(int exit_code, const char *fmt, ...)
- {
--	va_list ap;
--	va_start(ap, fmt);
--	v(1, -1, exit_code, fmt, ap);
--	va_end(ap);
-+    va_list ap;
-+    va_start(ap, fmt);
-+    v(1, -1, exit_code, fmt, ap);
-+    va_end(ap);
- }
- 
- void *
- bitch(const char *fmt, ...)
- {
--	va_list ap;
--	va_start(ap, fmt);
--	if (!G.opt.no_output) {
--		fprintf(stderr, "%s:%d: ", file_info->name, file_info->line);
--		if (fmt != NULL) {
--			vfprintf(stderr, fmt, ap);
--		}
--		fprintf(stderr, "\n");
--	}
--	va_end(ap);
--	G.exit_code = 1;
--	G.stats.error_count++;
--	file_info->paren_mode = 0;
--	if (G.opt.die_on_first_error)
--		exit(1);
--	return NULL;
-+    va_list ap;
-+    va_start(ap, fmt);
-+    if (!G.opt.no_output) {
-+        fprintf(stderr, "%s:%d: ", file_info->name, file_info->line);
-+        if (fmt != NULL) {
-+            vfprintf(stderr, fmt, ap);
-+        }
-+        fprintf(stderr, "\n");
-+    }
-+    va_end(ap);
-+    G.exit_code = 1;
-+    G.stats.error_count++;
-+    file_info->paren_mode = 0;
-+    if (G.opt.die_on_first_error)
-+        exit(1);
-+    return NULL;
- }
- 
- void *
- moan(char *file_name, int line, const char *fmt, ...)
- {
--	va_list ap;
--	va_start(ap, fmt);
--	if (!G.opt.no_output) {
--		fprintf(stderr, "%s:%d: ", file_name, line);
--		if (fmt != NULL) {
--			vfprintf(stderr, fmt, ap);
--		}
--		fprintf(stderr, "\n");
--	}
--	va_end(ap);
--	G.exit_code = 1;
--	G.stats.error_count++;
--	if (G.opt.die_on_first_error)
--		exit(1);
--	return NULL;
-+    va_list ap;
-+    va_start(ap, fmt);
-+    if (!G.opt.no_output) {
-+        fprintf(stderr, "%s:%d: ", file_name, line);
-+        if (fmt != NULL) {
-+            vfprintf(stderr, fmt, ap);
-+        }
-+        fprintf(stderr, "\n");
-+    }
-+    va_end(ap);
-+    G.exit_code = 1;
-+    G.stats.error_count++;
-+    if (G.opt.die_on_first_error)
-+        exit(1);
-+    return NULL;
- }
- 
- void
- v(int is_croak, int use_errno, int exit_code, const char *fmt, va_list ap)
- {
--	fprintf(stderr, "%s: ", thisprogname());
--	if (fmt != NULL) {
--		vfprintf(stderr, fmt, ap);
--		if (use_errno >= 0)
--			fprintf(stderr, ": ");
--	}
--	if (use_errno >= 0)
--		fprintf(stderr, "%s\n", strerror(use_errno));
--	else
--		fprintf(stderr, "\n");
--	if (is_croak)
--		exit(exit_code);
-+    fprintf(stderr, "%s: ", thisprogname());
-+    if (fmt != NULL) {
-+        vfprintf(stderr, fmt, ap);
-+        if (use_errno >= 0)
-+            fprintf(stderr, ": ");
-+    }
-+    if (use_errno >= 0)
-+        fprintf(stderr, "%s\n", strerror(use_errno));
-+    else
-+        fprintf(stderr, "\n");
-+    if (is_croak)
-+        exit(exit_code);
- }
- 
- #if defined(__linux__)
-@@ -103,15 +103,15 @@
- const char *thisprogname(void)
- {
- #if defined(__FreeBSD__)
--	return getprogname();
-+    return getprogname();
- #elif defined(__APPLE__)
--	return getprogname();
-+    return getprogname();
- #elif defined(__sun__)
--	return getexecname();
-+    return getexecname();
- #elif defined(__linux__)
--	if (readlink("/proc/self/exe", proggy, MAXPATHLEN) != -1)
--		return proggy;
--	return "";
-+    if (readlink("/proc/self/exe", proggy, MAXPATHLEN) != -1)
-+        return proggy;
-+    return "";
- #else
- #error "unsupported OS"
- #endif
-diff -Naur validns-0.8/cbtree.c validns/cbtree.c
---- validns-0.8/cbtree.c	2013-04-11 15:38:07.000000000 -0400
-+++ validns/cbtree.c	2020-10-05 16:59:29.353681351 -0400
-@@ -24,10 +24,10 @@
- 
- struct pool
- {
--	struct pool *next;
--	size_t pool_size;
--	size_t free_index;
--	char mem[0];
-+    struct pool *next;
-+    size_t pool_size;
-+    size_t free_index;
-+    char mem[0];
- };
- 
- static struct pool *internal = NULL;
-@@ -35,35 +35,35 @@
- 
- static int new_pool(struct pool **root, size_t size)
- {
--	struct pool *pool;
-+    struct pool *pool;
- 
--	size = (size + sizeof(void *) - 1) / sizeof(void *);
--	size *= sizeof(void *);
--	pool = malloc(size + sizeof(struct pool));
--	if (!pool) {
--		return 1;
--	}
--	pool->next = *root;
--	pool->free_index = 0;
--	pool->pool_size = size;
--	*root = pool;
--	return 0;
-+    size = (size + sizeof(void *) - 1) / sizeof(void *);
-+    size *= sizeof(void *);
-+    pool = malloc(size + sizeof(struct pool));
-+    if (!pool) {
-+        return 1;
-+    }
-+    pool->next = *root;
-+    pool->free_index = 0;
-+    pool->pool_size = size;
-+    *root = pool;
-+    return 0;
- }
- 
- static void *alloc(struct pool **root, size_t size)
- {
--	void *ret;
--	size = (size + sizeof(void *) - 1) / sizeof(void *);
--	size *= sizeof(void *);
--	if (!*root)
--		if (new_pool(root, size > 256000 ? size : 256000) != 0)
--			return NULL;
--	if ((*root)->pool_size - (*root)->free_index < size)
--		if (new_pool(root, size > 256000 ? size : 256000) != 0)
--			return NULL;
--	ret = (*root)->mem + (*root)->free_index;
--	(*root)->free_index += size;
--	return ret;
-+    void *ret;
-+    size = (size + sizeof(void *) - 1) / sizeof(void *);
-+    size *= sizeof(void *);
-+    if (!*root)
-+        if (new_pool(root, size > 256000 ? size : 256000) != 0)
-+            return NULL;
-+    if ((*root)->pool_size - (*root)->free_index < size)
-+        if (new_pool(root, size > 256000 ? size : 256000) != 0)
-+            return NULL;
-+    ret = (*root)->mem + (*root)->free_index;
-+    (*root)->free_index += size;
-+    return ret;
- }
- 
- /* main code */
-@@ -75,318 +75,318 @@
-     const size_t ulen = strlen(u);
-     uint8_t *p = t->root;
- 
--	/* Test for empty tree */
--	if (!p) return NULL;
-+    /* Test for empty tree */
-+    if (!p) return NULL;
- 
-     /* Walk tree for best member */
--	while (1 & (intptr_t) p) {
--		struct node *q = (void *)(p - 1);
--		/* Calculate direction */
--		int direction;
--		uint8_t c = 0;
--
--		if (q->byte < ulen)
--			c = ubytes[q->byte];
--		direction = (1 + (q->otherbits | c)) >> 8;
--
--		p = q->child[direction];
--	}
--
--	/* The leaves contain "[data ptr][string]" */
--	if (strcmp(u, (const char *)(p + sizeof(intptr_t))) == 0)
--		return (intptr_t *)p;
--	return NULL;
-+    while (1 & (intptr_t) p) {
-+        struct node *q = (void *)(p - 1);
-+        /* Calculate direction */
-+        int direction;
-+        uint8_t c = 0;
-+
-+        if (q->byte < ulen)
-+            c = ubytes[q->byte];
-+        direction = (1 + (q->otherbits | c)) >> 8;
-+
-+        p = q->child[direction];
-+    }
-+
-+    /* The leaves contain "[data ptr][string]" */
-+    if (strcmp(u, (const char *)(p + sizeof(intptr_t))) == 0)
-+        return (intptr_t *)p;
-+    return NULL;
- }
- 
- intptr_t*
- cbtree_insert(struct cbtree *t, const char *u)
- {
--	const uint8_t *const ubytes = (void *) u;
--	const size_t ulen = strlen(u);
--	uint8_t *p = t->root;
--
--	/* Deal with inserting into an empty tree */
--	if (!p) {
--		char *x = alloc(&external, ulen + 1 + sizeof(intptr_t));
--		if (!x)
--			return NULL;
--		*((intptr_t *)x) = 0;
--		memcpy(x + sizeof(intptr_t), u, ulen + 1);
--		t->root = x;
--		return (intptr_t *)x;
--	}
-+    const uint8_t *const ubytes = (void *) u;
-+    const size_t ulen = strlen(u);
-+    uint8_t *p = t->root;
-+
-+    /* Deal with inserting into an empty tree */
-+    if (!p) {
-+        char *x = alloc(&external, ulen + 1 + sizeof(intptr_t));
-+        if (!x)
-+            return NULL;
-+        *((intptr_t *)x) = 0;
-+        memcpy(x + sizeof(intptr_t), u, ulen + 1);
-+        t->root = x;
-+        return (intptr_t *)x;
-+    }
- 
-     /* Walk tree for best member */
--	while (1 & (intptr_t) p) {
--		struct node *q = (void *)(p - 1);
--		/* Calculate direction */
--		int direction;
--		uint8_t c = 0;
--
--		if (q->byte < ulen)
--			c = ubytes[q->byte];
--		direction = (1 + (q->otherbits | c)) >> 8;
--
--		p = q->child[direction];
--	}
--
--	/* Find the critical bit */
--	/* 1: Find differing byte */
--	uint32_t newbyte;
--	uint32_t newotherbits;
--
--	for (newbyte = 0; newbyte < ulen; ++newbyte) {
--		if (p[sizeof(intptr_t) + newbyte] != ubytes[newbyte]) {
--			newotherbits = p[sizeof(intptr_t) + newbyte] ^ ubytes[newbyte];
--			goto different_byte_found;
--		}
--	}
--
--	if (p[sizeof(intptr_t) + newbyte] != 0) {
--		newotherbits = p[sizeof(intptr_t) + newbyte];
--		goto different_byte_found;
--	}
--	return (intptr_t *)p;
-+    while (1 & (intptr_t) p) {
-+        struct node *q = (void *)(p - 1);
-+        /* Calculate direction */
-+        int direction;
-+        uint8_t c = 0;
-+
-+        if (q->byte < ulen)
-+            c = ubytes[q->byte];
-+        direction = (1 + (q->otherbits | c)) >> 8;
-+
-+        p = q->child[direction];
-+    }
-+
-+    /* Find the critical bit */
-+    /* 1: Find differing byte */
-+    uint32_t newbyte;
-+    uint32_t newotherbits;
-+
-+    for (newbyte = 0; newbyte < ulen; ++newbyte) {
-+        if (p[sizeof(intptr_t) + newbyte] != ubytes[newbyte]) {
-+            newotherbits = p[sizeof(intptr_t) + newbyte] ^ ubytes[newbyte];
-+            goto different_byte_found;
-+        }
-+    }
-+
-+    if (p[sizeof(intptr_t) + newbyte] != 0) {
-+        newotherbits = p[sizeof(intptr_t) + newbyte];
-+        goto different_byte_found;
-+    }
-+    return (intptr_t *)p;
- 
- different_byte_found:
- 
--	/* 2: Find differing bit */
--	newotherbits |= newotherbits >> 1;
--	newotherbits |= newotherbits >> 2;
--	newotherbits |= newotherbits >> 4;
--	newotherbits = (newotherbits & ~(newotherbits >> 1)) ^ 255;
--	uint8_t c = p[sizeof(intptr_t) + newbyte];
--	int newdirection = (1 + (newotherbits | c)) >> 8;
--
--	/* Insert new string */
--
--	/* 1: Allocate new node structure */
--	struct node *newnode;
--
--	newnode = alloc(&internal, sizeof(struct node));
--	if (!newnode)
--		return NULL;
--
--	char *x = alloc(&external, ulen + 1 + sizeof(intptr_t));
--	if (!x)
--		return NULL;
--	*((intptr_t *)x) = 0;
--	memcpy(x + sizeof(intptr_t), ubytes, ulen + 1);
--
--	newnode->byte = newbyte;
--	newnode->otherbits = newotherbits;
--	newnode->child[1 - newdirection] = x;
--
--	/* 2: Insert new node */
--	void **wherep = &t->root;
--	for (;;) {
--		uint8_t *p = *wherep;
--		if (!(1 & (intptr_t) p)) break;
--		struct node *q = (void *) (p - 1);
--		if (q->byte > newbyte) break;
--		if (q->byte == newbyte && q->otherbits > newotherbits) break;
--		uint8_t c = 0;
--		if (q->byte < ulen) c = ubytes[q->byte];
--		const int direction = (1 + (q->otherbits | c)) >> 8;
--		wherep = q->child + direction;
--	}
-+    /* 2: Find differing bit */
-+    newotherbits |= newotherbits >> 1;
-+    newotherbits |= newotherbits >> 2;
-+    newotherbits |= newotherbits >> 4;
-+    newotherbits = (newotherbits & ~(newotherbits >> 1)) ^ 255;
-+    uint8_t c = p[sizeof(intptr_t) + newbyte];
-+    int newdirection = (1 + (newotherbits | c)) >> 8;
-+
-+    /* Insert new string */
-+
-+    /* 1: Allocate new node structure */
-+    struct node *newnode;
-+
-+    newnode = alloc(&internal, sizeof(struct node));
-+    if (!newnode)
-+        return NULL;
-+
-+    char *x = alloc(&external, ulen + 1 + sizeof(intptr_t));
-+    if (!x)
-+        return NULL;
-+    *((intptr_t *)x) = 0;
-+    memcpy(x + sizeof(intptr_t), ubytes, ulen + 1);
-+
-+    newnode->byte = newbyte;
-+    newnode->otherbits = newotherbits;
-+    newnode->child[1 - newdirection] = x;
-+
-+    /* 2: Insert new node */
-+    void **wherep = &t->root;
-+    for (;;) {
-+        uint8_t *p = *wherep;
-+        if (!(1 & (intptr_t) p)) break;
-+        struct node *q = (void *) (p - 1);
-+        if (q->byte > newbyte) break;
-+        if (q->byte == newbyte && q->otherbits > newotherbits) break;
-+        uint8_t c = 0;
-+        if (q->byte < ulen) c = ubytes[q->byte];
-+        const int direction = (1 + (q->otherbits | c)) >> 8;
-+        wherep = q->child + direction;
-+    }
- 
--	newnode->child[newdirection] = *wherep;
--	*wherep = (void *) (1 + (char *) newnode);
-+    newnode->child[newdirection] = *wherep;
-+    *wherep = (void *) (1 + (char *) newnode);
- 
--	return (intptr_t *)x;
-+    return (intptr_t *)x;
- }
- 
- intptr_t
- cbtree_delete(struct cbtree *t, const char *u)
- {
--	const uint8_t *ubytes = (void *) u;
--	const size_t ulen = strlen(u);
--	uint8_t *p = t->root;
--	void **wherep = &t->root;
--	void **whereq = 0;
--	struct node *q = 0;
--	int direction = 0;
--	intptr_t ret;
--
--	/* Deal with deleting from an empty tree */
--	if (!p) return 0;
--
--	/* Walk the tree for the best match */
--	while (1 & (intptr_t) p) {
--		whereq = wherep;
--		q = (void *) (p - 1);
--		uint8_t c = 0;
--		if (q->byte < ulen) c = ubytes[q->byte];
--		direction = (1 + (q->otherbits | c)) >> 8;
--		wherep = q->child + direction;
--		p = *wherep;
--	}
--
--	/* Check the best match */
--	if (0 != strcmp(u, (const char *)(p + sizeof(intptr_t))))
--		return 0;
--	ret = *((intptr_t *)p);
--
--	/* Remove the element and/or node */
--	if (!whereq) {
--		t->root = 0;
--		return ret;
--	}
-+    const uint8_t *ubytes = (void *) u;
-+    const size_t ulen = strlen(u);
-+    uint8_t *p = t->root;
-+    void **wherep = &t->root;
-+    void **whereq = 0;
-+    struct node *q = 0;
-+    int direction = 0;
-+    intptr_t ret;
-+
-+    /* Deal with deleting from an empty tree */
-+    if (!p) return 0;
-+
-+    /* Walk the tree for the best match */
-+    while (1 & (intptr_t) p) {
-+        whereq = wherep;
-+        q = (void *) (p - 1);
-+        uint8_t c = 0;
-+        if (q->byte < ulen) c = ubytes[q->byte];
-+        direction = (1 + (q->otherbits | c)) >> 8;
-+        wherep = q->child + direction;
-+        p = *wherep;
-+    }
-+
-+    /* Check the best match */
-+    if (0 != strcmp(u, (const char *)(p + sizeof(intptr_t))))
-+        return 0;
-+    ret = *((intptr_t *)p);
-+
-+    /* Remove the element and/or node */
-+    if (!whereq) {
-+        t->root = 0;
-+        return ret;
-+    }
- 
--	*whereq = q->child[1 - direction];
--	// free(q);
-+    *whereq = q->child[1 - direction];
-+    // free(q);
- 
--	return ret;
-+    return ret;
- }
- 
- static void
- traverse(void *top) {
--	uint8_t *p = top;
-+    uint8_t *p = top;
- 
--	if (1 & (intptr_t) p) {
--		struct node *q = (void *) (p - 1);
--		traverse(q->child[0]);
--		traverse(q->child[1]);
--		// free(q);
--	} else {
--		// free(p);
--	}
-+    if (1 & (intptr_t) p) {
-+        struct node *q = (void *) (p - 1);
-+        traverse(q->child[0]);
-+        traverse(q->child[1]);
-+        // free(q);
-+    } else {
-+        // free(p);
-+    }
- }
- 
- void
- cbtree_clear(struct cbtree *t)
- {
--	if (t->root) traverse(t->root);
--	t->root = NULL;
-+    if (t->root) traverse(t->root);
-+    t->root = NULL;
- }
- 
- static int
- allprefixed_traverse(uint8_t *top, int (*handle)(const char *, intptr_t *, void *), void *arg)
- {
--	int direction;
-+    int direction;
- 
--	/* Deal with an internal node */
--	if (1 & (intptr_t) top) {
--		struct node *q = (void *) (top - 1);
--		for (direction = 0; direction < 2; ++direction)
--			switch(allprefixed_traverse(q->child[direction], handle, arg)) {
--			case 1: break;
--			case 0: return 0;
--			default: return -1;
--			}
--		return 1;
--	}
-+    /* Deal with an internal node */
-+    if (1 & (intptr_t) top) {
-+        struct node *q = (void *) (top - 1);
-+        for (direction = 0; direction < 2; ++direction)
-+            switch(allprefixed_traverse(q->child[direction], handle, arg)) {
-+            case 1: break;
-+            case 0: return 0;
-+            default: return -1;
-+            }
-+        return 1;
-+    }
- 
--	/* Deal with an external node */
--	return handle((const char *)(top + sizeof(intptr_t)), (intptr_t *)top, arg);
-+    /* Deal with an external node */
-+    return handle((const char *)(top + sizeof(intptr_t)), (intptr_t *)top, arg);
- }
- 
- int
- cbtree_allprefixed(struct cbtree *t, const char *prefix,
--				   int (*handle)(const char *, intptr_t *, void *),
--				   void *arg)
-+                   int (*handle)(const char *, intptr_t *, void *),
-+                   void *arg)
- {
--	const uint8_t *ubytes = (void *) prefix;
--	const size_t ulen = strlen(prefix);
--	uint8_t *p = t->root;
--	uint8_t *top = p;
--	int i;
--
--	if (!p) return 1; /* S = $\emptyset$ */
--
--	/* Walk tree, maintaining top pointer */
--	while (1 & (intptr_t) p) {
--		struct node *q = (void *) (p - 1);
--		uint8_t c = 0;
--		if (q->byte < ulen) c = ubytes[q->byte];
--		const int direction = (1 + (q->otherbits | c)) >> 8;
--		p = q->child[direction];
--		if (q->byte < ulen) top = p;
--	}
--
--	/* Check prefix */
--	for (i = 0; i < ulen; ++i) {
--		if (p[i+sizeof(intptr_t)] != ubytes[i]) return 1;
--	}
-+    const uint8_t *ubytes = (void *) prefix;
-+    const size_t ulen = strlen(prefix);
-+    uint8_t *p = t->root;
-+    uint8_t *top = p;
-+    int i;
- 
--	return allprefixed_traverse(top, handle, arg);
-+    if (!p) return 1; /* S = $\emptyset$ */
-+
-+    /* Walk tree, maintaining top pointer */
-+    while (1 & (intptr_t) p) {
-+        struct node *q = (void *) (p - 1);
-+        uint8_t c = 0;
-+        if (q->byte < ulen) c = ubytes[q->byte];
-+        const int direction = (1 + (q->otherbits | c)) >> 8;
-+        p = q->child[direction];
-+        if (q->byte < ulen) top = p;
-+    }
-+
-+    /* Check prefix */
-+    for (i = 0; i < ulen; ++i) {
-+        if (p[i+sizeof(intptr_t)] != ubytes[i]) return 1;
-+    }
-+
-+    return allprefixed_traverse(top, handle, arg);
- }
- 
- static const char *byte_to_binary(int x)
- {
--	static char b[9];
--	int z;
-+    static char b[9];
-+    int z;
- 
--	b[0] = '\0';
--	for (z = 128; z > 0; z >>= 1)
--		strcat(b, ((x & z) == z) ? "1" : "0");
-+    b[0] = '\0';
-+    for (z = 128; z > 0; z >>= 1)
-+        strcat(b, ((x & z) == z) ? "1" : "0");
- 
--	return b;
-+    return b;
- }
- 
- static void
- traverse_dump(void *top, int level, int byte)
- {
--	uint8_t *p = top;
--	int i;
-+    uint8_t *p = top;
-+    int i;
- 
--	for (i = 0; i < level; i++) printf(" ");
--	if (1 & (intptr_t) p) {
--		struct node *q = (void *) (p - 1);
--		printf("[byte(%d),otherbits(%s)]\n", q->byte, byte_to_binary(q->otherbits));
--		traverse_dump(q->child[0], level + 1, q->byte);
--		traverse_dump(q->child[1], level + 1, q->byte);
--	} else {
--		const size_t ulen = strlen((char *)(p + sizeof(intptr_t)));
--		int c = byte < ulen ? p[sizeof(intptr_t) + byte] : 0;
--		printf("\"%s\" (%s)\n", p + sizeof(intptr_t), byte_to_binary(c));
--	}
-+    for (i = 0; i < level; i++) printf(" ");
-+    if (1 & (intptr_t) p) {
-+        struct node *q = (void *) (p - 1);
-+        printf("[byte(%d),otherbits(%s)]\n", q->byte, byte_to_binary(q->otherbits));
-+        traverse_dump(q->child[0], level + 1, q->byte);
-+        traverse_dump(q->child[1], level + 1, q->byte);
-+    } else {
-+        const size_t ulen = strlen((char *)(p + sizeof(intptr_t)));
-+        int c = byte < ulen ? p[sizeof(intptr_t) + byte] : 0;
-+        printf("\"%s\" (%s)\n", p + sizeof(intptr_t), byte_to_binary(c));
-+    }
- }
- 
- void
- cbtree_dump(struct cbtree *t)
- {
--	if (t->root)
--		traverse_dump(t->root, 0, 0);
--	printf("\n");
-+    if (t->root)
-+        traverse_dump(t->root, 0, 0);
-+    printf("\n");
- }
- 
- char*
- cbtree_next(struct cbtree *t, const char *u, intptr_t *data)
- {
--	const uint8_t *ubytes = (void *) u;
--	const size_t ulen = strlen(u);
--	uint8_t *p = t->root;
--	uint8_t *branch = NULL;
--
--	if (!p) return NULL;
--
--	/* Walk tree, maintaining top pointer */
--	while (1 & (intptr_t) p) {
--		struct node *q = (void *) (p - 1);
--		uint8_t c = 0;
--		if (q->byte < ulen) c = ubytes[q->byte];
--		const int direction = (1 + (q->otherbits | c)) >> 8;
--		if (direction == 0)
--			branch = q->child[1];
--		p = q->child[direction];
--	}
--
--	/* check whether what we found is what we are looking for already */
--	if (strcmp((char *)(p + sizeof(intptr_t)), u) > 0) {
--		if (data) *data = *((intptr_t *)p);
--		return (char *)(p + sizeof(intptr_t));
--	}
--
--	if (!branch) return NULL;
--
--	/* select the lowest value on the branch */
--	p = branch;
--	while (1 & (intptr_t) p) {
--		struct node *q = (void *) (p - 1);
--		p = q->child[0];
--	}
--	if (data) *data = *((intptr_t *)p);
--	return (char *)(p + sizeof(intptr_t));
-+    const uint8_t *ubytes = (void *) u;
-+    const size_t ulen = strlen(u);
-+    uint8_t *p = t->root;
-+    uint8_t *branch = NULL;
-+
-+    if (!p) return NULL;
-+
-+    /* Walk tree, maintaining top pointer */
-+    while (1 & (intptr_t) p) {
-+        struct node *q = (void *) (p - 1);
-+        uint8_t c = 0;
-+        if (q->byte < ulen) c = ubytes[q->byte];
-+        const int direction = (1 + (q->otherbits | c)) >> 8;
-+        if (direction == 0)
-+            branch = q->child[1];
-+        p = q->child[direction];
-+    }
-+
-+    /* check whether what we found is what we are looking for already */
-+    if (strcmp((char *)(p + sizeof(intptr_t)), u) > 0) {
-+        if (data) *data = *((intptr_t *)p);
-+        return (char *)(p + sizeof(intptr_t));
-+    }
-+
-+    if (!branch) return NULL;
-+
-+    /* select the lowest value on the branch */
-+    p = branch;
-+    while (1 & (intptr_t) p) {
-+        struct node *q = (void *) (p - 1);
-+        p = q->child[0];
-+    }
-+    if (data) *data = *((intptr_t *)p);
-+    return (char *)(p + sizeof(intptr_t));
- }
-diff -Naur validns-0.8/cbtree.h validns/cbtree.h
---- validns-0.8/cbtree.h	2013-04-11 15:38:07.000000000 -0400
-+++ validns/cbtree.h	2020-10-05 16:59:29.353681351 -0400
-@@ -47,8 +47,8 @@
- void cbtree_clear(struct cbtree *t);
- 
- int cbtree_allprefixed(struct cbtree *t, const char *prefix,
--					   int (*handle)(const char *, intptr_t *, void *),
--					   void *arg);
-+                       int (*handle)(const char *, intptr_t *, void *),
-+                       void *arg);
- 
- void cbtree_dump(struct cbtree *t);
- 
-diff -Naur validns-0.8/cert.c validns/cert.c
---- validns-0.8/cert.c	2014-02-11 15:46:12.000000000 -0500
-+++ validns/cert.c	2020-10-05 16:59:29.353681351 -0400
-@@ -26,115 +26,115 @@
- 
- static int extract_certificate_type(char **s, char *what)
- {
--	int type;
--	char *str_type;
-+    int type;
-+    char *str_type;
- 
--	if (isdigit(**s)) {
--		type = extract_integer(s, what);
--		if (type >= 1 && type <= 8)
--			return type;
--		if (type == 253 || type == 254)
--			return type;
--		if (type >= 65280 && type <= 65534)
--			return type;
--		if (type < 0 || type > 65535) {
--			bitch("bad certificate type %d", type);
--			return -1;
--		}
--		if (type == 0 || type == 255 || type == 65535) {
--			bitch("certificate type %d is reserved by IANA", type);
--			return -1;
--		}
--		bitch("certificate type %d is unassigned", type);
--		return -1;
--	} else {
--		str_type = extract_label(s, what, "temporary");
--		if (!str_type) return -1;
--		if (strcmp(str_type, "pkix") == 0)
--			return 1;
--		if (strcmp(str_type, "spki") == 0)
--			return 2;
--		if (strcmp(str_type, "pgp") == 0)
--			return 3;
--		if (strcmp(str_type, "ipkix") == 0)
--			return 4;
--		if (strcmp(str_type, "ispki") == 0)
--			return 5;
--		if (strcmp(str_type, "ipgp") == 0)
--			return 6;
--		if (strcmp(str_type, "acpkix") == 0)
--			return 7;
--		if (strcmp(str_type, "iacpkix") == 0)
--			return 8;
--		if (strcmp(str_type, "uri") == 0)
--			return 253;
--		if (strcmp(str_type, "oid") == 0)
--			return 254;
--		bitch("bad certificate type %s", str_type);
--		return -1;
--	}
-+    if (isdigit(**s)) {
-+        type = extract_integer(s, what, NULL);
-+        if (type >= 1 && type <= 8)
-+            return type;
-+        if (type == 253 || type == 254)
-+            return type;
-+        if (type >= 65280 && type <= 65534)
-+            return type;
-+        if (type < 0 || type > 65535) {
-+            bitch("bad certificate type %d", type);
-+            return -1;
-+        }
-+        if (type == 0 || type == 255 || type == 65535) {
-+            bitch("certificate type %d is reserved by IANA", type);
-+            return -1;
-+        }
-+        bitch("certificate type %d is unassigned", type);
-+        return -1;
-+    } else {
-+        str_type = extract_label(s, what, "temporary");
-+        if (!str_type) return -1;
-+        if (strcmp(str_type, "pkix") == 0)
-+            return 1;
-+        if (strcmp(str_type, "spki") == 0)
-+            return 2;
-+        if (strcmp(str_type, "pgp") == 0)
-+            return 3;
-+        if (strcmp(str_type, "ipkix") == 0)
-+            return 4;
-+        if (strcmp(str_type, "ispki") == 0)
-+            return 5;
-+        if (strcmp(str_type, "ipgp") == 0)
-+            return 6;
-+        if (strcmp(str_type, "acpkix") == 0)
-+            return 7;
-+        if (strcmp(str_type, "iacpkix") == 0)
-+            return 8;
-+        if (strcmp(str_type, "uri") == 0)
-+            return 253;
-+        if (strcmp(str_type, "oid") == 0)
-+            return 254;
-+        bitch("bad certificate type %s", str_type);
-+        return -1;
-+    }
- }
- 
- static struct rr* cert_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_cert *rr = getmem(sizeof(*rr));
--	int cert_type, key_tag, alg;
-+    struct rr_cert *rr = getmem(sizeof(*rr));
-+    int cert_type, key_tag, alg;
- 
--	cert_type = extract_certificate_type(&s, "certificate type");
--	if (cert_type < 0)	return NULL;
--	rr->type = cert_type;
--
--	key_tag = extract_integer(&s, "key tag");
--	if (key_tag < 0)	return NULL;
--	if (key_tag > 65535)
--		return bitch("bad key tag");
--	rr->key_tag = key_tag;
--
--	if (isdigit(*s)) {
--		alg = extract_integer(&s, "algorithm");
--		if (alg < 0)	return NULL;
--		if (alg > 255)	return bitch("bad algorithm");
--		if (alg != 0) {  /* 0 is just fine */
--			if (algorithm_type(alg) == ALG_UNSUPPORTED)
--				return bitch("bad algorithm %d", alg);
--		}
--	} else {
--		alg = extract_algorithm(&s, "algorithm");
--		if (alg == ALG_UNSUPPORTED)	return NULL;
--	}
--	rr->algorithm = alg;
--
--	if (alg == 0 && key_tag != 0) {
--		/* we might want to bitch here, but RFC says "SHOULD", so we don't */
--	}
--
--	rr->certificate = extract_base64_binary_data(&s, "certificate");
--	if (rr->certificate.length < 0)	return NULL;
--	/* TODO validate cert length based on algorithm */
--
--	if (*s) {
--		return bitch("garbage after valid CERT data");
--	}
--	return store_record(type, name, ttl, rr);
-+    cert_type = extract_certificate_type(&s, "certificate type");
-+    if (cert_type < 0)  return NULL;
-+    rr->type = cert_type;
-+
-+    key_tag = extract_integer(&s, "key tag", NULL);
-+    if (key_tag < 0)    return NULL;
-+    if (key_tag > 65535)
-+        return bitch("bad key tag");
-+    rr->key_tag = key_tag;
-+
-+    if (isdigit(*s)) {
-+        alg = extract_integer(&s, "algorithm", NULL);
-+        if (alg < 0)    return NULL;
-+        if (alg > 255)  return bitch("bad algorithm");
-+        if (alg != 0) {  /* 0 is just fine */
-+            if (algorithm_type(alg) == ALG_UNSUPPORTED)
-+                return bitch("bad algorithm %d", alg);
-+        }
-+    } else {
-+        alg = extract_algorithm(&s, "algorithm");
-+        if (alg == ALG_UNSUPPORTED) return NULL;
-+    }
-+    rr->algorithm = alg;
-+
-+    if (alg == 0 && key_tag != 0) {
-+        /* we might want to bitch here, but RFC says "SHOULD", so we don't */
-+    }
-+
-+    rr->certificate = extract_base64_binary_data(&s, "certificate");
-+    if (rr->certificate.length < 0) return NULL;
-+    /* TODO validate cert length based on algorithm */
-+
-+    if (*s) {
-+        return bitch("garbage after valid CERT data");
-+    }
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* cert_human(struct rr *rrv)
- {
--	RRCAST(cert);
-+    RRCAST(cert);
-     char s[1024];
- 
-     snprintf(s, 1024, "%d %d %d ...",
--		rr->type, rr->key_tag, rr->algorithm);
-+        rr->type, rr->key_tag, rr->algorithm);
-     return quickstrdup_temp(s);
- }
- 
- static struct binary_data cert_wirerdata(struct rr *rrv)
- {
--	RRCAST(cert);
-+    RRCAST(cert);
- 
--	return compose_binary_data("221d", 1,
--		rr->type, rr->key_tag, rr->algorithm,
--		rr->certificate);
-+    return compose_binary_data("221d", 1,
-+        rr->type, rr->key_tag, rr->algorithm,
-+        rr->certificate);
- }
- 
- struct rr_methods cert_methods = { cert_parse, cert_human, cert_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/cname.c validns/cname.c
---- validns-0.8/cname.c	2014-02-11 15:46:59.000000000 -0500
-+++ validns/cname.c	2020-10-05 16:59:29.353681351 -0400
-@@ -19,58 +19,58 @@
- 
- static struct rr *cname_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_cname *rr = getmem(sizeof(*rr));
-+    struct rr_cname *rr = getmem(sizeof(*rr));
- 
--	rr->cname = extract_name(&s, "cname", 0);
--	if (!rr->cname)
--		return NULL;
--	if (*s) {
--		return bitch("garbage after valid CNAME data");
--	}
-+    rr->cname = extract_name(&s, "cname", 0);
-+    if (!rr->cname)
-+        return NULL;
-+    if (*s) {
-+        return bitch("garbage after valid CNAME data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* cname_human(struct rr *rrv)
- {
--	RRCAST(cname);
-+    RRCAST(cname);
-     return rr->cname;
- }
- 
- static struct binary_data cname_wirerdata(struct rr *rrv)
- {
--	RRCAST(cname);
--	return name2wire_name(rr->cname);
-+    RRCAST(cname);
-+    return name2wire_name(rr->cname);
- }
- 
- static void* cname_validate_set(struct rr_set *rr_set)
- {
--	struct rr *rr;
--	struct rr_set *another_set;
--	struct named_rr *named_rr;
--	int count;
--
--	if (G.opt.policy_checks[POLICY_CNAME_OTHER_DATA]) {
--		if (rr_set->count > 1) {
--			rr = rr_set->tail;
--			return moan(rr->file_name, rr->line, "CNAME and other data");
--		}
--		named_rr = rr_set->named_rr;
--		count = get_rr_set_count(named_rr);
--		if (count > 1) {
--			another_set = find_rr_set_in_named_rr(named_rr, T_RRSIG);
--			if (another_set)
--				count -= another_set->count;
--			another_set = find_rr_set_in_named_rr(named_rr, T_NSEC);
--			if (another_set)
--				count -= another_set->count;
--			if (count > 1) {
--				rr = rr_set->tail;
--				return moan(rr->file_name, rr->line, "CNAME and other data");
--			}
--		}
--	}
--	return NULL;
-+    struct rr *rr;
-+    struct rr_set *another_set;
-+    struct named_rr *named_rr;
-+    int count;
-+
-+    if (G.opt.policy_checks[POLICY_CNAME_OTHER_DATA]) {
-+        if (rr_set->count > 1) {
-+            rr = rr_set->tail;
-+            return moan(rr->file_name, rr->line, "CNAME and other data");
-+        }
-+        named_rr = rr_set->named_rr;
-+        count = get_rr_set_count(named_rr);
-+        if (count > 1) {
-+            another_set = find_rr_set_in_named_rr(named_rr, T_RRSIG);
-+            if (another_set)
-+                count -= another_set->count;
-+            another_set = find_rr_set_in_named_rr(named_rr, T_NSEC);
-+            if (another_set)
-+                count -= another_set->count;
-+            if (count > 1) {
-+                rr = rr_set->tail;
-+                return moan(rr->file_name, rr->line, "CNAME and other data");
-+            }
-+        }
-+    }
-+    return NULL;
- }
- 
- struct rr_methods cname_methods = { cname_parse, cname_human, cname_wirerdata, cname_validate_set, NULL };
-diff -Naur validns-0.8/common.h validns/common.h
---- validns-0.8/common.h	2020-10-05 16:54:14.346790446 -0400
-+++ validns/common.h	2020-10-05 16:59:29.353681351 -0400
-@@ -9,19 +9,37 @@
- #ifndef _COMMON_H_
- #define _COMMON_H_ 1
- 
-+struct generate_template_piece;
-+struct generate_template_piece
-+{
-+    char *constant_string;
-+    struct generate_template_piece *next;
-+};
-+
-+#define LINEBUFSZ 2048
-+
- struct file_info
- {
--	struct file_info *next;
--	FILE *file;
--	int  line;
--	int  paren_mode;
--	char buf[2048];
--	char name[0];
-+    struct file_info *next;
-+    FILE *file;
-+    int  line;
-+    int  paren_mode;
-+    char buf[LINEBUFSZ];
-+    char *current_origin;
-+
-+    int generate_cur;
-+    int generate_lim;
-+    char *generate_type;
-+    struct generate_template_piece *generate_lhs;
-+    struct generate_template_piece *generate_rhs;
-+
-+    /* must be last struct member */
-+    char name[0];
- };
- 
- extern struct file_info *file_info;
- 
--#define N_POLICY_CHECKS 9
-+#define N_POLICY_CHECKS 11
- 
- #define POLICY_SINGLE_NS 0
- #define POLICY_CNAME_OTHER_DATA 1
-@@ -32,41 +50,44 @@
- #define POLICY_DNAME 6
- #define POLICY_DNSKEY 7
- #define POLICY_TLSA_HOST 8
-+#define POLICY_KSK_EXISTS 9
-+#define POLICY_SMIMEA_HOST 10
- 
- #define MAX_TIMES_TO_CHECK 32
- 
- struct globals {
--	struct stats {
--		int names_count;
--		int rr_count;
--		int rrset_count;
--		int error_count;
--		int skipped_dup_rr_count;
--		int soa_rr_count;
--		int signatures_verified;
--		int delegations;
--		int not_authoritative;
--		int nsec3_count;
--	} stats;
--	struct command_line_options
--	{
--		int die_on_first_error;
--		int no_output;
--		int summary;
--		int notiming;
--		int verbose;
--		char *include_path;
--		char *current_origin;
--		int n_times_to_check;
--		uint32_t times_to_check[MAX_TIMES_TO_CHECK];
--		char policy_checks[N_POLICY_CHECKS];
--		int n_threads;
--	} opt;
--	int exit_code;
--	long default_ttl;
--	int nsec3_present;
--	int nsec3_opt_out_present;
--	int dnssec_active;
-+    struct stats {
-+        int names_count;
-+        int rr_count;
-+        int rrset_count;
-+        int error_count;
-+        int skipped_dup_rr_count;
-+        int soa_rr_count;
-+        int signatures_verified;
-+        int delegations;
-+        int not_authoritative;
-+        int nsec3_count;
-+    } stats;
-+    struct command_line_options
-+    {
-+        int die_on_first_error;
-+        int no_output;
-+        int summary;
-+        int verbose;
-+        char *include_path;
-+        int include_path_specified;
-+        char *first_origin;
-+        int n_times_to_check;
-+        uint32_t times_to_check[MAX_TIMES_TO_CHECK];
-+        char policy_checks[N_POLICY_CHECKS];
-+        int n_threads;
-+        int soa_minttl_as_default_ttl;
-+    } opt;
-+    int exit_code;
-+    long default_ttl;
-+    int nsec3_present;
-+    int nsec3_opt_out_present;
-+    int dnssec_active;
- };
- 
- extern struct globals G;
-diff -Naur validns-0.8/dhcid.c validns/dhcid.c
---- validns-0.8/dhcid.c	2014-02-11 15:46:29.000000000 -0500
-+++ validns/dhcid.c	2020-10-05 16:59:29.354681360 -0400
-@@ -21,35 +21,35 @@
- 
- static struct rr* dhcid_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_dhcid *rr = getmem(sizeof(*rr));
--	struct binary_data data;
-+    struct rr_dhcid *rr = getmem(sizeof(*rr));
-+    struct binary_data data;
- 
--	data = extract_base64_binary_data(&s, "rdata");
--	if (data.length < 0)	return NULL;
-+    data = extract_base64_binary_data(&s, "rdata");
-+    if (data.length < 0)    return NULL;
- 
--	if (data.length < 3)
--		return bitch("rdata too short");
-+    if (data.length < 3)
-+        return bitch("rdata too short");
- 
--	rr->id_type = data.data[0]*256 + data.data[1];
--	if (rr->id_type > 2)
--		return bitch("unsupported identifier type %s", rr->id_type);
--
--	rr->digest_type = data.data[2];
--	if (rr->digest_type != 1)
--		return bitch("unsupported digest type %s", rr->digest_type);
--
--	if (data.length != 35)
--		return bitch("wrong digest length, must be 32 for SHA-256");
--
--	/* let's cheat a bit */
--	data.length -= 3;
--	data.data += 3;
--	rr->digest = data;
--
--	if (*s) {
--		return bitch("garbage after valid DHCID data");
--	}
--	return store_record(type, name, ttl, rr);
-+    rr->id_type = data.data[0]*256 + data.data[1];
-+    if (rr->id_type > 2)
-+        return bitch("unsupported identifier type %s", rr->id_type);
-+
-+    rr->digest_type = data.data[2];
-+    if (rr->digest_type != 1)
-+        return bitch("unsupported digest type %s", rr->digest_type);
-+
-+    if (data.length != 35)
-+        return bitch("wrong digest length, must be 32 for SHA-256");
-+
-+    /* let's cheat a bit */
-+    data.length -= 3;
-+    data.data += 3;
-+    rr->digest = data;
-+
-+    if (*s) {
-+        return bitch("garbage after valid DHCID data");
-+    }
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* dhcid_human(struct rr *rrv)
-@@ -59,10 +59,10 @@
- 
- static struct binary_data dhcid_wirerdata(struct rr *rrv)
- {
--	RRCAST(dhcid);
-+    RRCAST(dhcid);
- 
--	return compose_binary_data("21d", 1,
--		rr->id_type, rr->digest_type, rr->digest);
-+    return compose_binary_data("21d", 1,
-+        rr->id_type, rr->digest_type, rr->digest);
- }
- 
- struct rr_methods dhcid_methods = { dhcid_parse, dhcid_human, dhcid_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/dlv.c validns/dlv.c
---- validns-0.8/dlv.c	2014-02-11 15:46:32.000000000 -0500
-+++ validns/dlv.c	2020-10-05 16:59:29.354681360 -0400
-@@ -19,80 +19,80 @@
- 
- static struct rr* dlv_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_dlv *rr = getmem(sizeof(*rr));
--	int key_tag, algorithm, digest_type;
-+    struct rr_dlv *rr = getmem(sizeof(*rr));
-+    int key_tag, algorithm, digest_type;
- 
--	key_tag = extract_integer(&s, "key tag");
--	if (key_tag < 0)	return NULL;
--	rr->key_tag = key_tag;
--
--	algorithm = extract_algorithm(&s, "algorithm");
--	if (algorithm == ALG_UNSUPPORTED)	return NULL;
--	rr->algorithm = algorithm;
--
--	digest_type = extract_integer(&s, "digest type");
--	if (digest_type < 0)	return NULL;
--	rr->digest_type = digest_type;
--
--	rr->digest = extract_hex_binary_data(&s, "digest", EXTRACT_EAT_WHITESPACE);
--	if (rr->digest.length < 0)	return NULL;
--
--	switch (digest_type) {
--	case 1:
--		if (rr->digest.length != SHA1_BYTES) {
--			return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES);
--		}
--		break;
--	case 2:
--		if (rr->digest.length != SHA256_BYTES) {
--			return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES);
--		}
--		break;
--	case 3:
--		if (rr->digest.length != GOST_BYTES) {
--			return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES);
--		}
--		break;
--	case 4:
--		if (rr->digest.length != SHA384_BYTES) {
--			return bitch("wrong SHA-384 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA384_BYTES);
--		}
--		break;
--	default:
--		return bitch("bad or unsupported digest type %d", digest_type);
--	}
--
--	if (*s) {
--		return bitch("garbage after valid DLV data");
--	}
--	G.dnssec_active = 1;
--	return store_record(type, name, ttl, rr);
-+    key_tag = extract_integer(&s, "key tag", NULL);
-+    if (key_tag < 0)    return NULL;
-+    rr->key_tag = key_tag;
-+
-+    algorithm = extract_algorithm(&s, "algorithm");
-+    if (algorithm == ALG_UNSUPPORTED)   return NULL;
-+    rr->algorithm = algorithm;
-+
-+    digest_type = extract_integer(&s, "digest type", NULL);
-+    if (digest_type < 0)    return NULL;
-+    rr->digest_type = digest_type;
-+
-+    rr->digest = extract_hex_binary_data(&s, "digest", EXTRACT_EAT_WHITESPACE);
-+    if (rr->digest.length < 0)  return NULL;
-+
-+    switch (digest_type) {
-+    case 1:
-+        if (rr->digest.length != SHA1_BYTES) {
-+            return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES);
-+        }
-+        break;
-+    case 2:
-+        if (rr->digest.length != SHA256_BYTES) {
-+            return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES);
-+        }
-+        break;
-+    case 3:
-+        if (rr->digest.length != GOST_BYTES) {
-+            return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES);
-+        }
-+        break;
-+    case 4:
-+        if (rr->digest.length != SHA384_BYTES) {
-+            return bitch("wrong SHA-384 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA384_BYTES);
-+        }
-+        break;
-+    default:
-+        return bitch("bad or unsupported digest type %d", digest_type);
-+    }
-+
-+    if (*s) {
-+        return bitch("garbage after valid DLV data");
-+    }
-+    G.dnssec_active = 1;
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* dlv_human(struct rr *rrv)
- {
--	RRCAST(dlv);
-+    RRCAST(dlv);
-     char ss[4096];
--	char *s = ss;
--	int l;
--	int i;
-+    char *s = ss;
-+    int l;
-+    int i;
- 
-     l = snprintf(s, 4096, "%u %u %u ", rr->key_tag, rr->algorithm, rr->digest_type);
--	s += l;
--	for (i = 0; i < rr->digest.length; i++) {
--		l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->digest.data[i]);
--		s += l;
--	}
-+    s += l;
-+    for (i = 0; i < rr->digest.length; i++) {
-+        l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->digest.data[i]);
-+        s += l;
-+    }
-     return quickstrdup_temp(ss);
- }
- 
- static struct binary_data dlv_wirerdata(struct rr *rrv)
- {
--	RRCAST(dlv);
-+    RRCAST(dlv);
- 
--	return compose_binary_data("211d", 1,
--		rr->key_tag, rr->algorithm, rr->digest_type,
--		rr->digest);
-+    return compose_binary_data("211d", 1,
-+        rr->key_tag, rr->algorithm, rr->digest_type,
-+        rr->digest);
- }
- 
- struct rr_methods dlv_methods = { dlv_parse, dlv_human, dlv_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/dname.c validns/dname.c
---- validns-0.8/dname.c	2014-02-11 15:46:14.000000000 -0500
-+++ validns/dname.c	2020-10-05 16:59:29.354681360 -0400
-@@ -21,66 +21,66 @@
- 
- static struct rr *dname_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_dname *rr = getmem(sizeof(*rr));
-+    struct rr_dname *rr = getmem(sizeof(*rr));
- 
--	rr->target = extract_name(&s, "dname target", 0);
--	if (!rr->target)
--		return NULL;
--	if (*s) {
--		return bitch("garbage after valid DNAME data");
--	}
-+    rr->target = extract_name(&s, "dname target", 0);
-+    if (!rr->target)
-+        return NULL;
-+    if (*s) {
-+        return bitch("garbage after valid DNAME data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* dname_human(struct rr *rrv)
- {
--	RRCAST(dname);
-+    RRCAST(dname);
-     return rr->target;
- }
- 
- static struct binary_data dname_wirerdata(struct rr *rrv)
- {
--	RRCAST(dname);
--	return name2wire_name(rr->target);
-+    RRCAST(dname);
-+    return name2wire_name(rr->target);
- }
- 
- static void* dname_validate_set(struct rr_set *rr_set)
- {
--	struct rr *rr;
--	struct rr_set *suspect;
--	int count;
--	struct named_rr *named_rr, *next_named_rr;
--
--	if (G.opt.policy_checks[POLICY_DNAME]) {
--		named_rr = rr_set->named_rr;
--		rr = rr_set->tail;
--		if (rr_set->count > 1)
--			return moan(rr->file_name, rr->line, "multiple DNAMEs");
--		/* This check is already handled by "CNAME and other data" in cname.c *
--		another_set = find_rr_set_in_named_rr(named_rr, T_CNAME);
--		if (another_set)
--			return moan(rr->file_name, rr->line, "DNAME cannot co-exist with a CNAME");
--		*/
--		next_named_rr = find_next_named_rr(named_rr);
--		/* handle http://tools.ietf.org/html/rfc5155#section-10.2 case */
--		if (next_named_rr && next_named_rr->parent == named_rr && (named_rr->flags & NAME_FLAG_APEX)) {
--			count = get_rr_set_count(next_named_rr);
--			if (count > 0) {
--				suspect = find_rr_set_in_named_rr(next_named_rr, T_RRSIG);
--				if (suspect)	count--;
--				suspect = find_rr_set_in_named_rr(next_named_rr, T_NSEC3);
--				if (suspect)	count--;
--				if (count == 0)
--					next_named_rr = find_next_named_rr(next_named_rr);
--			}
--		}
--		if (next_named_rr && next_named_rr->parent == named_rr)
--			return moan(rr->file_name, rr->line,
--						"DNAME must not have any children (but %s exists)",
--						next_named_rr->name);
--	}
--	return NULL;
-+    struct rr *rr;
-+    struct rr_set *suspect;
-+    int count;
-+    struct named_rr *named_rr, *next_named_rr;
-+
-+    if (G.opt.policy_checks[POLICY_DNAME]) {
-+        named_rr = rr_set->named_rr;
-+        rr = rr_set->tail;
-+        if (rr_set->count > 1)
-+            return moan(rr->file_name, rr->line, "multiple DNAMEs");
-+        /* This check is already handled by "CNAME and other data" in cname.c *
-+        another_set = find_rr_set_in_named_rr(named_rr, T_CNAME);
-+        if (another_set)
-+            return moan(rr->file_name, rr->line, "DNAME cannot co-exist with a CNAME");
-+        */
-+        next_named_rr = find_next_named_rr(named_rr);
-+        /* handle http://tools.ietf.org/html/rfc5155#section-10.2 case */
-+        if (next_named_rr && next_named_rr->parent == named_rr && (named_rr->flags & NAME_FLAG_APEX)) {
-+            count = get_rr_set_count(next_named_rr);
-+            if (count > 0) {
-+                suspect = find_rr_set_in_named_rr(next_named_rr, T_RRSIG);
-+                if (suspect)    count--;
-+                suspect = find_rr_set_in_named_rr(next_named_rr, T_NSEC3);
-+                if (suspect)    count--;
-+                if (count == 0)
-+                    next_named_rr = find_next_named_rr(next_named_rr);
-+            }
-+        }
-+        if (next_named_rr && next_named_rr->parent == named_rr)
-+            return moan(rr->file_name, rr->line,
-+                        "DNAME must not have any children (but %s exists)",
-+                        next_named_rr->name);
-+    }
-+    return NULL;
- }
- 
- struct rr_methods dname_methods = { dname_parse, dname_human, dname_wirerdata, dname_validate_set, NULL };
-diff -Naur validns-0.8/dnskey.c validns/dnskey.c
---- validns-0.8/dnskey.c	2020-10-05 16:57:07.219376944 -0400
-+++ validns/dnskey.c	2020-10-05 16:59:48.870860473 -0400
-@@ -13,6 +13,8 @@
- #include <openssl/bn.h>
- #include <openssl/evp.h>
- #include <openssl/rsa.h>
-+#include <openssl/ec.h>
-+#include <openssl/sha.h>
- 
- #include "common.h"
- #include "textparse.h"
-@@ -20,172 +22,239 @@
- #include "carp.h"
- #include "rr.h"
- 
--static struct rr* dnskey_parse(char *name, long ttl, int type, char *s)
-+static struct rr_dnskey *all_dns_keys = NULL;
-+
-+static struct rr* dnskey_cdnskey_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_dnskey *rr = getmem(sizeof(*rr));
--	struct binary_data key;
--	int flags, proto, algorithm;
--	unsigned int ac;
--	int i;
--
--	flags = extract_integer(&s, "flags");
--	if (flags < 0) return NULL;
--	if (flags & 0xfefe)
--		return bitch("reserved flags bits are set");
--	if (flags & 0x0001 && !(flags & 0x0100))
--		return bitch("SEP bit is set but Zone Key bit is unset");
--	rr->flags = flags;
--
--	/* TODO validate that `name` is the name of the zone if flags have Zone Key bit set */
--
--	proto = extract_integer(&s, "protocol");
--	if (proto < 0) return NULL;
--	if (proto != 3)
--		return bitch("bad protocol value");
--	rr->protocol = proto;
--
--	algorithm = extract_algorithm(&s, "algorithm");
--	if (algorithm == ALG_UNSUPPORTED)	return NULL;
--	if (algorithm == ALG_PRIVATEDNS || algorithm == ALG_PRIVATEOID) {
--		return bitch("private algorithms are not supported in DNSKEY");
--	}
--	rr->algorithm = algorithm;
--
--	key = extract_base64_binary_data(&s, "public key");
--	if (key.length < 0)	return NULL;
--	/* TODO validate key length based on algorithm */
--	rr->pubkey = key;
--
--	ac = 0;
--	ac += rr->flags;
--	ac += rr->protocol << 8;
--	ac += rr->algorithm;
--	for (i = 0; i < rr->pubkey.length; i++) {
--		ac += (i & 1) ? (unsigned char)rr->pubkey.data[i] : ((unsigned char)rr->pubkey.data[i]) << 8;
--	}
--	ac += (ac >> 16) & 0xFFFF;
--	rr->key_tag = ac & 0xFFFF;
--
--	rr->pkey_built = 0;
--	rr->pkey = NULL;
--
--	if (*s) {
--		return bitch("garbage after valid DNSKEY data");
--	}
--	return store_record(type, name, ttl, rr);
-+    struct rr_dnskey *rr = getmem(sizeof(*rr));
-+    struct binary_data key;
-+    int flags, proto, algorithm;
-+    unsigned int ac;
-+    int i;
-+    static struct rr *result;
-+
-+    flags = extract_integer(&s, "flags", NULL);
-+    if (flags < 0) return NULL;
-+    if (flags & 0xfe7e)
-+        return bitch("reserved flags bits are set");
-+    if (flags & 0x0001 && !(flags & 0x0100))
-+        return bitch("SEP bit is set but Zone Key bit is unset");
-+    rr->flags = flags;
-+
-+    /* TODO validate that `name` is the name of the zone if flags have Zone Key bit set */
-+
-+    proto = extract_integer(&s, "protocol", NULL);
-+    if (proto < 0) return NULL;
-+    if (proto != 3)
-+        return bitch("bad protocol value");
-+    rr->protocol = proto;
-+
-+    algorithm = extract_algorithm(&s, "algorithm");
-+    if (algorithm == ALG_UNSUPPORTED)   return NULL;
-+    if (algorithm == ALG_PRIVATEDNS || algorithm == ALG_PRIVATEOID) {
-+        return bitch("private algorithms are not supported in %s", type == T_CDNSKEY ? "CDNSKEY" : "DNSKEY");
-+    }
-+    rr->algorithm = algorithm;
-+
-+    key = extract_base64_binary_data(&s, "public key");
-+    if (key.length < 0) return NULL;
-+    /* TODO validate key length based on algorithm */
-+    rr->pubkey = key;
-+
-+    ac = 0;
-+    ac += rr->flags;
-+    ac += rr->protocol << 8;
-+    ac += rr->algorithm;
-+    for (i = 0; i < rr->pubkey.length; i++) {
-+        ac += (i & 1) ? (unsigned char)rr->pubkey.data[i] : ((unsigned char)rr->pubkey.data[i]) << 8;
-+    }
-+    ac += (ac >> 16) & 0xFFFF;
-+    rr->key_tag = ac & 0xFFFF;
-+
-+    rr->pkey_built = 0;
-+    rr->pkey = NULL;
-+    rr->key_type = KEY_TYPE_UNUSED;
-+
-+    if (*s) {
-+        return bitch("garbage after valid %s data", type == T_CDNSKEY ? "CDNSKEY" : "DNSKEY");
-+    }
-+    result = store_record(type, name, ttl, rr);
-+    if (result && type == T_DNSKEY) {
-+        rr->next_key = all_dns_keys;
-+        all_dns_keys = rr;
-+    }
-+    return result;
- }
- 
--static char* dnskey_human(struct rr *rrv)
-+static char* dnskey_cdnskey_human(struct rr *rrv)
- {
--	RRCAST(dnskey);
-+    RRCAST(dnskey);
-     char s[1024];
- 
-     snprintf(s, 1024, "%hu %d %d XXX ; key id = %hu",
--			 rr->flags, rr->protocol, rr->algorithm, rr->key_tag);
-+             rr->flags, rr->protocol, rr->algorithm, rr->key_tag);
-     return quickstrdup_temp(s);
- }
- 
--static struct binary_data dnskey_wirerdata(struct rr *rrv)
-+static struct binary_data dnskey_cdnskey_wirerdata(struct rr *rrv)
-+{
-+    RRCAST(dnskey);
-+
-+    return compose_binary_data("211d", 1,
-+        rr->flags, rr->protocol, rr->algorithm,
-+        rr->pubkey);
-+}
-+
-+static void *dnskey_cdnskey_validate(struct rr *rrv)
- {
--	RRCAST(dnskey);
-+    RRCAST(dnskey);
- 
--	return compose_binary_data("211d", 1,
--		rr->flags, rr->protocol, rr->algorithm,
--		rr->pubkey);
--}
--
--static void *dnskey_validate(struct rr *rrv)
--{
--	RRCAST(dnskey);
--
--	if (G.opt.policy_checks[POLICY_DNSKEY]) {
--		if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) {
--			unsigned int e_bytes;
--			unsigned char *pk;
--			int l;
--
--			pk = (unsigned char *)rr->pubkey.data;
--			l = rr->pubkey.length;
--
--			e_bytes = *pk++;
--			l--;
--			if (e_bytes == 0) {
--				if (l < 2)
--					return moan(rr->rr.file_name, rr->rr.line, "public key is too short");
--				e_bytes = (*pk++)  << 8;
--				e_bytes += *pk++;
--				l -= 2;
--			}
--			if (l < e_bytes)
--				return moan(rr->rr.file_name, rr->rr.line, "public key is too short");
--
--			if (*pk == 0)
--				return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in public key exponent");
--			pk += e_bytes;
--			l -= e_bytes;
--			if (l > 0 && *pk == 0)
--				return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in key modulus");
--		}
--	}
--	return NULL;
-+    if (G.opt.policy_checks[POLICY_DNSKEY]) {
-+        if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) {
-+            unsigned int e_bytes;
-+            unsigned char *pk;
-+            int l;
-+
-+            pk = (unsigned char *)rr->pubkey.data;
-+            l = rr->pubkey.length;
-+
-+            e_bytes = *pk++;
-+            l--;
-+            if (e_bytes == 0) {
-+                if (l < 2)
-+                    return moan(rr->rr.file_name, rr->rr.line, "public key is too short");
-+                e_bytes = (*pk++)  << 8;
-+                e_bytes += *pk++;
-+                l -= 2;
-+            }
-+            if (l < e_bytes)
-+                return moan(rr->rr.file_name, rr->rr.line, "public key is too short");
-+
-+            if (*pk == 0)
-+                return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in public key exponent");
-+            pk += e_bytes;
-+            l -= e_bytes;
-+            if (l > 0 && *pk == 0)
-+                return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in key modulus");
-+        }
-+    }
-+    return NULL;
- }
- 
--struct rr_methods dnskey_methods = { dnskey_parse, dnskey_human, dnskey_wirerdata, NULL, dnskey_validate };
-+struct rr_methods dnskey_methods = { dnskey_cdnskey_parse, dnskey_cdnskey_human, dnskey_cdnskey_wirerdata, NULL, dnskey_cdnskey_validate };
-+struct rr_methods cdnskey_methods = { dnskey_cdnskey_parse, dnskey_cdnskey_human, dnskey_cdnskey_wirerdata, NULL, dnskey_cdnskey_validate };
- 
- int dnskey_build_pkey(struct rr_dnskey *rr)
- {
--	if (rr->pkey_built)
--		return rr->pkey ? 1 : 0;
-+    if (rr->pkey_built)
-+        return rr->pkey ? 1 : 0;
- 
--	rr->pkey_built = 1;
-+    rr->pkey_built = 1;
- 
--	if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) {
--		RSA *rsa;
--		EVP_PKEY *pkey;
--		unsigned int e_bytes;
--		unsigned char *pk;
--		int l;
-+    if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) {
-+        RSA *rsa;
-+        EVP_PKEY *pkey;
-+        unsigned int e_bytes;
-+        unsigned char *pk;
-+        int l;
- 	BIGNUM *n, *e;
- 
--		rsa = RSA_new();
--		if (!rsa)
--			goto done;
--
--		pk = (unsigned char *)rr->pubkey.data;
--		l = rr->pubkey.length;
--
--		e_bytes = *pk++;
--		l--;
--		if (e_bytes == 0) {
--			if (l < 2) /* public key is too short */
--				goto done;
--			e_bytes = (*pk++)  << 8;
--			e_bytes += *pk++;
--			l -= 2;
--		}
--		if (l < e_bytes) /* public key is too short */
--			goto done;
-+        rsa = RSA_new();
-+        if (!rsa)
-+            goto done;
-+
-+        pk = (unsigned char *)rr->pubkey.data;
-+        l = rr->pubkey.length;
-+
-+        e_bytes = *pk++;
-+        l--;
-+        if (e_bytes == 0) {
-+            if (l < 2) /* public key is too short */
-+                goto done;
-+            e_bytes = (*pk++)  << 8;
-+            e_bytes += *pk++;
-+            l -= 2;
-+        }
-+        if (l < e_bytes) /* public key is too short */
-+            goto done;
- 
-         e = BN_bin2bn(pk, e_bytes, NULL);
--		pk += e_bytes;
--		l -= e_bytes;
-+        pk += e_bytes;
-+        l -= e_bytes;
- 
- 	n = BN_bin2bn(pk, l, NULL);
- 	RSA_set0_key(rsa, n, e, NULL);
- 
--		pkey = EVP_PKEY_new();
--		if (!pkey)
--			goto done;
-+        pkey = EVP_PKEY_new();
-+        if (!pkey)
-+            goto done;
-+
-+        if (!EVP_PKEY_set1_RSA(pkey, rsa))
-+            goto done;
-+
-+        rr->pkey = pkey;
-+    } else if (algorithm_type(rr->algorithm) == ALG_ECC_FAMILY) {
-+        EC_KEY *pubeckey;
-+        EVP_PKEY *pkey;
-+        unsigned char *pk;
-+        int l;
-+        BIGNUM *bn_x = NULL;
-+        BIGNUM *bn_y = NULL;
-+
-+        if (rr->algorithm == ALG_ECDSAP256SHA256) {
-+            l = SHA256_DIGEST_LENGTH;
-+            pubeckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
-+        } else if (rr->algorithm == ALG_ECDSAP384SHA384) {
-+            l = SHA384_DIGEST_LENGTH;
-+            pubeckey = EC_KEY_new_by_curve_name(NID_secp384r1);
-+        } else {
-+            goto done;
-+        }
-+
-+        if (!pubeckey)
-+            goto done;
-+
-+        if (rr->pubkey.length != 2*l) {
-+            goto done;
-+        }
-+
-+        pk = (unsigned char *)rr->pubkey.data;
-+
-+        bn_x = BN_bin2bn(pk, l, NULL);
-+        bn_y = BN_bin2bn(&pk[l], l, NULL);
-+
-+        if (1 != EC_KEY_set_public_key_affine_coordinates(pubeckey, bn_x, bn_y)) {
-+            goto done;
-+        }
-+
-+        pkey = EVP_PKEY_new();
-+        if (!pkey)
-+            goto done;
- 
--		if (!EVP_PKEY_set1_RSA(pkey, rsa))
--			goto done;
-+        if (!EVP_PKEY_assign_EC_KEY(pkey, pubeckey))
-+            goto done;
- 
--		rr->pkey = pkey;
--	}
-+        rr->pkey = pkey;
-+    }
- done:
--	if (!rr->pkey) {
--		moan(rr->rr.file_name, rr->rr.line, "error building pkey");
--	}
--	return rr->pkey ? 1 : 0;
-+    if (!rr->pkey) {
-+        moan(rr->rr.file_name, rr->rr.line, "error building pkey");
-+    }
-+    return rr->pkey ? 1 : 0;
-+}
-+
-+void
-+dnskey_ksk_policy_check(void)
-+{
-+    struct rr_dnskey *rr = all_dns_keys;
-+    int ksk_found = 0;
-+
-+    while (rr) {
-+        if (rr->key_type == KEY_TYPE_KSK)
-+            ksk_found = 1;
-+        rr = rr->next_key;
-+    }
-+    if (!ksk_found)
-+        moan(all_dns_keys->rr.file_name, all_dns_keys->rr.line, "No KSK found");
- }
- 
-diff -Naur validns-0.8/dnskey.c.orig validns/dnskey.c.orig
---- validns-0.8/dnskey.c.orig	2014-02-11 15:45:11.000000000 -0500
-+++ validns/dnskey.c.orig	1969-12-31 19:00:00.000000000 -0500
-@@ -1,189 +0,0 @@
--/*
-- * Part of DNS zone file validator `validns`.
-- *
-- * Copyright 2011-2014 Anton Berezin <tobez@tobez.org>
-- * Modified BSD license.
-- * (See LICENSE file in the distribution.)
-- *
-- */
--#include <sys/types.h>
--#include <stdio.h>
--#include <netinet/in.h>
--#include <arpa/inet.h>
--#include <openssl/bn.h>
--#include <openssl/evp.h>
--#include <openssl/rsa.h>
--
--#include "common.h"
--#include "textparse.h"
--#include "mempool.h"
--#include "carp.h"
--#include "rr.h"
--
--static struct rr* dnskey_parse(char *name, long ttl, int type, char *s)
--{
--	struct rr_dnskey *rr = getmem(sizeof(*rr));
--	struct binary_data key;
--	int flags, proto, algorithm;
--	unsigned int ac;
--	int i;
--
--	flags = extract_integer(&s, "flags");
--	if (flags < 0) return NULL;
--	if (flags & 0xfefe)
--		return bitch("reserved flags bits are set");
--	if (flags & 0x0001 && !(flags & 0x0100))
--		return bitch("SEP bit is set but Zone Key bit is unset");
--	rr->flags = flags;
--
--	/* TODO validate that `name` is the name of the zone if flags have Zone Key bit set */
--
--	proto = extract_integer(&s, "protocol");
--	if (proto < 0) return NULL;
--	if (proto != 3)
--		return bitch("bad protocol value");
--	rr->protocol = proto;
--
--	algorithm = extract_algorithm(&s, "algorithm");
--	if (algorithm == ALG_UNSUPPORTED)	return NULL;
--	if (algorithm == ALG_PRIVATEDNS || algorithm == ALG_PRIVATEOID) {
--		return bitch("private algorithms are not supported in DNSKEY");
--	}
--	rr->algorithm = algorithm;
--
--	key = extract_base64_binary_data(&s, "public key");
--	if (key.length < 0)	return NULL;
--	/* TODO validate key length based on algorithm */
--	rr->pubkey = key;
--
--	ac = 0;
--	ac += rr->flags;
--	ac += rr->protocol << 8;
--	ac += rr->algorithm;
--	for (i = 0; i < rr->pubkey.length; i++) {
--		ac += (i & 1) ? (unsigned char)rr->pubkey.data[i] : ((unsigned char)rr->pubkey.data[i]) << 8;
--	}
--	ac += (ac >> 16) & 0xFFFF;
--	rr->key_tag = ac & 0xFFFF;
--
--	rr->pkey_built = 0;
--	rr->pkey = NULL;
--
--	if (*s) {
--		return bitch("garbage after valid DNSKEY data");
--	}
--	return store_record(type, name, ttl, rr);
--}
--
--static char* dnskey_human(struct rr *rrv)
--{
--	RRCAST(dnskey);
--    char s[1024];
--
--    snprintf(s, 1024, "%hu %d %d XXX ; key id = %hu",
--			 rr->flags, rr->protocol, rr->algorithm, rr->key_tag);
--    return quickstrdup_temp(s);
--}
--
--static struct binary_data dnskey_wirerdata(struct rr *rrv)
--{
--	RRCAST(dnskey);
--
--	return compose_binary_data("211d", 1,
--		rr->flags, rr->protocol, rr->algorithm,
--		rr->pubkey);
--}
--
--static void *dnskey_validate(struct rr *rrv)
--{
--	RRCAST(dnskey);
--
--	if (G.opt.policy_checks[POLICY_DNSKEY]) {
--		if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) {
--			unsigned int e_bytes;
--			unsigned char *pk;
--			int l;
--
--			pk = (unsigned char *)rr->pubkey.data;
--			l = rr->pubkey.length;
--
--			e_bytes = *pk++;
--			l--;
--			if (e_bytes == 0) {
--				if (l < 2)
--					return moan(rr->rr.file_name, rr->rr.line, "public key is too short");
--				e_bytes = (*pk++)  << 8;
--				e_bytes += *pk++;
--				l -= 2;
--			}
--			if (l < e_bytes)
--				return moan(rr->rr.file_name, rr->rr.line, "public key is too short");
--
--			if (*pk == 0)
--				return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in public key exponent");
--			pk += e_bytes;
--			l -= e_bytes;
--			if (l > 0 && *pk == 0)
--				return moan(rr->rr.file_name, rr->rr.line, "leading zero octets in key modulus");
--		}
--	}
--	return NULL;
--}
--
--struct rr_methods dnskey_methods = { dnskey_parse, dnskey_human, dnskey_wirerdata, NULL, dnskey_validate };
--
--int dnskey_build_pkey(struct rr_dnskey *rr)
--{
--	if (rr->pkey_built)
--		return rr->pkey ? 1 : 0;
--
--	rr->pkey_built = 1;
--
--	if (algorithm_type(rr->algorithm) == ALG_RSA_FAMILY) {
--		RSA *rsa;
--		EVP_PKEY *pkey;
--		unsigned int e_bytes;
--		unsigned char *pk;
--		int l;
--
--		rsa = RSA_new();
--		if (!rsa)
--			goto done;
--
--		pk = (unsigned char *)rr->pubkey.data;
--		l = rr->pubkey.length;
--
--		e_bytes = *pk++;
--		l--;
--		if (e_bytes == 0) {
--			if (l < 2) /* public key is too short */
--				goto done;
--			e_bytes = (*pk++)  << 8;
--			e_bytes += *pk++;
--			l -= 2;
--		}
--		if (l < e_bytes) /* public key is too short */
--			goto done;
--
--		rsa->e = BN_bin2bn(pk, e_bytes, NULL);
--		pk += e_bytes;
--		l -= e_bytes;
--
--		rsa->n = BN_bin2bn(pk, l, NULL);
--
--		pkey = EVP_PKEY_new();
--		if (!pkey)
--			goto done;
--
--		if (!EVP_PKEY_set1_RSA(pkey, rsa))
--			goto done;
--
--		rr->pkey = pkey;
--	}
--done:
--	if (!rr->pkey) {
--		moan(rr->rr.file_name, rr->rr.line, "error building pkey");
--	}
--	return rr->pkey ? 1 : 0;
--}
--
-diff -Naur validns-0.8/ds.c validns/ds.c
---- validns-0.8/ds.c	2014-02-11 15:44:59.000000000 -0500
-+++ validns/ds.c	2020-10-05 16:59:29.354681360 -0400
-@@ -17,83 +17,84 @@
- #include "carp.h"
- #include "rr.h"
- 
--static struct rr* ds_parse(char *name, long ttl, int type, char *s)
-+static struct rr* ds_cds_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_ds *rr = getmem(sizeof(*rr));
--	int key_tag, algorithm, digest_type;
-+    struct rr_ds *rr = getmem(sizeof(*rr));
-+    int key_tag, algorithm, digest_type;
- 
--	key_tag = extract_integer(&s, "key tag");
--	if (key_tag < 0)	return NULL;
--	rr->key_tag = key_tag;
--
--	algorithm = extract_algorithm(&s, "algorithm");
--	if (algorithm == ALG_UNSUPPORTED)	return NULL;
--	rr->algorithm = algorithm;
--
--	digest_type = extract_integer(&s, "digest type");
--	if (digest_type < 0)	return NULL;
--	rr->digest_type = digest_type;
--
--	rr->digest = extract_hex_binary_data(&s, "digest", EXTRACT_EAT_WHITESPACE);
--	if (rr->digest.length < 0)	return NULL;
--
--	/* See http://www.iana.org/assignments/ds-rr-types/ds-rr-types.xml
--	 * for valid digest types. */
--	switch (digest_type) {
--	case 1:
--		if (rr->digest.length != SHA1_BYTES) {
--			return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES);
--		}
--		break;
--	case 2:
--		if (rr->digest.length != SHA256_BYTES) {
--			return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES);
--		}
--		break;
--	case 3:
--		if (rr->digest.length != GOST_BYTES) {
--			return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES);
--		}
--		break;
--	case 4:
--		if (rr->digest.length != SHA384_BYTES) {
--			return bitch("wrong SHA-384 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA384_BYTES);
--		}
--		break;
--	default:
--		return bitch("bad or unsupported digest type %d", digest_type);
--	}
--
--	if (*s) {
--		return bitch("garbage after valid DS data");
--	}
--	return store_record(type, name, ttl, rr);
-+    key_tag = extract_integer(&s, "key tag", NULL);
-+    if (key_tag < 0)    return NULL;
-+    rr->key_tag = key_tag;
-+
-+    algorithm = extract_algorithm(&s, "algorithm");
-+    if (algorithm == ALG_UNSUPPORTED)   return NULL;
-+    rr->algorithm = algorithm;
-+
-+    digest_type = extract_integer(&s, "digest type", NULL);
-+    if (digest_type < 0)    return NULL;
-+    rr->digest_type = digest_type;
-+
-+    rr->digest = extract_hex_binary_data(&s, "digest", EXTRACT_EAT_WHITESPACE);
-+    if (rr->digest.length < 0)  return NULL;
-+
-+    /* See http://www.iana.org/assignments/ds-rr-types/ds-rr-types.xml
-+     * for valid digest types. */
-+    switch (digest_type) {
-+    case 1:
-+        if (rr->digest.length != SHA1_BYTES) {
-+            return bitch("wrong SHA-1 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA1_BYTES);
-+        }
-+        break;
-+    case 2:
-+        if (rr->digest.length != SHA256_BYTES) {
-+            return bitch("wrong SHA-256 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA256_BYTES);
-+        }
-+        break;
-+    case 3:
-+        if (rr->digest.length != GOST_BYTES) {
-+            return bitch("wrong GOST R 34.11-94 digest length: %d bytes found, %d bytes expected", rr->digest.length, GOST_BYTES);
-+        }
-+        break;
-+    case 4:
-+        if (rr->digest.length != SHA384_BYTES) {
-+            return bitch("wrong SHA-384 digest length: %d bytes found, %d bytes expected", rr->digest.length, SHA384_BYTES);
-+        }
-+        break;
-+    default:
-+        return bitch("bad or unsupported digest type %d", digest_type);
-+    }
-+
-+    if (*s) {
-+        return bitch("garbage after valid %s data", type == T_CDS ? "CDS" : "DS");
-+    }
-+    return store_record(type, name, ttl, rr);
- }
- 
--static char* ds_human(struct rr *rrv)
-+static char* ds_cds_human(struct rr *rrv)
- {
--	RRCAST(ds);
-+    RRCAST(ds);
-     char ss[4096];
--	char *s = ss;
--	int l;
--	int i;
-+    char *s = ss;
-+    int l;
-+    int i;
- 
-     l = snprintf(s, 4096, "%u %u %u ", rr->key_tag, rr->algorithm, rr->digest_type);
--	s += l;
--	for (i = 0; i < rr->digest.length; i++) {
--		l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->digest.data[i]);
--		s += l;
--	}
-+    s += l;
-+    for (i = 0; i < rr->digest.length; i++) {
-+        l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->digest.data[i]);
-+        s += l;
-+    }
-     return quickstrdup_temp(ss);
- }
- 
--static struct binary_data ds_wirerdata(struct rr *rrv)
-+static struct binary_data ds_cds_wirerdata(struct rr *rrv)
- {
--	RRCAST(ds);
-+    RRCAST(ds);
- 
--	return compose_binary_data("211d", 1,
--		rr->key_tag, rr->algorithm, rr->digest_type,
--		rr->digest);
-+    return compose_binary_data("211d", 1,
-+        rr->key_tag, rr->algorithm, rr->digest_type,
-+        rr->digest);
- }
- 
--struct rr_methods ds_methods = { ds_parse, ds_human, ds_wirerdata, NULL, NULL };
-+struct rr_methods ds_methods = { ds_cds_parse, ds_cds_human, ds_cds_wirerdata, NULL, NULL };
-+struct rr_methods cds_methods = { ds_cds_parse, ds_cds_human, ds_cds_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/hinfo.c validns/hinfo.c
---- validns-0.8/hinfo.c	2014-02-11 15:45:14.000000000 -0500
-+++ validns/hinfo.c	2020-10-05 16:59:29.354681360 -0400
-@@ -20,30 +20,30 @@
- 
- static struct rr *hinfo_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_hinfo *rr = getmem(sizeof(*rr));
-+    struct rr_hinfo *rr = getmem(sizeof(*rr));
- 
--	rr->cpu = extract_text(&s, "CPU");
--	if (rr->cpu.length < 0)
--		return NULL;
--	if (rr->cpu.length > 255)
--		return bitch("CPU string is too long");
--
--	rr->os = extract_text(&s, "OS");
--	if (rr->os.length < 0)
--		return NULL;
--	if (rr->os.length > 255)
--		return bitch("OS string is too long");
--
--	if (*s) {
--		return bitch("garbage after valid HINFO data");
--	}
-+    rr->cpu = extract_text(&s, "CPU");
-+    if (rr->cpu.length < 0)
-+        return NULL;
-+    if (rr->cpu.length > 255)
-+        return bitch("CPU string is too long");
-+
-+    rr->os = extract_text(&s, "OS");
-+    if (rr->os.length < 0)
-+        return NULL;
-+    if (rr->os.length > 255)
-+        return bitch("OS string is too long");
-+
-+    if (*s) {
-+        return bitch("garbage after valid HINFO data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* hinfo_human(struct rr *rrv)
- {
--	RRCAST(hinfo);
-+    RRCAST(hinfo);
-     char s[1024];
- 
-     snprintf(s, 1024, "\"%s\" \"%s\"", rr->cpu.data, rr->os.data);
-@@ -52,7 +52,7 @@
- 
- static struct binary_data hinfo_wirerdata(struct rr *rrv)
- {
--	RRCAST(hinfo);
-+    RRCAST(hinfo);
- 
-     return compose_binary_data("bb", 1, rr->cpu, rr->os);
- }
-diff -Naur validns-0.8/ipseckey.c validns/ipseckey.c
---- validns-0.8/ipseckey.c	2020-10-05 16:54:14.348790465 -0400
-+++ validns/ipseckey.c	2020-10-05 16:59:29.354681360 -0400
-@@ -21,157 +21,157 @@
- 
- static struct rr *ipseckey_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_ipseckey *rr = getmem(sizeof(*rr));
--	int i;
-+    struct rr_ipseckey *rr = getmem(sizeof(*rr));
-+    int i;
- 
--	rr->precedence = i = extract_integer(&s, "precedence");
--	if (i < 0)    return NULL;
--	if (i >= 256) return bitch("precedence range is not valid");
--
--	rr->gateway_type = i = extract_integer(&s, "gateway type");
--	if (i < 0) return NULL;
--	if (i > 3) return bitch("gateway type is not valid");
--
--	rr->algorithm = i = extract_integer(&s, "algorithm");
--	if (i < 0) return NULL;
--	if (i > 2) return bitch("algorithm is not valid");
--
--	switch (rr->gateway_type) {
--	case 0:
--		rr->gateway.gateway_none = extract_name(&s, "gateway/.", KEEP_CAPITALIZATION);
--		if (!rr->gateway.gateway_none) return NULL;
--		if (strcmp(rr->gateway.gateway_none, ".") != 0)
--			return bitch("gateway must be \".\" for gateway type 0");
--		break;
--	case 1:
--		if (extract_ipv4(&s, "gateway/IPv4", &rr->gateway.gateway_ipv4) <= 0)
--			return NULL;
--		break;
--	case 2:
--		if (extract_ipv6(&s, "gateway/IPv6", &rr->gateway.gateway_ipv6) <= 0)
--			return NULL;
--		break;
--	case 3:
--		rr->gateway.gateway_name = extract_name(&s, "gateway/name", KEEP_CAPITALIZATION);
--		if (!rr->gateway.gateway_name) return NULL;
--		break;
--	default:
--		croakx(7, "assertion failed: gateway type %d not within range", rr->gateway_type);
--	}
--
--	/* My reading of http://tools.ietf.org/html/rfc4025 is fuzzy on:
--	 *
--	 * - whether it is possible to have algorithm 0 and non-empty key;
--	 * - whether it is possible to have empty key and algorithm != 0.
--	 *
--	 * Here I assume "not possible" for both.
--	 */
--	switch (rr->algorithm) {
--	case 0:
--		break;
--	case 1:
--		/* DSA key */
--		rr->public_key = extract_base64_binary_data(&s, "public key");
--		if (rr->public_key.length < 0)     return NULL;
--		break;
--	case 2:
--		/* RSA key */
--		rr->public_key = extract_base64_binary_data(&s, "public key");
--		if (rr->public_key.length < 0)     return NULL;
--		break;
--	default:
--		croakx(7, "assertion failed: algorithm %d not within range", rr->algorithm);
--	}
--
--	if (*s) {
--		return bitch("garbage after valid IPSECKEY data");
--	}
-+    rr->precedence = i = extract_integer(&s, "precedence", NULL);
-+    if (i < 0)    return NULL;
-+    if (i >= 256) return bitch("precedence range is not valid");
-+
-+    rr->gateway_type = i = extract_integer(&s, "gateway type", NULL);
-+    if (i < 0) return NULL;
-+    if (i > 3) return bitch("gateway type is not valid");
-+
-+    rr->algorithm = i = extract_integer(&s, "algorithm", NULL);
-+    if (i < 0) return NULL;
-+    if (i > 2) return bitch("algorithm is not valid");
-+
-+    switch (rr->gateway_type) {
-+    case 0:
-+        rr->gateway.gateway_none = extract_name(&s, "gateway/.", KEEP_CAPITALIZATION);
-+        if (!rr->gateway.gateway_none) return NULL;
-+        if (strcmp(rr->gateway.gateway_none, ".") != 0)
-+            return bitch("gateway must be \".\" for gateway type 0");
-+        break;
-+    case 1:
-+        if (extract_ipv4(&s, "gateway/IPv4", &rr->gateway.gateway_ipv4) <= 0)
-+            return NULL;
-+        break;
-+    case 2:
-+        if (extract_ipv6(&s, "gateway/IPv6", &rr->gateway.gateway_ipv6) <= 0)
-+            return NULL;
-+        break;
-+    case 3:
-+        rr->gateway.gateway_name = extract_name(&s, "gateway/name", KEEP_CAPITALIZATION);
-+        if (!rr->gateway.gateway_name) return NULL;
-+        break;
-+    default:
-+        croakx(7, "assertion failed: gateway type %d not within range", rr->gateway_type);
-+    }
-+
-+    /* My reading of http://tools.ietf.org/html/rfc4025 is fuzzy on:
-+     *
-+     * - whether it is possible to have algorithm 0 and non-empty key;
-+     * - whether it is possible to have empty key and algorithm != 0.
-+     *
-+     * Here I assume "not possible" for both.
-+     */
-+    switch (rr->algorithm) {
-+    case 0:
-+        break;
-+    case 1:
-+        /* DSA key */
-+        rr->public_key = extract_base64_binary_data(&s, "public key");
-+        if (rr->public_key.length < 0)     return NULL;
-+        break;
-+    case 2:
-+        /* RSA key */
-+        rr->public_key = extract_base64_binary_data(&s, "public key");
-+        if (rr->public_key.length < 0)     return NULL;
-+        break;
-+    default:
-+        croakx(7, "assertion failed: algorithm %d not within range", rr->algorithm);
-+    }
-+
-+    if (*s) {
-+        return bitch("garbage after valid IPSECKEY data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* ipseckey_human(struct rr *rrv)
- {
--	RRCAST(ipseckey);
-+    RRCAST(ipseckey);
-     char s[1024], gw[1024];
- 
--	switch (rr->gateway_type) {
--	case 0:
--		strcpy(gw, rr->gateway.gateway_none);
--		break;
--	case 1:
--		inet_ntop(AF_INET, &rr->gateway.gateway_ipv4, gw, 2048);
--		break;
--	case 2:
--		inet_ntop(AF_INET6, &rr->gateway.gateway_ipv6, gw, 2048);
--		break;
--	case 3:
--		strcpy(gw, rr->gateway.gateway_name);
--		break;
--	default:
--		strcpy(gw, "??");
--	}
--    snprintf(s, 2048, "( %d %d %d %s ... )",
--	     rr->precedence, rr->gateway_type, rr->algorithm, gw);
-+    switch (rr->gateway_type) {
-+    case 0:
-+        strcpy(gw, rr->gateway.gateway_none);
-+        break;
-+    case 1:
-+        inet_ntop(AF_INET, &rr->gateway.gateway_ipv4, gw, 1024);
-+        break;
-+    case 2:
-+        inet_ntop(AF_INET6, &rr->gateway.gateway_ipv6, gw, 1024);
-+        break;
-+    case 3:
-+        strcpy(gw, rr->gateway.gateway_name);
-+        break;
-+    default:
-+        strcpy(gw, "??");
-+    }
-+    snprintf(s, 1024, "( %d %d %d %s ... )",
-+         rr->precedence, rr->gateway_type, rr->algorithm, gw);
-     return quickstrdup_temp(s);
- }
- 
- static struct binary_data ipseckey_wirerdata(struct rr *rrv)
- {
--	RRCAST(ipseckey);
--	struct binary_data helper;
-+    RRCAST(ipseckey);
-+    struct binary_data helper;
- 
--	switch (rr->gateway_type) {
--	case 0:
--		if (rr->algorithm != 0)
--			return compose_binary_data("111d", 1,
--				rr->precedence, rr->gateway_type, rr->algorithm,
--				rr->public_key);
--		else
--			return compose_binary_data("111", 1,
--				rr->precedence, rr->gateway_type, rr->algorithm);
--		break;
--	case 1:
--		helper.length = sizeof(rr->gateway.gateway_ipv4);
--		helper.data = (void *)&rr->gateway.gateway_ipv4;
--
--		if (rr->algorithm != 0)
--			return compose_binary_data("111dd", 1,
--				rr->precedence, rr->gateway_type, rr->algorithm,
--				helper,
--				rr->public_key);
--		else
--			return compose_binary_data("111d", 1,
--				rr->precedence, rr->gateway_type, rr->algorithm,
--				helper);
--		break;
--	case 2:
--
--		helper.length = sizeof(rr->gateway.gateway_ipv6);
--		helper.data = (void *)&rr->gateway.gateway_ipv6;
--
--		if (rr->algorithm != 0)
--			return compose_binary_data("111dd", 1,
--				rr->precedence, rr->gateway_type, rr->algorithm,
--				helper,
--				rr->public_key);
--		else
--			return compose_binary_data("111d", 1,
--				rr->precedence, rr->gateway_type, rr->algorithm,
--				helper);
--		break;
--	case 3:
--		if (rr->algorithm != 0)
--			return compose_binary_data("111dd", 1,
--				rr->precedence, rr->gateway_type, rr->algorithm,
--				name2wire_name(rr->gateway.gateway_name),
--				rr->public_key);
--		else
--			return compose_binary_data("111d", 1,
--				rr->precedence, rr->gateway_type, rr->algorithm,
--				name2wire_name(rr->gateway.gateway_name));
--		break;
--	}
-+    switch (rr->gateway_type) {
-+    case 0:
-+        if (rr->algorithm != 0)
-+            return compose_binary_data("111d", 1,
-+                rr->precedence, rr->gateway_type, rr->algorithm,
-+                rr->public_key);
-+        else
-+            return compose_binary_data("111", 1,
-+                rr->precedence, rr->gateway_type, rr->algorithm);
-+        break;
-+    case 1:
-+        helper.length = sizeof(rr->gateway.gateway_ipv4);
-+        helper.data = (void *)&rr->gateway.gateway_ipv4;
-+
-+        if (rr->algorithm != 0)
-+            return compose_binary_data("111dd", 1,
-+                rr->precedence, rr->gateway_type, rr->algorithm,
-+                helper,
-+                rr->public_key);
-+        else
-+            return compose_binary_data("111d", 1,
-+                rr->precedence, rr->gateway_type, rr->algorithm,
-+                helper);
-+        break;
-+    case 2:
-+
-+        helper.length = sizeof(rr->gateway.gateway_ipv6);
-+        helper.data = (void *)&rr->gateway.gateway_ipv6;
-+
-+        if (rr->algorithm != 0)
-+            return compose_binary_data("111dd", 1,
-+                rr->precedence, rr->gateway_type, rr->algorithm,
-+                helper,
-+                rr->public_key);
-+        else
-+            return compose_binary_data("111d", 1,
-+                rr->precedence, rr->gateway_type, rr->algorithm,
-+                helper);
-+        break;
-+    case 3:
-+        if (rr->algorithm != 0)
-+            return compose_binary_data("111dd", 1,
-+                rr->precedence, rr->gateway_type, rr->algorithm,
-+                name2wire_name(rr->gateway.gateway_name),
-+                rr->public_key);
-+        else
-+            return compose_binary_data("111d", 1,
-+                rr->precedence, rr->gateway_type, rr->algorithm,
-+                name2wire_name(rr->gateway.gateway_name));
-+        break;
-+    }
-     return bad_binary_data();
- }
- 
-diff -Naur validns-0.8/isdn.c validns/isdn.c
---- validns-0.8/isdn.c	2014-02-11 15:46:34.000000000 -0500
-+++ validns/isdn.c	2020-10-05 16:59:29.354681360 -0400
-@@ -23,52 +23,52 @@
- 
- static struct rr *isdn_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_isdn *rr = getmem(sizeof(*rr));
-+    struct rr_isdn *rr = getmem(sizeof(*rr));
- 
--	rr->isdn_address = extract_text(&s, "ISDN-address");
--	if (rr->isdn_address.length < 0)
--		return NULL;
--	if (rr->isdn_address.length > 255)
--		return bitch("ISDN-address too long");
--
--	rr->sa_present = 0;
--	if (*s) {
--		rr->sa = extract_text(&s, "subaddress");
--		if (rr->sa.length < 0)
--			return NULL;
--		if (rr->sa.length > 255)
--			return bitch("subaddress too long");
--		rr->sa_present = 1;
--	}
--
--	if (*s) {
--		return bitch("garbage after valid ISDN data");
--	}
-+    rr->isdn_address = extract_text(&s, "ISDN-address");
-+    if (rr->isdn_address.length < 0)
-+        return NULL;
-+    if (rr->isdn_address.length > 255)
-+        return bitch("ISDN-address too long");
-+
-+    rr->sa_present = 0;
-+    if (*s) {
-+        rr->sa = extract_text(&s, "subaddress");
-+        if (rr->sa.length < 0)
-+            return NULL;
-+        if (rr->sa.length > 255)
-+            return bitch("subaddress too long");
-+        rr->sa_present = 1;
-+    }
-+
-+    if (*s) {
-+        return bitch("garbage after valid ISDN data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* isdn_human(struct rr *rrv)
- {
--	RRCAST(isdn);
-+    RRCAST(isdn);
- 
-     return rr->isdn_address.data;
- }
- 
- static struct binary_data isdn_wirerdata(struct rr *rrv)
- {
--	RRCAST(isdn);
--	struct binary_data r, t;
-+    RRCAST(isdn);
-+    struct binary_data r, t;
- 
--	r = bad_binary_data();
--	t.length = 0;
--	t.data = NULL;
--	r = compose_binary_data("db", 1, t, rr->isdn_address);
--	t = r;
--	if (rr->sa_present) {
--		r = compose_binary_data("db", 1, t, rr->sa);
--		t = r;
--	}
-+    r = bad_binary_data();
-+    t.length = 0;
-+    t.data = NULL;
-+    r = compose_binary_data("db", 1, t, rr->isdn_address);
-+    t = r;
-+    if (rr->sa_present) {
-+        r = compose_binary_data("db", 1, t, rr->sa);
-+        t = r;
-+    }
-     return r;
- }
- 
-diff -Naur validns-0.8/kx.c validns/kx.c
---- validns-0.8/kx.c	2014-02-11 15:46:36.000000000 -0500
-+++ validns/kx.c	2020-10-05 16:59:29.354681360 -0400
-@@ -19,40 +19,40 @@
- 
- static struct rr *kx_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_kx *rr = getmem(sizeof(*rr));
-+    struct rr_kx *rr = getmem(sizeof(*rr));
- 
--	rr->preference = extract_integer(&s, "KX preference");
--	if (rr->preference < 0)
--		return NULL;
-+    rr->preference = extract_integer(&s, "KX preference", NULL);
-+    if (rr->preference < 0)
-+        return NULL;
- 
--	rr->exchanger = extract_name(&s, "KX exchanger", 0);
--	if (!rr->exchanger)
--		return NULL;
-+    rr->exchanger = extract_name(&s, "KX exchanger", 0);
-+    if (!rr->exchanger)
-+        return NULL;
- 
--	if (*s) {
--		return bitch("garbage after valid KX data");
--	}
-+    if (*s) {
-+        return bitch("garbage after valid KX data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* kx_human(struct rr *rrv)
- {
--	RRCAST(kx);
-+    RRCAST(kx);
-     char s[1024];
- 
-     snprintf(s, 1024, "%d %s",
--	     rr->preference, rr->exchanger);
-+         rr->preference, rr->exchanger);
-     return quickstrdup_temp(s);
- }
- 
- static struct binary_data kx_wirerdata(struct rr *rrv)
- {
--	RRCAST(kx);
-+    RRCAST(kx);
- 
-     return compose_binary_data("2d", 1,
--		rr->preference,
--		name2wire_name(rr->exchanger));
-+        rr->preference,
-+        name2wire_name(rr->exchanger));
- }
- 
- struct rr_methods kx_methods = { kx_parse, kx_human, kx_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/l32.c validns/l32.c
---- validns-0.8/l32.c	2014-02-11 15:46:17.000000000 -0500
-+++ validns/l32.c	2020-10-05 16:59:29.354681360 -0400
-@@ -19,41 +19,41 @@
- 
- static struct rr *l32_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_l32 *rr = getmem(sizeof(*rr));
--	struct in_addr ipv4_like;
--	int preference;
--
--	rr->preference = preference = extract_integer(&s, "L32 preference");
--	if (preference < 0)
--		return NULL;
--	if (extract_ipv4(&s, "Locator32", &ipv4_like) <= 0)
--		return NULL;
--	rr->locator32 = ipv4_like.s_addr;
--
--	if (*s) {
--		return bitch("garbage after valid L32 data");
--	}
-+    struct rr_l32 *rr = getmem(sizeof(*rr));
-+    struct in_addr ipv4_like;
-+    int preference;
-+
-+    rr->preference = preference = extract_integer(&s, "L32 preference", NULL);
-+    if (preference < 0)
-+        return NULL;
-+    if (extract_ipv4(&s, "Locator32", &ipv4_like) <= 0)
-+        return NULL;
-+    rr->locator32 = ipv4_like.s_addr;
-+
-+    if (*s) {
-+        return bitch("garbage after valid L32 data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* l32_human(struct rr *rrv)
- {
--	RRCAST(l32);
-+    RRCAST(l32);
-     char s[1024];
- 
-     snprintf(s, 1024, "%d %d.%d.%d.%d",
--	     rr->preference,
--		 (rr->locator32 >> 24) & 0xff,
--		 (rr->locator32 >> 16) & 0xff,
--		 (rr->locator32 >> 8) & 0xff,
--		 (rr->locator32 >> 0) & 0xff);
-+         rr->preference,
-+         (rr->locator32 >> 24) & 0xff,
-+         (rr->locator32 >> 16) & 0xff,
-+         (rr->locator32 >> 8) & 0xff,
-+         (rr->locator32 >> 0) & 0xff);
-     return quickstrdup_temp(s);
- }
- 
- static struct binary_data l32_wirerdata(struct rr *rrv)
- {
--	RRCAST(l32);
-+    RRCAST(l32);
-     return compose_binary_data("24", 1, rr->preference, rr->locator32);
- }
- 
-diff -Naur validns-0.8/l64.c validns/l64.c
---- validns-0.8/l64.c	2014-02-11 15:46:18.000000000 -0500
-+++ validns/l64.c	2020-10-05 16:59:29.354681360 -0400
-@@ -19,39 +19,39 @@
- 
- static struct rr *l64_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_l64 *rr = getmem(sizeof(*rr));
--	int preference;
-+    struct rr_l64 *rr = getmem(sizeof(*rr));
-+    int preference;
- 
--	rr->preference = preference = extract_integer(&s, "L64 preference");
--	if (preference < 0)
--		return NULL;
--	if (extract_u64(&s, "Locator64", &rr->locator64) < 0)
--		return NULL;
--
--	if (*s) {
--		return bitch("garbage after valid L64 data");
--	}
-+    rr->preference = preference = extract_integer(&s, "L64 preference", NULL);
-+    if (preference < 0)
-+        return NULL;
-+    if (extract_u64(&s, "Locator64", &rr->locator64) < 0)
-+        return NULL;
-+
-+    if (*s) {
-+        return bitch("garbage after valid L64 data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* l64_human(struct rr *rrv)
- {
--	RRCAST(l64);
-+    RRCAST(l64);
-     char s[1024];
- 
-     snprintf(s, 1024, "%d %x:%x:%x:%x",
--	     rr->preference,
--		 (unsigned)(rr->locator64 >> 48) & 0xffff,
--		 (unsigned)(rr->locator64 >> 32) & 0xffff,
--		 (unsigned)(rr->locator64 >> 16) & 0xffff,
--		 (unsigned)(rr->locator64 >> 0) & 0xffff);
-+         rr->preference,
-+         (unsigned)(rr->locator64 >> 48) & 0xffff,
-+         (unsigned)(rr->locator64 >> 32) & 0xffff,
-+         (unsigned)(rr->locator64 >> 16) & 0xffff,
-+         (unsigned)(rr->locator64 >> 0) & 0xffff);
-     return quickstrdup_temp(s);
- }
- 
- static struct binary_data l64_wirerdata(struct rr *rrv)
- {
--	RRCAST(l64);
-+    RRCAST(l64);
-     return compose_binary_data("28", 1, rr->preference, rr->locator64);
- }
- 
-diff -Naur validns-0.8/loc.c validns/loc.c
---- validns-0.8/loc.c	2014-02-11 15:45:16.000000000 -0500
-+++ validns/loc.c	2020-10-05 16:59:29.354681360 -0400
-@@ -21,161 +21,161 @@
- 
- static uint8_t double2loc_format(double val)
- {
--	if (val > 1000000000) {
--		return (((uint8_t)(val / 1000000000)) << 4) | 9;
--	} else if (val > 100000000) {
--		return (((uint8_t)(val / 100000000)) << 4) | 8;
--	} else if (val > 10000000) {
--		return (((uint8_t)(val / 10000000)) << 4) | 7;
--	} else if (val > 1000000) {
--		return (((uint8_t)(val / 1000000)) << 4) | 6;
--	} else if (val > 100000) {
--		return (((uint8_t)(val / 100000)) << 4) | 5;
--	} else if (val > 10000) {
--		return (((uint8_t)(val / 10000)) << 4) | 4;
--	} else if (val > 1000) {
--		return (((uint8_t)(val / 1000)) << 4) | 3;
--	} else if (val > 100) {
--		return (((uint8_t)(val / 100)) << 4) | 2;
--	} else if (val > 10) {
--		return (((uint8_t)(val / 10)) << 4) | 1;
--	} else {
--		return (((uint8_t)(val)) << 4);
--	}
-+    if (val > 1000000000) {
-+        return (((uint8_t)(val / 1000000000)) << 4) | 9;
-+    } else if (val > 100000000) {
-+        return (((uint8_t)(val / 100000000)) << 4) | 8;
-+    } else if (val > 10000000) {
-+        return (((uint8_t)(val / 10000000)) << 4) | 7;
-+    } else if (val > 1000000) {
-+        return (((uint8_t)(val / 1000000)) << 4) | 6;
-+    } else if (val > 100000) {
-+        return (((uint8_t)(val / 100000)) << 4) | 5;
-+    } else if (val > 10000) {
-+        return (((uint8_t)(val / 10000)) << 4) | 4;
-+    } else if (val > 1000) {
-+        return (((uint8_t)(val / 1000)) << 4) | 3;
-+    } else if (val > 100) {
-+        return (((uint8_t)(val / 100)) << 4) | 2;
-+    } else if (val > 10) {
-+        return (((uint8_t)(val / 10)) << 4) | 1;
-+    } else {
-+        return (((uint8_t)(val)) << 4);
-+    }
- 
- }
- 
- static struct rr *loc_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_loc *rr = getmem(sizeof(*rr));
--	long long i;
--	int deg;
--	int min;
--	double sec, val;
--
--	rr->version = 0;
--
--	/* latitude block */
--	i = extract_integer(&s, "degrees latitude");
--	if (i < 0)
--		return NULL;
--	if (i > 90)
--		return bitch("degrees latitude not in the range 0..90");
--	deg = i;
--	min = 0;
--	sec = 0;
--	if (isdigit(*s)) {
--		i = extract_integer(&s, "minutes latitude");
--		if (i < 0)
--			return NULL;
--		if (i > 59)
--			return bitch("minutes latitude not in the range 0..59");
--		min = i;
--
--		if (isdigit(*s)) { /* restricted floating point, starting with a digit */
--			if (extract_double(&s, "seconds latitude", &sec, 0) < 0)
--				return NULL;
--			if (sec < 0 || sec > 59.999)
--				return bitch("seconds latitude not in the range 0..59.999");
--		}
--	}
--	rr->latitude = sec*1000 + .5 + min*1000*60 + deg*1000*60*60;
--	if (*s == 'n' || *s == 'N') {
--		s++;
--		rr->latitude = 2147483648u + rr->latitude;
--	} else if (*s == 's' || *s == 'S') {
--		s++;
--		rr->latitude = 2147483648u - rr->latitude;
--	} else {
--		return bitch("latitude: N or S is expected");
--	}
--	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--		return bitch("latitude: N or S is expected");
--	}
--	s = skip_white_space(s);
--	if (!s) return NULL;
--
--	/* longitude block */
--	i = extract_integer(&s, "degrees longitude");
--	if (i < 0)
--		return NULL;
--	if (i > 180)
--		return bitch("degrees longitude not in the range 0..90");
--	deg = i;
--	min = 0;
--	sec = 0;
--	if (isdigit(*s)) {
--		i = extract_integer(&s, "minutes longitude");
--		if (i < 0)
--			return NULL;
--		if (i > 59)
--			return bitch("minutes longitude not in the range 0..59");
--		min = i;
--
--		if (isdigit(*s)) { /* restricted floating point, starting with a digit */
--			if (extract_double(&s, "seconds longitude", &sec, 0) < 0)
--				return NULL;
--			if (sec < 0 || sec > 59.999)
--				return bitch("seconds longitude not in the range 0..59.999");
--		}
--	}
--	rr->longitude = sec*1000 + .5 + min*1000*60 + deg*1000*60*60;
--	if (*s == 'e' || *s == 'E') {
--		s++;
--		rr->longitude = 2147483648u + rr->longitude;
--	} else if (*s == 'w' || *s == 'W') {
--		s++;
--		rr->longitude = 2147483648u - rr->longitude;
--	} else {
--		return bitch("longitude: E or W is expected");
--	}
--	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--		return bitch("longitude: E or W is expected");
--	}
--	s = skip_white_space(s);
--	if (!s) return NULL;
--
--	if (extract_double(&s, "altitude", &val, 1) < 0)
--		return NULL;
--	if (val < -100000.00 || val > 42849672.95)
--		return bitch("altitude is out of supported range");
--	rr->altitude = (val + 100000.00) * 100 + 0.5;
--
--	if (*s) {
--		if (extract_double(&s, "sphere size", &val, 1) < 0)
--			return NULL;
--		if (val < 0 || val > 90000000.00)
--			return bitch("sphere size is out of supported range");
--		rr->size = double2loc_format(val * 100 + 0.5);
--
--		if (*s) {
--			if (extract_double(&s, "horizontal precision", &val, 1) < 0)
--				return NULL;
--			if (val < 0 || val > 90000000.00)
--				return bitch("horizontal precision is out of supported range");
--			rr->horiz_pre = double2loc_format(val * 100 + 0.5);
--
--			if (*s) {
--				if (extract_double(&s, "vertical precision", &val, 1) < 0)
--					return NULL;
--				if (val < 0 || val > 90000000.00)
--					return bitch("vertical precision is out of supported range");
--				rr->vert_pre = double2loc_format(val * 100 + 0.5);
--			} else {
--				rr->vert_pre = double2loc_format(10 * 100 + 0.5);
--			}
--		} else {
--			rr->horiz_pre = double2loc_format(10000 * 100 + 0.5);
--		}
--	} else {
--		rr->size = double2loc_format(1 * 100 + 0.5);
--	}
--
--	if (*s) {
--		return bitch("garbage after valid LOC data");
--	}
-+    struct rr_loc *rr = getmem(sizeof(*rr));
-+    long long i;
-+    int deg;
-+    int min;
-+    double sec, val;
-+
-+    rr->version = 0;
-+
-+    /* latitude block */
-+    i = extract_integer(&s, "degrees latitude", NULL);
-+    if (i < 0)
-+        return NULL;
-+    if (i > 90)
-+        return bitch("degrees latitude not in the range 0..90");
-+    deg = i;
-+    min = 0;
-+    sec = 0;
-+    if (isdigit(*s)) {
-+        i = extract_integer(&s, "minutes latitude", NULL);
-+        if (i < 0)
-+            return NULL;
-+        if (i > 59)
-+            return bitch("minutes latitude not in the range 0..59");
-+        min = i;
-+
-+        if (isdigit(*s)) { /* restricted floating point, starting with a digit */
-+            if (extract_double(&s, "seconds latitude", &sec, 0) < 0)
-+                return NULL;
-+            if (sec < 0 || sec > 59.999)
-+                return bitch("seconds latitude not in the range 0..59.999");
-+        }
-+    }
-+    rr->latitude = sec*1000 + .5 + min*1000*60 + deg*1000*60*60;
-+    if (*s == 'n' || *s == 'N') {
-+        s++;
-+        rr->latitude = 2147483648u + rr->latitude;
-+    } else if (*s == 's' || *s == 'S') {
-+        s++;
-+        rr->latitude = 2147483648u - rr->latitude;
-+    } else {
-+        return bitch("latitude: N or S is expected");
-+    }
-+    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+        return bitch("latitude: N or S is expected");
-+    }
-+    s = skip_white_space(s);
-+    if (!s) return NULL;
-+
-+    /* longitude block */
-+    i = extract_integer(&s, "degrees longitude", NULL);
-+    if (i < 0)
-+        return NULL;
-+    if (i > 180)
-+        return bitch("degrees longitude not in the range 0..90");
-+    deg = i;
-+    min = 0;
-+    sec = 0;
-+    if (isdigit(*s)) {
-+        i = extract_integer(&s, "minutes longitude", NULL);
-+        if (i < 0)
-+            return NULL;
-+        if (i > 59)
-+            return bitch("minutes longitude not in the range 0..59");
-+        min = i;
-+
-+        if (isdigit(*s)) { /* restricted floating point, starting with a digit */
-+            if (extract_double(&s, "seconds longitude", &sec, 0) < 0)
-+                return NULL;
-+            if (sec < 0 || sec > 59.999)
-+                return bitch("seconds longitude not in the range 0..59.999");
-+        }
-+    }
-+    rr->longitude = sec*1000 + .5 + min*1000*60 + deg*1000*60*60;
-+    if (*s == 'e' || *s == 'E') {
-+        s++;
-+        rr->longitude = 2147483648u + rr->longitude;
-+    } else if (*s == 'w' || *s == 'W') {
-+        s++;
-+        rr->longitude = 2147483648u - rr->longitude;
-+    } else {
-+        return bitch("longitude: E or W is expected");
-+    }
-+    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+        return bitch("longitude: E or W is expected");
-+    }
-+    s = skip_white_space(s);
-+    if (!s) return NULL;
-+
-+    if (extract_double(&s, "altitude", &val, 1) < 0)
-+        return NULL;
-+    if (val < -100000.00 || val > 42849672.95)
-+        return bitch("altitude is out of supported range");
-+    rr->altitude = (val + 100000.00) * 100 + 0.5;
-+
-+    if (*s) {
-+        if (extract_double(&s, "sphere size", &val, 1) < 0)
-+            return NULL;
-+        if (val < 0 || val > 90000000.00)
-+            return bitch("sphere size is out of supported range");
-+        rr->size = double2loc_format(val * 100 + 0.5);
-+
-+        if (*s) {
-+            if (extract_double(&s, "horizontal precision", &val, 1) < 0)
-+                return NULL;
-+            if (val < 0 || val > 90000000.00)
-+                return bitch("horizontal precision is out of supported range");
-+            rr->horiz_pre = double2loc_format(val * 100 + 0.5);
-+
-+            if (*s) {
-+                if (extract_double(&s, "vertical precision", &val, 1) < 0)
-+                    return NULL;
-+                if (val < 0 || val > 90000000.00)
-+                    return bitch("vertical precision is out of supported range");
-+                rr->vert_pre = double2loc_format(val * 100 + 0.5);
-+            } else {
-+                rr->vert_pre = double2loc_format(10 * 100 + 0.5);
-+            }
-+        } else {
-+            rr->horiz_pre = double2loc_format(10000 * 100 + 0.5);
-+        }
-+    } else {
-+        rr->size = double2loc_format(1 * 100 + 0.5);
-+    }
-+
-+    if (*s) {
-+        return bitch("garbage after valid LOC data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* loc_human(struct rr *rrv)
-@@ -185,17 +185,17 @@
- 
-     // snprintf(s, 1024, "\"%s\" \"%s\"", rr->cpu.data, rr->os.data);
-     // return quickstrdup_temp(s);
--	return "meow";
-+    return "meow";
- }
- 
- static struct binary_data loc_wirerdata(struct rr *rrv)
- {
--	RRCAST(loc);
-+    RRCAST(loc);
- 
-     return compose_binary_data("1111444", 1,
--		rr->version, rr->size,
--		rr->horiz_pre, rr->vert_pre,
--		rr->latitude, rr->longitude, rr->altitude);
-+        rr->version, rr->size,
-+        rr->horiz_pre, rr->vert_pre,
-+        rr->latitude, rr->longitude, rr->altitude);
- }
- 
- struct rr_methods loc_methods = { loc_parse, loc_human, loc_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/lp.c validns/lp.c
---- validns-0.8/lp.c	2014-02-11 15:45:55.000000000 -0500
-+++ validns/lp.c	2020-10-05 16:59:29.354681360 -0400
-@@ -20,41 +20,41 @@
- 
- static struct rr *lp_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_lp *rr = getmem(sizeof(*rr));
--	int preference;
-+    struct rr_lp *rr = getmem(sizeof(*rr));
-+    int preference;
- 
--	rr->preference = preference = extract_integer(&s, "LP preference");
--	if (preference < 0)
--		return NULL;
--	rr->fqdn = extract_name(&s, "LP fqdn", 0);
--	if (!rr->fqdn)
--		return NULL;
--	if (strcasecmp(name, rr->fqdn) == 0) {
--		return bitch("LP points to itself");
--	}
--
--	if (*s) {
--		return bitch("garbage after valid LP data");
--	}
-+    rr->preference = preference = extract_integer(&s, "LP preference", NULL);
-+    if (preference < 0)
-+        return NULL;
-+    rr->fqdn = extract_name(&s, "LP fqdn", 0);
-+    if (!rr->fqdn)
-+        return NULL;
-+    if (strcasecmp(name, rr->fqdn) == 0) {
-+        return bitch("LP points to itself");
-+    }
-+
-+    if (*s) {
-+        return bitch("garbage after valid LP data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* lp_human(struct rr *rrv)
- {
--	RRCAST(lp);
--	char s[1024];
-+    RRCAST(lp);
-+    char s[1024];
- 
--	snprintf(s, 1024, "%d %s",
--			 rr->preference, rr->fqdn);
--	return quickstrdup_temp(s);
-+    snprintf(s, 1024, "%d %s",
-+             rr->preference, rr->fqdn);
-+    return quickstrdup_temp(s);
- }
- 
- static struct binary_data lp_wirerdata(struct rr *rrv)
- {
--	RRCAST(lp);
-+    RRCAST(lp);
-     return compose_binary_data("2d", 1,
--		rr->preference, name2wire_name(rr->fqdn));
-+        rr->preference, name2wire_name(rr->fqdn));
- }
- 
- struct rr_methods lp_methods = { lp_parse, lp_human, lp_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/main.c validns/main.c
---- validns-0.8/main.c	2020-10-05 16:54:14.347790456 -0400
-+++ validns/main.c	2020-10-05 16:59:29.354681360 -0400
-@@ -17,6 +17,7 @@
- #include <time.h>
- #include <netinet/in.h>
- #include <arpa/inet.h>
-+#include <libgen.h>
- 
- #include "common.h"
- #include "carp.h"
-@@ -27,418 +28,631 @@
- struct globals G;
- struct file_info *file_info = NULL;
- 
--int
--read_zone_file(void);
-+int read_zone_file(void);
-+void open_zone_file(char *fname);
-+
-+static void
-+concat_generate_template(char *buf, int bufsz, int val, struct generate_template_piece *t)
-+{
-+    char sval[40];
-+
-+    while (t) {
-+        if (t->constant_string) {
-+            mystrlcat(buf, t->constant_string, bufsz);
-+        } else {
-+            snprintf(sval, 40, "%d", val);
-+            mystrlcat(buf, sval, bufsz);
-+        }
-+        t = t->next;
-+    }
-+}
-+
-+static struct generate_template_piece *
-+free_generate_template(struct generate_template_piece *t)
-+{
-+    struct generate_template_piece *n;
-+    while (t) {
-+        n = t->next;
-+        free(t);
-+        t = n;
-+    }
-+    return NULL;
-+}
-+
-+static void
-+create_generate_template_piece(struct generate_template_piece **generate_template, char *s)
-+{
-+    if (s && *s == 0)
-+        return;
-+
-+    struct generate_template_piece *p = malloc(sizeof(struct generate_template_piece));
-+
-+    p->constant_string = s;
-+    p->next = NULL;
-+
-+    if (*generate_template) {
-+        struct generate_template_piece *t = *generate_template;
-+        while (t->next)
-+            t = t->next;
-+        t->next = p;
-+    } else {
-+        *generate_template = p;
-+    }
-+}
-+
-+static struct generate_template_piece *
-+prepare_generate_template(char *t)
-+{
-+    char *s = t;
-+    struct generate_template_piece *r = NULL;
-+
-+    while (1) {
-+        while (*t && *t != '$') t++;
-+        if (!*t) {
-+            create_generate_template_piece(&r, s);
-+            break;
-+        } else {
-+            *t = 0;
-+            create_generate_template_piece(&r, s);
-+            create_generate_template_piece(&r, NULL);
-+            t++;
-+            s = t;
-+        }
-+    }
-+
-+    return r;
-+}
- 
- static char *process_directive(char *s)
- {
--	char *d = s+1;
--	if (*(s+1) == 'O' && strncmp(s, "$ORIGIN", 7) == 0) {
--		char *o;
--		s += 7;
--		if (!isspace(*s)) {
--			if (isalnum(*s)) goto unrecognized_directive;
--			return bitch("bad $ORIGIN format");
--		}
--		s = skip_white_space(s);
--		o = extract_name(&s, "$ORIGIN value", 0);
--		if (!o) {
--			return NULL;
--		}
--		if (*s) {
--			return bitch("garbage after valid $ORIGIN directive");
--		}
--		G.opt.current_origin = o;
--		if (G.opt.verbose) {
--			fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
--			fprintf(stderr, "origin is now %s\n", o);
--		}
--	} else if (*(s+1) == 'T' && strncmp(s, "$TTL", 4) == 0) {
--		s += 4;
--		if (!isspace(*s)) {
--			if (isalnum(*s)) goto unrecognized_directive;
--			return bitch("bad $TTL format");
--		}
--		s = skip_white_space(s);
--		G.default_ttl = extract_timevalue(&s, "$TTL value");
--		if (G.default_ttl < 0) {
--			return NULL;
--		}
--		if (*s) {
--			return bitch("garbage after valid $TTL directive");
--		}
--		if (G.opt.verbose) {
--			fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
--			fprintf(stderr, "default ttl is now %ld\n", G.default_ttl);
--		}
--	} else if (*(s+1) == 'I' && strncmp(s, "$INCLUDE", 8) == 0) {
--		s += 8;
--		if (!isspace(*s)) {
--			if (isalnum(*s)) goto unrecognized_directive;
--			return bitch("bad $INCLUDE format");
--		}
--		s = skip_white_space(s);
--		return bitch("XXX include support is not implemented");
--	} else {
-+    char *d = s+1;
-+    if (*(s+1) == 'O' && strncmp(s, "$ORIGIN", 7) == 0) {
-+        char *o;
-+        s += 7;
-+        if (!isspace(*s)) {
-+            if (isalnum(*s)) goto unrecognized_directive;
-+            return bitch("bad $ORIGIN format");
-+        }
-+        s = skip_white_space(s);
-+        o = extract_name(&s, "$ORIGIN value", 0);
-+        if (!o) {
-+            return NULL;
-+        }
-+        if (*s) {
-+            return bitch("garbage after valid $ORIGIN directive");
-+        }
-+        file_info->current_origin = o;
-+        if (G.opt.verbose) {
-+            fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
-+            fprintf(stderr, "origin is now %s\n", o);
-+        }
-+    } else if (*(s+1) == 'T' && strncmp(s, "$TTL", 4) == 0) {
-+        s += 4;
-+        if (!isspace(*s)) {
-+            if (isalnum(*s)) goto unrecognized_directive;
-+            return bitch("bad $TTL format");
-+        }
-+        s = skip_white_space(s);
-+        G.default_ttl = extract_timevalue(&s, "$TTL value");
-+        if (G.default_ttl < 0) {
-+            return NULL;
-+        }
-+        if (*s) {
-+            return bitch("garbage after valid $TTL directive");
-+        }
-+        if (G.opt.verbose) {
-+            fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
-+            fprintf(stderr, "default ttl is now %ld\n", G.default_ttl);
-+        }
-+    } else if (*(s+1) == 'G' && strncmp(s, "$GENERATE", 9) == 0) {
-+        int from, to;
-+        char *lhs, *rdtype;
-+
-+        s += 9;
-+        if (!isspace(*s)) {
-+            if (isalnum(*s)) goto unrecognized_directive;
-+            return bitch("bad $GENERATE format");
-+        }
-+        s = skip_white_space(s);
-+
-+        from = extract_integer(&s, "generate-from", "-");
-+        if (from < 0)
-+            return NULL;
-+        if (*s != '-')
-+            return bitch("'-' between generate-from and generate-to is expected");
-+        s++;
-+        to = extract_integer(&s, "generate-to", "-");
-+        if (to < 0)
-+            return NULL;
-+
-+        if (*s == '/')
-+            return bitch("generate-step is unsupported for now");
-+
-+        lhs = extract_name(&s, "generate-lhs", KEEP_CAPITALIZATION | DOLLAR_OK_IN_NAMES);
-+        if (!lhs)
-+            return NULL;
-+
-+        if (*s == '{')
-+            return bitch("{offset,width,type} is unsupported for now");
-+
-+        rdtype = extract_label(&s, "type", NULL);
-+        if (!rdtype)
-+            return NULL;
-+
-+        file_info->generate_cur  = from;
-+        file_info->generate_lim  = to;
-+        file_info->generate_type = rdtype;
-+        file_info->generate_lhs = prepare_generate_template(lhs);
-+        file_info->generate_rhs = prepare_generate_template(quickstrdup(s));
-+
-+        return s;
-+    } else if (*(s+1) == 'I' && strncmp(s, "$INCLUDE", 8) == 0) {
-+        char *p, *f;
-+        char c;
-+        s += 8;
-+        if (!isspace(*s)) {
-+            if (isalnum(*s)) goto unrecognized_directive;
-+            return bitch("bad $INCLUDE format");
-+        }
-+        s = skip_white_space(s);
-+        p = s;
-+        while (*s && !isspace(*s) && *s != ';')
-+            s++;
-+        c = *s;
-+        *s = '\0';
-+        if (!*p) {
-+            return bitch("$INCLUDE directive with empty file name");
-+        }
-+        f = quickstrdup_temp(p);
-+        *s = c;
-+        s = skip_white_space(s);
-+
-+        if (*s) {
-+            return bitch("garbage after valid $INCLUDE directive");
-+        }
-+        if (*f == '/') {
-+            open_zone_file(f);
-+        } else {
-+            char buf[1024];
-+
-+            snprintf(buf, 1024, "%s/%s", G.opt.include_path, f);
-+            open_zone_file(buf);
-+        }
-+    } else {
- unrecognized_directive:
--		s = d-1;
--		while (isalnum(*d))	d++;
--		*d = '\0';
--		return bitch("unrecognized directive: %s", s);
--	}
--	return s;
-+        s = d-1;
-+        while (isalnum(*d)) d++;
-+        *d = '\0';
-+        return bitch("unrecognized directive: %s", s);
-+    }
-+    return s;
-+}
-+
-+char *
-+read_zone_line(void)
-+{
-+    char *r;
-+
-+    if (file_info->generate_lhs) {
-+        if (file_info->generate_cur <= file_info->generate_lim) {
-+            file_info->buf[0] = 0;
-+            concat_generate_template(file_info->buf, LINEBUFSZ, file_info->generate_cur, file_info->generate_lhs);
-+            mystrlcat(file_info->buf, " ", LINEBUFSZ);
-+            mystrlcat(file_info->buf, file_info->generate_type, LINEBUFSZ);
-+            mystrlcat(file_info->buf, " ", LINEBUFSZ);
-+            concat_generate_template(file_info->buf, LINEBUFSZ, file_info->generate_cur, file_info->generate_rhs);
-+            file_info->generate_cur++;
-+            return file_info->buf;
-+        } else {
-+            /* Done with this $GENERATE */
-+            file_info->generate_cur = 0;
-+            file_info->generate_lim = 0;
-+            file_info->generate_type = NULL;
-+            file_info->generate_lhs = NULL;
-+            free_generate_template(file_info->generate_lhs);
-+            free_generate_template(file_info->generate_rhs);
-+            file_info->generate_rhs = NULL;
-+        }
-+    }
-+
-+    r = fgets(file_info->buf, LINEBUFSZ, file_info->file);
-+    if (r)
-+        file_info->line++;
-+    return r;
- }
- 
- int
- read_zone_file(void)
- {
--	char *s;
--	char *name = NULL, *class, *rdtype;
--	long ttl = -1;
--	while (file_info) {
--		while (fgets(file_info->buf, 2048, file_info->file)) {
--			freeall_temp();
--			file_info->line++;
--			file_info->paren_mode = 0;
--			rdtype = NULL;
--			if (empty_line_or_comment(file_info->buf))
--				continue;
--
--			s = file_info->buf;
--			if (!isspace(*s)) {
--				/* <domain-name>, $INCLUDE, $ORIGIN */
--				if (*s == '$') {
--					process_directive(s);
--					continue;
--				} else {
--					/* <domain-name> */
--					name = extract_name(&s, "record name", 0);
--					if (!name)
--						continue;
--				}
--			} else {
--				s = skip_white_space(s);
--			}
--			if (!s)
--				continue;
--			if (!name) {
--				bitch("cannot assume previous name for it is not known");
--				continue;
--			}
--			if (G.default_ttl >= 0)
--				ttl = G.default_ttl;
--			if (isdigit(*s)) {
--				ttl = extract_timevalue(&s, "TTL");
--				if (ttl < 0)
--					continue;
--				class = extract_label(&s, "class or type", "temporary");
--				if (!class)
--					continue;
--				if (*class == 'i' && *(class+1) == 'n' && *(class+2) == 0) {
--				} else if (*class == 'c' && *(class+1) == 's' && *(class+2) == 0) {
--					bitch("CSNET class is not supported");
--					continue;
--				} else if (*class == 'c' && *(class+1) == 'h' && *(class+2) == 0) {
--					bitch("CHAOS class is not supported");
--					continue;
--				} else if (*class == 'h' && *(class+1) == 's' && *(class+2) == 0) {
--					bitch("HESIOD class is not supported");
--					continue;
--				} else {
--					rdtype = class;
--				}
--			} else {
--				class = extract_label(&s, "class or type", "temporary");
--				if (!class)
--					continue;
--				if (*class == 'i' && *(class+1) == 'n' && *(class+2) == 0) {
--					if (isdigit(*s)) {
--						ttl = extract_timevalue(&s, "TTL");
--						if (ttl < 0)
--							continue;
--					}
--				} else if (*class == 'c' && *(class+1) == 's' && *(class+2) == 0) {
--					bitch("CSNET class is not supported");
--					continue;
--				} else if (*class == 'c' && *(class+1) == 'h' && *(class+2) == 0) {
--					bitch("CHAOS class is not supported");
--					continue;
--				} else if (*class == 'h' && *(class+1) == 's' && *(class+2) == 0) {
--					bitch("HESIOD class is not supported");
--					continue;
--				} else {
--					rdtype = class;
--				}
--			}
--			if (!rdtype) {
--				rdtype = extract_label(&s, "type", "temporary");
--			}
--			if (!rdtype) {
--				continue;
--			}
--			if (ttl < 0) {
--				ttl = G.default_ttl;
--			}
--			if (ttl < 0) {
--				bitch("ttl not specified and default is not known");
--				continue;
--			}
--
--			{
--				int is_generic;
--				int type = str2rdtype(rdtype, &is_generic);
--				if (type <= 0) continue;
--				if (is_generic)
--					rr_parse_any(name, ttl, type, s);
--				else if (type > T_MAX)
--					rr_parse_any(name, ttl, type, s);
--				else if (rr_methods[type].rr_parse)
--					rr_methods[type].rr_parse(name, ttl, type, s);
--				else
--					rr_parse_any(name, ttl, type, s);
--			}
--		}
--		if (ferror(file_info->file))
--			croak(1, "read error for %s", file_info->name);
--		file_info = file_info->next;
--	}
--	return 0;
-+    char *s;
-+    char *name = NULL, *class, *rdtype;
-+    long ttl = -1;
-+    while (file_info) {
-+        while (read_zone_line()) {
-+            freeall_temp();
-+            file_info->paren_mode = 0;
-+            rdtype = NULL;
-+            if (empty_line_or_comment(file_info->buf))
-+                continue;
-+
-+            s = file_info->buf;
-+            if (!isspace(*s)) {
-+                /* <domain-name>, $INCLUDE, $ORIGIN */
-+                if (*s == '$') {
-+                    process_directive(s);
-+                    continue;
-+                } else {
-+                    /* <domain-name> */
-+                    name = extract_name(&s, "record name", 0);
-+                    if (!name)
-+                        continue;
-+                }
-+            } else {
-+                s = skip_white_space(s);
-+            }
-+            if (!s)
-+                continue;
-+            if (!name) {
-+                bitch("cannot assume previous name for it is not known");
-+                continue;
-+            }
-+            if (G.default_ttl >= 0)
-+                ttl = G.default_ttl;
-+            if (isdigit(*s)) {
-+                ttl = extract_timevalue(&s, "TTL");
-+                if (ttl < 0)
-+                    continue;
-+                class = extract_label(&s, "class or type", "temporary");
-+                if (!class)
-+                    continue;
-+                if (*class == 'i' && *(class+1) == 'n' && *(class+2) == 0) {
-+                } else if (*class == 'c' && *(class+1) == 's' && *(class+2) == 0) {
-+                    bitch("CSNET class is not supported");
-+                    continue;
-+                } else if (*class == 'c' && *(class+1) == 'h' && *(class+2) == 0) {
-+                    bitch("CHAOS class is not supported");
-+                    continue;
-+                } else if (*class == 'h' && *(class+1) == 's' && *(class+2) == 0) {
-+                    bitch("HESIOD class is not supported");
-+                    continue;
-+                } else {
-+                    rdtype = class;
-+                }
-+            } else {
-+                class = extract_label(&s, "class or type", "temporary");
-+                if (!class)
-+                    continue;
-+                if (*class == 'i' && *(class+1) == 'n' && *(class+2) == 0) {
-+                    if (isdigit(*s)) {
-+                        ttl = extract_timevalue(&s, "TTL");
-+                        if (ttl < 0)
-+                            continue;
-+                    }
-+                } else if (*class == 'c' && *(class+1) == 's' && *(class+2) == 0) {
-+                    bitch("CSNET class is not supported");
-+                    continue;
-+                } else if (*class == 'c' && *(class+1) == 'h' && *(class+2) == 0) {
-+                    bitch("CHAOS class is not supported");
-+                    continue;
-+                } else if (*class == 'h' && *(class+1) == 's' && *(class+2) == 0) {
-+                    bitch("HESIOD class is not supported");
-+                    continue;
-+                } else {
-+                    rdtype = class;
-+                }
-+            }
-+            if (!rdtype) {
-+                rdtype = extract_label(&s, "type", "temporary");
-+            }
-+            if (!rdtype) {
-+                continue;
-+            }
-+            if (ttl < 0) {
-+                ttl = G.default_ttl;
-+            }
-+
-+            {
-+                int is_generic;
-+                int type = str2rdtype(rdtype, &is_generic);
-+                struct rr *rr;
-+
-+                if (type <= 0) continue;
-+
-+                if (ttl < 0 && !(G.opt.soa_minttl_as_default_ttl && type == T_SOA)) {
-+                    bitch("ttl not specified and default is not known");
-+                    continue;
-+                }
-+
-+                if (is_generic)
-+                    rr = rr_parse_any(name, ttl, type, s);
-+                else if (type > T_MAX)
-+                    rr = rr_parse_any(name, ttl, type, s);
-+                else if (rr_methods[type].rr_parse)
-+                    rr = rr_methods[type].rr_parse(name, ttl, type, s);
-+                else
-+                    rr = rr_parse_any(name, ttl, type, s);
-+
-+                if (type == T_SOA && ttl < 0 && rr) {
-+                    struct rr_soa *soa = (struct rr_soa *) rr;
-+                    soa->rr.ttl = G.default_ttl = soa->minimum;
-+                    if (G.opt.verbose) {
-+                        fprintf(stderr, "-> %s:%d: ", file_info->name, file_info->line);
-+                        fprintf(stderr, "no ttl specified; using SOA MINTTL (%ld) instead\n", G.default_ttl);
-+                    }
-+                }
-+            }
-+        }
-+        if (ferror(file_info->file))
-+            croak(1, "read error for %s", file_info->name);
-+        file_info = file_info->next;
-+    }
-+    return 0;
- }
- 
- void
- open_zone_file(char *fname)
- {
--	FILE *f;
--	struct file_info *new_file_info;
-+    FILE *f;
-+    struct file_info *new_file_info;
- 
--	if (strcmp(fname, "-") == 0) {
--		f = stdin;
--		fname = "stdin";
--	} else {
--		f = fopen(fname, "r");
--	}
--	if (!f)
--		croak(1, "open %s", fname);
--	new_file_info = malloc(sizeof(*new_file_info) + strlen(fname) + 1);
--	if (!new_file_info)
--		croak(1, "malloc(file_info), %s", fname);
--	new_file_info->next = file_info;
--	new_file_info->file = f;
--	new_file_info->line = 0;
--	strcpy(new_file_info->name, fname);
--	file_info = new_file_info;
-+    if (strcmp(fname, "-") == 0) {
-+        f = stdin;
-+        fname = "stdin";
-+    } else {
-+        f = fopen(fname, "r");
-+        if (!file_info && !G.opt.include_path_specified) {
-+            G.opt.include_path = quickstrdup(dirname(quickstrdup_temp(fname)));
-+        }
-+    }
-+    if (!f)
-+        croak(1, "open %s", fname);
-+    new_file_info = malloc(sizeof(*new_file_info) + strlen(fname) + 1);
-+    if (!new_file_info)
-+        croak(1, "malloc(file_info), %s", fname);
-+    new_file_info->next = file_info;
-+    new_file_info->file = f;
-+    new_file_info->line = 0;
-+    strcpy(new_file_info->name, fname);
-+    if (file_info) {
-+        new_file_info->current_origin = file_info->current_origin;
-+    } else {
-+        new_file_info->current_origin = G.opt.first_origin;
-+    }
-+    file_info = new_file_info;
- }
- 
- void usage(char *err)
- {
--	if (err)
--		fprintf(stderr, "%s\n", err);
--	fprintf(stderr, "Usage:\n");
--	fprintf(stderr, "    %s -h\n", thisprogname());
--	fprintf(stderr, "    %s [options] zone-file\n", thisprogname());
--	fprintf(stderr, "Usage parameters:\n");
--	fprintf(stderr, "\t-h\t\tproduce usage text and quit\n");
--	fprintf(stderr, "\t-f\t\tquit on first validation error\n");
--
--	fprintf(stderr, "\t-p name\tperform policy check <name>\n");
--	fprintf(stderr, "\t\t\tsingle-ns\n");
--	fprintf(stderr, "\t\t\tcname-other-data\n");
--	fprintf(stderr, "\t\t\tdname\n");
--	fprintf(stderr, "\t\t\tnsec3param-not-apex\n");
--	fprintf(stderr, "\t\t\tmx-alias\n");
--	fprintf(stderr, "\t\t\tns-alias\n");
--	fprintf(stderr, "\t\t\trp-txt-exists\n");
--	fprintf(stderr, "\t\t\tall\n");
--
--	fprintf(stderr, "\t-n N\t\tuse N worker threads\n");
--	fprintf(stderr, "\t-q\t\tquiet - do not produce any output\n");
--	fprintf(stderr, "\t-s\t\tprint validation summary/stats\n");
--	fprintf(stderr, "\t-x\t\tskip printing 'time taken' entry in summary/stats\n");
--	fprintf(stderr, "\t-v\t\tbe extra verbose\n");
--	fprintf(stderr, "\t-I path\tuse this path for $INCLUDE files\n");
--	fprintf(stderr, "\t-z origin\tuse this origin as initial $ORIGIN\n");
--	fprintf(stderr, "\t-t epoch-time\tuse this time instead of \"now\"\n");
--	exit(1);
-+    if (err)
-+        fprintf(stderr, "%s\n", err);
-+    fprintf(stderr, "Usage:\n");
-+    fprintf(stderr, "    %s -h\n", thisprogname());
-+    fprintf(stderr, "    %s [options] zone-file\n", thisprogname());
-+    fprintf(stderr, "Usage parameters:\n");
-+    fprintf(stderr, "\t-h\t\tproduce usage text and quit\n");
-+    fprintf(stderr, "\t-f\t\tquit on first validation error\n");
-+
-+    fprintf(stderr, "\t-p name\tperform policy check <name>\n");
-+    fprintf(stderr, "\t\t\tsingle-ns\n");
-+    fprintf(stderr, "\t\t\tcname-other-data\n");
-+    fprintf(stderr, "\t\t\tdname\n");
-+    fprintf(stderr, "\t\t\tnsec3param-not-apex\n");
-+    fprintf(stderr, "\t\t\tmx-alias\n");
-+    fprintf(stderr, "\t\t\tns-alias\n");
-+    fprintf(stderr, "\t\t\trp-txt-exists\n");
-+    fprintf(stderr, "\t\t\ttlsa-host\n");
-+    fprintf(stderr, "\t\t\tksk-exists\n");
-+    fprintf(stderr, "\t\t\tsmimea-host\n");
-+    fprintf(stderr, "\t\t\tall\n");
-+
-+    fprintf(stderr, "\t-n N\t\tuse N worker threads\n");
-+    fprintf(stderr, "\t-q\t\tquiet - do not produce any output\n");
-+    fprintf(stderr, "\t-s\t\tprint validation summary/stats\n");
-+    fprintf(stderr, "\t-v\t\tbe extra verbose\n");
-+    fprintf(stderr, "\t-I path\tuse this path for $INCLUDE files\n");
-+    fprintf(stderr, "\t-z origin\tuse this origin as initial $ORIGIN\n");
-+    fprintf(stderr, "\t-t epoch-time\tuse this time instead of \"now\"\n");
-+    exit(1);
- }
- 
- struct rr_methods rr_methods[T_MAX+1];
- 
- static void initialize_globals(void)
- {
--	int i;
-+    int i;
- 
--	setenv("TZ", "GMT0", 1);	tzset();
--	memset(&G, 0, sizeof(G));
--	memset(&G.opt, 0, sizeof(G.opt));
--	memset(&G.stats, 0, sizeof(G.stats));
--	G.default_ttl = -1; /* XXX orly? */
--	G.opt.times_to_check[0] = time(NULL);
--	G.opt.n_times_to_check = 0;
--
--	for (i = 0; i <= T_MAX; i++) {
--		rr_methods[i] = unknown_methods;
--	}
--	rr_methods[T_AAAA]         =       aaaa_methods;
--	rr_methods[T_A]            =          a_methods;
--	rr_methods[T_AFSDB]        =      afsdb_methods;
--	rr_methods[T_CERT]         =       cert_methods;
--	rr_methods[T_CNAME]        =      cname_methods;
--	rr_methods[T_DHCID]        =      dhcid_methods;
--	rr_methods[T_DLV]          =        dlv_methods;
--	rr_methods[T_DNAME]        =      dname_methods;
--	rr_methods[T_DNSKEY]       =     dnskey_methods;
--	rr_methods[T_DS]           =         ds_methods;
--	rr_methods[T_HINFO]        =      hinfo_methods;
--	rr_methods[T_IPSECKEY]     =   ipseckey_methods;
--	rr_methods[T_ISDN]         =       isdn_methods;
--	rr_methods[T_KX]           =         kx_methods;
--	rr_methods[T_L32]          =        l32_methods;
--	rr_methods[T_L64]          =        l64_methods;
--	rr_methods[T_LOC]          =        loc_methods;
--	rr_methods[T_LP]           =         lp_methods;
--	rr_methods[T_MB]           =         mb_methods;
--	rr_methods[T_MG]           =         mg_methods;
--	rr_methods[T_MINFO]        =      minfo_methods;
--	rr_methods[T_MR]           =         mr_methods;
--	rr_methods[T_MX]           =         mx_methods;
--	rr_methods[T_NAPTR]        =      naptr_methods;
--	rr_methods[T_NID]          =        nid_methods;
--	rr_methods[T_NSAP]         =       nsap_methods;
--	rr_methods[T_NSEC3PARAM]   = nsec3param_methods;
--	rr_methods[T_NSEC3]        =      nsec3_methods;
--	rr_methods[T_NSEC]         =       nsec_methods;
--	rr_methods[T_NS]           =         ns_methods;
--	rr_methods[T_PTR]          =        ptr_methods;
--	rr_methods[T_PX]           =         px_methods;
--	rr_methods[T_RP]           =         rp_methods;
--	rr_methods[T_RT]           =         rt_methods;
--	rr_methods[T_RRSIG]        =      rrsig_methods;
--	rr_methods[T_SOA]          =        soa_methods;
--	rr_methods[T_SPF]          =        spf_methods;
--	rr_methods[T_SRV]          =        srv_methods;
--	rr_methods[T_SSHFP]        =      sshfp_methods;
--	rr_methods[T_TLSA]         =       tlsa_methods;
--	rr_methods[T_TXT]          =        txt_methods;
--	rr_methods[T_X25]          =        x25_methods;
-+    setenv("TZ", "GMT0", 1);    tzset();
-+    memset(&G, 0, sizeof(G));
-+    memset(&G.opt, 0, sizeof(G.opt));
-+    memset(&G.stats, 0, sizeof(G.stats));
-+    memset(rr_counts, 0, sizeof(rr_counts[0])*(T_MAX+1));
-+    G.default_ttl = -1; /* XXX orly? */
-+    G.opt.times_to_check[0] = time(NULL);
-+    G.opt.n_times_to_check = 0;
-+    G.opt.include_path = ".";
-+
-+    for (i = 0; i <= T_MAX; i++) {
-+        rr_methods[i] = unknown_methods;
-+    }
-+    rr_methods[T_AAAA]         =       aaaa_methods;
-+    rr_methods[T_A]            =          a_methods;
-+    rr_methods[T_AFSDB]        =      afsdb_methods;
-+    rr_methods[T_CAA]          =        caa_methods;
-+    rr_methods[T_CDNSKEY]      =    cdnskey_methods;
-+    rr_methods[T_CDS]          =        cds_methods;
-+    rr_methods[T_CERT]         =       cert_methods;
-+    rr_methods[T_CNAME]        =      cname_methods;
-+    rr_methods[T_DHCID]        =      dhcid_methods;
-+    rr_methods[T_DLV]          =        dlv_methods;
-+    rr_methods[T_DNAME]        =      dname_methods;
-+    rr_methods[T_DNSKEY]       =     dnskey_methods;
-+    rr_methods[T_DS]           =         ds_methods;
-+    rr_methods[T_HINFO]        =      hinfo_methods;
-+    rr_methods[T_IPSECKEY]     =   ipseckey_methods;
-+    rr_methods[T_ISDN]         =       isdn_methods;
-+    rr_methods[T_KX]           =         kx_methods;
-+    rr_methods[T_L32]          =        l32_methods;
-+    rr_methods[T_L64]          =        l64_methods;
-+    rr_methods[T_LOC]          =        loc_methods;
-+    rr_methods[T_LP]           =         lp_methods;
-+    rr_methods[T_MB]           =         mb_methods;
-+    rr_methods[T_MG]           =         mg_methods;
-+    rr_methods[T_MINFO]        =      minfo_methods;
-+    rr_methods[T_MR]           =         mr_methods;
-+    rr_methods[T_MX]           =         mx_methods;
-+    rr_methods[T_NAPTR]        =      naptr_methods;
-+    rr_methods[T_NID]          =        nid_methods;
-+    rr_methods[T_NSAP]         =       nsap_methods;
-+    rr_methods[T_NSEC3PARAM]   = nsec3param_methods;
-+    rr_methods[T_NSEC3]        =      nsec3_methods;
-+    rr_methods[T_NSEC]         =       nsec_methods;
-+    rr_methods[T_NS]           =         ns_methods;
-+    rr_methods[T_PTR]          =        ptr_methods;
-+    rr_methods[T_PX]           =         px_methods;
-+    rr_methods[T_RP]           =         rp_methods;
-+    rr_methods[T_RT]           =         rt_methods;
-+    rr_methods[T_RRSIG]        =      rrsig_methods;
-+    rr_methods[T_SMIMEA]       =     smimea_methods;
-+    rr_methods[T_SOA]          =        soa_methods;
-+    rr_methods[T_SPF]          =        spf_methods;
-+    rr_methods[T_SRV]          =        srv_methods;
-+    rr_methods[T_SSHFP]        =      sshfp_methods;
-+    rr_methods[T_TLSA]         =       tlsa_methods;
-+    rr_methods[T_TXT]          =        txt_methods;
-+    rr_methods[T_X25]          =        x25_methods;
- }
- 
- int
- main(int argc, char **argv)
- {
--	int o;
--	struct timeval start, stop;
-+    int o;
-+    struct timeval start, stop;
- 
--	initialize_globals();
--	while ((o = getopt(argc, argv, "fhqsxvI:z:t:p:n:")) != -1) {
--		switch(o) {
--		case 'h':
--			usage(NULL);
--			break;
--		case 'f':
--			G.opt.die_on_first_error = 1;
--			break;
--		case 'q':
--			G.opt.no_output = 1;
--			break;
--		case 's':
--			G.opt.summary = 1;
--			break;
--		case 'x':
--			G.opt.notiming = 1;
--			break;
--		case 'v':
--			G.opt.verbose = 1;
--			break;
--		case 'p':
--			if (strcmp(optarg, "all") == 0) {
--				int i;
--				for (i = 0; i < N_POLICY_CHECKS; i++) {
--					G.opt.policy_checks[i] = 1;
--				}
--			} else if (strcmp(optarg, "single-ns") == 0) {
--				G.opt.policy_checks[POLICY_SINGLE_NS] = 1;
--			} else if (strcmp(optarg, "cname-other-data") == 0) {
--				G.opt.policy_checks[POLICY_CNAME_OTHER_DATA] = 1;
--			} else if (strcmp(optarg, "dname") == 0) {
--				G.opt.policy_checks[POLICY_DNAME] = 1;
--			} else if (strcmp(optarg, "dnskey") == 0) {
--				G.opt.policy_checks[POLICY_DNSKEY] = 1;
--			} else if (strcmp(optarg, "nsec3param-not-apex") == 0) {
--				G.opt.policy_checks[POLICY_NSEC3PARAM_NOT_APEX] = 1;
--			} else if (strcmp(optarg, "mx-alias") == 0) {
--				G.opt.policy_checks[POLICY_MX_ALIAS] = 1;
--			} else if (strcmp(optarg, "ns-alias") == 0) {
--				G.opt.policy_checks[POLICY_NS_ALIAS] = 1;
--			} else if (strcmp(optarg, "rp-txt-exists") == 0) {
--				G.opt.policy_checks[POLICY_RP_TXT_EXISTS] = 1;
--			} else if (strcmp(optarg, "tlsa-host") == 0) {
--				G.opt.policy_checks[POLICY_TLSA_HOST] = 1;
--			} else {
--				usage("unknown policy name");
--			}
--			break;
--		case 'I':
--			G.opt.include_path = optarg;
--			break;
--		case 'z':
--			if (strlen(optarg) && *(optarg+strlen(optarg)-1) == '.') {
--				G.opt.current_origin = optarg;
--			} else if (strlen(optarg)) {
--				G.opt.current_origin = getmem(strlen(optarg)+2);
--				strcpy(mystpcpy(G.opt.current_origin, optarg), ".");
--			} else {
--				usage("origin must not be empty");
--			}
--			break;
--		case 'n':
--			G.opt.n_threads = strtol(optarg, NULL, 10);
--			if (G.opt.n_threads > 256)
--				usage("non-sensical number of threads requested");
--			if (G.opt.verbose)
--				fprintf(stderr, "using %d worker threads\n", G.opt.n_threads);
--			break;
--		case 't':
--			if (G.opt.n_times_to_check >= MAX_TIMES_TO_CHECK)
--				usage("too many -t specified");
--			G.opt.times_to_check[G.opt.n_times_to_check++] = strtol(optarg, NULL, 10);
--			break;
--		default:
--			usage(NULL);
--		}
--	}
--	if (G.opt.n_times_to_check <= 0)
--		G.opt.n_times_to_check = 1;
--	argc -= optind;
--	argv += optind;
--	if (argc != 1)
--		usage(NULL);
--	gettimeofday(&start, NULL);
--	open_zone_file(argv[0]);
--	read_zone_file();
--	validate_zone();
--	verify_all_keys();
--	if (G.nsec3_present) {
--		if (first_nsec3) nsec3_validate(&first_nsec3->rr);
--		perform_remaining_nsec3checks();
--	}
--	gettimeofday(&stop, NULL);
--	if (G.opt.summary) {
--		printf("records found:       %d\n", G.stats.rr_count);
--		printf("skipped dups:        %d\n", G.stats.skipped_dup_rr_count);
--		printf("record sets found:   %d\n", G.stats.rrset_count);
--		printf("unique names found:  %d\n", G.stats.names_count);
--		printf("delegations found:   %d\n", G.stats.delegations);
--		printf("    nsec3 records:   %d\n", G.stats.nsec3_count);
--		/* "not authoritative names" - non-empty terminals without any authoritative records */
--		/* delegation points count as authoritative, which might or might not be correct */
--		printf("not authoritative names, not counting delegation points:\n"
--			   "                     %d\n", G.stats.not_authoritative);
--		printf("validation errors:   %d\n", G.stats.error_count);
--		printf("signatures verified: %d\n", G.stats.signatures_verified);
--		if (!G.opt.notiming) {
--			printf("time taken:          %.3fs\n",
--			   stop.tv_sec - start.tv_sec + (stop.tv_usec - start.tv_usec)/1000000.);
--		}
--	}
--	return G.exit_code;
-+    initialize_globals();
-+    while ((o = getopt(argc, argv, "fhMqsvI:z:t:p:n:")) != -1) {
-+        switch(o) {
-+        case 'h':
-+            usage(NULL);
-+            break;
-+        case 'f':
-+            G.opt.die_on_first_error = 1;
-+            break;
-+        case 'M':
-+            G.opt.soa_minttl_as_default_ttl = 1;
-+            break;
-+        case 'q':
-+            G.opt.no_output = 1;
-+            break;
-+        case 's':
-+            G.opt.summary++;
-+            break;
-+        case 'v':
-+            G.opt.verbose = 1;
-+            break;
-+        case 'p':
-+            if (strcmp(optarg, "all") == 0) {
-+                int i;
-+                for (i = 0; i < N_POLICY_CHECKS; i++) {
-+                    G.opt.policy_checks[i] = 1;
-+                }
-+            } else if (strcmp(optarg, "single-ns") == 0) {
-+                G.opt.policy_checks[POLICY_SINGLE_NS] = 1;
-+            } else if (strcmp(optarg, "cname-other-data") == 0) {
-+                G.opt.policy_checks[POLICY_CNAME_OTHER_DATA] = 1;
-+            } else if (strcmp(optarg, "dname") == 0) {
-+                G.opt.policy_checks[POLICY_DNAME] = 1;
-+            } else if (strcmp(optarg, "dnskey") == 0) {
-+                G.opt.policy_checks[POLICY_DNSKEY] = 1;
-+            } else if (strcmp(optarg, "nsec3param-not-apex") == 0) {
-+                G.opt.policy_checks[POLICY_NSEC3PARAM_NOT_APEX] = 1;
-+            } else if (strcmp(optarg, "mx-alias") == 0) {
-+                G.opt.policy_checks[POLICY_MX_ALIAS] = 1;
-+            } else if (strcmp(optarg, "ns-alias") == 0) {
-+                G.opt.policy_checks[POLICY_NS_ALIAS] = 1;
-+            } else if (strcmp(optarg, "rp-txt-exists") == 0) {
-+                G.opt.policy_checks[POLICY_RP_TXT_EXISTS] = 1;
-+            } else if (strcmp(optarg, "tlsa-host") == 0) {
-+                G.opt.policy_checks[POLICY_TLSA_HOST] = 1;
-+            } else if (strcmp(optarg, "smimea-host") == 0) {
-+                G.opt.policy_checks[POLICY_SMIMEA_HOST] = 1;
-+            } else if (strcmp(optarg, "ksk-exists") == 0) {
-+                G.opt.policy_checks[POLICY_KSK_EXISTS] = 1;
-+            } else {
-+                usage("unknown policy name");
-+            }
-+            break;
-+        case 'I':
-+            G.opt.include_path = optarg;
-+            G.opt.include_path_specified = 1;
-+            break;
-+        case 'z':
-+            if (strlen(optarg) && *(optarg+strlen(optarg)-1) == '.') {
-+                G.opt.first_origin = optarg;
-+            } else if (strlen(optarg)) {
-+                G.opt.first_origin = getmem(strlen(optarg)+2);
-+                strcpy(mystpcpy(G.opt.first_origin, optarg), ".");
-+            } else {
-+                usage("origin must not be empty");
-+            }
-+            break;
-+        case 'n':
-+            G.opt.n_threads = strtol(optarg, NULL, 10);
-+            if (G.opt.n_threads > 256)
-+                usage("non-sensical number of threads requested");
-+            if (G.opt.verbose)
-+                fprintf(stderr, "using %d worker threads\n", G.opt.n_threads);
-+            break;
-+        case 't':
-+            if (G.opt.n_times_to_check >= MAX_TIMES_TO_CHECK)
-+                usage("too many -t specified");
-+            G.opt.times_to_check[G.opt.n_times_to_check++] = strtol(optarg, NULL, 10);
-+            break;
-+        default:
-+            usage(NULL);
-+        }
-+    }
-+    if (G.opt.n_times_to_check <= 0)
-+        G.opt.n_times_to_check = 1;
-+    argc -= optind;
-+    argv += optind;
-+    if (argc != 1)
-+        usage(NULL);
-+    gettimeofday(&start, NULL);
-+    open_zone_file(argv[0]);
-+    read_zone_file();
-+    validate_zone();
-+    verify_all_keys();
-+    if (G.nsec3_present) {
-+        if (first_nsec3) nsec3_validate(&first_nsec3->rr);
-+        perform_remaining_nsec3checks();
-+    }
-+    if (G.dnssec_active && G.opt.policy_checks[POLICY_KSK_EXISTS]) {
-+        dnskey_ksk_policy_check();
-+    }
-+    gettimeofday(&stop, NULL);
-+    if (G.opt.summary) {
-+        printf("records found:       %d\n", G.stats.rr_count);
-+        printf("skipped dups:        %d\n", G.stats.skipped_dup_rr_count);
-+        printf("record sets found:   %d\n", G.stats.rrset_count);
-+        printf("unique names found:  %d\n", G.stats.names_count);
-+        printf("delegations found:   %d\n", G.stats.delegations);
-+        printf("    nsec3 records:   %d\n", G.stats.nsec3_count);
-+        /* "not authoritative names" - non-empty terminals without any authoritative records */
-+        /* delegation points count as authoritative, which might or might not be correct */
-+        printf("not authoritative names, not counting delegation points:\n"
-+               "                     %d\n", G.stats.not_authoritative);
-+        printf("validation errors:   %d\n", G.stats.error_count);
-+        printf("signatures verified: %d\n", G.stats.signatures_verified);
-+        printf("time taken:          %.3fs\n",
-+               stop.tv_sec - start.tv_sec + (stop.tv_usec - start.tv_usec)/1000000.);
-+        if (G.opt.summary > 1) {
-+            int i;
-+            printf("record count by type:\n");
-+            for (i = 1; i <= T_MAX; i++) {
-+                if (rr_counts[i])
-+                    printf("%20s: %d\n", rdtype2str(i), rr_counts[i]);
-+            }
-+        }
-+    }
-+    return G.exit_code;
- }
-diff -Naur validns-0.8/Makefile validns/Makefile
---- validns-0.8/Makefile	2014-02-11 15:08:39.000000000 -0500
-+++ validns/Makefile	2020-10-05 16:59:29.353681351 -0400
-@@ -27,7 +27,7 @@
- 	dname.o tlsa.o nid.o l32.o l64.o lp.o \
- 	ipseckey.o cbtree.o mb.o mg.o mr.o minfo.o \
- 	afsdb.o x25.o isdn.o rt.o px.o kx.o \
--	dlv.o dhcid.o nsap.o
-+	dlv.o dhcid.o nsap.o caa.o
- 	$(CC) $(CFLAGS) $(OPTIMIZE) -o validns \
- 	    main.o carp.o mempool.o textparse.o base64.o base32hex.o \
- 	    rr.o soa.o a.o cname.o mx.o ns.o \
-@@ -38,7 +38,7 @@
- 	    dname.o tlsa.o nid.o l32.o l64.o lp.o \
- 	    ipseckey.o cbtree.o mb.o mg.o mr.o minfo.o \
- 	    afsdb.o x25.o isdn.o rt.o px.o kx.o \
--	    dlv.o dhcid.o nsap.o \
-+	    dlv.o dhcid.o nsap.o caa.o \
- 	    -L/usr/local/lib -L/opt/local/lib $(EXTRALPATH) \
- 	    -lJudy -lcrypto $(EXTRALIBS) $(EXTRALINKING)
- 
-@@ -53,7 +53,7 @@
- 	-rm -f nid.o l32.o l64.o lp.o ipseckey.o
- 	-rm -f cbtree.o mb.o mg.o mr.o minfo.o
- 	-rm -f afsdb.o x25.o isdn.o rt.o px.o kx.o
--	-rm -f dlv.o dhcid.o nsap.o
-+	-rm -f dlv.o dhcid.o nsap.o caa.o
- 	-rm -f validns.core core
- 	@echo ':-)'
- 
-@@ -177,6 +177,9 @@
- sshfp.o: sshfp.c common.h textparse.h mempool.h carp.h rr.h
- 	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o sshfp.o sshfp.c $(INCPATH)
- 
-+caa.o: caa.c common.h textparse.h mempool.h carp.h rr.h
-+	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o caa.o caa.c $(INCPATH)
-+
- rp.o: rp.c common.h textparse.h mempool.h carp.h rr.h
- 	$(CC) $(CFLAGS) $(OPTIMIZE) -c -o rp.o rp.c $(INCPATH)
- 
-diff -Naur validns-0.8/mb.c validns/mb.c
---- validns-0.8/mb.c	2014-02-11 15:46:38.000000000 -0500
-+++ validns/mb.c	2020-10-05 16:59:29.354681360 -0400
-@@ -19,28 +19,28 @@
- 
- static struct rr *mb_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_mb *rr = getmem(sizeof(*rr));
-+    struct rr_mb *rr = getmem(sizeof(*rr));
- 
--	rr->madname = extract_name(&s, "madname", 0);
--	if (!rr->madname)
--		return NULL;
--	if (*s) {
--		return bitch("garbage after valid MB data");
--	}
-+    rr->madname = extract_name(&s, "madname", 0);
-+    if (!rr->madname)
-+        return NULL;
-+    if (*s) {
-+        return bitch("garbage after valid MB data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* mb_human(struct rr *rrv)
- {
--	RRCAST(mb);
-+    RRCAST(mb);
-     return rr->madname;
- }
- 
- static struct binary_data mb_wirerdata(struct rr *rrv)
- {
--	RRCAST(mb);
--	return name2wire_name(rr->madname);
-+    RRCAST(mb);
-+    return name2wire_name(rr->madname);
- }
- 
- struct rr_methods mb_methods = { mb_parse, mb_human, mb_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/mempool.c validns/mempool.c
---- validns-0.8/mempool.c	2014-02-11 15:47:03.000000000 -0500
-+++ validns/mempool.c	2020-10-05 16:59:29.354681360 -0400
-@@ -14,10 +14,10 @@
- 
- struct pool
- {
--	struct pool *next;
--	size_t pool_size;
--	size_t free_index;
--	char mem[0];
-+    struct pool *next;
-+    size_t pool_size;
-+    size_t free_index;
-+    char mem[0];
- };
- 
- static struct pool *freespace = NULL;
-@@ -25,78 +25,78 @@
- 
- static void new_pool(size_t size)
- {
--	struct pool *pool;
-+    struct pool *pool;
- 
--	size = (size + sizeof(void *) - 1) / sizeof(void *);
--	size *= sizeof(void *);
--	pool = malloc(size + sizeof(struct pool));
--	if (!pool)
--		croak(1, "new_pool malloc");
--	pool->next = freespace;
--	pool->free_index = 0;
--	pool->pool_size = size;
--	freespace = pool;
-+    size = (size + sizeof(void *) - 1) / sizeof(void *);
-+    size *= sizeof(void *);
-+    pool = malloc(size + sizeof(struct pool));
-+    if (!pool)
-+        croak(1, "new_pool malloc");
-+    pool->next = freespace;
-+    pool->free_index = 0;
-+    pool->pool_size = size;
-+    freespace = pool;
- }
- 
- void
- mem_requirements_hint(size_t size)
- {
--	if (freespace) return;
--	new_pool(size);
-+    if (freespace) return;
-+    new_pool(size);
- }
- 
- void *getmem(size_t size)
- {
--	void *ret;
--	size = (size + sizeof(void *) - 1) / sizeof(void *);
--	size *= sizeof(void *);
--	if (!freespace)	new_pool(size > 256000 ? size : 256000);
--	if (freespace->pool_size - freespace->free_index < size)
--		new_pool(size > 256000 ? size : 256000);
--	ret = freespace->mem + freespace->free_index;
--	freespace->free_index += size;
--	return ret;
-+    void *ret;
-+    size = (size + sizeof(void *) - 1) / sizeof(void *);
-+    size *= sizeof(void *);
-+    if (!freespace) new_pool(size > 256000 ? size : 256000);
-+    if (freespace->pool_size - freespace->free_index < size)
-+        new_pool(size > 256000 ? size : 256000);
-+    ret = freespace->mem + freespace->free_index;
-+    freespace->free_index += size;
-+    return ret;
- }
- 
- void *getmem_temp(size_t size)
- {
--	void *ret;
--	size = (size + sizeof(void *) - 1) / sizeof(void *);
--	size *= sizeof(void *);
--	if (!temp_freespace) {
--		size_t pool_size = size > 1024*1024 ? size : 1024*1024;
--		pool_size = (pool_size + sizeof(void *) - 1) / sizeof(void *);
--		pool_size *= sizeof(void *);
--		temp_freespace = malloc(pool_size + sizeof(struct pool));
--		if (!temp_freespace)
--			croak(1, "getmem_temp malloc");
--		temp_freespace->next = NULL;
--		temp_freespace->free_index = 0;
--		temp_freespace->pool_size = pool_size;
--	}
--	if (temp_freespace->pool_size - temp_freespace->free_index < size)
--		croak(1, "getmem_temp request too large");
--	ret = temp_freespace->mem + temp_freespace->free_index;
--	temp_freespace->free_index += size;
--	return ret;
-+    void *ret;
-+    size = (size + sizeof(void *) - 1) / sizeof(void *);
-+    size *= sizeof(void *);
-+    if (!temp_freespace) {
-+        size_t pool_size = size > 1024*1024 ? size : 1024*1024;
-+        pool_size = (pool_size + sizeof(void *) - 1) / sizeof(void *);
-+        pool_size *= sizeof(void *);
-+        temp_freespace = malloc(pool_size + sizeof(struct pool));
-+        if (!temp_freespace)
-+            croak(1, "getmem_temp malloc");
-+        temp_freespace->next = NULL;
-+        temp_freespace->free_index = 0;
-+        temp_freespace->pool_size = pool_size;
-+    }
-+    if (temp_freespace->pool_size - temp_freespace->free_index < size)
-+        croak(1, "getmem_temp request too large");
-+    ret = temp_freespace->mem + temp_freespace->free_index;
-+    temp_freespace->free_index += size;
-+    return ret;
- }
- 
- int freeall_temp(void)
- {
--	if (temp_freespace) {
--		temp_freespace->free_index = 0;
--	}
--	return 1;
-+    if (temp_freespace) {
-+        temp_freespace->free_index = 0;
-+    }
-+    return 1;
- }
- 
- char *quickstrdup(char *s)
- {
--	char *r = getmem(strlen(s)+1);
--	return strcpy(r, s);
-+    char *r = getmem(strlen(s)+1);
-+    return strcpy(r, s);
- }
- 
- char *quickstrdup_temp(char *s)
- {
--	char *r = getmem_temp(strlen(s)+1);
--	return strcpy(r, s);
-+    char *r = getmem_temp(strlen(s)+1);
-+    return strcpy(r, s);
- }
-diff -Naur validns-0.8/mg.c validns/mg.c
---- validns-0.8/mg.c	2014-02-11 15:46:40.000000000 -0500
-+++ validns/mg.c	2020-10-05 16:59:29.355681369 -0400
-@@ -19,28 +19,28 @@
- 
- static struct rr *mg_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_mg *rr = getmem(sizeof(*rr));
-+    struct rr_mg *rr = getmem(sizeof(*rr));
- 
--	rr->mgmname = extract_name(&s, "mgmname", 0);
--	if (!rr->mgmname)
--		return NULL;
--	if (*s) {
--		return bitch("garbage after valid MG data");
--	}
-+    rr->mgmname = extract_name(&s, "mgmname", 0);
-+    if (!rr->mgmname)
-+        return NULL;
-+    if (*s) {
-+        return bitch("garbage after valid MG data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* mg_human(struct rr *rrv)
- {
--	RRCAST(mg);
-+    RRCAST(mg);
-     return rr->mgmname;
- }
- 
- static struct binary_data mg_wirerdata(struct rr *rrv)
- {
--	RRCAST(mg);
--	return name2wire_name(rr->mgmname);
-+    RRCAST(mg);
-+    return name2wire_name(rr->mgmname);
- }
- 
- struct rr_methods mg_methods = { mg_parse, mg_human, mg_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/minfo.c validns/minfo.c
---- validns-0.8/minfo.c	2014-02-11 15:46:43.000000000 -0500
-+++ validns/minfo.c	2020-10-05 16:59:29.355681369 -0400
-@@ -19,38 +19,38 @@
- 
- static struct rr *minfo_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_minfo *rr = getmem(sizeof(*rr));
-+    struct rr_minfo *rr = getmem(sizeof(*rr));
- 
--	rr->rmailbx = extract_name(&s, "rmailbx", 0);
--	if (!rr->rmailbx)
--		return NULL;
-+    rr->rmailbx = extract_name(&s, "rmailbx", 0);
-+    if (!rr->rmailbx)
-+        return NULL;
- 
--	rr->emailbx = extract_name(&s, "emailbx", 0);
--	if (!rr->emailbx)
--		return NULL;
-+    rr->emailbx = extract_name(&s, "emailbx", 0);
-+    if (!rr->emailbx)
-+        return NULL;
- 
--	if (*s) {
--		return bitch("garbage after valid MINFO data");
--	}
-+    if (*s) {
-+        return bitch("garbage after valid MINFO data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* minfo_human(struct rr *rrv)
- {
--	RRCAST(minfo);
--	char s[1024];
-+    RRCAST(minfo);
-+    char s[1024];
- 
--	snprintf(s, 1024, "%s %s", rr->rmailbx, rr->emailbx);
--	return quickstrdup_temp(s);
-+    snprintf(s, 1024, "%s %s", rr->rmailbx, rr->emailbx);
-+    return quickstrdup_temp(s);
- }
- 
- static struct binary_data minfo_wirerdata(struct rr *rrv)
- {
--	RRCAST(minfo);
--	return compose_binary_data("dd", 1,
--		name2wire_name(rr->rmailbx),
--		name2wire_name(rr->emailbx));
-+    RRCAST(minfo);
-+    return compose_binary_data("dd", 1,
-+        name2wire_name(rr->rmailbx),
-+        name2wire_name(rr->emailbx));
- }
- 
- struct rr_methods minfo_methods = { minfo_parse, minfo_human, minfo_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/mr.c validns/mr.c
---- validns-0.8/mr.c	2014-02-11 15:46:46.000000000 -0500
-+++ validns/mr.c	2020-10-05 16:59:29.355681369 -0400
-@@ -19,28 +19,28 @@
- 
- static struct rr *mr_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_mr *rr = getmem(sizeof(*rr));
-+    struct rr_mr *rr = getmem(sizeof(*rr));
- 
--	rr->newname = extract_name(&s, "newname", 0);
--	if (!rr->newname)
--		return NULL;
--	if (*s) {
--		return bitch("garbage after valid MR data");
--	}
-+    rr->newname = extract_name(&s, "newname", 0);
-+    if (!rr->newname)
-+        return NULL;
-+    if (*s) {
-+        return bitch("garbage after valid MR data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* mr_human(struct rr *rrv)
- {
--	RRCAST(mr);
-+    RRCAST(mr);
-     return rr->newname;
- }
- 
- static struct binary_data mr_wirerdata(struct rr *rrv)
- {
--	RRCAST(mr);
--	return name2wire_name(rr->newname);
-+    RRCAST(mr);
-+    return name2wire_name(rr->newname);
- }
- 
- struct rr_methods mr_methods = { mr_parse, mr_human, mr_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/mx.c validns/mx.c
---- validns-0.8/mx.c	2014-02-11 15:45:19.000000000 -0500
-+++ validns/mx.c	2020-10-05 16:59:29.355681369 -0400
-@@ -19,59 +19,59 @@
- 
- static struct rr *mx_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_mx *rr = getmem(sizeof(*rr));
-+    struct rr_mx *rr = getmem(sizeof(*rr));
- 
--	rr->preference = extract_integer(&s, "MX preference");
--	if (rr->preference < 0)
--		return NULL;
--	/* XXX preference range check */
--	rr->exchange = extract_name(&s, "MX exchange", 0);
--	if (!rr->exchange)
--		return NULL;
--	if (*s) {
--		return bitch("garbage after valid MX data");
--	}
-+    rr->preference = extract_integer(&s, "MX preference", NULL);
-+    if (rr->preference < 0)
-+        return NULL;
-+    /* XXX preference range check */
-+    rr->exchange = extract_name(&s, "MX exchange", 0);
-+    if (!rr->exchange)
-+        return NULL;
-+    if (*s) {
-+        return bitch("garbage after valid MX data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* mx_human(struct rr *rrv)
- {
--	RRCAST(mx);
-+    RRCAST(mx);
-     char s[1024];
- 
-     snprintf(s, 1024, "%d %s",
--	     rr->preference, rr->exchange);
-+         rr->preference, rr->exchange);
-     return quickstrdup_temp(s);
- }
- 
- static struct binary_data mx_wirerdata(struct rr *rrv)
- {
--	RRCAST(mx);
-+    RRCAST(mx);
- 
-     return compose_binary_data("2d", 1,
--		rr->preference, name2wire_name(rr->exchange));
-+        rr->preference, name2wire_name(rr->exchange));
- }
- 
- static void* mx_validate_set(struct rr_set *rr_set)
- {
--	if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) {
--		struct rr *rr = rr_set->tail;
--		return moan(rr->file_name, rr->line, "host name contains '/'");
--	}
--	return NULL;
-+    if (rr_set->named_rr->flags & NAME_FLAG_CONTAINS_SLASH) {
-+        struct rr *rr = rr_set->tail;
-+        return moan(rr->file_name, rr->line, "host name contains '/'");
-+    }
-+    return NULL;
- }
- 
- static void *mx_validate(struct rr *rrv)
- {
--	RRCAST(mx);
-+    RRCAST(mx);
- 
--	if (G.opt.policy_checks[POLICY_MX_ALIAS]) {
--		if (find_rr_set(T_CNAME, rr->exchange)) {
--			return moan(rr->rr.file_name, rr->rr.line, "MX exchange is an alias");
--		}
--	}
--	return NULL;
-+    if (G.opt.policy_checks[POLICY_MX_ALIAS]) {
-+        if (find_rr_set(T_CNAME, rr->exchange)) {
-+            return moan(rr->rr.file_name, rr->rr.line, "MX exchange is an alias");
-+        }
-+    }
-+    return NULL;
- }
- 
- struct rr_methods mx_methods = { mx_parse, mx_human, mx_wirerdata, mx_validate_set, mx_validate };
-diff -Naur validns-0.8/naptr.c validns/naptr.c
---- validns-0.8/naptr.c	2014-02-11 15:45:22.000000000 -0500
-+++ validns/naptr.c	2020-10-05 16:59:29.355681369 -0400
-@@ -20,74 +20,74 @@
- 
- static struct rr *naptr_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_naptr *rr = getmem(sizeof(*rr));
--	int i;
--	struct binary_data text;
--
--	i = extract_integer(&s, "order");
--	if (i < 0)
--		return NULL;
--	if (i >= 65536)
--		return bitch("order range is not valid");
--	rr->order = i;
--
--	i = extract_integer(&s, "preference");
--	if (i < 0)
--		return NULL;
--	if (i >= 65536)
--		return bitch("preference range is not valid");
--	rr->preference = i;
--
--	text = extract_text(&s, "flags");
--	if (text.length < 0)
--		return NULL;
--	for (i = 0; i < text.length; i++) {
--		if (!isalnum(text.data[i])) {
--			return bitch("flags contains illegal characters");
--		}
--	}
--	rr->flags = text;
--
--	text = extract_text(&s, "services");
--	if (text.length < 0)
--		return NULL;
--	rr->services = text;
--
--	text = extract_text(&s, "regexp");
--	if (text.length < 0)
--		return NULL;
--	rr->regexp = text;
--
--	rr->replacement = extract_name(&s, "replacement", 0);
--	if (!rr->replacement)
--		return NULL;
--
--	if (*s) {
--		return bitch("garbage after valid NAPTR data");
--	}
-+    struct rr_naptr *rr = getmem(sizeof(*rr));
-+    int i;
-+    struct binary_data text;
-+
-+    i = extract_integer(&s, "order", NULL);
-+    if (i < 0)
-+        return NULL;
-+    if (i >= 65536)
-+        return bitch("order range is not valid");
-+    rr->order = i;
-+
-+    i = extract_integer(&s, "preference", NULL);
-+    if (i < 0)
-+        return NULL;
-+    if (i >= 65536)
-+        return bitch("preference range is not valid");
-+    rr->preference = i;
-+
-+    text = extract_text(&s, "flags");
-+    if (text.length < 0)
-+        return NULL;
-+    for (i = 0; i < text.length; i++) {
-+        if (!isalnum(text.data[i])) {
-+            return bitch("flags contains illegal characters");
-+        }
-+    }
-+    rr->flags = text;
-+
-+    text = extract_text(&s, "services");
-+    if (text.length < 0)
-+        return NULL;
-+    rr->services = text;
-+
-+    text = extract_text(&s, "regexp");
-+    if (text.length < 0)
-+        return NULL;
-+    rr->regexp = text;
-+
-+    rr->replacement = extract_name(&s, "replacement", 0);
-+    if (!rr->replacement)
-+        return NULL;
-+
-+    if (*s) {
-+        return bitch("garbage after valid NAPTR data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* naptr_human(struct rr *rrv)
- {
--	RRCAST(naptr);
-+    RRCAST(naptr);
-     char s[1024];
- 
--	snprintf(s, 1024, "%hu %hu \"%s\" ...",
--			 rr->order, rr->preference, rr->flags.data);
-+    snprintf(s, 1024, "%hu %hu \"%s\" ...",
-+             rr->order, rr->preference, rr->flags.data);
- 
--	return quickstrdup_temp(s);
-+    return quickstrdup_temp(s);
- }
- 
- static struct binary_data naptr_wirerdata(struct rr *rrv)
- {
--	RRCAST(naptr);
-+    RRCAST(naptr);
- 
-     return compose_binary_data("22bbbd", 1,
--		rr->order, rr->preference,
--		rr->flags, rr->services, rr->regexp,
--		name2wire_name(rr->replacement));
-+        rr->order, rr->preference,
-+        rr->flags, rr->services, rr->regexp,
-+        name2wire_name(rr->replacement));
- }
- 
- struct rr_methods naptr_methods = { naptr_parse, naptr_human, naptr_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/nid.c validns/nid.c
---- validns-0.8/nid.c	2014-02-11 15:46:20.000000000 -0500
-+++ validns/nid.c	2020-10-05 16:59:29.355681369 -0400
-@@ -19,39 +19,39 @@
- 
- static struct rr *nid_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_nid *rr = getmem(sizeof(*rr));
--	int preference;
-+    struct rr_nid *rr = getmem(sizeof(*rr));
-+    int preference;
- 
--	rr->preference = preference = extract_integer(&s, "NID preference");
--	if (preference < 0)
--		return NULL;
--	if (extract_u64(&s, "NodeID", &rr->node_id) < 0)
--		return NULL;
--
--	if (*s) {
--		return bitch("garbage after valid NID data");
--	}
-+    rr->preference = preference = extract_integer(&s, "NID preference", NULL);
-+    if (preference < 0)
-+        return NULL;
-+    if (extract_u64(&s, "NodeID", &rr->node_id) < 0)
-+        return NULL;
-+
-+    if (*s) {
-+        return bitch("garbage after valid NID data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* nid_human(struct rr *rrv)
- {
--	RRCAST(nid);
-+    RRCAST(nid);
-     char s[1024];
- 
-     snprintf(s, 1024, "%d %x:%x:%x:%x",
--	     rr->preference,
--		 (unsigned)(rr->node_id >> 48) & 0xffff,
--		 (unsigned)(rr->node_id >> 32) & 0xffff,
--		 (unsigned)(rr->node_id >> 16) & 0xffff,
--		 (unsigned)(rr->node_id >> 0) & 0xffff);
-+         rr->preference,
-+         (unsigned)(rr->node_id >> 48) & 0xffff,
-+         (unsigned)(rr->node_id >> 32) & 0xffff,
-+         (unsigned)(rr->node_id >> 16) & 0xffff,
-+         (unsigned)(rr->node_id >> 0) & 0xffff);
-     return quickstrdup_temp(s);
- }
- 
- static struct binary_data nid_wirerdata(struct rr *rrv)
- {
--	RRCAST(nid);
-+    RRCAST(nid);
-     return compose_binary_data("28", 1, rr->preference, rr->node_id);
- }
- 
-diff -Naur validns-0.8/nsap.c validns/nsap.c
---- validns-0.8/nsap.c	2014-02-11 15:46:48.000000000 -0500
-+++ validns/nsap.c	2020-10-05 16:59:29.355681369 -0400
-@@ -19,15 +19,15 @@
- 
- static struct rr* nsap_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_nsap *rr = getmem(sizeof(*rr));
-+    struct rr_nsap *rr = getmem(sizeof(*rr));
- 
--	rr->data = extract_hex_binary_data(&s, "NSAP data", EXTRACT_EAT_WHITESPACE);
--	if (rr->data.length < 0)	return NULL;
-+    rr->data = extract_hex_binary_data(&s, "NSAP data", EXTRACT_EAT_WHITESPACE);
-+    if (rr->data.length < 0)    return NULL;
- 
--	if (*s) {
--		return bitch("garbage after valid NSAP data");
--	}
--	return store_record(type, name, ttl, rr);
-+    if (*s) {
-+        return bitch("garbage after valid NSAP data");
-+    }
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* nsap_human(struct rr *rrv)
-@@ -37,9 +37,9 @@
- 
- static struct binary_data nsap_wirerdata(struct rr *rrv)
- {
--	RRCAST(nsap);
-+    RRCAST(nsap);
- 
--	return compose_binary_data("d", 1, rr->data);
-+    return compose_binary_data("d", 1, rr->data);
- }
- 
- struct rr_methods nsap_methods = { nsap_parse, nsap_human, nsap_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/ns.c validns/ns.c
---- validns-0.8/ns.c	2014-02-11 15:45:28.000000000 -0500
-+++ validns/ns.c	2020-10-05 16:59:29.355681369 -0400
-@@ -20,63 +20,63 @@
- 
- static struct rr *ns_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_ns *rr = getmem(sizeof(*rr));
--	struct rr *ret_rr;
-+    struct rr_ns *rr = getmem(sizeof(*rr));
-+    struct rr *ret_rr;
- 
--	rr->nsdname = extract_name(&s, "name server domain name", 0);
--	if (!rr->nsdname)
--		return NULL;
--	if (*s) {
--		return bitch("garbage after valid NS data");
--	}
--
--	ret_rr = store_record(type, name, ttl, rr);
--	if (ret_rr) {
--		if (!(ret_rr->rr_set->named_rr->flags & (NAME_FLAG_APEX|NAME_FLAG_DELEGATION))) {
--			ret_rr->rr_set->named_rr->flags |= NAME_FLAG_DELEGATION;
--			G.stats.delegations++;
--		}
--	}
--	return ret_rr;
-+    rr->nsdname = extract_name(&s, "name server domain name", 0);
-+    if (!rr->nsdname)
-+        return NULL;
-+    if (*s) {
-+        return bitch("garbage after valid NS data");
-+    }
-+
-+    ret_rr = store_record(type, name, ttl, rr);
-+    if (ret_rr) {
-+        if (!(ret_rr->rr_set->named_rr->flags & (NAME_FLAG_APEX|NAME_FLAG_DELEGATION))) {
-+            ret_rr->rr_set->named_rr->flags |= NAME_FLAG_DELEGATION;
-+            G.stats.delegations++;
-+        }
-+    }
-+    return ret_rr;
- }
- 
- static char* ns_human(struct rr *rrv)
- {
--	RRCAST(ns);
-+    RRCAST(ns);
- 
-     return rr->nsdname;
- }
- 
- static struct binary_data ns_wirerdata(struct rr *rrv)
- {
--	RRCAST(ns);
--	return name2wire_name(rr->nsdname);
-+    RRCAST(ns);
-+    return name2wire_name(rr->nsdname);
- }
- 
- static void* ns_validate_set(struct rr_set *rr_set)
- {
--	struct rr *rr;
--	if (G.opt.policy_checks[POLICY_SINGLE_NS]) {
--		if (rr_set->count < 2) {
--			rr = rr_set->tail;
--			return moan(rr->file_name, rr->line, "there should be at least two NS records per name");
--		}
--	}
--	return NULL;
-+    struct rr *rr;
-+    if (G.opt.policy_checks[POLICY_SINGLE_NS]) {
-+        if (rr_set->count < 2) {
-+            rr = rr_set->tail;
-+            return moan(rr->file_name, rr->line, "there should be at least two NS records per name");
-+        }
-+    }
-+    return NULL;
- }
- 
- static void *ns_validate(struct rr *rrv)
- {
--	RRCAST(ns);
-+    RRCAST(ns);
- 
--	if (G.opt.policy_checks[POLICY_NS_ALIAS]) {
--		if (find_rr_set(T_CNAME, rr->nsdname)) {
--			return moan(rr->rr.file_name, rr->rr.line, "NS data is an alias");
--		}
--	}
--	if (strchr(rr->nsdname, '/') != NULL)
--		return moan(rr->rr.file_name, rr->rr.line, "NS data contains '/'");
--	return NULL;
-+    if (G.opt.policy_checks[POLICY_NS_ALIAS]) {
-+        if (find_rr_set(T_CNAME, rr->nsdname)) {
-+            return moan(rr->rr.file_name, rr->rr.line, "NS data is an alias");
-+        }
-+    }
-+    if (strchr(rr->nsdname, '/') != NULL)
-+        return moan(rr->rr.file_name, rr->rr.line, "NS data contains '/'");
-+    return NULL;
- }
- 
- struct rr_methods ns_methods = { ns_parse, ns_human, ns_wirerdata, ns_validate_set, ns_validate };
-diff -Naur validns-0.8/nsec3.c validns/nsec3.c
---- validns-0.8/nsec3.c	2014-02-11 15:45:31.000000000 -0500
-+++ validns/nsec3.c	2020-10-05 16:59:29.355681369 -0400
-@@ -24,125 +24,125 @@
- static struct rr* nsec3_parse(char *name, long ttl, int type, char *s)
- {
-     struct rr_nsec3 *rr = getmem(sizeof(*rr));
--	struct rr *ret_rr;
--	struct binary_data bitmap;
--	int i;
--	int opt_out = 0;
--	char *str_type = NULL;
--	int ltype;
--
--	i = extract_integer(&s, "hash algorithm");
--	if (i < 0)
--		return NULL;
--	if (i > 255)
--		return bitch("bad hash algorithm value");
--	if (i != 1)
--		return bitch("unrecognized or unsupported hash algorithm");
--	rr->hash_algorithm = i;
--
--	i = extract_integer(&s, "flags");
--	if (i < 0)
--		return NULL;
--	if (i > 255)
--		return bitch("bad flags value");
--
--	if (!(i == 0 || i == 1))
--		return bitch("unsupported flags value");
--	if (i == 1)
--		opt_out = 1;
--	rr->flags = i;
--
--	i = extract_integer(&s, "iterations");
--	if (i < 0)
--		return NULL;
--	if (i > 2500)
--		return bitch("bad iterations value");
--	rr->iterations = i;
--	/* TODO validate iteration count according to key size,
--	 * as per http://tools.ietf.org/html/rfc5155#section-10.3 */
--
--	if (*s == '-') {
--		rr->salt.length = 0;
--		rr->salt.data = NULL;
--		s++;
--		if (*s && !isspace(*s) && *s != ';' && *s != ')')
--			return bitch("salt is not valid");
--		s = skip_white_space(s);
--	} else {
--		rr->salt = extract_hex_binary_data(&s, "salt", EXTRACT_DONT_EAT_WHITESPACE);
--		if (rr->salt.length <= 0)
--			return NULL;
--		if (rr->salt.length > 255)
--			return bitch("salt is too long");
--	}
--
--	rr->next_hashed_owner = extract_base32hex_binary_data(&s, "next hashed owner");
--	if (rr->next_hashed_owner.length != 20) {
--		return bitch("next hashed owner does not have the right size");
--	}
--
--	bitmap = new_set();
--	while (s && *s) {
--		str_type = extract_label(&s, "type list", "temporary");
--		if (!str_type) return NULL;
--		ltype = str2rdtype(str_type, NULL);
--		if (ltype < 0)
--			return NULL;
--		add_bit_to_set(&bitmap, ltype);
--	}
--	if (!s)
--		return NULL;
--	rr->type_bitmap = compressed_set(&bitmap);
-+    struct rr *ret_rr;
-+    struct binary_data bitmap;
-+    int i;
-+    int opt_out = 0;
-+    char *str_type = NULL;
-+    int ltype;
-+
-+    i = extract_integer(&s, "hash algorithm", NULL);
-+    if (i < 0)
-+        return NULL;
-+    if (i > 255)
-+        return bitch("bad hash algorithm value");
-+    if (i != 1)
-+        return bitch("unrecognized or unsupported hash algorithm");
-+    rr->hash_algorithm = i;
-+
-+    i = extract_integer(&s, "flags", NULL);
-+    if (i < 0)
-+        return NULL;
-+    if (i > 255)
-+        return bitch("bad flags value");
-+
-+    if (!(i == 0 || i == 1))
-+        return bitch("unsupported flags value");
-+    if (i == 1)
-+        opt_out = 1;
-+    rr->flags = i;
-+
-+    i = extract_integer(&s, "iterations", NULL);
-+    if (i < 0)
-+        return NULL;
-+    if (i > 2500)
-+        return bitch("bad iterations value");
-+    rr->iterations = i;
-+    /* TODO validate iteration count according to key size,
-+     * as per http://tools.ietf.org/html/rfc5155#section-10.3 */
-+
-+    if (*s == '-') {
-+        rr->salt.length = 0;
-+        rr->salt.data = NULL;
-+        s++;
-+        if (*s && !isspace(*s) && *s != ';' && *s != ')')
-+            return bitch("salt is not valid");
-+        s = skip_white_space(s);
-+    } else {
-+        rr->salt = extract_hex_binary_data(&s, "salt", EXTRACT_DONT_EAT_WHITESPACE);
-+        if (rr->salt.length <= 0)
-+            return NULL;
-+        if (rr->salt.length > 255)
-+            return bitch("salt is too long");
-+    }
-+
-+    rr->next_hashed_owner = extract_base32hex_binary_data(&s, "next hashed owner");
-+    if (rr->next_hashed_owner.length != 20) {
-+        return bitch("next hashed owner does not have the right size");
-+    }
-+
-+    bitmap = new_set();
-+    while (s && *s) {
-+        str_type = extract_label(&s, "type list", "temporary");
-+        if (!str_type) return NULL;
-+        ltype = str2rdtype(str_type, NULL);
-+        if (ltype < 0)
-+            return NULL;
-+        add_bit_to_set(&bitmap, ltype);
-+    }
-+    if (!s)
-+        return NULL;
-+    rr->type_bitmap = compressed_set(&bitmap);
- 
--	rr->corresponding_name = NULL;
--	rr->next_nsec3 = NULL;
-+    rr->corresponding_name = NULL;
-+    rr->next_nsec3 = NULL;
- 
--	if (!remember_nsec3(name, rr))
--		return NULL;
-+    if (!remember_nsec3(name, rr))
-+        return NULL;
- 
-     ret_rr = store_record(type, name, ttl, rr);
--	if (ret_rr) {
--		G.nsec3_present = 1;
--		G.dnssec_active = 1;
--		G.stats.nsec3_count++;
--		if (opt_out) {
--			G.nsec3_opt_out_present = 1;
--		}
--		if (ret_rr && !nsec3param)
--			nsec3param = ret_rr;
--	}
--	return ret_rr;
-+    if (ret_rr) {
-+        G.nsec3_present = 1;
-+        G.dnssec_active = 1;
-+        G.stats.nsec3_count++;
-+        if (opt_out) {
-+            G.nsec3_opt_out_present = 1;
-+        }
-+        if (ret_rr && !nsec3param)
-+            nsec3param = ret_rr;
-+    }
-+    return ret_rr;
- }
- 
- static char* nsec3_human(struct rr *rrv)
- {
--	RRCAST(nsec3);
-+    RRCAST(nsec3);
-     char ss[1024];
--	char *s = ss;
--	int l;
--	int i;
-+    char *s = ss;
-+    int l;
-+    int i;
- 
-     l = snprintf(s, 1024, "%u %u %u ", rr->hash_algorithm, rr->flags, rr->iterations);
--	s += l;
--	if (rr->salt.length) {
--		for (i = 0; i < rr->salt.length; i++) {
--			l = snprintf(s, 1024-(s-ss), "%02X", (unsigned char)rr->salt.data[i]);
--			s += l;
--		}
--	} else {
--		sprintf(s, "-");
--	}
-+    s += l;
-+    if (rr->salt.length) {
-+        for (i = 0; i < rr->salt.length; i++) {
-+            l = snprintf(s, 1024-(s-ss), "%02X", (unsigned char)rr->salt.data[i]);
-+            s += l;
-+        }
-+    } else {
-+        sprintf(s, "-");
-+    }
-     return quickstrdup_temp(ss);
- }
- 
- static struct binary_data nsec3_wirerdata(struct rr *rrv)
- {
--	RRCAST(nsec3);
-+    RRCAST(nsec3);
- 
--	return compose_binary_data("112bbd", 1,
--		rr->hash_algorithm, rr->flags,
--		rr->iterations, rr->salt,
--		rr->next_hashed_owner, rr->type_bitmap);
-+    return compose_binary_data("112bbd", 1,
-+        rr->hash_algorithm, rr->flags,
-+        rr->iterations, rr->salt,
-+        rr->next_hashed_owner, rr->type_bitmap);
- }
- 
- struct rr_nsec3 *first_nsec3 = NULL;
-@@ -150,36 +150,36 @@
- 
- void* nsec3_validate(struct rr *rrv)
- {
--	RRCAST(nsec3);
-+    RRCAST(nsec3);
- 
--	if (!first_nsec3) {
--		first_nsec3 = rr;
--	}
--	if (latest_nsec3) {
--		if (memcmp(latest_nsec3->next_hashed_owner.data, rr->this_hashed_name.data, 20) != 0) {
--			char *expected_name = quickstrdup_temp(rr->rr.rr_set->named_rr->name);
--			/* guaranteed to have same length, I think */
--			encode_base32hex(expected_name, 32, latest_nsec3->next_hashed_owner.data, 20);
--			if (rr == first_nsec3) {
--				moan(latest_nsec3->rr.file_name, latest_nsec3->rr.line,
--					 "broken NSEC3 chain, expected %s, but nothing found",
--					 expected_name);
--			} else {
--				moan(latest_nsec3->rr.file_name, latest_nsec3->rr.line,
--					 "broken NSEC3 chain, expected %s, but found %s",
--					 expected_name,
--					 rr->rr.rr_set->named_rr->name);
--			}
--			if (rr != first_nsec3)
--				latest_nsec3->next_nsec3 = rr;
--			latest_nsec3 = rr;
--			return NULL;
--		}
--		if (rr != first_nsec3)
--			latest_nsec3->next_nsec3 = rr;
--	}
--	latest_nsec3 = rr;
--	return rr;
-+    if (!first_nsec3) {
-+        first_nsec3 = rr;
-+    }
-+    if (latest_nsec3) {
-+        if (memcmp(latest_nsec3->next_hashed_owner.data, rr->this_hashed_name.data, 20) != 0) {
-+            char *expected_name = quickstrdup_temp(rr->rr.rr_set->named_rr->name);
-+            /* guaranteed to have same length, I think */
-+            encode_base32hex(expected_name, 32, latest_nsec3->next_hashed_owner.data, 20);
-+            if (rr == first_nsec3) {
-+                moan(latest_nsec3->rr.file_name, latest_nsec3->rr.line,
-+                     "broken NSEC3 chain, expected %s, but nothing found",
-+                     expected_name);
-+            } else {
-+                moan(latest_nsec3->rr.file_name, latest_nsec3->rr.line,
-+                     "broken NSEC3 chain, expected %s, but found %s",
-+                     expected_name,
-+                     rr->rr.rr_set->named_rr->name);
-+            }
-+            if (rr != first_nsec3)
-+                latest_nsec3->next_nsec3 = rr;
-+            latest_nsec3 = rr;
-+            return NULL;
-+        }
-+        if (rr != first_nsec3)
-+            latest_nsec3->next_nsec3 = rr;
-+    }
-+    latest_nsec3 = rr;
-+    return rr;
- }
- 
- struct rr_methods nsec3_methods = { nsec3_parse, nsec3_human, nsec3_wirerdata, NULL, nsec3_validate };
-diff -Naur validns-0.8/nsec3checks.c validns/nsec3checks.c
---- validns-0.8/nsec3checks.c	2020-10-05 16:57:07.219376944 -0400
-+++ validns/nsec3checks.c	2020-10-05 16:59:48.870860473 -0400
-@@ -29,44 +29,44 @@
- {
-     struct rr_nsec3param *p = (struct rr_nsec3param *)param;
-     EVP_MD_CTX *ctx;
--	unsigned char md0[EVP_MAX_MD_SIZE];
--	unsigned char md1[EVP_MAX_MD_SIZE];
--	unsigned char *md[2];
--	int mdi = 0;
--	struct binary_data r = bad_binary_data();
--	struct binary_data wire_name = name2wire_name(name);
--	int i;
--	int digest_size;
--
--	md[0] = md0;
--	md[1] = md1;
--	if (wire_name.length < 0)
--		return r;
-+    unsigned char md0[EVP_MAX_MD_SIZE];
-+    unsigned char md1[EVP_MAX_MD_SIZE];
-+    unsigned char *md[2];
-+    int mdi = 0;
-+    struct binary_data r = bad_binary_data();
-+    struct binary_data wire_name = name2wire_name(name);
-+    int i;
-+    int digest_size;
-+
-+    md[0] = md0;
-+    md[1] = md1;
-+    if (wire_name.length < 0)
-+        return r;
- 
--	/* XXX Maybe use Init_ex and Final_ex for speed? */
-+    /* XXX Maybe use Init_ex and Final_ex for speed? */
- 
-     ctx = EVP_MD_CTX_new();
--		return r;
-+        return r;
-     digest_size = EVP_MD_CTX_size(ctx);
-     EVP_DigestUpdate(ctx, wire_name.data, wire_name.length);
-     EVP_DigestUpdate(ctx, p->salt.data, p->salt.length);
-     EVP_DigestFinal(ctx, md[mdi], NULL);
- 
--	for (i = 0; i < p->iterations; i++) {
-+    for (i = 0; i < p->iterations; i++) {
-         if (EVP_DigestInit(ctx, EVP_sha1()) != 1)
--			return r;
-+            return r;
-         EVP_DigestUpdate(ctx, md[mdi], digest_size);
--		mdi = (mdi + 1) % 2;
-+        mdi = (mdi + 1) % 2;
-         EVP_DigestUpdate(ctx, p->salt.data, p->salt.length);
-         EVP_DigestFinal(ctx, md[mdi], NULL);
--	}
-+    }
-     EVP_MD_CTX_free(ctx);
- 
- 
--	r.length = digest_size;
--	r.data = getmem(digest_size);
--	memcpy(r.data, md[mdi], digest_size);
--	return r;
-+    r.length = digest_size;
-+    r.data = getmem(digest_size);
-+    memcpy(r.data, md[mdi], digest_size);
-+    return r;
- }
- 
- int sorted_hashed_names_count;
-@@ -77,193 +77,193 @@
- static int
- validate_nsec3_for_name(const char *name, intptr_t *data, void *p)
- {
--	struct named_rr *named_rr = *((struct named_rr **)data);
--	struct binary_data hash;
--	struct rr_nsec3 **nsec3_slot;
--	struct rr_nsec3 *nsec3;
-+    struct named_rr *named_rr = *((struct named_rr **)data);
-+    struct binary_data hash;
-+    struct rr_nsec3 **nsec3_slot;
-+    struct rr_nsec3 *nsec3;
- 
--	if ((named_rr->flags & mask) == NAME_FLAG_KIDS_WITH_RECORDS) {
--		//fprintf(stderr, "--- need nsec3, kids with records: %s\n", named_rr->name);
-+    if ((named_rr->flags & mask) == NAME_FLAG_KIDS_WITH_RECORDS) {
-+        //fprintf(stderr, "--- need nsec3, kids with records: %s\n", named_rr->name);
- needs_nsec3:
--		freeall_temp();
--		hash = name2hash(named_rr->name, nsec3param);
--		if (hash.length < 0) {
--			moan(named_rr->file_name, named_rr->line, "internal: cannot calculate hashed name");
--			goto next;
--		}
--		if (hash.length != 20)
--			croak(4, "assertion failed: wrong hashed name size %d", hash.length);
--		JHSG(nsec3_slot, nsec3_hash, hash.data, hash.length);
--		if (nsec3_slot == PJERR)
--			croak(5, "perform_remaining_nsec3checks: JHSG failed");
--		if (!nsec3_slot) {
--			moan(named_rr->file_name, named_rr->line,
--				 "no corresponding NSEC3 found for %s",
--				 named_rr->name);
--			goto next;
--		}
--		nsec3 = *nsec3_slot;
--		if (!nsec3)
--			croak(6, "assertion failed: existing nsec3 from hash is empty");
--		nsec3->corresponding_name = named_rr;
--		sorted_hashed_names_count++;
--		check_typemap(nsec3->type_bitmap, named_rr, &nsec3->rr);
--	} else if ((named_rr->flags &
--				(NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_SIGNED_DELEGATION)) ==
--			   NAME_FLAG_SIGNED_DELEGATION)
--	{
--		//fprintf(stderr, "--- need nsec3, signed delegation: %s\n", named_rr->name);
--		goto needs_nsec3;
--	} else if (!G.nsec3_opt_out_present && (named_rr->flags &
--											(NAME_FLAG_APEX_PARENT|NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_DELEGATION|NAME_FLAG_HAS_RECORDS)) ==
--			   0)
--	{
--		//fprintf(stderr, "--- need nsec3, empty non-term: %s\n", named_rr->name);
--		goto needs_nsec3;
--	} else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE))==NAME_FLAG_DELEGATION)
--	{
--		//fprintf(stderr, "--- need nsec3, no opt-out: %s\n", named_rr->name);
--		goto needs_nsec3;
--	} else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_THIS_WITH_RECORDS|NAME_FLAG_NOT_AUTHORITATIVE)) == NAME_FLAG_THIS_WITH_RECORDS)
--	{
--		//fprintf(stderr, "--- need nsec3, this with records: %s\n", named_rr->name);
--		goto needs_nsec3;
--	} else {
--		//fprintf(stderr, "--- NO need for nsec3: %s\n", named_rr->name);
--	}
-+        freeall_temp();
-+        hash = name2hash(named_rr->name, nsec3param);
-+        if (hash.length < 0) {
-+            moan(named_rr->file_name, named_rr->line, "internal: cannot calculate hashed name");
-+            goto next;
-+        }
-+        if (hash.length != 20)
-+            croak(4, "assertion failed: wrong hashed name size %d", hash.length);
-+        JHSG(nsec3_slot, nsec3_hash, hash.data, hash.length);
-+        if (nsec3_slot == PJERR)
-+            croak(5, "perform_remaining_nsec3checks: JHSG failed");
-+        if (!nsec3_slot) {
-+            moan(named_rr->file_name, named_rr->line,
-+                 "no corresponding NSEC3 found for %s",
-+                 named_rr->name);
-+            goto next;
-+        }
-+        nsec3 = *nsec3_slot;
-+        if (!nsec3)
-+            croak(6, "assertion failed: existing nsec3 from hash is empty");
-+        nsec3->corresponding_name = named_rr;
-+        sorted_hashed_names_count++;
-+        check_typemap(nsec3->type_bitmap, named_rr, &nsec3->rr);
-+    } else if ((named_rr->flags &
-+                (NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_SIGNED_DELEGATION)) ==
-+               NAME_FLAG_SIGNED_DELEGATION)
-+    {
-+        //fprintf(stderr, "--- need nsec3, signed delegation: %s\n", named_rr->name);
-+        goto needs_nsec3;
-+    } else if (!G.nsec3_opt_out_present && (named_rr->flags &
-+                                            (NAME_FLAG_APEX_PARENT|NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_DELEGATION|NAME_FLAG_HAS_RECORDS)) ==
-+               0)
-+    {
-+        //fprintf(stderr, "--- need nsec3, empty non-term: %s\n", named_rr->name);
-+        goto needs_nsec3;
-+    } else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE))==NAME_FLAG_DELEGATION)
-+    {
-+        //fprintf(stderr, "--- need nsec3, no opt-out: %s\n", named_rr->name);
-+        goto needs_nsec3;
-+    } else if (!G.nsec3_opt_out_present && (named_rr->flags & (NAME_FLAG_THIS_WITH_RECORDS|NAME_FLAG_NOT_AUTHORITATIVE)) == NAME_FLAG_THIS_WITH_RECORDS)
-+    {
-+        //fprintf(stderr, "--- need nsec3, this with records: %s\n", named_rr->name);
-+        goto needs_nsec3;
-+    } else {
-+        //fprintf(stderr, "--- NO need for nsec3: %s\n", named_rr->name);
-+    }
- next:
--	return 1;
-+    return 1;
- }
- 
- void perform_remaining_nsec3checks(void)
- {
--	struct rr_nsec3 *nsec3;
-+    struct rr_nsec3 *nsec3;
- 
--	sorted_hashed_names_count = 0;
--	mask = NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_NSEC3_ONLY|NAME_FLAG_KIDS_WITH_RECORDS;
--	if (G.nsec3_opt_out_present) {
--		mask |= NAME_FLAG_DELEGATION;
--	}
--
--	cbtree_allprefixed(&zone_data, "", validate_nsec3_for_name, NULL);
--
--	nsec3 = first_nsec3;
--	while (nsec3) {
--		if (!nsec3->corresponding_name) {
--			moan(nsec3->rr.file_name, nsec3->rr.line,
--				 "NSEC3 without a corresponding record (or empty non-terminal)");
--		}
--		nsec3 = nsec3->next_nsec3;
--	}
-+    sorted_hashed_names_count = 0;
-+    mask = NAME_FLAG_NOT_AUTHORITATIVE|NAME_FLAG_NSEC3_ONLY|NAME_FLAG_KIDS_WITH_RECORDS;
-+    if (G.nsec3_opt_out_present) {
-+        mask |= NAME_FLAG_DELEGATION;
-+    }
-+
-+    cbtree_allprefixed(&zone_data, "", validate_nsec3_for_name, NULL);
-+
-+    nsec3 = first_nsec3;
-+    while (nsec3) {
-+        if (!nsec3->corresponding_name) {
-+            moan(nsec3->rr.file_name, nsec3->rr.line,
-+                 "NSEC3 without a corresponding record (or empty non-terminal)");
-+        }
-+        nsec3 = nsec3->next_nsec3;
-+    }
- }
- 
- void *remember_nsec3(char *name, struct rr_nsec3 *rr)
- {
--	char hashed_name[33];
--	char binary_hashed_name[20];
--	int l;
--	struct rr_nsec3 **nsec3_slot;
--
--	l = strlen(name);
--	if (l < 33 || name[32] != '.')
--		return bitch("NSEC3 record name is not valid");
--	if (l == 33 && zone_apex_l != 1)  /* root zone */
--		return bitch("NSEC3 record name is not valid");
--	if (l > 33 && strcmp(name+33, zone_apex) != 0)
--		return bitch("NSEC3 record name is not valid");
--
--	memcpy(hashed_name, name, 32);  hashed_name[32] = 0;
--	l = decode_base32hex(binary_hashed_name, hashed_name, 20);
--	if (l != 20)
--		return bitch("NSEC3 record name is not valid");
--	JHSI(nsec3_slot, nsec3_hash, binary_hashed_name, 20);
--	if (nsec3_slot == PJERR)
--		croak(2, "remember_nsec3: JHSI failed");
--	if (*nsec3_slot)
--		return bitch("multiple NSEC3 with the same record name");
--	*nsec3_slot = rr;
--	rr->this_hashed_name.length = 20;
--	rr->this_hashed_name.data = getmem(20);
--	memcpy(rr->this_hashed_name.data, binary_hashed_name, 20);
--	return rr;
-+    char hashed_name[33];
-+    char binary_hashed_name[20];
-+    int l;
-+    struct rr_nsec3 **nsec3_slot;
-+
-+    l = strlen(name);
-+    if (l < 33 || name[32] != '.')
-+        return bitch("NSEC3 record name is not valid");
-+    if (l == 33 && zone_apex_l != 1)  /* root zone */
-+        return bitch("NSEC3 record name is not valid");
-+    if (l > 33 && strcmp(name+33, zone_apex) != 0)
-+        return bitch("NSEC3 record name is not valid");
-+
-+    memcpy(hashed_name, name, 32);  hashed_name[32] = 0;
-+    l = decode_base32hex(binary_hashed_name, hashed_name, 20);
-+    if (l != 20)
-+        return bitch("NSEC3 record name is not valid");
-+    JHSI(nsec3_slot, nsec3_hash, binary_hashed_name, 20);
-+    if (nsec3_slot == PJERR)
-+        croak(2, "remember_nsec3: JHSI failed");
-+    if (*nsec3_slot)
-+        return bitch("multiple NSEC3 with the same record name");
-+    *nsec3_slot = rr;
-+    rr->this_hashed_name.length = 20;
-+    rr->this_hashed_name.data = getmem(20);
-+    memcpy(rr->this_hashed_name.data, binary_hashed_name, 20);
-+    return rr;
- }
- 
- void *check_typemap(struct binary_data type_bitmap, struct named_rr *named_rr, struct rr *reference_rr)
- {
--	int type;
--	char *base;
--	int i, k;
--	struct rr_set *set;
--	uint32_t nsec_distinct_types = 0;
--	uint32_t real_distinct_types;
--
--	base = type_bitmap.data;
--	while (base - type_bitmap.data < type_bitmap.length) {
--		for (i = 0; i < base[1]; i++) {
--			for (k = 0; k <= 7; k++) {
--				if (base[2+i] & (0x80 >> k)) {
--					type = ((unsigned char)base[0])*256 + i*8 + k;
--					nsec_distinct_types++;
--					set = find_rr_set_in_named_rr(named_rr, type);
--					if (!set) {
--						return moan(reference_rr->file_name, reference_rr->line,
--								   	"%s mentions %s, but no such record found for %s",
--									rdtype2str(reference_rr->rdtype), rdtype2str(type), named_rr->name);
--					}
--				}
--			}
--		}
--		base += base[1]+2;
--	}
--	real_distinct_types = get_rr_set_count(named_rr);
--	if (real_distinct_types > nsec_distinct_types) {
--		void *bitmap = NULL;
--		struct rr_set **rr_set_slot;
--		int rc;
--		Word_t rcw;
--		Word_t rdtype;
--		int skipped = 0;
--
--		base = type_bitmap.data;
--		while (base - type_bitmap.data < type_bitmap.length) {
--			for (i = 0; i < base[1]; i++) {
--				for (k = 0; k <= 7; k++) {
--					if (base[2+i] & (0x80 >> k)) {
--						type = ((unsigned char)base[0])*256 + i*8 + k;
--						J1S(rc, bitmap, type);
--					}
--				}
--			}
--			base += base[1]+2;
--		}
--		rdtype = 0;
--		JLF(rr_set_slot, named_rr->rr_sets, rdtype);
--		while (rr_set_slot) {
--			J1T(rc, bitmap, (*rr_set_slot)->rdtype);
--			if (!rc) {
--				if ((named_rr->flags & NAME_FLAG_DELEGATION) &&
--					((*rr_set_slot)->rdtype == T_A ||
--					(*rr_set_slot)->rdtype == T_AAAA))
--				{
--					skipped++;
--				} else {
--					moan(reference_rr->file_name, reference_rr->line,
--						 "%s exists, but %s does not mention it for %s",
--						 rdtype2str((*rr_set_slot)->rdtype),
--						 rdtype2str(reference_rr->rdtype),
--						 named_rr->name);
--					J1FA(rcw, bitmap);
--					return NULL;
--				}
--			}
--			JLN(rr_set_slot, named_rr->rr_sets, rdtype);
--		}
--		J1FA(rcw, bitmap);
--		if (real_distinct_types - skipped > nsec_distinct_types) {
--			return moan(reference_rr->file_name, reference_rr->line,
--						"internal: we know %s typemap is wrong, but don't know any details",
--						rdtype2str(reference_rr->rdtype));
--		}
--	}
--	return reference_rr;
-+    int type;
-+    char *base;
-+    int i, k;
-+    struct rr_set *set;
-+    uint32_t nsec_distinct_types = 0;
-+    uint32_t real_distinct_types;
-+
-+    base = type_bitmap.data;
-+    while (base - type_bitmap.data < type_bitmap.length) {
-+        for (i = 0; i < base[1]; i++) {
-+            for (k = 0; k <= 7; k++) {
-+                if (base[2+i] & (0x80 >> k)) {
-+                    type = ((unsigned char)base[0])*256 + i*8 + k;
-+                    nsec_distinct_types++;
-+                    set = find_rr_set_in_named_rr(named_rr, type);
-+                    if (!set) {
-+                        return moan(reference_rr->file_name, reference_rr->line,
-+                                    "%s mentions %s, but no such record found for %s",
-+                                    rdtype2str(reference_rr->rdtype), rdtype2str(type), named_rr->name);
-+                    }
-+                }
-+            }
-+        }
-+        base += base[1]+2;
-+    }
-+    real_distinct_types = get_rr_set_count(named_rr);
-+    if (real_distinct_types > nsec_distinct_types) {
-+        void *bitmap = NULL;
-+        struct rr_set **rr_set_slot;
-+        int rc;
-+        Word_t rcw;
-+        Word_t rdtype;
-+        int skipped = 0;
-+
-+        base = type_bitmap.data;
-+        while (base - type_bitmap.data < type_bitmap.length) {
-+            for (i = 0; i < base[1]; i++) {
-+                for (k = 0; k <= 7; k++) {
-+                    if (base[2+i] & (0x80 >> k)) {
-+                        type = ((unsigned char)base[0])*256 + i*8 + k;
-+                        J1S(rc, bitmap, type);
-+                    }
-+                }
-+            }
-+            base += base[1]+2;
-+        }
-+        rdtype = 0;
-+        JLF(rr_set_slot, named_rr->rr_sets, rdtype);
-+        while (rr_set_slot) {
-+            J1T(rc, bitmap, (*rr_set_slot)->rdtype);
-+            if (!rc) {
-+                if ((named_rr->flags & NAME_FLAG_DELEGATION) &&
-+                    ((*rr_set_slot)->rdtype == T_A ||
-+                    (*rr_set_slot)->rdtype == T_AAAA))
-+                {
-+                    skipped++;
-+                } else {
-+                    moan(reference_rr->file_name, reference_rr->line,
-+                         "%s exists, but %s does not mention it for %s",
-+                         rdtype2str((*rr_set_slot)->rdtype),
-+                         rdtype2str(reference_rr->rdtype),
-+                         named_rr->name);
-+                    J1FA(rcw, bitmap);
-+                    return NULL;
-+                }
-+            }
-+            JLN(rr_set_slot, named_rr->rr_sets, rdtype);
-+        }
-+        J1FA(rcw, bitmap);
-+        if (real_distinct_types - skipped > nsec_distinct_types) {
-+            return moan(reference_rr->file_name, reference_rr->line,
-+                        "internal: we know %s typemap is wrong, but don't know any details",
-+                        rdtype2str(reference_rr->rdtype));
-+        }
-+    }
-+    return reference_rr;
- }
-diff -Naur validns-0.8/nsec3param.c validns/nsec3param.c
---- validns-0.8/nsec3param.c	2014-02-11 15:45:41.000000000 -0500
-+++ validns/nsec3param.c	2020-10-05 16:59:29.355681369 -0400
-@@ -24,94 +24,94 @@
- static struct rr* nsec3param_parse(char *name, long ttl, int type, char *s)
- {
-     struct rr_nsec3param *rr = getmem(sizeof(*rr));
--	struct rr *ret_rr;
--	int i;
-+    struct rr *ret_rr;
-+    int i;
- 
--	i = extract_integer(&s, "hash algorithm");
--	if (i < 0)
--		return NULL;
--	if (i > 255)
--		return bitch("bad hash algorithm value");
--	if (i != 1)
--		return bitch("unrecognized or unsupported hash algorithm");
--	rr->hash_algorithm = i;
--
--	i = extract_integer(&s, "flags");
--	if (i < 0)
--		return NULL;
--	if (i > 255)
--		return bitch("bad flags value");
--	if (i != 0)
--		return bitch("flags is supposed to be 0 for NSEC3PARAM");
--	rr->flags = i;
--
--	i = extract_integer(&s, "iterations");
--	if (i < 0)
--		return NULL;
--	if (i > 2500)
--		return bitch("bad iterations value");
--	rr->iterations = i;
--	/* TODO validate iteration count according to key size,
--	 * as per http://tools.ietf.org/html/rfc5155#section-10.3 */
--
--	if (*s == '-') {
--		rr->salt.length = 0;
--		rr->salt.data = NULL;
--		s++;
--		if (*s && !isspace(*s) && *s != ';' && *s != ')')
--			return bitch("salt is not valid");
--		s = skip_white_space(s);
--	} else {
--		rr->salt = extract_hex_binary_data(&s, "salt", EXTRACT_DONT_EAT_WHITESPACE);
--		if (rr->salt.length <= 0)
--			return NULL;
--		if (rr->salt.length > 255)
--			return bitch("salt is too long");
--	}
--	if (*s) {
--		return bitch("garbage after valid NSEC3PARAM data");
--	}
-+    i = extract_integer(&s, "hash algorithm", NULL);
-+    if (i < 0)
-+        return NULL;
-+    if (i > 255)
-+        return bitch("bad hash algorithm value");
-+    if (i != 1)
-+        return bitch("unrecognized or unsupported hash algorithm");
-+    rr->hash_algorithm = i;
-+
-+    i = extract_integer(&s, "flags", NULL);
-+    if (i < 0)
-+        return NULL;
-+    if (i > 255)
-+        return bitch("bad flags value");
-+    if (i != 0)
-+        return bitch("flags is supposed to be 0 for NSEC3PARAM");
-+    rr->flags = i;
-+
-+    i = extract_integer(&s, "iterations", NULL);
-+    if (i < 0)
-+        return NULL;
-+    if (i > 2500)
-+        return bitch("bad iterations value");
-+    rr->iterations = i;
-+    /* TODO validate iteration count according to key size,
-+     * as per http://tools.ietf.org/html/rfc5155#section-10.3 */
-+
-+    if (*s == '-') {
-+        rr->salt.length = 0;
-+        rr->salt.data = NULL;
-+        s++;
-+        if (*s && !isspace(*s) && *s != ';' && *s != ')')
-+            return bitch("salt is not valid");
-+        s = skip_white_space(s);
-+    } else {
-+        rr->salt = extract_hex_binary_data(&s, "salt", EXTRACT_DONT_EAT_WHITESPACE);
-+        if (rr->salt.length <= 0)
-+            return NULL;
-+        if (rr->salt.length > 255)
-+            return bitch("salt is too long");
-+    }
-+    if (*s) {
-+        return bitch("garbage after valid NSEC3PARAM data");
-+    }
- 
--	G.dnssec_active = 1;
-+    G.dnssec_active = 1;
-     ret_rr = store_record(type, name, ttl, rr);
--	if (ret_rr && !nsec3param && (ret_rr->rr_set->named_rr->flags & NAME_FLAG_APEX))
--		nsec3param = ret_rr;
--	if (G.opt.policy_checks[POLICY_NSEC3PARAM_NOT_APEX] &&
--		(ret_rr->rr_set->named_rr->flags & NAME_FLAG_APEX) == 0)
--	{
--		return bitch("NSEC3PARAM found not at zone apex");
--	}
--	return ret_rr;
-+    if (ret_rr && !nsec3param && (ret_rr->rr_set->named_rr->flags & NAME_FLAG_APEX))
-+        nsec3param = ret_rr;
-+    if (G.opt.policy_checks[POLICY_NSEC3PARAM_NOT_APEX] &&
-+        (ret_rr->rr_set->named_rr->flags & NAME_FLAG_APEX) == 0)
-+    {
-+        return bitch("NSEC3PARAM found not at zone apex");
-+    }
-+    return ret_rr;
- }
- 
- static char* nsec3param_human(struct rr *rrv)
- {
--	RRCAST(nsec3param);
-+    RRCAST(nsec3param);
-     char ss[1024];
--	char *s = ss;
--	int l;
--	int i;
-+    char *s = ss;
-+    int l;
-+    int i;
- 
-     l = snprintf(s, 1024, "%u %u %u ", rr->hash_algorithm, rr->flags, rr->iterations);
--	s += l;
--	if (rr->salt.length) {
--		for (i = 0; i < rr->salt.length; i++) {
--			l = snprintf(s, 1024-(s-ss), "%02X", (unsigned char)rr->salt.data[i]);
--			s += l;
--		}
--	} else {
--		sprintf(s, "-");
--	}
-+    s += l;
-+    if (rr->salt.length) {
-+        for (i = 0; i < rr->salt.length; i++) {
-+            l = snprintf(s, 1024-(s-ss), "%02X", (unsigned char)rr->salt.data[i]);
-+            s += l;
-+        }
-+    } else {
-+        sprintf(s, "-");
-+    }
-     return quickstrdup_temp(ss);
- }
- 
- static struct binary_data nsec3param_wirerdata(struct rr *rrv)
- {
--	RRCAST(nsec3param);
-+    RRCAST(nsec3param);
- 
--	return compose_binary_data("112b", 1,
--		rr->hash_algorithm, rr->flags,
--		rr->iterations, rr->salt);
-+    return compose_binary_data("112b", 1,
-+        rr->hash_algorithm, rr->flags,
-+        rr->iterations, rr->salt);
- }
- 
- struct rr_methods nsec3param_methods = { nsec3param_parse, nsec3param_human, nsec3param_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/nsec.c validns/nsec.c
---- validns-0.8/nsec.c	2014-02-11 15:44:21.000000000 -0500
-+++ validns/nsec.c	2020-10-05 16:59:29.355681369 -0400
-@@ -1,18 +1,18 @@
- /*
-  * Part of DNS zone file validator `validns`.
--			604800	NSEC	example.com. NS DS RRSIG NSEC
--			604800	RRSIG	NSEC 10 3 604800 20130321184221 (
--					20130219184221 35615 example.com.
--					WWg7EiYoY8Hp593I2i5Mkl2ezg7YuAnq0y75
--					oymTCuEfGwh4OxbMT/mWNqAFL5Y8f0YoQOOY
--					wZP0m/sGK/EJN7ulNsfQyULY4WsyHIGlKMwT
--					KdyDXJLrmrzlmRnGv7pFb0bo53n3osE0uFfH
--					yMQYOkQRYfqa4yWXF9Nl48dy67frtVih0foy
--					9Mm76mmJSDUd/jGsYQmaoFGVU/a64rWapVQ9
--					O/mXPqr6Pw2ZCHecsF4ElMEp41YqG1DfR5QR
--					khTjvTlg4aTKvgX1YuvDhjUygSHit47xn2NC
--					2WwEZF+vYXT9DIUCMcKdVeb4bjWwUXbWNFqz
--					Ca3jb/mpOpUDFnrRPw== )
-+            604800  NSEC    example.com. NS DS RRSIG NSEC
-+            604800  RRSIG   NSEC 10 3 604800 20130321184221 (
-+                    20130219184221 35615 example.com.
-+                    WWg7EiYoY8Hp593I2i5Mkl2ezg7YuAnq0y75
-+                    oymTCuEfGwh4OxbMT/mWNqAFL5Y8f0YoQOOY
-+                    wZP0m/sGK/EJN7ulNsfQyULY4WsyHIGlKMwT
-+                    KdyDXJLrmrzlmRnGv7pFb0bo53n3osE0uFfH
-+                    yMQYOkQRYfqa4yWXF9Nl48dy67frtVih0foy
-+                    9Mm76mmJSDUd/jGsYQmaoFGVU/a64rWapVQ9
-+                    O/mXPqr6Pw2ZCHecsF4ElMEp41YqG1DfR5QR
-+                    khTjvTlg4aTKvgX1YuvDhjUygSHit47xn2NC
-+                    2WwEZF+vYXT9DIUCMcKdVeb4bjWwUXbWNFqz
-+                    Ca3jb/mpOpUDFnrRPw== )
-  *
-  * Copyright 2011-2014 Anton Berezin <tobez@tobez.org>
-  * Modified BSD license.
-@@ -35,114 +35,114 @@
- static struct rr* nsec_parse(char *name, long ttl, int type, char *s)
- {
-     struct rr_nsec *rr = getmem(sizeof(*rr));
--	struct binary_data bitmap;
--	char *str_type = NULL;
--	int ltype;
-+    struct binary_data bitmap;
-+    char *str_type = NULL;
-+    int ltype;
- 
-     rr->next_domain = extract_name(&s, "next domain", KEEP_CAPITALIZATION);
--	/* TODO: validate next_domain, http://tools.ietf.org/html/rfc4034#section-4.1.1 */
-+    /* TODO: validate next_domain, http://tools.ietf.org/html/rfc4034#section-4.1.1 */
- 
--	bitmap = new_set();
--	while (s && *s) {
--		str_type = extract_label(&s, "type list", "temporary");
--		if (!str_type) return NULL;
--		ltype = str2rdtype(str_type, NULL);
--		if (ltype < 0)
--			return NULL;
--		add_bit_to_set(&bitmap, ltype);
--	}
--	if (!s)
--		return NULL;
--	if (!str_type) {
--		return bitch("NSEC type list should not be empty");
--	}
--	rr->type_bitmap = compressed_set(&bitmap);
--	G.dnssec_active = 1;
-+    bitmap = new_set();
-+    while (s && *s) {
-+        str_type = extract_label(&s, "type list", "temporary");
-+        if (!str_type) return NULL;
-+        ltype = str2rdtype(str_type, NULL);
-+        if (ltype < 0)
-+            return NULL;
-+        add_bit_to_set(&bitmap, ltype);
-+    }
-+    if (!s)
-+        return NULL;
-+    if (!str_type) {
-+        return bitch("NSEC type list should not be empty");
-+    }
-+    rr->type_bitmap = compressed_set(&bitmap);
-+    G.dnssec_active = 1;
- 
-     return store_record(type, name, ttl, rr);
- }
- 
- static char* nsec_human(struct rr *rrv)
- {
--	RRCAST(nsec);
-+    RRCAST(nsec);
-     char ss[1024];
--	char *s = ss;
--	int l;
--	char *base;
--	int i, k;
--	int type;
--	char *type_name;
-+    char *s = ss;
-+    int l;
-+    char *base;
-+    int i, k;
-+    int type;
-+    char *type_name;
- 
-     l = snprintf(s, 1024, "%s", rr->next_domain);
--	s += l;
--	base = rr->type_bitmap.data;
--	while (base - rr->type_bitmap.data < rr->type_bitmap.length) {
--		for (i = 0; i < base[1]; i++) {
--			for (k = 0; k <= 7; k++) {
--				if (base[2+i] & (0x80 >> k)) {
--					type = ((unsigned char)base[0])*256 + i*8 + k;
--					type_name = rdtype2str(type);
--					l = snprintf(s, 1024-(s-ss), " %s", type_name);
--					s += l;
--				}
--			}
--		}
--		base += base[1]+2;
--	}
-+    s += l;
-+    base = rr->type_bitmap.data;
-+    while (base - rr->type_bitmap.data < rr->type_bitmap.length) {
-+        for (i = 0; i < base[1]; i++) {
-+            for (k = 0; k <= 7; k++) {
-+                if (base[2+i] & (0x80 >> k)) {
-+                    type = ((unsigned char)base[0])*256 + i*8 + k;
-+                    type_name = rdtype2str(type);
-+                    l = snprintf(s, 1024-(s-ss), " %s", type_name);
-+                    s += l;
-+                }
-+            }
-+        }
-+        base += base[1]+2;
-+    }
-     return quickstrdup_temp(ss);
- }
- 
- static struct binary_data nsec_wirerdata(struct rr *rrv)
- {
--	RRCAST(nsec);
-+    RRCAST(nsec);
- 
--	return compose_binary_data("dd", 1,
--		name2wire_name(rr->next_domain), rr->type_bitmap);
-+    return compose_binary_data("dd", 1,
-+        name2wire_name(rr->next_domain), rr->type_bitmap);
- }
- 
- static void* nsec_validate(struct rr *rrv)
- {
--	RRCAST(nsec);
--	struct named_rr *named_rr;
-+    RRCAST(nsec);
-+    struct named_rr *named_rr;
- 
--	named_rr = rr->rr.rr_set->named_rr;
--	if (!check_typemap(rr->type_bitmap, named_rr, rrv))
--		return NULL;
-+    named_rr = rr->rr.rr_set->named_rr;
-+    if (!check_typemap(rr->type_bitmap, named_rr, rrv))
-+        return NULL;
- 
--	return rr;
-+    return rr;
- }
- 
- void validate_nsec_chain(void)
- {
--	struct rr_set *rr_set;
--	struct named_rr *named_rr;
-+    struct rr_set *rr_set;
-+    struct named_rr *named_rr;
- 
--	rr_set = find_rr_set(T_NSEC, zone_apex);
--	if (!rr_set) {
--		named_rr = find_named_rr(zone_apex);
--		moan(named_rr->file_name, named_rr->line, "apex NSEC not found");
--		return;
--	}
--	while (1) {
--		char name[1024];
--		struct rr_nsec *rr = (struct rr_nsec *)rr_set->tail;
--		char *s, *t;
--
--		if (strcasecmp(rr->next_domain, zone_apex) == 0) /* chain complete */
--			break;
--		freeall_temp();
--		s = rr->next_domain;
--		t = name;
--		while (*s) *t++ = tolower(*s++);
--		*t = 0;
--		rr_set = find_rr_set(T_NSEC, name);
--		if (!rr_set) {
--			moan(rr->rr.file_name, rr->rr.line, "broken NSEC chain %s -> %s",
--				 rr->rr.rr_set->named_rr->name, rr->next_domain);
--			break;
--		}
--	}
--	freeall_temp();
-+    rr_set = find_rr_set(T_NSEC, zone_apex);
-+    if (!rr_set) {
-+        named_rr = find_named_rr(zone_apex);
-+        moan(named_rr->file_name, named_rr->line, "apex NSEC not found");
-+        return;
-+    }
-+    while (1) {
-+        char name[1024];
-+        struct rr_nsec *rr = (struct rr_nsec *)rr_set->tail;
-+        char *s, *t;
-+
-+        if (strcasecmp(rr->next_domain, zone_apex) == 0) /* chain complete */
-+            break;
-+        freeall_temp();
-+        s = rr->next_domain;
-+        t = name;
-+        while (*s) *t++ = tolower(*s++);
-+        *t = 0;
-+        rr_set = find_rr_set(T_NSEC, name);
-+        if (!rr_set) {
-+            moan(rr->rr.file_name, rr->rr.line, "broken NSEC chain %s -> %s",
-+                 rr->rr.rr_set->named_rr->name, rr->next_domain);
-+            break;
-+        }
-+    }
-+    freeall_temp();
- }
- 
- struct rr_methods nsec_methods = { nsec_parse, nsec_human, nsec_wirerdata, NULL, nsec_validate };
-diff -Naur validns-0.8/PAUL.txt validns/PAUL.txt
---- validns-0.8/PAUL.txt	1969-12-31 19:00:00.000000000 -0500
-+++ validns/PAUL.txt	2020-10-05 17:00:40.157331142 -0400
-@@ -0,0 +1 @@
-+new:
-diff -Naur validns-0.8/ptr.c validns/ptr.c
---- validns-0.8/ptr.c	2014-02-11 15:45:36.000000000 -0500
-+++ validns/ptr.c	2020-10-05 16:59:29.355681369 -0400
-@@ -19,29 +19,29 @@
- 
- static struct rr *ptr_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_ptr *rr = getmem(sizeof(*rr));
-+    struct rr_ptr *rr = getmem(sizeof(*rr));
- 
--	rr->ptrdname = extract_name(&s, "name server domain name", 0);
--	if (!rr->ptrdname)
--		return NULL;
--	if (*s) {
--		return bitch("garbage after valid PTR data");
--	}
-+    rr->ptrdname = extract_name(&s, "name server domain name", 0);
-+    if (!rr->ptrdname)
-+        return NULL;
-+    if (*s) {
-+        return bitch("garbage after valid PTR data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* ptr_human(struct rr *rrv)
- {
--	RRCAST(ptr);
-+    RRCAST(ptr);
- 
-     return rr->ptrdname;
- }
- 
- static struct binary_data ptr_wirerdata(struct rr *rrv)
- {
--	RRCAST(ptr);
--	return name2wire_name(rr->ptrdname);
-+    RRCAST(ptr);
-+    return name2wire_name(rr->ptrdname);
- }
- 
- struct rr_methods ptr_methods = { ptr_parse, ptr_human, ptr_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/px.c validns/px.c
---- validns-0.8/px.c	2014-02-11 15:46:50.000000000 -0500
-+++ validns/px.c	2020-10-05 16:59:29.355681369 -0400
-@@ -19,45 +19,45 @@
- 
- static struct rr *px_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_px *rr = getmem(sizeof(*rr));
-+    struct rr_px *rr = getmem(sizeof(*rr));
- 
--	rr->preference = extract_integer(&s, "PX preference");
--	if (rr->preference < 0)
--		return NULL;
-+    rr->preference = extract_integer(&s, "PX preference", NULL);
-+    if (rr->preference < 0)
-+        return NULL;
- 
--	rr->map822 = extract_name(&s, "map822", 0);
--	if (!rr->map822)
--		return NULL;
-+    rr->map822 = extract_name(&s, "map822", 0);
-+    if (!rr->map822)
-+        return NULL;
- 
--	rr->mapx400 = extract_name(&s, "mapx400", 0);
--	if (!rr->mapx400)
--		return NULL;
-+    rr->mapx400 = extract_name(&s, "mapx400", 0);
-+    if (!rr->mapx400)
-+        return NULL;
- 
--	if (*s) {
--		return bitch("garbage after valid KX data");
--	}
-+    if (*s) {
-+        return bitch("garbage after valid KX data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* px_human(struct rr *rrv)
- {
--	RRCAST(px);
-+    RRCAST(px);
-     char s[1024];
- 
-     snprintf(s, 1024, "%d %s %s",
--	     rr->preference, rr->map822, rr->mapx400);
-+         rr->preference, rr->map822, rr->mapx400);
-     return quickstrdup_temp(s);
- }
- 
- static struct binary_data px_wirerdata(struct rr *rrv)
- {
--	RRCAST(px);
-+    RRCAST(px);
- 
-     return compose_binary_data("2dd", 1,
--		rr->preference,
--		name2wire_name(rr->map822),
--		name2wire_name(rr->mapx400));
-+        rr->preference,
-+        name2wire_name(rr->map822),
-+        name2wire_name(rr->mapx400));
- }
- 
- struct rr_methods px_methods = { px_parse, px_human, px_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/rp.c validns/rp.c
---- validns-0.8/rp.c	2014-02-11 15:45:43.000000000 -0500
-+++ validns/rp.c	2020-10-05 16:59:29.355681369 -0400
-@@ -20,26 +20,26 @@
- 
- static struct rr *rp_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_rp *rr = getmem(sizeof(*rr));
-+    struct rr_rp *rr = getmem(sizeof(*rr));
- 
--	rr->mbox_dname = extract_name(&s, "mbox domain name", 0);
--	if (!rr->mbox_dname)
--		return NULL;
-+    rr->mbox_dname = extract_name(&s, "mbox domain name", 0);
-+    if (!rr->mbox_dname)
-+        return NULL;
- 
--	rr->txt_dname = extract_name(&s, "txt domain name", 0);
--	if (!rr->txt_dname)
--		return NULL;
-+    rr->txt_dname = extract_name(&s, "txt domain name", 0);
-+    if (!rr->txt_dname)
-+        return NULL;
- 
--	if (*s) {
--		return bitch("garbage after valid RP data");
--	}
-+    if (*s) {
-+        return bitch("garbage after valid RP data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* rp_human(struct rr *rrv)
- {
--	RRCAST(rp);
-+    RRCAST(rp);
-     char s[1024];
- 
-     snprintf(s, 1024, "\"%s\" \"%s\"", rr->mbox_dname, rr->txt_dname);
-@@ -48,24 +48,24 @@
- 
- static struct binary_data rp_wirerdata(struct rr *rrv)
- {
--	RRCAST(rp);
-+    RRCAST(rp);
- 
--	return compose_binary_data("dd", 1,
--		name2wire_name(rr->mbox_dname),
--		name2wire_name(rr->txt_dname));
-+    return compose_binary_data("dd", 1,
-+        name2wire_name(rr->mbox_dname),
-+        name2wire_name(rr->txt_dname));
- }
- 
- static void *rp_validate(struct rr *rrv)
- {
--	RRCAST(rp);
-+    RRCAST(rp);
- 
--	if (G.opt.policy_checks[POLICY_RP_TXT_EXISTS]) {
--		if (name_belongs_to_zone(rr->txt_dname) && !find_rr_set(T_TXT, rr->txt_dname)) {
--			return moan(rr->rr.file_name, rr->rr.line, "%s RP TXT %s does not exist",
--				rr->rr.rr_set->named_rr->name, rr->txt_dname);
--		}
--	}
--	return NULL;
-+    if (G.opt.policy_checks[POLICY_RP_TXT_EXISTS]) {
-+        if (name_belongs_to_zone(rr->txt_dname) && !find_rr_set(T_TXT, rr->txt_dname)) {
-+            return moan(rr->rr.file_name, rr->rr.line, "%s RP TXT %s does not exist",
-+                rr->rr.rr_set->named_rr->name, rr->txt_dname);
-+        }
-+    }
-+    return NULL;
- }
- 
- struct rr_methods rp_methods = { rp_parse, rp_human, rp_wirerdata, NULL, rp_validate };
-diff -Naur validns-0.8/rr.c validns/rr.c
---- validns-0.8/rr.c	2014-02-11 15:45:34.000000000 -0500
-+++ validns/rr.c	2020-10-05 16:59:29.355681369 -0400
-@@ -20,859 +20,899 @@
- #include "cbtree.h"
- 
- static char* rdtype2str_map[T_MAX+1] = {
--	"0",
--	"A",
--	"NS",
--	"MD",
--	"MF",
--	"CNAME", /* 5 */
--	"SOA",
--	"MB",
--	"MG",
--	"MR",
--	"NULL", /* 10 */
--	"WKS",
--	"PTR",
--	"HINFO",
--	"MINFO",
--	"MX",  /* 15 */
--	"TXT", 
--	"RP",
--	"AFSDB",
--	"X25",
--	"ISDN", /* 20 */
--	"RT",
--	"NSAP",
--	"NSAP-PTR",
--	"SIG",
--	"KEY",  /* 25 */
--	"PX",
--	"GPOS",
--	"AAAA",
--	"LOC",
--	"NXT",  /* 30 */
--	"EID",
--	"NIMLOC",
--	"SRV",
--	"ATMA",
--	"NAPTR", /* 35 */
--	"KX",
--	"CERT",
--	"A6",
--	"DNAME",
--	"SINK", /* 40 */
--	"OPT",
--	"APL",
--	"DS",
--	"SSHFP",
--	"IPSECKEY", /* 45 */
--	"RRSIG",
--	"NSEC",
--	"DNSKEY",
--	"DHCID",
--	"NSEC3", /* 50 */
--	"NSEC3PARAM",
--	"TLSA",
--	      0, 0, 0, 0, 0, 0, 0, 0, /* 60 */
--	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 70 */
--	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 80 */
--	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 90 */
--	0, 0, 0, 0, 0, 0, 0, 0,
--	"SPF",
--	                           0, /* 100 */
--	0, 0, 0,
--	"NID",
--	"L32",
--	"L64",
--	"LP",
-+    "0",
-+    "A",
-+    "NS",
-+    "MD",
-+    "MF",
-+    "CNAME", /* 5 */
-+    "SOA",
-+    "MB",
-+    "MG",
-+    "MR",
-+    "NULL", /* 10 */
-+    "WKS",
-+    "PTR",
-+    "HINFO",
-+    "MINFO",
-+    "MX",  /* 15 */
-+    "TXT", 
-+    "RP",
-+    "AFSDB",
-+    "X25",
-+    "ISDN", /* 20 */
-+    "RT",
-+    "NSAP",
-+    "NSAP-PTR",
-+    "SIG",
-+    "KEY",  /* 25 */
-+    "PX",
-+    "GPOS",
-+    "AAAA",
-+    "LOC",
-+    "NXT",  /* 30 */
-+    "EID",
-+    "NIMLOC",
-+    "SRV",
-+    "ATMA",
-+    "NAPTR", /* 35 */
-+    "KX",
-+    "CERT",
-+    "A6",
-+    "DNAME",
-+    "SINK", /* 40 */
-+    "OPT",
-+    "APL",
-+    "DS",
-+    "SSHFP",
-+    "IPSECKEY", /* 45 */
-+    "RRSIG",
-+    "NSEC",
-+    "DNSKEY",
-+    "DHCID",
-+    "NSEC3", /* 50 */
-+    "NSEC3PARAM",
-+    "TLSA",
-+    "SMIMEA",
-+             0, 0, 0, 0, 0,
-+    "CDS",
-+    "CDNSKEY", /* 60 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 70 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 80 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 90 */
-+    0, 0, 0, 0, 0, 0, 0, 0,
-+    "SPF",
-+                               0, /* 100 */
-+    0, 0, 0,
-+    "NID",
-+    "L32",
-+    "L64",
-+    "LP",
-+                         0, 0, 0, /* 110 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 120 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 130 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 140 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 150 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 160 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 170 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 180 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 190 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 200 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 210 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 220 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 230 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 240 */
-+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 250 */
-+    0, 0, 0, 0, 0, 0,
-+    "CAA",
-+                         0, 0, 0, /* 260 */
- };
- struct cbtree zone_data = {NULL};
- char *zone_apex = NULL;
- int zone_apex_l = 0;
-+int rr_counts[T_MAX+1];
- 
- char *rdtype2str(int type)
- {
--	char s[10];
--	char *r;
--	if (type < 0 || type > 65535) {
--		return "???";
--	}
--	if (type > T_MAX) {
--		sprintf(s, "TYPE%d", type);
--		return quickstrdup_temp(s);
--	}
--	r = rdtype2str_map[type];
--	if (r)	return r;
--	if (type == 32769) {
--		return rdtype2str_map[type] = "DLV";
--	}
--	sprintf(s, "TYPE%d", type);
--	return quickstrdup_temp(s);
-+    char s[10];
-+    char *r;
-+    if (type < 0 || type > 65535) {
-+        return "???";
-+    }
-+    if (type > T_MAX) {
-+        sprintf(s, "TYPE%d", type);
-+        return quickstrdup_temp(s);
-+    }
-+    r = rdtype2str_map[type];
-+    if (r)  return r;
-+    if (type == 32769) {
-+        return rdtype2str_map[type] = "DLV";
-+    }
-+    sprintf(s, "TYPE%d", type);
-+    return quickstrdup_temp(s);
- }
- 
- static unsigned char *name2findable_name(char *s)
- {
--	int l = strlen(s);
--	unsigned char *res = getmem_temp(l+1);
--	unsigned char *r = res;
--	int i;
--
--	if (l > 0 && s[l-1] == '.')
--		l--;
--	while (--l >= 0) {
--		i = l;
--		while (i >= 0 && s[i] != '.')
--			i--;
--		memcpy(r, s+i+1, l-i);
--		r += l-i;
--		*r = '\x01';
--		r++;
--		l = i;
--	}
--	if (r > res)    r--;
--	*r = 0;
--	return res;
-+    int l = strlen(s);
-+    unsigned char *res = getmem_temp(l+1);
-+    unsigned char *r = res;
-+    int i;
-+
-+    if (l > 0 && s[l-1] == '.')
-+        l--;
-+    while (--l >= 0) {
-+        i = l;
-+        while (i >= 0 && s[i] != '.')
-+            i--;
-+        memcpy(r, s+i+1, l-i);
-+        r += l-i;
-+        *r = '\x01';
-+        r++;
-+        l = i;
-+    }
-+    if (r > res)    r--;
-+    *r = 0;
-+    return res;
- }
- 
- struct binary_data name2wire_name(char *s)
- {
--	unsigned char *res = getmem_temp(strlen(s)+2);
--	unsigned char *r = res;
--	unsigned char *c = res;
--	struct binary_data toret;
--
--	r++;
--	*c = 0;
--	while (*s) {
--		if (*s != '.') {
--			*r++ = *s++;
--		} else {
--			*c = (unsigned char)(r-c-1);
--			c = r;
--			*c = 0;
--			r++;
--			s++;
--		}
--	}
--	*c = (unsigned char)(r-c-1);
--	toret.length = r-res;
--	toret.data = (char*)res;
--	if (toret.length == 2) /* "." is just 00, not 00 00 */
--	    toret.length = 1;
--	return toret;
-+    unsigned char *res = getmem_temp(strlen(s)+2);
-+    unsigned char *r = res;
-+    unsigned char *c = res;
-+    struct binary_data toret;
-+
-+    r++;
-+    *c = 0;
-+    while (*s) {
-+        if (*s != '.') {
-+            *r++ = *s++;
-+        } else {
-+            *c = (unsigned char)(r-c-1);
-+            c = r;
-+            *c = 0;
-+            r++;
-+            s++;
-+        }
-+    }
-+    *c = (unsigned char)(r-c-1);
-+    toret.length = r-res;
-+    toret.data = (char*)res;
-+    if (toret.length == 2) /* "." is just 00, not 00 00 */
-+        toret.length = 1;
-+    return toret;
- }
- 
- static struct named_rr *find_or_create_named_rr(char *name)
- {
--	struct named_rr *named_rr = find_named_rr(name);
-+    struct named_rr *named_rr = find_named_rr(name);
- 
--	if (!named_rr) {
--		struct named_rr **named_rr_slot;
--		char *s;
--
--		named_rr = getmem(sizeof(struct named_rr));
--		named_rr->name = quickstrdup(name);
--		named_rr->rr_sets = NULL;
--		named_rr->line = file_info->line;
--		named_rr->file_name = file_info->name;
--		named_rr->flags = 0;
--		named_rr->parent = NULL;
--
--		if (strchr(name, '/') != NULL)
--			named_rr->flags |= NAME_FLAG_CONTAINS_SLASH;
--
--		named_rr_slot = (void *)cbtree_insert(&zone_data, (char *)name2findable_name(name));
--		if (!named_rr_slot)
--			croak(2, "find_or_create_named_rr: tree insertion failed");
--		if (*named_rr_slot)
--			croak(3, "find_or_create_named_rr: assertion error, %s should not be there", name);
--		*named_rr_slot = named_rr;
--		G.stats.names_count++;
--
--		s = strchr(name, '.');
--		if (s && s[1] != '\0') {
--			named_rr->parent = find_or_create_named_rr(s+1);
--		}
--	}
-+    if (!named_rr) {
-+        struct named_rr **named_rr_slot;
-+        char *s;
-+
-+        named_rr = getmem(sizeof(struct named_rr));
-+        named_rr->name = quickstrdup(name);
-+        named_rr->rr_sets = NULL;
-+        named_rr->line = file_info->line;
-+        named_rr->file_name = file_info->name;
-+        named_rr->flags = 0;
-+        named_rr->parent = NULL;
-+
-+        if (strchr(name, '/') != NULL)
-+            named_rr->flags |= NAME_FLAG_CONTAINS_SLASH;
-+
-+        named_rr_slot = (void *)cbtree_insert(&zone_data, (char *)name2findable_name(name));
-+        if (!named_rr_slot)
-+            croak(2, "find_or_create_named_rr: tree insertion failed");
-+        if (*named_rr_slot)
-+            croak(3, "find_or_create_named_rr: assertion error, %s should not be there", name);
-+        *named_rr_slot = named_rr;
-+        G.stats.names_count++;
-+
-+        s = strchr(name, '.');
-+        if (s && s[1] != '\0') {
-+            named_rr->parent = find_or_create_named_rr(s+1);
-+        }
-+    }
- 
--	return named_rr;
-+    return named_rr;
- }
- 
- static struct rr_set *find_or_create_rr_set(struct named_rr *named_rr, int rdtype)
- {
--	struct rr_set *rr_set = find_rr_set_in_named_rr(named_rr, rdtype);
--	if (!rr_set) {
--		struct rr_set **rr_set_slot;
--
--		rr_set = getmem(sizeof(struct rr_set));
--		rr_set->head = NULL;
--		rr_set->tail = NULL;
--		rr_set->named_rr = named_rr;
--		rr_set->rdtype = rdtype;
--		rr_set->count = 0;
--
--		JLI(rr_set_slot, named_rr->rr_sets, rdtype);
--		if (rr_set_slot == PJERR)
--			croak(2, "find_or_create_rr_set: JLI failed");
--		if (*rr_set_slot)
--			croak(3, "find_or_create_rr_set: assertion error, %s/%s should not be there",
--				  named_rr->name, rdtype2str(rdtype));
--		*rr_set_slot = rr_set;
--		G.stats.rrset_count++;
--	}
--	return rr_set;
-+    struct rr_set *rr_set = find_rr_set_in_named_rr(named_rr, rdtype);
-+    if (!rr_set) {
-+        struct rr_set **rr_set_slot;
-+
-+        rr_set = getmem(sizeof(struct rr_set));
-+        rr_set->head = NULL;
-+        rr_set->tail = NULL;
-+        rr_set->named_rr = named_rr;
-+        rr_set->rdtype = rdtype;
-+        rr_set->count = 0;
-+
-+        JLI(rr_set_slot, named_rr->rr_sets, rdtype);
-+        if (rr_set_slot == PJERR)
-+            croak(2, "find_or_create_rr_set: JLI failed");
-+        if (*rr_set_slot)
-+            croak(3, "find_or_create_rr_set: assertion error, %s/%s should not be there",
-+                  named_rr->name, rdtype2str(rdtype));
-+        *rr_set_slot = rr_set;
-+        G.stats.rrset_count++;
-+    }
-+    return rr_set;
- }
- 
- int name_belongs_to_zone(const char *name)
- {
--	int name_l;
-+    int name_l;
- 
--	name_l = strlen(name);
--	if (zone_apex && name_l >= zone_apex_l) {
--		if (strcmp(zone_apex, name+name_l-zone_apex_l) != 0) {
--			return 0;
--		} else if (name_l > zone_apex_l && name[name_l-zone_apex_l-1] != '.') {
--			return 0;
--		}
--	} else {
--		if (zone_apex) {
--			return 0;
--		} else {
--			// XXX this is actually very bad, zone apex is not know
--			return 0;
--		}
--	}
--	return 1;
-+    name_l = strlen(name);
-+    if (zone_apex && name_l >= zone_apex_l) {
-+        if (strcmp(zone_apex, name+name_l-zone_apex_l) != 0) {
-+            return 0;
-+        } else if (name_l > zone_apex_l && name[name_l-zone_apex_l-1] != '.') {
-+            return 0;
-+        }
-+    } else {
-+        if (zone_apex) {
-+            return 0;
-+        } else {
-+            // XXX this is actually very bad, zone apex is not know
-+            return 0;
-+        }
-+    }
-+    return 1;
- }
- 
- struct binary_data call_get_wired(struct rr *rr)
- {
--	rr_wire_func get_wired;
-+    rr_wire_func get_wired;
- 
--	if (rr->rdtype > T_MAX || rr->is_generic)
--		get_wired = any_wirerdata;
--	else
--		get_wired = rr_methods[rr->rdtype].rr_wire;
--	if (!get_wired) return bad_binary_data();
--	return get_wired(rr);
-+    if (rr->rdtype > T_MAX || rr->is_generic)
-+        get_wired = any_wirerdata;
-+    else
-+        get_wired = rr_methods[rr->rdtype].rr_wire;
-+    if (!get_wired) return bad_binary_data();
-+    return get_wired(rr);
- }
- 
- struct rr *store_record(int rdtype, char *name, long ttl, void *rrptr)
- {
--	struct rr *rr = rrptr;
--	struct named_rr *named_rr;
--	struct rr_set *rr_set;
--	int name_l;
--	int apex_assigned = 0;
--	int is_generic = 0;
--
--	if (rdtype < 0) {
--		rdtype = -rdtype;
--		is_generic = 1;
--	}
--	name_l = strlen(name);
--	if (name_l > 511)
--		return bitch("name is too long: %s", name);
--
--	if (G.stats.rr_count == 0) {
--		if (rdtype != T_SOA) {
--			return bitch("the first record in the zone must be an SOA record");
--		} else {
--			zone_apex = name;
--			zone_apex_l = name_l;
--			apex_assigned = 1;
--		}
--	}
--	if (zone_apex && name_l >= zone_apex_l) {
--		if (strcmp(zone_apex, name+name_l-zone_apex_l) != 0) {
--			return bitch("%s does not belong to zone %s", name, zone_apex);
--		} else if (name_l > zone_apex_l && name[name_l-zone_apex_l-1] != '.') {
--			return bitch("%s does not belong to zone %s", name, zone_apex);
--		}
--	} else {
--		if (zone_apex) {
--			return bitch("%s does not belong to zone %s", name, zone_apex);
--		} else {
--			croakx(3, "assertion error: %s does not belong to a zone", name);
--		}
--	}
--
--	named_rr = find_or_create_named_rr(name);
--	if (apex_assigned) {
--		named_rr->flags |= NAME_FLAG_APEX;
--	}
--	rr_set = find_or_create_rr_set(named_rr, rdtype);
--
--	rr->rdtype = rdtype;
--	rr->ttl = ttl;
--	rr->line = file_info->line;
--	rr->file_name = file_info->name;
--	rr->is_generic = is_generic;
--
--	if (rr_set->count > 0) {
--		struct binary_data new_d, old_d;
--		struct rr *old_rr;
--
--		new_d = call_get_wired(rr);
--		if (new_d.length < 0) goto after_dup_check;
--
--		old_rr = rr_set->tail;
--		while (old_rr) {
--			old_d = call_get_wired(old_rr);
--			if (old_d.length == new_d.length &&
--				memcmp(old_d.data, new_d.data, old_d.length) == 0)
--			{
--				G.stats.skipped_dup_rr_count++;
--				return old_rr;
--			}
--			old_rr = old_rr->next;
--		}
--	}
-+    struct rr *rr = rrptr;
-+    struct named_rr *named_rr;
-+    struct rr_set *rr_set;
-+    int name_l;
-+    int apex_assigned = 0;
-+    int is_generic = 0;
-+
-+    if (rdtype < 0) {
-+        rdtype = -rdtype;
-+        is_generic = 1;
-+    }
-+    name_l = strlen(name);
-+    if (name_l > 511)
-+        return bitch("name is too long: %s", name);
-+
-+    if (G.stats.rr_count == 0) {
-+        if (rdtype != T_SOA) {
-+            return bitch("the first record in the zone must be an SOA record");
-+        } else {
-+            zone_apex = name;
-+            zone_apex_l = name_l;
-+            apex_assigned = 1;
-+        }
-+    }
-+    if (zone_apex && name_l >= zone_apex_l) {
-+        if (strcmp(zone_apex, name+name_l-zone_apex_l) != 0) {
-+            return bitch("%s does not belong to zone %s", name, zone_apex);
-+        } else if (name_l > zone_apex_l && name[name_l-zone_apex_l-1] != '.') {
-+            return bitch("%s does not belong to zone %s", name, zone_apex);
-+        }
-+    } else {
-+        if (zone_apex) {
-+            return bitch("%s does not belong to zone %s", name, zone_apex);
-+        } else {
-+            croakx(3, "assertion error: %s does not belong to a zone", name);
-+        }
-+    }
-+
-+    named_rr = find_or_create_named_rr(name);
-+    if (apex_assigned) {
-+        named_rr->flags |= NAME_FLAG_APEX;
-+    }
-+    rr_set = find_or_create_rr_set(named_rr, rdtype);
-+
-+    rr->rdtype = rdtype;
-+    rr->ttl = ttl;
-+    rr->line = file_info->line;
-+    rr->file_name = file_info->name;
-+    rr->is_generic = is_generic;
-+
-+    if (rr_set->count > 0) {
-+        struct binary_data new_d, old_d;
-+        struct rr *old_rr;
-+
-+        new_d = call_get_wired(rr);
-+        if (new_d.length < 0) goto after_dup_check;
-+
-+        old_rr = rr_set->tail;
-+        while (old_rr) {
-+            old_d = call_get_wired(old_rr);
-+            if (old_d.length == new_d.length &&
-+                memcmp(old_d.data, new_d.data, old_d.length) == 0)
-+            {
-+                G.stats.skipped_dup_rr_count++;
-+                return old_rr;
-+            }
-+            old_rr = old_rr->next;
-+        }
-+    }
- after_dup_check:
--	if (rdtype == T_SOA) {
--	   	if (G.stats.soa_rr_count++) {
--			return bitch("there could only be one SOA in a zone");
--		}
--	}
--
--	rr->rr_set = rr_set;
--	rr->next = NULL;
--	rr->prev = rr_set->head;
--	rr_set->head = rr;
--	if (rr->prev)
--		rr->prev->next = rr;
--	if (!rr_set->tail)
--		rr_set->tail = rr;
--
--	rr_set->count++;
--
--	if (G.opt.verbose) {
--		char *rdata;
--		if (rdtype > T_MAX)
--			rdata = any_human(rr);
--		else
--			rdata = rr_methods[rdtype].rr_human(rr);
--		fprintf(stderr, "-> %s:%d: %s IN %ld %s",
--				file_info->name, file_info->line,
--				name, ttl, rdtype2str(rdtype));
--		if (rdata) {
--			fprintf(stderr, " %s\n", rdata);
--		} else {
--			fprintf(stderr, "\n");
--		}
--	}
-+    if (rdtype == T_SOA) {
-+        if (G.stats.soa_rr_count++) {
-+            return bitch("there could only be one SOA in a zone");
-+        }
-+    }
-+
-+    rr->rr_set = rr_set;
-+    rr->next = NULL;
-+    rr->prev = rr_set->head;
-+    rr_set->head = rr;
-+    if (rr->prev)
-+        rr->prev->next = rr;
-+    if (!rr_set->tail)
-+        rr_set->tail = rr;
-+
-+    rr_set->count++;
-+
-+    if (G.opt.verbose) {
-+        char *rdata;
-+        if (rdtype > T_MAX)
-+            rdata = any_human(rr);
-+        else
-+            rdata = rr_methods[rdtype].rr_human(rr);
-+        fprintf(stderr, "-> %s:%d: %s IN %ld %s",
-+                file_info->name, file_info->line,
-+                name, ttl, rdtype2str(rdtype));
-+        if (rdata) {
-+            fprintf(stderr, " %s\n", rdata);
-+        } else {
-+            fprintf(stderr, "\n");
-+        }
-+    }
- 
--	G.stats.rr_count++;
--	named_rr->flags |= NAME_FLAG_HAS_RECORDS;
-+    G.stats.rr_count++;
-+    named_rr->flags |= NAME_FLAG_HAS_RECORDS;
- 
--	return rr;
-+    return rr;
- }
- 
- struct named_rr *find_named_rr(char *name)
- {
--	struct named_rr **named_rr_slot;
-+    struct named_rr **named_rr_slot;
- 
--	named_rr_slot = (void*) cbtree_find(&zone_data, (char *)name2findable_name(name));
--	if (named_rr_slot)
--		return *named_rr_slot;
--	return NULL;
-+    named_rr_slot = (void*) cbtree_find(&zone_data, (char *)name2findable_name(name));
-+    if (named_rr_slot)
-+        return *named_rr_slot;
-+    return NULL;
- }
- 
- struct named_rr *find_next_named_rr(struct named_rr *named_rr)
- {
--	struct named_rr *res;
-+    struct named_rr *res;
- 
--	if (cbtree_next(&zone_data, (char *)name2findable_name(named_rr->name), (intptr_t *)&res) == NULL)
--		return NULL;
-+    if (cbtree_next(&zone_data, (char *)name2findable_name(named_rr->name), (intptr_t *)&res) == NULL)
-+        return NULL;
- 
--	return res;
-+    return res;
- }
- 
- struct rr_set *find_rr_set(int rdtype, char *name)
- {
--	struct named_rr *named_rr;
-+    struct named_rr *named_rr;
- 
--	named_rr = find_named_rr(name);
--	if (!named_rr)
--		return NULL;
-+    named_rr = find_named_rr(name);
-+    if (!named_rr)
-+        return NULL;
- 
--	return find_rr_set_in_named_rr(named_rr, rdtype);
-+    return find_rr_set_in_named_rr(named_rr, rdtype);
- }
- 
- struct rr_set *find_rr_set_in_named_rr(struct named_rr *named_rr, int rdtype)
- {
--	struct rr_set **rr_set_slot;
-+    struct rr_set **rr_set_slot;
- 
--	JLG(rr_set_slot, named_rr->rr_sets, rdtype);
--	if (rr_set_slot)
--		return *rr_set_slot;
--	return NULL;
-+    JLG(rr_set_slot, named_rr->rr_sets, rdtype);
-+    if (rr_set_slot)
-+        return *rr_set_slot;
-+    return NULL;
- }
- 
- uint32_t get_rr_set_count(struct named_rr *named_rr)
- {
--	uint32_t count;
--	JLC(count, named_rr->rr_sets, 0, -1);
--	return count;
-+    uint32_t count;
-+    JLC(count, named_rr->rr_sets, 0, -1);
-+    return count;
- }
- 
- struct rr *rr_parse_any(char *name, long ttl, int type, char *s)
- {
--	struct rr_any *rr = getmem(sizeof(*rr));
--	long long len;
-+    struct rr_any *rr = getmem(sizeof(*rr));
-+    long long len;
- 
--	if (*s++ != '\\') {
-+    if (*s++ != '\\') {
- invalid:
--		return bitch("invalid custom type rdata");
--	}
--	if (*s++ != '#')
--		goto invalid;
--	if (*s && !isspace(*s) && *s != ';' && *s != ')')
--		goto invalid;
--	s = skip_white_space(s);
--	if (!s)	return NULL;
--
--	len = extract_integer(&s, "custom data size");
--	if (len < 0) return NULL;
--	if (len > 65535) goto invalid;
--
--	rr->data = extract_hex_binary_data(&s, "custom data", EXTRACT_EAT_WHITESPACE);
--	if (rr->data.length < 0)	return NULL;
--	if (rr->data.length != len)
--		return bitch("custom data is longer than specified");
--
--	if (*s) {
--		return bitch("garbage after valid %s data", rdtype2str(type));
--	}
-+        return bitch("invalid custom type rdata");
-+    }
-+    if (*s++ != '#')
-+        goto invalid;
-+    if (*s && !isspace(*s) && *s != ';' && *s != ')')
-+        goto invalid;
-+    s = skip_white_space(s);
-+    if (!s) return NULL;
-+
-+    len = extract_integer(&s, "custom data size", NULL);
-+    if (len < 0) return NULL;
-+    if (len > 65535) goto invalid;
-+
-+    rr->data = extract_hex_binary_data(&s, "custom data", EXTRACT_EAT_WHITESPACE);
-+    if (rr->data.length < 0)    return NULL;
-+    if (rr->data.length != len)
-+        return bitch("custom data is longer than specified");
-+
-+    if (*s) {
-+        return bitch("garbage after valid %s data", rdtype2str(type));
-+    }
- 
--	return store_record(-type, name, ttl, rr);
-+    return store_record(-type, name, ttl, rr);
- }
- 
- char* any_human(struct rr *rrv)
- {
--	RRCAST(any);
--	char buf[80];
-+    RRCAST(any);
-+    char buf[80];
- 
--	sprintf(buf, "\\# %d ...", rr->data.length);
--	return quickstrdup_temp(buf);
-+    sprintf(buf, "\\# %d ...", rr->data.length);
-+    return quickstrdup_temp(buf);
- }
- 
- struct binary_data any_wirerdata(struct rr *rrv)
- {
--	RRCAST(any);
-+    RRCAST(any);
- 
--	return compose_binary_data("d", 1, rr->data);
-+    return compose_binary_data("d", 1, rr->data);
- }
- 
- struct rr_methods unknown_methods = { NULL, any_human, any_wirerdata, NULL, NULL };
- 
- int str2rdtype(char *rdtype, int *is_generic)
- {
--	if (!rdtype) return -1;
--	if (is_generic) *is_generic = 0;
--	switch (*rdtype) {
--	case 'a':
--		if (strcmp(rdtype, "a") == 0) {
--			return T_A;
--		} else if (strcmp(rdtype, "aaaa") == 0) {
--			return T_AAAA;
--		} else if (strcmp(rdtype, "afsdb") == 0) {
--			return T_AFSDB;
--		}
--		break;
--	case 'c':
--		if (strcmp(rdtype, "cname") == 0) {
--			return T_CNAME;
--		} else if (strcmp(rdtype, "cert") == 0) {
--			return T_CERT;
--		}
--		break;
--	case 'd':
--		if (strcmp(rdtype, "ds") == 0) {
--			return T_DS;
--		} else if (strcmp(rdtype, "dnskey") == 0) {
--			return T_DNSKEY;
--		} else if (strcmp(rdtype, "dname") == 0) {
--			return T_DNAME;
--		} else if (strcmp(rdtype, "dlv") == 0) {
--			return T_DLV;
--		} else if (strcmp(rdtype, "dhcid") == 0) {
--			return T_DHCID;
--		}
--		break;
--	case 'h':
--		if (strcmp(rdtype, "hinfo") == 0) {
--			return T_HINFO;
--		}
--		break;
--	case 'i':
--		if (strcmp(rdtype, "ipseckey") == 0) {
--			return T_IPSECKEY;
--		} else if (strcmp(rdtype, "isdn") == 0) {
--			return T_ISDN;
--		}
--		break;
--	case 'k':
--		if (strcmp(rdtype, "kx") == 0) {
--			return T_KX;
--		}
--		break;
--	case 'l':
--		if (strcmp(rdtype, "loc") == 0) {
--			return T_LOC;
--		} else if (strcmp(rdtype, "l32") == 0) {
--			return T_L32;
--		} else if (strcmp(rdtype, "l64") == 0) {
--			return T_L64;
--		} else if (strcmp(rdtype, "lp") == 0) {
--			return T_LP;
--		}
--		break;
--	case 'm':
--		if (strcmp(rdtype, "mx") == 0) {
--			return T_MX;
--		} else if (strcmp(rdtype, "mb") == 0) {
--			return T_MB;
--		} else if (strcmp(rdtype, "mg") == 0) {
--			return T_MG;
--		} else if (strcmp(rdtype, "minfo") == 0) {
--			return T_MINFO;
--		} else if (strcmp(rdtype, "mr") == 0) {
--			return T_MR;
--		}
--		break;
--	case 'n':
--		if (strcmp(rdtype, "ns") == 0) {
--			return T_NS;
--		} else if (strcmp(rdtype, "naptr") == 0) {
--			return T_NAPTR;
--		} else if (strcmp(rdtype, "nsec") == 0) {
--			return T_NSEC;
--		} else if (strcmp(rdtype, "nsec3") == 0) {
--			return T_NSEC3;
--		} else if (strcmp(rdtype, "nid") == 0) {
--			return T_NID;
--		} else if (strcmp(rdtype, "nsec3param") == 0) {
--			return T_NSEC3PARAM;
--		} else if (strcmp(rdtype, "nsap") == 0) {
--			return T_NSAP;
--		}
--		break;
--	case 'p':
--		if (strcmp(rdtype, "ptr") == 0) {
--			return T_PTR;
--		} else if (strcmp(rdtype, "px") == 0) {
--			return T_PX;
--		}
--		break;
--	case 'r':
--		if (strcmp(rdtype, "rrsig") == 0) {
--			return T_RRSIG;
--		} else if (strcmp(rdtype, "rp") == 0) {
--			return T_RP;
--		} else if (strcmp(rdtype, "rt") == 0) {
--			return T_RT;
--		}
--		break;
--	case 's':
--		if (strcmp(rdtype, "soa") == 0) {
--			return T_SOA;
--		} else if (strcmp(rdtype, "srv") == 0) {
--			return T_SRV;
--		} else if (strcmp(rdtype, "spf") == 0) {
--			return T_SPF;
--		} else if (strcmp(rdtype, "sshfp") == 0) {
--			return T_SSHFP;
--		}
--		break;
--	case 't':
--		if (strcmp(rdtype, "txt") == 0) {
--			return T_TXT;
--		} else if (strcmp(rdtype, "tlsa") == 0) {
--			return T_TLSA;
--		} else if (strncmp(rdtype, "type", 4) == 0) {
--			long type = strtol(rdtype+4, NULL, 10);
--			if (is_generic) *is_generic = 1;
--			if (type <= 0 || type > 65535)
--				bitch("invalid rdtype %s", rdtype);
--			return type;
--		}
--		break;
--	case 'x':
--		if (strcmp(rdtype, "x25") == 0) {
--			return T_X25;
--		}
--		break;
--	}
--	bitch("invalid or unsupported rdtype %s", rdtype);
--	return -1;
-+    if (!rdtype) return -1;
-+    if (is_generic) *is_generic = 0;
-+    switch (*rdtype) {
-+    case 'a':
-+        if (strcmp(rdtype, "a") == 0) {
-+            return T_A;
-+        } else if (strcmp(rdtype, "aaaa") == 0) {
-+            return T_AAAA;
-+        } else if (strcmp(rdtype, "afsdb") == 0) {
-+            return T_AFSDB;
-+        }
-+        break;
-+    case 'c':
-+        if (strcmp(rdtype, "cname") == 0) {
-+            return T_CNAME;
-+        } else if (strcmp(rdtype, "cert") == 0) {
-+            return T_CERT;
-+        } else if (strcmp(rdtype, "caa") == 0) {
-+            return T_CAA;
-+        } else if (strcmp(rdtype, "cds") == 0) {
-+            return T_CDS;
-+        } else if (strcmp(rdtype, "cdnskey") == 0) {
-+            return T_CDNSKEY;
-+        }
-+        break;
-+    case 'd':
-+        if (strcmp(rdtype, "ds") == 0) {
-+            return T_DS;
-+        } else if (strcmp(rdtype, "dnskey") == 0) {
-+            return T_DNSKEY;
-+        } else if (strcmp(rdtype, "dname") == 0) {
-+            return T_DNAME;
-+        } else if (strcmp(rdtype, "dlv") == 0) {
-+            return T_DLV;
-+        } else if (strcmp(rdtype, "dhcid") == 0) {
-+            return T_DHCID;
-+        }
-+        break;
-+    case 'h':
-+        if (strcmp(rdtype, "hinfo") == 0) {
-+            return T_HINFO;
-+        }
-+        break;
-+    case 'i':
-+        if (strcmp(rdtype, "ipseckey") == 0) {
-+            return T_IPSECKEY;
-+        } else if (strcmp(rdtype, "isdn") == 0) {
-+            return T_ISDN;
-+        }
-+        break;
-+    case 'k':
-+        if (strcmp(rdtype, "kx") == 0) {
-+            return T_KX;
-+        }
-+        break;
-+    case 'l':
-+        if (strcmp(rdtype, "loc") == 0) {
-+            return T_LOC;
-+        } else if (strcmp(rdtype, "l32") == 0) {
-+            return T_L32;
-+        } else if (strcmp(rdtype, "l64") == 0) {
-+            return T_L64;
-+        } else if (strcmp(rdtype, "lp") == 0) {
-+            return T_LP;
-+        }
-+        break;
-+    case 'm':
-+        if (strcmp(rdtype, "mx") == 0) {
-+            return T_MX;
-+        } else if (strcmp(rdtype, "mb") == 0) {
-+            return T_MB;
-+        } else if (strcmp(rdtype, "mg") == 0) {
-+            return T_MG;
-+        } else if (strcmp(rdtype, "minfo") == 0) {
-+            return T_MINFO;
-+        } else if (strcmp(rdtype, "mr") == 0) {
-+            return T_MR;
-+        }
-+        break;
-+    case 'n':
-+        if (strcmp(rdtype, "ns") == 0) {
-+            return T_NS;
-+        } else if (strcmp(rdtype, "naptr") == 0) {
-+            return T_NAPTR;
-+        } else if (strcmp(rdtype, "nsec") == 0) {
-+            return T_NSEC;
-+        } else if (strcmp(rdtype, "nsec3") == 0) {
-+            return T_NSEC3;
-+        } else if (strcmp(rdtype, "nid") == 0) {
-+            return T_NID;
-+        } else if (strcmp(rdtype, "nsec3param") == 0) {
-+            return T_NSEC3PARAM;
-+        } else if (strcmp(rdtype, "nsap") == 0) {
-+            return T_NSAP;
-+        }
-+        break;
-+    case 'p':
-+        if (strcmp(rdtype, "ptr") == 0) {
-+            return T_PTR;
-+        } else if (strcmp(rdtype, "px") == 0) {
-+            return T_PX;
-+        }
-+        break;
-+    case 'r':
-+        if (strcmp(rdtype, "rrsig") == 0) {
-+            return T_RRSIG;
-+        } else if (strcmp(rdtype, "rp") == 0) {
-+            return T_RP;
-+        } else if (strcmp(rdtype, "rt") == 0) {
-+            return T_RT;
-+        }
-+        break;
-+    case 's':
-+        if (strcmp(rdtype, "soa") == 0) {
-+            return T_SOA;
-+        } else if (strcmp(rdtype, "srv") == 0) {
-+            return T_SRV;
-+        } else if (strcmp(rdtype, "spf") == 0) {
-+            return T_SPF;
-+        } else if (strcmp(rdtype, "sshfp") == 0) {
-+            return T_SSHFP;
-+        } else if (strcmp(rdtype, "smimea") == 0) {
-+            return T_SMIMEA;
-+        }
-+        break;
-+    case 't':
-+        if (strcmp(rdtype, "txt") == 0) {
-+            return T_TXT;
-+        } else if (strcmp(rdtype, "tlsa") == 0) {
-+            return T_TLSA;
-+        } else if (strncmp(rdtype, "type", 4) == 0) {
-+            long type = strtol(rdtype+4, NULL, 10);
-+            if (is_generic) *is_generic = 1;
-+            if (type <= 0 || type > 65535)
-+                bitch("invalid rdtype %s", rdtype);
-+            return type;
-+        }
-+        break;
-+    case 'x':
-+        if (strcmp(rdtype, "x25") == 0) {
-+            return T_X25;
-+        }
-+        break;
-+    }
-+    bitch("invalid or unsupported rdtype %s", rdtype);
-+    return -1;
- }
- 
- void validate_rrset(struct rr_set *rr_set)
- {
--	struct rr *rr;
--	int ttl;
-+    struct rr *rr;
-+    int ttl;
- 
--	/* This can happen when rr_set was allocated but
--	 * nothing was added to it due to an error. */
--	if (rr_set->count == 0) return;
--	rr = rr_set->tail;
--	if (!rr) {
--		croakx(4, "assertion failed: %s %s is null, but count is %d",
--			   rdtype2str(rr_set->rdtype), rr_set->named_rr->name,
--			   rr_set->count);
--	}
--	if (rr_set->rdtype < T_MAX && rr_methods[rr_set->rdtype].rr_validate_set)
--		rr_methods[rr_set->rdtype].rr_validate_set(rr_set);
--	ttl = rr->ttl;
--
--	while (rr) {
--		validate_record(rr);
--		if (ttl != rr->ttl) {
--		   	if (rr->rdtype != T_RRSIG) /* RRSIG is an exception */
--				moan(rr->file_name, rr->line, "TTL values differ within an RR set");
--		}
--		rr = rr->next;
--	}
-+    /* This can happen when rr_set was allocated but
-+     * nothing was added to it due to an error. */
-+    if (rr_set->count == 0) return;
-+    rr = rr_set->tail;
-+    if (!rr) {
-+        croakx(4, "assertion failed: %s %s is null, but count is %d",
-+               rdtype2str(rr_set->rdtype), rr_set->named_rr->name,
-+               rr_set->count);
-+    }
-+    if (rr_set->rdtype < T_MAX && rr_methods[rr_set->rdtype].rr_validate_set)
-+        rr_methods[rr_set->rdtype].rr_validate_set(rr_set);
-+    ttl = rr->ttl;
-+
-+    while (rr) {
-+        validate_record(rr);
-+        if (ttl != rr->ttl) {
-+            if (rr->rdtype != T_RRSIG) /* RRSIG is an exception */
-+                moan(rr->file_name, rr->line, "TTL values differ within an RR set");
-+        }
-+        rr = rr->next;
-+    }
- }
- 
- void debug(struct named_rr *named_rr, char *s)
- {
--	fprintf(stderr, "%s %s", s, named_rr->name);
--	if ((named_rr->flags & NAME_FLAG_APEX))
--		fprintf(stderr, ", apex");
--	if ((named_rr->flags & NAME_FLAG_HAS_RECORDS))
--		fprintf(stderr, ", has records");
--	if ((named_rr->flags & NAME_FLAG_DELEGATION))
--		fprintf(stderr, ", delegation");
--	if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE))
--		fprintf(stderr, ", not auth");
--	if ((named_rr->flags & NAME_FLAG_NSEC3_ONLY))
--		fprintf(stderr, ", nsec3 only");
--	if ((named_rr->flags & NAME_FLAG_KIDS_WITH_RECORDS))
--		fprintf(stderr, ", kid records");
--	if ((named_rr->flags & NAME_FLAG_SIGNED_DELEGATION))
--		fprintf(stderr, ", signed delegation");
--	if ((named_rr->flags & NAME_FLAG_APEX_PARENT))
--		fprintf(stderr, ", apex parent");
--	fprintf(stderr, "\n");
-+    fprintf(stderr, "%s %s", s, named_rr->name);
-+    if ((named_rr->flags & NAME_FLAG_APEX))
-+        fprintf(stderr, ", apex");
-+    if ((named_rr->flags & NAME_FLAG_HAS_RECORDS))
-+        fprintf(stderr, ", has records");
-+    if ((named_rr->flags & NAME_FLAG_DELEGATION))
-+        fprintf(stderr, ", delegation");
-+    if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE))
-+        fprintf(stderr, ", not auth");
-+    if ((named_rr->flags & NAME_FLAG_NSEC3_ONLY))
-+        fprintf(stderr, ", nsec3 only");
-+    if ((named_rr->flags & NAME_FLAG_KIDS_WITH_RECORDS))
-+        fprintf(stderr, ", kid records");
-+    if ((named_rr->flags & NAME_FLAG_SIGNED_DELEGATION))
-+        fprintf(stderr, ", signed delegation");
-+    if ((named_rr->flags & NAME_FLAG_APEX_PARENT))
-+        fprintf(stderr, ", apex parent");
-+    fprintf(stderr, "\n");
- }
- 
- static int
- validate_named_rr(const char *name, intptr_t *data, void *p)
- {
--	struct named_rr *named_rr = *((struct named_rr **)data);
--	Word_t rdtype;
--	struct rr_set **rr_set_p;
--	int nsec3_present = 0;
--	int nsec3_only = 1;
--	static int seen_apex = 0;
--
--	if ((named_rr->flags & NAME_FLAG_APEX))
--		seen_apex = 1;
--	if (!seen_apex)
--		named_rr->flags |= NAME_FLAG_APEX_PARENT;
--
--	if (named_rr->parent && (named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) {
--		named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE;
--		if ((named_rr->flags & NAME_FLAG_HAS_RECORDS) != 0) {
--			G.stats.not_authoritative++;
--		}
--	}
--
--	if (G.nsec3_opt_out_present && (named_rr->flags & NAME_FLAG_DELEGATION)) {
--		JLG(rr_set_p, named_rr->rr_sets, T_DS);
--		if (!rr_set_p)
--			named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE;
--	}
-+    struct named_rr *named_rr = *((struct named_rr **)data);
-+    Word_t rdtype;
-+    struct rr_set **rr_set_p;
-+    int nsec3_present = 0;
-+    int nsec3_only = 1;
-+    static int seen_apex = 0;
-+
-+    if ((named_rr->flags & NAME_FLAG_APEX))
-+        seen_apex = 1;
-+    if (!seen_apex)
-+        named_rr->flags |= NAME_FLAG_APEX_PARENT;
-+
-+    if (named_rr->parent && (named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) {
-+        named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE;
-+        if ((named_rr->flags & NAME_FLAG_HAS_RECORDS) != 0) {
-+            G.stats.not_authoritative++;
-+        }
-+    }
-+
-+    if (G.nsec3_opt_out_present && (named_rr->flags & NAME_FLAG_DELEGATION)) {
-+        JLG(rr_set_p, named_rr->rr_sets, T_DS);
-+        if (!rr_set_p)
-+            named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE;
-+    }
- //debug(named_rr, ">>>>");
- 
--	rdtype = 0;
--	JLF(rr_set_p, named_rr->rr_sets, rdtype);
-+    rdtype = 0;
-+    JLF(rr_set_p, named_rr->rr_sets, rdtype);
- 
--	while (rr_set_p) {
--		validate_rrset(*rr_set_p);
--		if (rdtype == T_NSEC3)
--			nsec3_present = 1;
--		else if (rdtype != T_RRSIG)
--			nsec3_only = 0;
--		if (rdtype != T_NSEC3 && rdtype != T_RRSIG && rdtype != T_NS)
--			named_rr->flags |= NAME_FLAG_THIS_WITH_RECORDS;
--		if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE) == 0 &&
--			rdtype != T_NS && rdtype != T_NSEC3 && rdtype != T_RRSIG)
--		{
--			struct named_rr *nrr = named_rr;
--			int skip_first = rdtype == T_NS;
--
--			while (nrr && (nrr->flags & NAME_FLAG_KIDS_WITH_RECORDS) == 0) {
--				if ((nrr->flags & NAME_FLAG_APEX_PARENT) || strlen(nrr->name) < zone_apex_l) {
--					nrr->flags |= NAME_FLAG_APEX_PARENT;
--					break;
--				}
--				if (!skip_first)
--					nrr->flags |= NAME_FLAG_KIDS_WITH_RECORDS;
--				skip_first = 0;
--				nrr = nrr->parent;
--			}
--		}
--		if (rdtype == T_DS) {
--			struct named_rr *nrr = named_rr;
--			while (nrr && (nrr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) {
--				// nrr->flags &= ~(NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE);
--				nrr->flags |= NAME_FLAG_SIGNED_DELEGATION;
--				nrr = nrr->parent;
--			}
--		}
--		JLN(rr_set_p, named_rr->rr_sets, rdtype);
--	}
--	if (nsec3_present && nsec3_only) {
--		named_rr->flags |= NAME_FLAG_NSEC3_ONLY;
--	}
--	return 1;
-+    while (rr_set_p) {
-+        validate_rrset(*rr_set_p);
-+        if (rdtype == T_NSEC3)
-+            nsec3_present = 1;
-+        else if (rdtype != T_RRSIG)
-+            nsec3_only = 0;
-+        if (rdtype != T_NSEC3 && rdtype != T_RRSIG && rdtype != T_NS)
-+            named_rr->flags |= NAME_FLAG_THIS_WITH_RECORDS;
-+        if ((named_rr->flags & NAME_FLAG_NOT_AUTHORITATIVE) == 0 &&
-+            rdtype != T_NS && rdtype != T_NSEC3 && rdtype != T_RRSIG)
-+        {
-+            struct named_rr *nrr = named_rr;
-+            int skip_first = rdtype == T_NS;
-+
-+            while (nrr && (nrr->flags & NAME_FLAG_KIDS_WITH_RECORDS) == 0) {
-+                if ((nrr->flags & NAME_FLAG_APEX_PARENT) || strlen(nrr->name) < zone_apex_l) {
-+                    nrr->flags |= NAME_FLAG_APEX_PARENT;
-+                    break;
-+                }
-+                if (!skip_first)
-+                    nrr->flags |= NAME_FLAG_KIDS_WITH_RECORDS;
-+                skip_first = 0;
-+                nrr = nrr->parent;
-+            }
-+        }
-+        if (rdtype == T_DS) {
-+            struct named_rr *nrr = named_rr;
-+            while (nrr && (nrr->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0) {
-+                // nrr->flags &= ~(NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE);
-+                nrr->flags |= NAME_FLAG_SIGNED_DELEGATION;
-+                nrr = nrr->parent;
-+            }
-+        }
-+        JLN(rr_set_p, named_rr->rr_sets, rdtype);
-+    }
-+    if (nsec3_present && nsec3_only) {
-+        named_rr->flags |= NAME_FLAG_NSEC3_ONLY;
-+    }
-+    return 1;
- }
- 
- 
- static void* nsec_validate_pass2(struct rr *rrv)
- {
--	RRCAST(nsec);
--	struct named_rr *named_rr, *next_named_rr;
-+    RRCAST(nsec);
-+    struct named_rr *named_rr, *next_named_rr;
- 
--	named_rr = rr->rr.rr_set->named_rr;
--	next_named_rr = find_next_named_rr(named_rr);
--	/* Skip empty non-terminals and not authoritative records from consideration */
--	while (next_named_rr) {
--		if ((next_named_rr->flags & NAME_FLAG_HAS_RECORDS) == 0) {
--			next_named_rr = find_next_named_rr(next_named_rr);
--			continue;
--		}
--		if (next_named_rr->parent &&
--			(next_named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0)
--		{
--			named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE;
--			next_named_rr = find_next_named_rr(next_named_rr);
--			continue;
--		}
--		break;
--	}
--
--	if (strcasecmp(rr->next_domain, zone_apex) == 0) {
--		if (next_named_rr) {
--			return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s is the last name, but %s exists",
--						named_rr->name, next_named_rr->name);
--		}
--	} else {
--		if (!next_named_rr) {
--			return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but nothing does",
--						rr->next_domain, named_rr->name);
--		} else if (strcasecmp(rr->next_domain, next_named_rr->name) != 0) {
--			return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but %s does",
--						rr->next_domain, named_rr->name, next_named_rr->name);
--		}
--	}
-+    named_rr = rr->rr.rr_set->named_rr;
-+    next_named_rr = find_next_named_rr(named_rr);
-+    /* Skip empty non-terminals and not authoritative records from consideration */
-+    while (next_named_rr) {
-+        if ((next_named_rr->flags & NAME_FLAG_HAS_RECORDS) == 0) {
-+            next_named_rr = find_next_named_rr(next_named_rr);
-+            continue;
-+        }
-+        if (next_named_rr->parent &&
-+            (next_named_rr->parent->flags & (NAME_FLAG_DELEGATION|NAME_FLAG_NOT_AUTHORITATIVE)) != 0)
-+        {
-+            named_rr->flags |= NAME_FLAG_NOT_AUTHORITATIVE;
-+            next_named_rr = find_next_named_rr(next_named_rr);
-+            continue;
-+        }
-+        break;
-+    }
-+
-+    if (strcasecmp(rr->next_domain, zone_apex) == 0) {
-+        if (next_named_rr) {
-+            return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s is the last name, but %s exists",
-+                        named_rr->name, next_named_rr->name);
-+        }
-+    } else {
-+        if (!next_named_rr) {
-+            return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but nothing does",
-+                        rr->next_domain, named_rr->name);
-+        } else if (strcasecmp(rr->next_domain, next_named_rr->name) != 0) {
-+            return moan(rr->rr.file_name, rr->rr.line, "NSEC says %s comes after %s, but %s does",
-+                        rr->next_domain, named_rr->name, next_named_rr->name);
-+        }
-+    }
- 
--	/* TODO: more checks */
--	return rr;
-+    /* TODO: more checks */
-+    return rr;
- }
- 
- static int
- second_pass_one_name(const char *name, intptr_t *data, void *p)
- {
--	struct named_rr *named_rr = *((struct named_rr **)data);
--	struct rr_set **rr_set_p;
-+    struct named_rr *named_rr = *((struct named_rr **)data);
-+    struct rr_set **rr_set_p;
- 
--	freeall_temp();
--	JLG(rr_set_p, named_rr->rr_sets, T_NSEC);
--	if (rr_set_p && (*rr_set_p)->tail) {
--		nsec_validate_pass2((*rr_set_p)->tail);
--	}
--	return 1;
-+    freeall_temp();
-+    JLG(rr_set_p, named_rr->rr_sets, T_NSEC);
-+    if (rr_set_p && (*rr_set_p)->tail) {
-+        nsec_validate_pass2((*rr_set_p)->tail);
-+    }
-+    return 1;
- }
- 
- void validate_zone(void)
- {
--	cbtree_allprefixed(&zone_data, "", validate_named_rr, NULL);
--	cbtree_allprefixed(&zone_data, "", second_pass_one_name, NULL);
-+    cbtree_allprefixed(&zone_data, "", validate_named_rr, NULL);
-+    cbtree_allprefixed(&zone_data, "", second_pass_one_name, NULL);
- 
--	if (G.dnssec_active && !G.nsec3_present)
--		validate_nsec_chain();
-+    if (G.dnssec_active && !G.nsec3_present)
-+        validate_nsec_chain();
- }
- 
- void validate_record(struct rr *rr)
- {
--	freeall_temp();
--	if (!rr->is_generic && rr->rdtype < T_MAX && rr_methods[rr->rdtype].rr_validate)
--		rr_methods[rr->rdtype].rr_validate(rr);
-+    freeall_temp();
-+    if (!rr->is_generic && rr->rdtype <= T_MAX)
-+        rr_counts[rr->rdtype]++;
-+    if (!rr->is_generic && rr->rdtype <= T_MAX && rr_methods[rr->rdtype].rr_validate)
-+        rr_methods[rr->rdtype].rr_validate(rr);
- }
- 
- int extract_algorithm(char **s, char *what)
- {
--	int alg;
--	char *str_alg;
-+    int alg;
-+    char *str_alg;
- 
--	if (isdigit(**s)) {
--		alg = extract_integer(s, what);
--		if (algorithm_type(alg) == ALG_UNSUPPORTED) {
--			bitch("bad or unsupported algorithm %d", alg);
--			return ALG_UNSUPPORTED;
--		}
--		return alg;
--	} else {
--		str_alg = extract_label(s, what, "temporary");
--		if (!str_alg) return ALG_UNSUPPORTED;
--		if (strcmp(str_alg, "dsa") == 0)
--			return ALG_DSA;
--		if (strcmp(str_alg, "rsasha1") == 0)
--			return ALG_RSASHA1;
--		if (strcmp(str_alg, "dsa-nsec3-sha1") == 0)
--			return ALG_DSA_NSEC3_SHA1;
--		if (strcmp(str_alg, "rsasha1-nsec3-sha1") == 0)
--			return ALG_RSASHA1_NSEC3_SHA1;
--		if (strcmp(str_alg, "rsasha256") == 0)
--			return ALG_RSASHA256;
--		if (strcmp(str_alg, "rsasha512") == 0)
--			return ALG_RSASHA512;
--
--		if (strcmp(str_alg, "ecc-gost") == 0)
--			return ALG_ECCGOST;
--		if (strcmp(str_alg, "ecdsap256sha256") == 0)
--			return ALG_ECDSAP256SHA256;
--		if (strcmp(str_alg, "ecdsap384sha384") == 0)
--			return ALG_ECDSAP384SHA384;
--
--		if (strcmp(str_alg, "privatedns") == 0)
--			return ALG_PRIVATEDNS;
--		if (strcmp(str_alg, "privateoid") == 0)
--			return ALG_PRIVATEOID;
--		bitch("bad or unsupported algorithm %s", str_alg);
--		return ALG_UNSUPPORTED;
--	}
-+    if (isdigit(**s)) {
-+        alg = extract_integer(s, what, NULL);
-+        if (algorithm_type(alg) == ALG_UNSUPPORTED) {
-+            bitch("bad or unsupported algorithm %d", alg);
-+            return ALG_UNSUPPORTED;
-+        }
-+        return alg;
-+    } else {
-+        str_alg = extract_label(s, what, "temporary");
-+        if (!str_alg) return ALG_UNSUPPORTED;
-+        if (strcmp(str_alg, "dsa") == 0)
-+            return ALG_DSA;
-+        if (strcmp(str_alg, "rsasha1") == 0)
-+            return ALG_RSASHA1;
-+        if (strcmp(str_alg, "dsa-nsec3-sha1") == 0)
-+            return ALG_DSA_NSEC3_SHA1;
-+        if (strcmp(str_alg, "rsasha1-nsec3-sha1") == 0)
-+            return ALG_RSASHA1_NSEC3_SHA1;
-+        if (strcmp(str_alg, "rsasha256") == 0)
-+            return ALG_RSASHA256;
-+        if (strcmp(str_alg, "rsasha512") == 0)
-+            return ALG_RSASHA512;
-+
-+        if (strcmp(str_alg, "ecc-gost") == 0)
-+            return ALG_ECCGOST;
-+        if (strcmp(str_alg, "ecdsap256sha256") == 0)
-+            return ALG_ECDSAP256SHA256;
-+        if (strcmp(str_alg, "ecdsap384sha384") == 0)
-+            return ALG_ECDSAP384SHA384;
-+        if (strcmp(str_alg, "ed25519") == 0)
-+            return ALG_ED25519;
-+        if (strcmp(str_alg, "ed448") == 0)
-+            return ALG_ED448;
-+
-+        if (strcmp(str_alg, "privatedns") == 0)
-+            return ALG_PRIVATEDNS;
-+        if (strcmp(str_alg, "privateoid") == 0)
-+            return ALG_PRIVATEOID;
-+        bitch("bad or unsupported algorithm %s", str_alg);
-+        return ALG_UNSUPPORTED;
-+    }
- }
- 
- int algorithm_type(int alg)
- {
--	switch (alg) {
--	case ALG_DSA:
--		return ALG_DSA_FAMILY;
--	case ALG_RSASHA1:
--		return ALG_RSA_FAMILY;
--	case ALG_DSA_NSEC3_SHA1:
--		return ALG_DSA_FAMILY;
--	case ALG_RSASHA1_NSEC3_SHA1:
--		return ALG_RSA_FAMILY;
--	case ALG_RSASHA256:
--		return ALG_RSA_FAMILY;
--	case ALG_RSASHA512:
--		return ALG_RSA_FAMILY;
-+    switch (alg) {
-+    case ALG_DSA:
-+        return ALG_DSA_FAMILY;
-+    case ALG_RSASHA1:
-+        return ALG_RSA_FAMILY;
-+    case ALG_DSA_NSEC3_SHA1:
-+        return ALG_DSA_FAMILY;
-+    case ALG_RSASHA1_NSEC3_SHA1:
-+        return ALG_RSA_FAMILY;
-+    case ALG_RSASHA256:
-+        return ALG_RSA_FAMILY;
-+    case ALG_RSASHA512:
-+        return ALG_RSA_FAMILY;
-         case ALG_ECCGOST:
-                 return ALG_ECC_FAMILY;
-         case ALG_ECDSAP256SHA256:
-                 return ALG_ECC_FAMILY;
-         case ALG_ECDSAP384SHA384:
-                 return ALG_ECC_FAMILY;
--	case ALG_PRIVATEDNS:
--		return ALG_PRIVATE_FAMILY;
--	case ALG_PRIVATEOID:
--		return ALG_PRIVATE_FAMILY;
--	}
--	return ALG_UNSUPPORTED;
-+    case ALG_ED25519:
-+        return ALG_ECC_FAMILY;
-+    case ALG_ED448:
-+        return ALG_ECC_FAMILY;
-+    case ALG_PRIVATEDNS:
-+        return ALG_PRIVATE_FAMILY;
-+    case ALG_PRIVATEOID:
-+        return ALG_PRIVATE_FAMILY;
-+    }
-+    return ALG_UNSUPPORTED;
- }
-diff -Naur validns-0.8/rr.h validns/rr.h
---- validns-0.8/rr.h	2014-02-11 15:46:57.000000000 -0500
-+++ validns/rr.h	2020-10-05 16:59:29.355681369 -0400
-@@ -9,49 +9,53 @@
- #ifndef _RR_H
- #define _RR_H 1
- 
--#define T_A		1
--#define T_NS	2
--#define T_CNAME	5
--#define T_SOA	6
--#define T_MB	7
--#define T_MG	8
--#define T_MR	9
--#define T_PTR	12
--#define T_HINFO	13
--#define T_MINFO	14
--#define T_MX	15
--#define T_TXT	16
--#define T_RP	17
--#define T_AFSDB	18
--#define T_X25	19
--#define T_ISDN	20
--#define T_RT	21
--#define T_NSAP	22
--#define T_PX	26
--#define T_AAAA	28
--#define T_LOC	29
--#define T_SRV	33
--#define T_NAPTR	35
--#define T_KX	36
--#define T_CERT	37
--#define T_DNAME	39
--#define T_DS	43
--#define T_SSHFP	44
--#define T_IPSECKEY	45
--#define T_RRSIG	46
--#define T_NSEC	47
--#define T_DNSKEY	48
--#define T_DHCID	49
--#define T_NSEC3	50
--#define T_NSEC3PARAM	51
--#define T_TLSA	52
--#define T_SPF	99
--#define T_NID	104
--#define T_L32	105
--#define T_L64	106
--#define T_LP	107
-+#define T_A     1
-+#define T_NS    2
-+#define T_CNAME 5
-+#define T_SOA   6
-+#define T_MB    7
-+#define T_MG    8
-+#define T_MR    9
-+#define T_PTR   12
-+#define T_HINFO 13
-+#define T_MINFO 14
-+#define T_MX    15
-+#define T_TXT   16
-+#define T_RP    17
-+#define T_AFSDB 18
-+#define T_X25   19
-+#define T_ISDN  20
-+#define T_RT    21
-+#define T_NSAP  22
-+#define T_PX    26
-+#define T_AAAA  28
-+#define T_LOC   29
-+#define T_SRV   33
-+#define T_NAPTR 35
-+#define T_KX    36
-+#define T_CERT  37
-+#define T_DNAME 39
-+#define T_DS    43
-+#define T_SSHFP 44
-+#define T_IPSECKEY  45
-+#define T_RRSIG 46
-+#define T_NSEC  47
-+#define T_DNSKEY    48
-+#define T_DHCID 49
-+#define T_NSEC3 50
-+#define T_NSEC3PARAM    51
-+#define T_TLSA  52
-+#define T_SMIMEA  53
-+#define T_CDS   59
-+#define T_CDNSKEY 60
-+#define T_SPF   99
-+#define T_NID   104
-+#define T_L32   105
-+#define T_L64   106
-+#define T_LP    107
-+#define T_CAA   257
- #define T_DLV   32769
--#define T_MAX	32769
-+#define T_MAX   32769
- 
- #define ALG_DSA                  3
- #define ALG_RSASHA1              5
-@@ -62,6 +66,8 @@
- #define ALG_ECCGOST             12
- #define ALG_ECDSAP256SHA256     13
- #define ALG_ECDSAP384SHA384     14
-+#define ALG_ED25519             15
-+#define ALG_ED448               16
- #define ALG_PRIVATEDNS         253
- #define ALG_PRIVATEOID         254
- 
-@@ -88,14 +94,15 @@
- typedef void* (*rr_validate_set_func)(struct rr_set*);
- typedef void* (*rr_validate_func)(struct rr*);
- struct rr_methods {
--	rr_parse_func        rr_parse;
--	rr_human_func        rr_human;
--	rr_wire_func         rr_wire;
--	rr_validate_set_func rr_validate_set;
--	rr_validate_func     rr_validate;
-+    rr_parse_func        rr_parse;
-+    rr_human_func        rr_human;
-+    rr_wire_func         rr_wire;
-+    rr_validate_set_func rr_validate_set;
-+    rr_validate_func     rr_validate;
- };
- extern struct rr_methods rr_methods[T_MAX+1];
- extern struct rr_methods unknown_methods;
-+extern int rr_counts[T_MAX+1];
- 
- struct binary_data call_get_wired(struct rr *rr);
- struct rr *rr_parse_any(char *name, long ttl, int type, char *s);
-@@ -130,58 +137,58 @@
- 
- struct named_rr
- {
--	char *name;
--	void *rr_sets;
-+    char *name;
-+    void *rr_sets;
- 
--	int line;
--	char *file_name;
--	uint32_t flags;
--	struct named_rr *parent;
-+    int line;
-+    char *file_name;
-+    uint32_t flags;
-+    struct named_rr *parent;
- };
- 
- struct rr_set
- {
--	struct rr* head;
--	struct rr* tail;
--	struct named_rr *named_rr;
--	int rdtype;
--	int count;
-+    struct rr* head;
-+    struct rr* tail;
-+    struct named_rr *named_rr;
-+    int rdtype;
-+    int count;
- };
- 
- struct rr
- {
--	struct rr* next;
--	struct rr* prev;
--	struct rr_set *rr_set;
--
--	int	ttl;
--	int rdtype;
--
--	int line;
--	int is_generic;
--	char *file_name;
-+    struct rr* next;
-+    struct rr* prev;
-+    struct rr_set *rr_set;
-+
-+    int ttl;
-+    int rdtype;
-+
-+    int line;
-+    int is_generic;
-+    char *file_name;
- };
- 
- struct rr_any
- {
--	struct rr rr;
--	struct binary_data data;
-+    struct rr rr;
-+    struct binary_data data;
- };
- 
- struct rr_a
- {
--	struct rr rr;
--	struct in_addr address;
-+    struct rr rr;
-+    struct in_addr address;
- };
- extern struct rr_methods a_methods;
- 
- struct rr_soa
- {
--	struct rr rr;
--	uint32_t serial;
--	int refresh, retry, expire, minimum;
--	char *rname;
--	char *mname;
-+    struct rr rr;
-+    uint32_t serial;
-+    int refresh, retry, expire, minimum;
-+    char *rname;
-+    char *mname;
- };
- extern struct rr_methods soa_methods;
- 
-@@ -197,19 +204,23 @@
-     struct rr rr;
-     int id_type;
-     int digest_type;
--	struct binary_data digest;
-+    struct binary_data digest;
- };
- extern struct rr_methods dhcid_methods;
- 
-+struct rr_txt_segment {
-+    struct binary_data txt;
-+    struct rr_txt_segment *next;
-+};
- struct rr_txt
- {
-     struct rr rr;
-     int count;
--    struct binary_data txt[1];
-+    struct rr_txt_segment *txt;
- };
- extern struct rr_methods txt_methods;
- 
--struct rr_tlsa
-+struct rr_tlsa_smimea
- {
-     struct rr rr;
-     uint8_t cert_usage;
-@@ -218,20 +229,21 @@
-     struct binary_data association_data;
- };
- extern struct rr_methods tlsa_methods;
-+extern struct rr_methods smimea_methods;
- 
- struct rr_ipseckey
- {
-     struct rr rr;
--	uint8_t precedence;
--	uint8_t gateway_type;
--	uint8_t algorithm;
--	union {
--		char           *gateway_none; /* gateway_type == 0 */
--		struct in_addr  gateway_ipv4; /* gateway_type == 1 */
--		struct in6_addr gateway_ipv6; /* gateway_type == 2 */
--		char           *gateway_name; /* gateway_type == 3 */
--	} gateway;
--	struct binary_data public_key;
-+    uint8_t precedence;
-+    uint8_t gateway_type;
-+    uint8_t algorithm;
-+    union {
-+        char           *gateway_none; /* gateway_type == 0 */
-+        struct in_addr  gateway_ipv4; /* gateway_type == 1 */
-+        struct in6_addr gateway_ipv6; /* gateway_type == 2 */
-+        char           *gateway_name; /* gateway_type == 3 */
-+    } gateway;
-+    struct binary_data public_key;
- };
- extern struct rr_methods ipseckey_methods;
- 
-@@ -270,20 +282,20 @@
- struct rr_naptr
- {
-     struct rr rr;
--	uint16_t order;
--	uint16_t preference;
--	struct binary_data flags;
--	struct binary_data services;
--	struct binary_data regexp;
--	char *replacement;
-+    uint16_t order;
-+    uint16_t preference;
-+    struct binary_data flags;
-+    struct binary_data services;
-+    struct binary_data regexp;
-+    char *replacement;
- };
- extern struct rr_methods naptr_methods;
- 
- struct rr_nsec
- {
--	struct rr rr;
--	char *next_domain;
--	struct binary_data type_bitmap;
-+    struct rr rr;
-+    char *next_domain;
-+    struct binary_data type_bitmap;
- };
- extern struct rr_methods nsec_methods;
- 
-@@ -291,208 +303,218 @@
- 
- struct rr_nsec3
- {
--	struct rr rr;
--	uint8_t hash_algorithm;
--	uint8_t flags;
--	uint16_t iterations;
--	struct binary_data salt;
--	struct binary_data next_hashed_owner;
--	struct binary_data type_bitmap;
--	struct binary_data this_hashed_name;
--	struct named_rr *corresponding_name;
--	struct rr_nsec3 *next_nsec3;
-+    struct rr rr;
-+    uint8_t hash_algorithm;
-+    uint8_t flags;
-+    uint16_t iterations;
-+    struct binary_data salt;
-+    struct binary_data next_hashed_owner;
-+    struct binary_data type_bitmap;
-+    struct binary_data this_hashed_name;
-+    struct named_rr *corresponding_name;
-+    struct rr_nsec3 *next_nsec3;
- };
- extern struct rr_methods nsec3_methods;
- 
- struct rr_nsec3param
- {
--	struct rr rr;
--	uint8_t hash_algorithm;
--	uint8_t flags;
--	uint16_t iterations;
--	struct binary_data salt;
-+    struct rr rr;
-+    uint8_t hash_algorithm;
-+    uint8_t flags;
-+    uint16_t iterations;
-+    struct binary_data salt;
- };
- extern struct rr_methods nsec3param_methods;
- extern struct rr *nsec3param;
- 
- struct rr_rrsig
- {
--	struct rr rr;
--	uint16_t type_covered;
--	int algorithm;
--	int labels;
--	int orig_ttl;
--	uint32_t sig_expiration;
--	uint32_t sig_inception;
--	uint16_t key_tag;
--	char *signer;
--	struct binary_data signature;
-+    struct rr rr;
-+    uint16_t type_covered;
-+    int algorithm;
-+    int labels;
-+    int orig_ttl;
-+    uint32_t sig_expiration;
-+    uint32_t sig_inception;
-+    uint16_t key_tag;
-+    char *signer;
-+    struct binary_data signature;
- };
- extern struct rr_methods rrsig_methods;
- 
- struct rr_srv
- {
--	struct rr rr;
--	uint16_t priority;
--	uint16_t weight;
--	uint16_t port;
--	char *target;
-+    struct rr rr;
-+    uint16_t priority;
-+    uint16_t weight;
-+    uint16_t port;
-+    char *target;
- };
- extern struct rr_methods srv_methods;
- 
- struct rr_cname
- {
--	struct rr rr;
--	char *cname;
-+    struct rr rr;
-+    char *cname;
- };
- extern struct rr_methods cname_methods;
- 
- struct rr_mb
- {
--	struct rr rr;
--	char *madname;
-+    struct rr rr;
-+    char *madname;
- };
- extern struct rr_methods mb_methods;
- 
- struct rr_mg
- {
--	struct rr rr;
--	char *mgmname;
-+    struct rr rr;
-+    char *mgmname;
- };
- extern struct rr_methods mg_methods;
- 
- struct rr_minfo
- {
--	struct rr rr;
--	char *rmailbx;
--	char *emailbx;
-+    struct rr rr;
-+    char *rmailbx;
-+    char *emailbx;
- };
- extern struct rr_methods minfo_methods;
- 
- struct rr_mr
- {
--	struct rr rr;
--	char *newname;
-+    struct rr rr;
-+    char *newname;
- };
- extern struct rr_methods mr_methods;
- 
- struct rr_dname
- {
--	struct rr rr;
--	char *target;
-+    struct rr rr;
-+    char *target;
- };
- extern struct rr_methods dname_methods;
- 
- struct rr_aaaa
- {
--	struct rr rr;
--	struct in6_addr address;
-+    struct rr rr;
-+    struct in6_addr address;
- };
- extern struct rr_methods aaaa_methods;
- 
- struct rr_mx
- {
--	struct rr rr;
--	int   preference;
--	char *exchange;
-+    struct rr rr;
-+    int   preference;
-+    char *exchange;
- };
- extern struct rr_methods mx_methods;
- 
- struct rr_rt
- {
--	struct rr rr;
--	int   preference;
--	char *intermediate_host;
-+    struct rr rr;
-+    int   preference;
-+    char *intermediate_host;
- };
- extern struct rr_methods rt_methods;
- 
- struct rr_afsdb
- {
--	struct rr rr;
--	int   subtype;
--	char *hostname;
-+    struct rr rr;
-+    int   subtype;
-+    char *hostname;
- };
- extern struct rr_methods afsdb_methods;
- 
- struct rr_x25
- {
--	struct rr rr;
-+    struct rr rr;
-     struct binary_data psdn_address;
- };
- extern struct rr_methods x25_methods;
- 
- struct rr_isdn
- {
--	struct rr rr;
-+    struct rr rr;
-     struct binary_data isdn_address;
-     struct binary_data sa;
--	int sa_present;
-+    int sa_present;
- };
- extern struct rr_methods isdn_methods;
- 
- struct rr_px
- {
--	struct rr rr;
--	int   preference;
--	char *map822;
--	char *mapx400;
-+    struct rr rr;
-+    int   preference;
-+    char *map822;
-+    char *mapx400;
- };
- extern struct rr_methods px_methods;
- 
- struct rr_kx
- {
--	struct rr rr;
--	int   preference;
--	char *exchanger;
-+    struct rr rr;
-+    int   preference;
-+    char *exchanger;
- };
- extern struct rr_methods kx_methods;
- 
- struct rr_dnskey
- {
--	struct rr rr;
--	uint16_t flags;
--	uint8_t protocol;
--	uint8_t algorithm;
--	struct binary_data pubkey;
--	/* calculated */
--	uint16_t key_tag;
--	int pkey_built;
--	void *pkey;
-+    struct rr rr;
-+    uint16_t flags;
-+    uint8_t protocol;
-+    uint8_t algorithm;
-+    struct binary_data pubkey;
-+    /* calculated */
-+    uint16_t key_tag;
-+    int pkey_built;
-+    void *pkey;
-+    /* extras */
-+    int key_type;
-+    struct rr_dnskey *next_key;
- };
- extern struct rr_methods dnskey_methods;
-+extern struct rr_methods cdnskey_methods;
-+
-+#define KEY_TYPE_UNUSED 0
-+#define KEY_TYPE_KSK    1
-+#define KEY_TYPE_ZSK    2
- 
- int dnskey_build_pkey(struct rr_dnskey *rr);
-+void dnskey_ksk_policy_check(void);
- 
- struct rr_ds
- {
--	struct rr rr;
--	uint16_t key_tag;
--	uint8_t algorithm;
--	uint8_t digest_type;
--	struct binary_data digest;
-+    struct rr rr;
-+    uint16_t key_tag;
-+    uint8_t algorithm;
-+    uint8_t digest_type;
-+    struct binary_data digest;
- };
- extern struct rr_methods ds_methods;
-+extern struct rr_methods cds_methods;
- 
- struct rr_dlv
- {
--	struct rr rr;
--	uint16_t key_tag;
--	uint8_t algorithm;
--	uint8_t digest_type;
--	struct binary_data digest;
-+    struct rr rr;
-+    uint16_t key_tag;
-+    uint8_t algorithm;
-+    uint8_t digest_type;
-+    struct binary_data digest;
- };
- extern struct rr_methods dlv_methods;
- 
- struct rr_nsap
- {
--	struct rr rr;
--	struct binary_data data;
-+    struct rr rr;
-+    struct binary_data data;
- };
- extern struct rr_methods nsap_methods;
- 
- struct rr_hinfo
- {
--	struct rr rr;
-+    struct rr rr;
-     struct binary_data cpu;
-     struct binary_data os;
- };
-@@ -500,7 +522,7 @@
- 
- struct rr_rp
- {
--	struct rr rr;
-+    struct rr rr;
-     char *mbox_dname;
-     char *txt_dname;
- };
-@@ -508,14 +530,14 @@
- 
- struct rr_loc
- {
--	struct rr rr;
--	uint8_t version;
--	uint8_t size;
--	uint8_t horiz_pre;
--	uint8_t vert_pre;
--	uint32_t latitude;
--	uint32_t longitude;
--	uint32_t altitude;
-+    struct rr rr;
-+    uint8_t version;
-+    uint8_t size;
-+    uint8_t horiz_pre;
-+    uint8_t vert_pre;
-+    uint32_t latitude;
-+    uint32_t longitude;
-+    uint32_t altitude;
- };
- extern struct rr_methods loc_methods;
- 
-@@ -530,15 +552,15 @@
- {
-     struct rr rr;
-     uint8_t algorithm;
--	uint8_t fp_type;
--	struct binary_data fingerprint;
-+    uint8_t fp_type;
-+    struct binary_data fingerprint;
- };
- extern struct rr_methods sshfp_methods;
- 
- struct rr_spf
- {
-     struct rr rr;
--	int count;
-+    int count;
-     struct binary_data spf[1];
- };
- extern struct rr_methods spf_methods;
-@@ -546,13 +568,22 @@
- struct rr_cert
- {
-     struct rr rr;
--	uint16_t type;
--	uint16_t key_tag;
--	int algorithm;
--	struct binary_data certificate;
-+    uint16_t type;
-+    uint16_t key_tag;
-+    int algorithm;
-+    struct binary_data certificate;
- };
- extern struct rr_methods cert_methods;
- 
-+struct rr_caa
-+{
-+    struct rr rr;
-+    uint8_t flags;
-+    struct binary_data tag;
-+    struct binary_data value;
-+};
-+extern struct rr_methods caa_methods;
-+
- extern struct rr_nsec3 *first_nsec3;
- extern struct rr_nsec3 *latest_nsec3;
- 
-diff -Naur validns-0.8/rrsig.c validns/rrsig.c
---- validns-0.8/rrsig.c	2020-10-05 16:57:07.219376944 -0400
-+++ validns/rrsig.c	2020-10-05 16:59:48.871860482 -0400
-@@ -16,6 +16,7 @@
- #include <arpa/inet.h>
- #include <openssl/evp.h>
- #include <openssl/err.h>
-+#include <openssl/ecdsa.h>
- 
- #include "common.h"
- #include "textparse.h"
-@@ -25,135 +26,154 @@
- 
- struct verification_data
- {
--	struct verification_data *next;
-+    struct verification_data *next;
-     EVP_MD_CTX *ctx;
--	struct rr_dnskey *key;
--	struct rr_rrsig *rr;
--	int ok;
--	unsigned long openssl_error;
-+    struct rr_dnskey *key;
-+    struct rr_rrsig *rr;
-+    int ok;
-+    unsigned long openssl_error;
- };
- 
- struct keys_to_verify
- {
--	struct keys_to_verify *next;
--	struct rr_rrsig *rr;
--	struct rr_set *signed_set;
--	int n_keys;
--	struct verification_data to_verify[1];
-+    struct keys_to_verify *next;
-+    struct rr_rrsig *rr;
-+    struct rr_set *signed_set;
-+    int n_keys;
-+    struct verification_data to_verify[1];
- };
- 
- static struct keys_to_verify *all_keys_to_verify = NULL;
- 
- static struct rr* rrsig_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_rrsig *rr = getmem(sizeof(*rr));
--	int type_covered, key_tag;
--	char *str_type_covered;
--	struct binary_data sig;
--	long long ts;
--
--	str_type_covered = extract_label(&s, "type covered", "temporary");
--	if (!str_type_covered) return NULL;
--	type_covered = str2rdtype(str_type_covered, NULL);
--	if (type_covered <= 0 || type_covered > 65535) return NULL;
--	rr->type_covered = type_covered;
--
--	rr->algorithm = extract_algorithm(&s, "algorithm");
--	if (rr->algorithm == ALG_UNSUPPORTED)	return NULL;
--	if (rr->algorithm == ALG_PRIVATEDNS || rr->algorithm == ALG_PRIVATEOID) {
--		return bitch("private algorithms are not supported in RRSIG");
--	}
--
--	rr->labels = extract_integer(&s, "labels");
--	if (rr->labels < 0)	return NULL;
--	/* TODO validate labels, see http://tools.ietf.org/html/rfc4034#section-3.1.3 */
--
--	rr->orig_ttl = extract_timevalue(&s, "original TTL");
--	if (rr->orig_ttl < 0) return NULL;
--
--	ts = extract_timestamp(&s, "signature expiration");
--	if (ts < 0) return NULL;
--	rr->sig_expiration = ts;
--
--	ts = extract_timestamp(&s, "signature inception");
--	if (ts < 0) return NULL;
--	rr->sig_inception = ts;
--
--	key_tag = extract_integer(&s, "key tag");
--	if (key_tag < 0)	return NULL;
--	rr->key_tag = key_tag;
--
--	rr->signer = extract_name(&s, "signer name", 0);
--	if (!rr->signer) return NULL;
--	/* TODO validate signer name, http://tools.ietf.org/html/rfc4034#section-3.1.7 */
--
--	sig = extract_base64_binary_data(&s, "signature");
--	if (sig.length < 0)	return NULL;
--	/* TODO validate signature length based on algorithm */
--	rr->signature = sig;
--
--	if (*s) {
--		return bitch("garbage after valid RRSIG data");
--	}
--	G.dnssec_active = 1;
--	return store_record(type, name, ttl, rr);
-+    struct rr_rrsig *rr = getmem(sizeof(*rr));
-+    int type_covered, key_tag;
-+    char *str_type_covered;
-+    struct binary_data sig;
-+    long long ts;
-+
-+    str_type_covered = extract_label(&s, "type covered", "temporary");
-+    if (!str_type_covered) return NULL;
-+    type_covered = str2rdtype(str_type_covered, NULL);
-+    if (type_covered <= 0 || type_covered > 65535) return NULL;
-+    rr->type_covered = type_covered;
-+
-+    rr->algorithm = extract_algorithm(&s, "algorithm");
-+    if (rr->algorithm == ALG_UNSUPPORTED)   return NULL;
-+    if (rr->algorithm == ALG_PRIVATEDNS || rr->algorithm == ALG_PRIVATEOID) {
-+        return bitch("private algorithms are not supported in RRSIG");
-+    }
-+
-+    rr->labels = extract_integer(&s, "labels", NULL);
-+    if (rr->labels < 0) return NULL;
-+    /* TODO validate labels, see http://tools.ietf.org/html/rfc4034#section-3.1.3 */
-+
-+    rr->orig_ttl = extract_timevalue(&s, "original TTL");
-+    if (rr->orig_ttl < 0) return NULL;
-+
-+    ts = extract_timestamp(&s, "signature expiration");
-+    if (ts < 0) return NULL;
-+    rr->sig_expiration = ts;
-+
-+    ts = extract_timestamp(&s, "signature inception");
-+    if (ts < 0) return NULL;
-+    rr->sig_inception = ts;
-+
-+    key_tag = extract_integer(&s, "key tag", NULL);
-+    if (key_tag < 0)    return NULL;
-+    rr->key_tag = key_tag;
-+
-+    rr->signer = extract_name(&s, "signer name", 0);
-+    if (!rr->signer) return NULL;
-+    /* TODO validate signer name, http://tools.ietf.org/html/rfc4034#section-3.1.7 */
-+
-+    sig = extract_base64_binary_data(&s, "signature");
-+    if (sig.length < 0) return NULL;
-+    /* TODO validate signature length based on algorithm */
-+    if (algorithm_type(rr->algorithm) == ALG_ECC_FAMILY) {
-+        /*
-+         * Transform ECDSA signatures from DNSSEC vanilla binary
-+         * representation (r || s) into OpenSSL ASN.1 DER format
-+         */
-+        ECDSA_SIG *ecdsa_sig = ECDSA_SIG_new();
-+	BIGNUM *r, *s;
-+        int l = sig.length / 2;
-+	r = BN_bin2bn((unsigned char *)sig.data, l, NULL);
-+	s = BN_bin2bn((unsigned char *)sig.data + l, l, NULL);
-+	if ((r == NULL) || (s == NULL))
-+            return NULL;
-+	ECDSA_SIG_set0(ecdsa_sig, r, s);
-+        sig.length = i2d_ECDSA_SIG(ecdsa_sig, NULL);
-+        sig.data = getmem(sig.length); /* reallocate larger mempool chunk */
-+        unsigned char *sig_ptr = (unsigned char *)sig.data;
-+        sig.length = i2d_ECDSA_SIG(ecdsa_sig, &sig_ptr);
-+        ECDSA_SIG_free(ecdsa_sig);
-+    }
-+    rr->signature = sig;
-+
-+    if (*s) {
-+        return bitch("garbage after valid RRSIG data");
-+    }
-+    G.dnssec_active = 1;
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* rrsig_human(struct rr *rrv)
- {
--	// RRCAST(rrsig);
-+    // RRCAST(rrsig);
-     // char s[1024];
- 
-     //snprintf(s, 1024, "SOA %s %s %d %d %d %d %d",
--	 //    rr->mname, rr->rname, rr->serial,
--	  //   rr->refresh, rr->retry, rr->expire, rr->minimum);
-+     //    rr->mname, rr->rname, rr->serial,
-+      //   rr->refresh, rr->retry, rr->expire, rr->minimum);
-     //return quickstrdup_temp(s);
--	return NULL;
-+    return NULL;
- }
- 
- static struct binary_data rrsig_wirerdata_ex(struct rr *rrv, int with_signature)
- {
--	RRCAST(rrsig);
--	struct binary_data bd;
-+    RRCAST(rrsig);
-+    struct binary_data bd;
- 
--	bd = compose_binary_data("2114442d", 1,
--		rr->type_covered, rr->algorithm, rr->labels,
--		rr->orig_ttl, rr->sig_expiration, rr->sig_inception,
--		rr->key_tag, name2wire_name(rr->signer));
--	if (with_signature) {
--		return compose_binary_data("dd", 1, bd, rr->signature);
--	}
--	return bd;
-+    bd = compose_binary_data("2114442d", 1,
-+        rr->type_covered, rr->algorithm, rr->labels,
-+        rr->orig_ttl, rr->sig_expiration, rr->sig_inception,
-+        rr->key_tag, name2wire_name(rr->signer));
-+    if (with_signature) {
-+        return compose_binary_data("dd", 1, bd, rr->signature);
-+    }
-+    return bd;
- }
- 
- static struct binary_data rrsig_wirerdata(struct rr *rrv)
- {
--	return rrsig_wirerdata_ex(rrv, 1);
-+    return rrsig_wirerdata_ex(rrv, 1);
- }
- 
- struct rr_with_wired
- {
--	struct rr *rr;
--	struct binary_data wired;
-+    struct rr *rr;
-+    struct binary_data wired;
- };
- 
- static int compare_rr_with_wired(const void *va, const void *vb)
- {
--	const struct rr_with_wired *a = va;
--	const struct rr_with_wired *b = vb;
--	int r;
--
--	if (a->wired.length == b->wired.length) {
--		return memcmp(a->wired.data, b->wired.data, a->wired.length);
--	} else if (a->wired.length < b->wired.length) {
--		r = memcmp(a->wired.data, b->wired.data, a->wired.length);
--		if (r != 0) return r;
--		return -1;
--	} else {
--		r = memcmp(a->wired.data, b->wired.data, b->wired.length);
--		if (r != 0) return r;
--		return 1;
--	}
-+    const struct rr_with_wired *a = va;
-+    const struct rr_with_wired *b = vb;
-+    int r;
-+
-+    if (a->wired.length == b->wired.length) {
-+        return memcmp(a->wired.data, b->wired.data, a->wired.length);
-+    } else if (a->wired.length < b->wired.length) {
-+        r = memcmp(a->wired.data, b->wired.data, a->wired.length);
-+        if (r != 0) return r;
-+        return -1;
-+    } else {
-+        r = memcmp(a->wired.data, b->wired.data, b->wired.length);
-+        if (r != 0) return r;
-+        return 1;
-+    }
- }
- 
- static struct verification_data *verification_queue = NULL;
-@@ -164,211 +184,219 @@
- 
- void *verification_thread(void *dummy)
- {
--	struct verification_data *d;
--	struct timespec sleep_time;
-+    struct verification_data *d;
-+    struct timespec sleep_time;
- 
--	while (1) {
--		if (pthread_mutex_lock(&queue_lock) != 0)
--			croak(1, "pthread_mutex_lock");
--		d = verification_queue;
--		if (d) {
--			verification_queue = d->next;
--			G.stats.signatures_verified++;
--		}
--		if (pthread_mutex_unlock(&queue_lock) != 0)
--			croak(1, "pthread_mutex_unlock");
--		if (d) {
--			int r;
--			d->next = NULL;
-+    while (1) {
-+        if (pthread_mutex_lock(&queue_lock) != 0)
-+            croak(1, "pthread_mutex_lock");
-+        d = verification_queue;
-+        if (d) {
-+            verification_queue = d->next;
-+            G.stats.signatures_verified++;
-+        }
-+        if (pthread_mutex_unlock(&queue_lock) != 0)
-+            croak(1, "pthread_mutex_unlock");
-+        if (d) {
-+            int r;
-+            d->next = NULL;
-             r = EVP_VerifyFinal(d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
--			if (r == 1) {
--				d->ok = 1;
--			} else {
--				d->openssl_error = ERR_peek_last_error();
--			}
--			if (pthread_mutex_lock(&queue_lock) != 0)
--				croak(1, "pthread_mutex_lock");
--			verification_queue_size--;
--			if (pthread_mutex_unlock(&queue_lock) != 0)
--				croak(1, "pthread_mutex_unlock");
--		} else {
--			sleep_time.tv_sec  = 0;
--			sleep_time.tv_nsec = 10000000;
--			nanosleep(&sleep_time, NULL);
--		}
--	}
-+            if (r == 1) {
-+                d->ok = 1;
-+            } else {
-+                d->openssl_error = ERR_peek_last_error();
-+            }
-+            if (pthread_mutex_lock(&queue_lock) != 0)
-+                croak(1, "pthread_mutex_lock");
-+            verification_queue_size--;
-+            if (pthread_mutex_unlock(&queue_lock) != 0)
-+                croak(1, "pthread_mutex_unlock");
-+        } else {
-+            sleep_time.tv_sec  = 0;
-+            sleep_time.tv_nsec = 10000000;
-+            nanosleep(&sleep_time, NULL);
-+        }
-+    }
- }
- 
- static void start_workers(void)
- {
--	int i;
-+    int i;
- 
--	if (workers_started)
--		return;
--	if (G.opt.verbose)
--		fprintf(stderr, "starting workers for signature verification\n");
--	workers = getmem(sizeof(*workers)*G.opt.n_threads);
--	for (i = 0; i < G.opt.n_threads; i++) {
--		if (pthread_create(&workers[i], NULL, verification_thread, NULL) != 0)
--			croak(1, "pthread_create");
--	}
--	workers_started = 1;
-+    if (workers_started)
-+        return;
-+    if (G.opt.verbose)
-+        fprintf(stderr, "starting workers for signature verification\n");
-+    workers = getmem(sizeof(*workers)*G.opt.n_threads);
-+    for (i = 0; i < G.opt.n_threads; i++) {
-+        if (pthread_create(&workers[i], NULL, verification_thread, NULL) != 0)
-+            croak(1, "pthread_create");
-+    }
-+    workers_started = 1;
- }
- 
- static void schedule_verification(struct verification_data *d)
- {
--	int cur_size;
--	if (G.opt.n_threads > 1) {
--		if (pthread_mutex_lock(&queue_lock) != 0)
--			croak(1, "pthread_mutex_lock");
--		d->next = verification_queue;
--		verification_queue = d;
--		verification_queue_size++;
--		cur_size = verification_queue_size;
--		if (pthread_mutex_unlock(&queue_lock) != 0)
--			croak(1, "pthread_mutex_unlock");
--		if (!workers_started && cur_size >= G.opt.n_threads)
--			start_workers();
--	} else {
--		int r;
--		G.stats.signatures_verified++;
-+    int cur_size;
-+    if (G.opt.n_threads > 1) {
-+        if (pthread_mutex_lock(&queue_lock) != 0)
-+            croak(1, "pthread_mutex_lock");
-+        d->next = verification_queue;
-+        verification_queue = d;
-+        verification_queue_size++;
-+        cur_size = verification_queue_size;
-+        if (pthread_mutex_unlock(&queue_lock) != 0)
-+            croak(1, "pthread_mutex_unlock");
-+        if (!workers_started && cur_size >= G.opt.n_threads)
-+            start_workers();
-+    } else {
-+        int r;
-+        G.stats.signatures_verified++;
-         r = EVP_VerifyFinal(d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
--		if (r == 1) {
--			d->ok = 1;
--		} else {
--			d->openssl_error = ERR_peek_last_error();
--		}
--	}
-+        if (r == 1) {
-+            d->ok = 1;
-+        } else {
-+            d->openssl_error = ERR_peek_last_error();
-+        }
-+    }
- }
- 
- static int verify_signature(struct verification_data *d, struct rr_set *signed_set)
- {
--	uint16_t b2;
--	uint32_t b4;
--	struct binary_data chunk;
--	struct rr_with_wired *set;
--	struct rr *signed_rr;
--	int i;
--
--	EVP_MD_CTX_init(&d->ctx);
--	switch (d->rr->algorithm) {
--	case ALG_DSA:
--	case ALG_RSASHA1:
--	case ALG_DSA_NSEC3_SHA1:
--	case ALG_RSASHA1_NSEC3_SHA1:
--		if (EVP_VerifyInit(&d->ctx, EVP_sha1()) != 1)
--			return 0;
--		break;
--	case ALG_RSASHA256:
--		if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1)
--			return 0;
--		break;
--	case ALG_RSASHA512:
--		if (EVP_VerifyInit(&d->ctx, EVP_sha512()) != 1)
--			return 0;
--		break;
--	default:
--		return 0;
--	}
--
--	chunk = rrsig_wirerdata_ex(&d->rr->rr, 0);
--	if (chunk.length < 0)
--		return 0;
-+    uint16_t b2;
-+    uint32_t b4;
-+    struct binary_data chunk;
-+    struct rr_with_wired *set;
-+    struct rr *signed_rr;
-+    int i;
-+
-+    d->ctx = EVP_MD_CTX_new();
-+    switch (d->rr->algorithm) {
-+    case ALG_DSA:
-+    case ALG_RSASHA1:
-+    case ALG_DSA_NSEC3_SHA1:
-+    case ALG_RSASHA1_NSEC3_SHA1:
-+        if (EVP_VerifyInit(d->ctx, EVP_sha1()) != 1)
-+            return 0;
-+        break;
-+    case ALG_RSASHA256:
-+        if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1)
-+            return 0;
-+        break;
-+    case ALG_RSASHA512:
-+        if (EVP_VerifyInit(d->ctx, EVP_sha512()) != 1)
-+            return 0;
-+        break;
-+    case ALG_ECDSAP256SHA256:
-+        if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1)
-+            return 0;
-+        break;
-+    case ALG_ECDSAP384SHA384:
-+        if (EVP_VerifyInit(d->ctx, EVP_sha384()) != 1)
-+            return 0;
-+        break;
-+    default:
-+        return 0;
-+    }
-+
-+    chunk = rrsig_wirerdata_ex(&d->rr->rr, 0);
-+    if (chunk.length < 0)
-+        return 0;
-     EVP_VerifyUpdate(d->ctx, chunk.data, chunk.length);
- 
--	set = getmem_temp(sizeof(*set) * signed_set->count);
-+    set = getmem_temp(sizeof(*set) * signed_set->count);
- 
--	signed_rr = signed_set->tail;
--	i = 0;
--	while (signed_rr) {
--		set[i].rr = signed_rr;
--		set[i].wired = call_get_wired(signed_rr);
--		if (set[i].wired.length < 0)
--			return 0;
--		i++;
--		signed_rr = signed_rr->next;
--	}
--	qsort(set, signed_set->count, sizeof(*set), compare_rr_with_wired);
--
--	for (i = 0; i < signed_set->count; i++) {
--		chunk = name2wire_name(signed_set->named_rr->name);
--		if (chunk.length < 0)
--			return 0;
-+    signed_rr = signed_set->tail;
-+    i = 0;
-+    while (signed_rr) {
-+        set[i].rr = signed_rr;
-+        set[i].wired = call_get_wired(signed_rr);
-+        if (set[i].wired.length < 0)
-+            return 0;
-+        i++;
-+        signed_rr = signed_rr->next;
-+    }
-+    qsort(set, signed_set->count, sizeof(*set), compare_rr_with_wired);
-+
-+    for (i = 0; i < signed_set->count; i++) {
-+        chunk = name2wire_name(signed_set->named_rr->name);
-+        if (chunk.length < 0)
-+            return 0;
-         EVP_VerifyUpdate(d->ctx, chunk.data, chunk.length);
-         b2 = htons(set[i].rr->rdtype);    EVP_VerifyUpdate(d->ctx, &b2, 2);
-         b2 = htons(1);  /* class IN */   EVP_VerifyUpdate(d->ctx, &b2, 2);
-         b4 = htonl(set[i].rr->ttl);       EVP_VerifyUpdate(d->ctx, &b4, 4);
-         b2 = htons(set[i].wired.length); EVP_VerifyUpdate(d->ctx, &b2, 2);
-         EVP_VerifyUpdate(d->ctx, set[i].wired.data, set[i].wired.length);
--	}
-+    }
- 
--	schedule_verification(d);
--	return 1;
-+    schedule_verification(d);
-+    return 1;
- }
- 
- static void *rrsig_validate(struct rr *rrv)
- {
--	RRCAST(rrsig);
--	struct named_rr *named_rr;
--	struct rr_set *signed_set;
--	struct rr_dnskey *key = NULL;
--	struct rr_set *dnskey_rr_set;
--	int candidate_keys = 0;
--	struct keys_to_verify *candidates;
--	int i = 0;
--	int t;
--
--	named_rr = rr->rr.rr_set->named_rr;
--	for (t = 0; t < G.opt.n_times_to_check; t++) {
--		if (G.opt.times_to_check[t] < rr->sig_inception) {
--			return moan(rr->rr.file_name, rr->rr.line, "%s signature is too new", named_rr->name);
--		}
--		if (G.opt.times_to_check[t] > rr->sig_expiration) {
--			return moan(rr->rr.file_name, rr->rr.line, "%s signature is too old", named_rr->name);
--		}
--	}
--	signed_set = find_rr_set_in_named_rr(named_rr, rr->type_covered);
--	if (!signed_set) {
--		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG exists for non-existing type %s", named_rr->name, rdtype2str(rr->type_covered));
--	}
--	if (signed_set->tail->ttl != rr->orig_ttl) {
--		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG's original TTL differs from corresponding record's", named_rr->name);
--	}
--	dnskey_rr_set = find_rr_set(T_DNSKEY, rr->signer);
--	if (!dnskey_rr_set) {
--		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find a signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer);
--	}
--	key = (struct rr_dnskey *)dnskey_rr_set->tail;
--	while (key) {
--		if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) {
--			candidate_keys++;
--			dnskey_build_pkey(key);
--		}
--		key = (struct rr_dnskey *)key->rr.next;
--	}
--	if (candidate_keys == 0)
--		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find the right signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer);
--
--	candidates = getmem(sizeof(struct keys_to_verify) + (candidate_keys-1) * sizeof(struct verification_data));
--	candidates->next = all_keys_to_verify;
--	candidates->rr = rr;
--	candidates->signed_set = signed_set;
--	candidates->n_keys = candidate_keys;
--	all_keys_to_verify = candidates;
--	key = (struct rr_dnskey *)dnskey_rr_set->tail;
--	while (key) {
--		if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) {
--			candidates->to_verify[i].key = key;
--			candidates->to_verify[i].rr = rr;
--			candidates->to_verify[i].ok = 0;
--			candidates->to_verify[i].openssl_error = 0;
--			candidates->to_verify[i].next = NULL;
--			i++;
--		}
--		key = (struct rr_dnskey *)key->rr.next;
--	}
-+    RRCAST(rrsig);
-+    struct named_rr *named_rr;
-+    struct rr_set *signed_set;
-+    struct rr_dnskey *key = NULL;
-+    struct rr_set *dnskey_rr_set;
-+    int candidate_keys = 0;
-+    struct keys_to_verify *candidates;
-+    int i = 0;
-+    int t;
-+
-+    named_rr = rr->rr.rr_set->named_rr;
-+    for (t = 0; t < G.opt.n_times_to_check; t++) {
-+        if (G.opt.times_to_check[t] < rr->sig_inception) {
-+            return moan(rr->rr.file_name, rr->rr.line, "%s signature is too new", named_rr->name);
-+        }
-+        if (G.opt.times_to_check[t] > rr->sig_expiration) {
-+            return moan(rr->rr.file_name, rr->rr.line, "%s signature is too old", named_rr->name);
-+        }
-+    }
-+    signed_set = find_rr_set_in_named_rr(named_rr, rr->type_covered);
-+    if (!signed_set) {
-+        return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG exists for non-existing type %s", named_rr->name, rdtype2str(rr->type_covered));
-+    }
-+    if (signed_set->tail->ttl != rr->orig_ttl) {
-+        return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG's original TTL differs from corresponding record's", named_rr->name);
-+    }
-+    dnskey_rr_set = find_rr_set(T_DNSKEY, rr->signer);
-+    if (!dnskey_rr_set) {
-+        return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find a signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer);
-+    }
-+    key = (struct rr_dnskey *)dnskey_rr_set->tail;
-+    while (key) {
-+        if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) {
-+            candidate_keys++;
-+            dnskey_build_pkey(key);
-+        }
-+        key = (struct rr_dnskey *)key->rr.next;
-+    }
-+    if (candidate_keys == 0)
-+        return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find the right signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer);
-+
-+    candidates = getmem(sizeof(struct keys_to_verify) + (candidate_keys-1) * sizeof(struct verification_data));
-+    candidates->next = all_keys_to_verify;
-+    candidates->rr = rr;
-+    candidates->signed_set = signed_set;
-+    candidates->n_keys = candidate_keys;
-+    all_keys_to_verify = candidates;
-+    key = (struct rr_dnskey *)dnskey_rr_set->tail;
-+    while (key) {
-+        if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) {
-+            candidates->to_verify[i].key = key;
-+            candidates->to_verify[i].rr = rr;
-+            candidates->to_verify[i].ok = 0;
-+            candidates->to_verify[i].openssl_error = 0;
-+            candidates->to_verify[i].next = NULL;
-+            i++;
-+        }
-+        key = (struct rr_dnskey *)key->rr.next;
-+    }
- 
--	return rr;
-+    return rr;
- }
- 
- static pthread_mutex_t *lock_cs;
-@@ -376,81 +404,87 @@
- 
- unsigned long pthreads_thread_id(void)
- {
--	unsigned long ret;
-+    unsigned long ret;
- 
--	ret=(unsigned long)pthread_self();
--	return(ret);
-+    ret=(unsigned long)pthread_self();
-+    return(ret);
- }
- 
- void pthreads_locking_callback(int mode, int type, char *file, int line)
- {
--	if (mode & CRYPTO_LOCK) {
--		pthread_mutex_lock(&(lock_cs[type]));
--		lock_count[type]++;
--	} else {
--		pthread_mutex_unlock(&(lock_cs[type]));
--	}
-+    if (mode & CRYPTO_LOCK) {
-+        pthread_mutex_lock(&(lock_cs[type]));
-+        lock_count[type]++;
-+    } else {
-+        pthread_mutex_unlock(&(lock_cs[type]));
-+    }
- }
- 
- void verify_all_keys(void)
- {
--	struct keys_to_verify *k = all_keys_to_verify;
--	int i;
--	struct timespec sleep_time;
--
--	ERR_load_crypto_strings();
--	if (G.opt.n_threads > 1) {
--		lock_cs = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
--		lock_count = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long));
--		for (i = 0; i < CRYPTO_num_locks(); i++) {
--			lock_count[i] = 0;
--			pthread_mutex_init(&lock_cs[i],NULL);
--		}
--
--		CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id);
--		CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback);
--
--		if (pthread_mutex_init(&queue_lock, NULL) != 0)
--			croak(1, "pthread_mutex_init");
--	}
--
--	while (k) {
--		freeall_temp();
--		for (i = 0; i < k->n_keys; i++) {
--			if (dnskey_build_pkey(k->to_verify[i].key))
--				verify_signature(&k->to_verify[i], k->signed_set);
--		}
--		k = k->next;
--	}
--	start_workers(); /* this is needed in case n_threads is greater than the number of signatures to verify */
--	while (verification_queue_size > 0) {
--		sleep_time.tv_sec  = 0;
--		sleep_time.tv_nsec = 10000000;
--		nanosleep(&sleep_time, NULL);
--	}
--	k = all_keys_to_verify;
--	while (k) {
--		int ok = 0;
--		unsigned long e = 0;
--		for (i = 0; i < k->n_keys; i++) {
--			if (k->to_verify[i].ok) {
--				ok = 1;
--				break;
--			} else {
--				if (k->to_verify[i].openssl_error != 0)
--					e = k->to_verify[i].openssl_error;
--			}
-+    struct keys_to_verify *k = all_keys_to_verify;
-+    int i;
-+    struct timespec sleep_time;
-+
-+    ERR_load_crypto_strings();
-+    if (G.opt.n_threads > 1) {
-+        lock_cs = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
-+        lock_count = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long));
-+        for (i = 0; i < CRYPTO_num_locks(); i++) {
-+            lock_count[i] = 0;
-+            pthread_mutex_init(&lock_cs[i],NULL);
-+        }
-+
-+        CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id);
-+        CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback);
-+
-+        if (pthread_mutex_init(&queue_lock, NULL) != 0)
-+            croak(1, "pthread_mutex_init");
-+    }
-+
-+    while (k) {
-+        freeall_temp();
-+        for (i = 0; i < k->n_keys; i++) {
-+            if (dnskey_build_pkey(k->to_verify[i].key))
-+                verify_signature(&k->to_verify[i], k->signed_set);
-+        }
-+        k = k->next;
-+    }
-+    start_workers(); /* this is needed in case n_threads is greater than the number of signatures to verify */
-+    while (verification_queue_size > 0) {
-+        sleep_time.tv_sec  = 0;
-+        sleep_time.tv_nsec = 10000000;
-+        nanosleep(&sleep_time, NULL);
-+    }
-+    k = all_keys_to_verify;
-+    while (k) {
-+        int ok = 0;
-+        unsigned long e = 0;
-+        for (i = 0; i < k->n_keys; i++) {
-+            if (k->to_verify[i].ok) {
-+                if (k->to_verify[i].rr->rr.rr_set->named_rr->flags & NAME_FLAG_APEX) {
-+                    if (k->to_verify[i].key->key_type == KEY_TYPE_UNUSED)
-+                        k->to_verify[i].key->key_type = KEY_TYPE_KSK;
-+                } else {
-+                    k->to_verify[i].key->key_type = KEY_TYPE_ZSK;
-+                }
-+                ok = 1;
-+                break;
-+            } else {
-+                if (k->to_verify[i].openssl_error != 0)
-+                    e = k->to_verify[i].openssl_error;
-+            }
-             EVP_MD_CTX_free(k->to_verify[i].ctx);
--		}
--		if (!ok) {
--			struct named_rr *named_rr;
--			named_rr = k->rr->rr.rr_set->named_rr;
--			moan(k->rr->rr.file_name, k->rr->rr.line, "%s RRSIG(%s): %s",
--				 named_rr->name, rdtype2str(k->rr->type_covered),
--				 e ? ERR_reason_error_string(e) : "cannot verify signature, reason unknown");
--		}
--		k = k->next;
--	}
-+        }
-+        if (!ok) {
-+            struct named_rr *named_rr;
-+            named_rr = k->rr->rr.rr_set->named_rr;
-+            moan(k->rr->rr.file_name, k->rr->rr.line, "%s RRSIG(%s): %s",
-+                 named_rr->name, rdtype2str(k->rr->type_covered),
-+                 e ? ERR_reason_error_string(e) : "cannot verify signature, reason unknown");
-+        }
-+        k = k->next;
-+    }
- }
- 
- struct rr_methods rrsig_methods = { rrsig_parse, rrsig_human, rrsig_wirerdata, NULL, rrsig_validate };
-diff -Naur validns-0.8/rrsig.c.orig validns/rrsig.c.orig
---- validns-0.8/rrsig.c.orig	2014-02-11 15:45:39.000000000 -0500
-+++ validns/rrsig.c.orig	1969-12-31 19:00:00.000000000 -0500
-@@ -1,455 +0,0 @@
--/*
-- * Part of DNS zone file validator `validns`.
-- *
-- * Copyright 2011-2014 Anton Berezin <tobez@tobez.org>
-- * Modified BSD license.
-- * (See LICENSE file in the distribution.)
-- *
-- */
--#include <sys/types.h>
--#include <string.h>
--#include <stdlib.h>
--#include <stdio.h>
--#include <time.h>
--#include <pthread.h>
--#include <netinet/in.h>
--#include <arpa/inet.h>
--#include <openssl/evp.h>
--#include <openssl/err.h>
--
--#include "common.h"
--#include "textparse.h"
--#include "mempool.h"
--#include "carp.h"
--#include "rr.h"
--
--struct verification_data
--{
--	struct verification_data *next;
--	EVP_MD_CTX ctx;
--	struct rr_dnskey *key;
--	struct rr_rrsig *rr;
--	int ok;
--	unsigned long openssl_error;
--};
--
--struct keys_to_verify
--{
--	struct keys_to_verify *next;
--	struct rr_rrsig *rr;
--	struct rr_set *signed_set;
--	int n_keys;
--	struct verification_data to_verify[1];
--};
--
--static struct keys_to_verify *all_keys_to_verify = NULL;
--
--static struct rr* rrsig_parse(char *name, long ttl, int type, char *s)
--{
--	struct rr_rrsig *rr = getmem(sizeof(*rr));
--	int type_covered, key_tag;
--	char *str_type_covered;
--	struct binary_data sig;
--	long long ts;
--
--	str_type_covered = extract_label(&s, "type covered", "temporary");
--	if (!str_type_covered) return NULL;
--	type_covered = str2rdtype(str_type_covered, NULL);
--	if (type_covered <= 0 || type_covered > 65535) return NULL;
--	rr->type_covered = type_covered;
--
--	rr->algorithm = extract_algorithm(&s, "algorithm");
--	if (rr->algorithm == ALG_UNSUPPORTED)	return NULL;
--	if (rr->algorithm == ALG_PRIVATEDNS || rr->algorithm == ALG_PRIVATEOID) {
--		return bitch("private algorithms are not supported in RRSIG");
--	}
--
--	rr->labels = extract_integer(&s, "labels");
--	if (rr->labels < 0)	return NULL;
--	/* TODO validate labels, see http://tools.ietf.org/html/rfc4034#section-3.1.3 */
--
--	rr->orig_ttl = extract_timevalue(&s, "original TTL");
--	if (rr->orig_ttl < 0) return NULL;
--
--	ts = extract_timestamp(&s, "signature expiration");
--	if (ts < 0) return NULL;
--	rr->sig_expiration = ts;
--
--	ts = extract_timestamp(&s, "signature inception");
--	if (ts < 0) return NULL;
--	rr->sig_inception = ts;
--
--	key_tag = extract_integer(&s, "key tag");
--	if (key_tag < 0)	return NULL;
--	rr->key_tag = key_tag;
--
--	rr->signer = extract_name(&s, "signer name", 0);
--	if (!rr->signer) return NULL;
--	/* TODO validate signer name, http://tools.ietf.org/html/rfc4034#section-3.1.7 */
--
--	sig = extract_base64_binary_data(&s, "signature");
--	if (sig.length < 0)	return NULL;
--	/* TODO validate signature length based on algorithm */
--	rr->signature = sig;
--
--	if (*s) {
--		return bitch("garbage after valid RRSIG data");
--	}
--	G.dnssec_active = 1;
--	return store_record(type, name, ttl, rr);
--}
--
--static char* rrsig_human(struct rr *rrv)
--{
--	// RRCAST(rrsig);
--    // char s[1024];
--
--    //snprintf(s, 1024, "SOA %s %s %d %d %d %d %d",
--	 //    rr->mname, rr->rname, rr->serial,
--	  //   rr->refresh, rr->retry, rr->expire, rr->minimum);
--    //return quickstrdup_temp(s);
--	return NULL;
--}
--
--static struct binary_data rrsig_wirerdata_ex(struct rr *rrv, int with_signature)
--{
--	RRCAST(rrsig);
--	struct binary_data bd;
--
--	bd = compose_binary_data("2114442d", 1,
--		rr->type_covered, rr->algorithm, rr->labels,
--		rr->orig_ttl, rr->sig_expiration, rr->sig_inception,
--		rr->key_tag, name2wire_name(rr->signer));
--	if (with_signature) {
--		return compose_binary_data("dd", 1, bd, rr->signature);
--	}
--	return bd;
--}
--
--static struct binary_data rrsig_wirerdata(struct rr *rrv)
--{
--	return rrsig_wirerdata_ex(rrv, 1);
--}
--
--struct rr_with_wired
--{
--	struct rr *rr;
--	struct binary_data wired;
--};
--
--static int compare_rr_with_wired(const void *va, const void *vb)
--{
--	const struct rr_with_wired *a = va;
--	const struct rr_with_wired *b = vb;
--	int r;
--
--	if (a->wired.length == b->wired.length) {
--		return memcmp(a->wired.data, b->wired.data, a->wired.length);
--	} else if (a->wired.length < b->wired.length) {
--		r = memcmp(a->wired.data, b->wired.data, a->wired.length);
--		if (r != 0) return r;
--		return -1;
--	} else {
--		r = memcmp(a->wired.data, b->wired.data, b->wired.length);
--		if (r != 0) return r;
--		return 1;
--	}
--}
--
--static struct verification_data *verification_queue = NULL;
--static int verification_queue_size = 0;
--static pthread_mutex_t queue_lock;
--static int workers_started = 0;
--static pthread_t *workers;
--
--void *verification_thread(void *dummy)
--{
--	struct verification_data *d;
--	struct timespec sleep_time;
--
--	while (1) {
--		if (pthread_mutex_lock(&queue_lock) != 0)
--			croak(1, "pthread_mutex_lock");
--		d = verification_queue;
--		if (d) {
--			verification_queue = d->next;
--			G.stats.signatures_verified++;
--		}
--		if (pthread_mutex_unlock(&queue_lock) != 0)
--			croak(1, "pthread_mutex_unlock");
--		if (d) {
--			int r;
--			d->next = NULL;
--			r = EVP_VerifyFinal(&d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
--			if (r == 1) {
--				d->ok = 1;
--			} else {
--				d->openssl_error = ERR_peek_last_error();
--			}
--			if (pthread_mutex_lock(&queue_lock) != 0)
--				croak(1, "pthread_mutex_lock");
--			verification_queue_size--;
--			if (pthread_mutex_unlock(&queue_lock) != 0)
--				croak(1, "pthread_mutex_unlock");
--		} else {
--			sleep_time.tv_sec  = 0;
--			sleep_time.tv_nsec = 10000000;
--			nanosleep(&sleep_time, NULL);
--		}
--	}
--}
--
--static void start_workers(void)
--{
--	int i;
--
--	if (workers_started)
--		return;
--	if (G.opt.verbose)
--		fprintf(stderr, "starting workers for signature verification\n");
--	workers = getmem(sizeof(*workers)*G.opt.n_threads);
--	for (i = 0; i < G.opt.n_threads; i++) {
--		if (pthread_create(&workers[i], NULL, verification_thread, NULL) != 0)
--			croak(1, "pthread_create");
--	}
--	workers_started = 1;
--}
--
--static void schedule_verification(struct verification_data *d)
--{
--	int cur_size;
--	if (G.opt.n_threads > 1) {
--		if (pthread_mutex_lock(&queue_lock) != 0)
--			croak(1, "pthread_mutex_lock");
--		d->next = verification_queue;
--		verification_queue = d;
--		verification_queue_size++;
--		cur_size = verification_queue_size;
--		if (pthread_mutex_unlock(&queue_lock) != 0)
--			croak(1, "pthread_mutex_unlock");
--		if (!workers_started && cur_size >= G.opt.n_threads)
--			start_workers();
--	} else {
--		int r;
--		G.stats.signatures_verified++;
--		r = EVP_VerifyFinal(&d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
--		if (r == 1) {
--			d->ok = 1;
--		} else {
--			d->openssl_error = ERR_peek_last_error();
--		}
--	}
--}
--
--static int verify_signature(struct verification_data *d, struct rr_set *signed_set)
--{
--	uint16_t b2;
--	uint32_t b4;
--	struct binary_data chunk;
--	struct rr_with_wired *set;
--	struct rr *signed_rr;
--	int i;
--
--	EVP_MD_CTX_init(&d->ctx);
--	switch (d->rr->algorithm) {
--	case ALG_DSA:
--	case ALG_RSASHA1:
--	case ALG_DSA_NSEC3_SHA1:
--	case ALG_RSASHA1_NSEC3_SHA1:
--		if (EVP_VerifyInit(&d->ctx, EVP_sha1()) != 1)
--			return 0;
--		break;
--	case ALG_RSASHA256:
--		if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1)
--			return 0;
--		break;
--	case ALG_RSASHA512:
--		if (EVP_VerifyInit(&d->ctx, EVP_sha512()) != 1)
--			return 0;
--		break;
--	default:
--		return 0;
--	}
--
--	chunk = rrsig_wirerdata_ex(&d->rr->rr, 0);
--	if (chunk.length < 0)
--		return 0;
--	EVP_VerifyUpdate(&d->ctx, chunk.data, chunk.length);
--
--	set = getmem_temp(sizeof(*set) * signed_set->count);
--
--	signed_rr = signed_set->tail;
--	i = 0;
--	while (signed_rr) {
--		set[i].rr = signed_rr;
--		set[i].wired = call_get_wired(signed_rr);
--		if (set[i].wired.length < 0)
--			return 0;
--		i++;
--		signed_rr = signed_rr->next;
--	}
--	qsort(set, signed_set->count, sizeof(*set), compare_rr_with_wired);
--
--	for (i = 0; i < signed_set->count; i++) {
--		chunk = name2wire_name(signed_set->named_rr->name);
--		if (chunk.length < 0)
--			return 0;
--		EVP_VerifyUpdate(&d->ctx, chunk.data, chunk.length);
--		b2 = htons(set[i].rr->rdtype);    EVP_VerifyUpdate(&d->ctx, &b2, 2);
--		b2 = htons(1);  /* class IN */   EVP_VerifyUpdate(&d->ctx, &b2, 2);
--		b4 = htonl(set[i].rr->ttl);       EVP_VerifyUpdate(&d->ctx, &b4, 4);
--		b2 = htons(set[i].wired.length); EVP_VerifyUpdate(&d->ctx, &b2, 2);
--		EVP_VerifyUpdate(&d->ctx, set[i].wired.data, set[i].wired.length);
--	}
--
--	schedule_verification(d);
--	return 1;
--}
--
--static void *rrsig_validate(struct rr *rrv)
--{
--	RRCAST(rrsig);
--	struct named_rr *named_rr;
--	struct rr_set *signed_set;
--	struct rr_dnskey *key = NULL;
--	struct rr_set *dnskey_rr_set;
--	int candidate_keys = 0;
--	struct keys_to_verify *candidates;
--	int i = 0;
--	int t;
--
--	named_rr = rr->rr.rr_set->named_rr;
--	for (t = 0; t < G.opt.n_times_to_check; t++) {
--		if (G.opt.times_to_check[t] < rr->sig_inception) {
--			return moan(rr->rr.file_name, rr->rr.line, "%s signature is too new", named_rr->name);
--		}
--		if (G.opt.times_to_check[t] > rr->sig_expiration) {
--			return moan(rr->rr.file_name, rr->rr.line, "%s signature is too old", named_rr->name);
--		}
--	}
--	signed_set = find_rr_set_in_named_rr(named_rr, rr->type_covered);
--	if (!signed_set) {
--		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG exists for non-existing type %s", named_rr->name, rdtype2str(rr->type_covered));
--	}
--	if (signed_set->tail->ttl != rr->orig_ttl) {
--		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG's original TTL differs from corresponding record's", named_rr->name);
--	}
--	dnskey_rr_set = find_rr_set(T_DNSKEY, rr->signer);
--	if (!dnskey_rr_set) {
--		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find a signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer);
--	}
--	key = (struct rr_dnskey *)dnskey_rr_set->tail;
--	while (key) {
--		if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) {
--			candidate_keys++;
--			dnskey_build_pkey(key);
--		}
--		key = (struct rr_dnskey *)key->rr.next;
--	}
--	if (candidate_keys == 0)
--		return moan(rr->rr.file_name, rr->rr.line, "%s RRSIG(%s): cannot find the right signer key (%s)", named_rr->name, rdtype2str(rr->type_covered), rr->signer);
--
--	candidates = getmem(sizeof(struct keys_to_verify) + (candidate_keys-1) * sizeof(struct verification_data));
--	candidates->next = all_keys_to_verify;
--	candidates->rr = rr;
--	candidates->signed_set = signed_set;
--	candidates->n_keys = candidate_keys;
--	all_keys_to_verify = candidates;
--	key = (struct rr_dnskey *)dnskey_rr_set->tail;
--	while (key) {
--		if (key->algorithm == rr->algorithm && key->key_tag == rr->key_tag) {
--			candidates->to_verify[i].key = key;
--			candidates->to_verify[i].rr = rr;
--			candidates->to_verify[i].ok = 0;
--			candidates->to_verify[i].openssl_error = 0;
--			candidates->to_verify[i].next = NULL;
--			i++;
--		}
--		key = (struct rr_dnskey *)key->rr.next;
--	}
--
--	return rr;
--}
--
--static pthread_mutex_t *lock_cs;
--static long *lock_count;
--
--static unsigned long pthreads_thread_id(void)
--{
--	unsigned long ret;
--
--	ret=(unsigned long)pthread_self();
--	return(ret);
--}
--
--static void pthreads_locking_callback(int mode, int type, char *file, int line)
--{
--	if (mode & CRYPTO_LOCK) {
--		pthread_mutex_lock(&(lock_cs[type]));
--		lock_count[type]++;
--	} else {
--		pthread_mutex_unlock(&(lock_cs[type]));
--	}
--}
--
--void verify_all_keys(void)
--{
--	struct keys_to_verify *k = all_keys_to_verify;
--	int i;
--	struct timespec sleep_time;
--
--	ERR_load_crypto_strings();
--	if (G.opt.n_threads > 1) {
--		lock_cs = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
--		lock_count = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long));
--		for (i = 0; i < CRYPTO_num_locks(); i++) {
--			lock_count[i] = 0;
--			pthread_mutex_init(&lock_cs[i],NULL);
--		}
--
--		CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id);
--		CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback);
--
--		if (pthread_mutex_init(&queue_lock, NULL) != 0)
--			croak(1, "pthread_mutex_init");
--	}
--
--	while (k) {
--		freeall_temp();
--		for (i = 0; i < k->n_keys; i++) {
--			if (dnskey_build_pkey(k->to_verify[i].key))
--				verify_signature(&k->to_verify[i], k->signed_set);
--		}
--		k = k->next;
--	}
--	start_workers(); /* this is needed in case n_threads is greater than the number of signatures to verify */
--	while (verification_queue_size > 0) {
--		sleep_time.tv_sec  = 0;
--		sleep_time.tv_nsec = 10000000;
--		nanosleep(&sleep_time, NULL);
--	}
--	k = all_keys_to_verify;
--	while (k) {
--		int ok = 0;
--		unsigned long e = 0;
--		for (i = 0; i < k->n_keys; i++) {
--			if (k->to_verify[i].ok) {
--				ok = 1;
--				break;
--			} else {
--				if (k->to_verify[i].openssl_error != 0)
--					e = k->to_verify[i].openssl_error;
--			}
--		}
--		if (!ok) {
--			struct named_rr *named_rr;
--			named_rr = k->rr->rr.rr_set->named_rr;
--			moan(k->rr->rr.file_name, k->rr->rr.line, "%s RRSIG(%s): %s",
--				 named_rr->name, rdtype2str(k->rr->type_covered),
--				 e ? ERR_reason_error_string(e) : "cannot verify signature, reason unknown");
--		}
--		k = k->next;
--	}
--}
--
--struct rr_methods rrsig_methods = { rrsig_parse, rrsig_human, rrsig_wirerdata, NULL, rrsig_validate };
-diff -Naur validns-0.8/rrsig.c.rej validns/rrsig.c.rej
---- validns-0.8/rrsig.c.rej	2020-10-05 16:57:07.219376944 -0400
-+++ validns/rrsig.c.rej	1969-12-31 19:00:00.000000000 -0500
-@@ -1,54 +0,0 @@
----- rrsig.c
--+++ rrsig.c
--@@ -97,10 +97,13 @@ static struct rr* rrsig_parse(char *name, long ttl, int type, char *s)
--          * representation (r || s) into OpenSSL ASN.1 DER format
--          */
--         ECDSA_SIG *ecdsa_sig = ECDSA_SIG_new();
--+	BIGNUM *r, *s;
--         int l = sig.length / 2;
---        if ((BN_bin2bn((unsigned char *)sig.data, l, ecdsa_sig->r) == NULL) ||
---            (BN_bin2bn(((unsigned char *)sig.data) + l, l, ecdsa_sig->s) == NULL))
--+	r = BN_bin2bn((unsigned char *)sig.data, l, NULL);
--+	s = BN_bin2bn((unsigned char *)sig.data + l, l, NULL);
--+	if ((r == NULL) || (s == NULL))
--             return NULL;
--+	ECDSA_SIG_set0(ecdsa_sig, r, s);
--         sig.length = i2d_ECDSA_SIG(ecdsa_sig, NULL);
--         sig.data = getmem(sig.length); /* reallocate larger mempool chunk */
--         unsigned char *sig_ptr = (unsigned char *)sig.data;
--@@ -267,29 +270,29 @@ static int verify_signature(struct verification_data *d, struct rr_set *signed_s
--     struct rr *signed_rr;
--     int i;
-- 
---    EVP_MD_CTX_init(&d->ctx);
--+    d->ctx = EVP_MD_CTX_new();
--     switch (d->rr->algorithm) {
--     case ALG_DSA:
--     case ALG_RSASHA1:
--     case ALG_DSA_NSEC3_SHA1:
--     case ALG_RSASHA1_NSEC3_SHA1:
---        if (EVP_VerifyInit(&d->ctx, EVP_sha1()) != 1)
--+        if (EVP_VerifyInit(d->ctx, EVP_sha1()) != 1)
--             return 0;
--         break;
--     case ALG_RSASHA256:
---        if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1)
--+        if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1)
--             return 0;
--         break;
--     case ALG_RSASHA512:
---        if (EVP_VerifyInit(&d->ctx, EVP_sha512()) != 1)
--+        if (EVP_VerifyInit(d->ctx, EVP_sha512()) != 1)
--             return 0;
--         break;
--     case ALG_ECDSAP256SHA256:
---        if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1)
--+        if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1)
--             return 0;
--         break;
--     case ALG_ECDSAP384SHA384:
---        if (EVP_VerifyInit(&d->ctx, EVP_sha384()) != 1)
--+        if (EVP_VerifyInit(d->ctx, EVP_sha384()) != 1)
--             return 0;
--         break;
--     default:
-diff -Naur validns-0.8/rt.c validns/rt.c
---- validns-0.8/rt.c	2014-02-11 15:46:53.000000000 -0500
-+++ validns/rt.c	2020-10-05 16:59:29.356681378 -0400
-@@ -19,38 +19,38 @@
- 
- static struct rr *rt_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_rt *rr = getmem(sizeof(*rr));
-+    struct rr_rt *rr = getmem(sizeof(*rr));
- 
--	rr->preference = extract_integer(&s, "RT preference");
--	if (rr->preference < 0)
--		return NULL;
--
--	rr->intermediate_host = extract_name(&s, "intermediate-host", 0);
--	if (!rr->intermediate_host)
--		return NULL;
--	if (*s) {
--		return bitch("garbage after valid RT data");
--	}
-+    rr->preference = extract_integer(&s, "RT preference", NULL);
-+    if (rr->preference < 0)
-+        return NULL;
-+
-+    rr->intermediate_host = extract_name(&s, "intermediate-host", 0);
-+    if (!rr->intermediate_host)
-+        return NULL;
-+    if (*s) {
-+        return bitch("garbage after valid RT data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* rt_human(struct rr *rrv)
- {
--	RRCAST(rt);
-+    RRCAST(rt);
-     char s[1024];
- 
-     snprintf(s, 1024, "%d %s",
--	     rr->preference, rr->intermediate_host);
-+         rr->preference, rr->intermediate_host);
-     return quickstrdup_temp(s);
- }
- 
- static struct binary_data rt_wirerdata(struct rr *rrv)
- {
--	RRCAST(rt);
-+    RRCAST(rt);
- 
-     return compose_binary_data("2d", 1,
--		rr->preference, name2wire_name(rr->intermediate_host));
-+        rr->preference, name2wire_name(rr->intermediate_host));
- }
- 
- struct rr_methods rt_methods = { rt_parse, rt_human, rt_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/soa.c validns/soa.c
---- validns-0.8/soa.c	2014-02-11 15:45:26.000000000 -0500
-+++ validns/soa.c	2020-10-05 16:59:29.356681378 -0400
-@@ -20,61 +20,64 @@
- 
- static struct rr* soa_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_soa *rr = getmem(sizeof(*rr));
--	long long i;
-+    struct rr_soa *rr = getmem(sizeof(*rr));
-+    long long i;
- 
--	rr->mname = extract_name(&s, "mname", 0);
--	if (!rr->mname) return NULL;
--	rr->rname = extract_name(&s, "rname", 0);
--	if (!rr->rname) return NULL;
--	i = extract_integer(&s, "serial");
--	if (i < 0) return NULL;
--	if (i > 4294967295UL) return bitch("serial is out of range");
--	rr->serial = i;
--	rr->refresh = extract_timevalue(&s, "refresh");
--	if (rr->refresh < 0) return NULL;
--	rr->retry = extract_timevalue(&s, "retry");
--	if (rr->retry < 0) return NULL;
--	rr->expire = extract_timevalue(&s, "expire");
--	if (rr->expire < 0) return NULL;
--	rr->minimum = extract_timevalue(&s, "minimum");
--	if (rr->minimum < 0) return NULL;
--	if (*s) {
--		return bitch("garbage after valid SOA data");
--	}
--	return store_record(type, name, ttl, rr);
-+    rr->mname = extract_name(&s, "mname", 0);
-+    if (!rr->mname) return NULL;
-+    rr->rname = extract_name(&s, "rname", 0);
-+    if (!rr->rname) return NULL;
-+    i = extract_integer(&s, "serial", NULL);
-+    if (i < 0) return NULL;
-+    if (i > 4294967295UL) return bitch("serial is out of range");
-+    rr->serial = i;
-+    rr->refresh = extract_timevalue(&s, "refresh");
-+    if (rr->refresh < 0) return NULL;
-+    rr->retry = extract_timevalue(&s, "retry");
-+    if (rr->retry < 0) return NULL;
-+    rr->expire = extract_timevalue(&s, "expire");
-+    if (rr->expire < 0) return NULL;
-+    rr->minimum = extract_timevalue(&s, "minimum");
-+    if (rr->minimum < 0) return NULL;
-+    if (ttl < 0 && G.opt.soa_minttl_as_default_ttl) {
-+        ttl = rr->minimum;
-+    }
-+    if (*s) {
-+        return bitch("garbage after valid SOA data");
-+    }
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* soa_human(struct rr *rrv)
- {
--	RRCAST(soa);
-+    RRCAST(soa);
-     char s[1024];
- 
-     snprintf(s, 1024, "%s %s %u %d %d %d %d",
--	     rr->mname, rr->rname, rr->serial,
--	     rr->refresh, rr->retry, rr->expire, rr->minimum);
-+         rr->mname, rr->rname, rr->serial,
-+         rr->refresh, rr->retry, rr->expire, rr->minimum);
-     return quickstrdup_temp(s);
- }
- 
- static struct binary_data soa_wirerdata(struct rr *rrv)
- {
--	RRCAST(soa);
-+    RRCAST(soa);
- 
--	return compose_binary_data("dd44444", 1,
--		name2wire_name(rr->mname), name2wire_name(rr->rname),
--		rr->serial, rr->refresh, rr->retry,
--		rr->expire, rr->minimum);
-+    return compose_binary_data("dd44444", 1,
-+        name2wire_name(rr->mname), name2wire_name(rr->rname),
-+        rr->serial, rr->refresh, rr->retry,
-+        rr->expire, rr->minimum);
- }
- 
- static void *soa_validate(struct rr *rrv)
- {
--	RRCAST(soa);
-+    RRCAST(soa);
- 
--	if (strchr(rr->mname, '/') != NULL)
--		return moan(rr->rr.file_name, rr->rr.line, "MNAME contains '/'");
--	if (strchr(rr->rname, '/') != NULL)
--		return moan(rr->rr.file_name, rr->rr.line, "RNAME contains '/'");
--	return NULL;
-+    if (strchr(rr->mname, '/') != NULL)
-+        return moan(rr->rr.file_name, rr->rr.line, "MNAME contains '/'");
-+    if (strchr(rr->rname, '/') != NULL)
-+        return moan(rr->rr.file_name, rr->rr.line, "RNAME contains '/'");
-+    return NULL;
- }
- 
- struct rr_methods soa_methods = { soa_parse, soa_human, soa_wirerdata, NULL, soa_validate };
-diff -Naur validns-0.8/spf.c validns/spf.c
---- validns-0.8/spf.c	2014-02-11 15:46:10.000000000 -0500
-+++ validns/spf.c	2020-10-05 16:59:29.356681378 -0400
-@@ -19,70 +19,70 @@
- 
- /* XXX
-  * We need to add the following spf-specific policy checks:
-- * 	- record not too long (DNS name + length of SPF+TXT < 450) - rfc4408, 3.1.4
-- * 	- record should match /^v=spf1( |$)/  - rfc4408, 4.5
-- * 	- maybe check for other syntax features
-- * 	- there should be an identical TXT record - rfc4408, 3.1.1
-- * 	- there should only be one SPF per DNS name - rfc4408, 4.5
-+ *  - record not too long (DNS name + length of SPF+TXT < 450) - rfc4408, 3.1.4
-+ *  - record should match /^v=spf1( |$)/  - rfc4408, 4.5
-+ *  - maybe check for other syntax features
-+ *  - there should be an identical TXT record - rfc4408, 3.1.1
-+ *  - there should only be one SPF per DNS name - rfc4408, 4.5
-  */
- 
- static struct rr *spf_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_spf *rr;
--	struct binary_data spf[20];
--	int i;
--
--	i = 0;
--	while (*s) {
--		if (i >= 20)
--			return bitch("program limit: too many SPF text segments");
--		spf[i] = extract_text(&s, "SPF text segment");
--		if (spf[i].length < 0)
--			return NULL;
--		if (spf[i].length > 255)
--			return bitch("SPF segment too long");
--		i++;
--	}
--	if (i == 0)
--		return bitch("empty text record");
--
--   	rr = getmem(sizeof(*rr) + sizeof(struct binary_data) * (i-1));
--	rr->count = i;
--	for (i = 0; i < rr->count; i++) {
--		rr->spf[i] = spf[i];
--	}
-+    struct rr_spf *rr;
-+    struct binary_data spf[20];
-+    int i;
-+
-+    i = 0;
-+    while (*s) {
-+        if (i >= 20)
-+            return bitch("program limit: too many SPF text segments");
-+        spf[i] = extract_text(&s, "SPF text segment");
-+        if (spf[i].length < 0)
-+            return NULL;
-+        if (spf[i].length > 255)
-+            return bitch("SPF segment too long");
-+        i++;
-+    }
-+    if (i == 0)
-+        return bitch("empty text record");
-+
-+    rr = getmem(sizeof(*rr) + sizeof(struct binary_data) * (i-1));
-+    rr->count = i;
-+    for (i = 0; i < rr->count; i++) {
-+        rr->spf[i] = spf[i];
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* spf_human(struct rr *rrv)
- {
--	RRCAST(spf);
-+    RRCAST(spf);
-     char ss[1024];
--	int i;
--	char *s = ss;
--	int l;
--
--	for (i = 0; i < rr->count; i++) {
--		l = snprintf(s, 1024-(s-ss), "\"%s\" ", rr->spf[i].data);
--		s += l;
--	}
-+    int i;
-+    char *s = ss;
-+    int l;
-+
-+    for (i = 0; i < rr->count; i++) {
-+        l = snprintf(s, 1024-(s-ss), "\"%s\" ", rr->spf[i].data);
-+        s += l;
-+    }
-     return quickstrdup_temp(ss);
- }
- 
- static struct binary_data spf_wirerdata(struct rr *rrv)
- {
--	RRCAST(spf);
--	struct binary_data r, t;
--	int i;
--
--	r = bad_binary_data();
--	t.length = 0;
--	t.data = NULL;
--	for (i = 0; i < rr->count; i++) {
--		r = compose_binary_data("db", 1, t, rr->spf[i]);
--		t = r;
--	}
-+    RRCAST(spf);
-+    struct binary_data r, t;
-+    int i;
-+
-+    r = bad_binary_data();
-+    t.length = 0;
-+    t.data = NULL;
-+    for (i = 0; i < rr->count; i++) {
-+        r = compose_binary_data("db", 1, t, rr->spf[i]);
-+        t = r;
-+    }
-     return r;
- }
- 
-diff -Naur validns-0.8/srv.c validns/srv.c
---- validns-0.8/srv.c	2014-02-11 15:45:48.000000000 -0500
-+++ validns/srv.c	2020-10-05 16:59:29.356681378 -0400
-@@ -19,60 +19,60 @@
- 
- static struct rr *srv_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_srv *rr = getmem(sizeof(*rr));
--	int i;
-+    struct rr_srv *rr = getmem(sizeof(*rr));
-+    int i;
- 
--	/* TODO validate `name` (underscores etc) http://tools.ietf.org/html/rfc2782 */
-+    /* TODO validate `name` (underscores etc) http://tools.ietf.org/html/rfc2782 */
- 
--	i = extract_integer(&s, "priority");
--	if (i < 0)
--		return NULL;
--	if (i >= 65536)
--		return bitch("priority range is not valid");
--	rr->priority = i;
--
--	i = extract_integer(&s, "weight");
--	if (i < 0)
--		return NULL;
--	if (i >= 65536)
--		return bitch("weight range is not valid");
--	rr->weight = i;
--
--	i = extract_integer(&s, "port");
--	if (i < 0)
--		return NULL;
--	if (i >= 65536)
--		return bitch("port range is not valid");
--	rr->port = i;
--
--	rr->target = extract_name(&s, "target", 0);
--	if (!rr->target)
--		return NULL;
--
--	if (*s) {
--		return bitch("garbage after valid SRV data");
--	}
-+    i = extract_integer(&s, "priority", NULL);
-+    if (i < 0)
-+        return NULL;
-+    if (i >= 65536)
-+        return bitch("priority range is not valid");
-+    rr->priority = i;
-+
-+    i = extract_integer(&s, "weight", NULL);
-+    if (i < 0)
-+        return NULL;
-+    if (i >= 65536)
-+        return bitch("weight range is not valid");
-+    rr->weight = i;
-+
-+    i = extract_integer(&s, "port", NULL);
-+    if (i < 0)
-+        return NULL;
-+    if (i >= 65536)
-+        return bitch("port range is not valid");
-+    rr->port = i;
-+
-+    rr->target = extract_name(&s, "target", 0);
-+    if (!rr->target)
-+        return NULL;
-+
-+    if (*s) {
-+        return bitch("garbage after valid SRV data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* srv_human(struct rr *rrv)
- {
--	RRCAST(srv);
-+    RRCAST(srv);
-     char s[1024];
- 
--	snprintf(s, 1024, "%hu %hu %hu %s",
--			 rr->priority, rr->weight, rr->port, rr->target);
-+    snprintf(s, 1024, "%hu %hu %hu %s",
-+             rr->priority, rr->weight, rr->port, rr->target);
- 
--	return quickstrdup_temp(s);
-+    return quickstrdup_temp(s);
- }
- 
- static struct binary_data srv_wirerdata(struct rr *rrv)
- {
--	RRCAST(srv);
-+    RRCAST(srv);
-     return compose_binary_data("222d", 1,
--		rr->priority, rr->weight, rr->port,
--		name2wire_name(rr->target));
-+        rr->priority, rr->weight, rr->port,
-+        name2wire_name(rr->target));
- }
- 
- struct rr_methods srv_methods = { srv_parse, srv_human, srv_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/sshfp.c validns/sshfp.c
---- validns-0.8/sshfp.c	2014-02-11 15:45:51.000000000 -0500
-+++ validns/sshfp.c	2020-10-05 16:59:29.356681378 -0400
-@@ -19,63 +19,63 @@
- 
- static struct rr* sshfp_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_sshfp *rr = getmem(sizeof(*rr));
--	int algorithm, fp_type;
-+    struct rr_sshfp *rr = getmem(sizeof(*rr));
-+    int algorithm, fp_type;
- 
--	algorithm = extract_integer(&s, "algorithm");
--	if (algorithm < 0)	return NULL;
--	if (algorithm != 1 && algorithm != 2 && algorithm != 3)
--		return bitch("unsupported algorithm");
--	rr->algorithm = algorithm;
--
--	fp_type = extract_integer(&s, "fp type");
--	if (fp_type < 0)	return NULL;
--	if (fp_type != 1 && fp_type != 2)
--		return bitch("unsupported fp_type");
--	rr->fp_type = fp_type;
--
--	rr->fingerprint = extract_hex_binary_data(&s, "fingerprint", EXTRACT_EAT_WHITESPACE);
--	if (rr->fingerprint.length < 0)	return NULL;
--	
--	if (rr->fp_type == 1 && rr->fingerprint.length != SHA1_BYTES) {
--		return bitch("wrong SHA-1 fingerprint length: %d bytes found, %d bytes expected",
--					 rr->fingerprint.length, SHA1_BYTES);
--	}
--	if (rr->fp_type == 2 && rr->fingerprint.length != SHA256_BYTES) {
--		return bitch("wrong SHA-256 fingerprint length: %d bytes found, %d bytes expected",
--					 rr->fingerprint.length, SHA256_BYTES);
--	}
--
--	if (*s) {
--		return bitch("garbage after valid SSHFP data");
--	}
--	return store_record(type, name, ttl, rr);
-+    algorithm = extract_integer(&s, "algorithm", NULL);
-+    if (algorithm < 0)  return NULL;
-+    if (algorithm != 1 && algorithm != 2 && algorithm != 3 && algorithm != 4)
-+        return bitch("unsupported algorithm");
-+    rr->algorithm = algorithm;
-+
-+    fp_type = extract_integer(&s, "fp type", NULL);
-+    if (fp_type < 0)    return NULL;
-+    if (fp_type != 1 && fp_type != 2)
-+        return bitch("unsupported fp_type");
-+    rr->fp_type = fp_type;
-+
-+    rr->fingerprint = extract_hex_binary_data(&s, "fingerprint", EXTRACT_EAT_WHITESPACE);
-+    if (rr->fingerprint.length < 0) return NULL;
-+    
-+    if (rr->fp_type == 1 && rr->fingerprint.length != SHA1_BYTES) {
-+        return bitch("wrong SHA-1 fingerprint length: %d bytes found, %d bytes expected",
-+                     rr->fingerprint.length, SHA1_BYTES);
-+    }
-+    if (rr->fp_type == 2 && rr->fingerprint.length != SHA256_BYTES) {
-+        return bitch("wrong SHA-256 fingerprint length: %d bytes found, %d bytes expected",
-+                     rr->fingerprint.length, SHA256_BYTES);
-+    }
-+
-+    if (*s) {
-+        return bitch("garbage after valid SSHFP data");
-+    }
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* sshfp_human(struct rr *rrv)
- {
--	RRCAST(sshfp);
-+    RRCAST(sshfp);
-     char ss[4096];
--	char *s = ss;
--	int l;
--	int i;
-+    char *s = ss;
-+    int l;
-+    int i;
- 
-     l = snprintf(s, 4096, "%u %u ", rr->algorithm, rr->fp_type);
--	s += l;
--	for (i = 0; i < rr->fingerprint.length; i++) {
--		l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->fingerprint.data[i]);
--		s += l;
--	}
-+    s += l;
-+    for (i = 0; i < rr->fingerprint.length; i++) {
-+        l = snprintf(s, 4096-(s-ss), "%02X", (unsigned char)rr->fingerprint.data[i]);
-+        s += l;
-+    }
-     return quickstrdup_temp(ss);
- }
- 
- static struct binary_data sshfp_wirerdata(struct rr *rrv)
- {
--	RRCAST(sshfp);
-+    RRCAST(sshfp);
- 
--	return compose_binary_data("11d", 1,
--		rr->algorithm, rr->fp_type,
--		rr->fingerprint);
-+    return compose_binary_data("11d", 1,
-+        rr->algorithm, rr->fp_type,
-+        rr->fingerprint);
- }
- 
- struct rr_methods sshfp_methods = { sshfp_parse, sshfp_human, sshfp_wirerdata, NULL, NULL };
-diff -Naur validns-0.8/t/issues/36-include/empty-include.zone validns/t/issues/36-include/empty-include.zone
---- validns-0.8/t/issues/36-include/empty-include.zone	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/36-include/empty-include.zone	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,4 @@
-+$ORIGIN example.com.
-+@       IN  200    SOA     ns hostmaster 1 10800 3600 2592000 1200
-+        IN      NS      ns
-+$INCLUDE ; there is no include, and it is wrong
-diff -Naur validns-0.8/t/issues/36-include/inc2.inc validns/t/issues/36-include/inc2.inc
---- validns-0.8/t/issues/36-include/inc2.inc	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/36-include/inc2.inc	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,2 @@
-+$ORIGIN inc2 ; i.e., inc2.inc1.example.com.
-+@ A 55.55.55.55
-diff -Naur validns-0.8/t/issues/36-include/include.zone validns/t/issues/36-include/include.zone
---- validns-0.8/t/issues/36-include/include.zone	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/36-include/include.zone	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,6 @@
-+$ORIGIN example.com.
-+@       IN  200    SOA     ns hostmaster 1 10800 3600 2592000 1200
-+        IN      NS      ns
-+$INCLUDE reldir/inc1.inc ; relative to the zone file
-+; here we should be back to our origin
-+@ IN A 99.99.99.99
-diff -Naur validns-0.8/t/issues/36-include/missing-include.zone validns/t/issues/36-include/missing-include.zone
---- validns-0.8/t/issues/36-include/missing-include.zone	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/36-include/missing-include.zone	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,4 @@
-+$ORIGIN example.com.
-+@       IN  200    SOA     ns hostmaster 1 10800 3600 2592000 1200
-+        IN      NS      ns
-+$INCLUDE nosuch.inc
-diff -Naur validns-0.8/t/issues/36-include/reldir/inc1.inc validns/t/issues/36-include/reldir/inc1.inc
---- validns-0.8/t/issues/36-include/reldir/inc1.inc	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/36-include/reldir/inc1.inc	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,5 @@
-+$ORIGIN inc1 ; i.e., inc1.example.com.
-+@ A 11.11.11.11
-+$INCLUDE inc2.inc ; still relative to the zone file, not to this dir
-+; should be back to this origin
-+@ AAAA 1111::1111
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/dsset-example.sec. validns/t/issues/41-ksk-policy-check/dsset-example.sec.
---- validns-0.8/t/issues/41-ksk-policy-check/dsset-example.sec.	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/41-ksk-policy-check/dsset-example.sec.	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,2 @@
-+example.sec.		IN DS 7686 7 1 51B9CD8F901235705C6D353ADA23736AE954B4DE
-+example.sec.		IN DS 7686 7 2 9EC80B8BAD67C66954B8FE726E06CA7840282C7F444BE51A916ED11C 36908A3F
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/example.sec validns/t/issues/41-ksk-policy-check/example.sec
---- validns-0.8/t/issues/41-ksk-policy-check/example.sec	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/41-ksk-policy-check/example.sec	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,12 @@
-+$TTL    1d
-+@       IN      SOA     ns.example.sec. hostmaster.example.sec. (
-+                              1         ; Serial
-+                         604800         ; Refresh
-+                          86400         ; Retry
-+                        2419200         ; Expire
-+                         604800 )       ; Negative Cache TTL
-+                IN      NS      ns1.example.net.
-+subA            IN      NS      ns1.example.net.
-+subb            IN      NS      ns1.example.net.
-+subC            IN      NS      ns1.example.net.
-+myMX	IN	MX 5 mx.example.net.
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/example.sec.signed validns/t/issues/41-ksk-policy-check/example.sec.signed
---- validns-0.8/t/issues/41-ksk-policy-check/example.sec.signed	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/41-ksk-policy-check/example.sec.signed	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,131 @@
-+; File written on Tue Jun 30 15:31:27 2015
-+; dnssec_signzone version 9.9.7
-+example.sec.		86400	IN SOA	ns.example.sec. hostmaster.example.sec. (
-+					1          ; serial
-+					604800     ; refresh (1 week)
-+					86400      ; retry (1 day)
-+					2419200    ; expire (4 weeks)
-+					604800     ; minimum (1 week)
-+					)
-+			86400	RRSIG	SOA 7 2 86400 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					b1Qs5d/0a4IDAvFPVvDKqWpir4189XoPOD4E
-+					804eiNXRLP2ShkEUBPil44+6Ikwup5Im24XU
-+					PLnmStjUFHVniicvwbwT/IY4etXR4xNoBHUc
-+					BU8LiADPpZGfJ1tC/s/IHLcPbX21OltyYzi0
-+					++z9gxZGy4vCG5gYCH0vm+Q96fY= )
-+			86400	NS	ns1.example.net.
-+			86400	RRSIG	NS 7 2 86400 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					gyqsk3xSnKefnjTOVzJS4sdDFiJ5cPEupSkP
-+					+LGXGRDGrclY6V9mkfddQz3MkeCCjujvQNAi
-+					NpZllyzFj221se5bHLAVydkT0jhl2jgp8bsL
-+					DBk15FGa7SXcwtpXn5rkDvR1/wmS7M/aYnrY
-+					3j5dTSSsOlZQLENWBEtct9QSNbU= )
-+			86400	DNSKEY	256 3 7 (
-+					AwEAAaMBYu1QXBi6AII33FKwWpHhOkGMhcVc
-+					IWJ73npEFjvDe0jJfLjkghnij4tMfDI8MPIZ
-+					6xwVLYsEshxsDNEJJGdZ1dUvfJDxSCv8Wp0a
-+					2IffxQ5NDRHSpUw27yJoQfI5gUqvor+wGTNC
-+					UWx2OU0Y1BOy1whHtVbDl1gt1R6/8mOZ
-+					) ; ZSK; alg = NSEC3RSASHA1; key id = 64232
-+			86400	DNSKEY	257 3 7 (
-+					AwEAAciLWglw17dt8EDAN88BrQYCIaGPifC4
-+					pxrizfz3S1cC4XbSyRW5loj5SSHVveUmmIV9
-+					0MTEOhGCDUVq/qiYG7NgTNHn3YiqyRU3sirw
-+					4SACFiwln/ejxFDpQkeAbZMCzU8FQhTIB1K9
-+					y7QRiLacI6naULzgP3h4PsdQSQmw3/TWy973
-+					M+lHzwkgVq6ML42L18rGG0sn1KQDNSs/6sd9
-+					dcRjPo7uJ2OuUsnbu/5N3vWYLciSBUnY27FU
-+					vbFLkVIq072wjUMIb0Xc2EgYGRFKyV2MMckL
-+					voD7vPclBE0Krv9fO/B2/KXsbObTgz4m5iQN
-+					F45QLU02kmvwB4iyIzIk9O0=
-+					) ; KSK; alg = NSEC3RSASHA1; key id = 7686
-+			86400	RRSIG	DNSKEY 7 2 86400 (
-+					20150730123127 20150630123127 7686 example.sec.
-+					YQ42WBCr7e4MR51W+d6Awkxdff7tTNiA1qfJ
-+					wsst0UiNXKAv504YRcS6B34u4CfG59lWWtcd
-+					+xBHU7Zuox5nehsLEkFAneD1YrJLkgVw03nZ
-+					NzDNWFvlxfQ2/tJ7vGbjKG2cEwUnbJKl+Kcl
-+					JTAc5JzZegfM75M0Z4Yi9NiDjicpHbaICtKJ
-+					5WZ6T5nVFo1nl2xCq2CiXiR1+jGKARUW+btO
-+					NzHMApLQszDo7CMgvYJoHy0CHAV1Uc7Ka4zO
-+					P3dVYkwu1Puk+gixhNUqo+UhKgLB2JUYdci7
-+					cQ1JR9RzqEXzyZgGpLmXCOEOc8KD2c2dDN5L
-+					uvOV40OrWhST/bAQ+Q== )
-+			86400	RRSIG	DNSKEY 7 2 86400 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					lKX35bocQ1iR4VTW0Es+2bZ2qX1ON7OGU1fO
-+					Pb0ZqueG2GYgI63VE4Jv3WeOmGg/Tkjvsdb6
-+					bMHVuVpxHvQKRqqzfaQmY7nzoDe53LfSJewj
-+					p2TvdhvpPRroEZGXXPmVl46R/p+jlYMJd47T
-+					o0oqB/BvQPUS61a5NThagGq6vJM= )
-+			0	NSEC3PARAM 1 0 10 -
-+			0	RRSIG	NSEC3PARAM 7 2 0 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					hNJlc3JuGYBpnYEZQrhqNwrIL2fBegnnR4ii
-+					TOW+0Km2maqF5ZZMxBZ7x54gW4T0amXXz89+
-+					uE+l02eknf/FgM81FFOrQvJul0toOzKW9g67
-+					e2VwQAwcw7g6H06cSsypXM/h9wvsNQpoSdx0
-+					rq6qU2ruYM9NmJf+xUzUk38AFUw= )
-+subA.example.sec.	86400	IN NS	ns1.example.net.
-+subb.example.sec.	86400	IN NS	ns1.example.net.
-+subC.example.sec.	86400	IN NS	ns1.example.net.
-+93GL7KF6D2G7J2PSLEO2CIA70A3MM4KQ.example.sec. 604800 IN	NSEC3 1 0 10 - (
-+					CSLD6RFNKVSKA73DGNI0EOM95Q8DKGBQ
-+					NS )
-+			604800	RRSIG	NSEC3 7 3 604800 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					JRhyC3PbmnvYBkXzV5GmIBnj5LJTnrVeC1t3
-+					v6t6o+3udfPZRecHw2cApf/Oed8H9jCeox77
-+					vA13/fLXui635CYAcqXYxVgO4g0au1d1S6lo
-+					N2Pw96JXDNhIqyVBVj1Ii2ZOQLWXZ8YgZRQ6
-+					lxgww8m0QGC8FjEnzR8z2liSG88= )
-+3ED4GMVJJ0FT4TCFDKNFQ5EPEFSDBPNM.example.sec. 604800 IN	NSEC3 1 0 10 - (
-+					93GL7KF6D2G7J2PSLEO2CIA70A3MM4KQ
-+					NS )
-+			604800	RRSIG	NSEC3 7 3 604800 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					B9L5NrHjO/J6FDmv7DjT1xq/f8jiB2WTEXSl
-+					bFeUVcTivoyvdyfNNTH+YlzJesqTtQ9GaEPQ
-+					ouzw7XbdyvtJ//GD+vrO/7XwfrVmkckQgEVl
-+					zPm70TksAkwLzj0uY6WBIGIPq/KJMM14f6El
-+					ct5w2KtgvF9sazFP+KMchU5Be3Q= )
-+myMX.example.sec.	86400	IN MX	5 mx.example.net.
-+			86400	RRSIG	MX 7 3 86400 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					lh8vFwFg77gLtLyXbzqzYSlebkzn3yAlXHU2
-+					/hgiyUWYcuZa5E33Ul+ZrUJPCGLaUQs3X+yL
-+					p/uk6LP2dnMaf/X1mow/tyYNtIdn0MhTYNqs
-+					WmYV1Ga/NSoErtoHYoNgeqV1w0Q/nfhipMdX
-+					RekpxVR6RUUt2d3LS8UIH+pEYd8= )
-+CSLD6RFNKVSKA73DGNI0EOM95Q8DKGBQ.example.sec. 604800 IN	NSEC3 1 0 10 - (
-+					JC1M8I9IPBEENK9RDGMN9LQKAMMSQEVV
-+					MX RRSIG )
-+			604800	RRSIG	NSEC3 7 3 604800 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					menCNV7RkbVWmfhuPfoYHfHCEtvQmVb3+p/x
-+					WYVymu5hXUPQ2+K4Ns0jQ+om4GuTmXmm1DYY
-+					IjIXv4jthJoD6jydqN6Hr+tr0ewxr6mHXj3I
-+					RizTBuw4zcgPUrIRVQStkMtwyjN4Nlznhg7I
-+					txZ14uH1G4U1DgkR2oC6YZsSqi8= )
-+JC1M8I9IPBEENK9RDGMN9LQKAMMSQEVV.example.sec. 604800 IN	NSEC3 1 0 10 - (
-+					NLF2NKFTCGVVRC4C941FOOCD00TPI9DV
-+					NS SOA RRSIG DNSKEY NSEC3PARAM )
-+			604800	RRSIG	NSEC3 7 3 604800 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					ggLIoKQYmI9GeBkSccVdE87G1QQwGGO0HlrN
-+					dg9Ah5QiWWjZ5icSOU4vyEm0XiqkFCrGEAq0
-+					9L4HMOFuELMa28dAhVxOvZldbXizXUSCbWCS
-+					miYFLOIKcQ9IcmzeEgg+uJzHdAyYSSK2Jb+0
-+					YYuoXOhiZwzluj+u2i6kbf6wDY4= )
-+NLF2NKFTCGVVRC4C941FOOCD00TPI9DV.example.sec. 604800 IN	NSEC3 1 0 10 - (
-+					3ED4GMVJJ0FT4TCFDKNFQ5EPEFSDBPNM
-+					NS )
-+			604800	RRSIG	NSEC3 7 3 604800 (
-+					20150730123127 20150630123127 64232 example.sec.
-+					buRQJjfJDIbRFZFr8s7odGSxqnrSHXXN/AAu
-+					tbG1k2L7WD+DGYFiRnR5Uia/C2oL186PqBtT
-+					R8oDKf/4zr5qOsZz9xYabaBqG98JVXwPTiFk
-+					JBoc7sFcwGJ16hj9Zey05aNs1h5RZm6BL8W0
-+					9bRF3qIezckG0VA+U7ASTLNH4ME= )
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key
---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.key	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,5 @@
-+; This is a key-signing key, keyid 7686, for example.sec.
-+; Created: 20150630133112 (Tue Jun 30 15:31:12 2015)
-+; Publish: 20150630133112 (Tue Jun 30 15:31:12 2015)
-+; Activate: 20150630133112 (Tue Jun 30 15:31:12 2015)
-+example.sec. IN DNSKEY 257 3 7 AwEAAciLWglw17dt8EDAN88BrQYCIaGPifC4pxrizfz3S1cC4XbSyRW5 loj5SSHVveUmmIV90MTEOhGCDUVq/qiYG7NgTNHn3YiqyRU3sirw4SAC Fiwln/ejxFDpQkeAbZMCzU8FQhTIB1K9y7QRiLacI6naULzgP3h4PsdQ SQmw3/TWy973M+lHzwkgVq6ML42L18rGG0sn1KQDNSs/6sd9dcRjPo7u J2OuUsnbu/5N3vWYLciSBUnY27FUvbFLkVIq072wjUMIb0Xc2EgYGRFK yV2MMckLvoD7vPclBE0Krv9fO/B2/KXsbObTgz4m5iQNF45QLU02kmvw B4iyIzIk9O0=
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private
---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+07686.private	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,13 @@
-+Private-key-format: v1.3
-+Algorithm: 7 (NSEC3RSASHA1)
-+Modulus: yItaCXDXt23wQMA3zwGtBgIhoY+J8LinGuLN/PdLVwLhdtLJFbmWiPlJIdW95SaYhX3QxMQ6EYINRWr+qJgbs2BM0efdiKrJFTeyKvDhIAIWLCWf96PEUOlCR4BtkwLNTwVCFMgHUr3LtBGItpwjqdpQvOA/eHg+x1BJCbDf9NbL3vcz6UfPCSBWrowvjYvXysYbSyfUpAM1Kz/qx311xGM+ju4nY65Sydu7/k3e9ZgtyJIFSdjbsVS9sUuRUirTvbCNQwhvRdzYSBgZEUrJXYwxyQu+gPu89yUETQqu/1878Hb8pexs5tODPibmJA0XjlAtTTaSa/AHiLIjMiT07Q==
-+PublicExponent: AQAB
-+PrivateExponent: d5kDfRXaz/20hikcH0v0j9y9icg8j17P6WzRQ8eHGsERDPfwDBC+AboJLzB1Ky+1TgcWdgJATyisGXYRoSH1gygvKA+LQnH3sbuheZJl79zOtE1L9TepYEd7y4B/2GiXYETWf+Y619Fwpla+nYjIjAcylzF1KLctWVg79peROEXC0zb+IxWQFIBpe7OzTZ1qxG8ymm6uiu9KXH6qQi3BLSarxj5rY+tO8oj0qQNOGkbSVsXFax0arZ0qMRFT5UooOm+2Yl8Q9Z/PC52qwNqkSDZ2QeoYTJx5tDFhuVJxXhioxGIueA4QuCRA4cRL2U5ZnCYcQa10JFE2O4N990eLUQ==
-+Prime1: 5LW1fl8ky4bBaIPg48Cq8bXQIvaK5syFTvzzMopuTeD6PGwOByuzc4u9KLVrDRebjeYfNVkqXIJAHMjolOr4jURWp2Q3FUrewqdgyY2ULSLMmQo0+dHkvjJIs2A/6vNme+MtFms6msJjyzj3EhLf32djvCH+jWStP3Vb/jopYWs=
-+Prime2: 4HlJJB25JSLygHd0GWi8yu0z3FaYhWXnIs8bwpT8er1lH+tsBeYI8ughuX9h19STMRnBhAh0ZlQaKHOrPTsdVOFQJWr6aUbWIAhv5m+ij1IFsQ58DKnsYP0DXiNkR7K4pXO8yzPTo9UfaMCJAKYipENTgpfb43sVBQnDIGr9oQc=
-+Exponent1: aJpK9g9h7swlLT4T31bBWGeFWFhWUxT7a5L5UAZMSMY67OOmztTH8HLbAwFmgshnVtEHOQkc/M59sCybY3DMWSAGWezV3KEvnOucstJUEQi3ds9aR2AeNHcfFRtSYI0ONF9EwdotJZb+uXXGWrfTOIQ681LA7746FqoAdxf20R0=
-+Exponent2: QlFS3Iqzglc60d14vXEGJeXCZpxm3zJmARCzIN+nYBPIZo/FEFEP38PZAtaxb3RsMBtt4rYkvX6nY8AYnTRzy/ntFcDvTl8RL9GOTcQ5gKI48EBZQdyJ63WUoyFNpSkWCDuTUW10X3i9mNMZJsnufh0t9O0sl55rbVue/Frfp80=
-+Coefficient: aLnGdfeRJ3nSjmbby8IDkJ+W+gFGOHd3XAMDSNP9D8kn6B3JyAfY6FDSg0+Bh+F80PFNGsESkYimXlWr3B6NlC0Gq99hPSV8yU2pYHq3TPVB0tWOAkNVIXM9icEH9wshCQH7wD7cPDWvhhgcgo64nYOGYeK6sjTL7XDtRanvbP8=
-+Created: 20150630133112
-+Publish: 20150630133112
-+Activate: 20150630133112
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key
---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.key	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,5 @@
-+; This is a zone-signing key, keyid 64232, for example.sec.
-+; Created: 20150630133105 (Tue Jun 30 15:31:05 2015)
-+; Publish: 20150630133105 (Tue Jun 30 15:31:05 2015)
-+; Activate: 20150630133105 (Tue Jun 30 15:31:05 2015)
-+example.sec. IN DNSKEY 256 3 7 AwEAAaMBYu1QXBi6AII33FKwWpHhOkGMhcVcIWJ73npEFjvDe0jJfLjk ghnij4tMfDI8MPIZ6xwVLYsEshxsDNEJJGdZ1dUvfJDxSCv8Wp0a2Iff xQ5NDRHSpUw27yJoQfI5gUqvor+wGTNCUWx2OU0Y1BOy1whHtVbDl1gt 1R6/8mOZ
-diff -Naur validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private
---- validns-0.8/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/41-ksk-policy-check/Kexample.sec.+007+64232.private	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,13 @@
-+Private-key-format: v1.3
-+Algorithm: 7 (NSEC3RSASHA1)
-+Modulus: owFi7VBcGLoAgjfcUrBakeE6QYyFxVwhYnveekQWO8N7SMl8uOSCGeKPi0x8Mjww8hnrHBUtiwSyHGwM0QkkZ1nV1S98kPFIK/xanRrYh9/FDk0NEdKlTDbvImhB8jmBSq+iv7AZM0JRbHY5TRjUE7LXCEe1VsOXWC3VHr/yY5k=
-+PublicExponent: AQAB
-+PrivateExponent: ATf/b1rMdXreihq00QF0i+atMtREI8eekEfwz+U2bVf20gJ/pjo/JsZk4FvACfgdPZIoCdu2rXVph4DfT6jL1t7sDY/9mfcMd2Zge6eB8Kat3QpdDu4qClgkXFTYFLj2lQ5Bm/b+YbQ8fiPlZovp7YGFodmsjfnNvbT7UiOiSKE=
-+Prime1: 1wNWdr5FIrew1NTzpbeClZr5NIIoRBpEPsSDCBZpbRDZ944LcjWgrJpVlG1klkp/cR/zcSzrq+637rva30jglQ==
-+Prime2: whQSB4wqB87wyYrewJLU5qFY5Up/YiZ0iyD4m4OIQMk/K7eXtuqFuSOP4xTR4WAWHIyRixa1F85/eh7y6+9h9Q==
-+Exponent1: XjHZJEYw9Yex0VvFrdjaPX5aJJXM3CEButnOabGf2Cckxl4VR6CU1mj6iv7trSXP9RhBR1idmoIHVHA57832jQ==
-+Exponent2: dtzn9etoSoP5gNYmevbyoZWr5jJsNeardhJpcIVsS5F1uQamSob0A2G+XCuCJ3A72pxU/0SXAM+dz2NpEAr6iQ==
-+Coefficient: egVfeiBCmggrVDolCSvAIg+XEb+YmLcD1SLT5qFLuqCtPKWGDx9lGMbqbx5s2gzeeoAPL1r34pohHNLMCqCNdw==
-+Created: 20150630133105
-+Publish: 20150630133105
-+Activate: 20150630133105
-diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/13.example.com validns/t/issues/51-support-curved-algorithms/13.example.com
---- validns-0.8/t/issues/51-support-curved-algorithms/13.example.com	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/51-support-curved-algorithms/13.example.com	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,16 @@
-+$TTL 86400 ; (1 day)
-+$ORIGIN 13.example.com.
-+$INCLUDE K13.example.com.+013+18450.key;
-+@ IN SOA ns1.example.com. hostmaster.example.com. (
-+                2014012401 ; serial YYYYMMDDnn
-+                14400      ; refresh (4 hours)
-+                1800       ; retry   (30 minutes)
-+                1209600    ; expire  (2 weeks)
-+                3600       ; minimum (1 hour)
-+                )
-+ 
-+         172800    IN   NS    ns1.example.org.
-+         172800    IN   NS    ns2.example.org.
-+ 
-+                   IN   A     203.0.113.10
-+www                IN   CNAME 13.example.com.
-diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/13.example.com.signed validns/t/issues/51-support-curved-algorithms/13.example.com.signed
---- validns-0.8/t/issues/51-support-curved-algorithms/13.example.com.signed	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/51-support-curved-algorithms/13.example.com.signed	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,55 @@
-+; File written on Tue Mar 29 15:52:18 2016
-+; dnssec_signzone version 9.9.8-P4-RedHat-9.9.8_P4-2.el7.0
-+13.example.com.		86400	IN SOA	ns1.example.com. hostmaster.example.com. (
-+					2014012401 ; serial
-+					14400      ; refresh (4 hours)
-+					1800       ; retry (30 minutes)
-+					1209600    ; expire (2 weeks)
-+					3600       ; minimum (1 hour)
-+					)
-+			86400	RRSIG	SOA 13 3 86400 (
-+					20160428125218 20160329125218 18450 13.example.com.
-+					7LfQswmP8B9hr6Bg8nr9o8yd/fe6n86HDhs9
-+					pAByPITSjdqML6Rwb4NOHWvFDZJXVA4mz5Pe
-+					TG4JVHiGYU7HCw== )
-+			172800	NS	ns1.example.org.
-+			172800	NS	ns2.example.org.
-+			172800	RRSIG	NS 13 3 172800 (
-+					20160428125218 20160329125218 18450 13.example.com.
-+					eses1PGFULOHDZbqPt+CMQHdYCIVNdxVMYba
-+					YtW3iA9nN4mfvS6jls69J60bqSA4p3w4tD3k
-+					v9dnDcFdS+tEUQ== )
-+			86400	A	203.0.113.10
-+			86400	RRSIG	A 13 3 86400 (
-+					20160428125218 20160329125218 18450 13.example.com.
-+					2QqqZ4i7yq1sCrK82aLm85pTSUgpWR0XsBzi
-+					MVFyjcoW75f0ysZKZafO5lFJECKEP8ncJfEP
-+					NEMXVuyAUJihSA== )
-+			3600	NSEC	www.13.example.com. A NS SOA RRSIG NSEC DNSKEY
-+			3600	RRSIG	NSEC 13 3 3600 (
-+					20160428125218 20160329125218 18450 13.example.com.
-+					IV+0txuv6DNk7kRBUmkk4jorMjXoyi/klFC/
-+					1g5ZK8/cZuFcKREuIW7bmpvhB4Mhj8yWpLJ9
-+					CVNy339z+Rt/6g== )
-+			86400	DNSKEY	257 3 13 (
-+					SFycyLoVKBBL0re1qD6sezd/bOM9jwtT/mTT
-+					1KkW0yqIXixXN/szwzm49r6YzlIFHRDXry8a
-+					7aaIKWopkx8WBA==
-+					) ; KSK; alg = ECDSAP256SHA256; key id = 18450
-+			86400	RRSIG	DNSKEY 13 3 86400 (
-+					20160428125218 20160329125218 18450 13.example.com.
-+					OsKqN6fhvL4b0XK5TOEpZXrSoC/GcRMlCqIe
-+					csfZem7xMmcBjUe333/fJdw0x1QKmA17BoX/
-+					Px88zz24dRW0Vg== )
-+www.13.example.com.	86400	IN CNAME 13.example.com.
-+			86400	RRSIG	CNAME 13 4 86400 (
-+					20160428125218 20160329125218 18450 13.example.com.
-+					CFfxilFg72g3rQerviVCO6jmf8kVodqusejq
-+					WETSBiCAfMhcB2+uLsitmaH8LsAiNLNMY7nc
-+					533WnQjsJ4vsmQ== )
-+			3600	NSEC	13.example.com. CNAME RRSIG NSEC
-+			3600	RRSIG	NSEC 13 4 3600 (
-+					20160428125218 20160329125218 18450 13.example.com.
-+					IWqCg2pcOd9kX4waHb8Ij3kWeJxfXGKUBbpf
-+					Fuc3bhOJ/rvQ2kPYO305TeZP5Rfcd7+efDEb
-+					i8be+VqhOgf7Pg== )
-diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/14.example.com validns/t/issues/51-support-curved-algorithms/14.example.com
---- validns-0.8/t/issues/51-support-curved-algorithms/14.example.com	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/51-support-curved-algorithms/14.example.com	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,16 @@
-+$TTL 86400 ; (1 day)
-+$ORIGIN 14.example.com.
-+$INCLUDE K14.example.com.+014+01045.key;
-+@ IN SOA ns1.example.com. hostmaster.example.com. (
-+                2014012401 ; serial YYYYMMDDnn
-+                14400      ; refresh (4 hours)
-+                1800       ; retry   (30 minutes)
-+                1209600    ; expire  (2 weeks)
-+                3600       ; minimum (1 hour)
-+                )
-+ 
-+         172800    IN   NS    ns1.example.org.
-+         172800    IN   NS    ns2.example.org.
-+ 
-+                   IN   A     203.0.113.10
-+www                IN   CNAME 14.example.com.
-diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/14.example.com.signed validns/t/issues/51-support-curved-algorithms/14.example.com.signed
---- validns-0.8/t/issues/51-support-curved-algorithms/14.example.com.signed	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/51-support-curved-algorithms/14.example.com.signed	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,63 @@
-+; File written on Tue Mar 29 15:52:22 2016
-+; dnssec_signzone version 9.9.8-P4-RedHat-9.9.8_P4-2.el7.0
-+14.example.com.		86400	IN SOA	ns1.example.com. hostmaster.example.com. (
-+					2014012401 ; serial
-+					14400      ; refresh (4 hours)
-+					1800       ; retry (30 minutes)
-+					1209600    ; expire (2 weeks)
-+					3600       ; minimum (1 hour)
-+					)
-+			86400	RRSIG	SOA 14 3 86400 (
-+					20160428125222 20160329125222 1045 14.example.com.
-+					5FEzZuz1HrgRNTakg4D24h1RrO1Kx9IDzXN6
-+					S/00bsfO5AQ8hxVd2X7XzrYGdqs+gpecBpkl
-+					WLG1MrEgzYvRVgPTVY0bL0U7GxmvqAp871WH
-+					yuJKB8NFTkgQDA7cA2Do )
-+			172800	NS	ns1.example.org.
-+			172800	NS	ns2.example.org.
-+			172800	RRSIG	NS 14 3 172800 (
-+					20160428125222 20160329125222 1045 14.example.com.
-+					9Yol4eoRhw52o7LJqCnTlDlQlFbaHFyTOGf4
-+					3MAPNe5hx2NFCujCg9RxE66l+BE6otDMC+tb
-+					hJKVPfb5U8+rpjDna3H1RSjV7MkS4crlzS0k
-+					0rximlQ9x7OIy2wkZ0bw )
-+			86400	A	203.0.113.10
-+			86400	RRSIG	A 14 3 86400 (
-+					20160428125222 20160329125222 1045 14.example.com.
-+					DG685u5rAML7/ga7TnixPiLwBEHFzcGpQeRc
-+					WZkPX2W/gJ8VyejkZbWDinYEZIVUeQaRTNW4
-+					RcXBSq7o5wDgTJUSih+fnoLh9Fuzlfch6voG
-+					qGKMeWl4i+2eYF7QImB8 )
-+			3600	NSEC	www.14.example.com. A NS SOA RRSIG NSEC DNSKEY
-+			3600	RRSIG	NSEC 14 3 3600 (
-+					20160428125222 20160329125222 1045 14.example.com.
-+					tPxJtlAhflaMsTI0zx0vt+R73cmU9zL9ly20
-+					xrhZlRWhScxZ4y8fAIs57rfbl4XCe1Rln6y/
-+					TZ3V0BcpXH2fl3vXxOJqcnsK/RHHxl57va7E
-+					v704MwP3Je9qhirfLd6O )
-+			86400	DNSKEY	257 3 14 (
-+					FWoMjTSsjInt9389me7cymDHNbntmNWejqPI
-+					zSsifAs2CdBtfCoN98LvEU1eADIG4kkpKvVv
-+					QTYnoiUP/jsFQa6Uz+PmfgKO+PpyNl1fNy+b
-+					N7uEPJzIZhen3X6bIwYg
-+					) ; KSK; alg = ECDSAP384SHA384; key id = 1045
-+			86400	RRSIG	DNSKEY 14 3 86400 (
-+					20160428125222 20160329125222 1045 14.example.com.
-+					FD2AI0MGo8w5JRfVihohNNsgj1pVrCUxaehv
-+					R7DH2eS7STiJFEBFr8e8UO1CiDGXuOGhgoPY
-+					CyEay93XJfdHaWBA4iCPctZUkdyA5ZXrYrpT
-+					iCkK6GK0MtbyH7W3H4Uu )
-+www.14.example.com.	86400	IN CNAME 14.example.com.
-+			86400	RRSIG	CNAME 14 4 86400 (
-+					20160428125222 20160329125222 1045 14.example.com.
-+					Y8knRqg1Hpta6KZ57zc+eY6XDgIgRLVYWZ0m
-+					7YESOgRTU0oEU8j8NQ+S1RPAZM8migNkHjB4
-+					NKdm9DCMnlD237546++VmZFUZgzGnKW3lQAQ
-+					GpTe7MtqMUY40B+TxSIg )
-+			3600	NSEC	14.example.com. CNAME RRSIG NSEC
-+			3600	RRSIG	NSEC 14 4 3600 (
-+					20160428125222 20160329125222 1045 14.example.com.
-+					TnQB0LmuU2Z4WtQDOBslDrIWFguyh4rv17gZ
-+					nV8GvUJnn1Wk8/djZv47chNeNK6Rxt+lUaDm
-+					E9S6f7eSJiGTAP6N0Mgfg7BmFbmD+4ZOUez2
-+					t5FEl5KRUrPoiHQvOB8w )
-diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.key validns/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.key
---- validns-0.8/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.key	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.key	2020-10-05 16:59:29.357681388 -0400
-@@ -0,0 +1,5 @@
-+; This is a key-signing key, keyid 18450, for 13.example.com.
-+; Created: 20160302102736 (Wed Mar  2 11:27:36 2016)
-+; Publish: 20160302102736 (Wed Mar  2 11:27:36 2016)
-+; Activate: 20160302102736 (Wed Mar  2 11:27:36 2016)
-+13.example.com. IN DNSKEY 257 3 13 SFycyLoVKBBL0re1qD6sezd/bOM9jwtT/mTT1KkW0yqIXixXN/szwzm4 9r6YzlIFHRDXry8a7aaIKWopkx8WBA==
-diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.private validns/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.private
---- validns-0.8/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.private	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/51-support-curved-algorithms/K13.example.com.+013+18450.private	2020-10-05 16:59:29.358681397 -0400
-@@ -0,0 +1,6 @@
-+Private-key-format: v1.3
-+Algorithm: 13 (ECDSAP256SHA256)
-+PrivateKey: X3Mr05PnOJKClnUa14y2CdCCHUjkUNFl6wh1knpRKg==
-+Created: 20160302102736
-+Publish: 20160302102736
-+Activate: 20160302102736
-diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.key validns/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.key
---- validns-0.8/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.key	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.key	2020-10-05 16:59:29.358681397 -0400
-@@ -0,0 +1,5 @@
-+; This is a key-signing key, keyid 1045, for 14.example.com.
-+; Created: 20160302103027 (Wed Mar  2 11:30:27 2016)
-+; Publish: 20160302103027 (Wed Mar  2 11:30:27 2016)
-+; Activate: 20160302103027 (Wed Mar  2 11:30:27 2016)
-+14.example.com. IN DNSKEY 257 3 14 FWoMjTSsjInt9389me7cymDHNbntmNWejqPIzSsifAs2CdBtfCoN98Lv EU1eADIG4kkpKvVvQTYnoiUP/jsFQa6Uz+PmfgKO+PpyNl1fNy+bN7uE PJzIZhen3X6bIwYg
-diff -Naur validns-0.8/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.private validns/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.private
---- validns-0.8/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.private	1969-12-31 19:00:00.000000000 -0500
-+++ validns/t/issues/51-support-curved-algorithms/K14.example.com.+014+01045.private	2020-10-05 16:59:29.358681397 -0400
-@@ -0,0 +1,6 @@
-+Private-key-format: v1.3
-+Algorithm: 14 (ECDSAP384SHA384)
-+PrivateKey: U2ji19bf3QQ3wqgNm1/PJUcD4Bp17Gb53UIcSCPe9yNd665GOvlRSCQaKbr+IXCY
-+Created: 20160302103027
-+Publish: 20160302103027
-+Activate: 20160302103027
-diff -Naur validns-0.8/t/test.pl validns/t/test.pl
---- validns-0.8/t/test.pl	2014-02-11 15:08:39.000000000 -0500
-+++ validns/t/test.pl	2020-10-05 16:59:29.358681397 -0400
-@@ -20,7 +20,7 @@
- run('./validns', @threads, 't/zones/galaxyplus.org');
- is(rc, 0, 'valid zone parses ok');
- 
--run('./validns', @threads, '-t1381239017', 't/zones/example.sec.signed');
-+run('./validns', @threads, '-t1501789043', 't/zones/example.sec.signed');
- is(rc, 0, 'valid signed zone parses ok');
- 
- run('./validns', @threads, '-t1303720010', 't/zones/example.sec.signed');
-@@ -28,7 +28,7 @@
- @e = split /\n/, stderr;
- like(shift @e, qr/signature is too new/, "signature is too new");
- 
--run('./validns', @threads, '-t1421410832', 't/zones/example.sec.signed');
-+run('./validns', @threads, '-t1561789043', 't/zones/example.sec.signed');
- isnt(rc, 0, 'valid signed zone with timestamps in the past');
- @e = split /\n/, stderr;
- like(shift @e, qr/signature is too old/, "signature is too old");
-@@ -113,11 +113,34 @@
- like(shift @e, qr/name cannot start with a dot/, "dot-dot");
- like(shift @e, qr/garbage after valid DNAME data/, "DNAME garbage");
- 
-+like(shift @e, qr/CAA flags expected/, "CAA without a flag");
-+like(shift @e, qr/CAA tag expected/, "CAA without a tag");
-+like(shift @e, qr/CAA unrecognized flags value/, "CAA with bad flags");
-+like(shift @e, qr/CAA unrecognized tag name/, "CAA with bad tag");
-+like(shift @e, qr/CAA tag is not valid/, "CAA with bad chars in tag");
-+like(shift @e, qr/CAA reserved tag name/, "CAA with reserved tag 1");
-+like(shift @e, qr/CAA reserved tag name/, "CAA with reserved tag 2");
-+like(shift @e, qr/CAA reserved tag name/, "CAA with reserved tag 3");
-+like(shift @e, qr/CAA missing tag value/, "CAA without a tag value");
-+like(shift @e, qr/garbage after valid CAA/, "CAA + garbage");
-+## these things are not validated but probably should be
-+#like(shift @e, qr/CAA invalid issue domain/, "CAA bad issue domain");
-+#like(shift @e, qr/CAA missing issue parameter value/, "CAA missing issue parameter value");
-+#like(shift @e, qr/CAA missing issue parameter tag/, "CAA missing issue parameter tag");
-+#like(shift @e, qr/CAA invalid issuewild domain/, "CAA bad issuewild domain");
-+#like(shift @e, qr/CAA missing issuewild parameter value/, "CAA missing issuewild parameter value");
-+#like(shift @e, qr/CAA missing issuewild parameter tag/, "CAA missing issuewild parameter tag");
-+#like(shift @e, qr/CAA iodef value not a URL/, "CAA iodef value is not a URL");
-+#like(shift @e, qr/CAA iodef value unrecognized URL/, "CAA iodef value unrecognized URL");
-+
- ## actual validations done after parsing
- like(shift @e, qr/CNAME and other data/, "CNAME+CNAME");
- like(shift @e, qr/CNAME and other data/, "CNAME+something else");
- like(shift @e, qr/there should be at least two NS records/, "NS limit");
-+like(shift @e, qr/not a proper domain name for an SMIMEA record/, "SMIMEA host 1");
- like(shift @e, qr/not a proper prefixed DNS domain name/, "TLSA host 1");
-+like(shift @e, qr/not a proper domain name for an SMIMEA record/, "SMIMEA host 2");
-+like(shift @e, qr/not a proper domain name for an SMIMEA record/, "SMIMEA host 3");
- like(shift @e, qr/not a proper prefixed DNS domain name/, "TLSA host 2");
- 
- like(shift @e, qr/TTL values differ within an RR set/, "TTL conflict");
-@@ -215,6 +238,35 @@
- like(shift @e, qr/leading zero octets in public key exponent/, "leading zeroes in exponent 2");
- is(+@e, 0, "no unaccounted errors for DNSKEY policy checks");
- 
-+# issue 36: https://github.com/tobez/validns/issues/36 - $include implementation
-+run('./validns', @threads, 't/issues/36-include/empty-include.zone');
-+isnt(rc, 0, 'empty include detected');
-+@e = split /\n/, stderr;
-+like(shift @e, qr/\bINCLUDE directive with empty file name\b/, "Expected error with empty INCLUDE");
-+is(+@e, 0, "no unaccounted errors for empty include");
-+
-+run('./validns', @threads, 't/issues/36-include/missing-include.zone');
-+isnt(rc, 0, 'missing include detected');
-+@e = split /\n/, stderr;
-+like(shift @e, qr/\bNo such file or directory\b/, "Expected error with missing INCLUDE file");
-+is(+@e, 0, "no unaccounted errors for missing include");
-+
-+run('./validns', @threads, '-v', 't/issues/36-include/include.zone');
-+is(rc, 0, 'zone with nested includes parses ok');
-+@e = split /\n/, stderr;
-+for my $rx ((qr/\d:\s+example\.com\.\s+IN\s+\d+\s+NS\s+ns\.example\.com\./,
-+			 qr/\d:\s+inc1\.example\.com\.\s+IN\s+\d+\s+A\s+11\.11\.11\.11/,
-+			 qr/\d:\s+inc2\.inc1\.example\.com\.\s+IN\s+\d+\s+A\s+55\.55\.55\.55/,
-+			 qr/\d:\s+inc1\.example\.com\.\s+IN\s+\d+\s+AAAA\s+1111::1111/,
-+			 qr/\d:\s+example\.com\.\s+IN\s+\d+\s+A\s+99\.99\.99\.99/))
-+{
-+	my $ok = 0;
-+	for my $e (@e) {
-+		$ok = 1 if $e =~ $rx;
-+	}
-+	is($ok, 1, "found expected record with correct ORIGIN tracked across INCLUDEs");
-+}
-+
- # issue 21: https://github.com/tobez/validns/issues/21
- run('./validns', @threads, '-t1345815800', 't/issues/21-nsec3-without-corresponding/example.sec.signed');
- is(rc, 0, 'issue 21 did not come back');
-@@ -227,6 +279,19 @@
- run('./validns', @threads, '-t1345815800', 't/issues/25-nsec/example.sec.signed');
- is(rc, 0, 'issue 25 did not come back');
- 
-+# issue 41: https://github.com/tobez/validns/issues/41
-+run('./validns', @threads, '-t1345815800', '-pksk-exists', 't/issues/25-nsec/example.sec.signed');
-+isnt(rc, 0, 'KSK policy check fails');
-+@e = split /\n/, stderr;
-+like(shift @e, qr/\bNo KSK found\b/, "KSK policy check produces expected error output");
-+is(+@e, 0, "no unaccounted errors for KSK policy check");
-+
-+run('./validns', @threads, '-t1435671103', '-pksk-exists', 't/issues/41-ksk-policy-check/example.sec.signed');
-+is(rc, 0, 'signed zone with KSK parses ok when KSK policy check is active');
-+
-+run('./validns', @threads, '-pksk-exists', 't/zones/galaxyplus.org');
-+is(rc, 0, 'unsigned zone ignores KSK policy checks');
-+
- # issue 26: https://github.com/tobez/validns/issues/26
- run('./validns', @threads, '-t1349357570', 't/issues/26-spurios-glue/example.sec.signed.no-optout');
- is(rc, 0, 'issue 26 did not come back (NSEC3 NO optout)');
-@@ -296,24 +361,31 @@
- is(rc, 0, 'issue 32: SSHFP supports ECDSA and SHA-256');
- 
- # issue 34: multiple time specifications
--run('./validns', @threads, ('-t1381239017') x 32, 't/zones/example.sec.signed');
-+run('./validns', @threads, ('-t1501789043') x 32, 't/zones/example.sec.signed');
- is(rc, 0, 'valid signed zone parses ok');
- 
--run('./validns', @threads, ('-t1421410832') x 33, 't/zones/example.sec.signed');
-+run('./validns', @threads, ('-t1501789043') x 33, 't/zones/example.sec.signed');
- isnt(rc, 0, 'too many time specs');
- @e = split /\n/, stderr;
- like(shift @e, qr/too many -t/, "too many -t");
- 
--run('./validns', @threads, '-t1381239017', '-t1303720010', 't/zones/example.sec.signed');
-+run('./validns', @threads, '-t1501789043', '-t1303720010', 't/zones/example.sec.signed');
- isnt(rc, 0, 'multitime: valid signed zone with timestamps in the future');
- @e = split /\n/, stderr;
- like(shift @e, qr/signature is too new/, "multitime: signature is too new");
- 
--run('./validns', @threads, '-t1381239017', '-t1421410832', 't/zones/example.sec.signed');
-+run('./validns', @threads, '-t1501789043', '-t1561789043', 't/zones/example.sec.signed');
- isnt(rc, 0, 'multitime: valid signed zone with timestamps in the past');
- @e = split /\n/, stderr;
- like(shift @e, qr/signature is too old/, "multitime: signature is too old");
- 
-+# issue 51: support curved algorithms 
-+run('./validns', @threads, '-t1459259658', 't/issues/51-support-curved-algorithms/13.example.com.signed');
-+is(rc, 0, 'issue 51: support ECDSAP256SHA256');
-+
-+run('./validns', @threads, '-t1459259658', 't/issues/51-support-curved-algorithms/14.example.com.signed');
-+is(rc, 0, 'issue 51: support ECDSAP384SHA384');
-+
- }
- 
- done_testing;
-diff -Naur validns-0.8/t/zones/example.sec validns/t/zones/example.sec
---- validns-0.8/t/zones/example.sec	2014-02-11 15:08:39.000000000 -0500
-+++ validns/t/zones/example.sec	2020-10-05 16:59:29.359681406 -0400
-@@ -14,7 +14,21 @@
- 		A 3.4.5.6
- 		RP some.mail.box @
- 		TXT "Responsible person"
-+        CAA 0 issue "example.sec" ; fine
- 
-+        CDS	50458 12 3 2e40b2a6ccd2760ec70af69d1c144064c8931e53a6b3eee78bdb9e0bafbb9c02
-+        CDNSKEY 256 3 8 (
-+            AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27
-+            3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe
-+            avuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90
-+            yQwfC53hxyH10GzGnAx4Sutrdkh1w4HM1nMB
-+            dlTMa0g9yxjJ0vm/T7qHzj+3dTUi84s8Du2m
-+            fMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB
-+            /QUuoY2FyThfidT+nhOQpzftVtLcta0E0Uv3
-+            PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/
-+            byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01
-+            u8SJYP6ULwx0mZ0p5BmoMH8=
-+        )
- ns1		A	1.2.3.4
- ns2		A	5.6.7.8
- mail	A	2.3.4.5
-@@ -33,6 +47,12 @@
- _25._tcp.mail IN TLSA (
-       3 0 0 30820307308201efa003020102020123 )
- 
-+c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com IN SMIMEA (
-+      1 1 2 92003ba34942dc74152e2f2c408d29ec
-+            a5a520e7f2e06bb944f4dca346baf63c
-+            1b177615d466f6c4b71c216a50292bd5
-+            8c9ebdd2f74e38fe51ffd48c43326cbc )
-+
- delegation NS ns1
- delegation NS ns2
- delegation DS 60485 5 1 ( 2BB183AF5F22588179A53B0A
-diff -Naur validns-0.8/t/zones/example.sec.signed validns/t/zones/example.sec.signed
---- validns-0.8/t/zones/example.sec.signed	2014-02-11 15:08:39.000000000 -0500
-+++ validns/t/zones/example.sec.signed	2020-10-05 16:59:29.360681415 -0400
-@@ -1,5 +1,5 @@
--; File written on Tue Oct  8 15:28:55 2013
--; dnssec_signzone version 9.8.4-P2
-+; File written on Fri Aug  4 16:23:33 2017
-+; dnssec_signzone version 9.9.10-P3
- example.sec.		300	IN SOA	ns1.example.sec. hostmaster.example.sec. (
- 					42         ; serial
- 					3600       ; refresh (1 hour)
-@@ -7,237 +7,321 @@
- 					604800     ; expire (1 week)
- 					300        ; minimum (5 minutes)
- 					)
--			300	RRSIG	SOA 5 2 300 20141212121212 (
--					20121010101010 516 example.sec.
--					L2S8qd2eLKNZZSLsCwPtfw6oDRyWSTTj9E7a
--					7kt2uCnwCpNFFYuNSJp8NgEUkjWHO2XWbTSt
--					gpiz4jefzxG6wiLH7LjbDCNVhljKkwIlicP2
--					srahJ9oUGM+MdYXHKKHqAUsgzeQQi87psTQL
--					KzDjN7dV9LfxBPXK1TybQg3ME6s= )
--			300	RRSIG	SOA 5 2 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					HYXfJCuz0aBt+Ye/+vnk4H4EOHvhTCBB6+BE
--					TJLzzSCuNtrOOdhftFi58IHBon10OSsbrp6W
--					SmiCAte+JuijZ0VNK+90foCnW5qVJy/KagrV
--					U8rhmUcL/vMsxEBHtKadu60UO0800FNi2PH2
--					nS+VvXjM5kKA+F0HiPTaLcc9Z8Ez0sQslhmI
--					9LHgV4kd/XvXJ5E7oJwnd0Ex5MCXUwnFjvgU
--					t1iL7s8Lfryfy0av0y9z9+yHqRgywoyHiaF5
--					4UtIpQeezu5MoqbLDh8w94tfiAMxGJH20JOZ
--					ObaYPtc887wpOlh+iDNvAl2xKqce5KbGbxuV
--					21Pm9R6zjhEFlKlcvw== )
--			300	RRSIG	SOA 8 2 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					ICsoYt1gdoIS4d1VRon0e6DZ1c0nK3UDHlFr
--					+or12x+W7I63ZwFz2dOtV4nW2CN44ElhkxG3
--					wpNzy2V5XKk5uHWrc0aMttwsOq7yguu3Ieee
--					YahgmGBzbsPmwBszuMXyIyGH21DOx3cqe38f
--					6OT9RYiH8jYQtz7jhr/dR5eaLk3Tf54GrPQt
--					c9ltFgwgb/Z6nkKsOTu6OnjGxCsS++hfwLM2
--					Dp25HeLxAfdwyDqvZn+tIBgqh7+SAtfrhZEU
--					7wv0YKD7GCuxhc1ci+CQpDuHJOSBc/Se30Kv
--					EyPFRPCwIrH1IuVIU7SJ6UgNdDFcPGNiKmDF
--					Sl1aeg1YIGONZtlV4g== )
-+			300	RRSIG	SOA 5 2 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					ZUaelSGCJvMFzMaQy77tad0kbZp+dbTSPSrC
-+					T3STmG8SlLx5XTU+gh9TC9gogFrBe5Yv51an
-+					aMUSREyGWgjPeGQkC4nozxnvXsqC1THqjrZz
-+					acHk96pKiUeLhCiqXXM3XLT7LS5dIwDQ6SUz
-+					b6croHRgfwhbWakKO3Y2fjQjGxI= )
-+			300	RRSIG	SOA 5 2 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					VhaLnLhWTPgDn9mxsaHekoDaoO2L2Y7nQ48/
-+					Qf+LphujRkprAUB5p/FP+FCpuC0ZFi+6DEeA
-+					J9DB1CRxbrefursnTnM0HIGH8qv1pC5ugCWB
-+					i7St+pPPUULdxbasdVlAzEAo9L8uMx+qDl/y
-+					WEo/WCrV93FTM91rvLvd/6ZYDTHaIe4Q34xF
-+					5wgZ72UeYwh6yb4iCaY8BT7E85vpLnb3ljn8
-+					Sh7EyctWmJFUR6rHaMliVibGmPaYAjtl6NH9
-+					Lv8V0H8I++EntvLCzmrICcfr/ZHbZUUdvlyh
-+					bYOhSCCbR3GEajLJ/isRJP9se5nNdmQKwOtj
-+					gpjWyP5KqOZ0a+J9zw== )
-+			300	RRSIG	SOA 8 2 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					JeQBLagZYcSSUcjMSKqDTitliweSc++0c/+c
-+					MIbUjKIySJjFbCeDX6zaZ/R7xvCC5YR+nUVn
-+					byghJZoNR7sATP5a6pT4+7u2oYOuEjryqKZm
-+					Qo+KTsbcULnuyQDGMgyDtzQAoZMVSZF88AtC
-+					bLKHHgQhsAPl+g+1zGgvFKyoqmzPHuCidSeq
-+					y0pX8IITkES+PpqgO9VHC/orfwYiTRDdunoa
-+					USPwiXUpRMXwuPH8F0/BHkf0wWnk0/9MkhZb
-+					5Xmltt9L8BU/wO9tFWMMlvVH/CQX4swNxRlX
-+					UNDxNBboRczWb4mbnzjJRDm8V3RYlDVIh3fi
-+					pcyDncf5QtpJvKCgiA== )
-+			300	RRSIG	SOA 10 2 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					JwTWJEU0r+bSc1t5KXDRo+Ykd/EjTmpD25/O
-+					7X14X55IWELlUV1NKHUfGAE7JcK7HUFj4ADx
-+					tKMYHU+FQRcbdzYhTLwtWLYy/kol1WHWP2Hn
-+					9iCzY6Lx1ZHkrM23204osCor9q3+DIuTF2rT
-+					z6uDBeSF5SHCmft9SmJWFEgI9SH02Y1GDZB8
-+					FtA+EMe3pBG8o8yJOQY2soaTiKG03ZdW9Kl6
-+					De6Wdfg5nDeCN2idqN5l3AH+P773gnMfuaCk
-+					kRhfZ2dK++J6H/5EJ1MHd5BZ1TN71r7GSqUh
-+					+sLr/Qs68ZaSdNEF3HFLZ8Dt4gW2GvigoqTQ
-+					947r5ge941Cro4uP7w== )
- 			300	NS	ns1.example.sec.
- 			300	NS	ns2.example.sec.
--			300	RRSIG	NS 5 2 300 20141212121212 (
--					20121010101010 516 example.sec.
--					Is2FN6iXMylX2qYT7PVbW3jzSwLV9egXRxN3
--					Al8PGlBLZ55smhDdkDc64PiazFfK/u7FG6Qk
--					cx8SCA6MEVaDALtSU6qzYYZ89X/QBmdeQCUb
--					5pb6A7rMuvxWKZ07NAZ+M+kNBrcasVSuX7m+
--					7+95oWQo0gnaGegpP7UTB25zpM0= )
--			300	RRSIG	NS 5 2 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					nTskckPf0Gaj3CFbzSZXRA6uBQ3hDGPXmJT8
--					HahnznWdnMq2w/gg0I2VSmTb8PZ84To8bGu+
--					53hbxA1NBlAtydTFYrdh3H9qcAnP4ASJm8Pd
--					NrXWEl6N1iGiPXUHawBpWy44MGu5mqVqUHUn
--					tuO/ERBRNudhvp9zouLehgrtWcW5BMq2q8pK
--					R8OZxkd4YJtbVjv/1N1yVyRGkNg6XJLqbbf9
--					pW/btCU+JPoOJ4g6G77T5v7m7PH3yYrk4rTz
--					97KMrLMqh6Q4pzwr/BjjAV2vs742ieo8UKKn
--					tAL4GsBPOnd7EzFuadI37+EGrsSAHOMbnD09
--					yp7Gnu33Ql5f4Zr63Q== )
--			300	RRSIG	NS 8 2 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					qifctVQsOnhFpUz+d0xcVK6nNu1F2IYwrUhM
--					H+kwNTFYJByMGmiZ8Q7ezWD/g40SOBw5T/TP
--					xwHyXHRMr8uqbMFQsEPhAM6Ly14bj4JygnIb
--					8iuVfnTWzNhZAJficuuLFaX5u1aJY4N9MZCD
--					okYBI6AMIVuTI3GRQx857q1PxMdnUm5KmsAB
--					GqwplhjhIAhHuDygJ/2ZR6aQeL8GJTF9CdmW
--					1av2rJzOdtRfgHmU056Fof8tvB73SbW9Mhb2
--					dECJ4vYJpp/VfywREcLzcG4EcWDmgHvNgbzs
--					DhSEGXAj/ytIGRshPk8j8tIcHN//soqfV9dn
--					3Xv42NZTk7xt/Q+bOw== )
-+			300	RRSIG	NS 5 2 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					l+fqpS+kssvC9xvQ06eiXo/j4UdAYdNDET6X
-+					rL/UE5RLQMT1F+n4lqFawdGEFisSF9LszgRo
-+					xS67wAHx5lrm6cfOwkVsRRL7isA/tM/RYaFS
-+					4M0LqTuoM3pPIUr9qbFfGFRPW0IW198q2KMd
-+					pPveE8yc3AlJvaqh2/KzHNPrzUQ= )
-+			300	RRSIG	NS 5 2 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					zU6ylvFVb7xbpUbGbCwgA0xRLt/J4iZ+qYSg
-+					93c1IN3tkNEJkcnbkJfTwxG2kpgAdOU782tY
-+					lOyNMyT9sujFVSsdMxGz4MB5x2wefaznuJRc
-+					ERGwfwxGY2Bdwe4z1/OGQhU/wppuukOR4n3P
-+					WihMo2v04TqcY8lNahglBjvKYLPDWRiW1xJI
-+					XfQg5A0pha09ykfjaDmMyvUZ1BtnWtk0r8N6
-+					gVXDuaSWc3fqS0lcRew4PW6D37Hr0Dk4uFnx
-+					zNHY2QkejV1+FCRhZjVWzX4ycyIEHqXprWed
-+					iXnIiNdR2oYfoP8uRaSpoIhYzaXtfSvtXLQ6
-+					KgHjjsi0LC1sb3N52g== )
-+			300	RRSIG	NS 8 2 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					uHjuwG8FbPQqBkDSCaL5FIBq7tLnIPII7vGU
-+					dLN07Fb8jrCqYKiYtBWXn44JSRnhr+lJsbrh
-+					qTUkKmqL/jBSQwwv5nWs+Xq93/FHfzBLsM0b
-+					2YDVTCbFYY0ui0TU2BDmdkCeQbmcQXPI6Oer
-+					l5GILqLmlsnW5ka/jBA3j3jUBRFtVM2uTKTZ
-+					XUkzQAhA3F63UfnVaZUwA79ix53BvmnefD19
-+					V6yJ2fCs5Prw3jWtvQCz4qDOM+MnNmxeIYZQ
-+					jL/iW62FadgScYPSq0pPYYCJbPTMJUnTlfsa
-+					L2DRZ7D496e7XvgjP7yui+V9s5E+3/3fOZmw
-+					9hVp2SL65Esw48lmQg== )
-+			300	RRSIG	NS 10 2 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					RqC1fn5PA7hDmsv8/ZywJWMGF5NJAsCHZbs/
-+					0619xJe62kVDzky2pIT7C5XiDRwAdpvZeCh4
-+					0CRYA6ejFqQLai3oVuvcZFSenQJNmRxzuH/Z
-+					2hq84kGz/3bsEL/GQd3zyL9mNO7xgm56dm7m
-+					q+UIxNwx8FFOVVUBKSSDjsnCVNTZKYmwIZV3
-+					L2KdaKwOn6Jl4g4ZKuFlKyPadJM8tAO+Gjd6
-+					YJksXWWIiOoqpNwuh/S/9G9iveWxziHM35yu
-+					8Fs3Ty1oYSKnzWSDgfFfnKeGelcgNk/9KB8f
-+					8OHUWAApgWc2qbSxlhrs5McTKyhcdBAnqzbK
-+					WjgUVosg4Jnjn6mkzg== )
- 			300	A	3.4.5.6
--			300	RRSIG	A 5 2 300 20141212121212 (
--					20121010101010 516 example.sec.
--					REruNlWPhPdn0OwDISrhCIYEHLpL/9RrAAAl
--					JNlCRluGECUt4pKGBcNYsFl/BCu0ZSaGu0ol
--					c5gvD9CsP92HoiWhFjmJG8epEiblcUnQmYfK
--					cfqhRxb4Pwvaw5eP/p5ysBhhJhcklLs0eETu
--					UsqFT0LbnDHkLZL7SX0EvlMCNWY= )
--			300	RRSIG	A 5 2 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					Zs9ZU25qM+2tWswmMNbByYvJmFdC/x1Hzc0E
--					5kdb5Z7x8Su7Qir+sINQtqZ/CmPextOV746c
--					bgH5Yax+G9sCJK7ssVQaCsNB4rcECELDpQRP
--					6ca7+dOQ3pMGX5a6FGO+b3zucLdexkWf9VKo
--					zS0BTnjDl9R0sVr1FaN29YbjtRJpO65UVfKV
--					FkYFIaBQCS+E5/cLzTzI6iP8ZThhzgDd6Mux
--					cHxqGtb0fXKP5igpEcUHwh/+G5h5RthvSCn1
--					nlo35njMb4UR7q5WPUSrHCv1LB2KdqxHBq5u
--					ckS96/q2X/grY4NnFr8f02+ZwhHy77VqPcpL
--					SKoobHQkkMSaY8F6ww== )
--			300	RRSIG	A 8 2 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					iYrO6bkdXX4d8SU6yay5yY1rm3RPcr6eQSbv
--					NIZSiP4T9oM96uEXTeVt52RNFSH5E3FPctBY
--					LJ4wgga8MemwCNi3N+SLtIKQztAFb1TxgrF4
--					1tJXnNEtsMSpJFxNSSDDWye1BgAMF6IE99Jb
--					dGWGm+n/GV/UOCZrHTJs7cI+LtDgxJq+3dys
--					ZD+ZO2uncAm0Z7o93HQqHpNzmZmhNOy6RTaC
--					D2RIPo4fwSfI8LmbvOpCOUhdU8cKv/ruhuaW
--					g9163lz3Nyxj30S2TX1Aj6QDAZbGYgi+t+Q8
--					ad1dOqTam5DZx3ksjyjGDz4UEufJKFa7SG5E
--					UGLnRHbWGLZaMcGxcw== )
-+			300	RRSIG	A 5 2 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					q9IkSE8SR3e6sFKsFyHl82mKw1yDvlnHEUnH
-+					T3dHAyymmteFobaCSQqLTf7yWu8yu65kam8c
-+					g8vUm+VLDEeqAlXTXqDlNcUhPsIYQbHvdSr/
-+					4toES5X9eWZL3Qrcjjn5qarpIcz3woiD6d2I
-+					CHmeUgyU4ZCfgKp7kX2bmSj7a6c= )
-+			300	RRSIG	A 5 2 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					ZKGRCTHYjDBFSHJ2tyeo0kUhJaUdKgpO3CPx
-+					EYtOak3I4HBFUn20GvxV6gA04g6wqWUzJlmt
-+					1vzW/x954Fbz5Xz6N3JDFMmNRdXcqFqpGTXL
-+					zuGyMA2yo3O3sFUXOl9Yp1P6/LDApHS6teJo
-+					Kt8Cibn++ZrcgV9iF2cc8i3e0KJ/14LexPSw
-+					d39iokwrc0K5FECT8BhQ1Tv8uuDjOOA5WOQr
-+					9cslS2bR96gcBXHCVF9IA2ZfgUvpbGvYX7gI
-+					93Ke5wWxfT7QQkhP7Ux0ulEsNVXTxbDkqgJV
-+					5CsyxBOKQDWCc5iQ/IgQY2N9BW8sd9lZ+lgl
-+					XoFm3smgQQBd9lt4VQ== )
-+			300	RRSIG	A 8 2 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					qfWdvC+YOs8XEdMzPOgk3QeWMH5pLTy6Emea
-+					k53wChLO5J11ZVGRsILxP7ewn0VFmI+nzD5t
-+					QTvhSeaJlotPkgGaL6UOZ1SKQ2TurGbU0zpO
-+					/YkSTCGg9trliIPSafs6NEQrXCtyG889H8GZ
-+					pCZJ5YhNz22/F9/0vOfGrVlA9ZCLYOOwlx0t
-+					Um8cmyzWqOud7Et0AzF1t1D78iPxJ21/E0IE
-+					T36lf14IsoJNkcSZcEEg8Rc27vSQsBSUfIFh
-+					mjSmLmnHRwsAG26XqJ7enaGw2lq0XDDMzaFI
-+					MvdTfsmmUmhXXLUyuLPtYURYkgCvygI4uZas
-+					2xs74kWMFcRY4UxTRw== )
-+			300	RRSIG	A 10 2 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					dunBRK95/L3G4kIgV05yUMk4KeM1kuwpmtMe
-+					DpMxGCt4sG7M43zmcTN4lvcBPVu+pJUPmiFb
-+					3DnF0+R/9wEpy06s4ldITPCxRZnfNpYZowUk
-+					ThrnO6GK3CC7E3Z89l4p9waBb45Ej3igEZ0S
-+					8s4RNQhgKUdEnmx8uR9Qhzg0Ep48saui7vrv
-+					gsmf6xLopwcyaIRYaKzhmI8aAeBSE22Dh3hd
-+					x/Pp1W60r0ZHUcH9r+p8dpaesbSvRWbhKuBc
-+					TUSEaL5adDUVLLfa17+waGlZOFRHX92P83zH
-+					ChaLEKBDJt0RRversJ+fzFwRfxELYlOyYzD5
-+					qqVmnfrd+adA7SuQHg== )
- 			300	MX	5 mail.example.sec.
--			300	RRSIG	MX 5 2 300 20141212121212 (
--					20121010101010 516 example.sec.
--					gcagSolgEmDVIc5cU08Zt4K7abuJ5aXWxWbB
--					xe4F6fz2slHoG09n8WUxUz4duF4omLAtnuB+
--					uW+79fdn7p+EwhzBZ8ds8WIlGSdtI5edU6cA
--					A5SL2msnLqv512puF1wXxrVoNYBdkcBgFjlR
--					VLpKMhBZR6dsYkr552R0qcJP0UQ= )
--			300	RRSIG	MX 5 2 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					XXsoPIEF4nldBqzujYDPNefWYdo2BO31uXli
--					nTd+bjPT5S5fhBcTGqWSSOW2/hTTdEjhd7sA
--					9crpwCNex1BV4WySdsctwwwxSi/uQDbV4Ld4
--					GBtef94RFwtAiDs4kE7J8LjDrM10DKmQxTTi
--					KCU6u8LRyQCTS8f2XcX0HnM9z41z0y7USNz/
--					WTAJa0e4lVXv4wMPfQRel8TAgBc9RNUg9qyd
--					c8JFGlpxL09tXA7n6LvBoqHFDZSHf2eSBwDk
--					2fwsqHw1FF1fcMkAvsv2R8P0yv+oJkbT5Dv8
--					AKzyw2OVTBygImCZpREtz3OBs8R4vSN6RF1K
--					HTEnfuPVunKd89zctA== )
--			300	RRSIG	MX 8 2 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					qcDxTb50zfqGgiIsk8x+0pDm6AAFdCXy1+Oa
--					i3SfnVrUYKp+BUvvPPZasEj5+19O0Ih1jdPu
--					2zB/Af7jS0pp2LwdN5dh2fJGvf4yId1sZfD+
--					FjwRXli+F2MP+S9cEqiICk0aknEH8wEHNjJl
--					DkxtCWtYvfbNOJ15PhtgspolbDh+WKNgq0fA
--					JcCqkyaZIIQvV2YITqzXDHH0K+jZEqVIfa4m
--					SCbYidkbBkeX1JsaY/RX0u4mM/CcugGfrVdL
--					PxfeIZDJh9qJ+WxjR/tVSs1mhOBRTeBzlS3m
--					zNnlHJovqj1KRPFaNWu2Bg7V/9cQMr7HnoyB
--					hUkYh17aBRxZA50ttw== )
-+			300	RRSIG	MX 5 2 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					j6ABEspumt737VkKITDnM6TZ3hyGqUsKQDsb
-+					yHl2FEoebBXr37+6e/0WvoH1NFovuM1PEDTL
-+					lwJvv/YdNHgUmNphP581vUQter9/xMJXLwBR
-+					3BHcV3r1+djzRIJ1m4ZUXQ9Ph+B4hkL08/cy
-+					QSiVR7FHEMLS63nVyo/YKhvMLWE= )
-+			300	RRSIG	MX 5 2 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					qbcrNIqYGCAMB9+lVjpx+P8yAn43Y19uYbIa
-+					YQza9Vf2d7p6cosbcONv0j2WjTTImXbvooot
-+					RYyLHrwD9NwBMxhH4KD8am/tsgGouX6Bz7Nx
-+					kglq9UbRSRDybtEXbbSRXHh5WqGdifzmvKMT
-+					036OX6FwLoKLOvgHcEx+CyiW9Ype10LIhkpY
-+					VMedUPynLpXX8q3wqDOW3dK8XxEMQAr4/FYU
-+					pVj4cySRQTygwOfFHpLI5yPsm5VuWNLQ1TKX
-+					gLuDZfWLxrBQr/xK3RdVWTACo11JW1BDsRKQ
-+					DNjHbcng7SOFzkYzgV+BnMXy8n0gXqnL+718
-+					PffuMjRCkljCibvklA== )
-+			300	RRSIG	MX 8 2 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					yf1HatMaCU0CDEaCgtYKYzF4DlpnOBLQTHdX
-+					tn3Lh6unhrn39WlHivLzDoWksGuE3HI/z831
-+					iRT7iG85aqRlgQpX8nldszwKQMC7KUh0R9nL
-+					dsLZvHhEmUduo8dudHuGEcAjDUw2M0dT2ReR
-+					wLZb0wiGowmDTT2u3RhHsSW3hDYf9KVsQBf2
-+					G4ax7Oa2jdc/1y/hFJJGuJ4RmADMKGBKwgU3
-+					LQyvr12onH+SomYv7Wufa+IKxwLVVHRcP1+X
-+					yx9vTixTcTJc5iNKxa7bZwVwtK9HRYSxlbF/
-+					6T4+JX6RFcY0pWwFfvkNl15NPqTZyiYJzdr3
-+					5xcOWMMnvD7oVygz4g== )
-+			300	RRSIG	MX 10 2 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					AgetqsB/CZ/UjSj06mTeO1WM1UzfUxmuKIe3
-+					Ls+P1yYJBwv7S03HO62uuuU3c2cvcv2S/vR4
-+					bAeU8cS80cz05xQHMOvyvU5qesJuSM7/x6n1
-+					MV2rnr68KxlFev/ihZTDxY/VNykr0Zh+abNq
-+					aYrXROCjMak5XY7GJtxhhC/guZWTHKaYYMW7
-+					7AyD/KJQy3t4horHs1qRMLYVaB/Hmg4wlNwh
-+					HMvqfyQpPtKvq6fUX9DBo1WxAmkoJQ8C5VG8
-+					P84IlLD4raAPpmKeb1k+Y9uh3mU5CTNrYluX
-+					mgVTyqQljzutS8efQLwU38turMxqgFdABEdT
-+					4Fov31RylTYYHCpq8A== )
- 			300	TXT	"Responsible person"
--			300	RRSIG	TXT 5 2 300 20141212121212 (
--					20121010101010 516 example.sec.
--					W5OGt0M32rE9ap4wt0EOv2XYrHNL82jXfUHE
--					f/NlLZBTrsZgOtv/kUig/mfynYY9UT+Nabrk
--					GZ354v41yoMjRs8T8xYPW5d4U3CkeIGldzoj
--					ccJYgvbd0kfirTLnFozQmq/NZ6XPDeSUvmPI
--					zNzyu5MWG97toTkXWXwcoEcNOZw= )
--			300	RRSIG	TXT 5 2 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					inApW4wPqSfEMEHSrT+X9yJt/V9GJdSu4h8r
--					QvZurxth3xyqOezB1fdffF3Z37wd2tDdCwj4
--					f9vuTNlFYjVaQe5Q8555tnEpVTOjXxwe7FfP
--					cPGJEj4ufh2R+k5PDLqLiom9HZuFMR7qO6+K
--					iSHbnThFCwN99hX70YtHxlv+tohZdHpRJ+4+
--					68bRfMkZ15gQLDRcaXG83zN4QBup/n73eSsw
--					zWPi6ZUuMbK7tKXqLNupXS00QsIqhe4AucP4
--					7bjlHLo6a0g4ds73l6LSHr6Mxow968mM0dQ/
--					Uxhg6o4dFujGNjwEzv5bQ1LFnhgOyh2MG9ue
--					DgOl1BUANskW35uuoQ== )
--			300	RRSIG	TXT 8 2 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					QRfJNke6ca9HqkTzuIreT7bMmNbrEas3mArh
--					K84gox4s4Y0Ud7JPn4iusX7JyaIsY5Yzbmr6
--					BtfHTM0DFC8WgCdO6i37l/illpJOJ1TEZ7Cs
--					CT/HUSOVxvpOS94T2hEoDXzDZbnBhm0mRERC
--					N7VWoio5zxzX7Gn/iyNeJiYOzyayKPQoOyrO
--					KgfvlWnbk8MsN4a/KVHYAZ7xEYDCbWNw17dE
--					zP49wVJTNK6mQ/inKXnzmdk2QVBoNhE+OPHo
--					owIUzavwBUI0MiFMFtD9OULrH9JU+t2wja/u
--					VNzHjz+i1Ka2u1Y879b1RHCTFcDaH725H6rN
--					kQSSwyiCC5yemHP9Jw== )
-+			300	RRSIG	TXT 5 2 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					hOqntsY0coi126BO7dw/eTlLhiVA1DDo7/cY
-+					MHxaPAxvLpU2QPkvgie5T1eNwvJoezQPqieW
-+					QA21Naq0hH4x4YAPSDVwhDmKQ7bZJm7HeWxE
-+					EAA3TIr2tic5FI7kqhHeczvYX9CIB7lMA3Jv
-+					kH7xUYJrBLO15f7vrEV7yifJX6Y= )
-+			300	RRSIG	TXT 5 2 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					VoRm9hszby6JmfJ7rAhTTvsR3C78pkJVy63a
-+					Xi+Bx6q78hXFE9bGKW6qBqKxG2f6j3S+z+Na
-+					UL7QtlcYNLKVWgvaQK137pDFZMMWTp7tWYEm
-+					Omgxn3+2f+JWT/unaPWcmphlfl7fCEYqSkOs
-+					1YYTnVuDXf91TNo+mOwMVKWu2gg7WR0jp+Ky
-+					f1/2jm9jt8zv/0vlbOcMP5DqLU6ajF2Lqh0R
-+					e2gr3812E3QigpG92E3Eq3H+mZUKdzuBqHec
-+					B2j1iKEqfGpykLkzblvuzEUY1AL6nrOYvxkE
-+					4SnW7B09qh1A3opM0y3XZGm/DY+fjq32PC6A
-+					DHTdTuz+ftk6tOMMKw== )
-+			300	RRSIG	TXT 8 2 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					V6tkO6CFnsbBXhDYWuEnppbtLN62nD9q8LVw
-+					fAv6/jRAfw9+gJw3rUNaFg9sFwjhK4wY7FZj
-+					+JbUDX7izurv5udlORXkdMODC874kVdrbJ1q
-+					sE0JMu6lrzmi6PopiYeb7AEduXFJzktFIaio
-+					dCbhu9ZY3k0s7Z1Aox6cVzYH+KljAgvrsItJ
-+					olPKJpPajjZGJeS7LMxIcuLs3+LMfVl27Ehj
-+					Z8PBfomJ5AXShwdCJ8BzyD2ue3L0HKnMLG86
-+					+zTPVrjq+d+bxP4YfkYlpHQQ0cO1U0CkVlAz
-+					2yw006HbE5n9hjyLwNu+p51eDWBo57LHrxO/
-+					CkM5kIxNl7fyq2T7JQ== )
-+			300	RRSIG	TXT 10 2 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					fC7OMWgo/mj4cPKb19Npao6fPdso8/9zhLjN
-+					YAN8D3bTeAoioW3rJTCM6Jejx/KfPaXDyQ3u
-+					JeBO5xC5rGuE/RpGphVmJOp/2kFvlamqoP1R
-+					PgKfQC7lOcIQlr+LEE5FSUwLRgWsgeQS0waI
-+					AiWbdH+X+lFPBl8Els99WWcG95VzzMqC9r5g
-+					FB85E3LkLqLWoX+NJNGHVnA4c5M9m/OKBdF/
-+					4BckVUbGYx0piazHcCEvPQC1vYoxvBw7U6ac
-+					fz6vmYzNEBE+YAQi0bCSEjWxWDP/Qhl2UBBU
-+					OuyKFo1TteeBnvPSkGU8YludcfYHOMyIlSCS
-+					pgCM7uEM5PUAka1zmg== )
- 			300	RP	some.mail.box.example.sec. example.sec.
--			300	RRSIG	RP 5 2 300 20141212121212 (
--					20121010101010 516 example.sec.
--					JuqZzfAFhs9gBrCGKSQPmq2cOzZSum4PzvfL
--					mCXjZg5zYXZUoW3HKboRpCIkQzuKKZWJC4PA
--					jWau/6mZCE1Fsk33AqkHB18mn+06fPtmFAZY
--					UyRjfWmbyoKzqewbfLrCzdwqjfAVQEhCjPfl
--					jarWyvCYn155l8dW/oW3/ib/d84= )
--			300	RRSIG	RP 5 2 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					HfYsVtUxudMxdmeRXfXpjoJx7700b938l0GC
--					rjHmH054yb7r/gwvQT/7ZSglHRiCeLINtu0u
--					K+3ejMaADM1SIUS2X0/K/Wv9wO8i826CHjp/
--					EZ0X4GQLMKMqgvgpzVYldA1Vh2XUkPswu9Xi
--					/zvp/5SrjBPEAD7QlyO6M5odBvqIGUv4ZIJR
--					U6QaQakv0RB+gb1DLOwqwutpyPUZehMEGeIn
--					SnSZZwq1KUyS0Cma3KNC4aYUL/SboSeBEHPq
--					SXG8ueXAPNoa5fDP1DuiOB5haW4yomuRa0as
--					wBaFLcjw2tD5jDNwvLfUxB8QpslaUY+Js2M2
--					F2m13hC8T8eZ6pC9zA== )
--			300	RRSIG	RP 8 2 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					BfTyse4P2G1V/6L6JNZlEKT4OpNEXw4zIIDf
--					xz1iMdFHyDCng53xlDrm4VLCcjkzMmllaPid
--					HtZ65SfHpdJncaLFsFSSmeiSg/UAe485LSmD
--					KGgTxCHBmFT+FFoFkimbn8L2Jr7V2FQQ2ILB
--					/CAuWpBSogX5N6vssiLEbVcfIQlWzqod1qV4
--					TPC0xNinSmtD0eTep1L4ZVGJHq8ZI/+Mzzrp
--					RvUCyWEEAD2H9BBxhXY/D/qHeQsvpFVsJUwY
--					cahL/AIjdbksEMjkw/KDNTs6WZWRluskvVy9
--					NfkzBioZk0xGzryV8xfiBNbdVkei708PZDyE
--					BfNPJodoCmqHS0w+Pw== )
--			300	NSEC	alias.example.sec. A NS SOA MX TXT RP RRSIG NSEC DNSKEY SPF
--			300	RRSIG	NSEC 5 2 300 20141212121212 (
--					20121010101010 516 example.sec.
--					Q1MtdC/FeeI0yxUEuR2yE9LHjPdKttjFUPic
--					BpX7FaxE0YKgk3rlodPoL5dRz3rQWI7I1Wfl
--					EPQKOIZTWIFrRvjbDamwnsa25m8CCvIMUpbQ
--					CvuDHn5ycbpbEpaHfJi17sCylGoj3niCehwg
--					h/uOOigKQHLQK8DTgN0e0Ddxv9U= )
--			300	RRSIG	NSEC 5 2 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					bTXEqJah647l0EOnVO6SXO/XIJ3bQcFN/Ci1
--					jFvtPipkyk2pQvkwuWlRUyt8ip4fjuHgCDPK
--					D7ODTzMEiHVZNuh7bSv7LoW7bpM11ie5qnO6
--					TfyOYcHjR2lYHcDNjwGTUjadN8yiAFUBAXNq
--					84h34yKA3slx5DQLaNoA5a7XWr0ODsslDll+
--					Of9EwBGhjHvlyiJrXT3VMUg/SBGndxoIZrtN
--					CGON0mkNI1Pk/ZSqyib29N1U8POiP/wPAz1C
--					phG7IAlc6PUMiXegNDanaWQuPhOI4uV+f0tV
--					ZDFa/9mIAgF3rZC0mqHDk3h0GjJn/Ocbp4sg
--					RoGUCOcPuZnLlyJ9tw== )
--			300	RRSIG	NSEC 8 2 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					g9vjezK5ony2cpKX7v/ISk/XEW9VHFUd99pH
--					4QV6SrX3J1OVQ5PzrKCyN/Ak1gWSVrETtIfv
--					fLpvxHxBR8EWZdunUUTi0ElrhVY0xW/UT+/s
--					GjaCTcuTHRhw/ee4bdcE8aH3S5FCFzZPa10E
--					w8K597UiFyzZUF/LqjXqSoI0fUvRTSwMQ/ZV
--					AoNtBi/3dP6ItrvIirJLMdI8QXR/X2segPyW
--					DnVfK4m6OzyNbcAV/9NaycsU2L6MiUpwPTNy
--					um5LdGwiUJXfVRMbD5+CI/UaXhozoNbAoy5K
--					1Zr7mZzjl9l8a3WAkeAUWxT9H1xLWX9ux0FC
--					yO1REofyVJ0WPnGKJg== )
-+			300	RRSIG	RP 5 2 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					Po+c+7fuZHTa+aFAWg+6Jf7zkmr3qrISwh0n
-+					8sX+b0D1lS51TSH9ehLDSYjzVEJdGpkvun8L
-+					CfapnT2cqFvRZ2KN+7UBEbRjCdIYSfLvDWaC
-+					9hqglmtxuKcH6mR3cbBFbB5x3qm3qQBh4CL3
-+					5g/VH3btSpfLA5wq7DKJw4iEHB0= )
-+			300	RRSIG	RP 5 2 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					KMiPSeGt1Go/WLm2Gzs3F9SNXtm2dndVRlfl
-+					qvgNlyx/fpzNvW6DI0fLeTTTrZZy/nDsRgbr
-+					AbEqO7aCV1wQbGb+dZLGyyNp+VUkN4fbzgt4
-+					yH0mYU5ba0e0Uktpnx7PZMdbzfcK6C1riNBi
-+					M5B9hFphPcLZp7INI5JmfsZaWIKEOGrSCq6I
-+					rKVrt9XA1m0lL3Wo7e3W8bz9xw9WKhObvdv7
-+					Txx3b/ofL/PQBFiM2DLq7aJq+7BzLQ37UxqI
-+					mfbup3qpUPON6kKmMmY5PTTg5XdNcOqgTRzs
-+					3eXVJOkiXCaxnhMGZjPJJUOegRSpAguO5avE
-+					3qIoqGFSZy+WXuDzxg== )
-+			300	RRSIG	RP 8 2 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					yGFkdmcp30W22O5x3rQ+mIBM0JUZUyAUKN8R
-+					9RK1RAqw4BWmUwH5ZY5srve7QGirPNQSU+sr
-+					lUZ5dwOrqqd3wfqfhQsnovfsnXdrDOcpt2Nj
-+					VJWnFY8uyUAfSPhhSPgOnzRJtV7WniV8G/vM
-+					6ctiwxQQZKigKEiPMAj61AO9nZgiR/Jp3Xav
-+					yg8aeQvdPJ9TQF6xxlcRwfAINO1Ba3twvOp/
-+					t+nEETzM/KLyxy9QRh2WaosxdB8seDOoFvW2
-+					CU/z3ALKzwYtbNjxFNkJBfJqYl3GH+rf/V3X
-+					rO0hqk/GptdPtQ0Vi0F9H3adMUYpCavAE9Dm
-+					slXrCvKeq6b+16f+Xg== )
-+			300	RRSIG	RP 10 2 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					DW/0qQc6HV/qEEjmi7c3blTZAUajQT8Wll45
-+					ASYH4rqfwwTgHt9zSujALbDLuvN4Hi5z6qu/
-+					2xTGfnXj96YTvjYf7FHBWuCk/TH32bbo30zJ
-+					SHK+tWJmeMvUg4WnIgutXlbH0veGw/dYXyn0
-+					UuTX2K1kJvDNl76AaaqfRjF5jMXLQdJ8/115
-+					jRRC2t/xcuPQfzzPmFlTWG8yzjYQ4v2q74T9
-+					6W4r03tbvuLXlfC3+OBbyqQLCIIvgt2nmffW
-+					IHuLZZm67TD/XdMbeZ4Skqlx/WjrIs6kOZGf
-+					1f4T+fUmq4SDzbTw7qZ/wpC7a/FMoewKshJz
-+					CLI5G6UHTnuq098zvQ== )
-+			300	NSEC	alias.example.sec. A NS SOA MX TXT RP RRSIG NSEC DNSKEY CDS CDNSKEY SPF CAA
-+			300	RRSIG	NSEC 5 2 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					A6DDPO48A6D8JjqHyvCPkPshwnEHzbfIQFtw
-+					2+U+JGmN/b2/73aCZfKoF7sOS/hTv1hOwFX3
-+					OJGMeDATZrQBdpuWEZmsxnJkOXTg+0cSrAsU
-+					9WfsJqPcP+9uy7vyUuNTjCodjqTblFlAugTB
-+					r8BpDsXhD805y7/2pY9k1niJ7iU= )
-+			300	RRSIG	NSEC 5 2 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					pKsw4iVWwNUEdboHCHS4yeatbMSHHJY+ZTp1
-+					6lJUSVfaT5a0dnQul47LUCXJJ+E/pUl8G9ZA
-+					O9XztxGh+4ixHpPDyro8QTkj8FQU/V5dZGFr
-+					56NwBTHGJTI5RgAtIPmPJaeuW6OCfQscGSwE
-+					cfatGz+qCc7aK6ePVsFeT5yOD7+yutfmSgzr
-+					gpRn+NJLR76NBTf3rzIIisICXens1A2GtKUZ
-+					AuWmSRrp+wNBTpvKljRyyCZMd0rjTUCf7ZfM
-+					QiEMFBTXUEDZskHWx2fjVi3BtRtIUHXONrNX
-+					SAFQKqWDIQbegyQPhC9UWfqHaySU6Y7fj4C1
-+					u2e1kRAnAbeB3pmRhg== )
-+			300	RRSIG	NSEC 8 2 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					VW+L1LdmUkZTXASOdkCS6536gjj2cy0aVYk2
-+					nMAJG409aub4yKuwEnZWQZ9w95+RClowHZAA
-+					yjTW1vkANKbc/UYsIf3zZw5t6wcVDy31q/rm
-+					7juWmR7vQOmLYlsQfKjki5qBf6OuFwr/h5G0
-+					SNwcJjnAE0puBYzhhpTrcU9YIzkgxJFdnZii
-+					150z9V8EYr57R1HYRoSnVHx80KieBUilWT9V
-+					EUkKAqrlKg0fXTYRlLmltWDt5BC8sg1MmbMJ
-+					OwpNalmX761h7anEuIvWFSTtGHDDrwa5DDFq
-+					fEfV4c1WeqtfIe+wLyqPHrN7X2X0jcZYWOjx
-+					eyKHIEi3aUNDdzTVVA== )
-+			300	RRSIG	NSEC 10 2 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					Hd8cbN+6kNpmQCAtjTIZC+hv8nqe7uh7bz8/
-+					BczipNlRYc5TQ8pdK0acwWTHZxNjmC9RlKzA
-+					PTDGWmQHx2JmDSJ9aZxaA+xMfPZF5jc/Rn4G
-+					0Escxw4wCtITQn12adpm2EVJGp2uSQLm+W12
-+					o9ekxuVrJhKHpjqcYBNdcgDy7xD1pKVCJtKE
-+					cTeTAfTb+scRdpFJhjs12DhUdwaAcHAKxnbf
-+					EeW4yshT/UdvjD86Vb2BBySrLVtHqt2szk6o
-+					2ed/gMMvcFaaBQ7dVxv5dQcGqb3XjYV5RZ/t
-+					RAqCGyo27eBkWdLVzu5WR2JIpgusUwULkNFl
-+					vP/trHJpqbLnRUayVw== )
- 			300	DNSKEY	256 3 5 (
- 					AwEAAbqjCxtmin71unORku1IrrQx2S49KTmw
- 					45jnlNdreCH40YmhDZo26CMiVXbq29rvUDW+
- 					ZEJqVT5fd5GrA1wEEGbrudd2LDr5AedBK7fY
- 					TsZf/LEm32/Bu//KzynrJqyB4HSN3GIPbp3K
- 					YyY/Hl7HawOvWAd+tUHgUtes4trE/4pr
--					) ; key id = 516
-+					) ; ZSK; alg = RSASHA1 ; key id = 516
- 			300	DNSKEY	256 3 5 (
- 					AwEAAeluubFtl7Qtw4TpuZl85abGI+HXO4ag
- 					qzv1kSLQ5tkYFGdpZyZwQcBU2znMrdw03o6d
-@@ -249,7 +333,7 @@
- 					t8er3cZ1y62yOSbPK0SlouSRplbz+ezNyqD3
- 					c5zvz6F2AcZ4NqaTZOMWZbOowujQj3FxElaZ
- 					S+/ughQZKq3OtMN8bqc0tZ0=
--					) ; key id = 44427
-+					) ; ZSK; alg = RSASHA1 ; key id = 44427
- 			300	DNSKEY	256 3 8 (
- 					AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27
- 					3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe
-@@ -261,7 +345,7 @@
- 					PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/
- 					byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01
- 					u8SJYP6ULwx0mZ0p5BmoMH8=
--					) ; key id = 48381
-+					) ; ZSK; alg = RSASHA256 ; key id = 48381
- 			300	DNSKEY	256 3 10 (
- 					AwEAAcZdPacjnWNuQKCF8CPmUW1/NUxI/G7x
- 					dbwrU9lOuAD3sw14rLw2NTzpbC/bubt2aHQ0
-@@ -273,504 +357,824 @@
- 					knECGC8L/9o/R1zfSzSN+ay+dI45t+jOOLgW
- 					p5gmjsI/mXhoO6GqX8rbZoV7/DQyAR5rATJH
- 					W1eausJhOgE2wBJgl6V0XbM=
--					) ; key id = 1862
--			300	RRSIG	DNSKEY 5 2 300 20141212121212 (
--					20121010101010 516 example.sec.
--					RK/yubKLU0d+bs9z+qzPSNA+mSn+7Q7zDff+
--					uAzcd4tD0QvVO8jIQaVAxVWOfenQ0tovTzXH
--					39VuRH52UW0i4a9ylxlq1HFv96f9wsV6wGEb
--					sNGGMebDESHUkfMLIiZzAx7hmjX+YjlrYLEY
--					chOaBsoYc4pEtmWLHSL3Qc7TCxU= )
--			300	RRSIG	DNSKEY 5 2 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					DM9TZSWvwPIKkg2oB7NDRqpDMYGvl3sX3/BZ
--					2MALATpbDPQqJt+4b2837rjXPR7hP6cGTl0l
--					kjRc/wSqG8scYqQzhcUJ/j76jtFVwwggPycD
--					u0pgzl9h8lvR7pFAEKlQHUz+MXtVs51eq3GQ
--					NgqFVd2Nze717phEJJF0Vpw05jsZzqokl8Ep
--					/Dps27AslVY9vyg8ZNfJ3rgCl/zSsAcuBVfv
--					22+t0Y/crI76AxhqHIgxjyoQ3Bd2pXKU/1Dn
--					PI9Igw+1TzeKXoGQEHkN3ij+J8dL62EUgR27
--					RIFl3X4U2snEaznDXZdGd5x0Q1uv6V6+g1T+
--					rx3gnmitBrDbrhnV4g== )
--			300	RRSIG	DNSKEY 8 2 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					lepL7TovQDjJN5c2g9jMnrOUqljp6qrVjmeG
--					nSTWiTbxItUMzx6nWx+I44u8j9bpUYcPnx9T
--					HZBjOtGTqzDx6eepB0mWoUbqkUsj2dk9r/F5
--					uSx/I75XeT7vma52K3TLTua5AsYwaXYFOoX0
--					rXWRS5rlCY4FeK5TZUgfjvLYQAFrvonRtVcW
--					Tk/BdmDkKgvWm2FbJmCBEhQj5q6V8dIXnGPn
--					d/7mRQ0OmnQtqKIMzWhdD9Lpkfda9B6vzmln
--					tvOAUcHMgG9PGrEDAW/pp42douc2u0nDdpaA
--					0UkIFm60cDmMuDM8TOXZJQ2l6uLQGNiAWrsi
--					z3e/fFbUIkccz2LxVg== )
-+					) ; ZSK; alg = RSASHA512 ; key id = 1862
-+			300	RRSIG	DNSKEY 5 2 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					P4ilLbwbloDRSZMw3dHOXE2Zg/dNB6VmDPRN
-+					8jppzAKtKWHnZ83fsPeF35PvK2paDN2kFib5
-+					R+tcXaLVi5h97QacHoPhoqEujX9KdHkLG9yg
-+					vuJJvTgMDaKyzZPMTYUifKlzIGD4y4ChixO/
-+					d6HUDFMrh7/5/8kpVRxndGotgSI= )
-+			300	RRSIG	DNSKEY 5 2 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					YxpolCqYSlVhnOl82FFEdaGDj9KEkfl3+x0z
-+					gHhGZ8Sbaa3MTFE6C2tsYJF3f+wsvKE/q6mH
-+					WrGalB7BAaDFOmwRmjfV0DNA0MpN5h42yHJE
-+					5y9GXJt+5V1VXj1LdXKLLWAkNPitnrpNoB0U
-+					Ysk4X5tvcq1KrHrRH5FG6qhxaqs2TY5EFhJf
-+					HFPnLfSSOoWEADIhwoTCDtQ1EimNA/PXp45f
-+					Wh3Sb1TZZnJEXpvO55ZIMkeThZje5eQbhd5E
-+					LBol46Olx9qnCenBMuQV4JNt8u5Q+/Kznwll
-+					DVTeiRYfPEUYcEMtZrkTu5zbk19lgonPFI1h
-+					dBUv5/WqV80cQCq9Kg== )
-+			300	RRSIG	DNSKEY 8 2 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					1TfsvBo16W3Lu9h07C0n1KmRu+tOiwzQYccB
-+					hTUWq34DeYLM3gZ1GLRzh4agva7bo9XeNZ+2
-+					F5MoHgZE+DZbGxAVWbPcL1Eg6KB251PtEqFA
-+					4z/Dm8VOLRWohucVwAEQOOLqDoV6pPCTYSRF
-+					TRwuUcvwENzfHRNWIergssL1CzybyCmbHZiL
-+					x1NI5yZrkioHDFxO8XELJIOqJmBkXiCgEQoH
-+					TuBOl43ulF7vu/ZCvHKHTVdNRKacxd2+YXno
-+					tlGxXp/9GdJiLqwfNqXb2eYCi9RPwIt59ggW
-+					2v45h/QaiM3QwHo0b92jUusZEtszxTO2AQgy
-+					Eq7CncYxzcU6oavH8w== )
-+			300	RRSIG	DNSKEY 10 2 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					GJ3J1Iro3+XVgVa6by2QMOOkgrIKK2yaGM/M
-+					a48WDa4kfP5GU9ukoScgNTgp4rSB9hcJ1KfN
-+					eL+HUCA3/Dk0KrfjlN3TTWcxmB09jchuGQLE
-+					mdaas4WLf4PW9kMZaqP3KAddzd/B2cFAkK3+
-+					pVcCinD27AuhjiMmhHa98cNfNowFao9dWp4d
-+					GEO9m8y8lsQtinaGSk6TL6r1C8LQe2DOtNX+
-+					vufx3dH/MO7B5iqqENGHNuJFJIhAi1h8Gq3v
-+					d4x81B+HwNWDSWYYSFrBYxsKR2EM4v0amywA
-+					njeJPrvl/9GH/Pl2tNbyQBbwa/o3g/U+0TCt
-+					rThbMAyzhhZ9zLHcmw== )
-+			300	CDS	50458 12 3 (
-+					2E40B2A6CCD2760EC70AF69D1C144064C893
-+					1E53A6B3EEE78BDB9E0BAFBB9C02 )
-+			300	RRSIG	CDS 5 2 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					e+fYaOwAOKNB89dJKd8eKB3wB8zvnzerm6fU
-+					zIoeMj3xBnNxsadFJY3IwSjFsA2LhN8G8Nfo
-+					EUYyFA/D25gT/FPLjfFxv2227bpEV/sxfMs3
-+					ax6jNEHyuXSxoSQ0XNu2msJc5cdweJHbjcn5
-+					SaeNQCqYIv3K5IOyXrbYBMcD5OI= )
-+			300	RRSIG	CDS 5 2 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					Y8Z8cMmZhnW6vLI6aylycsAfrhS4PT9SOvD8
-+					jeNjLdL0EDgQE7+KXnpzVgbEh/NLte4ewmUf
-+					UbHsJxUgpmr0+ak5cgSqeII56a4hEHYoseC8
-+					RI/gtcy7BQFwtKZs9c9SjQsCN7j8+gbJASfa
-+					PIEaWuciKu2wsJkq6/oOFhB0Gu3232Ty4U0f
-+					4/oeddmd+t9p4sFr1jhWEKajJN+951Ux6cDi
-+					IbiCrFhBORncjuXu4fEpgt5wRozrlKWbKqzS
-+					ipV7G6jdhgcMv5ejDT2JrcdRcwtvSRWXoNl6
-+					VzbQVw4bwqpEyV9hErN+XhcYEC/vCoSpDfmY
-+					K4nkkXXs1XGJl+/Czg== )
-+			300	RRSIG	CDS 8 2 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					dlGP8OjPHifuzuJ+VSlO4XSRaG/ZJZTV0sYs
-+					uLm7G7bLGn+WPQRJWfQcggo5KBgN23/SoMfR
-+					2xA4+3l5e1RxAss/tCHosnh/EeVyTcUuTzxB
-+					3/h/pwu5x9MtnlJ3Ybuzpp3fFd251f6o9jxT
-+					K1GXZ5sT9E45bV22Mss4xppLrNY++e6cYBwx
-+					weUA/abG5emxO7N+Y0mV61IkoJnPtORbove7
-+					HxW0EY0fIe0zQviUi9sgxR3aj/+S1ZkAlonW
-+					dhWAP4jEGYRP1PIwO0HiAadRdpx1wf9ns3le
-+					PRcxl/jVvwVsJc46hgVGiMdasFVuqD2Lot1o
-+					proWTh/W00CH5mhBiA== )
-+			300	RRSIG	CDS 10 2 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					EhHaPji1zb/BBgFoCHHFKQgLzF+i6ErJYXh6
-+					cw2QLRIEHirWgQ/MmOvAxGti9on56Pwtn1oO
-+					D27t84B525KLRj3TJ7CVtlMR6YcJX23pfIrO
-+					9TZV4DPHFKf4lFmHjEy9S3QtEaKJDg+zxpnU
-+					0np89RRFeEXY/2xeDyt1AmyAyEuy/bdZPK3S
-+					IQrG8EdG18PAfx+fNlF9DxHgY8gmaeUc7b8S
-+					i6WCaOap+W+RFfazMm0NeppxCztBBh3gZsuH
-+					nqTCLlF8wxayKgJZgP+i440FwhtnbEZR92IE
-+					UVGOiDgb7g6FsgBmquGzXmCpG1gycBK72uLZ
-+					4QrJt3IR6XYZ7Elclg== )
-+			300	CDNSKEY	256 3 8 (
-+					AwEAAdZOvnLtTdQjfdIqqH3stb7vI6bJlg27
-+					3Tp4oRpnmnmgizDFtLQhnIv1Mr3AuwSWVIDe
-+					avuiyWIAtfvwy0f3EYIv8Ys5kDiKs8PE1k90
-+					yQwfC53hxyH10GzGnAx4Sutrdkh1w4HM1nMB
-+					dlTMa0g9yxjJ0vm/T7qHzj+3dTUi84s8Du2m
-+					fMD6noy+leZ2IuX7lFca8SzDNmhUPTkXuFrB
-+					/QUuoY2FyThfidT+nhOQpzftVtLcta0E0Uv3
-+					PcVDp1d7vBXsAEYGHr54r2vb3eXdOTmoFyh/
-+					byehUlPq1gDEH0mBRlWbUHqbGnKyolz0dR01
-+					u8SJYP6ULwx0mZ0p5BmoMH8=
-+					) ; ZSK; alg = RSASHA256 ; key id = 48381
-+			300	RRSIG	CDNSKEY 5 2 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					Q/H66+MGtrftHL5uJrHk72G52YySeOsR55YF
-+					iO6h9obTrFOHGAmfSQbpl9c6BtXYD4Q0ka4u
-+					xN69mHKv3qpfx75lT8X4eAw8dEB7LMSHXSUG
-+					VTpoILN/l/o25RZHD0SNTre7l38Y51ldNyyR
-+					0Ow/hPH3bflqakBZBHxhItz1chk= )
-+			300	RRSIG	CDNSKEY 5 2 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					aM0wQ2jtoBT4iGTjH2jrhCQ7uND715dnybkj
-+					GHkoVu5iq/MUOB+j5u9RlbhWnZhzD2QjG9wm
-+					wKJiXeAkcMfP0GhxGiZleIQw5JbAAluiMKh3
-+					aefZ62GRt8cgx7UoF/G1QDhxLfNxtgWCNUo/
-+					d0vqcBfTDlmNKfHfmoRj4nIvYC2HSo0jwGwe
-+					eXF0ROzqyVuRjqiSMixqp0HrMf0pzCMu2eSR
-+					zpL4gRu2ja70oDWpWbkO9JwqppVmcCLKT4kB
-+					bYZoJ4GUuryi5EyrsaL+v53wtd+/Y9Skxv/w
-+					qjAz46S4OCGlz+Nueep13x1azQ2VXj9ztAit
-+					AAik5G5DcQuxAAjYhg== )
-+			300	RRSIG	CDNSKEY 8 2 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					zqO8HvhNJnQMcmfdq+2Xj9eR60eWLVaPn018
-+					ViP7SXl/EILd/T23u9gd6/mI3cL/tYUQMAlC
-+					6IGnVwtC/pe0Hirotkuq/qaTYtRtDw+d5cwJ
-+					pnshJKtVbgpPUNsu9K9KyXxld3kkQGhh06XR
-+					Pp3WEoJoXfJOsRSzVCarGXrE0UVU3ekpQf4D
-+					ofLndCuqDbMzlgPli3xPXhDP9M85fqFdkLel
-+					FNyDU25OlznZCbylUszJ9Aziijp+D5+FPV2t
-+					Avkj7TngL6y8Ux88FjK8RYy3YqVrKV0G9Izw
-+					f07LCR43sLGwUTzcsgLkq+F0MtC6VIbjWLAc
-+					bgZrlpLaDd+c9D/7SA== )
-+			300	RRSIG	CDNSKEY 10 2 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					awyvSG3Fgti6GD/VOBhWKU7ULLz8YTLimth/
-+					0w41WpGMwnNYI0Zd4d8cqzjubtFUmxQS9JMU
-+					ICxmZohryh7zJYDUHv0lJTKO7ZoACqfwz6Mv
-+					/xw0lMvHIdxtx77SbxwOXeLOXehqH7fDo5fL
-+					g0fWLZ7AcK/98a92sd/6YOqxnwQxpmg/17A6
-+					MZwNwC4e5os11OGrEkurBV3TJAbg/HeYYacH
-+					N2K2dx9ldGeHzuK1js9zrMATaCzUkW66fRLY
-+					lZVlVCAgezGCk8hz9+fDxSC29z0Q8qArpwH2
-+					q8PVlkoL9tisnony2JXBRkoAcZRVVC5gk4xe
-+					gxlNWk3j+HCBifW3Xg== )
- 			300	SPF	"v=spf1 a:mail.example.sec -all"
--			300	RRSIG	SPF 5 2 300 20141212121212 (
--					20121010101010 516 example.sec.
--					RWs0sDBYmiqAGzP2gfRP0p6BzzPh2XqDpCHZ
--					LsDaCmlZI+XIdJy/dV9jGNwJ7+YWLNA/gIIG
--					NcIj8HElceCzlv14z84hL+8gkvOU90RX/bH0
--					wIXMQDqo68JwQ+A65V498Hf5ouzKbRitAFu9
--					zEGiW3TXhWUilqfjFm3H+qoeS/M= )
--			300	RRSIG	SPF 5 2 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					cpiGOZZZsTeROsxC22DEBjuCFs+GZOXwY6Wh
--					le/jrshFrjjANERcA2TrQRFXS+GCxkXb7dI+
--					ZxnmaSx4uh8PHcJSn3cIJt0rZgPPGX12S0qI
--					vj3iKPG73VHhBXiXC8tq5+mEi3/2u9+HJLCk
--					Lfc3fFJUamhtsElaLsGX76qgnr2brb5bf9D5
--					avjPRA1mPQdxCb6Sh8iC28bfXQBWdLolNDNO
--					EefhmVLU6H399dMD57mXzuBKWRrC6L+i5vIr
--					KfNKRqodm8AVJybAZImBONQybIkpjMKWNC5z
--					MoNqfYxskZS/W3N1jHAXFush9+MltyevFvxm
--					VWQ14I31At06oQfong== )
--			300	RRSIG	SPF 8 2 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					GILnbrIqzGeuNVHG0GigYP/SKkPvW55L2QYo
--					/Jmd7/DauvShmxW3KWZu1QD2ibJi7evbpysL
--					4ktJ67dzhfTpWHFsKBPrMTG965iqcckIfWMk
--					5LPs6hqjvCyTS1qWcCxu7vYsNyp8Dyb1wWgO
--					5Y4zR0X5MYFVaDOZ3m/td3SFVKTgawkOtiWh
--					24paSPl+lzbknBaLtaG6TYFS4MTsdlwpApw2
--					V6s2zSaoKIXQbethxFAqWNUOmxp/Gcyusff/
--					UKi5NM6DAsrWfuLRkmGD09bWbtf0aPIzTVZT
--					CaQ3Ys71cUBnJbb73qUCO3c9MGxIpJ9SU0wu
--					UIBe5nLshMGnv4voEg== )
-+			300	RRSIG	SPF 5 2 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					J1CgUN17y4TVrVx2Px5NBViQnRwZZ1rif58h
-+					xAWraY5kbgB7yw+zocCb1QnCbGTgCelQIh8T
-+					buel4rpUeMBz98B/ddmYyuzORK6IAB5fLmlF
-+					oNZhHWG48ugKZye7C8ufjmlskIQeRvNl5kd2
-+					fq7t/paVl/zEZ0h0r4uJ8iG6u+4= )
-+			300	RRSIG	SPF 5 2 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					QPQCtQuiqPtrebdPeC8ESc9TBfF3zl0rjhFr
-+					wlNdlK8r2Fp4L6X7idnbctf8XXDidxNxmGDT
-+					/S7B+h8j3mg5oFcGzy3oH7jMp64D6xQnGeLB
-+					l4yKn/+ivG/wp2XqZXMTdp0+GJ7wQ20GzGZQ
-+					dvhBZd8hbOXLxQhkNBXbxBY08M6I94FJxH+k
-+					kGlVUaRQ9GM0qxJ4nCNfyyv/NqtRW3W+m+Pg
-+					Fe0xLO5I+imEsv0CIFqB+tqHbtVLUp7dKccE
-+					xqSIIF4ygsyZoFdHaw4GWELh1T2IwDL+Nh1r
-+					jwAxojherHL6mcWELjYndTVGiZKrbhLthkYM
-+					qG7o6+f7IUf5jmzNBg== )
-+			300	RRSIG	SPF 8 2 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					v53uhdO0bwgxTAhCJjZ42bUwqB2P9vwoU0m5
-+					6Sj7FsK66ulyw2+vCXJsHcMM2KuuWViag/Wk
-+					NfYqWObu0K2yZXgrhPtQ+VYKeiB1WHlI4mtR
-+					oFSIlUM3VVwJeUkzeRRyRJkOM+oV59ZIRnVn
-+					lQ5skC2Oy9n7xK/XjmxvSady7f1eyB+L9iFU
-+					ZMVHTo11KNT5B4T4tb/S5fb6sw1Vcmwyo0FN
-+					sCOc2LGwFRcIsqzPWn//HrT1SQSdC9k0wx1D
-+					KAg2s4cYl9BVcVtAx++Aj6+ym5dEEmUCyM7Q
-+					BSptcl/7fM7cIZv4WcZbbrKuPRQJtIUWHk9l
-+					wPvhWuJoLblxN7sqdA== )
-+			300	RRSIG	SPF 10 2 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					gRIEs+4ZWNO30DTdZecDsPO95HLIaWdqiqhU
-+					moVflYcA80XkyETHzrPHp5VM405LSbGn0eSw
-+					ZYD4b4DFpW32JTYKB4f/8VzEPZ+AvXePGp7/
-+					3YkBu242xZEXBcaqNtsxXnPcgmFKbPb75hVd
-+					IkY4nEezPgjcxeDY6Ajnnwrhv8/g1yTX59pz
-+					QvCc+IB8V5IOf7jRA6axauQ2CjP0jOBxdJNE
-+					qVF4OKnZfaWAv5amGD4uNBn9kRSH/2UpcXJm
-+					J73in3qfoWfVaSeUBo+U8RKrUA/n3qBjqWXg
-+					ezkT7moL6GrpZh+0OWNtXgL4z3gpmFDZ6Ruz
-+					7cTpzI7N57Qx1ZALdw== )
-+			300	CAA	0 issue "example.sec"
-+			300	RRSIG	CAA 5 2 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					Tg2gLgMkTTPnO9hug8P6TthqlZ6wnTiBq+Uf
-+					14qlfD5tV2N8MgxSoLtsTxFvTjeGyqUgEAER
-+					/vhVAfPWsIuNSytedrfj2EEqeakpdX+b6De3
-+					ZK2jrV4qSl0XQB4qw0ysjmM7stASKavOqsOY
-+					Iwf2+42Xcd+YkIbLoqrSDfko30g= )
-+			300	RRSIG	CAA 5 2 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					gpg6iv7/pWHCzCF1YBKVzA7ShtvV8vnXNxxd
-+					ojv1wlxkyI5LADHaKjdkzjtQq4CF2UIJkRsx
-+					VY1y4KC4EW1ACUIDvBDMtN6i8wMLhySsdcjJ
-+					kkUoiZc+h5VM664Nezhf1bU+1AT1hx0vC+ol
-+					dXqs1w9EPj9i2iId4Pd9tQ3yiwH7KthYLXap
-+					DVKxtGb5CzgkRfeZfJABdPs3eH8LWHc84sSk
-+					YWD7/T1wjlR6MtAeZcTTrYeq8o1dBtBndqGx
-+					gi8q8eCGdeUNAJ33fUWmcuF50IcCAmCm01lk
-+					pNRxGOXjmEChnCk/diNW1bAo/11EVATR87Tm
-+					LwgrQGG3zYsglEs6bw== )
-+			300	RRSIG	CAA 8 2 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					Zdnsv+j/2VJ30qQ7jFzygrzbtiaSbJACPEwD
-+					pojI7+IEGeYWQoUdTRiZjg8Tay4iql+b1dao
-+					+HOlfIxvl/w+Vp4TgonTtydcYICCKZKZdrYB
-+					Hf0GSMJrdaCU5HV/uCTdrww44dXDISYTph4l
-+					KTmdeqIuDDk5ZZ28XaqGdCYJg76YorZxzS3e
-+					332BzPBKjcWpWhPzbKXYF1070AgXlvNsboGb
-+					JlFdYBNBsMqwsl9PolxURfsEKsnrz99cTAmX
-+					iV2xJGYHZjSY3+t7Uqt4VtD/8faeW0kgkMe/
-+					Rktevt+UQJGnqif6dDNgJOLFvtOvb/rZWXNi
-+					6kRM+l0MghRD2t4ldA== )
-+			300	RRSIG	CAA 10 2 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					FnjAGBYlAWL7ggOc1aoaCIkF3VC1032MYoVn
-+					6MRBImO7EUnTn3K1Dx0n8AgIcgvMeg9yZh2q
-+					tojGJa/mtZK4EOdAOhFu5uRxbnKJkLaNeezA
-+					p3opWnDyzjGn7svDJyR3cQOqXK+cboNNhOso
-+					xOvTJ0MHrvewpouObAcI0Mlz3mLeZ2G0vVF4
-+					7Bkkd6vIj3yYLAf1Kg1HoDFwvlInz/2ivNhK
-+					xULcE3F8UA3b22eXVZELVhHtXrO+c4svKAcN
-+					3OF8JxVNlerqnknf8yth9JA6InizyvkYWBHj
-+					RAIdSn+7LzDfK2xHGxNNTZ5U1l0ILujJETx9
-+					ej96BYwhqb1uKmyV/A== )
- a.ns.delegation2.example.sec. 300 IN A	8.8.1.1
-+delegation2.example.sec. 300	IN NS	a.ns.delegation2.example.sec.
-+			300	NSEC	delegation3.example.sec. NS RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					N/dKyieQ9YnNG5ryp9kgvgZ4AfvdPQmNcSaO
-+					FA3qougSU3JVYOQ4bxep5jTEetudM7fhgGwD
-+					I7yRzgmc8oohiHZkG7yDIeC6CG98nuq1mWSw
-+					xX1AtsxfMHsujDeXf6wNuOsspPXyVBlW2t8D
-+					s5urv/DxCx/mG2uUMJCOa1mb8+4= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					XJWlVH5VeNY08IT4AJVGBgTynQtXEfmXrXYx
-+					qjE78snQZCvPeHMi1U200oRQm0Zmd2b5S3JZ
-+					8LhEl+4kyBuUQC/cldgf6/3s2PT+usLt2yxA
-+					jek+W8y70jKsZDyCE77+o6vP5TNpSl6VyxKe
-+					uvUReVYe/i/0elQ3kj1wZHTjt597j3ZIdpgU
-+					phKgDpMnubf/oT4jvvJrbDqUwjZZVS8Q9ZNl
-+					NLkqbNt3pri/tqt7iQkSeZBN8dZtLk3GrUPT
-+					cEGqeqUPDan6N07uUU+/dkJZaCN4cF4a0foD
-+					axqfzCZwqTw9cIr+1or0AncRm6571VU/CSuh
-+					EejAYmuqnQtGWoLT5w== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					MZN/l5ivOmOOhExQL79guD4yuF1LCMVJZ3PQ
-+					RT7SLcldN2kS/NTb/0k0lHR9/1Yq5G4Vc8Lv
-+					F5A2Gji1K8V+l1ZQ2m/033/ykTcNO1SO+ivH
-+					5IRStznBsusEGtfRb4FT9Y7mCQJgXyACCFeh
-+					7meti9nykB8ncGNC78QJtPxp+SF4DpUhmSVT
-+					OVBxS8RsZJt2AB4iW1cRsv4DF6M1UuuJ1oUG
-+					uOVXwkfITlhdLt745l2T8IRZeMrmv7oWS76r
-+					UIJmQDevvc8/nCXVFVdfEwQ5j2aE5BEr0DVf
-+					zhMJ5hGix+XI/s+kW4b04nyABcYnX3ZNdB0k
-+					zg56eg+gdrZiXuMVMQ== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					mgFMIU5xdIzb0jgvbbMeEmWbpLJN6Q3JZ+oG
-+					bfAm4hJHf2kAyKJTRf2HEFfNCFb24JTVNAmm
-+					jhpcVOxXSQgSD3ffrLEUt2k7qSNjXuCigI9E
-+					OvRhoM2fP2F0GqcRVYbTI9Lykf5QrP01w4e1
-+					wG4Ho3FCF65As12coaPO61Uh0xBTnNf/mHfC
-+					NAc9PMrhh3p9m0/7H61ZN1IYlNhegyIODuXu
-+					fTdp8ajmcku01RQf92W/JacU1dx+1kvqj4dZ
-+					aqykIHIOzqjxoe/m9eiVOHd7cegzT+jwB4Yh
-+					svv70irBU1uZimJ88ES0PI4vfl+ALKMcf+jj
-+					6Q5apgo7p8DXVUafjA== )
-+delegation4.example.sec. 300	IN NS	delegation4.example.sec.
-+			300	AAAA	2001:2010:1::feef
-+			300	NSEC	ghost.example.sec. NS RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					bNEy+yaf6tq+ZH3QnqILlmvI4ldeebL2mbqR
-+					z85MyEaz6BTDkarnglIi1X1lBZQcHrdYJ4Zm
-+					IMSqzR2Mk05r4uUOvDSosTExbp9HNB1C0SB/
-+					BeJ1uQ9HsJHNDAM4F3f+m3tGQZndW9yG+iAi
-+					5Zs5MJJWvQoFDHcH5GbRjCDogMg= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					pzswCphGA9sNJ0h69aFI6KaTkcNZ51IN1t2q
-+					aIR+EE+vjpcSKCVJPJq/UNWcqy3IUjDogL/H
-+					T1ez18wmjK7MWmelQty2EXm827Z+CJy7Wbnl
-+					OytU5grXG38bVS06wS90YtDLbIww+kfoyJsY
-+					k/CqMg3mNA6HsTlmvD42M4tZIRHOUFQ2bQKd
-+					nuERZcn0drH88OS7XCbiWkVWNmI0p6Ud432H
-+					obKFUJf6U3+B90sPPiCOF3JckzBJ6yJPj18k
-+					8fLbEP9c9zkvb+SOa/SxxftI3E+BtD84Y6zY
-+					SowCCa3xSNdgVKpasZAttESD9xLvEC2E1muy
-+					GCCB2d1XvqANp2rgLw== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					ZowFOEUjJl8qIdNa2VGuREBPDx2PtBEicdWF
-+					giLk7tJNxOgwyf1waNdHiuGsAaE6M5UVDOA2
-+					GfOQ/ip0R62WE5uAifSxpiq0MmV8X1+UonIf
-+					bWeNWYwtmq9Y3rAxzHK/3b4P44DxxicQyZSX
-+					lDs2XbfhhGVWAUIFNVYNlA+2eDSEUsKfJ27J
-+					7s6AfdFdAAvWEGPolHKJ7glnldElabkxhLR3
-+					5z0VVuJ+zQg8bWmZ+WkwE1Z0tcvtQzH1fH9K
-+					VvMLjDnOVhFJtd4fuEpQA0pquEsEyUUvVlh1
-+					SKNk511c07lXNTOZcaVtU7ZTuMmtJdELerW+
-+					LX6+Owt4Cfi38f6Zfg== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					VxyoGuLjUDV2f2ENKsLnFdoU5Gv7+xs3gkC8
-+					6Vf73QLVIwFbVXfwZ/PocbotObAdgIpg9XTv
-+					0NTeKjwu4/3PdeVeHc/+AhNWpdIfi29Fxl5c
-+					V3Fyl8IUbDOhaBxNStjddyKcuLCtE14t4Jss
-+					SLGFP4oDt6NZlWVXSyOj6Tdhllj6B7ggtFQF
-+					lePkeKkSRYsXQPx778roj08/7k7I3BED7irn
-+					4D+mG9cDfB1hK0CIPD3ROfh8ER8rBt1mBT3S
-+					FBSmz9F5G9cz4YeWiAMso0zHTOZSt0pAsg6i
-+					YUrh9mxA5uFILjI+4U4l+xi/CbC8mquemg8q
-+					FaXnwHpcxf2yNqL9CQ== )
- delegation3.example.sec. 300	IN NS	delegation3.example.sec.
- 			300	A	1.2.9.253
- 			300	NSEC	delegation4.example.sec. NS RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					CD0RsskZkRqESk9FFf6Xs6V05y34ogZVMQxb
--					xFTmXwGXFJujPot8Y+r524aHtZ/TMT+5jmZC
--					272lf5THZa8L6GSmjOXEShEzE/NxK6QPi0A/
--					41hyTDLfTdMeS434vEArzjCte8vFi3Gs1lke
--					ALxfuXEPFlqShzRH049QIiKVb7E= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					aA3RBcFysyza0jCN2bN4fRv/K+NTvsseUw1p
--					eM39ciePCxg20JhsGDWIMCqpSz5R3BLPemSg
--					ll+B8CuHMCQPLWcb3vg1WOTpSPjIZxgt97I8
--					VRfGga9FWxyKk9qohvjVIBKOiROE15OKEnVl
--					1T5dk2I32BaWKvOxQEbjxYUcnLwPPsostvWQ
--					L6e7vsDpFPh2boW/x7tc9oADCX770TPVtS7d
--					0Tn6eAganiw2SzgDHsRcOv3Y3PvNCuBxxUla
--					dkOsPk0Aeho6Go50N6Pq5u9P0EXZQuMN9NMp
--					cuwn3kotN0XoYBX5fIXnsEsZceiyCDntsPdf
--					sOXRjg+PmWiM5L/nRw== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					bnK6CJhATrnBj+HNVW55je0rBI2Xsvqfhv/C
--					IFNaesD3eRA5Sq23rZ+kRJuZb7JlndzPKfCt
--					axjm3m/9GGXf0YVUvMp/vRvxgemllQn9ANyh
--					d9KTnEK/L9Fn6KgeT+tti4RkIJB3ok2Yllv7
--					uYg3IUDKKrDjETppQeoFKuiflHbAnN3s9wta
--					HgF5Q1/jI204i9Ausup4wBjFYpJTx1J2Z0ak
--					zg7zjw5H0fgnKXDGcmT+ErWWMsYYsHMUx6CO
--					qFrqpP1BnRdOBZ43Nt9OTgUQMTJ+fTJwC+pS
--					Qxa9+P87gbXCGoV7vyCiYcla3oB9bP7Hnztc
--					3gxrjI1G4oUg2GdHbQ== )
--delegation2.example.sec. 300	IN NS	a.ns.delegation2.example.sec.
--			300	NSEC	delegation3.example.sec. NS RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					fvrYyP2h+pG+7CEEE6CjzruLRi+9yentUTE+
--					AOxJs41pEs11Uw7MR1wO+TGPxanzJlJwvJCs
--					9xIBZE4PQta2AKqyAML/s1DeK4a392qPUHrQ
--					8N7evTS2KoOKH6F7pdXOPv6xOIhm54ufg7tb
--					QSr2Ngn3jQFH+rqQqAQluTNXjys= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					SUDQwaDyaGV0a554BvxUbJzFjh9Jhp6Xr98B
--					/pFXzUvJMcW9gvlAZiWh+Uu+h0w5449aFAFU
--					I3DByimfOIJJG+iPQ8A8I9u5W6goVeeB6WzT
--					QL24+e8vAjLrLCInHxlxAQGgkkX1hhFMceRW
--					+pZyxsS2uBt11jCVM8y8qzVkQE+3gU/DODO8
--					8a7zd2gNNNJ5RIdigzvPxvVq69FGfl70nRLZ
--					kMBnQQ1Ot/E5KysoprCbEeYSVF3wglFxCmcs
--					QAJQ9Fj9jsTrBO4M3cQFJcB5KjM0BE7+R57c
--					yxg7ZKMMMgqe/ubt9NvFJXQFQfQjSmB/3yR7
--					Zczk4Z8FScb4NQlAPA== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					ItHnrTkwSbhG9tYZQKAC9XCRmKkt4lSWrXjB
--					fn5Vwm4cf66uVFkj6gHNGapR5w/Vg+snvffp
--					gzAGUsgkLk6+xxbFcGGoeQ/VwflWsDWTtOau
--					XsChTTVnOiQ5vTRhUOmDOHXGk/LF60FaBMBG
--					R8p9kTtFe6sLtstuVvmMw/e7gfJrYMO8IZ1A
--					Wy4rnBTzf1MMKZBpJJM8CAyDq3dzinjgFkA8
--					/cRwH0+7ODBbEo7r492VOLMzbMWXPBJjs0kR
--					yZeI9lxr1Ah52WIw99mOAWQ6TW/w4RxsP8J2
--					Xj34MwPmIMR3Qy8sf+yeHeUD4cS0woHOlpyu
--					ButVE7zeuDPgS+Bojg== )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					Sa8w0Gtmmmt/koUXa1jM+pR0blfDb8uQjZ5z
-+					sWR+Qtm9pUeVi6Im7ZsLF0UvThhPB4M7Cssu
-+					e8mZq8djWe24yfoROn/CM3Za+Zt+pN/CBStQ
-+					wecdIEwY0NuUTqDpc8eqMiMfi+FQkMwyxO0X
-+					SXi+6wfLZMPqa6E1Xko1mHO0VUE= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					GxBmASFjw1z882KzO6qRQuClpk9VCSyJIljM
-+					qCqfjKKdGKqLkvcn2DsfsYj3ZbJo5hgJKumR
-+					1DPrHFbRBmjAWrVZ7kXxTTvhZgqekSldo1wf
-+					cT+ssNVmFTm+VTVY3Cz8msNjbtv5VLiE5RTI
-+					fX370c0+cCK/6svDtnYgw0vj/3bayYxQ5sx/
-+					R/jE8CumJ2FNuGx+6+/kDO7MZsNHJ1glZqTW
-+					FCS/2wybR/N8ErEihov35j6Z5NIKAZqG3oXJ
-+					g4WjhuHc9fhfZLn3uRVd+USn3SNnjm35UODX
-+					qS+kLeFvQvLiWYuiJQTiqPoYQuup3DpILMxo
-+					vX9mMUHILutOYGYuFg== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					w2KrHdEoyXYzPAg9cqx8vF1hhc4zdjSvEjIs
-+					+sb+ZgrHKPRMrezf6zQKIjfeZ1DyeMN8nKsS
-+					cmzUOuDUKoytvX8Xo9FB2nUqU+Y8RRao36FV
-+					4PXOqnmsyHdTAQYFAGaDXqYzQvt3Ev+KRa4I
-+					CjGzwVhhuijSskv393NNJVeTKXIR51Etz0DO
-+					kdk8SamYpitDoGSLr7oKX3nw6Fv//+faGdk6
-+					zQq+tcj4Gu09nrfe4I2RQDcsMXJODv0RwF9y
-+					64ilGuRZxsN81sM8849uzBUDdNQIxd9Tod+w
-+					Gg8P7AFxWyFhhhfO4lTS/OiLCgG1yYT0L2l/
-+					pU5AWah3d8VT1PzULQ== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					kMb4PgqThtSZSJUiBRUeSOJl9S4toailINo8
-+					Fs7wG0yqMzI4jZ3YiI6myWiw36m/y66X8P7d
-+					9eYomaEbO4/1QpUNDtbuBams4KzWVygStswe
-+					2AK0VrZV1o7RhaJfQ5PwWc6tYMyepE4NwqUe
-+					0t1JF/ktw7yXiG9vcy4copaYnqLSnfgotG02
-+					3sc8f7YAMthm4/o9lAtYVCWGwd7YIiLz6CHR
-+					kcbfRn61GqNKUOTJU98AEhIqaQ99iIrD9gtA
-+					q2p6eP9YH+jR6GqXjKKo93hrcdev0rWPD+Bp
-+					xHVStzs6Fu0frnAjzPJCNjxD4TZN9dqp6Ffk
-+					CfAF8X41YLSdbVmSHw== )
-+mail.example.sec.	300	IN A	2.3.4.5
-+			300	RRSIG	A 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					uBuhc3/9thGl1UkMMxLoI2y0Pck5siv2bm9y
-+					8ZZ+mj5n5CxMtY1dKg1Ie5AnWUklOceXespb
-+					eImHlRcr05gVBSAYkH00hANMWgnoTSWp05G9
-+					78/14rMVC9XfuHHYqL9rlqZfRpKTELPYuI4T
-+					YReeJL4DG82WN46CGipmhSFI6rQ= )
-+			300	RRSIG	A 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					vHfCAnnCsulD6AXdpDClBtnNThqRSxwC5Wxf
-+					Pj8toyQqEvGV3I8bh3/jq6yWv+bjTHBLy6qQ
-+					X8Vob50ezCFcdJ6qlwVlVHGjsPSL3wXvaxKs
-+					tG3yClwy/UmI2Ey4UUy8KBRrPvOHhn5f+LAe
-+					yOM7IfPPDDABkDoLXNJpXLIhUrTjhB01jhvn
-+					wcdGmR77QBF5+I9eZsrQC2Dmr4xwOcOWYRwQ
-+					398LmCuZYh10X/A/IEcTm8SxnUwfAOw0Dg2J
-+					TRnU6Es1ag0nEU2dOvwVVefqm4F4H3ZeEaZD
-+					qZiKvmf8vTWaPF0X0RKwdJVu0sZnQdNFwliN
-+					mhVCgnMLtRLm5f6QEA== )
-+			300	RRSIG	A 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					etcmhIlYcyL/MJWcI1HWKYQRKlQN83SJglUw
-+					tqMEDQYvC9aIl/EnWp9OMlkEytl8dIdpNMIH
-+					+kttjnxmoyY/CFUXXbNKGxc42AZB8NCNeT15
-+					EI3YE2LNP4kG4dYDi/2K/05eel6U6JkuzByW
-+					0vC0DCRqvkI13r+igDp73hVta+Ee9JcfrokV
-+					RLO6X0nK4P4a1RxI8OVklVOQ9Vu5fWlxLjd9
-+					ki8MI9V2kNiVvNVyQFb4IW1d9qjZQgsFQIco
-+					uL6IMWxR9QCQd9cGRxOD9hodqObsm2E2YYPE
-+					/CtMpE6hpAjVm6oSEyby1oHjFH+Mzzv5lfvY
-+					AsBXgVPKeK14Q5P45Q== )
-+			300	RRSIG	A 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					Iixa0xKHw5w70HJ7xYdvFk4iJLyMJ/4puisU
-+					NQZKnEZqzFEND1HdtplcWI7/GW8QWG+D9Lhr
-+					XPCbaPSIT6al1gHmLUpf/nCsI1fL9VY8Wyc1
-+					ZHhsyItDJHwErbXBFo5tWpqM0WDjeFAwJGI6
-+					ZjC1VeRX1FWDelXcVPMP8IZgQ4fbGrdC60Kz
-+					Wew2YFEPdiHXmCZ2t6t1lfBdkVKlNqLEWwiD
-+					Yjl0liXKOy3t031LLN9z5PJ+gpWePwFpdlgL
-+					Od2kmXBTOKqB54J71py1NZagoTrEvXGNna+F
-+					MDVkqdOv7ExXbv221atZOF92xIxuzrto7Grp
-+					3c21bdJDbX10e7+Q0g== )
-+			300	NSEC	_25._tcp.mail.example.sec. A RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					UydDK1ifmnSxlnDhmxEwiku23EYm1B6LEeUs
-+					AOEFtlkFDCBtn8LUir1HwGsOwRNBTPi0ofN1
-+					VpUdcAF91RQoZdVogjJKKirldqci3CFH+Cop
-+					YV6WTOLLSidi+O+lykt3ejflrrEBwuKUcu0M
-+					UWfVKWQQcEE+1KIS6A8MGLCtxFs= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					UYRGOZZaoYg0FnsImfKW3p7J0CEMIzYBHYpn
-+					PSHvUKIuBVID44uQVNVqJ5KDaO4squ0FgrC4
-+					PKqMjExEcZAi3e57xuXWciHf0uQT60mvXqMT
-+					LA94SOC9CYF13Qft+XY0TMB0ufI0BWTuBDK0
-+					qDpYKa9fdviwmLHJnXyrJxYI2kKFE0fOkoaE
-+					vGa6B/fSzSzT4xpk1zrsWbfhWM2X6uY/Wv9d
-+					KKnVw/S41EshBwsUWKLGqRigyn8/XOI+baoZ
-+					We9+JbSu/mbIi5w2TqBndKkFwnb7mKUCDz0Y
-+					SLkCeMywApytF3EgQggb68sDP/vApt0YVuy1
-+					oJphlerS+RsWUUSHXQ== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					thTuKDb8SXg2IgbU0MKhtlU1109j9UGeo1OW
-+					cJAqAGfNUC9vT0qzYQxmmZiCBDBzsBu95Gtk
-+					9k2cORB/Hvn/CY8Rso72t0Um3ergBfCcA/Dk
-+					57XAb+oDYV0sIBnXOvYpNAO1pIhFAgfMnqUB
-+					pKuslPOMyHR+E3lrbGHplPYlDizLqJu89WhC
-+					TVU1yHuCxFKte8G8ViRE8RyScNC8ESAQQ3bR
-+					HA0Ido9+iy//ZnsLeDjnOicKNo22NS906s7+
-+					DAV1P1BaW2c990zO03dJa3mFAR9p8nbwsGLa
-+					MOtXlTufHBjG7WcMq8sVpQSa4HGP85TAxHzP
-+					SKalXVqikQeiV5P0Ww== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					jGUL3AKnEao3XDQBPr2ZErCmowkDihF1kPB6
-+					SZfKAI1VisPEFn6kZrucHNAW9842HS3ihvB+
-+					KbIVa00iy70o0O9CHTeGherk9iNwiBI8YEFd
-+					rkZotXFk+fxpQ0n8G+nkCSaHLSoXvp+i91Qi
-+					/1Zi4hkldcfdblH3mprbZMyFsaxBIPjNma/4
-+					fzYZ0hVl9RA9mHtU2Ef+/uS7X1B4iu5OrRIv
-+					8n2WMz4F1KzLzoPglO2oEoprNMqpDfvxhQ9J
-+					d+jEsiyciHPPT1us5hWnPzfQx9POSCUn6ZJz
-+					Mzup6QnKCWT9eTJ39BNgUYPK/0I6vypmlb4M
-+					eOsytBhJVquQqQl0Hw== )
- delegation.example.sec.	300	IN NS	ns1.example.sec.
- 			300	IN NS	ns2.example.sec.
- 			300	DS	60485 5 1 (
- 					2BB183AF5F22588179A53B0A98631FAD1A29
- 					2118 )
--			300	RRSIG	DS 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					HBXFIbzthhFqFB7YUceWeSHsb3jlbWvhJaqa
--					xqhh4G58Ktbq/eD/ODKJWpTwDsrwK9neYp1P
--					En/ZfvmBZe8jS8SmdTAWt0Ov3yMMN/lk3rEQ
--					vE7xlsCFxk2MvJubUBaTGK8Ixf4mSJBKiew6
--					2lxjroBoK2AV84tScm2mxTS8GMg= )
--			300	RRSIG	DS 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					zf2WlfNwFRqt888jC5ORYqgHeMp0TLkO0bWP
--					tPcw/hgyCF+JdqIXuEDyubiqGZD7QQM0xEoO
--					jLprcOG8ZdTMjhW5JXBoyOY4B5MfD1Ucy8Of
--					4onnUcP4Pfm91xuXr2Rb3RbTDyfqCyJ1fNsA
--					nAh7nOChJmxHJYz9oH0AfQvvClUWd16inwgn
--					XIOdQxDmKkEtdU2u42FwAk6pSiOzR6zbJ1yo
--					lXWeINVxL8TxWjVfq2XIzwXFEkWMftDQjTwH
--					/LX2aueermN2xa5uqOqDVhsLG3PHR3sQMFTL
--					heIY3Vietpxu0LMZgiL2IaNTLWEW+mhCvtmq
--					aaxKq7kSKxjg+VU9pA== )
--			300	RRSIG	DS 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					RLaaahYnGiGwt0y3MapNhZ1wrmaK4pxp4fMx
--					LgK60SNOGymW6JfnoLIEDLIYG3m8mLVhdEvA
--					nt/5739u2Nu5HN3LQLNeeF4Kcd795Ns+Lggz
--					bte1nVdvj79L4xd+5woTs4FgD+gO0iV/i93n
--					Qy0MlnkNDN1js7VU1ONSb6GZu2ggVO6lY6hl
--					+HeOX+9xIdD7lsJj2UDZWKV0SLLT5kBDxLvs
--					I9ZA/u9tce30uEEpmZIopF0UABHzqZqm4vNs
--					Qcr3jP85Kuw25E47Bpgg9RIirITAooac4jjs
--					qVh/ydgLMzoklcPB3tISSIh0x1iKvnWVevMm
--					aloA6DajwqBSlcA7nA== )
-+			300	RRSIG	DS 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					FFR1I0RCKnQAiZjnbYSa0IChopcJV6xwrejk
-+					g2yhwUF55yLgmICr0qC8OyfcctHIzTl6At9Q
-+					s6u6wG7mDqCxvD4wv90DbJb4VheGO2rHC3Ie
-+					Ie5M6TKqHbcOxGKxPpJSFBiX+hnOwAjcOaez
-+					+fT+MPZavgQWjfYgIORMjw4JULo= )
-+			300	RRSIG	DS 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					qGi/8U4Z1lYF54aGwcxLdgZ7vm+14atpACBN
-+					XGF1qFQjL1W4d/Vw/19KaPuXsjHJPOmK0Zce
-+					4qS1hosa5wPnJOJBUmUOkRW2tVojpnmkKaSS
-+					jbjcQiTlKHcUNPMJrNVrwJHtOMyZjCwzdzFs
-+					mnzLa7yW+CNoP6mHd25bErC4iZ6MDi7j6Q3Z
-+					+MUi63BbUUNxL6tuCl62m+pr+0ShsCvwd0IN
-+					l5+OI8VexQOydES2o8NxoRwR2yE7a0MELM6K
-+					AurhtViy95nQ0kOYJ/0sJkTrVsbZ/RHnnlzK
-+					czn/6D156tN9pL5O5YYwPWDQRC0Mq4DJMi0j
-+					POol+ZTFys1OfnVfrA== )
-+			300	RRSIG	DS 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					0JohpJrNEFwcDbffWpOAU/L6O3e4zO0aK9aK
-+					P5X8BQMj0NHvQGZXE5PMvB2pZLTyi5zq9udg
-+					/4Vv10Qbn2AMV9NpIyj30nhsIZrG2ruDjaX6
-+					I6xW+Yp+LeS6ddDekBCFtvgvxP15H3T1kAmc
-+					kpfHjCfTnKnoxgOBqaNjYe1YPwo7jXJ+qOVs
-+					SZdEglCSJeVTMsj0W/YQdJmwOI+gbWNA78jn
-+					TMAgWMbbsG2k7B2VDhYLwJQgZbm9vIhtfJLW
-+					JxdEbMCgVB3d5O47Su2nPTXOv1a2QX91ahRn
-+					BFxhhCn9/9SHGxe/OuK+XwzxefjfMyhBWI+3
-+					OecSui9MhQtAhwIaHg== )
-+			300	RRSIG	DS 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					YkXhW2eX/F2Y2G4/eH2vJ4PEN24vLCFmbHho
-+					RR048doWiquWN1qmVsvtrVxOs+akCqItazVO
-+					KyoVAGc5Nc2OM57Rz+4kH2V0crWCrIRZb88I
-+					+5/e0RFGe3+CDnhIl1V8U9JqlmFq2QYknjbP
-+					gu6QcwUwJbxff2mFWO9RSmm2/ARFMfjMfk0j
-+					VVA1o3/e9R18njNijmnDVtVd3fp1aUQCr4R0
-+					C7VbsG7+pEicPaY4B6AjWp19WZQLU56JyTyj
-+					E52NU67U3QcED0gQhj3Bz2nivJDKnq2XelzH
-+					0/EC8vV9BdqDBLjMhnXq+Q9jREKBWSNjaPCc
-+					ieTw0KM+YQIAtMjfag== )
- 			300	NSEC	delegation2.example.sec. NS DS RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					syy7tcQTts42hPpDms1kF92e/4duPtn5wuuS
--					CXMw+C7aIIMEm2EJ5BHtjLfQ5Qh5QRieCgJC
--					S6aT6hr9DXCfmXa1x+Ing97VBoYll1GxNDup
--					xiRR4nXam9d8T9UM7I82L6pV4qF3NSVDGiVN
--					VqW1wTPWEwRtGrrRBOdUvn2KyXI= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					EK6oHG96GEBKuirll3p35bCKrDylDYOj65gc
--					9G4AwWaayurXBAu4iHZhA3ZjBZXixobktlJL
--					vK+B/KshG5zYwVeKDnqYNMuCxJ9+u2Py7u2x
--					9uqcQyp5KBF63aPbvS7+Xg6alNsaEKQEwWjc
--					7J3ZbvMgG4Q4fVR0LO7CeGcX/tlOc1WpBH1m
--					txhACsZk+Qmy78hC++X9EVc3CA/AwLoGvdhe
--					UMpclz6uk/C/ZklNyRH6aRZlJz834wBL1Ziz
--					EskVYIosekKpA0ZCYl/V258dnetBE7lvQ9Nh
--					qE5JngQyOQnM/SGPFwDQAfGcXIlOJWzhug43
--					EhL6uVCHe05lN072Dg== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					Mq68uAgzCUU9wD1ybPMBlyEFcICEkgLbS2iK
--					ZlvdlYfN2GQeiBznSdg7y+Ss2eXoNfZd8ouT
--					9FIAEbWoKjg9k1B3/HXVtzW/QsdiLFSepgmL
--					nusgNfgcSIwNbN12g8YMgETNLFnNon8te2Ry
--					SWuSK6tJ8vKPGT9CA4AaF35qnouvAStYplKh
--					EaJ//UGoWLvKxFPCmTP+RAyLgqidOvJTAZmf
--					gLELI+A9SxWI1oB4tKd1Vc2Aq8NbNBx2Z19b
--					cvOQwBuAuiHRmqiRzHPP6jVBBE+pZ/wI4izT
--					c+1oSOo49QSpUUQlLIGGjnXgh3IRV229rSiF
--					0nPycKu/3BOUo5cxjQ== )
--cert.example.sec.	300	IN CERT	URI 0 0 (
--					V2Ugc2hhbGwgbmVlZCBhIG51bWJlciBvZiBt
--					YXRoZW1hdGljYWwgaWRlYXMgYW5kIG5vdGF0
--					aW9ucyBjb25jZXJuaW5nIGZ1bmN0aW9ucyBp
--					biBnZW5lcmFsLg== )
--			300	RRSIG	CERT 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					PdA5ui/NfwgzxQhNBSwqyniuI9QpQedtQqOm
--					7waMIAXEi4MWEeZurjJwA9ak6EZYHkR2V77Z
--					n6YoD1gXUp9iE2iX50VRLjDMawHVUmovD59P
--					/ArjKvm1msx+dtkgqLAXj4v2If3LLcyzO4s3
--					8mjrp8phLeGPISo17Fen+xUeaJ8= )
--			300	RRSIG	CERT 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					qFPPehUwkyZhjdJRqXk9ZMJ5ysPmR83af3hF
--					91OGr9i2wnC46II2o1sxfgiL5F+jNhOYyUv7
--					QnJWJn3+iqIomGnCHqSYy3JoGpG/fkZBSwek
--					icxxnvyzEN73tf/EOJ5v9akWPOy2PPyd0L8p
--					xQWJlqF6EZlAuC5a+OAbANZEF94/2YIGsoKg
--					wXy2cwTZ701ujeMzvivyuuJG/rhrOZUXDexs
--					FH/UvREmOLuqyKwelfB64BEJBuk+CuASeabt
--					PE1b86qzs+rU9nm0O2EtUaImRDVJSWXP3x9b
--					VflYJbj9rnzB/4edkLLNuMtcpLvViHb9FRVV
--					XU9PQ7/uGgPyPRdnlg== )
--			300	RRSIG	CERT 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					Rf95qrkQoPedfcRlD7NfdpGeti7JdKouptkP
--					YtLUrzwhsb4kEvcI0DC+Ua3jhpDhPKCPZfrN
--					VBBhmeAeAIZdn/MT7wMKtChGA4VtgI61jmir
--					2/K2a2/HFqW1PRwWx8NqgFz77C0PbTpOesim
--					qxsjYCyGJF6HOpKhQ1DBWb1+twt2n3o6lj3d
--					wYBnveKohQBkK3Hl8LklRFjSkbAU0Qj6309h
--					OZI4p+WQrZ34+92ZcgcZ9JLYDv2qXcaj4bOq
--					E5lThX4NLRIjx44fTzrLxW10W7bEXPzgKZAH
--					vKoRC6GHp6hh/xsGdTCX9GPNf6S0YkVzDsaZ
--					ZrXvo2sNO9PmPNuBQg== )
--			300	NSEC	delegation.example.sec. CERT RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					njMBdqH1BnBZyawcmbUHT5WDDroJDBAwc/S7
--					YYUAUwoXwrPSRiW2aGYHdAKZCbH1M5wrynoz
--					L4xfEkZlRD+w8m9bN56ydnY2y34RgoRZUq7V
--					2Pk0n/2P5f0wB/34J3KKkxH8ynxv1Jm8IA8g
--					XY5PuJebRYA8mxXF73/R+NyR25o= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					lOgiQTRHuvOXU2k4XBQ50x693t6Tb5Hz18Lw
--					tjrlZKsXHb86IbqP7pgD9c7GS2ov2RpQBh1q
--					AYsmibLelbjFPppFh8EQz42WqjTL1PM7bunF
--					KQSgd6pea32ewp7RMYfss69A+nsVD8t0HFNP
--					JyzUkIAjM1knIYXGPeHfPBQu4XpOzVeF9783
--					ADEQs1c2oFAA7R+xmuoQh8jX/JDQJuUKEwHa
--					u84k89GZukCr7pLssqLybZmAYvsH6ajR/NrA
--					Gv4pjGZWz4wy2s5h1mNMkEFqm/qf5RWqsfKw
--					kO40Yr2jfKOfTUrmsQjLdvjqBMzgzp+JnAqw
--					tOzTeEWGtkxb5JVWyg== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					uRSh10E+hDBZH22j8jZqRoLvz/rzQQzcWR8Q
--					/ayzqu+xizpC08tLr7SGBjqlqkFCvhvGoYkT
--					X/C46ItvNtx5YDLMuZMeuxOd9RcaTPeVbhfe
--					TjfQ7Smw3bCEx2PzZvC3urA5Owvi0/JnFvBW
--					+lWGmDTnHxi632QrfEQ1DoL/dJCBkDUCcYRX
--					4lYqzXXO2vdJo0GrghtIor86jBy7C6nVrLb6
--					xe+oNfz7aBlXm8JGXTriXKa0LUbX/xu0Rox2
--					ETgm1G1e3HwfjXxQ+NCrHLUOxHYeq/GDi9NM
--					9r+jXTD1gNvMpMCTidufsGDpYMwuGEhCSXTr
--					0q4c+Z8Vv5GyEEb/Gg== )
--alias.example.sec.	300	IN DNAME anotherone.sec.
--			300	RRSIG	DNAME 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					hN5znng+AmkGWTmle6Vm+xCIEgGtZHOX7wu1
--					L5tQbdQygpRWAL3AEvI2B7zqOURAokvl9Dqp
--					2O6JhxtxxH7hTW8wk0ZeL8SAWXGe+Dmw7OYi
--					lnDuO8DahBZmg3rMQHFo7jlWqRB2BYicSAmh
--					78e9JVIwZE1zsdJBpvFjVgYWWPw= )
--			300	RRSIG	DNAME 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					lQRMT04a7jSKtyoPyhCoa9cEJU0Psria1SqB
--					fFq4pccSeBTjZcbiXs322ogGc3cmUO/4+YRC
--					742YEd9/iAiCILrEZXPpCprgymCIqZ2uJxIK
--					Vk2QUNDHOaJOjbZ7U4/g9T9K6LlCqBwsUAuG
--					euur4wDsiuEQPln5T+9hIwjS8Jbhx8jPRs1J
--					QXe+G8zwg733I0GSU7F+IuNhzgt1N6O/8J5y
--					OzLPLdUwLs9ty9B2rbyU2zMySQgiWaD+wSnp
--					bZ5iJLrg192nxIZhaeOZ5Ig4mwk3UdF8baCq
--					UpxAUddSdSLtd402+F/6dQV38mEeez4FOdv8
--					egjnfq59oLOSiQxA8Q== )
--			300	RRSIG	DNAME 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					nrFN+doVZOaYEk2HLbNCwBEreN2Z+nB86rfE
--					u5f8Xb99sppDFsSrc5dnsNBsOyzmg3OhjmeN
--					5vXZ/dOTlaAD1AJwYPUEXZ+SPaF8nFusHib1
--					kVfcbUSMKaGBIaQJmIBQELL0E5u6Vx85PwwP
--					gfujuUSs29VoDmXkRj2978PVihb7U1mX9fjw
--					az0ZYmbMDKzlKEYKYEz7PnDIvl1HBmYxSZlx
--					HLLLeImzszHMJMdzeH7wSmH+INj69bPpNREn
--					SO1F1AJvFW5vjHtoa692Ggk8kUyYJhRFMNDV
--					1JDTQxNeEikvp5glE3ywPKRRVxVDWCXVFgJP
--					m67Q3r6pfzRQbP9obA== )
--			300	NSEC	cert.example.sec. DNAME RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					arLwaxZ/s64IufkYQljXb1V49hgVY6aOA/4G
--					CrFOB4KO/eEaHiinFBuXznKlE9ePiKKtGsbm
--					ALz4gP/zeUEsYuDYbuFAYixWvhHG4wDMKF3y
--					V3Hfxeue3PYulOreyPuRriK24sZJDhy7LVN3
--					Ps/z1TWJ+HWnMDeprU2qjj223YM= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					ew74MRufBg6jYSbb/cDx3f6kVpPxD7lfzp0G
--					kPVIsgqaRARFbl4cLQIUCaAhRIIjwR0G56gl
--					2EqrjXKWr2hBDIsvhX8Pgdom5j4vGC1TS0wI
--					0YMrfuyuviNXnutdyxKqEPhgtnUa327/suTX
--					Z/aoQoe4Um+EI7AFBpVuHdAYxgYF3qiDCNqO
--					nzNxQCuW/Tx0NzocmRHxw3sl/MRknbQvKUgi
--					1inJQizjxtncLdjNPxn4UoJcb+QUE55letYO
--					TuIDyaBc9kuPnT4l/1GsnbZuODDAiRI/f565
--					h3dw18WeoaDk7sJKdiGZISt9hj99ARrGgpn9
--					u1w4JRpoO6rXpgXopQ== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					Xzl+kKu9k2pjKyeg9hz06MD5ItGIt9SkWHf4
--					fXcNtSQ+GabNVNtSlCPbaIRycHSLf6/AluJe
--					SSijB/dEaSSnPogAATefm6NlgF6Tc9NjRM6S
--					dz0s1sFNP8pnGP89JSA6HTk/13hcAbIhkXUg
--					aWMUpmTn78+g7LnzGmnCPTsEKr65x0IETfsh
--					06/0zjZJXLOmNr270cuj11SHNtEr5Y6qw0v+
--					FzSeWn5GySsgShj+q0ZZY7OJmdQFjW3j5ic5
--					YpHwaHGq8Fv/VoTiKUjE+Or7cZFW5nFkA2L9
--					KYR9z2bXY4uteKxU+VfpIn8+BGtnTBR+LE2k
--					y8/ie58TOaga3W3yWQ== )
--ghost.example.sec.	300	IN NS	ns1.example.sec.
--			300	IN NS	ns2.example.sec.
--			300	DS	50458 12 3 (
--					2E40B2A6CCD2760EC70AF69D1C144064C893
--					1E53A6B3EEE78BDB9E0BAFBB9C02 )
--			300	RRSIG	DS 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					dbS4zOt4yPFQz+tp6SmfVPSgWF1bSkJBVq5b
--					y13h2bZayms064FdTJmdGNErN29VVnZXiaFe
--					1gf7kmSdR2YLYoI2U740DD01NUC+3eH/E3cu
--					IWmjQKkwhB9Iwe8UaX7jqaG00bxNaTJpb/Cq
--					+zMy2gjMcG7KvQvuQ6SPzdmCUC8= )
--			300	RRSIG	DS 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					DsjOIOocYhuHZJWNijzIj02FOxQPXFlaUhPM
--					u9hBsWEOA2CFyuAdpshG9EQJa4jISUT3Setz
--					9RZA5UZAV7/ERHsLdDKAZez+j5v2d/MqwiNA
--					d6SdhSUWlZqPUMQluM81RfMCzqYbcNE5sw+N
--					0MzzBQz2iHdO2+tJ8Tvg+4ek0aaCAIJ+IrRT
--					f7wiWgiUmiMkWTjjkuFxGtOKotTZp+W64KuW
--					yEbt0ApmpahDlwSUKruXs76FVZPk9OLRM9zQ
--					agLs4pVKpwP8OK3KUVUiR16W25JrycEd4TKU
--					IuDAuodR0SRrXatBj3X/Qm63CT4gjQf3F/Ga
--					nLDeZKDi7aL+86qPzw== )
--			300	RRSIG	DS 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					Ske9cNhh15n9cJxkozsENJtlTgnEPDIi/7Hx
--					Q3nj3UPSx24JTiTHdddQAcFwmnDj2qVuVyoG
--					sDq4GBdj20soTcP6+cGrQ8ELokXwZoQ8ddGy
--					uaJnkqh4JBcSXNCv3OoimAj/tVxse9zjpFgl
--					d9c/C2LF7/4rEtflLybmgLmlFwVVsDUCpQ9X
--					S+Btx+fgQNvpK6BbeVaDEr57X9ysLBy6UxJM
--					mXyV6/oDEcK/8enhqTIiExOi40yhx2woQRMy
--					X4szYS/jwLrS/yUrUrtbpcOHwpW/ISqDFCuC
--					LWqEfQtPAr6U/H3SXs73++cMAoBuEdbeRUcq
--					OSZMxNY8m4uZvC2EOg== )
--			300	NSEC	jumphost.example.sec. NS DS RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					jcw7VqEW7YR70DJAV+oYAKxSHQ9H5vQBLve8
--					zcW1dge1L/EQppk5I0zRj7yr8f7pTrm7IhNn
--					aPv0YbFGRGQJI6w0a/xVr965LyQt/LNyp56g
--					UwLO07msGUvxr9br2bsYb+lI5esjmUeI38K/
--					GkO77+5iWuv4WcSfx3X0KtfKyRU= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					KDx7V+aqRbzoDaY7QB7PTsuH4IrtBimwJsfx
--					Oth/fSUdmFfPpByVmY+Zln6HzAcCDMAapKEA
--					D9QV9f8qPssd8uQpAVKylqfSRcYHkZzeGvvA
--					ho4bmrNPz2wQEz9XFvB0hXJ8YI89a55HYN/s
--					TzdNmGtK0WVZO/6A6nALCB96r5FMLTEhdn7s
--					8iLV1k1DojkWkD44Bojj3Vkq6r6o21h2FVHd
--					/lOjUQSjEwQvt/1ctI7bJMHnFvMewVCt/oQO
--					gu7oQijwsyFMGJZl7FDmIQXRLxywHhrTkysH
--					d05krTNL7A1K6y+GFdw7/Zv2kfqrrVSyRoxH
--					XF8zxi588nrfOuqcRA== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					Cao7WSRgcLLlQRSTUCB+1AMcfTpkzLAVqs1U
--					zfz3o6xQHr4Eb6THmF29W4xEx5sYMC+9yLws
--					sppmbfTRVISRXZe5MoajC8DWBC0lqEbQjMPM
--					MG2xZ4kinEGPvzM7Xx5TFejV/n3yMRFm7QHp
--					LBIB3pIfgXWMvpLNINCChUVdwBMXJ8vopULk
--					rdTJ0ZMtnwO0iMo4W7YmgiWqCD4f8i8+6MWG
--					4WUFvsitaogroKkvOJgj5hxEL6OXLyAWNgfX
--					lxF2jBpK+tLCJb8cTe91slIOkus83rCxVmAP
--					wjwt57GQrn8REiw2bbfeXc+kZzoPC8ud7Hlz
--					eOYtpW+EfZQhwqXyoQ== )
--delegation4.example.sec. 300	IN NS	delegation4.example.sec.
--			300	AAAA	2001:2010:1::feef
--			300	NSEC	ghost.example.sec. NS RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					ck530M3oNpf6MB6IOEKlAG31GUvfMGvrnmvL
--					mc3gFj4YkH4cr/Mue35C34JsOITZ4eCAr1qm
--					90I1ZZFirtznpK+XSoJ2OmpljD7ukp1v4fkr
--					xcBi4DRVN33O9NvMGo5ByOq83y5Sr5DIZn5B
--					K1xnLIeGNYNiNabKbvYsL63GNBw= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					KvynUaRjew0Llu0ir/Dae+y39m4n2hiFGEld
--					U9/ka9ebYwbULECDoZlppm+1VQ7aPfyEtm/1
--					MulIQHWplHwjxGw10nk71XTLgeiSUsVYCdDN
--					qK0dC5mJ/xnkaNgR7Q//e4YSg8Z7aVGojkh5
--					ewXCyVzqg+hLSWWe2TSQV5CeakjBkTmew8hS
--					Ugg0vRepRtZ+VdFa6A3RX3/35Kj5YE1x+QiO
--					RKpM6oIaeinSpNcJgOKAUIfsm0rMlGqYwun4
--					GqDJi+X3rqKmg3ooVNXjq6FqQr8hxtPkO52f
--					mHQxeGyOczc6odQGMMrlpEEroTmcOLP+r25h
--					zFicoZjtVpMCk3Im/w== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					u9kemCEEjLcWoyHLMgQiMESYDWJJosTnqbxR
--					p/0wjbjjtcDCxheIMq1QVzgiM1dlEJhyGgry
--					en4VD0ap+RAMP2LRTudtoTogAEGb6OuFYOM9
--					IBV8tYkq8AXAKKQeQ0HDiveQFC2Af66XJbZu
--					ioTdNy9uJyPHSVQK1FPwyHrMpDkkMyc2pmJo
--					T0qUGMHTZCDX/JcRkA/tuKpftpkaZq70/edG
--					oK9ZRF3ke4YnrW8RiwUp64dSmzAWqth2ht0v
--					W1BmNAoR/oCdBMmMYzPJxNDjJ1BDaZiNUH49
--					I19wMnvrFdYVz6VP5o/TfJ3wLyejKUMAQi0H
--					AJcNAWb7T6czVkIXIw== )
--sec-10.example.sec.	300	IN IPSECKEY ( 10 1 0 192.168.1.10 )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					JzUbP5RijuruLZs7gOepWRrnChCfEGad6nPE
--					np1kuc5cf1z1FpPDntbxYzgLeyc2sY3PDZ/j
--					35OWKuE9zNR/M+uqA29ehZMqegYPcJZYIFD7
--					bPOpacCiwnoB2OYa4y8FKhWIrrLMtUKoYHRA
--					yKuAiduwr/7ndJXLsW348vbyKRc= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					LbM/he+aYiOZUenKh0WA64OJaljec26uvxYf
--					PS+NCp3Oe01KlRTvl1odasz+BO7hs2qo/IzK
--					YezdKU6xyxnP20yqxmOaeQ52S7QNCQciKZm+
--					YcFfmmrYMMylC8ca4RRzH/lhzM37PSOixCk+
--					3vUI0jfH/tnYpX0pWKTiU0cw1+yGqbY6yf6Z
--					KEdTVyLR/x84XFkvEHumDMPLfYwDk1qkpNhC
--					MqmSPqeRUHrui3DXUv2uhOn9McudB655IF0Q
--					gEbAKFRZW8/ey+rp1YByJKJp0jlbewBBwKf4
--					LKTRk+1N0V0QYkObd5zkA0JnjYoLqjit7ckV
--					wi7HwkcgQzBJ3scTBA== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					WMRM2N9um8rfzVrZDZlZpv4KWRf1unIS/99G
--					WCyG2RjWGwMSEmOQ3BUaMKGIsd/2qyp8iUf/
--					NMLxu4L4KnkCbsh0tIujdfh3Y4NhhTLsI/CQ
--					CbCJ3PBuAqEsQsBMtbQr6gPAVAqIdQRUGVf2
--					PTQWOoQ9iQVdHDoVUDrfWQjhvv9f0gov5VPQ
--					M74urfDVM4IqSm6VInygAG1i8jNsZBHOLjgQ
--					Xt1e97mkSbs3ZAqKUcIdDSzwem+HYo8dH9fG
--					BiciNg1uR3gqis9mJ6mgYcWD1dielZ3113gx
--					qd+s4+ZTVKEk79MP41RupkCjC7/lVT7mtKWM
--					+3hnz+R7kkZVwuatFw== )
--			300	NSEC	sec-11.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					tW2EHpJUeVBFWDDrFkXykskPkxFOY4BQY4K1
--					TKJKN7Q0b+Tkdfy7q7aQSfd1oISzZn0w5crz
--					0HGaTJzZKx2iMYK9E6HVH/FysCRge/p5lfpo
--					+Y31X2ldA1al8TtjVCpXqh2hyJvkP5+gD0a5
--					BXhB3s/q0FkdEmM23SfGK4XqPwM= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					0adnfzBJLo+kwjkPR9xFCAyY0J8EFzHgVYbg
--					bob4jNAZpKEBpCIWivxlTGzN6gb49eWLefgy
--					CdujmqzRwUCf2fXESYp4R0hLq8gVPbOF087/
--					4cwajOTeDLGVo9OlQA/MF5hrya4DCDNC/wiB
--					Mp1jFDDd3rPQIhVRW55UUAUcK67SazvxSSGB
--					Tnca4Y/q7mXOV224n6E/m6n7drmL17A/rr/3
--					fJaMH9b9JOSK65k2eqSCbWBaLFt1uYqGJC4M
--					0bs+QWc4oXV2985AsZNqShtGnNKgEJzKDZDq
--					h0zCspnlt1JgxzpQukXwrS9CbAYYlgRD4BvR
--					1i1P6OSSAT6XoJfkew== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					aIbGlRGSMBzpR3ZJDGHbbCjVFVUAoVSUjHLH
--					Tssbx4zGbRQ+V7agcRsRznYgDxgzuhgiWjOA
--					rYvjnXDXWGFx0HzWjQ+CbHouuF69eWJdHyUe
--					RFPzZ/dzKLlo4ucrX1awAf+3DcreTuWe0KcA
--					33ptJSJGvYILxwOoKpnVk6iymlVpkw1jPQP6
--					Q7hAD5A9W8z7hXn5tu4qknqU9BjwekkIqm8V
--					1eoIkGqHogWQs86aFMgeNAHvmklBgSwzcLc+
--					NHI96eqzfvqkS03MtdKyldUjq9WiCRlLIBbc
--					2Ra5fHN4dEEaYIUCu6tMhUwNQSjgev+a3WU7
--					DLivnEX79tIEEyS5bQ== )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					rljjcD5SsIUxIvEB56UoMLkvV61h2C2x46tD
-+					kGH48cphkaCQgZDxYnuYo0FLtMFy+JOnNJZE
-+					AcGII1+mH1NgQ2hvPW07TY0DVChq5sbZ0uAf
-+					7jYIpKYC5N4xFM/SkzLtrMWAW8caA71teXq+
-+					/1ChI0L3V1aFLEGyslcw2nSPAPM= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					s8FLFgQBXexonphsXRr+8gW+BY0WKJZx+qHr
-+					38fC9AC3bK3dD1w0jRVyKTE1Se2vwRu7FYbV
-+					b1xV3HKuHLtCrgW28UYffKnJLHLeIXgeZlJV
-+					6YufW6iEPJUhl9db6IHnD0rtJCesu+Mcqxjg
-+					uAIgq1YlWOGmJ3edYFyZzy3cfOGROmag6g2g
-+					4BlQ6kRtpeQujfl44bPmm30v5FZi+kIH9ba6
-+					RpXOmdbZAJqer3hoBohmD8JABpfT0PqnJSFf
-+					fAlojw3WnNE44yUxhuMalER+BgK0u5bkwLYO
-+					SvkIEawgYFht1BEG9G0xjI3KOzZZFtZloyaR
-+					uiAa1K+46gGjMmPJWg== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					g6N0eggix11si7ZI6TBgO3Pys7fxrsysAQmX
-+					HK2Yw1kMAAsLe2kwW0ZmefNCrkkNNR0Ln/wc
-+					NfMHBEf5iU8ceXfiF1+3xZdH1U46l4YX1gUD
-+					gKL2TQI1A+xG3DHpHLQknhKqtwfPCKQThxsg
-+					X3NYYfct3GLkdgbaMzLaTa1UHAaPvxSrfSzG
-+					/eWSW6jWLU6VsLXOdNCzR6WTwMev8W1p+YG2
-+					7dyRyfFfA3S9hBrXFINnzvglCGWBryVXnXAE
-+					VYFI535zkjT+mSMEATERoRb6hm/XNgzy7Y3l
-+					Fj4bIoZFNebYbCD9HmI6GZCuBBVxOSmhrdfC
-+					fOL3mu1i2cK5U7vFgA== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					QqcY0N+DmPDaREk+KMd6ivo2xBcUsTEiPVJB
-+					gy/7Oq9x3Lzo9NvO2YKF+4HxzGk8GnkEVrmh
-+					WU8jFr2R5wfZmDgBCLMitew+jYU7CkI9vYst
-+					sNmsF4x0KZSVMlIF6NymdSZGW/2QkVzxZjmF
-+					Vgh1cthUGkOl/M2EU0TJmt3GU6bZNw/wW8bh
-+					Mjn2dJnR5MQrFHfoXjbQm/SXdcpl5IAiEK6A
-+					m30OxVFijBINNJzfkHLhpNT6Bza8trKBnP1J
-+					93hDJz/debKkxxruIMH/409nN8hexlG8Zk4G
-+					J9FWOMnSAvyitWAoKB2ykBa4obLyDaAt2NuQ
-+					iUt4du7WLqn5dSUXMw== )
-+sec-00.example.sec.	300	IN IPSECKEY ( 10 0 0 . )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					MluJokV2J5dK5n5hSqbmf5huLI77QYEnZd82
-+					8JmiDlILat+xFkgGrZlKMIvpGJVLWCgU98cV
-+					Z8rO13ZK7gr/ifFmocvgocchTrj+lw4J/aXW
-+					b1IHHPkhGeCJy2etKc5H+cln4PEt8h7to7IH
-+					+XSN4TNaQnQiUcTESdTAhuF3syw= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					dr7alfFGSizXT3Vbm+KM8/gD7GNsmxReRIg0
-+					zH0QrY9+kq9fKthsKrHhO3SkWmEACZzv23mA
-+					qggE9OpNS7mbOTCP2p3lvNtkbFOTunkYWK4h
-+					/EJqgs4J3QACtsU6h5uR5dALFjtODkegEo2v
-+					aQ5dV7XPfLK9UOG5v/NKamI1rBPwvLoAFLxL
-+					hx2QxLYKfsWjdNvK9YV2Bjw2Tvi9mk4M3EZG
-+					bEsvuRVDeT3M6THyt/1vV2yJBPey98dZqiFi
-+					Jzwrsufe8/PKT1fCGJVepkFqAzCPOYo8giTG
-+					t5rG2R+pfiXwKKTBWZUHt0GOR1JDrh33FR8O
-+					bH5mi/m4wh+6+6/lvg== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					BFyy/6BnJVa4IiTFkxiL9XjLHzEsdBp/vBSe
-+					ozTHysTnxfcqe9n0eQ4r1HCofwUgmnDnA+TO
-+					k0ojN3EK4QY0ksooBVAWSQDXGzhQc+rMeave
-+					92YyEglaNehWsBzM1wz2IXKS/2fLvA62KW4F
-+					87TBO6Ic6TZpNjNrKR/QRjKGXaxyLJ/9zD6x
-+					xGWUhGIa5gXoaLx13Zh4VXwCsty6TzNsV7EW
-+					elwSCSZmp0XrVz1+99qJ3Z2JjBCuXVA3uW8g
-+					yy1POb3bBskf/k3imiMmKz1FvXv5DjloUAUp
-+					ERYwByiFOOJXKgpiKoWb7RaAk0+etHrN6t5/
-+					tOHE/G6Qv4ewdwppvQ== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					Cf/VcD01yZOu6S3flMqW9ORT1v8g1NKIPKJ2
-+					Cat56avdz9g4HM9grub+K2he2svt68He4GVU
-+					x4Yn6JgHKXHIqD847kwFuOgn+gsUckUK2c8V
-+					vIoq2eQd2dwFfk5VAHtWXMEupBEixbBnbr6t
-+					Jn84/FIxabYBm0ItZTFjjPUO/RlmT4+7sqif
-+					AZl8pUit9cy1hR5tJCc8QGjUQi2m1E7tUhm0
-+					kd3VlbBJYZ7Gm8ky4vgeyQxxp7vbjvD50uCR
-+					0GS6O1CJUqdsk6xJW4O7vV5zbMEREZ2twHl3
-+					9Xq+nD6A6ZDdtUQQ7WrLrjRHLiD98o8v2LN+
-+					VG4MJFijTZqOIn8Bqg== )
-+			300	NSEC	sec-01.example.sec. IPSECKEY RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					muTWQdST0SXHIiJGTAvdhxFOHTne1ti82RbM
-+					DqXJynyYEgm5NlnmEZn+U+MyPAkjUdsciukW
-+					UGo2640qt78WTL1G7WuIWS3KmRD3WTFo61gm
-+					DdfMOcxBuyvDl84si6E/sMSjsM/GZJ8Z2BFn
-+					hUZB5RlhNbCeC/9O5rP591a84D4= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					W8RduB+y8pfSQ7343Pqa57PgfUqKMAylt13R
-+					tsTvudxywnxclvafjl65sREgHuq5ujwfOn0N
-+					qTKpmCCmeuUdWoeRLnl9agRdh6INv4u/lTXz
-+					y0xcmJeLhaI27IqjYYcsHmhlOy6w0OaL91Gp
-+					V4dTsr58H+jbxY6Z01NujZvaa3dC1ZjDDYMH
-+					DpyIj1RqNN6gMK+Dfcsh23Ok3LGyQgYw7byo
-+					bMmtOi8T6MZ7/kZ8F+iejAr9MiUGKIBQdNVu
-+					m7IpwWGJmkOQ6T1fDHLRuhrpyZx/PDl9kwxL
-+					XD7+sYke4TAlRiDokIreNR7zwLIqKY69JHx/
-+					GiX2a5hp9PRlYaQmRA== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					YT2sKENrTnNOOGhnRaVcD3YZAGDf04z7y5P/
-+					WcitVjRKx3ow9gIpFiI62yLi7ZQ11Hugqreb
-+					HDTY3F5PMuiDK0Fd4F9WkD5M8vJApfVfmrYQ
-+					2hDPbgzs88fHWtTHvReS3rNRk4RLFdvU/YoX
-+					zzrdpLqZDJah44eQWprr8WctjBk66slNhGgy
-+					T65l032BSi7Qh+fQe3R0IzgqLwxh9WAee2VU
-+					1nLRkszwzNygcfjE8trdf7pwtyauqZY9zqDj
-+					sKNsFFabP9pYvHi7dfweR/C7cGcbMLFJVSIp
-+					iEit3cMKHoJdU9nOC4AvUCxHXoXcpDByU8RL
-+					x9/BWaVFGbGAZePlZw== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					mHxAhUL2naUhz8gY2u68zZm0JDQAE0Nc8IPN
-+					dlsMHBA8SdSmZ9M3TwWxoB7/EqylOiT8GDRf
-+					QzbYqYgNChWdYc6Sc66czbdB5zPnwcYf4UT2
-+					YXkunPuTXSxWFAha9W78YeNutHIJwJ4Osuuy
-+					h3pO8UfJc3oSyDM6SeknxH15RzHs/dr1S/VY
-+					NlBByu33hC08VQ49MxJ22I7zQHjCEBcXoB6p
-+					LQ0z7JlDpRJimZyHLx3QIoDXXH58TxSrUPwf
-+					+faL6nMDGQfJGwYWpK6gThg/ZWFWbeUruZeZ
-+					BXjtM4Du9GirSGujpHAG9NAkcBxIvmZ2Y37t
-+					jsSwdr45U50mK6LLoA== )
-+jumphost.example.sec.	300	IN SSHFP 2 1 (
-+					123456789ABCDEF67890123456789ABCDEF6
-+					7890 )
-+			300	RRSIG	SSHFP 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					isolD6Ge9KtgMdZMFeR6SD8eu8gie9LMIGjd
-+					4Hba7ebnUi8d83e9DRfURbOYtZTjPJqmwSrp
-+					I0muhs3KaAmT8Sw5GxDp9dtBRYBexV7dDGvb
-+					wyFqICy3OfhOTORdumW+pxEKfgdAfsNv9VYJ
-+					EZIYm9vfX+qsIANXFH3D++7sNgg= )
-+			300	RRSIG	SSHFP 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					2D7q1ELbpNl9Ix4KrAizQSFPr7aG7F6OIc/W
-+					D0R10gAjkHZhH+t/JpwvzcDqGkd3590cAWn8
-+					9MV+zRkUnR/qj7+POaRb34oBFbYAA8f4mARl
-+					BybDjTWxfbF0VTfMfixM1jz/PbJ0o0I3FBdB
-+					zUx+g2nYmipcs7DYNAoWik5hfzalREH/fBW1
-+					gQg/BDbn1TvEQC1jVEfQ3YR7VMF/SMm4eoa2
-+					UcbjaBsDN/Mev/Nokv9+BaH34XBIh/lzSF0X
-+					mX8MAJZEzzwzgrqwYk4Ocp7EBda5pO55Lc6Y
-+					UQxVPNvgsrOpk8JkKlsrt7aD5nPnjWKy602j
-+					aaZizMEvU+hpaUGQoA== )
-+			300	RRSIG	SSHFP 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					k+jHq5IPvjzWCPmDKKfd4VWmE8GuvBcHENDU
-+					bgMAUw9x6Q4630/KDOR/euZWUS65HPALZdqX
-+					PibxJSI6xumkMIUxN2hh2IUrXlyLIVeY+DFg
-+					//Jdwo9kC9NZrIcynxiIXYcEQpFE+ICk3qIZ
-+					3rp37ysrX7P8OCNYa3zXT7M305iTkRVTG4Br
-+					313e1OAvM1cWp0fIMo32+UM9yegMMXu2DL4C
-+					+cD65Cd4BJtEu7dF4yUe7B2t78HzqZOxyWGK
-+					wO+XYaSB/rSOuqTNl/0bL6NA89O7DDWCAJoR
-+					mw0N2k+ujDF9gUOFhs9yzAgHbXppC4zocmwQ
-+					imYF2t3Bf0u+RVaKwQ== )
-+			300	RRSIG	SSHFP 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					Zjn8vpwvq7lAfqlM1SR474M+d3xffCkiEXaO
-+					W+AxUEUAJ+yi9uAF6fsA1wpCbKjaIvPbrZgr
-+					kvOczZlBiX0W/3cCL6KhGe7Lsd2YKqGO3TRe
-+					cStF9Ylj/KnFFfXnLPDdODXLQChQEEnLTB86
-+					Jk+ZtV6psNwOjSCimSSgc2x26i3rR9VxYIf3
-+					5s0K9XN/D8NR+T3NJx2ejsBzPoxQeJIb32iC
-+					EaimzXrnSJqLuDSKezP6aqtz2Jrc/Q+E7XeL
-+					1PJpgG+xBmmIxIf4SijxRTCG2a656lS4hcY8
-+					yl36lzj6QbwQk/EE35SLuyXRjvbowwhALRK7
-+					PcNjz9yClFecgRXxbA== )
-+			300	NSEC	mail.example.sec. SSHFP RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					aMan7ISnjzaeoqSZNWc1qqnAHd/Uuw8Viqwq
-+					2AKYBv2aN8gWkpj5M+61I6RJKXEqoK8PXVMu
-+					tzaROubJXbi1qC1gAo6H4sPqQWdJ2MuJ7G7A
-+					+VBvKz+U4R5P90g3/mqpBjE4+BGHNkAZ+SKE
-+					pZcgPBhzFOsKQlZQ6DWJyJVlG4A= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					jx6Tr9aDQu1NWU+iArkQXSJu/dhsQ/+UuiKU
-+					Q5JF83RlPjiqQhFhlyKtlARN3PepXbxOmzkI
-+					W3T2Jnd9HDfzy5+b4tJgh6vVDDylDu72G3Ij
-+					7kQErZ0gSQd1FDZSU6LMDDNidUHryWMcQQXT
-+					9286y9ia/zey4ZawbgmdbC+YYVeKZRBkZNM4
-+					F9+vuOm8laYrJwj/waUAAuuvtlc9rGOxb+hE
-+					LP4H2PkKVcMbO6jIR6qbXLl87vx7fsqzzPcK
-+					RS7HSDAAZhmFKvvOPVMXfk1GZi0F7jxzoTIt
-+					Gl4B1rvR941G6VxejaqvXmOA+sLs49drSCn4
-+					lyBW45ylAW/ZW/Uxlg== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					r5wkR1XWQcuQ/bINl2pHKgWDkk64NJZe5N6o
-+					EKODsgCysToooedN1kCkkaCNkjb7u7h9+tBG
-+					YFJmHFv3Gek0PW2ldT80wMSyVn21HVPmpANX
-+					daTkl0EE3NkjnAu7jCC8MZHAUJ1S24dEedGB
-+					PJuDwjTlFBt/B6/dOUCVxDW5+xRbC+w6mF1v
-+					VLsXhzq1VCb/udhbwoqfQXdztDbBNGRdkyBB
-+					tc6F68ceUhRVWqjU2cLBl98wrxD+ZbdIXqyX
-+					qwJJb6YtCy7swYb+8nOfVwZpAwcNkeHptDNB
-+					zEoDFqn5Zl+vCDIgFozwj9Qp8cCioq1jZzlw
-+					vSdWL609KjdlUbN9RQ== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					FQEazIPqzHedFVbV2IVHLqfS538V1bNZr0S9
-+					h4i+jAnWSz8bhyGPcIwY4kw42wbD6J6sffoK
-+					NlUS9F/DfoIgCpTwPLYRaq+2QD5lyUDA9uFX
-+					5L7JVgWkZI0dobp33sTelqvxZjcOl7rXO+z0
-+					MoJVJdAr0J5kPP3nz31+EWFL9g4Wu3h7ueFb
-+					eF0zA0DYqsgD2G5DtycAwz8M2RUZNbi/Io2P
-+					+DvjYLng9eiXJmmQ1HGBC7Vp/9D2OHm73ClM
-+					Xa82lu6onm2ScyO5+0sUuNXCDZf+rVgtr3Ac
-+					AsBUGjkVFgvLxKaRGZZ4ND/tuQZJrVLxwVfn
-+					mwntrMBMVL3khHfldQ== )
-+_25._tcp.mail.example.sec. 300	IN NSEC	ns1.example.sec. RRSIG NSEC TLSA
-+			300	RRSIG	NSEC 5 5 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					r+qJPmXLdfqfW/lGABbtRauhF1ivwtJYgYnL
-+					JP6Z2UyGcaThmBnGCBh+ZVqsTF5ye6RqvfBc
-+					pVzgLwclRHclZv3gawRptRdKRCC9cVAagAtz
-+					oO+jt4Hz7ZmELS4HVUYd58bHYjHqGK3JCpUW
-+					Rtzc1MzQXMerzT4kcV4te+0sem0= )
-+			300	RRSIG	NSEC 5 5 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					FwiVZ84+pSDj4Ai5nM1IMg8FFMV5Rb9GbLP6
-+					0oyEVx54dKBlc7aet+L/jLeptXdvf3RoU00i
-+					C89BgPhXYBqi6IBevANrL4HnI0VLD7cKGQw8
-+					Bh53d5rTXKYlCgvQh5lSLdbTtnUAmhjz8Gbs
-+					xob0zTpVuLfKBLfJdibdX3YD3k+jpyvAPfXq
-+					5ABOy8UJIerhxTIHvo2iPa/M/b7EtBD2xPje
-+					+4hHq0kR5gdhg+RhNdSTlHE+LTHFy29l1gvQ
-+					m32rYOhv+l9NnnzPbVPcpAp/UXIvZ5sSJuNv
-+					UFk3bQ1bslh2Kb468PqnBd6uoTZXb6zmkpbP
-+					x5BUhkWFBwL/LdvDSw== )
-+			300	RRSIG	NSEC 8 5 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					n/Q1maoE9ygqDPu74PBnkZ8te2+yF2Rx099K
-+					GUkf/s/bBD4gYYkzELdpF9+qrHcQlh0dpsDt
-+					qtOAVwaU80VpYJCTrci3sEWZN+suwsfCVan2
-+					tTj8Q54FCQhbxkqcd9t7YbuyJi4ASVhGQW5n
-+					MUdlop3M2nrvI1FadBWuiMe8RAYziiPsA3sb
-+					X1vJpl49bgguOzp5d81LT3YrVQnIGuRSqZhH
-+					xo+3zkGiBa4oBTf2SGKC1EO7ziul8JVbNmRv
-+					EG5UhYBfQGmJ21a6bBftMOqvSKS1jmKIOivI
-+					dzVJ7w+KyoUQsH6FHaxDHh8mKkKJJmDxXbGy
-+					3TkgwAq9Lw+qh2IjOQ== )
-+			300	RRSIG	NSEC 10 5 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					VNERZktOVwpJwneQu5jisBU3ffMS2MoWqDIt
-+					gtFzswwJA1WFr99WpCE8oKPnVY/QmHSZK3ol
-+					rcl9nTjjbWx4aFO0UVooNR548Hi/G8nQE7s4
-+					WluaGEMJzmcClTJ1n6JLE0goXb4930Q+Ljmd
-+					/TS0Y5+k0UclxSII0TErC8FllJ/N2uqGIx1a
-+					aev+HYvwWdnr5tkYE+7ieqLeAjN5sU4zkwyW
-+					Cj33djkBkguA9KqqEtVD2SaWBdh1rCRdAt8f
-+					bwKK5bV2sU58wERVBKKupiUWPy8dMUeIAEky
-+					5cS0vDQIRTF8f+joTiXYjZeLwsbmTVSInTdz
-+					zOjEvwKKAQMtVCVWlQ== )
-+			300	TLSA	3 0 0 (
-+					30820307308201EFA003020102020123 )
-+			300	RRSIG	TLSA 5 5 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					EUrc8WLvZmbuSRmymBPExTiotQIGn+zcIX68
-+					AiUWZKQ0wvltwKM2o6ilQLK8goxcZ5qZOmEb
-+					6hEivCKoRP0ov4yhJcndCJieQ0saa2+5DOZJ
-+					mf6BTSyRmO65P6lVANTJpi/fSh/Bxt+qFerF
-+					snrmHQSGVjzFBySCg5GhXB/oVP0= )
-+			300	RRSIG	TLSA 5 5 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					vVF5lbC0wOSj2ISUul+4ss46jRZ3mmXbf9NY
-+					XEQ+ArA+TThi0031cinFCbSU+4ELgDxRw0YT
-+					T2AwhFCnEHVYxs9RoynIIiVPbnmNVtDKrGc+
-+					VNjDFcGQ9XikKqw6w1B1dUyRUi+I5rYa/V4C
-+					mnDSrynMAgeZOADFbFI/JWo0p8JkPjsVakTi
-+					RufzRg+S3ViSaAIheUxDggav2h+BbCa4MTbl
-+					0BIyNDrrGEwLETtDnYu51SQbJgfDam1o576W
-+					eaEmSX3vf1hccFJem5ITVrCj+tWZY6MLGhwm
-+					DfJSt8Umhwg+TWbQm2hXd0AdAbQVSkucY9Fy
-+					TtYfK2gDmtZq6Fs1XQ== )
-+			300	RRSIG	TLSA 8 5 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					GTsa2uIy2wS9syW/ErQ5YGemfacsG95datpp
-+					CBeCplKsQw/Vh8oqgZRn2r39NaSroEY6rUMQ
-+					AWtcl/LUeGsKGMAjJ3QLauiWNFXc5kqlptRL
-+					iqlBhNSpMzROXEqpwu6o2C2MF2hFkUEtUnj/
-+					BZxGKbQmn+a3fA10iy9ADXAHQRXvVaX/V6S/
-+					yOtuAL53BC+yDGrLKKivSLW2w7y+iOf8yBA8
-+					Vmolq/p3+M8naHZl8LzmWReRcoBITOUMmIf0
-+					eq0BJ2ddwEAoneGg+168vCASDbTarXpUihDV
-+					XlS/EWfpnG9eRSEEyFq+pj4pdb3lLNxLRY1G
-+					RWvv8/A3n7H4rhtLMA== )
-+			300	RRSIG	TLSA 10 5 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					kdBkuHzOk9CA9UIAvW00ghDCkNTqmpxjqk5E
-+					16e7RaCrKA3UY0Hi5iXAiBkOhwTyGCWgRuQq
-+					AWgp2KwYnzs5ZuN5YWBqLVied0klCOWeWmAU
-+					mb7IGK1f2veAlTM9db3WLDmSepvmbkdw3F+K
-+					JrrqGn/sGYSj3LtXZ1oggHv/9cZWbHfipwZi
-+					bY1NfA7matOb2aNhO70Jvym72LFtNVbwanlK
-+					sesybPh+dHyRzMAyQLibm7tapJahko1d+KnR
-+					L/O426UvkFEGeu3Gm7xhN+hx3TM+URDfc7zR
-+					oWvs4rod6IZBIi++ZB/LuO+l3zMIntIy6etY
-+					y4ZQr6lSwWqCZQIaFg== )
- sec-11.example.sec.	300	IN IPSECKEY ( 10 1 1 192.168.1.11
- 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
- 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
-@@ -783,134 +1187,182 @@
- 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
- 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
- 					zZP5Vd2t )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					EnEg1ej/+kvQzICpJiLxQG8cQ9/cIR+6R1oB
--					aFIPxhIdoqWAvLGjAbZsgxajFsTK3nLrZ4V4
--					AknNa72DRIBsQ6CvLK+UHQU4nGnHg4933/zD
--					OW7CAXg0dEUYUReiKxukUjJcGQvs7zL9tyq/
--					1vk7gGxrNaR5hHurD9kpmwQB9Xs= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					NTVi/tlizek1k2PbjlpU5aPI0U0c+zLsFHsM
--					Kce2FHauoGuItfoRXRDryYw6hJ1xAdqhh657
--					SCsMYCXOfzmU6qsstKpTCMH+cM5TzuVzyIYL
--					gmiA+y7qq68LVdArrb0ht762RpQZ8RrU/4MI
--					YJKX4cqvqXvqHtenBXeqtsklZc9fuQCH2OKu
--					wUxLNoXuv08FVEXGQb5BV3Pp8JjoTD7z/SL+
--					qicgqSQkyO+TdUOQjtQIC0yRaUw2evvh46cC
--					pXc5uXRMukdMU7neSI7MMFoeDYTLip5xas2D
--					oeecHXrqC3PWGgP8mrnOT7s8ztNZ3BtU42XP
--					hx+ZYqumRqu6+zVtVw== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					UKuKZlAvsrmOd2k9PdEwz5x3TlVazEmfZEts
--					iV4z7nhKECj0LFE0YjC9dVWXQrJ451ulpMhO
--					RPWd1lKpJkx3rPWxphsFrP96cx+MnUOSaCxE
--					FoeSNHc8ODtXBU8CR2oXQwMAHOABpfE0M7d+
--					laGQBtEj/izMuNwSVGNd9TAHv+v/1zARaz6n
--					0owOBRoXvszAvKkyEHvV/8LZMJ+aMZLvJmCj
--					vb0E6Szky2dBgBKO3JEk73Avb6GLtxo1s6WL
--					s8lYmQxpOlqY4pJi9jqCB5PeNa6BQbRbIyFh
--					6nIPgi/QT64MTPRzI12wcvqLDJczgtD23K78
--					hBDZRe5WoJHE7bnMbA== )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					D+MmZHKbVmQCIkTu8SchY0UjsB8y+UtTC50R
-+					Sd/5DekXVogIw+f0QY3PEZXl4cJVBlKS+lRp
-+					tHtS5/244I2N+cRSffdHwhBlZpt9iD7S7CL4
-+					yhPVw1oRqhSlNv9rPTiXVwiX6HmCeoxQCSD5
-+					G3vX0k3zSCGGdkqlk0qtO1QT694= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					xyMK4+VtzkwjdR8ikxuZ8WR5UMntcaS9vZ0J
-+					dpMSTk6283PEtwurrITYxkPLNnrQPgp8R9Dt
-+					JHUpU2HSMOgYMeCQ/Kn+0/bI3zAuv6RfPzaO
-+					s5olCS6EYYn1+cCeowLETTiL/OV2zmtuCRx7
-+					Bbl82788cTEydVlLs+cFT+J4RzWE3f1DW+Gf
-+					Jf1o2TQtQKQSZM+USCfLD+Ze0EHkQZkffWgF
-+					5RwLxeeI8AaXDDut/ZVQpEXqFvUMTVa5RlMq
-+					QdITIJ3f2xKs0eeeef9xRS3IS6/fD0uEBg1+
-+					MRBMezzbYl//99R2MZVEOOLQ1XeY1m/akTBF
-+					OIHxzGEjLuhXEhv9ew== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					DuOUhn590KHaanXsaZkjxlGLnconU8B8QlF3
-+					lmn8GBViqcpegxEMKvqkwIazJDLGsPoDZeaP
-+					eSEFGxC13dLJiAeMpTnzzv24EjRTJS+NamJM
-+					CKHQDSKqgJkOzmiyUOlPfA3vfZLaPZADrXGR
-+					uGFwqPcEH5lkNKfWfr5QT2mjosIZtuAvjnpG
-+					Siz6LnaTLiFffin2iWKXkgcjRCYr0cgTDUvt
-+					8bWBwxS4RD1yZIJmHx8UwOptUKrBZnPbbqXZ
-+					3Iqm4NeOzVIKlx19p3MXqUWl5dgPGBr7qUbG
-+					r4y1zmnu0DbVKiCfezgM94Y03Rfff7T7dCga
-+					dwjuEsRStvRKig2DBA== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					DRKBmqio3VJ+jnJ4F45B2Wf1ZXNRMUDKUwfB
-+					ECFhRTBG4fAko58EVJDvNF2j+Hx+MRFjokgm
-+					ZKeKZYleu/jo0SbwZjxsk+LZnUmRte7A8uQ/
-+					HVNR7CK070H7gYS4TE+F2IyMd9S5z1GH2e2f
-+					VgsMwlA9TSZaqvb3VnvoPNw0IZiwbmw+T6Ie
-+					DvMp6pVC91GRc472mbqmfg01GApuAYvGRvLz
-+					1tU+g+tOLQZzxjFw7cHkbd20a0eRBGxTSN9j
-+					wmloooDznXy9aiSxBCQ+aYh11hvYMpzoIoMF
-+					1F2mnT3LT3FFgCnbLH2o0P0MpOYvKj55kdrB
-+					o/fw2K2jN9bINLrhfA== )
- 			300	NSEC	sec-12.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					ehNmR/L+tbSda5bN5mTUfSqUMd/OL66QnwXO
--					v/m8msSR8bfEs2xVqkrWTVgXkw5C+UBBU+3b
--					2hfcsvseeaKxeOSiaS0zNNDTNLmK5AHE7r0l
--					f4bo2QeCjcWr7BlToPUeqMCKoMNO0dQH374v
--					VEFH2EKCLM1g+CF7bFhM33//sTQ= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					YuvKjeXvCexLL0JicGPIaKEo1PwTr+oS4p4w
--					LuqZ0neZosi5dpelpmT0Jn5ZXJNstCS72cRZ
--					93DyIdvUNcgf10razoOsPPRnRMAMM0iGRN/7
--					JQu53DGHV8xHoRleyddNcre9/XHK/HYGAEbo
--					w4cFlnzwxTtNLfx1tv3qEVjEIBSLxiZDDj1s
--					VnfP/YHYhTxSQliakrrnKKKWe6fx4NMptJrp
--					O6YMXD21vlajzqtt1aA4m8mIAMSNkNRcbTVf
--					Dw2DJEe31agigtBRFZPICiZrq8YcH69rn5V7
--					rOy+InUYTozL8XOUTThiOvAE3gZqAB3J73PN
--					LSACnFRq1Ntt3mqdNw== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					EJfIAFT8ihSZXxRlLLV/0vJ8S5P3ml/97dNW
--					Loy2ifAL3+r1qVFIf8ZOGomN6ZF98OK4M1Cu
--					Rk8TrXbplE4CiQFF7+vWwSes4NtcSMTJTA3Q
--					V9Ehk/zjiEgrvUl8o6IEbMo6Li9Neo+/SKCw
--					A+GmSmq8mr1QGbKmPuwgmpSkij6SDN//xuCw
--					x2AMDppwnKahVYeeA/fn5d2Ja2KhEwoxkM9X
--					GGVdPBKxdG6r25v5xImows4AWqDiJysBjT9P
--					XrhA+7IEzh1oujMimZ4nV/f0h7rknxaGgkjr
--					9pweheUpI0xb2qGVf9+it36fHSJL7Y7BvFP/
--					H72Cci1DGCXAaZ38uQ== )
--mail.example.sec.	300	IN A	2.3.4.5
--			300	RRSIG	A 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					j3or3OPRZZcy93VY/A9mWcZkPxqi/NcPz52a
--					X5jPjXoHVcpwM6/SbQmnkjv8H3PdfVaWwW7/
--					KOD2GOMEudZC/E1LiA09IGDtMR1Sz+7Ythq2
--					uGQ3JPlWAmFq7sWegWVSpIDeOKRuJN91/Y5F
--					olyY0WTYk9LZu5Jhjp1YcD8FoxE= )
--			300	RRSIG	A 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					brufiALVyphNdDEA4NLWVi9iQUVEB63Af+Ro
--					2uig2q22XPTUOBLg1hrNJDUkdczG8vCUBBC6
--					ZKiCQ/z6d7cm2gBTrFBZZs+OzRKZjZDY5mfL
--					wz0JJ6pH9befaznow5RUGOA9qvf6k8Ob0yWM
--					/JWfN99n0e/RJxBqQeo82tYW23/O/RVinmZx
--					TmabPHJYybSzlNAd6yBFgzqz/Rm5Qqz03re/
--					tghkgALM/H77NoWKzO79l4wChQqPrG5XNV29
--					TKQ9+p6tR/9HxR2SPeMHhBCQSR9WHcaZp4Wk
--					jYXD1Bo8fnz0dka5D+R6nKCuT+TfuUezQmjK
--					sJKM6/tRBryilBBMRQ== )
--			300	RRSIG	A 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					AhsXyz+TztaueevZHV3V1YC8kMsz1VisZ8Ja
--					T4/LtB+ZaJYGgSqT66AovcGivXfhv73lM6cw
--					Kp1VnlvBhr4f30sPkXuOsC80KSLAvsLp6yCS
--					QnSMLT6XVCNgZwLc5WPpsOthAOjhNxiNbPz6
--					O+odMa/rW/EooC504a83KJkcLvvX1okacSG7
--					ljnVqtO1XCFozTi5aImXf3dO7+AzK/6Dl0Wi
--					Os3bme2jb9gPuyjwtIYbC3ej6IwDYJ0upV6l
--					G6ibkUWEPTQgoRPa5opBOod3vHd6sEEqr9V2
--					4pRuK9k17NujJrcgmPtI4Vhqmfy2eQmp29TY
--					dgftgmEdr810yDlAFg== )
--			300	NSEC	_25._tcp.mail.example.sec. A RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					SFFAGKi+qM26llKMe4ePNYY7lXsqkbP2+pXd
--					6jCc1ID9R7QOGQlV9LqO5rsEUkWSXUEUg8hZ
--					Z2R58go6jHpGIDltduVZ67ltG+jRqQM0VlAs
--					EGVBkqlF5k9PHVHg0O5OF/6pIi341EvOYodF
--					CF/9Ywwx+N9K6kquU2M4A1Hz+UU= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					ESaQbBc7BRAfQS0eqqjo8GHZs+D3UuEiah7T
--					c24iuLvUODcZUCsabvxXReJBaVxX8eATuhdi
--					chpLnjJKbqDM6/00lmMtnJD989d620L0Zbcn
--					GhqEzOv/5sqCXZ1cdu3Og3Vm6UsN99xfEDcZ
--					/FVEjAQqraDo0Lj/pDgmkpHX5gPEHR5l1bal
--					JO6BWuHRmgr7t0HE6j+Sq3OFRnfGGlOAgMmJ
--					BYZHOGrHKNgo8d4ToeGKY+Liw2+3+n2iFwQ3
--					u99v5E1jycps8gKWavQjfZ915LKkCmPljbSr
--					SwMU5UBNvw+q/Amu4GafHOpJjMwxnnvIROER
--					utFLORV0YcNBv2oKKg== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					Cgv9JsUZJziHfWwMWuHkcUgDcNWj5zEZZoDZ
--					UbHZ5MGb/yRSaq9Ps2NT7yzWbTtKkHx4K/Kr
--					kzVOWyRshHyHbzzRwmbC7tr6sTKJEsxZCoTd
--					DtLf+V2xrQECP4oI012Pxcg27l4BnK/Hu2Or
--					WYoPsZIWKcmd3NfDgBZW1M2/plhex4dIzXR/
--					886+vjAjRCT2Its4ZD6IAexVhJsSQiej2SLm
--					0D7O+LAFlAs/NWYV8uwHVGslSb0QzB0Y9Ui9
--					O6UtL9ggc9Gz5I9S/mO4pbE+POqBInTk8kju
--					BsJxi0ZcdxEg4Mg9ZYIFBO5BkeQZ/9c4Oi6k
--					sg1GY4dE7xU6RB2eSw== )
--sec-02.example.sec.	300	IN IPSECKEY ( 10 0 2 .
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					XzqRMTJMJ0oSPYwQt6RIOfScmhcQa0iHfbSs
-+					Ix5TV/c8lPWuMpanbjWUvsMblw/GypZLiIm5
-+					DjKi2eMDlLNyYNN9DsflkwkPaBbKirWq4vgg
-+					d18bhRwqL3Y96x2ks89aiP39AWrau2yZDzX0
-+					y5fJiN2jcSc49EWsdwk2i+Gr6y8= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					N0FMEYPy/Za21InzmzSYAp9OnDF9IEhiCXaz
-+					EhGlk3cBFsnuRvXZrtTScoDkUBXuuFncyJMW
-+					Sj+WGg17L5UhsX6rwx/EjQF/XGyI/DOLZKB3
-+					c4ll4t6QodCo9Iz7kPXmra8qrdZTRPRgRqzV
-+					6HAk/so2iCidbEaG8gIBfz9YWBRn0VCKG2Wp
-+					yqLqs3IlAdR5mJ3haOPM0JWr0kWywXA9YmWA
-+					fvxXtq46gepNcVJv7/JXr2b3c6LQX4V3+6mc
-+					NhxsDK8KrLZ4KOdgwUWYv0X5mXZ6EE8/rQJe
-+					SVrViDzVWGshK2mS3+VJzbZuPkXaRXfxjkcN
-+					led8XSLpIlzGhzJdTg== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					MR7kag6aIIFa0Cjm2FaQ429gN3BNaXZOSFer
-+					Lfop7SrNbBG1+K4beNuyX8oUUFuxaK/JyQnt
-+					B8gZ3Sd4+X+gRQ53gf4AX3qNCsngR7OjucmU
-+					71r38xw37B7VaTmGYMR48byanpvlX2RkINoS
-+					utxs2w+O/oKGZsK4VwNrQcQc6ZuvQ5DskIEH
-+					lpKwkZejlg7GuLaosnZCRiHmTxehhl6tP3cu
-+					hq5cal0gObUPDrZDnV/ii8E4o9alh3TWeUoN
-+					3pvBVlMTOEtjRA4LRw8b2AhDEne/GwNlo96l
-+					dDvcMaUL7K6BBFEkauxvL3L1nqzirLqBUKQk
-+					OeGbPbQtWjtChxhlyQ== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					mzBFRnRJRVITpu2gG5Z88sxCRVtPxJUvII6+
-+					luYDKgZtmIflXHcpS4CC9zccaGJAuSjuBAgv
-+					mDsbN2Wf9s1sC+T/YFQG53zwom7HSakr/A5P
-+					LfYMgZTlp76W7/Bd+6AzdhV/LQ5lFUBOd4QU
-+					GrTObiRlpTBidCP64780KeJuputoYPx5QOUT
-+					zxaIRht1HYSvpHYv45tCraBK6ab/1bZKrcAO
-+					qVFaKuWeYhgJQ4YNyyAzKke+Acjr3Vu5Uz6n
-+					mMyvoiPx8saiDJZs+aonkrEVONYF1ZW31UtW
-+					gIAbxJvWPwfoh7Dx79v+TEwtH2nEPknuQdso
-+					pV1/AAwEJwMo9ypOlQ== )
-+ns1.example.sec.	300	IN A	1.2.3.4
-+			300	RRSIG	A 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					VSulhGHN1NV7QH6uzJ55ApxAjZq+6Qn+DvT4
-+					Y/Kx5c4bw+ZiXErJmJJBmENScT+52Hh3Ki1k
-+					x2O2hoIm7v7LSC/+3jlTjEXmPxV6+Cam3s2U
-+					apmxZN+B6KlssH/1lgc7qzh6yBDfs+IZaakj
-+					tMt+2gUSx3qdajLtXmAnCyiLJLg= )
-+			300	RRSIG	A 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					o47UUbgcUSd9S8zOFs8h3vWTmcuP+cZRD684
-+					UOEtfOrWNGmX3kQZqB4UznyUxALz9gxRRWzX
-+					zDK3huPkA0WupVEbYJhqx36EqLMEwryoGqE7
-+					L8upivTohovDeuJRcmz1xq1M+8nSNOr33N9T
-+					yEbpiuN744WsnvGM2K/aja4tkMRImuk6Ed7n
-+					sFMUBK8+SQxmIVMdGe4laJZLOxVKqXAkmIw+
-+					xs7yDjPs2JWzFD3XFpX5yiQdcGuwFIFbpc1G
-+					kdxcs12H/XHvNoVUvMTf1soJTcvaBzv/UMFy
-+					KnRSuhCk9JwQQmguULZ7jTgiKVSSpZ9+xr6e
-+					xuxUMIuaR45XPUXV7w== )
-+			300	RRSIG	A 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					Ce86aefdf0aMdoDxrkoP3cpUTeZRR6us25Vi
-+					6T/ShoY5st8+0z/gkjraK0/7huNZMkvixVeZ
-+					rnsi+g2z1Kvlu9wjodDfiVWUymjrFdNtqscG
-+					tsqNfBRnH3Hrzr9ul7txWZFlcnrLSKm5wtNK
-+					XJZ5ChH02rFvIgOpyJGj/msvh50j1xmXENrq
-+					xLevWMy9dQjqi/iJ2K0dQQCL6w9iKW/ixxh2
-+					Js7F9zYkWYoPp8A+UhrAZep8Q7jE88iymyko
-+					EAKIbb7+/+QENqJw7WDx+fZ7eBJkvLNwisU7
-+					SwPT1vYRgDR4eHzRJGPEWWEIGCsRCj3PqOW0
-+					no3CMvdnYisET4I6TQ== )
-+			300	RRSIG	A 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					XFdqOX0w3WgayGkDBihXDKD1zhCBVOeaW3yV
-+					J5YJS2mJNgbGUY3QXz7OwSeQs8cD9cHxget1
-+					oIMR+op3H8VY6h3AzJP2EUNWw7Tuyh9wpdpU
-+					NRAkRA3vsfT6eBccQIbTWSYFIypdDufT6PHA
-+					hMJNvzSa7ljRPTuGiTZCersfvJ0cObNE5R55
-+					Y1qNNcmoFPysCHzZE7sdxmU1AO4IlhuXMA8A
-+					/LCXGFiMb5MKzm/qlrukTnUn39t62yEkisuA
-+					9P0jMD5fWey7KyZVS1K2dKqJdfuhF0eUUf7D
-+					5i5wi0s1eOCZGRV7BU24Up91DkMUHCyWQ2y8
-+					LoXhow/oMgADtWMk3w== )
-+			300	NSEC	ns2.example.sec. A RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					kVV6hLZf14IQaAISR/uaacBi1VBjKH46BsYG
-+					E9AoKqcBO7Kxu+KEj95yBdea08vzko36kOP/
-+					uWZ9cMXjXCigMojjqFWkv1RhJdMVkQ/IgDPx
-+					MCDiHrA+LI4z2YexyDuW/dnDacDDBS8Zv0XG
-+					gwMu5+86R/lPpBbC2KIfPXWZbnA= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					VoYzCDJPSLHtbuhrKoX+po/RHHYU2oYly+pp
-+					xhL4M3SNRxD7JZ9+dY/irqcGLheiMREuRjA3
-+					rCGp2NbPtLjmMfZkARzhoOTtYNri+p0ka53v
-+					a73X8T1xYAOW588ziWLLruqKa4Mdi+Ru+9e3
-+					aNW6AzQC/MGhiP/Wjd1j9ZeGbzyIPq7rFXgI
-+					7keT6XhRkdsGI0jMZmm6YWPRqwJXr0I809Wj
-+					GMdVfl3+Z5FHaMQyEXE2LN6pZnUY4817GfLY
-+					dAynL077dRtcUOjG7MU9tQx57rx6aNw9I/Qd
-+					SjWg5DGWcqAD6hVZB7OutY07HbODFwW2YBKK
-+					SD4pO6+t3OUyTimNKw== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					MuiOyDyiepK/LcssFA8yXDEeBQiw+O+45C5J
-+					Jzae7DMDqkW/LtZR8BBrKmbp9H0rTs32Bnx+
-+					CD+UKc9IW4q7N6ReWp9/LAEK44SgYa7PEnkm
-+					YGWBZqPeWqmzp2UTVipD2n9w87iFXu0lB6Iq
-+					7/nuBd76WBBXULjMq7HppkDyITEo1LowffkS
-+					le/rNacTQYmoGjIhjZG6aCIbHSVdzsxT7Keh
-+					apXowiGAJST7zzL05055Vfw0VaPx2XyPacGV
-+					xlTwZD6og/fH0dphUIPy2Bsad+Im/ce1rmQ+
-+					H3XeUqzVIOWpYJqNzEcythfxfcfDTdPg35Hq
-+					Fxo5vKGXe2FteolkQQ== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					Sga51xsZS7XpV6Qgm6bL8HY7xsplIOwKyw6W
-+					VTFtZk86lIysiGEOCPkZWJ9kkc6QpytyM/Lp
-+					hUfSKU1Swto+laEKt4zGadVFALDb03XL3Mdc
-+					RB3qrmZLIDv+8ox8mTrscv/mTjt1PPYS8/gn
-+					IwMtuJkFb819ntuIgPoD3WL8ttCCIJkq2KHU
-+					+Tv77wOGGoos5OUKtzXw07t3aQwbcNRkYJjr
-+					91YZqRxLL67FSBXKhTRZmpmvC3Mp848en07A
-+					4vgvij0JJ1YL8Zp3aIc24dyf/CZ8HzwzTQuF
-+					he33AXb6xjgmADby130rM66bO1dSDo+/2GRU
-+					6p+CttcRRbjk2GParQ== )
-+sec-01.example.sec.	300	IN IPSECKEY ( 10 0 1 .
- 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
- 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
- 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
-@@ -922,295 +1374,270 @@
- 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
- 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
- 					zZP5Vd2t )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					srEElTd1pqezDk4QXaxCDonm3SDN2vSLfSV2
--					51LzIcLuWaAP8uLydQfk5j/EclOLq1RRpcNS
--					QqGpH6pibLFEP17dzqBbPj/lpu3FC62u9mLE
--					3WIQm1rb//yX623M2pLmMLnXLdbXiDISwX/N
--					27brQ8xtg09uLo9NbIYX9CtA6+I= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					SR/yF8wfPQwjqtzJF+XmZ+06sUz7drIUyCcJ
--					03iBBq65kMEMlglSf8qVboaCY2H7X0E3cNfs
--					Jioc0uxmRbhMZrChMrPY4PR5eKQ+BP4GENLp
--					SnBUAWeBGmPhfK0vwXuj9Pp6AgHrCZcgYxM7
--					AtZemWm07+BqiWwQWM1e9hy4BMjH8yCyTCAq
--					a1y7KtYXWcAvs6YRgrI8GPMwDtI4E1JDBUR6
--					VN3aSFFfSXLGSO/Xt1ogVWeAMIifzm8at7xh
--					OmHkkOJmw58lMRceaKH4DiNwgMe3Wn7d0wgO
--					BHhh1awLYLXibzHDeH2WbfK83lMbPRPs6Ajh
--					EJigKAIYWDGebUi7mQ== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					TWykLOTIRHVZaU/h4nnrfHWBE11dbknXM5Jj
--					LWtXv1Eb6Z6r+b31uQCJDItjr+t6PotEDx3U
--					c5yNnD1L+4REoWsTxdGj1J6rS+QE7h25kyBn
--					FBD2y8X/c8NjqJy3zfYw7LOALrC11IaI03iH
--					SpS4P62+B9mQa/QG7WFc0N9Bjr7QrcW9QI3r
--					AGiu33yQ3BGx3sBXFFiGRxq+N4hGHx/LpUJU
--					DW85qFE7Omq2Zd7kaLUkuo45fiwV9P/54G3e
--					MvwHOmTjucJOZraKKoNibsyX0KtC9WROTgnf
--					OwaWBFjR3xILtHOphvgjcDDU8Jj4Cbgo9Br8
--					USMYDy2MWtYapSuAuw== )
--			300	NSEC	sec-10.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					s1KV6YbHSHFljDxAM+N0yWIbqBc3bV2nBEEw
--					c7i3dLQgVALjyqItuthZNgI5AB8lBgcFstNR
--					uM1+Lp8lS02lv0lQRu5fXzaeieg8l7LM4Cdj
--					uRLhqdVZEzYuiCS4ZojnRjwzDTigF5ckXbMa
--					g3Z1/x/WFcGhlBhwktrOVJXaJpQ= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					HD0pNArh0/sVcgLhfaJagHVPJ8+v7HMwmwE0
--					KrzvDBrRBKmcQOfZ1KK7JaJfv6lHdkHYizxm
--					gkJFcSj0b+gHNZGi1S9la8M0967noVZoZjjX
--					rY1F+VcxTq5LUu+IQVyMoY6hd8twvNK5LSPN
--					zt51UKm9BB8yNrKwOQi0fYz0M4dYC3x/5Mij
--					QiBMZrdUj7DjNP/mYpse3TOMip8ISKeEFEZe
--					7m6g01mjc3yPlsl+yNyRRdwXTv3HExGo0pGL
--					JRio9dt600BP23yI4d/QPiLPOAiQ8lpNMrVu
--					MsVqS/clsOg4fJMLLie2lqmGPjnJCkx9CUbS
--					AFaOKXHgPwfRWj3vNA== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					ZOjgqUmmAgf+Q2dCVvoEhEGMOpQ6BYV9NkQg
--					kJTY/b7sk3lolOH4D2sPNeJPXEn9IwWx2HVH
--					5ou9paYj9Bn3CffUPaEDBh5eX+1wiQKiv8SN
--					FTVOYFds38i85PplVu8liY05P9eic8kXNoC5
--					clK3c8wWKZNtcewhJn+bH1YvSbJ+4qWgzSXi
--					NSKXo+wFElkh+IJDLJXjxPe4f0tKPGA55j0Q
--					1/uTGoOW/1Igeb4zm2q3fLtsxn4bNwDdVbG6
--					/mQRjNm8X280bzzaIofdF00nXxpigOHwFLll
--					Fh3OcZ/73IQlGUB/ZNljzjjI47aWWMilcEcZ
--					1JfN6sYJMPWWLiFoxw== )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					tG9BDXttAhq/pvqvAtAnsUin46/z66T9yHLH
-+					Pt3gzwnIa+r3F5hqGxqmWEhelWUUxvwGJcQh
-+					NDscQmWvIY9acwKF58d+2sY4JUOj/wR1ZSWD
-+					9oYSMe1Jnt5smGcbVEEwvc+oyQ2POVYRO9wL
-+					KKaodgZ8W5BGgyk4IHYqS6Fp7YI= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					E810x3vA/rvBht30WgCi7oBxxN6hPlJn8dKY
-+					uy1jAC9vl2W3J5A8UhIt89sff8kTGCd3dN9L
-+					yrx4PEzRNRKxbCXXF/ZCZdGiG8aA4BiLUTPw
-+					tgtDzuqx2RAm6hxRlYw8iERDn5h9tdA625CR
-+					9cnROxhjx3x5F/Y9hcJf4mz4jMKti486DMQB
-+					uKENyFFBbSx78ZUtFy0Zo17MXV0xM5GsMSgP
-+					gcS3IRgiY72OR43eQ9HXpexGmt3mnQt5xQ6+
-+					QWELLmWNkKcOTZamkeMPnQmwVdh+NGJVLStM
-+					xQJflq606f0e1YMj7FMGJnIG5yJZwrT2jrQD
-+					2N8DcDc9H8/wci8sZA== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					MRFDvSNaBDN0uXJHShWHAoe3163OlwKjh5Vv
-+					bHPOGmMqChzJT56E2YN1LLNHNOCCePWUqWzI
-+					8KUpSEzHPn0T2v3NoX2D59ZpHWBY1S2CFqxE
-+					nQf/qEh34C1N0ue9sDlj9lH0ze2+S5rKbI35
-+					UVjcO94kGKpEcBDPfRDEBcfgoni0qrE0FuFG
-+					S0ycAv87e3wkWeF6ISkeuHph6hSyrtol59z+
-+					KdlMTNY3vRvAQPv6oBdmb2Ri6RgINkb6s5ze
-+					gCR640JglKzjPDyysJkTOeAUK9TZzNuvlXVu
-+					btZkqqSdKpug1ik5WfpQWI1u9RIeSYFu/+ai
-+					usucxtivAa/mE1lsdQ== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					iydE1zSvkIyU3ogg44zbiyv8aMcs/o1peWKT
-+					49o38rb1cg5w1dU6Y6SuyHmGI7LThohOhZbI
-+					gNewSLV1SOa+40a1sEeKuwyMdqDKMgTicH42
-+					t4P0FKdZIJmMtwbRqV4zW1uB+6FiGQbYwyAE
-+					AWMKIbo6MGxKO9kXfYCpjewS3yIhI02WL0V4
-+					lUsw+rupSUbDfhykghy14qBlF4EUCUfIcwZ0
-+					ROm2V6oEF3f8dNYcuSDovgF93qCamn7q0MXe
-+					U3lsmz1B3CspT1anuezpvR/kXIXJVpXSi2Ox
-+					U35K404MZkLzl7wZNaGR1pwkW2oTsWqPJSQs
-+					79ph+sMC8vi9c+xguw== )
-+			300	NSEC	sec-02.example.sec. IPSECKEY RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					YCt3Cz/LoltgpW8xGEYNTIH1tHzuE3BWX057
-+					gEex4Ymi1vVQacfBYMaiDZWg9VeVonQ9kVNP
-+					0q2cpWCIbbwu5FhLqiDQhBE/eQg8eDlY0Gwk
-+					CCSZqont4U94Q0NkuL8P2cVH6KMkTyifYa8I
-+					9/YYV8y3QbZvFVWyv0kvOXuUqP8= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					UwuuJi4OO24/1H1+Tve5xkBiisXsvk8rnPac
-+					34/Wpx01PXiKKfSmkCUX7tREYQDqHeMbgNQF
-+					OQYIjeLNPVEEKwrAzu6115+H2FKCk8DDnxRr
-+					OOAVAQXflDXtZ7op7I7BwvAMsxA0N1r4e/lm
-+					tpeStt8Ky4QVICZs/XJ/zqnMwoOa/QJwY/nG
-+					Kfs+V5VbuZqQQDBEVLq73l1Zb1r8G/Wj+SNb
-+					/d/WBDd8rf+u71OFZKlJgqSd73Q9fQyYtZea
-+					cKiGtOpzkh1WT0SnATNhE8TEDDzN+K9ymoSW
-+					8/gggv+W6L8/cvvfFYkAvKhGgdhuzJS2SE6n
-+					p16Gl/Yp7jQnmVgnoQ== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					Yd9ttghL3MV3+45CbmglhbEDp9n1qH3lfLs2
-+					HKoNzSCh0AGHFwnNbdAjn0l99dk70v0aYZ7k
-+					RVQkYVXqHkHVvQdqYs9FRtIXct4e9bHP2ZKB
-+					xAAoRSgKpAiwjhr0MX/nq8j7UacsNB6ndU5R
-+					wpAy9LVHJi260ofvyAumJazCYA3z/a1N+sTv
-+					O2Wzgkm/qSlx8AKrnTdbOcTnD3Vq/bpRoY0w
-+					RFcs4N3qdkILyTBK6X2I5eh8twHouBoeATWX
-+					nIs+I3LGvp+H0gAntT2OQGqeMaDQwYaRjBJJ
-+					akwoyc6dRN7rhD5Kp8Kpwm/HOJ+I0nW9UZH2
-+					jwrE5q3ghaCkAS24Gg== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					hPq+o9oKOcu4lXZqKZljb5vqEgyXceKdZhSA
-+					Cb9iTH9gQOAdl3xPLMebiiugPaQ9loJgZ7dl
-+					115RFqpykpbM62aMs4gL8qB5HXzeoT4tmxyC
-+					HHJMiIGfBBAvUcbTUXqC4P50NiFaC7dmmW+E
-+					ntAZDbBn6QcsH2La7pPgtoqTA3vANDzvxDfa
-+					OSwqXKaTvaYuuMo5I8ITuwygymWup0DtE3PV
-+					fc/c7K0vxWFFKV3uss3WV9f1kTD5AzSqh/Q+
-+					rxYyixdPi2LlLmZ4K/7NRBy0KLKxXGQZaBkl
-+					rWF0rTpwnJYh2pnfhKJN0RuPBQxUEuMqg2Ul
-+					VN8KhJEgxPg+2PzL6g== )
- sec-20.example.sec.	300	IN IPSECKEY ( 10 2 0 2001:2010:1::20 )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					qJHEWMPK9AnL64sEGYj2CNF10HQWeTFdV4IU
--					hU6O1/z9U4PVOIKmJNE71avxoKOSRBIfAB1f
--					yR6BK3HBHcqsIB0GpGlsau9NQHHCYYDdypFX
--					KlkgH0GR/vEnhTlkEO1KPK06fpx6C68Gr0dL
--					4B+vf+S0I6KbXnP10Cj6u0mO63I= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					t6PoSUCO18D6svanlBKJhl811aei9SkFRuND
--					RM+DV7hvdeWLIY7/qgZnlxIRD6m/Rzta41Is
--					3H8NFLXkIUrB+V/CpXMMN8PWiSgrsoh6Ovb0
--					K5EWOiEjZbh9TxMhgQzDBwwU7M7wXnUssWWY
--					IVpWiEKvqGqKj9SCdV+Guig3SSt6yR16kRJL
--					+63OJW59tA4/TSdyywTVfu3abQzZe1akZz7y
--					cRkgwb204NAJCSLnU0AG9Ss5ic5Zzc3+ps6a
--					Q4dv/7a1YLnvzTWf/WxeWy3V+naEVS9SOG83
--					3qqydc5VVI9dTM7dgUm+Gv0cf3JM+JXehYGK
--					OkQUj5A0OQYk9XizTA== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					Ts3gkpxjiQ4DT0TxAPaYjCWfVyVg5a2QErWP
--					YAd+8go4QDLmMz2hzg+ANapHzuht6LRNaaTU
--					gQlhbT5xKrgBSwcu6WRyWx5YHrR1FaMoH8DN
--					eq8xpzm+81A6TVpMWfzWYBd5YY2itftkiinq
--					ke+QFp8rRtnN9ORY5G6jn0FOIzV5fHBiaxg/
--					oSVbR/Da2OP3XZlDxpzrijXJOCOkn8ROw1MM
--					o8o7V1XH0HpU9sFrT+gb8wp3fg02IgfBKxLW
--					WM7ytoZ8comdKy5HA5WzypVY7rRx49H0fVWb
--					3Lokqe1tubWBQeeJBVytDIgKMwyOETX2kAW3
--					SG2JJuT1qGSN5UAtog== )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					tjylwqmHqeA8Fd9Pfs73MTlpWZRfE0n+WYQP
-+					Otr35nqTntkGdy09rAj5Brx1tEWn8DsMDu/h
-+					iyLnbOePqYBXhFaCoBNVxR3/IgoTx8iz+exK
-+					8a+RFzJN8JTtZ2F66Bw4NKuywy3wQrUECUDm
-+					aSdd48ut7s3venVkYsqWeOUv8YQ= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					0zgPGp2mHOVlSqV1eSy1kMr634A/DktQ2O7j
-+					9rwhC8yYq/hfNvyEd/+q3j+femQ9r4KDFucT
-+					xDalycVnQ1SVIaF398skn3YcJbUvezIvlG96
-+					+8hsTomnwvBul6dWQoTfeYcTjPch63XOQAz9
-+					lkrenfVdqrR/tD8sEe5fj8NysSPPGZYepXOm
-+					lqTHzMRRLkecFKDIgcIGiMbaZID143t9ywek
-+					Y7sBRR2e8V57MiKwA1n4K3cssYy8n4g3QoYs
-+					scBGpKKYJLAoj8wSfMXxq8ne0vfWOrwkI2WD
-+					TkyMpgyI0k0ZW2nwQa+VvSKu7VFDF+O3oKEd
-+					8nNAPLkm74o5Xz21bQ== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					Ggsal8D0dAgBvqf8i510LVt4FrWzK99/tf1E
-+					IwJ1zFPGl5vdkDDUkBCDizhJ7suar1wKBae/
-+					3okQQaS9oYy13BdikijxyyFiL9I3fiZ4YH50
-+					x/ZIDju8whbNxrExYV/xig4MrrkWLcVDBuKt
-+					N7ZKYBpD9d1CigZ37YtRzWXL6XdRrPTkDEGp
-+					Os4At1yjCsRisbpA35xGCHuy1Pznu7wyIe++
-+					+I9a2j/hJFTOsfeeTnRpNfWzQ2d7PMLglwDf
-+					IXpmxsKQKwLgJAgCOZZgLzxUldAZuGIb5/dC
-+					KzCcJVNai7IKpn32dOrRT/oTFXPlZBKzA7we
-+					H3cXS39r/CtwAksnDg== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					eGibxPy14OhN6qywILDF6U2ZX0Nn6+LyxMgZ
-+					E+GUTElgKZVj5MW4Fv/Sc9labsVFPh2jHbbM
-+					vShcRFDeN9s2krI2xCUfwftmR3hYXnRoNCN3
-+					lr+ug75ePSXW7K7uo8JTyCc8IgpdrOMgQVMH
-+					s9ap9WddvB6wcXUnSWr9PYmmtAkYGvs9VbpZ
-+					84lyxtXpXz/NahrToVmip7xjARVZydq+vTfh
-+					WwZJz0NhaJKJdRUDA1kSRF99aqJqnLd21LTe
-+					cLmCMEqtpXx17bxMXlaBUb3B7rq/BKJg4czn
-+					UKvF78/9rEysIUpju7LxxmLSl6q8dd0dX6R4
-+					mHx+wJiNYMEz2tZ/PA== )
- 			300	NSEC	sec-21.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					oj0HO+ZcjJeWeNJkf4R9kYx570wwEW9BKOJj
--					Pf7lSydkpCusVfIlS69BBoBDEVKClw0Aofq0
--					h0KEQclUX7gj5rR0lWHJISHAA/70a2DJqRvB
--					W3ItQ7RLen1q8zMGs7LyfNXPjrQjdrwZ80Zv
--					s+tDaKtZVOUMG8XIIv8thbWarWQ= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					KJmUYgivZf5BE9CmPLcNAIfqRCkKhNbtUTuP
--					vnc7hgEK/ifUBwGSUIlvwg72UuTZcd2TSykZ
--					MUFfhWbBqcR4ejzye1IQaYEiNPW342zLnsaw
--					rqzYENZOMkXSAV2fJo9NrNfh9tTqijtKKqy1
--					5fEhpz4mxecFakCmnWnqXPfsCujQ9a5qvbeg
--					kUrBeto33SH5SG6SEnLqXlHNDc8VLLhETFzZ
--					Ym9LFz5m9zcd5hlETjou6xCFhoXSxg/vfqQd
--					joJmc7/YDGjaA+v2C6xIfPMgDke2BchoYN5V
--					3ylTQP96cuPb9OdgvgdS5VVnXhHjoxRCWjHg
--					7fjWU6QgASdP+1GkPw== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					ZxY4LUFxLnczFLHPP805TWHIkwE8PREHMEBf
--					OAXV/F3LN5LRoG+m43ze+SelcuUkOa8JZWhO
--					5SYdLyV8yzpchrmX/+/uKfX0cS8meg7DwOpv
--					s1vrfIxGhGGHagF/aSAlJx/chpTaS2iRLaUX
--					AMasPRKnFaF5Hyi6mCjbA55wMn53l2xT/KEs
--					dOqXqNr+oSE2BW1cnJv233K/J9kpS9mMeETV
--					T6KfgEUMhyYH6lbGFmplhUxFlS/7eSWh05SF
--					W7OMJv8oKMTZSp4EDqdEr/tc5dRwlV4RJk5C
--					IGf6Gmk/SCkLrLzouLOBQGks9J31Ci7wE4ja
--					mlcQ4CHD4osm+MCRDg== )
--_25._tcp.mail.example.sec. 300	IN NSEC	ns1.example.sec. RRSIG NSEC TLSA
--			300	RRSIG	NSEC 5 5 300 20141212121212 (
--					20121010101010 516 example.sec.
--					GZUj441s800Vb4C0mUVvQfuEtkn6fhZ8+78Z
--					O+nVsn/EcKBhJ3+qLomFDopFGIedDMDN0bfw
--					0DLFkZGlMJlYIOxhBDEmonbmmiFNiuotzlI7
--					7bBBWc881/qgSVVVP5BkZkZzCOgn/Er41aiO
--					AZOXRlgIeGYjZ9OZKIMqtPnVTbY= )
--			300	RRSIG	NSEC 5 5 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					T2KQtM2CUU8g1ylwdjMsIx7e2WI/j2qA/45o
--					DMDnSlqGNpFMFgn4l4/5wJQALE+cskBFPx2w
--					UTZC4W3qXBhrF/QJSW56HU0gYEq/bA7Yw3Bw
--					T6ClJho2693XTBZDwu3j/BP21LExqNK0nQZ9
--					z074CiXUm1pTimc3K8wmrEBNT5G3dKOztd21
--					ktretO7gOFDkLLCHpvweWox6zpsUdMXqC5vV
--					0g4ibDzNOej28As13dtLc+7qrOphmIRYi0Gj
--					+4WsCtiT48ybKfM9Xq4UsspxQg8fE3ztGfJy
--					aKeIpW3GHehgu3Ja78udKUpGHKl9cIN8qL+8
--					x5g1nx8TjwrCSp38jQ== )
--			300	RRSIG	NSEC 8 5 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					zK9ePGE0f6NcsUsrRWA73otHTWfD8uzY0yBY
--					vlmYoQtbc5FtnHLUYb6I4xoqYL3C2ILbpvcC
--					pUQxZ5daykW8mHd1iJXEsnPogqr0WBDyGOQf
--					ad44CCcNiJ1C0Wtk3Mn44Qe4rQE7zpZ42+MM
--					1kBTMFF+dZ/1Ud+QbK9u1gAVagsutJZ2CmmE
--					s+heNr2TEaED+FpUUbNdCw/Fd9Mk+I3OWFVG
--					xrMr8Uh9g9W+d4iCVqgQ/iohGIwNBMTEsePe
--					+odNGQBDgl9GTv2PpgMXETtcy5wDkTwan2/j
--					1DOqYiOdu4BPieVwPTfRWC1VrqI0XzQp91nV
--					DoWdbSntdVtQBt9yWg== )
--			300	TLSA	3 0 0 (
--					30820307308201EFA003020102020123 )
--			300	RRSIG	TLSA 5 5 300 20141212121212 (
--					20121010101010 516 example.sec.
--					onpENNKVruacKg+VOesbEGIffNGUJlOyPqyI
--					gZ1F4A/qLhyYCMqnkNOQSOYXDeYTCqB/UCn7
--					OzJIObaOmm5osmxlHlIALUzP2LQSnRr6qt1z
--					aipTHTzmVAefB39lBgSXmsEI1xvJ9/6tnwUM
--					EBz4oYroKxKkJjAGt/I24WOoSjg= )
--			300	RRSIG	TLSA 5 5 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					kZKszgG8KVjZNdhfWIITRr0Z7Q20RPTNrrBZ
--					b3Q1WXdRxAXK3w9UAcOmb7Yg6m+1y1arrmDQ
--					1MuestqGpHmJntvH4rnEtz8F4BsdxX8q2Cr0
--					fZ4ZzGNuH7F//0jkeSlNFPLZN9uHgQxQ0vaj
--					flGcgB0r3B36DomI6uj2vMGN0f8CS53o04+B
--					tJaqdbmR8BrRDP1KIWe968tq01yhPtrZqtYe
--					+WXy9bJv76fb6N0s4Ak6RZ9vH0vjik+BsblL
--					YIF8A1MV5kSDMzCqU4eoUvxHhc87XCUa/aC+
--					sxA11oyPhMJhY8mZeqZ2xJ84myPSiNGSEEhq
--					OIsDfIdbQFHOCB4Qmg== )
--			300	RRSIG	TLSA 8 5 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					IH5582QvSgX9COm/HqiI1bUu8XNew1RMdjXE
--					leb05YrZIZ+eqoGbHOg41eCAjy830wu7qoXw
--					yXoXDDGt3bYxYAgKAGIQryYT0rNXDOuSeZam
--					/SFkd5EQmslbouQD1SMAQQ6ok331lgkIuUMq
--					vbWxUv3gl38c65dEeP/hqsSgvN6U6INDuzeR
--					tLLt5uvwC8XPBGI8O/0h39+x1GIaNpcR0mbq
--					Gvw9arZtvQmaGwu7TQyKyctyXNWhWUNEL+1R
--					TcIwbCxUbPQswgH8OZrazjs82WuPgSkdk8Vr
--					bfQNXl+4ZZWp35Ah3zxCeRbrt0RspF2Vh1tN
--					KhhMBu46kqIpDunK6Q== )
--public.example.sec.	300	IN HINFO "i386" "FreeBSD"
--			300	RRSIG	HINFO 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					uEfwWvVJN3COlaXZ4oM6PRnyLApSeLFyJOKf
--					9t1+Ds9dTTWg/6THtVRLYwMwd6MJduAKXNFS
--					W8NgAv4el2gboXSGZSRFGkKDjZU/S6nLopvI
--					MkCeYYQuN9w3/bvR/xHB8UJcaPopzFl4t+IG
--					EKmKnFq6GEJOuq88Vr7VhRXxOpY= )
--			300	RRSIG	HINFO 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					p1RR/HJNu5mNCIDPE0JaJz8V6PgR3IGBF3mI
--					aq/FuMlFVEuJ/CQnk6lzpRjI35WAtZpfYUl/
--					Vdj6WvTetDa49imIAn7zdM9pQ0LU1sZHKQ5z
--					m2JdU/r/fmK8QExPYCLhPEMPDTGqOFRrz6up
--					XiFGlmp3YA8pKxNbx69rfYELUsYbjA6+qwTQ
--					AaBNtcSb1l2AdS4w7bedmdzgy/rAcLljbj6f
--					hM2CLIoDmoIz3zO20PQ3g5l/ScSL+zZUW1NS
--					uOec9dzMhiNdNzdqV9fImpySkbfjdvydFu5Z
--					E5I3yrmNC+iTkB1ZeA4WgMSTQIOwuCo0tdup
--					eWp96pY5cRdo4LC1ww== )
--			300	RRSIG	HINFO 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					v4+OOdw/M4MIsBXhX32TjtQJBmB+32CDc2DC
--					LXqvd8g37QnMJHzEPIYAmvEsMRn1DRlB7nk6
--					7HSy2DwPNHtbu4swyYogCs7LGCbzk5aeEZbT
--					Mkcac/ONSZjl+kEiJUav32dp4/IySt1dG795
--					nyjuzz3/4WSC/fv/QJrOWvU7eLqF/bbqQa0+
--					VDZ87U2exA1gq7iIg1rKken3yAL8l1BHBfRj
--					oI+oozIBPInOm+wA3leZMmj2tcCzDvSGEgdf
--					VRB4IIx/zzdVPP4WG/DNoVJ+otM6h1APHDRj
--					PBKFDZhfQda8GT/R01fC8uxm8Tm5FyIgJnz7
--					IQfkHNcMAXCsPo9lDw== )
--			300	LOC	55 40 15.258 N 12 41 56.378 E 9.57m 10m 10000m 10m
--			300	RRSIG	LOC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					GHNspK9gS/zAz0cU8GZBU6P48xU5vOXYov+/
--					STQsf4jGW4Ikbog2ns3/+4kvZQsDNIhbOAgZ
--					GdWMwRPGC1DWXzUw8PIpYe42Pql2O+wm0mTI
--					yxso4A6sV3EhSofqh07dmX9L94N/Q/X1vQyL
--					SPrncF+FMZCX1CnIee6iFUvDsls= )
--			300	RRSIG	LOC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					Lb1zNgN/yVV2ziP/bXacrsBdqDNH+LS63IZF
--					t2R5SLbdLdSsrVlXcL+9jdNObCzqpC/H5qzQ
--					3j51B0mQ5JSN1mQrIXoNsomDUSM164+Dgbpc
--					76qHM4r7PNUeu5CAZ6zUGStgvfFleVC9M1Pg
--					Z2Zgqo9QJnN6rZcYgOjqOZX2U2i8JYrzdPnt
--					/e4/btWs5Im/j+4ZoAmCjjoFwsI2halDEdpZ
--					tS8XA+garId2+OuzW090dPJZpaR8ldB7czOd
--					QbPuwADNWYL98FlFA/+SOd+C5gD0Q08iBKdU
--					ddIzuoyKcsYwLpWLpM/6Klg3Y+7mwMn46+43
--					wx5LzUkfIG97aAOk8A== )
--			300	RRSIG	LOC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					HvUQYw8WP9/DdbJeICJFxhIpUj7VK8LMIa+C
--					ntxAO/1xGiq4ll449e7ylW3qdZMXo/5m8YZR
--					SayHpvSsAhRlfaqf6UO6CBWs3C39jr1+pB7K
--					dRL2RyzAs5I7kERvVR7OCqoWOXkBlqM/dSz5
--					ClaWQE3md+ZMXBi//9Ico/yK6noSzyM7Lrjn
--					aBQUYwFJbS3xsT1rc0UtL4v4Pt5iHUjSdE/8
--					0kA9F1APb6LNZ/VTo/uGzKd5vaRFU1Z4zaN+
--					zyWxrwyauKHXg+JVNbYjlbSXa3LnmKs/xlci
--					LzNvdXiUTHBQR+3w+s2GEMNQ7XDYtM2rYXIg
--					J9KF8v1CU/iQXqqy+w== )
--			300	NSEC	sec-00.example.sec. HINFO LOC RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					qxNbV3M0mNEVBIWaQfMcf5jXPjsmKqC+bcLe
--					2kM+j22RhkRYmhvhJPvw5hNSVjAZDJlkhgHo
--					Yu7hdpLC+xGFJ2TESRXBdiv+0+mxF0CnECJn
--					i0Xn3ftldu5+RFyZRPLmh//S/eSZqTTgiZ3l
--					nH1WrmGnM6U/ih2Z8RzdTzc97GY= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					Tu2X+rtzL9YbC7q/TxxtxCGxslGAUXUD1eKU
--					+nhwSB1/p2A4ZTIVHxkKton+3OM/oCeuy/Mw
--					n6sEkSJRioJcWIm8J56YtMF/v+Q119WDOF94
--					hf8YWuEDC0T+zB2XhLy8xcOye4K1K5wLv+UD
--					leifQ5jgNWtkDeC1rWHd7QH4/GNXya1OrQ4u
--					rMoIHn0uzuRFdP7t5KVIlqlr3I0HPdu6C5Fh
--					FsQC6egvKRGbpNhOw6XgT3JOvloSicX7nlER
--					01roxOVY/mQGP223b6y9mgTqeekVwzrbr54Y
--					zceMskVpa7zamkDcjb6BdavSb0dd9fmCrtjT
--					xva8yelrjvIqtfYZcQ== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					TrcPcHA41scU0PInaREU5/6/yOx7OAB8t0Ch
--					96kMoEe2OXklnx8NTcX8mQs4QjEJ5ABijSoS
--					z2OdKI/XX5xhS6BO1DQvv0TCK1HZ/y/1pO1j
--					50Q7YEUvtm3KsyABDL8ejwHgnHnJ3LE/gnrD
--					fHU8m58uyEIXRVz/m5yScIn+fUD44VpMuQCa
--					QMlUi/1yLiJfOjhUps0hcSSm/eAsa7A2wVZ1
--					YWvYh74OeZgP7oDr0dzUhM7r4HETzY502h62
--					97geaIxgZiciqcfxWaziDD8X+jV7XDSOsJC3
--					aSgYX8OzYibrA+F/MoumBu8sGK/Jok67qD2G
--					hiV7F3NQIXu+MZZEzg== )
--sec-01.example.sec.	300	IN IPSECKEY ( 10 0 1 .
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					N+IOMKdgPX9Rr3i0bbe7pUWq0dck1PoIGnyg
-+					FhGPQ5N9kN9SHAzJqiwyA8Wk1go/NrdRpara
-+					UwuueTlZhOnWUFTeNZ3zHtBawrQpeVoTfdos
-+					Ev666zh0UWfTbY7mXaF4Ypm1xSUmxC4Z/r7d
-+					aatMwv60DefxPnsROwlx1HZocgw= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					Ev/1PbSAmIrukwT1clYw49BaCTNH4CpUhA7L
-+					jRNDsJ+R84lN57O/TPeB17k6YivRNh6TFNgD
-+					SBBhtYnk6YZI4yG23h8E/PwFwSD/bXoYp8gC
-+					NgqS7IogNgFsVyI9YorzC2ngWFHHku02CFvI
-+					nMdA8jp+/pZwYiTB2QdBSnSCtmwoVhQo5uy6
-+					na4/GXeh78LEPVCdeHXHTLTdhzmqL8tNraIc
-+					Esc0OG/548XJ7wzAxUC3AEql4iu7msFFLw0r
-+					5bnv9nLYNF2B1B4+fifOmleJSerlsB+qbXAP
-+					ssV+BENJPKKtykXPv0laVw4fDOkkVL/cie+d
-+					8g4qmvKtu4tZesHkcw== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					Kr8agywhkHOZGdA+1m9zYIGkKKwtGaz72FPk
-+					l1yg9UMVgIDN2vAj9kYnexefsZ9L4jCopJMU
-+					uGD64tXbOeVIWvxdOwwer3GtxSMxVgRhfFlc
-+					AcS74bOXC1QNFTRsFBCAxauASH+sAml1CuKC
-+					ysZPPWuxg3U28dHqbzalNILf8SwIy8AFsmdu
-+					7VYeSLqt5DslrO+xGTqZpb9L3S30MIz6TpX5
-+					TL20ILVOWno51Hzy3v73qLjpjeuwoXDm8V9M
-+					0tKP58Uh9TPW+XC7WnJ/W1NNJAd5LoZ2Rpc/
-+					xCY0BymxdDre6of2DOLmtwP6DqICJB6lSg/V
-+					u8IBAJarrNfATWuPJA== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					pbxReQlDMPgS8HZut3zOBhnpQYVc7aiT15Sl
-+					C3mehzUrn5QvRSlQyZrnwLstg0nx423UaWqZ
-+					uqIWXSTmkJEYGstT9B/EruBb9bc2PUSpp4vY
-+					NcXIWHH8w6vsHUPWVOKPQHDtT5tYtK+6GC2w
-+					dnPFtI9E1L3RyQrgPoqYz/5f/31VLyb4R65X
-+					rMlSZX1oUO9pmHxwogfoiAyuA88hncerKkRD
-+					CR6aVRG3DhEa7xjGn6Hxi7Wo/ZGKtaSNdYp0
-+					KIaiUVIxQhAFIOiuU/9nqDFgTcNw72Btpty2
-+					fREGSFq1bRSTk+CBJXw/UjvLnZdIwJvZ8BxK
-+					GrkWE/rSnF+kmxGczQ== )
-+sec-10.example.sec.	300	IN IPSECKEY ( 10 1 0 192.168.1.10 )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					AOvxiEY8HYQno1h41Kjg7P/U35XRa/EhJUYk
-+					U/PnHwH7/aStPAn0npvZY6pOKGqzZXmGS8Le
-+					B04NPpRU2j3/b2hlR81WvMvMU+BAdBtwct69
-+					gd1aG1+za4sgfiB9BQQELznuJVeo3/Zc15AP
-+					Z/TVYG6cqZNfLw7JPORTCexavk0= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					WoLkHtWH5V2fxCwsSXli+Li1sQE8meKwDMCq
-+					6ZnS1r6INL68kWIsvgCOSmt360j2ZK9JvrsM
-+					vdfOLy9+wVB75tlYWUS6aem8YwG8bSCvZwwY
-+					OgG8BVbZNisutmmRjhUf0unGBRjiXRUWiYDj
-+					nVnAO8rSDNWN/TXzqYMGep06pEEiBzKN2Ig0
-+					Mft/6Ar9vm5fAYtDcR0Jo79YByhA51Fr677a
-+					2p7IfVO+koTuK3MFoRLVSZGQrc7ALFu9UEaw
-+					JbQkk5IDIlJnU8ae/Bsx+B0wgv+px4rK5i5/
-+					hAdk/1hECjNLI95F6hCPHTCR0Mx+lPOJPD0m
-+					TV77HDLGqxBQ0jhIjA== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					GSBxoR9JRcThupcNlgjm/g6XTwyEAF/vHyoK
-+					JmwH7DAgfVhwyHjVYw79PkaHGmN/sUwdenPV
-+					Bd1GKgOUjvjHXvtO6BQ4+mSEOlCbWlHmOH2y
-+					nFSal249NSm9eU4ab3PV7BMFPziGH6o6bhZf
-+					Yfe756/4e0rwCKqiFIcD1wlNeGmwVnejPgz4
-+					i73nRVn55r+QgcC6Qby+jeZiNzLXgsLsLr9/
-+					q4G3Jkaa0AAXmOb7XaFpmEXuqROZzCnceGHB
-+					7biLR4U55rC9DgkJPTLSOzuqRn0NwfPs6e6t
-+					R/7wClYjUt6XHjBwHqSvLiTLrlv4q65eQWq1
-+					ft/uhKP3iI3tXHa8cg== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					eO944SxxYuWjbMQ9XT7Yc/5C8KuphOPU/9xM
-+					CvX0KsZMXIWMEdsjLVyyLTPFYmqpyhA82tWg
-+					3rOhofLSnyOo1ANoHsJ+9dwVAhw41RERhTTQ
-+					Jzv38c/YuTyMgoPHfOafHzgLi55/3adxWsD5
-+					FD0CH56K4rBHKTKzpWtjyRqPqiaPCXejKQeT
-+					Vk4XYYYpDCoEIx71Vo5TZanr6GKfSNeT89wl
-+					wiztTRChDo7GiMQsli1YP48GQGyPm8jRU5JM
-+					h6fJg1CaWuoxCTWX/v5+1rxcIjZQx227FVka
-+					z9rD3n/xA2bv2DKbLlMBc2nouPIb7C3+3wrG
-+					iNRVyhoGksoDY9F1RQ== )
-+			300	NSEC	sec-11.example.sec. IPSECKEY RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					XGhMtyCDdm4i3LcU6YgE+Cm9hVbEzUZY08Jb
-+					7wBByMAbO7k/x4PTrgA7Ig/cTKbS1YF+cDad
-+					ZjIGhfljB476tAr42DiyXLbq9nYBgk5jLpIr
-+					hk2nvvIKOThdhQRAH1FSA1XPWXt+8MRNqv2p
-+					vqFUf0EThn2JobC61evB1FYJr2I= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					oP5Ph4R9BnLVI3r3btH6NdWs2hznmWt/O5OG
-+					qW2o5ttsVsjllzCV6RscxYrh/UmMCllXIhm8
-+					hMqFPNASCoBEorZ8AY90B3FS7zXw2pl/B628
-+					T1ItaRai837uBdbrv2RQ3JXYqBZEr9hLxlSj
-+					PsDjKoy8mkVsDrI472wY+Ym301WrWl0wKDQR
-+					1JS7fGDtRdY0YCnx4n0K3P/04zle77Efmfij
-+					dYALh0mlZ7JN71pfSwMapWB/JTNo7O2udWGm
-+					rEM/zO3eJH8uXhyTe4CFzAWJM+pbdswWwxRk
-+					7NqHAohC/YkSf88C+aYXijCZlYJ0UdmA7nlE
-+					SiJWqelz2nMww+zoVQ== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					QRiKplqddN7ogKMh6qu16OSH371f6+5Cw6OD
-+					6A7kWvsP4s2ie8Fu9WfYyWl1qRNWd4gEYc5A
-+					BkJa49zi7qmtDvOoZRD1KFSF6N3vKmwUbBVE
-+					c32oxf3kQZxs0Dsp7B056Pv1BE0KaapP45Bb
-+					9jwsaJaO/x8muLsOjokbfsACfY/XlJ4kQGrY
-+					z4hwJ7xm3b6SHY46Zv6XRw1TyW2CvHkx/2c+
-+					pg9gCCB6h2Zjn56FRQPHPcZqYMBroK/azY2B
-+					4+GbKTgfA/NqGdw2lf5bBi2fHziJhk6sWkh3
-+					RXRRYTQHMZatoehblQ1YR9Bo1F7U6qq/RI2x
-+					Tdbe/4cHjVQCkO7t0Q== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					VaOMaZWd4yo3vG8eFaeErZ1PjSpkKsRHNtqA
-+					O4EKRe+0SbypAJzg7MiuXyqFoDh6wrMopq1h
-+					MwGE0PrJUnMQYJmtAethsMpBkUtxgqZPaFaH
-+					jHUTRhaBK87jZDKQ0R/P5gw/whPQK7DJnwkb
-+					+4lj9ZT5bbJyJfvfX2jdl7zLEllK8ShboiqN
-+					v7LrrQJECCsCe7PL4f4qyCKW5zY8DZyuu8Gl
-+					ifE0+wY+8rFNnJWnRShPBivyy4evVsbgfMFw
-+					XRqkW1yY0TGfJA4C6bloanBbREeQ0ENiR0KS
-+					EfLjVCQqTn7UR+RMhphqYvNvCYKVIQKk7em9
-+					jb5HCsYAE3E5KB2hqA== )
-+sec-32.example.sec.	300	IN IPSECKEY ( 10 3 2 some.name.
- 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
- 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
- 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
-@@ -1222,70 +1649,94 @@
- 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
- 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
- 					zZP5Vd2t )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					dYRRx1AlyU8o0KvNvy0mAK3jU6x+BnioMJ69
--					0YtKQdcakpyFUzlswYxhB/7YIm7CfZSFOoJA
--					3ae8CkzD4sSFthM3BZjvZZZX+nRvw4lju9oV
--					5SzgrhPDPnpnL9ifCtGVTWA/8vVh5dPHAZVU
--					zh6vl8tnKQrwmiVApLRqZu5PFMw= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					cxhg/Zu4Y7Why4ftvdVWip4dmqIqi8/qACa+
--					ZdalnAbGyRAGSWAEAG19tLBtYMFX2NFF6yM1
--					Em9M8e37tHmwyNLpEnTi9QWGTOs6MCkUAIIW
--					teCAGiWu3MQMS5QiOCAiJBddLCrV5APi+Uwb
--					wWavFe5RqvIPxZ1GVG0WcgdI3GabVEavPtyd
--					7zSeT34J7Bd4bJxpPgXQiRWZpJkgep1e7xDT
--					MtEmhrUU8y2Bbt5WT3k0ARNYOh00dNjEDvpx
--					e/pIThrE+xySXvmOUZrvuP8V8cT73IcsMw5I
--					W0k2WvueLUDZEOHQrd3Yn0BFMnsVAnG/ciQB
--					92Ma1s0gM+SgZwOHRg== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					YdF5IyJaQVoYlRfuldCFW5CC1qICMS4Gjrve
--					H5GeqLHReuDhRVe5T7X27MexaC8u5O0Z89Ua
--					4O5YV14rACPv2Atzk+4wlLmVtk4Oswu30yav
--					NkdNIKDmvv8voJnjUkYTlDng7I7m9vNqCUn5
--					Nw1ciuawIzrL4JTdFUrKFWoOEYw/c8NHBhre
--					7RqJGzSbjr0Qo/Wcur4Kb2LkcuQtN9LSx9c6
--					wqNmOiX5WyKaS1DDNam2RuRXsdz1oTz1brV0
--					3LtIydp7F+AHrx2d5bhtjQK/v+tccNBsIpkO
--					BqXrXJM0hbo7cZ0uNGSnlzjbGKzF4jqaX4pR
--					xM/0wkKHe4MsnLg8hg== )
--			300	NSEC	sec-02.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					Ny1BBKgi9V9hPIQSHbLcmLBsglGjGFiBzrCc
--					tSaGM7UnbNjqiq9s1h7wBl9Y9CmnIUa0s3Hn
--					wsf8KQkMQrg3Obq44f8a+YEs3m0Mb6KsvrMj
--					46QswOwr3bXm9DXzyCwYePQmeed/w5oaOhe4
--					lTVwFW7fxug5PcfIe89MLMkqIsA= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					jEHbUbVWirjrY1WkWHojuFXqw5Nhg8zax9jX
--					eSQ49yBlwSnmhnEAA02IIYHyfrdnXEMztz31
--					r/bNqfHn5etXoPZvxxlj9hNxR1qBO/ZfR9Cq
--					pzQNeAxrVP1f9xuhcZwqMPjEqFnOnkbjlcWz
--					vLv9Ko1HOO/ifAhMQEwviR4yU3HEdca6r9uO
--					tBGo+BTuoYVzQqPhIYpA4QRStWNOKgIe/cgV
--					Fv+fvWnYzYXY21w4yRYv0AR4rxYXtSvX0/+u
--					fV+/9r+fz5O6ZX23fO9GrV/P2wi64m+B84Wg
--					AzdkstuI8eyNuLBymjlYcCgCDMJdE9W+E5ER
--					ABXyXzjWDvig6jkAyw== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					P9DCOfUpee9rYTXyA1tLCYheQDSIN8FYPee1
--					9evOBiJooO56RXM1TOBz1NxpIyaarFFG43E/
--					ZheazaUogq4wPBuG6exJiNnPA/cPV/7oLRGs
--					odaNXU3vKyTcX1EzhxGPvawZt33dxxGBdq7F
--					YaCg7wAvmV0LM1oa3RVzzicdNLtBfNgO2Zzc
--					ra+RE2mhtiiDjpFXeWP5kVd5ck7pVy4Y6yGT
--					MtL1EfiMQROQj7KNsuRMbE0bIEaYmwbcv8yy
--					PJcs5LAd/PYijHY7iat3eyjgGm+FTDnhsH3L
--					VjZspLQaK9jDDZ9bWnfC7pBrMODPxkFHBFQO
--					NWWQkJ5f96JrMutnPA== )
--sec-31.example.sec.	300	IN IPSECKEY ( 10 3 1 some.name.
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					WFKnw31YDWLiuNfHWYZnghyxu1m3supAa1u8
-+					BTroxFvmWai9zunHo0n6JtQD3mwwYxPo9Vgu
-+					FXgXuOaB/vnRqIP1gbspgc8CJd2iBMlGeLa7
-+					zCsXe9t8OgGL+8sLCDZpeWJiLmQPEu9+rcgA
-+					fNP5eINMWGzZFo0O7hmEcTQ1zWw= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					dD/tZ1ANTC6FYZcfJlXBC2V8I0pvqs9bkbYm
-+					bicN2Tdcks+BlB8NWl/muWsr2/8r08KJpN+8
-+					mZnOpCbLVI3wGjYaHoH4wQHfEo/W//gUGUGb
-+					He8R/YMCh3BOjtvzwiuoePRmyyDiWUOKn0or
-+					bL3nf6cp/9exLHdNnXe+8NV/A14Y735qGvni
-+					k4e6lGYyZ4wexmqzj+QQ3z0glPe/iu1wUHix
-+					9stdCHh28DQI0SxG0U849NurrWEsBkNwA3t2
-+					EHuIIPtPrTADGvOD68tVhxziBGd0SyqsHpWn
-+					vbS2QWLzWeKwIN49ePqTYMFp3JNbgR64F+ty
-+					77NbquNRRlKIz9wT6w== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					lr5WSXh3JBrHFzpfHiNTITkFX+z+s36o/WOV
-+					gYc3aT+BoWPkFPFGn550rYixJZUM1az7zuGS
-+					sTGi7y10bT57dJfw3bNqxLRzCuLO3ppmI4AT
-+					0xfIrrTJqm3KAyXUiXQqJ/e02eR5k3A3ptfv
-+					uraQQaMYVzXp6RYNKojysPNleNwwjjxoZQ0M
-+					9VSdU7Mwbu/USQQ/T8vQPOZ+pVAyadBEFB71
-+					7IbyYkcttSIUEn2vNuY06Qo7dpS8xcEdkt3N
-+					TP5sY4tOLDAm+Pov0iGCzf5XtxqdnhA/0k0W
-+					yxTSwMMHE3gwmjVmw8F+pUfLhEayC6BoUdME
-+					36tzfs4MgRzT52kGjQ== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					psHHwUHzPaXdd73twQNarWkgvihwT4qaZk0H
-+					JL36KwsMIXacL4gYhlv4k3Yo8fTk/xz1ea7R
-+					ZQo6RbTjotpkwXl3JKL2lBbUQgisUgBNqrm4
-+					bV9xcxxoeJh70xSyNsPKNRlhIiQI7S59lESy
-+					LnmLGfM2AxjAVWIvkyAPWkusuKkE29YjQx+h
-+					OECKQO266Aln6XWpglT17tUHqwk1pMsrSmYS
-+					8rhP/g9s5euVuGYMh5KA3m8fQWQCs97CVofN
-+					hJl4B8RE8ZSCQtYVKYTAcZ8Uxl43IZGajvc0
-+					aYlA/iDmsm1D8Z6N1e8mcsefjJnXYMaOunsd
-+					uVoBjKxAnLf+ko4V7A== )
-+			300	NSEC	sec-mixed-30.example.sec. IPSECKEY RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					B2rLde15M3+mnWcVSgP536sFS6jp0w2m6C9Z
-+					COpIAxg+hFuESbnqC4KTQsjiC6D+r26r9c/F
-+					YNy7fPlKTpG3+BfmRKvx0M48XTB7kuMZFSv+
-+					3bscm8rNon7QzCan7mMaBaK2iE+B7RHJ3yWQ
-+					lclS4/ISJS6hOe0mJWQ7MZ5USZE= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					ZRvKcFEP5Ewm4uKrLoE3Jl7hSAKQBPNSClJ5
-+					GKqdQIGEgFVY2wJ9oeWrpnrBeUNKxqAUfsEX
-+					X/8WFfkYFuJWVabi8R6MQ6PpLV361jctMXhx
-+					zbym0NP86yuOb8RLzzZLR8h1RXWdyKcbSRY5
-+					BJ/bRxHwno1AKvwgSd4bOsi5jypytjaXW08s
-+					VeKzZiiqx9CabukMS4KOqLgLBrNzyE/Kjd+l
-+					j6SkvSAK+9ABMNWPlv03lnbo3itK7HYUTNVQ
-+					DoX1o0MePgvYxh8A24MGZxoZMcHmxNAeUYM1
-+					CZ1GxbkVZ398YkI1NnvscW3DOGjoA739i/ha
-+					4UPgBPBEv6WAdRwGfg== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					04pyV9O+WCy7anxAcybbvEcSFOQp00Pq49PV
-+					2EwfaZwmATg1BooKXSfHepppnSJJbUAc4pm3
-+					PUJImhSpPQI1Xthqu0N7IGaA48a+ltps0qUu
-+					EeZqAWxK/Un6gDt6iguqlQZnMuCPs3vY+VaO
-+					ObHw9j7LTmbrSOQ7/wbuZEq/J1/xSU6SkePK
-+					pp3A6DXwfhETAx3xX9CfEVYdcicptqdqF+Ci
-+					VjLvUoTfeb3UJn5Fw9UNSD6H5UaxD8k7WVNq
-+					b9Wy5mfRrRlu0fuHNFmVFLnnM7p2UK0+qDyf
-+					60a9l9V9L04HD1ttW81Hj4eWX3xNEKYl1Tj6
-+					NA3UYQwNU8Nnc5FF3Q== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					beTmIlSaUs2hWD7A+TLnflYGpSTO1f7k1RAK
-+					4b4I8VPQnoErHap5PvXovIqIjyJz7tZgb8ht
-+					6sWcASJmTCm5BO6PVROlf1ZHPmNGrKz7/sVh
-+					WnA2WVCtsY+EzJo7sAiOl/zgmiGA+cKGyx4Z
-+					9cTDZnYcg3oQn//ZJOJPFC/FrauNM/rDsEV0
-+					nAaPTP8o3Td/Z/0jbdvSa/w4F8h2V5mVLWZu
-+					ieaPH/+xc4hRRHy+ixDZ2U9SXDpQIBJZBFNq
-+					PTYL+ywDNrcO+fig3fGNObjpL7bbIeSauBRO
-+					d20xkERNHSthmdjnXDdReGxdp7I8NTRTj44T
-+					1EMikumdg7FKVNQUoA== )
-+sec-22.example.sec.	300	IN IPSECKEY ( 10 2 2 2001:2010:1::22
- 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
- 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
- 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
-@@ -1297,70 +1748,270 @@
- 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
- 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
- 					zZP5Vd2t )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					ZAqqDBfAVkm5GAkLn0I+fY1Yh3q1P7c3953w
--					DHdglMo5DnBal5ezQH7c0vrI8GvJJO8fG3T5
--					MUZMhTaG648LQJ1oGQdky9PREi4yrFvSQlta
--					6NQgsPuAcDgtEGrKsL2IC0dMV3lkBV8OOqpz
--					JaI9HlxvLorGmLEEaBCNFLi4sk8= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					UZMDwvoYhyTLYr6PATsXcuZCeuBkeRXmfH2X
--					ishLwWnnYQ5ghMwkl4qtmn9/n5FDLwDkRtGv
--					iLpBEo1VNxGU2G/PAYTNaUGcULQFeGVbbAsq
--					v9427G8fNzGAPhqpBHRd8JRQ/eeoEA74/uKS
--					phs8FNUO18hEKmzol4JqchzSSIFSW9/bBaKz
--					Y6TkCYZtIutiBEHFRTlavgbyWqMxdXEji+Nn
--					Xze2v+sRi2kyaQFS7zSWBHH6VFMh0KygxCND
--					x5n00Sdl6aljlpuklNn75o/8iEkFdN2DsRI0
--					tkVQomX6js3SgTlQ2C2FUAo05jxlxzrIfcdO
--					/DcAG9FRlPvHoEhOPQ== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					tnQ2kFyCF7LHz3BpVO0OVVQVkyjwq+POLBl9
--					2d7WjjkIOnpaXMQRl3PxloQ5+eaTrPejynKU
--					Ck5BENCxzG7RyRMi4I5ewPBgrbVL+xEpVOJ7
--					9WsL2xKhkcFpIPcqWzPzo89szXreI++xEDex
--					WuBWBQ5t6K0+RJROl/yoq7v/AGiIsQ0QvESH
--					19YnNaXmhjBQVnU+Z7+edwMbBCZzbrq72Qp1
--					PH+a4wUOeQqp0AvSm9iWrsmK0k4iKq14fHPy
--					17TlC3PanW3PnG8DcRA79rBxDf2UWOcj6C+S
--					MVvDuJHjKHDXogWZHF4k3Np0lddMta5uTlfT
--					i/sXL0nKu1Ld0FWtvQ== )
--			300	NSEC	sec-32.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					YtGwkJFT45E5qfMwpUiGyqclXQTdgaANlprv
--					c11f0o6hy2U8I9bbeji2sD35xRB/gJxbeKUU
--					ASe5cdjJn7BuBRVpob3UItRDJMqTp1jihWEt
--					Z+ZUp5s0BC7gwC4C+879+I0828Y+X06NwE4L
--					PKt4eyZdl1EQLj1lyBKpKHxrMys= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					5bW1ijtao7NmBEWHKgoUg7JXjKcpz53S+LRk
--					vm2VG7Eo36H/3J+HZPPAwCSOLDJjh+CAa+E3
--					IZyuq+GIA+0EG7otHJVtc0dN/iQs1lPjdqFj
--					3qAtHIuftfcobQ5LDbFHh2r3VH0FLoaKvQYK
--					8nb4Uk43FRvK3MfUvUGX0VtkUggLSktYLdJN
--					tqvJCKnR4ydhMwBudqiTnR61dJkTjJS+hhcs
--					MqGNiAFFcbNF7WZZT88hXS3we3vyyAjfPUQi
--					QKi2BHK6IhthQ8tDyDu0hwX7wpuTNp9++6z7
--					MTRc2HsPjSyHc/1xmNFIFC3jJwjJlfZDMl8Z
--					5FvTr3nq3OI4XwtKqg== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					nEZGkAFPbQFS6bLUu4O3SzHAe/DtJs4wTFRe
--					LFN8SSp11JRcyPu5VdPjQ6EWNbHvmB3CWs3o
--					dKmsmSWtpT+fPsLPDuYjijjwXe5fefr/wRC8
--					VRr3rGqC3aoXm+NuaXMEKHHOf4MeIGVCDK6D
--					NEjPhagr96bv04SwrL4/LqclUlXrnMbHQe/f
--					xvULs6IyvLMTdCgEMRQ64eJLZDIerZkEPEqb
--					WYqy11ViCw+ASdN5lg/cwaXOAQ/Ao6S8Lsqm
--					DLy1rXe4kRHgMsei7c8/X3Pre0ZU80Bv55/s
--					vioJUwD1wihD41+dBCU8aPaxjuyRK2uqnyun
--					MKn/jYFoyNLMy9+nOw== )
--sec-32.example.sec.	300	IN IPSECKEY ( 10 3 2 some.name.
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					iWhWTw7iJntB+YHQzcTxoQ+6lzzXXAS6T/w1
-+					JZG3YDQSfh0kHpJfaNGmZH3bA2iHbU/phU/F
-+					DSjUCt5zu2aMaCRM4Gol8Au6BqEY3DDKfI50
-+					IaAy3Uw58J8f8pM+PNI49yHrVDc2ldoe1aaR
-+					nczvy3ifuq21ZMUQJMzd+l2Sr2I= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					PNqqrfsn3yiz2jzf8Gf988KbXIQC8szY2KFY
-+					LcYgf2+Hy+04TgSglJ5YPGUvotvfgH0n/oeZ
-+					W/TRlj3W18zbTko63oFYw56pOVVz6SwRrz0x
-+					swo7TP63OmgBrefaSbLW2u7hLsB4oB1MH9zN
-+					C72vx+fDX3Pz+VolB4AP11bLZjKILgLydU5p
-+					IMJUSWf/DVP/LictbcQkRb8bvZq2LeDZEvyE
-+					l0sGfxrgn/0lwtRRx3VOAunOnmV4KrTSwC/8
-+					XJWpqFsEPftILsqscglUK8RuWMsw7ivMClAb
-+					GbQbp1m/vfjJAT4RZQ1yU3/Q4qTSe6HX+pKx
-+					15TOhBSlil3I4P6xAw== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					MMoNOaud6z87L6uapJ0VfB3/R/SE1Bkp50qP
-+					NQ2TWas4vWgB4woubS0pomneuIyVABpuYvHR
-+					es57hgh3XK12OfYZ4c8nh/KmoJXfSNvWSBXq
-+					9orJHkmfDLES3djWR5zdrOSS1xIElYj4QL2S
-+					eeV7aKR1MrkyNIUqgqK6Lqdj8oXjREpTq/C+
-+					H7vdw9XgQeWZn5I86cUEhjf1Ugj+w8+hQNSI
-+					eoFnQCScI7lLO0Zn5uJg+X74/6JpguluwfAU
-+					8TLTdFISo89fvDkAzZQ5/WWW+XseV8doY4uf
-+					uWL/EfOkgSVb4rJuhN4LjaDpNNwKVupXUCgC
-+					animCObiB4dhlAfMTw== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					whhkXRVK2O3u1oR1Fvb2m3MIsZNi+6MtMjuK
-+					+h+r5RsLVcqhiFDUZrMiqaQomt42NQJNFn5A
-+					W0tOTudijAm7EwJyYg+m39LSJ8WJpH3Ek+po
-+					P/PcV3nkmDCHWVzYzRixP/QIF9hTjo9SiUAy
-+					++jP3S6LMnfHkGFIxemxqUwO4eotrvhNgVOA
-+					A0NA3UYMmbz5zyJcyD+Bsi5IQozB6GfaPtgi
-+					SBrmoNm5kBKM2qW2vmCYpKTqK17kwEaVgE6R
-+					tawaUy4lZK1Uj9O2vpWwnkJTPoeIYdducoAp
-+					Xet/azFBTh3n3DGOuYlk8xzrtYys+/lrgl1F
-+					9D8eBgSO8oRB6i1jrQ== )
-+			300	NSEC	sec-30.example.sec. IPSECKEY RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					h6dh0L2hnMjLbqHnfBW7zVcux6WgU+Htbt9i
-+					/s1xH3PYPNSB4YkqddSVkBEtFTkgZimOseEM
-+					nPGSPPqONAluT7gIAksWCqqUltbck5xLHbww
-+					Xv35SLvc2gVtxv3iFpxyid62D4mucIByYdvd
-+					l+6WpWU/As4COnT7HqCwTV8y1kA= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					u+WKYXFuvlOUudgJeALAAPscGsRZUM9+O2Z2
-+					XkuEAzxvZPiNxAGUg/sMOP2gVgfCrdMsKPd2
-+					/gWfvNyqwGF6jZHfklOJfnoy4apAa4qVrvYj
-+					KyCBKuigzeXjSpGMgohP86e5WbqVFkeV74zz
-+					fTYum+1VVrHAMyC1n+96A1Ssr1T8ApOx6Jwt
-+					T+3Z2VdxxPBOyNmQLKNzVBcuM6WP/5dlypPk
-+					BdyrqJlfZXhqTM8yG3MMOybmhYDLvz7Hmo5l
-+					I7rNrib3k3VLg2Pg0r5X3Yoci1LXQLo36N1U
-+					fvfApdgkP8XraiBSGIFBBq+Ouy7tDyll1HHa
-+					S1IlxGI7+j6g0gxTEA== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					Y+pNKoL+y01pqsQk/R3ofhx8YGTt+PkomQNk
-+					9NRVhI+sJH1opj8mDxSHdiw6UOHyU680eDhU
-+					i5jcOZSFvzyk9F08EfC4+Ko9Uyl4QFK/0OtV
-+					0rZ+xoRwOfB3xLlkffOc80dCc2WZQit2u3+R
-+					EYguqgNGbzuaN1BNXG42K97xeLiIU0eGv8rl
-+					mpHs39Fzcl8JiISeaQ5rkmkvKfpABq0jxbmp
-+					IIAJvSkxcuBtHmS54zzyUt+EVTxIRrytZNCq
-+					9rqdOV9C8FTfpMV2iVN2GBpH2jPClq+j8L2N
-+					DlDg7FRdR0ydTsudKEqUWhr9562LPL5/kIcZ
-+					4+IdhPjndoN9zuWgRQ== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					LNQxYEE1M3w/XlXaYlh+6TYj0tBmfAYrBAAf
-+					Fy+H2k4RX4gn7ep/MJgYOEzYJr9kNaWWADbt
-+					1321oKf+FjQTe6qwYmaRz6Cynp/d6vVSliA4
-+					pRhr8tIsZp8vCtHLgBILFBNFgu8HUtdYL1r8
-+					souiajW0zNsGd6sMCpde1PAjGsJjTM2/O0ry
-+					Ddu0QImJmbjsEWWaVx1C51ZOJgbt7zVHtfTN
-+					mbpYEf0NKxGID+aM6t3Ih7Ab8yw5GSyYS5c5
-+					uBPn1IEc/JAiEjXDpjhJ2TwKbAi9w9gYny6o
-+					6R+bCy9ogSgtE8WfLcmbX7nqQICM+c5B+YgK
-+					prqxsvSaDfi9Ntrjtw== )
-+sec-30.example.sec.	300	IN IPSECKEY ( 10 3 0 some.name. )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					n1/3YCfqAJhwmG/+X907lQTAdwoc2m7S+HWY
-+					SCB29a4Kum2jTyJ2TP5f67jAEbY+JAnUB2HL
-+					xGQ4096yXhXORKlZQ4jbGPZ5TL7AcKzDdaIt
-+					EoyMhB5IxYRfoSodaqHxw79CR38PzCWwcMsW
-+					spJD3yLzAxAGRN1g3q9unxBLtDM= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					kHFdQVysC8wtp8X4Vn94KaogvEzjBoxOB/fa
-+					NiklxzLxLFtwC4uwTvaZebNv4RLfuwtW1n+T
-+					pfIFxMDJ7fog890mD8BKPVZwKREohTPyjuTA
-+					tO57EyL64A9Ergqvjb2BxlXEo8q/hqn1PQ2p
-+					53T8wY4Bgd1BWFoB4PcvxNKU+SCcxSt85fyx
-+					RsUOnJbY0v1aGkOJYSXFHjr3VeWsc1o8lzxN
-+					mMO8qMwLsxbLr1kEq03FNNlFwTmpIKUojIwV
-+					78hI0APghgVxDrHNhKeRppuQlApkcyhDIjJd
-+					PEmaIoZ9azP4Otmi03C+duaheiIW3fv9UKzw
-+					7zoZ3Wa+HXM/joa0Kw== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					dQCgAn79u7gPzfdWGaASCzI4A9lsQbeT/wFs
-+					io+TFnqtDlhgaBH8OBjsLT9waEAuJYUbG+XM
-+					j//s7Qkc8gUwkbWGmSWMRBdXOcLv1yJPqb77
-+					6sGwNhWLyJ+wI442Ng3r6OyJw6oWm/HDwzus
-+					aEKwTDip2qPVmP2X14CQuOhri1pNc51vOTg0
-+					m8M2UsOBlmGQ3mHwPgU/zxWHjwJDxf/tYQRP
-+					5w2uMcTdY4kdydmLjaj1vBSln1ig8d5PaXiv
-+					eZCYPJj3+ToXtQbR1SCGksnwYTjwehfl4dq+
-+					60fiEytN8jAhZBqXcd5JWuhsDe+78J55yyzt
-+					z+tr0kBa+ClqpOvdDw== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					EV2YvMX367otPE5fj/NlAZdVU+jnKPvEG9np
-+					FUxtF9RzEoPTffdGIALsvGTzvQ1MRQrPT1xT
-+					dKp5sJ2yd+oAj0wMDVEHnDqcqkATFu9rV2zT
-+					V6Ec2ACsGKCzsIvynI1cm3FyaZkRa4IUa/4o
-+					iqdYWQbB6lvFNxlyxLsMjX1gkPE0bHYE02xF
-+					XArlqnCmbtaXx/EWTFLiOx528p8x8ZD5MN2w
-+					K985CA/oxOOhQc1DZ1R47ELad4a3F1/g+2hM
-+					V5FvA3bjQ7XJyAgjYFufJSyP0N6HLINIDdj/
-+					xB537dxxShUB11XFzKBtafrCRLFhrQ1Ksauq
-+					om5sY0Pm8ZtdTGfm4g== )
-+			300	NSEC	sec-31.example.sec. IPSECKEY RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					LwLKdvbnWMZOdQGkhOYN5UmFYO1jv6sCemUt
-+					TSVg/ekhh598VJog/uPpkkyc8Z5fWDNXU7qa
-+					qodH9o4ybxEKPTQMvNZhHGqEBO1zrFb+82YQ
-+					5YFBbmyHqtXZEoZsUBz83pVqenBJPvhk4fHu
-+					I2KzloN1mll+PxwP6ITX609QfLk= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					IiRrrSBHzcSODDc8rl99LDQ9+X42WqVLOTbs
-+					aaECCylMz7/d3Md423p7ZbZocZuso0fbC7RS
-+					PVPLfZGzAiiPddeb743XoH4oPTrXVShQoTpG
-+					NZX8+9hXmaI9VRVjtelRLvR1uq6MFkUQxBR/
-+					FJdVv8Ms7yYgX81DAZ5X7jHJ8g46zfR5vAaY
-+					BieizGl0POVYvgO63JI5S6Wes4C4tchMC68k
-+					y/FXtQZ+7uOhgpJmr9gpgkHDOa17Bfshu97i
-+					eHvaMhUbeL4V9mkGX0lnc7Fs8i9gi4p6rfx2
-+					cuCl/hcgFweMDRRoV9yTOnARECy2eOFeM3Yz
-+					bDKUzBWlp67bL4HFTA== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					t4As9gdV+R85vaKPjUKFrHfDNwe5kqREgeoM
-+					xWqEo/jVkGBDa60UqzUutLGT7O3zjwZa0Kl1
-+					g4yqCuiW9VhICtUd5Q7gGnWnSGBFqfvQVrae
-+					Fww+Pbn9xqmmeTntYtMq/OgUxrk1mdlLxY1B
-+					p5RFleFA1OAnTn4ZDGEUWkBuMP4TillZwsKI
-+					4W3qMzLfieOB/gknJn9JLPKj4+hIOzUY/r7t
-+					uNEzdpTiGP6/0YlzSjEwxzO3TuN1nrdgmnIk
-+					oW0GTuQCfZOah7xAdYe4oZemC2u10wK84PMV
-+					X8a8F8xWtUO90if8JEYD9o/BWBeoEUE3+5I1
-+					51VUfzXGG7kVeoaW2w== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					qSr0muO+ZSs1QIC68tsr+U4UlUtYGJ4Ygx/1
-+					PxoHzBTa5U642csRN4SDBL+5J0fl5tTkDYep
-+					piPmI/wgy6wnQs8hhCkdPPaeJZZ+YjOtcTr+
-+					72skfVX1z2aRRg4tWnhhRGNW1hPxYBawCZhQ
-+					Ktg7XDCALip1trc9mns2607rKhqCjv8PoHdI
-+					O5TQFmr4Xz1RW5Pau5bo/rZr+Qwn7mxPR1M1
-+					NPAuWpLJvQuaMcGq1A8IJstj3JyFLhgbwidz
-+					hsu+WeGio80Defl9VVE1COQ3ahlgZuv4iTlT
-+					EfQzSv68OKrn0MDRIAcE/ojVdYI7XY6HmCAm
-+					bez0AQJM300Jxrr4Pw== )
-+sec-mixed-30.example.sec. 300	IN IPSECKEY ( 10 3 0 sOme.naMe. )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					ENm4Dd0+Dx1N/BOYIoqlq1AbugLTxHLeNDyg
-+					HXO8zpgL8yTaa1U7dtE04wB4vYx0v4SYpJF7
-+					rFafGsKaPEvRxCbbPJ1K6/cWReYq1droXdPg
-+					YmYn2qKB+2rNqMhJsIGLhsFxJys69UJmoLoW
-+					+5djG08e62r+UK4EzoE8oz3iGVA= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					kkk49jmaU9PcciLS1yAK93kLIVXoXrdm0MP8
-+					q0BKwm48RAwia+E0p8HuSNAgMrHWYkSJJHYG
-+					QoTwBsMqBaL+6dE9+1woGa77Yu48+orUSC5L
-+					3Asx2tCc0A3ulYS9c9Sh5L3Uu4S8tau98FPG
-+					VcijrWzMGN4qIh4BNVxJ+ct7AqSPdsOqK8aj
-+					IfCZ4kUaUOYXWQeDPTfowhhk0YXBzf7P/v72
-+					navtsoeiAHCh7BOl502kQZ34XGkWNXnI4Kq2
-+					HmZ5+YdBVVQT87aVSDdZDvErWn8I6VLTaQQ0
-+					8VAog0jCL5DHXpB0ESbdxlWr8PlElTe3eZgr
-+					OFlX0SSAwEB21esr9Q== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					OLfBWi8gku1GmuWBRiMYWaH85HxHTfhbx+OB
-+					tmzJ6k2cICoyqmJ7Uxrvbl21/Qy2evrQrq90
-+					X+ZS3XbcrAUN6vw6OU9cG88JeinMexRADRjX
-+					WzaJx0JN32+9ummvyf+f3G8NtxjYQd5KLR5P
-+					lOUv/rm7jHgcslEsTlYE49r+xrr9upoZdJ84
-+					45Qy8mqjy3hcErT0X9jXV+5qscQ4Z9j679rB
-+					eLQcLjQ3bW8IeRqgYB2+2PDUb6gcdAkAR83V
-+					KBGbIwZeO7k82BIUSNDQIFq1IPP7+cFWdmFR
-+					uaZlFWFgZOpSwiy3VIkC+lzktjzWsYUEymQW
-+					6f72cdXioDqTX2Tcyw== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					xj4OSCDJKYoJrSmmtJPj9Gcan9iXkliNoYFt
-+					uKA+nBOIRGPq7V1ohNSksdW6fMIKEmrR0MwW
-+					mVxxRuKPseU//i2QBCBzQBz9YbmS9/nXx6PP
-+					UT8IOG592j8LojLxxp61oH0MB5t/cJUQ4ymd
-+					JvVT1NjdpEj268TdaevjnQ+c0uHJVc6XLHxq
-+					1K4FaufpqFI4KDncMJ7EzONGLw0pSP0NZbtw
-+					aWP9w2MVBv/pggNpS9ihNVMuEX5KjLsLVKez
-+					eMaOdtS2kSt5vNLpwbGwtCRmQSSbb0lTos9o
-+					opHrKzFEpULHqCTQ9CHoohJ63XlCU7nojX6s
-+					1gxQHC3ZQXSFhQCpSQ== )
-+			300	NSEC	sec-mixed-31.example.sec. IPSECKEY RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					KGljdH6WD8gODIrIGmNRHGdOlReJ5+aK2pxh
-+					ACdNe/nb+uJpRflPywuYGA4q11I+6ufcLmB7
-+					FKjRcmbI1Mnh/5DqLNhKu7aszdjUx84/r4Xq
-+					szLV8NDmjIyrYmNEiYjl4Z39Az91IFKblqOC
-+					e8GTMkAeaVJRmozUpXHE0/3gd1k= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					m09tl6HuH7v4fUkxtw8jCFRFzyVbBLkk0LvP
-+					pVZPT/8g7HsLX3wwcD2h9dRkAdYDuJ3VSOM+
-+					tusDIHlKIcPfIK1fjSKv+aHQu3/dn3huRkwb
-+					i+rp+ieNrTo66xHds7KzgR3kHtzQp5RUHoqh
-+					K1ppHrN4yMm3KZZv7U1g5D/ED2qXxCupoYAk
-+					UwRNgpocc3z9fjeaawtaRvUF+Qd+y6eCPU44
-+					f7sjbppSw4+Z6zQKPrsSCuIvs9lYaDHTf4NV
-+					+/Ec8CbH7uKrAA8qN1dJ1gUQye9dFnES2VkH
-+					tkAyReBxJ0EBTcdiLxf+MYHgE7JTlVILn22S
-+					E61hzZPlZzdbHra2vg== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					P40fI/B+2QZe63yXmyj1DiBjMixs2qTzFQsd
-+					X+rlEvc4B2xqKjJyTQLSqqKxECXF469z1RaM
-+					noQ0nWOXPOiQS+ITy1Nj0RwcwKBnCf4RZGyw
-+					+0WUufZqnNfnptSUTxdp1Jh+F6AUAC+EBsTE
-+					6BvnBjXvpvowdF4X/izJ6DvbQfuPMtAHGVZM
-+					d3e9DpSrDW7sh0AfB5Qc9XmNBnx5LhskBtJk
-+					ZmoNLt0QpnsYyTfGW3zc3e+1o8CKRrxP5KR+
-+					nTIlH16IhLNGQYMi2URRSZcLgCROkvY0U5Jt
-+					7URlDL7dcu74EO6n6YyfszHLXEi4TBW5Rj6p
-+					rH6XCaqJuB11JpDRkw== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					MdeBeBKykG4JHZtN/pVHBM4v84pkRcTjByvU
-+					egrKgl646PpGE9+sVjagR8DBIh12tjmQCVif
-+					wzMmqWLAcwWVPceYOPSFn5A+rRTV1xUmDs5Q
-+					6CT84fUYF2tfr12eMkpwX0A3mEv1np4wMA6x
-+					dG6QH80+7dJBisI09dwXWYnPFsJPSn54Ejnx
-+					gZxVZ5tQPgDP9O1JsDIwfyVia4Yd+ZyqrC1z
-+					H3W2/oraVZ8Kd+0oTzuP7U+J451WGwuQAyi2
-+					616ddcs8PUDth4oFcdIowU6Xrv7AJkgYudEP
-+					lFC0F2sFUQL/5gs1bCcseJcEar/gkYm3D6h/
-+					PLn0VINZFSnTYki6WA== )
-+sec-mixed-31.example.sec. 300	IN IPSECKEY ( 10 3 1 Some.namE.
- 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
- 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
- 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
-@@ -1372,134 +2023,94 @@
- 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
- 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
- 					zZP5Vd2t )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					CZJn5AslpFHB5i82KpADbin+ahFv+WkS04+x
--					ghMl+/iKWel63pNkn6ROWFEiLYiRRcpI1R8x
--					pkVHgoCocBQKioGtNRicqFzaiHWmcNwVLX6R
--					W6mFdErpEzP67m2+dg9hrpsQ0E8dlAj29FGp
--					LT5agAWqb+GL39advZ7+XeFYPhk= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					JTi78vBkBuGJH+i6gjjq/7aVH0V7Lo1y/1nT
--					OwJOaaQGvTszXtNEgnuaZWKRP7mmMMj/EDXw
--					4pY5t7uetwQsnoyBfNINevwgBvEv4xPNGly3
--					bazXmlPC9WL2pHIhH5OW5ktHs0n0C/oFxCcO
--					IVtqBSvylx3cwN7unAFF5jSF1zgMHSubRjZL
--					RzAwGQbpbPi3BXg3zT970wr1XIMsMnoU129K
--					Ii4+mgYdxitLeLw7/eIxTYYrUMPBOpDkSQ2u
--					k6GU+eqTXIzZCNhXWcXKnRe1CrrLkRtRwraQ
--					JlCXh408v0lLo6Em0b3gjYpWxRWyAmMz+wVA
--					CKoQo721i+2WURHytg== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					zvwNflQYyZDVLSjAGPb/NtE4D0vB48V17Pm2
--					nz2Snh63bllu4iCZwvO87DEl33L7me446rxH
--					/G21XZoGz8cwN7ecF40SQUv/grdpqdMPhqCu
--					15+irjwTF0vthMxKJIuMRUr8xqHis/1KKxLG
--					Wa6Rm28BFLfMKOti+o5wRyD7iB42UfK7dWlC
--					SRAJxB3kk42LchLGydC12FehBE7rJl8z/O3l
--					cULmW5UTB/4+AsNNQM7GrhGA/zvhrxGOGksV
--					0ncFq1I6na9XDYq7zZZQUAbTbaRWt/MhVcsV
--					W8d1Vqa9XvfC3FLlyUZq2jjAv4VSupTE2CSZ
--					OCx9JAqD7fMWUJU7dg== )
--			300	NSEC	sec-mixed-30.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					p4fImnEiq0raswfRFbjM7d8CA6WhMtdIn7RR
--					AmGcesf5xwgXlNcY4Uu8ac0UxxlqeNcf5+5A
--					AIrRraMEOPZOAC7daWoRLFgsgdKqrmZYHMpO
--					VxWcuyIc+5XXIFvfA5tHKUv47xq9wjJD+3+P
--					mVaeY7/tyBAu4OYBAaw5WfW8020= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					HXA5QfVNaSkandKCqFcvBg0TYwdnAywDzAS4
--					McM11MXxI2AUnYnRmBg0+ambJRt67P2VYw4/
--					3JlQftbTLd0r8b1Rb3yydEv0uUcfOe+AXn9f
--					kd8kgwutMCNYg99TDPUAAjBk4cbMXsNqu+Qv
--					xRPboSmONUiJ8TaHSLzLnNAOTIKbdnmq+p38
--					Dh3Xtfy2o9ZtxuHlqoldQmNHTN3opt3GJOO5
--					Ia/8mLJurOe9J5lDMjhSZQb/HYLRCM/1CRt0
--					C3TZnqP1RkOnSDqRP7petZcTWSsENjOFIBAL
--					V7uCzYIQWdeRQu81V9MYFp9c4lQ6FTGElKWJ
--					V7DQxTRpgjS5GkHu0g== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					dbdl0cBXuuV0G3mX7P1aMCGrJY+JXVVTVmBh
--					P4k8hWEp0RDWPsNV2YV002L4vz1HYIJWysDr
--					58IWpQPqy+MafcippdH49we4zLIWkstE0vEA
--					S3qWmymBnk/ZuhucDXF/HLGs6PXj0nw0h7Qx
--					/6Fwnyys+pAe77k3E35Zb/+EaZ5hwFgueswm
--					AwE5i94SUYATd0wljjzCcEB5ougB8epWmssY
--					azJ608EPu6wZ3rxkgvj+bZm9oj9jpujbWzls
--					95fgDTJPn7FUoXySCwa+lB/2S4GfzoWsgjF0
--					ho9zhNrG1hnbjWw4GEp8rVJwsTiBxrxIcMdm
--					DHHX0i9yF7DkxsDWXw== )
--sec-mixed-30.example.sec. 300	IN IPSECKEY ( 10 3 0 sOme.naMe. )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					Yn3qB+wu6No6XErby8iIjeIUWYG79xb28NWO
--					v7hveY+Z6/sKErALFM5pJCJ44ih3hINUdYep
--					HPcLh7ePz2iwdUVGvRD54fI48HTWMtj/dn1E
--					qp8SsHB90wHXmIeUaTPndDhHbTtLrs6+SJWL
--					ZyojgMongSZvbHNWisq2MOZMujM= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					qk0vQIuCA2+o9nLprjIyyUtVOZ8Pu8UDRBYK
--					e9/0s6VDQIFP1n81hM9ii8gdj1ETcYYEVUXw
--					g4STWkNiRGtOF9x2AiZwGumgf31169sFk/jc
--					654gRUQDdxQnB+qHLX9HugTGZrSvsIR5WrFm
--					eLe264dsniLc589N5JXWHV7iE9zEMj9zljDu
--					rXwj/7FptwoxDyUt/QzG8RhVjGwRduFOHbd6
--					fJf/tqQ/QI4yZiYoG0S1GkkaFERX7fJSpqxd
--					yI/B78KW31jWevGCdt7NsuifG0f2zJ5kkmUh
--					jCHvKi/yiji39sGm0kSlqtaw7Q47Rx0Ihegf
--					mylJPYx1cnzlibGVvA== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					wrzoKA22gia0sNq83CCag0ZjaraCbvE6Vi/J
--					7qeUXAuKhS0ekuYZx7SWp/hLgyUARrtQvoRM
--					VQmuHON4rSbmsL4ds48IpeQqcP5QqSdhAXAU
--					fDZSln9hvWpZpJC2dFBgE4H6tjPmZUe+116I
--					De/67cYRpqF6Y1VDxVjkLPmN7Tzuyjf8FF5z
--					prvaq21OTMBu3sBRnfAhFPwNZHf4q7+t+Lnl
--					rfe+koj3SdLgwNkxAA62Dj4mMCdmUT6nfC/4
--					wdi2NiJzlIyzVstprwiL/ZjueOHPyKJcdeDK
--					jR2f2P/6AF8//pCqTH2nmKGnX/nOHeKm7eBS
--					h1c0ZvFhooU9N+2DJA== )
--			300	NSEC	sec-mixed-31.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					AC8/yz3J6AdTfTvEy+VEyV1rH5fNfz1uxBs2
--					m+OHMBUZf6LpUmqf3HMRt4ymUEzZ4TXUFun+
--					BCRfuVl67ryfvU7Du1VIXaIjgq1NccJFPamX
--					cy5bvn7VfB/XgTYCOhkirPAo4bUEN5UyP90I
--					JZgfxjpy7/iSB7+Gn6rbefjRTJ0= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					lewi9S8lGbimRUFnQDXb0SG01qcbNbDbkSb+
--					zjyC/CcVBEYwwtl9+z4NDXp/tR/sgGZSHkeB
--					bnfJD+LcQ5/GFOC2xAhbebtFZbtuhMbI2N/W
--					oanScK2gH43sFgihjtE8L2c301cAIPjaLzyU
--					p4FIMeEowVVu8louVwACKr8kMQ2txCIjMJVo
--					4GblPUhx7lSIQnyF+AiKBW7qiAmlqvchtqr4
--					djaCWoXIjPA9Se1Qb5V/zdrjAav0x7nSoJvI
--					KaslX211RgodE7zlCb30bOk3KMmQ2jU2//se
--					6VhQO/qx6jKFkK4nSV4jXYpEACIhY/KrU115
--					qGNs9dnFv3q2ucCLtA== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					WW29gBQhuzzVjOwPWCwXIeewzcop7BMtMjzQ
--					vA5lMYTta4EAemgUksP9aBoP9jZfFhbCIhjk
--					WuAEE72t74236wxg3vAOfBCVVL7WrhjcXmiK
--					euT2D0I5EfeWzOy/izl/NbBgYwDCfiYcJGpC
--					61V3XFkKR+vF//LeXQdQqf5Lhz49AeOqW5yW
--					VSyWXi30DomFVM9m+94RUeefNq3MuZXa026r
--					ON3Sui6Jfy7P2L5Nm/k3ITnYd8oz5H8UYJHp
--					YwPc7uSC+Cu/sNpIow+eAneJt5TUj97KVxrk
--					x0eDIqLmwW47vLw0kLFZ1+69vWoO06xcNDbC
--					4RWHAwI/K1A35QK0Qw== )
--sec-21.example.sec.	300	IN IPSECKEY ( 10 2 1 2001:2010:1::21
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					UZyvsV9lD3KguJJfmvxJypmy+h6VqKOoLBGQ
-+					3pWpY4YOSZM618hSq1M87Um8W+hzA7HYK0bw
-+					1UDJrtTz7V6ohTe7Rp3q4ec1fGKLLHYM8OM1
-+					KoAwTSMWafZukf6NmNojHMGJ+auSMhB5xOsU
-+					DySe1nmno7NuU45sakWGvg5L+zI= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					0iXY8/u0b+OpgoxpGTbVtHmcF6ihlqs3IZXz
-+					O5uIozJHxJABSjKKjGZF7f0BY1Ax1VZKvxJ7
-+					x4wSs5hyZ68XOUCD3Zc6Ec8VdUOPA9hZa7AH
-+					U0U6/IkEcenLjCl3rPizpQIlfzmO0tbjGM9B
-+					zCT4l5C7VfVw46O4ybmdXKm0cL0DTo1v2x3d
-+					b3UWDeQlkYEGSCRXS0+GFE56w9EoH8/uS+Ir
-+					cBfvULf/Deta4UOd2el2jX6izvkedgtWdI6t
-+					qF3yhT65zXQgxmFtLNhgRgu3JHE8rNnTzmpj
-+					unto2AYjwDxH9IjhWvOEQCa2w4GiwKq+tT3t
-+					tFyCjHw4eq3tZSk3bg== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					I2VIZNkZ3u+CqOu1Pr3Yh3PQH/ODvbD9RS+A
-+					+A8TAvl2ULfcXAKq7tcmr5WTL7k+PrMC4+OK
-+					ojdROtqsPWtMi82iAkxkCULD9Xm9pVgVJ882
-+					NUkHgoHe+tKijf2RFV3hCGgpxqLjEvoVNB3k
-+					mEH283iRRxbQYDIBVTaVtHZgLDs2LzeK96ha
-+					NMS67/+hIVCJoXZar7HCR6TeurGytCG//Tnd
-+					VuWerWQQLo7sjB2MRtmdjarFt4ZOeQmiS/Hh
-+					O2gvsf74MSGSb8K9FJ32GvCT+VIT3iv2Dlad
-+					3l+i8iAiNyPhY3f3UvxvUQVBiHyTP0IU1sv5
-+					EcGJCXZqP/ssqvjRHw== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					KWizoHwBtTqYSl7U2z3BlcpS2Gvb6A0ivojA
-+					OaVwhsiZ+v7/2agZyrAaHKCvgl2yq89dC0Hf
-+					REprexspi9z1Ru37g8B4p/3MdUsK9JP6Gn7X
-+					8ajHQaqaLNHS9k8LsU0Cf05a0vaH/q8MmKxy
-+					XW8cxRqsh/1IGvN8SUaDjlBr+OyRr4YqxPsj
-+					JBp6HKkjrLQ1M0St2JBh2IXh8jqyrii6NCM3
-+					H+gCzSDlREqx+nT7oSGcLpw+uAeq1OJ/L24y
-+					E+coI82NKozyXv69uDpgr0AMirApmyoeVJCg
-+					zSK4RxOvYSv3isKlpqzIRWTA4F6Am3lTIw9J
-+					jKmMqt3KjMs19t7pbw== )
-+			300	NSEC	sec-mixed-32.example.sec. IPSECKEY RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					ipQjEsGLS43Fv0UrNVpJU6G3kQdY38W8PKuh
-+					VgBEPXoyHXuIcOrLhTATdnX9MC/2LfqQJooH
-+					G3dwa3Jh5PFN2JcUYATP9NQ1IflqxgjSq2gn
-+					WrCKbQI5yUCXRI7WLTXu7wihKM9ptBb6i5zY
-+					rYU35dDKPFd3Xnu0LtrrrNX7kQo= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					xC1thQOyAPxxYdZDoiko6pb41+RWZ0TZy4YB
-+					zeY49op+rU0q1Q2R+jnlH6Tgbudn2NQpw98V
-+					qvE1POZ9yo2YXOIQoaOaWkCTJT2AJQNNyiHq
-+					R3kM7uer6dyqGwXn9l3Y4RcCzqdG5+aJlgNC
-+					r9Vb3E/tMU/AyV+mz0O3W0fNPN/zZ7VcgyGf
-+					TrD8V799AGx2sA/xa3h9cYBxGuGpSJi73ZpI
-+					Ear1sUHcBYMWP9HEsJsV672ntIrXSwYkhraN
-+					W/9nTHYFgsZvyz4K2TTxLy4etd+PS0+TndLM
-+					Q12d6TuAXU3KLDmO8RQ1SXF84LshfDPV92f6
-+					JbckfOa8zKPsAklprw== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					JLD2RhURqgRnBqnNw/W0qobtvg28M4qoaIKZ
-+					VJcsKAtw2+tvAiGbFEgN6E7nAlSd6ei0Cj1S
-+					tGefXx9B8p1hYHnC9eE/XTzjr97YW8D3DJ/3
-+					F2+PL/PSYENeNzd+otcHKZFUdV1+g9rKgXjZ
-+					+N4vX3BXvABuVOQdYwdwXrejz9u/23Qhu9zL
-+					jiuigqafYXygE317KgVwga7VVCMgTmPsDQwc
-+					ri9V8Sm3jeklaUm/ISx9AQt0FwylPl1qNVHH
-+					ZZhoyvKK7Wqr3Hnl+i0tlhoL6k15I7RER9Ht
-+					7CzM6WOEYKUAFwsfJ8govxpeCx1fe5ZxLv88
-+					g+h8Ud1P5zRIdkcGCQ== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					I5ZgJ6QGF3H6T4GJtqCxIZVmOyCEz3dw28pe
-+					Aiuay4yVo2rEDEgAVEc1j5jAHWqasI5kNPpY
-+					BuIEEFfcEl/1j1wCYbpivh7a691MoWgWAbsP
-+					bT8KM/PrRKiV95axgScCT3fsDQedtuJV7XH5
-+					9nPbtf72v8t650ExblZWaZV7fZ4xUi+KINfn
-+					Wn2px6hvmEIjlm0h8m/YRBu/ujzw9q5EMW/l
-+					kfXp/5t7d20hflEPE3FyYOjc9elrSqBTvYgZ
-+					nbFnHy6UG1p3w1eksjot25i8XGElHlvRYXOs
-+					x7KG8l62142tPqUrv/i2BgkLSKN3DO0CtdzB
-+					KrvBo73gvsVNsLghHw== )
-+sec-mixed-32.example.sec. 300	IN IPSECKEY ( 10 3 2 soMe.NAme.
- 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
- 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
- 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
-@@ -1511,197 +2122,93 @@
- 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
- 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
- 					zZP5Vd2t )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					h0+HIceO4TyqQTpyxId6XNOUib32igcXidZl
--					7UIiHygAtYQyofUkMoYwjOuCTd5pQJe6jXyF
--					rcIslo9C1JDAyqcEewgLRi4/A2CEUhhmknxP
--					2qJBlQJ9GiWAzK05zS5g1+Q2y++Sp0gPYJFj
--					VY8MXOH4C2i09/HKPb7AmGQHTMQ= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					ccAqjClDisTOEK5baQDYScY87iFiQlQtbWjc
--					VoI3EhQ/TUqNLwK0fIdJijxBoQtfDwhiYDHx
--					Ban7hV/LWOBTC93AeJDM6aF2zIODDvGeSqWz
--					a1z95di1mNcMLd+m/0wAc5VwscyaCSgID39v
--					Az6ZoawlXo7LZ9JLeekx2UXcMS65ngUM78WT
--					co42xwz7EC5YSR74roPBWb5Xcu6RjBa1YWrD
--					5RCwwEyAJUiD/+1GlokbmWXNJOQbC/Y5b7Em
--					2/DfFmYo3GvmN9mZEUSkPcXz88sazuPeMojM
--					JJH5A0iM7FnZtEAMho7+UGvjbOdZEUr5GpKZ
--					elwJ1748pZZSzeQUwg== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					dc9l4nstQkI6gbn9u78X4DfpJsvTqiswhR42
--					VLckznSlTYn5UNv+pFfcAWx9cQM5HGx899xM
--					rzeEfXUegTZOQwCYmJWZrZsSrr4Lthigl8IW
--					kJ4BGEVbast5W33BjlwNACX03o4ysKn28JYQ
--					dhGB06g4Zfo7PNDKWMFh0Pbs2WjsvdTpk2ey
--					OazJ0FPAlGc3r2Xq7OVt27zc+iTZutgG8yFt
--					dYDuY8E525q7nlLwHAbx4zrZWyBRdg7Sw/l/
--					EsPBDv2wOo+0XIpnc0lipOICAhwzUoKf37rh
--					Nb0TAyviQwWkhFJ6MRl7jxYivFHJQAWCU5Dq
--					E4zy9dwoF3zHP1pj1g== )
--			300	NSEC	sec-22.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					K0DNo+HfGohkx6Q2HJh6kLNEG+NW9rqVq1qy
--					5i4NyR7yU9PCn8BJDWyhoG/t3EKHPGjc47n9
--					ChyJi/XSywK05PiWptIb1ByL1NtocO9b64EV
--					0fvi2peCm/f3njyOvDlPSJO7HP+vPZMKITb3
--					heoiHXv0tX5wrV4VtJBhZcgxy6o= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					SXlyw5BASyyMehGz6QUMAkvfExmoPQLHt/w2
--					wgJ1fHXTI+SFZEV/8xeII+DjOvkUBoebEyxZ
--					6PalHCEv6K6GnPbpJGNGhNwuuOucHx6FVoc/
--					xmU7ArMwiZORhyoTec3izKavKG2T6mJk+rvG
--					Xy9xi4K2g2CE7w1anGdA8oRPag1SIwhhB3AX
--					Trxch8RptYk3Z19jDaHZUxCSZWrfh/oISNWn
--					ycdERmHrQw8BMl87Hc2cICMLYWLSgvmor19z
--					4DYaqVa/IgDnS8kKwK2heUjNhhBrqOqxp3cO
--					7M3bCbSadHYH1yVuv2+7rYfhfAl6clkWftvX
--					dqu8/+1eU3MHZw+6bQ== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					gBq4IJtDynwz9Lx25Uu+BP0CNlKgUpDvIHvs
--					CYSVa8M2HvLury63U0YW6j1NP/5MMlr7Feky
--					jPEzMmlyXhn8WsiJiyy9pvpK4vVtVX429DJe
--					KwAtFjP29vpPZmjH0ZJqGTC7ojaBIE3GYiDw
--					7kGqGyxLFHC64kl8xJx7CFQtA3eicKAkwB5R
--					uIu1d8lG3BBnjrx1i8xkdlRj2vp0YU8zjcSY
--					K27gYKX3uZkY5R9Y/zbwyV5PhNb5DBfLNzFg
--					7lE28oevdOrlHQ/S2Tn5vEfja5bjo0Fmf1hC
--					ekt4+sOtUsob1hCOeaRxkYcVb+hWB9jQITNI
--					AibednFJmQEMr2Hn1w== )
--ns1.example.sec.	300	IN A	1.2.3.4
--			300	RRSIG	A 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					Hd5lXR86upb7H8fuiGZ0kcoO5h9s4R9Y98iL
--					StU1pnXxG5KV/AxMlz5p3s4/u0gte7japaiN
--					TFyASUxbTc8w6t79jyYMLlPauutggLPgPx5b
--					1DS3aFzrA/XKdTD9jJyKLkEgiYmHm1yRq9oW
--					U3gl2lF9kq/JTC6vHTJ6VdfR3GE= )
--			300	RRSIG	A 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					IpzshcLIMj4iWcq6jPh9fRUdHpciA2KsRhDz
--					6F0SYMg9Baauc55pNMihqq5mhQvpJqGnKVHS
--					GEgJbEUNAxI8OBwewVyMgDdTt8R1NK3ZjFGE
--					0VmtluwrEdKT9HyR45yVH0/SpFZeQTMKH9Ck
--					yPAuD5s53nEGHALkFFadEalyLOCSvrU1+j++
--					tHCfa22+QYbh1nSQAdvzzx5jhX/mrl0Blj0t
--					v91hb28yoClOzGzJIQisdfn6xPAdEGW9FP9M
--					wENWiSO2bhIMZQNxiCpBCmAeMRdlQVPwP6BP
--					SsH64WQJCIGVPrL+xiJQXaIXx6aZTBeLQKB9
--					RJQRDywk2cHNdji2Wg== )
--			300	RRSIG	A 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					vusjtNWhFBkOD/uIqtPS0tIByS/9SNIGDw+R
--					+SxcvJ5ovwZrNe0083ZOZ9nkt2+k7nWdsAw8
--					MBF2Sb2EP966f4fxCI0HE/oygHvZJ6oqtF70
--					IyS1CrwU8QJqoYsLFXBtprulN0fYvJk1KYff
--					RDfHtoae1Nmfn0tb375TBf01e+/ijpHdzlYL
--					rRF6eduUMgXOjstdzZb4mQIQ/UPZ18Ij86Q8
--					CTSZ5BAv8EQNKPkblEUzB7IPiYlTTLIENx1p
--					1lWIeZvrfufCubg1uVQZ30g2yOyexNaMT2Le
--					LVj00WsCuVcLRHEcxn5nQzBXZp8wZeVm9G0e
--					wFAsrFzRnQz+ttQXaw== )
--			300	NSEC	ns2.example.sec. A RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					AzygrAd/tnGAb5LOZFZxs84u3VRBrHAN/z59
--					e5uy/OBSa/3P7dFwlwfFHkCA02NFV+2oLO6B
--					WbwuK4hPwACrYZuJvw9rKa3rfYNZM1MF6fUx
--					FQ2p17NkSKetFR25G1dzXMzM1MlbK87EfBWb
--					ZXcw5e81JAvba8q6ZXCcXZz7DTk= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					zx0VjSCfOb9ajlaLpLD8gGahBk/GYwT3J2AT
--					D8KZwlpCFN28TQRlPCIaqCBDlb35sTBiYU0S
--					3rcJMWUGrUaDON4jmeMZZbGSASNVd+D5hcEp
--					hQpqN6Su8mFitflVMKIKdLnqACCXJUicb6g7
--					7SElAiesy1DuWEWMKwyyXV/X3bEHzmvdjIsB
--					9T4wsCcElDQbVItnPyms0No9xrgZmpNR3UTN
--					yoA882da5Wi4TubusiYryzncZZQKzZzCGKZ9
--					HSl+5STjx+nBvHL9ud8rLkimlzLHO5BEHrN9
--					hvkzqEQkmOer+15f3iQtFoovDZhR0Qp1Ag34
--					agn/nh19LtgqBFT6pg== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					x7P+aGsZoDroKh/AaVkBzmXLIy+TC7iUzUAS
--					M54UOWoGjlpU5gfyo6kL41dxRk2A77yYKxN7
--					HHSB/z+1u2IK0uXL/0teTgcUJ/yu+wTC21Z+
--					nKc4lPNr5koIsEMgdags9Coa90rMbLp8Nk1R
--					mv07wjykShruY5o7q9sf+EV/slSFcUmCXfsb
--					zmzfor0kUrwliqzgNPpwnI3eNIGkjUF4wW+u
--					t1c/9Yyv25a2ViFF1V6I1BvNKFtVAkRff96p
--					i2LPWjaH3/ISi+8T3Um1d63ALW+M6hvKdbh/
--					nrjG098f97DWL2+VrI+/bBVi1GPmzR9bdK+p
--					Lptct6Fg11LSqj5QJw== )
--ns2.example.sec.	300	IN A	5.6.7.8
--			300	RRSIG	A 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					E99YjCcD6e1mGnx+Gxj6pFw5/ISt2SGlGoOb
--					XHVaa0EWF4L8jZJGgzs1P+shE5miZqvhgGMo
--					aUZ1RPywjUBZ4NOxZrXOIutPMi4DTcH649rx
--					HWhbjgBJptfYVGI3fvnL/JustEQxchOCamdi
--					ohnkMS8K/+9LdNcVoBbXmd2xSWw= )
--			300	RRSIG	A 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					f+xyLGM0FkJuvIsBsiOpD4S54PC78wJRGHlJ
--					HGeOO9Rt0ZcuFP0zqqza+8J9ddYXxzAt74ut
--					QhYxhoWp0Cwv/Ah2ekgX1c2SHXB7gaWiS1jm
--					QInH+34hG/YOfDzdBmEvcghr0SA99mfSJPcM
--					iTdlP6ripnqhjiaILF69P86Wp8DJgGQXeAzT
--					bN26F+3YePj14TdO4d1W98nMolx3ASpE7Yzk
--					L+v5TV86OdwnLB0qOsHEwch+NvglXLS7mDn2
--					XljFd8FX4DVElTTGaWW9cwLBwwhZpz6VMx4G
--					mQw/nAEJ7Kp/2JYE9ma2H1dPoH7Yj/z/zRTY
--					+4bgonvmTaVyg8MFVA== )
--			300	RRSIG	A 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					uTBym8cXJHSj7GxGFNzqX+NL/Ys49a36kWLw
--					lEhjWH+z+CdEBuHRIfCQdPHe4XrUNsP9eWg9
--					TspzM+g4Fd/dh8Jz7WRQ9IEnEU0qnt7HagQW
--					qfOsxve4ny1Pjm2oc/RICfsGTBJpqL5UwVNw
--					u+4bCr2ZdJwz1VZeCaFQIG+iuaAWE/zQ+xJW
--					e8mGvPM/VTCb3l7ZXePvE6ej3XFHfGIXqr1Q
--					sB/c36gw4bkFajA9/U/Ni8Su4MjxkkvZnG8n
--					aT7YrHXocZI0GyoQJMk3IVERc/khN00P6NO4
--					5FQR6X6U32tBn7ijOHmdd+ldt4ckdcqZB/oH
--					4yjM5N+K/gt2/E4puw== )
--			300	NSEC	public.example.sec. A RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					ldRLarLBSF8qLKnXpiWUK03lLnJ+OaDnWK1c
--					60K5LY98IJSuHHuMeVw3t/NMJMUjSMBz29Ih
--					AJMViXc4BNr8U5kUryi3ryRtfc23PbPLGLK7
--					s7GDA2Mjd2dxx87MZwP0ER8l+o3dFjwqUBC5
--					jWfupB+Z12AkZtINb/BR9lAaOWg= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					fuH2T2IDBQ+QG1zc7cPrIVSm8Wk+phIDUhUn
--					rT6yYtpYeAfzsDzKlAC2iqLLXIT3C4ydda7P
--					vNlqS0W5Xl4SkVp3M796q1rOskBK3CqM/GvT
--					zRcFg35bXA0GgclMKfT/N3hp4ksWA1nQokIN
--					oeYNY9ChZVjEitJvxW2XdjxS8gWFvHpSJvr8
--					Qtk8/w0ghYl2WwmhwswDfQ6z//dgFrew9JXD
--					to0UEMkloBOFpmTJY7rtv5+52nRMw5wBnrgd
--					4cIAeZ9Fy0QNZvXvk50DLBS+KpSzpHIs55n2
--					jSLGLP6iTYSYJp3EbprqgqHrcGqno66Kb2SJ
--					fbtPtQo01WJn7FnWbw== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					imdOqDzfX3ecLJahnF8nCpHIAvL95A403DFb
--					ccKYOYG1cdJzyYyINOcWx1WluUxQRT5PQ1Dp
--					00vM5SGPwVljomtJEfxYi1uuGlGN/arwiL/L
--					7bdC0TtVBBuRsxp7XWUeakJqIZNfKdA8NabR
--					W9+16sdD1qQKrHZtmfyA8NRd9WuT0XuUqp9i
--					KsMH7CvKY9X3fiym9bUz2otu1ZT/hvm22ny4
--					cGQSHyZ318HoTVmzuS0HUAtT4SjInHdZOrf/
--					2HF+AMcF67HAGSQnmFVXJmpoZDowGt3HzPQ4
--					ztt7F4k6C+h4kMqeamrWmt/588OdfL1E+rAM
--					AzXmWlHrVgaMQVw12g== )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					ucuaYq3+riPlg50nnHLhNfopzI3q9bPyu/Hp
-+					OVxsp+Krmzjfxqnzr+XDVLquFQJoOFw/D9nJ
-+					/shPPjd81rHiHVZxLpPX9tzV2FMBv+vBcX6C
-+					/3K6WrL1qEejArcogPHrM6hdNdwEORueWq4W
-+					T+QOTHIagvn2E5gvgu5QJpX5TJ0= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					P/gQrVcBfPomBi4TtMOPgj++Z9rBza90vAxO
-+					57PYV72687WO+WOz60sxs5QH+NwfSYb9ABjV
-+					5Kv9W1Av4EMMBSXKM/Gw8FiPV5baB21MaHjz
-+					Qrf0LFmUWoDzEvaG8tQuwwJbBxvU4vIPzcO8
-+					ngwdY+C1UYOf4qGyMeZ055wKyk+ZA9xLO7Ag
-+					sEBtDMe28H4zq3T7WI24wwz7nj/TNf44DEpG
-+					+KJNVt76i3YHGtZKmtdEJ19zHMdkPpsGWZBN
-+					6FO66GXJrYtZtdssmNHb8dEMm/JhXt+0jz9Q
-+					lh4B3Ywmi9cyj4AsqMwFdNhXM61xTsokahe5
-+					0tJ20+Ig8aOWGwCUwQ== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					DewU0DqTaoYReXPJ1S+/EYaPyxyZFj7+hId1
-+					lhDtLSInAut0p9KaJZQSIJ3RBpZVJMoozoO4
-+					3HmA4CMgBbwIJeGJ3AhaGEPLwpTDVk+PWe4U
-+					SZoCdkK7snkyABe72NQ8sNO6FXnsU189WOln
-+					eQzRKU00u02qOFX8yRuQGaMtk4KV+Mw9FA0K
-+					r8RFTiwTn7V7+8r16uekK7jUcxYhCDvp6K21
-+					jOiFxPblSl7GlcIFAKOWEzh86KbcnvYOovNA
-+					P6Izq0NmEDspCCiUoKT/1+TSIqn6coOivMMw
-+					wI4/xXTLc8u6CK4XfMM8ch+OlKpewRfXneSY
-+					VyMGz/F9huAhpg+HUg== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					cXIFojsz8lrfCktQv9cxZZbPXULytrRYyN5L
-+					A912WJz98UCrneLxgcqw7/rTpuBqra77AoUx
-+					lz6+qPqxQ6DWPTGcyXzfgw9XQzUtHrqsRd0f
-+					8E+2y5+5+8Jjc45+7lkNa1LzAWCAikZwJii/
-+					OhU3iE5nZeXtUPcrztbLHg/pkKE2Y4NgE8uZ
-+					VkK8OfGHDve2gENhD+asBOBR+h9VRaicGo+u
-+					B5TA9G/SNSEHbkJGCp6e7XFVaCg8tf/z3o6V
-+					Yj46qtjhgwdCof9ajXQ5mM/za/JqQmmWIZDO
-+					ysFrEDtrXBYFfJkVz1YhvbPkodDdJkW5zOMJ
-+					epBdq0qS1tsN1pvK2w== )
-+			300	NSEC	sha384.example.sec. IPSECKEY RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					Xs1Px23rT5bBoLza06WFUJZkRkElWHQXVr+l
-+					2JnIlobHOLhT7cjAIvQmSbwxtF7bW9b96FVY
-+					ZoRgBJjvn//nRbs3X6YANeWBEfVeBQxrffWp
-+					6puGiXbCe2RiFPNJ4YXzltcuaNbDi4jYb3KW
-+					YTIkjeGmi6AMQmHwGMsebOnZlU8= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					Q6N4jEM6yO7skZ5rt5KnDhmMzcck+5EYu6mr
-+					2kEiicgbeWFnzTg3wcCrnW9KPXLGu5fH34Ol
-+					kIj4Ke6P7ev//k/ygscI8KQAmEKH/hV1cOhL
-+					5vMamczhrVp0Z/V5rHc5kIWOJMRo0tQ//ORV
-+					alrHTS+itAdAQzF9yR1rC1f6nbRXQofIO2K5
-+					TEWnV6Nwb55ZZ8QZVbJbDxWOJz/bIRquMlJJ
-+					JUfB1b5TRLqTj2jvqJaiSBVXV643ZucAfOa5
-+					B1UQnoxWzakMFKEkBRirxr8bw8PXujGu3P5D
-+					wNi6aquMAj16nhUow8T7AHJBWvMo8X+pNXTL
-+					Yf7RRYjYTSr8a8Z1vg== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					ltspdDOlwncTQ+Gtr4OPq43xdCSnrkGlNvnE
-+					vNpgNCI5QXYdythuOFnVvdhOTJJsoo3dVoV9
-+					N98FHLqgCJ2gjtHqPCe/ZfqsVKZ9BF+DHuUU
-+					OY5xNooQrWkLxFcKbSwfl3fJgFVqy+eyw0Ii
-+					VppS+1WEZhmhI/ib9+kBpd6/eYJkAuoVAzpJ
-+					eXbCK9SUMEATx5+ELQtCNyS1qTMVJ+I4+I/4
-+					hpkiCWizgmx0miZhWpWMmffkq8RyUF7NEa0C
-+					w9tj+Ls67bFJkzFjPXZa1YWBZcfYCWiGRsdo
-+					EzqPW5i78B+h1NECW8tVIHPA8MPZz1dTQUNM
-+					wPE76HikvyRfYMewSw== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					uardZlGiJG0zPdms/JRd0M20177k5W2Crf3K
-+					zVFlOT0//TjgJY7H3eA4rW7jQXcovVxaELFp
-+					NovHObB7mWyNgCsQGbY+RT1eVGXgf0CuFtVN
-+					kSjecmt5vIsJJmEzcBCR9M1hpUOj4k6NERuI
-+					ott4o8l6FKqk9yu230fj07HAOfpfaRXTaSes
-+					Q/rGzNOj393KEWTDZFjUDMz7nkYM1Vhrg0W6
-+					ooGvJIqdvgB2gWQ4j9ehdBAqsepGixFUn2oi
-+					Gn23iozFGgtEOlvAs+2Vc5UgsMyu2ekuh5kS
-+					NqhYo7U0X2aHiyEcGRCc1y0/X5l9KiTYIeP2
-+					1RgtaE5XClR/mPxTMA== )
- sec-12.example.sec.	300	IN IPSECKEY ( 10 1 2 192.168.1.12
- 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
- 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
-@@ -1714,70 +2221,186 @@
- 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
- 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
- 					zZP5Vd2t )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					Bp3Y98+B6Rgsy39TcRw3TPRmbXBGGBQTaXvi
--					oSywo/qBfkfoJgRYSxq0SffMHq9AstMAaoqT
--					VY1dSGloMJeF4J/VV9m5XWTtLoSB9fPLLOM+
--					JFYHtpYGQBLrkDvlLR0mMyiHLMB58YJ4qgVY
--					/swU//Bmf+ivf3OZAC9PAFJmh6k= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					TEoklx8wcff5wNwRdU49/WvfLb6V/NiVbJuE
--					7oWtSL2Djp1w4/Mo+p/mLk/UzcbQLxBU3TUO
--					jOWKsBxUrfhIn4O+6L27/7fKXlK4RbTsvWBI
--					RhSlj9/bVzpJzHZY86BNWQLJ2XJg13foQkLh
--					k2rm/s4lLvsdCJBhhf8yqhl9YpabrvvVKs8B
--					riGfZtfJRq817quPoG3bEHj+FS3SlrSP+wVX
--					aDlGrLJgMs2Jdo8koRnmq2bC14o7fB3Sb3C1
--					NqTyoVv4y4ORrfIUVfPHto5U4BJm1KNx7/6e
--					qlP4BGkfYIseNRRAc0YHwTmY/qEh5OXh1VT+
--					hHzexvbXkSdaNvsFDA== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					oKaq8JJMlTF6r9L9UypicA5tJ1FZ6lgEKXVg
--					yRjHyngziDDwetCumeu0spZ2gIYhlZ6+iO9e
--					bzLyaisD2/cX1TTwtHpOXdnLBmazdDK0N2Nc
--					thodwl/rn3Iw2IWUvArb7NFiM7G7H9XEy9Dc
--					KPXYj3NwXlbx45dzlaWcfeOcrphFdQfjqch7
--					WiCpeGoF4iWYCdwPOUXkLmETwzn16x8f7t+A
--					5yr0ou8EuNquAvPFZ7238w7g0K+jJAkiPq9u
--					PDzPEqf1XcFqhJtHgfOWSYtVY0BVF8gKmmdJ
--					iDmEoHE/u1cuaUaXw8u1e0f+mqahIykFVXLN
--					Hw1SuDZ692Rzej0JkA== )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					sp9cM4vtiPCYR/q/zjEFQMvp4Lae8VwcFoBS
-+					zVP1vbXrfLGjECmS29PS9w2EuSgG65ufsjsH
-+					ewjCQxXtbhS3GbkqW6T+BczchuTbxVPoeiwJ
-+					SpA1Nka3LhheDRznREFNi67LFe7T6WgqX9ji
-+					Fay7JIEKjO+dQcZyeFbPDn3GvSw= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					HH0l3riJtHnVsJ7e5mlYEP2K7gvsHo8H55qb
-+					k0itDJkpeCwnIPuXB4iOnoZYtcwecOTES3ir
-+					71J2wcdZFXp/ZDpM+u5ZxRhutSKU6kDk25ug
-+					k/yl/nNg8ea++Bzmf6OB+tTZ4yaCySIy5X3R
-+					7uIDisCQ5LJ3wkYCAP8z1h6gMdkJjITHa1+P
-+					hsGi2x9QuDOUcxxOPTvmLZyVdgnMN3K0ViUb
-+					PTqVqvj5dn7pOLreyQve4/iwaBfxlUtsXO+i
-+					wtzsyhb5Bd7y+1vHVbxvKGGY0gIF7cKovgkp
-+					NDh75Thkrg4oMJtTrqDRO9A+S0OtxQcN/osK
-+					FRxby5ILfQAKeN8oSw== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					flRzj3hURIHk9DLH1t7hTsOmyY4DIlTBP8qF
-+					rRGpDnjsbyFBw2+FQfxWaoqAc3hbaYZXyZ87
-+					r1QnZczUZoceroe9Y+45dMhy37xgtI0fNMC8
-+					sKCAX8Ph79yVdhekiBYcWp7XZPjKI3rP2I8M
-+					OrOMhBc0OYKk+Eo+RWPdv3TI3Fhbi70phUPV
-+					nFJAkDOVdusNwXwPJDVFBXVxT5yvtkgCdlc4
-+					nf/LYKHHnafWNxEhnnnuCR8o8y0PnnL/sc5D
-+					U1JFg9+nZRcgIhqffjZ4xOhCkjYYFnQ/1SCR
-+					K9u2F6XChf0sZlSrl8BYw3VjGyYRxM5X5R1W
-+					VunDRGfcKEVeJbtJug== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					F8yPUuB27JKYxQS9NOMLHulFa9BUPUXfVzum
-+					paCTXKJWp2YjOhoOwYj5+oNzelYqhiB5Cn6w
-+					oG6eYA3MiD4ZdEHpnw4ogWTN/MNVRIMoMOKx
-+					XE/iwM3QRSM7I++0eaIV16VuAKqLukJs3X7O
-+					ETsL9snQuMl+qFGkchJ/kGh5+Zgk6t3shsPi
-+					LnPIBM16Ts8xyIThJUrJ/mpA05fYx+ZdMyby
-+					aJCRAPhUzEcxe0c2scMyHTE0clrMGDdpmLcE
-+					ensARJyNuLIT+ikbkGudHTxNqgwxQ+16fZav
-+					ERlPx9Q1pSMFKtDFfyaqnSHeYBrB5PLijy7d
-+					rt40jwVeWtlVOGr27g== )
- 			300	NSEC	sec-20.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					AkRa3kAjknF3xBG0FiCOWdgvKUXTsjJQYZ3w
--					vH6hKtIw6iJLIHXBuw8ip09IXWvaYxYZboNV
--					r4M4bsg7dOArDvwWvKxXVzY1qLv/l+CzpWLF
--					H97Uhdv8oOvgfB50Va6zdwnm8NYWpSyZR8Sp
--					sUNRN42iDIx68g4DC0iXY73l3kM= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					z9SmmJ/i05AcUl2tl/kWmOFrScWGIErE3xyP
--					K6PJs/oFSH3qGsgS14Cx3nqARFkQujuxIVkX
--					H1mtu3uWnMa5q35cVgBym3ud9BLPtQDx4sGI
--					1bmkl5xh3Bi90xfx5fz4e8ziV7BGn7mvEKSl
--					l/ea7Gfa5yc3LmPUUbRHrHYJujuyX+d46hS7
--					KQ/haDf9shBoXt+/IWcQBT3azgwEZuiM+Csf
--					uyn2YyXxDJZpmzfOCL5dO/Hjh7yBAi+rc4jL
--					UdDrfplO2L3JDSXnY5abOwADAqbnUS7wUt9S
--					3EuGrQkmwDapvcph6dx5LXZRbsMMcJ3FwSJR
--					/rTeK+ifClOZqxqbvQ== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					GIjekPGJYOhERvkHNWc9eHrhjjyZccZe29Hw
--					MEgxNRnoGXrPEscbrR2L3JX0BqGdwp4DzoTn
--					ho1sbUQ77W0TaI12r+h0/jQjVlIvBgFUNMgT
--					4myQiUK2ubBg1mMjNkq/QYbZmgfuLahPXor6
--					UmefhMkR8tfzPJT9kBTxtWiEgbuJhwMGydPZ
--					zRoc9x+iH9xDu/nY8HFKAKmzoDtR/e6/AlPF
--					SBeF4nJe/YdglvNKeDUl4QKtE2spGnQlhvaY
--					eR9saXai7ErBF6q8oU7Bn0qDz0gI6qMFzBg2
--					IoJDqOe2PMg6OiNIm18Dwab80SiPggUxPhH1
--					XFwi/+vLRM+P30Lszg== )
--sec-mixed-32.example.sec. 300	IN IPSECKEY ( 10 3 2 soMe.NAme.
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					P4JeTGEPJ0b/373X144T/ZU1TzwnnLrUvsEL
-+					l9sR9gT86yKszFKMwIvjBtY3zMvYwTzVR5KF
-+					DTEf0xTXK1SGbXzHc4vLtz6/qRtwr7efaa+7
-+					kkeEt/FZ6r++YCUYF3pJ62VRYmyjJp1aWIn3
-+					64qXmpCbXLCTTtugcSmcjK1eGn8= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					s6+Evh5RDlAvlfTNNe9++eRiqH4G8F59coJu
-+					vFxHznIuDOBguVPmvVF62ESw+xgi40zw/QCL
-+					/Qn6y3tWEVrIvvmzNno97ZZ2r0hafRYxug0Z
-+					GDweMrck7Ax0a/mfYyrKII0A5xUZP0BNpNGo
-+					KOq9DKeO9M9h3rOkzUt8/K5U1GUjpb0trpWC
-+					mwyHpP93vFS6BVzvtwVjxOm4XvX7Chzw7W9S
-+					SHN1QLOJCEOAdc3+EA0h/aqIo7Hah7DXWBOX
-+					esGcKCEJQfMwuiHQG4u9bLUvyd9tTsiA1J0S
-+					iFuvppcsaBgAPw3f8mIvMXGT8L9XXppUl3MC
-+					CUvkRDk+GcmXUOvMqQ== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					vcAtprqLVI83SUYywC/qG+ZGOXbif+uIti6K
-+					3Nr5NzTRo9ZrkwrmnWMQPirkSFki6abodNhQ
-+					LNIWKjqpssw47wwjJ2HZPLpjGd2VWk0D+Iiq
-+					fteggBTkVEfw/mJZ02MUejOzBSVt4pW0y9BU
-+					Gwr1461niz+v7WUtYcLUV3DWUwZ2nmXE9qWd
-+					tC5zzfYBJYEnkTm7WRYSrOG2GKLZIxS/2D+i
-+					SRrY+KaL9hBUcWusK+vFJ3OFEaq3RHOVCBpG
-+					+ZyDAVSZAgsn7ObuEiLswuFD753b5ieteBfV
-+					2U5inlw6bHGRSctaq95TMiqKtgbgKyWaDyAN
-+					DKaBMdRGg098GH+zZA== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					L4jH5AxKcqyy8U7Di0m7MmmosO9e05fN37ZJ
-+					Bwkmg1Gf6k3Nv3nK+oaQyPgusHLnZAO8/V8m
-+					LY392PAo6mn5c8Jq2wxZFRV4splx+N6dGt5m
-+					bdaWZbUNqtTKgvfJhdPJFIxsJrm/c/iFit1A
-+					LFyQnRXFtZJXlH8+akFlYMwNxiY9tL9vbNhg
-+					MkjB8kKj38mfZ2cZB4/CN+bFyObjoIriF7jh
-+					MAWl62M1TA60zdmCSRGq70ACFZ1ttJxE47mh
-+					35OjlitMeW+9q5s8J7mIq+z8i7Bt+zYAivVx
-+					saaJvKaKpXDMit1pnJ0W7UuAGGD5YCixFKXm
-+					esrszfQpnoX8JqWTow== )
-+c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com.example.sec. 300 IN NSEC delegation.example.sec. RRSIG NSEC SMIMEA
-+			300	RRSIG	NSEC 5 6 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					jC5HX6U+DvUztGWPsCcqzRPGCx7618IEcZnZ
-+					AXNH3Bs1HgTnP71z7+H5d8Oy7l500MOEA6+M
-+					aJ31XH9xYUfrcE8l03i1Fs5qynB0NW22Knm6
-+					I9mipv1L3Z52OPRQdgQGNzOEml81fopAm9u8
-+					B6DZs141OOirem0et1qfozSnCXI= )
-+			300	RRSIG	NSEC 5 6 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					w6ukkiN/1Z9sH+8stG6WDsem+0oF/Vd8aD2y
-+					QYyP1uX4ICjgYNDMwUDc48v5zJU4zsT/IGXJ
-+					zSnys7VqjawHb9j6TouvtaW3lFTC9/Lfez/2
-+					SeeKqbyWCJKQzMIo3YoUG1V8nHbOb7zDqGsk
-+					6QFjPpy/uArLudiIezdc4azqud+JUpDhh80T
-+					t7fHRBB3mGTn1HVziwEJiQ6N0YiZEzEEuU4q
-+					ltgsQUhwOgbM+ZzKc0wyYeI2rUteO9IGOPgk
-+					PBMFTZolO08FA1z9/8ZtGlKvel6eHg5HuXn8
-+					WjfEcj3HPNpE4XFN/aKh/P5inuNocuTZeiUQ
-+					BzRwmiwjfRafwMddpQ== )
-+			300	RRSIG	NSEC 8 6 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					Ro2XNWTeWt8KuDq6UMwWkcQU+NdboYP5VoG0
-+					ldzWcRyMPGj1EOOT/vhDaehi9wp843nty4bt
-+					jIGReezourFpjHBG1TkGXexqLgx+1H74Bl4j
-+					XMs9DIKzFlXOkk8W554NG1bdQDOlrbtlM8pL
-+					zBO7sI91WbhKpJSABJR3rksNhDlwt+HzbN0G
-+					58+tiH3YLDdEgzs6yBPtkJTVp8N22EtEmesr
-+					RppiFOSPlubRZF90c1S44Kw2fBSpYZJ1hdGL
-+					NCx2fYO0e+oOF6scvS9DRrxnHyd4PwYfQDyH
-+					R4UcoVchhIbh3n0bi8T4F7teUT1LAYQadjpW
-+					KrfRqL8aB4nzyUT0sQ== )
-+			300	RRSIG	NSEC 10 6 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					Zr1faE3PrEg+05hjB0Rrkbgg4TNuR40PSBIc
-+					7iK8h7ItSP1hhAdUuaKvLAscHHlxfu5OR2AW
-+					GpsKIa3LSwdD8eOaSBgzmTCS0tBXrhtoEPn3
-+					e/sFB4uuOyo6NTBHLcbW1d8Fzg4JbvFHDNkw
-+					P1sUVUcy5qmaJeKLDWAEwYyksaigvJXDYOqf
-+					KEIYBecpm6Yw3Cld4weJBtulA2zS0i5mN1DL
-+					SqR/ML1etHNJxOJzRE3ps9IVaIlQye4YGFl2
-+					MaXmI+yS4fvqyc15fqnduo9ZO/Bo4Qb/rHF0
-+					rdCz+sasUPqOvkEG1mWxDiWtMwQH/l5qXPvV
-+					5qjTYcLhRFGHPRaOUQ== )
-+			300	SMIMEA	1 1 2 (
-+					92003BA34942DC74152E2F2C408D29ECA5A5
-+					20E7F2E06BB944F4DCA346BAF63C1B177615
-+					D466F6C4B71C216A50292BD58C9EBDD2F74E
-+					38FE51FFD48C43326CBC )
-+			300	RRSIG	SMIMEA 5 6 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					rgcYP4gQoJrfpOnvqi/eJ8BZwFy7UHQhoptr
-+					j8lf0hnxSPAytI84DHpse5o5E3kqJzfemhzV
-+					H7B/JZcR2/ELkaBM0HlVLZ2Hj5B9sUtoZo05
-+					W0019NkcsSW42KX4g3XXyniwM61Ibr/NtLvp
-+					xxZkGpnECcSxdKvjYc0Qbkbjwrs= )
-+			300	RRSIG	SMIMEA 5 6 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					nJQgbeNHvf1819+EGoOqapsmoPdB+rKscTp1
-+					pT260UL4EdvWGeZKuowKUwRHGktKkbk8yjwu
-+					eZWH3VedfFUYSAP75IR/jZFQy7bSRK0/u+iV
-+					uuwL0Rgbl8n5mGWGJk7/lyiSosfeYklKeBu+
-+					4JcO8wIjMSpb2+IgY3VEO5ykw66En/YfcM/O
-+					OXYpOAiHL8l5kYzTxQYhtquAZtw+TZ89CLiY
-+					B7Al2KvM7M6fh7jk84Q3sjMQbUNF3MI2mkzn
-+					xfTzZ+gE5D5FrKtMSE2kauVOvjerDsUUz8Y4
-+					O3cp6gldUOwSezlYWA+T84w6Phh9vMUjEBW5
-+					536uxZaQslhKqXWGGQ== )
-+			300	RRSIG	SMIMEA 8 6 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					S5Cs6tXyQ/3d53vtCxPuVi8b8w2wKjK4ZFNS
-+					ttOHnIDk1hV7xdAIqcbjyRBQjowFdp2huIBP
-+					ZWtdNoEFvUEqWTzl9jU4eapLmyAr3HzLvJsY
-+					Ajajx0BcRyT+gf04UOe+lnHbsbh3/zPCmqs4
-+					3aYQBnHZNnR+hIvtWYE3sUHQw8jFB9zcR/0a
-+					K0MGO4uamGKMI9ixq6bO5YIZ86hROnk9T8Mg
-+					r++C2ZI6e7vQrjqSuU/0c+3k1f+YucX/b8N4
-+					0rX7rdsuA97Yw4717y7srrG2eyuc+sBlfHD3
-+					fUS5ZNAF7hCqlgR0PaPJyhrx0VSDW5L8hp8y
-+					Yv5jse1Pj6t4zJrQlA== )
-+			300	RRSIG	SMIMEA 10 6 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					juY0ypbmPM0AU056OcCLf9TVzKC20tlEE9oo
-+					RMDh2qsq4yYccb8kO/H0GerBDgO7PNUV7dV2
-+					ryw6EFvzj0Tg9BWUYymnk1OV2gwRjFNRLCJI
-+					mc1akWOUYsZL1NJvkX967bPoDDCZMphO1R0G
-+					7Z47JnYwPjGRAHBVUdZSk33+ENVrpXtFbDJW
-+					K5yALboYV4/XJ0/4KNOrteOdNwe+yRVJcxBm
-+					GJzI/lsIEZ3ujqDWgqtPCIJfEMU+n1/jAiuX
-+					v0vefSuHBlr0oryuUIgT5lkh+oKauzibYeHV
-+					mNfYj+VbDFn8RjqtBlyBiUOLWQWooxAhr2Ej
-+					h8uTAWMWRp3o5XOnnQ== )
-+sec-31.example.sec.	300	IN IPSECKEY ( 10 3 1 some.name.
- 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
- 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
- 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
-@@ -1789,269 +2412,584 @@
- 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
- 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
- 					zZP5Vd2t )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					Q98uLQa4yiNx20mu2+eKuoDUIp1trGYoPIfh
--					2xjpF3LdJPKf7IWHRrKg/83mS/ZIUYMpubTc
--					UReFmBU+H8m2cNT52dgy5J2HDzsi32oj+0c5
--					rryu8ukq4w3WVCNfMB40HryiJfpo0xyxOlcY
--					pxA8T0H3pzxxF00PLsD6qEpzXLg= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					huDnVbUefzBpcL2koVKRLUDwoT1xGgkNCCyC
--					yreQ+VQyJPUOUPYmW76xSugebDPTus0l0dkO
--					6hzK2qH8WpTz48toCPndNLojiF2cIxZwAbDh
--					h9A2icNe9ho3Hr30WlzRCqtTOPkOW9AOcGHZ
--					wRANW/DQhwE4ibCUWx6BuXxlljcujJPfQqbr
--					pzG+jLg9Dw6ZygpjpHXv71cbEEWWNnoJgbfm
--					ijyE1R6mXBZWY6S2TPDfd4qyhWbnzH5caqfc
--					5TD5eAoDnnE1NmPKFg3+gQua/BTYaZeGksxr
--					tmbNOo2QndPX60eeR1Kn4ujxBf0nKa7GfAse
--					D7sX00LaW7kx/rXdaQ== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					xQIef/xGr81KqkEpNwIBHGKKg7c8Rup2Z116
--					60nevwq1tvbTSZCj7i88gVtgVAbdiDC21Tbb
--					4Kd7gTsvX2s9oDV5xYTxL/UHP8xbDjiTaAFz
--					201G5nCx+VLywFvUgjKr1Yu4YT9/aJ2XUkgj
--					tLKXobQX9lNytKCBThPYrIxTdQmYaPzUy3D0
--					hxboqhEgJ2AiKD5qZLhWw0o2CrhoAwsdZIjJ
--					rXsV68psRR7inaHQ3OdPtdwCIMx7MyZKECEZ
--					JEGveLqrR+NU0RqgltL6tSfPSZin2suDX/sd
--					otLdkc2RrLyAM/eYP8x9TS3hvhKy3pJKJiKB
--					bLDYyfw0AFdS/Vfq4A== )
--			300	NSEC	sha384.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					ZBIHK5XwJUX6lZIbqgOQWklBK9mls54IJ9T/
--					2q295urzRl/qT9mJk+7NXNMpu97K6DttQu74
--					7g43pAvQNVORxsP0AfM7c/DeB41IZwXAJ+oy
--					3VjtID+jSd+6HUJhvOEbvrB36kCxXTMk/Kdv
--					5Zl+fiHzWLazPtJPtKTjyi6FZn4= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					vnAbysWbBoMXN/4Iy8KSlLHxhXRRbzHkZA9m
--					q8VlXoyVjbz3xgmGsK87/ztkaAl8mHnYc2kS
--					qUZ21JpX8vFgY8exGU4GszPK+AdfUfdVcxsk
--					x2oNVtkpOqte0SVNtHd3IaatHywBdNE5571z
--					/DhHJytQKOd8AbSOW1B277/mu6c9jKHZdYwu
--					VEgboqW46QhKwyso7CjQYzUqi/9T2m8zN4iE
--					z7qcSHac8Ro2F+FpcGxtIyu2Z41W7Czk37ck
--					4IE9psNkgb4rEyY2YbWTHKIcnuscmlhqT+vg
--					g3boKmOV15rKH2NvJzgrAaWJsxcjW0p7zNzu
--					oHvx1TH44vAXzXJZoA== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					dgFnpZutgO50gp4PhC0a5rHQyjPQorrKpMT2
--					bHElABlUdLlSZL2dyn8iQrDhT75M1c9iuGmO
--					rnlq9jAEB4he88v3HPRW1EHNJFl3MFWBoSIH
--					xYZHDrrq2DT1LFFwJrjCgiH7yg61L7FoV+T3
--					PpIPN8yUaM2zXmuOup0XT/oRFuB7T5liwvtG
--					/M5v0G8ge4dbmRavN8mQSEwFDyE/ZQlGINXt
--					llQVyw2GkXf8eMERQyGeNVvV+lRo/w2zWyQI
--					XHE/3iA6atYJzk/YJooVTDskfbRjU/GaVgju
--					DpzoA/gm8m2LRJk1F3FWYO86JG66XXCjcq0n
--					0kzyTrKi8iTNjaGbgQ== )
--lets.introduce.some.empty.terminals.example.sec. 300 IN	CNAME example.sec.
--			300	RRSIG	CNAME 5 7 300 20141212121212 (
--					20121010101010 516 example.sec.
--					nKij8bJe39EFqF17wJ675A/Ez7cBoT6hHUW2
--					L6xdmeXOwyDsGI9e7PbVD54j8N3saCScDXz4
--					ItQqJIeAd0q22tGXFXQ+kQQRgLVPOTNS7IdH
--					957LABHKO21kZkzwVGF3/GL99RJqCYSfFZmz
--					LX7DQ9Za4nBS4d9AUiMhXRyIgeE= )
--			300	RRSIG	CNAME 5 7 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					Fp/KiTvkjNtPQh/qaR5EOvjKIc12ozI6sfg8
--					r4nPTi6JUFILNkfUTU9+47O0zk/0a7MmTrHZ
--					iZY+6urd8H+nr8RVBgW6b768z0oYUCuJV41q
--					GVuPooxRG5qfQLkNdUMehWIeGHPNFCKXGuYB
--					VqZnzR1JYktVmk/X+IduNCVUdkikgjpCfz6y
--					7m2J41uauMjWDlynA5G7PZYUBFt+WwXv9Ck4
--					/t3+BJwdJZzAxHX1tM3U/vnkEFzNIxWu2dng
--					U/A4F8YyPNff5Gfdbun4zq25Ex5mG20hCJDp
--					TCWlcpCJfd5ROil4VWDNrirdklsVj9frkBc1
--					EOA4dQ7nb2FFz5ysTw== )
--			300	RRSIG	CNAME 8 7 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					k6ck+Rrg0dFu8Z3TeskkbTbdLTTL8ByI6qhJ
--					bRA8XimCd1qCO6Q8fUod2q2cq9KGfHc8z6S2
--					c/+5TFWjzHOxfZbLEnGrQj7HMXtcAK31YHWp
--					SpZ9ucDWPbBU3NEfh4BQZmrB8NOkkCnZ/xDB
--					mjIlWc0Y9tTa5gRePaC3IegPPTQENNhUuEOF
--					DMvZKQsA+2pXSwrNtNvSXlRxGKLCPOvTF/al
--					iEnxnYuLjCl0EdYmgbKoG2wuTdZcCqyamqL3
--					EYqJjr9OmTI0LPTy5oBGPrUxFyaYHhvGa4rC
--					wXiLjK3KxpcYZfsDjr+nkrZXldHaCPX/KQ6w
--					ANsJ7JyBxUXR4GJyYw== )
--			300	NSEC	www.example.sec. CNAME RRSIG NSEC
--			300	RRSIG	NSEC 5 7 300 20141212121212 (
--					20121010101010 516 example.sec.
--					lYo1pIcvD8vscR0PVPNW45w6uOPEQGBrjr6N
--					rKyygzb5h+dJiiZuUdQL03oxI0dl11Ezh/G3
--					ocF81ndZMHrEnG5ERuKftI9vvAvkYr+DnFDc
--					D0N0tIfHzB35qp2AQnhNQY/RQ+i1ZSflOw9D
--					/8rOkoBQSlPAnCpIyGbmddEVcFA= )
--			300	RRSIG	NSEC 5 7 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					XmqQZjep1qmAHIYIQTnzVk4PTeKoqT2ih0yS
--					O32LiLcnGTpJZ+y+cdlvLUs6LqZaThePOqtw
--					foOCOYdMWSKWCCKXwonpwKEPocjt/C8v7tep
--					so7KOdEX0suWxbDOJP8TMzdNht147RwMXP07
--					N/TedkKA9Hs14fEYEoiK/y73KKDz2ckxTRIX
--					rxqeZ7ZJfGTXuK/PxAfAtgJS5nBkGJSDKM6f
--					ykym+QKrBe0ANqVZdbykaP3I0WR21d29Wg9p
--					qA+sh7SA2g/waj29e7Qd5NfbMis9AfU7lQrk
--					me4g7N3u5U9e+FsDRsNItwASl8c/5e7CrA5A
--					5mkKaTua5ovvwkonxg== )
--			300	RRSIG	NSEC 8 7 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					wtjR2qaqRvPjQBaTH2JgjhjWsnEZfN8qcPq2
--					Afjx1LqD3f1purYgNXtZhlqyHWs87qksqPbO
--					rykcGMB8TZ2VpByJS6yXB7LtRaM6SO9yGfPy
--					8b3Ki9bDsRuXRC2Ie0HStJW2rDuELlBJj1Mp
--					gKYUUCLrWJ4OCaF8/Xm72zmJDkzN3rMzThTZ
--					/6XY8tYBnXwKgnrWn9J+VT720pDwFy7pok2B
--					os2HTAO5WY3Zvl+20B/jkE/ebfkhTsWGHFob
--					ENUAukxaaDbPtXuyg4MKreaje2wh+Iu3PWqb
--					efFTG/pnsfLYTG+pXAnb4uzt75K50Ze0TUB3
--					+Y3ZTANyeYApZkXo1g== )
--jumphost.example.sec.	300	IN SSHFP 2 1 (
--					123456789ABCDEF67890123456789ABCDEF6
--					7890 )
--			300	RRSIG	SSHFP 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					WtF4ZiPXqdAu94QyYts0GKM31E2y8xOJg4wa
--					jPpkZI7WEyQOx4uwILRnpmkSjC6cS+ksRBC5
--					lgnLtsR+ZsZNCcOIZMZrsMQcGm21/DI93HxR
--					J+i2jCVQwiYws8hguupSahtrwGYlnwF0fn8l
--					D5RJryJFZQGHQKii316GQWIJ5fc= )
--			300	RRSIG	SSHFP 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					PzecZqU6DRFSEWJ1dfx/CGlIlRFdgu+Wjgo+
--					s7SedJVgGCLrCxhx/lbBbcnExjTiCHDi6/Wt
--					q0R8OtyUVXvqyKMUwr1f59AEBzWO9GbXs5fr
--					eqRD2h229Y3o6aVMKHl8hsJUYjxyFCBqNuvR
--					kFSPQuAJaUF+uQefB4pDiVl1aSJnZDCi6T5G
--					+pTUyF6Ttr6b9VVsR2EUdwzqF01JyqRNgzZM
--					hkmfwCQsBfJd9rGh3qCm/9iYVaCVEkNVX1T8
--					jVVhLm3UOhUEJwmi8IjRyCA7RJsLQmXkRrmw
--					AX7nROqRienYjw0Ztm0/VGbJPw1HOm3zAuHu
--					QtxtWTABc3j/C5hLdw== )
--			300	RRSIG	SSHFP 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					zhh18mu+feoq55Ddkkg03SIJQ/gbqN32ppia
--					+WKE3jBbBaEaWLJ/wP65WHqIyDu25zctg5g0
--					m87Z1BbDaaH4WQK4Joh5tLd1bZzvMAUOPip+
--					X66G3vwE1PXBLJNzjB2c2WZhOXbsghdBXmm8
--					RJbysUS/vH7JMNRZUTF/tSRSGOtlJkDbqAeh
--					KS7dd+m5StDlxP3Etv9zPW9tA+n0VxUhkCox
--					9kags6TtEPf6j8acS3HhYUhEJRqVjH3vEBy4
--					xhYhkX8Es1K1md5HY0RoKL3z5NSkVj32yMTk
--					vaFYtg/yhKLlSQsX/Hn75rOjgCDoxTBCj9EH
--					q/hHLW7UmO77w5RFvg== )
--			300	NSEC	mail.example.sec. SSHFP RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					L3vgFTbZOLeRq1I+RVhl5jOAPHTgKlKkr8Lk
--					ChyFcsWnYoaNdNSkotTSKoWW85T0SRwktH4d
--					BCexiVcc+pzODo9/SkCpFKgkZ+3Q3aC82mo8
--					rt3qjmgLOeeobCLj3X+lgLZRHqw96d+aRpq7
--					Jna2ZA963cUv5CGkRW1vUNDWwqo= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					Y07ocMMI0+fY8gCwsPEbdzDtwKdma7+JRKXT
--					9DMUx1hmcS7YxW53TrIMCW8gA9snXnSJjG0h
--					/aP0OuFrJvZ2xUUAmpYAsdyw+HoeZtwFb3rg
--					YJRL94Up6MVzNX89UsNYPvtvP7vEpebnYxzc
--					gzbOcjnV9F9NPHj86Gr1hT1A8dOarbKVFLTs
--					J3yXWalgG+qy51qhzThgimMUci3sNpFuKfG2
--					4SGCGIOt2rW8OulNuAFQzTg3zmR/mkVm+vip
--					2KVIZ6kre+Ka+fR0A7tZP+4U5xSaZXMh5h3K
--					YiuDaxUmWZSc6sCU0nJHtsB/HIxTi958T0Am
--					Scq72LK4IqpAfqSazQ== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					CbV2wVqT7r81G8rqWPnda5iHqPaUwVAqoDyW
--					zKQhbAj8ydnufTHODju4PV98alGuQCC50yQ5
--					KBHZu5enOTQ/MKiAcL4O0QQ76/OQ1Lw8HIa4
--					FtkArpipm9h3AFnFoYfq9wS6xmweX21SrNmG
--					phgrqYtR7pvjBXlh0O1kZG1h3fRaiF0nA8jt
--					1ZzkMhMCgiFubEDQCVhygbkucFmSSo31HSCC
--					ChwGnjLXj40HKvpNg4TUE/f7eUnQDeq95A9N
--					O8YoVcNkcVTxx0hbSlW6Q8O06Dryf6c/NEVj
--					lXgHRwxIsLEC2AqPbNuXVCN7A1z0aVLfTFxF
--					hNFwOEnZfExmu5BOsA== )
--sha384.example.sec.	300	IN NS	ns1.example.sec.
--			300	IN NS	ns2.example.sec.
--			3600	DS	10771 14 4 (
--					72D7B62976CE06438E9C0BF319013CF801F0
--					9ECC84B8D7E9495F27E305C6A9B0563A9B5F
--					4D288405C3008A946DF983D6 )
--			3600	RRSIG	DS 5 3 3600 20141212121212 (
--					20121010101010 516 example.sec.
--					RlSITzGdbUeiO/X6i7jPSTliXXzr/zw0l9MJ
--					rc4VzGC0dcGGeDYG1ZWodAL+pM/VZmS1O1hJ
--					8qqgmih6wk/6J1Mo1xFHNOsdQydLPbhb6ziD
--					aWc/yVfCUWH3bs972JM3VLCKRutNEu+aVrqH
--					D4GBx6a1ydJtsbAzKmwZ6UntJTo= )
--			3600	RRSIG	DS 5 3 3600 20141212121212 (
--					20121010101010 44427 example.sec.
--					5zkHCXkdljvaiL0IbpLxipLO/bs7qKegn4aS
--					3XY95f7aCH9jsuKh2uDBDveJkyU5TCLLjwq6
--					RxqPpYxykXvt9x7ezi2ErTxeJ+BPg6t7kBQ4
--					LkORMTBcZeGX8i8GDD3ENR5VcdyrTueDiWBx
--					Pgcs8l1N8yXs9o9Z2e6yiWCP3dGpzUsjcTWF
--					iIBuMdSROEoB4lTI5+uLPoYu13odCisP7f2n
--					uZcCJyIrnmsUAO/3gYaP+Rn4tJ4f3rYyIFa+
--					1dqimIVAlkPM48NWFLT+mQ9G0yJG2qApvjni
--					xjjR7H8iZjfkokn7v8oYD+s659sZ1p+ZtQEa
--					V/KtryLRnftxfi486A== )
--			3600	RRSIG	DS 8 3 3600 20141212121212 (
--					20121010101010 48381 example.sec.
--					oXm3VWAtTniky4PqghkkVdndrSxviZ9vWIeg
--					k/bjcAKeMyFViCuYZNwtKyq/GiDPKTjK+43x
--					iH5hFzBiMZ4xLfSZULvh6koONQN5UP/UyjGo
--					oAqayihsnpAd3jNt9vDRwHvkD3Nj7eg/JTU2
--					kQIIIYzsmCbAj34mnglaSep0Ms/Az37lzPs5
--					hYWFeW4k9fvD5QNkIWM5lJ1BsdNwVBpgLJw8
--					r+oXjy+d217hTSU5BzsWrUH+GQT731pk1neN
--					k3JWQ7zh3YgydJLjk5ajhj+hxfCgoCgE6Bc9
--					xlBKNJ6Rh1JfIRBt5IfHkheMTRD+xZO4hZVw
--					+QDVTvnhNjmV2sQnFA== )
--			300	NSEC	lets.introduce.some.empty.terminals.example.sec. NS DS RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					rC7wuuLqhJ6l+bW/sKlAHte1NWIb/JwiNHAB
--					wrGHvEIeEXH/qG1rKuMYK3QjeUkIC2oiMXjj
--					xodTvxPHsSMxqwSavndf5bJeMdJjJ7UaY8KV
--					EmcuUlXP5Mbb0TyxER07MVIbJW54X5DpM0bl
--					03Bgsnw7SpG+W2AlvwIWZqJ8Xwk= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					57QM/Ng2WsIIgVJ9f8FMCB99pw2Q2zP8NBcl
--					GWycLFxgEEIrpQ5+MZo6oORsChrvORQU7rlv
--					xEaLgEkfO6vS9aqXxBP60TSOL5k5XXtQb1Kf
--					dCvZTU6CHWjGy4ofynCMjEJWTaKAXe6lhaHn
--					HBnKhnTw6Kd/CzimHJAhFOISyiBwN/bjjwcJ
--					mzXZaYS7mZqw+syBbUmInFrxgfvmKMZvOjPm
--					mEUPq23UdpDgL6NEHPsGEr6dt1ae//xCu7Y7
--					Nq/q4ZiB+eQ0A6u/FSo5NZo5b8+ndZfgsTTL
--					dF3T5VUzvZ9LY1mMmda5+QtVMF3l+uM51Y3N
--					oMCURZ8o9y1kRgOe8g== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					rkUcLynqN37zmLl+S5Yu47n4OAHo0NKRFLUW
--					VIODdVqV+HNl2wimJpmkusOmZielq+O9xjWp
--					erdffAJ24MYAXObqaFSHizIRoMZVW0HwGVV9
--					zhuAjqVFGESd5Leen7sJ/B2Ari9Q1SPFyejT
--					YvLVeFNcqqYK4AZi64q56waNfA7kWKgyCx6a
--					crsYPNIYzcZHVtmuv11PWH7xKsZwqpU2wFMR
--					h8rtjJb8qEYo4MmNNtXCmdj80Cq0haTuqv7n
--					ESJH17445IDjvrs49q3ibTqzDTh68IwpJhca
--					G2VPTAWdtpdx/q/CIAuSHRLxU93OrMTUHPqi
--					gPFvVeDTxcPucgzQIA== )
--sec-mixed-31.example.sec. 300	IN IPSECKEY ( 10 3 1 Some.namE.
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					o1OyseVi+rnXv5XphFpoyn1S9RA/oBLaMDz1
-+					j6EtIxKzPc9hoECBQh/7FjSTweGkdhMbkaTJ
-+					AH//72vBj9kpWbBlU/A+cRkbookTsPJNW84t
-+					hfQaZEeVDK6tGxFuLjfu95kJKcncDZsEyhaS
-+					JUua7gyEBDy4sfyrLojVCT6jIdE= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					pK4pQ2/wxYAm2h//CXEp1otFBem3RsL2MOAs
-+					1mMVT4JOKwg/LML0GwrNddfPUEjO7k9Nau6M
-+					1B+Av2iir5zCdYaqi0o1JLKYX9atUEm0wXo8
-+					ZMZ2X8BqoFcfThvnZt6vd3nGc50wDj82tLJv
-+					7YlZm4iNz5qVD1AgWPXcy81U77eT4D14vhUX
-+					OpMq6lWzHA9TCXQLtPthLNawJGY6lGYlYGh0
-+					pwWrYhddfNhiKyWOzjnfLrt6axJbqGJ4LJ85
-+					7e5y22AablBRqPCLR28czCWeNgx4hVpPbiIX
-+					dcepLQiOUY2WFBsoFzwXWyt/VE68aR7wLRUZ
-+					X0nNt/m2XkruNu8X1g== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					vaoSbgs4NxC7/obO43g0MeMpYYoISPjhIH6t
-+					WS2u/k4h+Wwpa+dZB3QGGqtl5zAy5A8xd/ph
-+					veyY3ElY/CiRwbDcnZIIqVIrhmN8OiQyWl4P
-+					+lIlmCWwq7aw1Mp+PtyVdmRx0tKLRVVUGr76
-+					cxXtPYoHBZM9iGDuR/sBp9ne7Qx5xoqy5COY
-+					PYZ99ks/6y3ZnHl5QfKEKuLUGIUuop2LLiOs
-+					vNHJXORcW2gBsbtIbj29px74u4ZA7vcD9f+d
-+					LR1+4PW5PcPuA8dr+r4BX28VhSmhdizqlC6k
-+					gO2KbVplKfrmo1dC2ttQoDAYhko+AARt9g9t
-+					iEzQnveDN75dlK+VNg== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					oThQbYNemKxbcxmw1LBjlqLe3bZdpe4fd2ho
-+					AQBRN9QUpvrOP1eLrDSH6lp0OHXz7nHE26tI
-+					biFbLByyCfh/Bi/6VYwdGh9Q1s2g7YbU8Nru
-+					+eLuwbgPe0xpyM9TlLN/uRIkCYeQOEdcLrit
-+					7j+vUTCcp6B/o0swUhemn6lxkZLQwouY1A4j
-+					zXVUp+9Qqa0ffNtRnPR7Ho+aBY6hx8pBbg2J
-+					89wyQ0tu1a8teHTDIQRnnfy3gwObHFYSGBn6
-+					avIHcxPmlFwMERx0tNJAHIkhp96cliSFGgqt
-+					BDdiVvKXmTxxtGNtFPfAyORs8l2h2KE63rTZ
-+					UQHwlF1iELN138njUw== )
-+			300	NSEC	sec-32.example.sec. IPSECKEY RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					cvjaA3Qs8UpY6JPG5FbfaZX0j5RWXo5jaJiZ
-+					wU8Cz2hPpA9L/GvAT5ww+esIlU6oDej4TeH+
-+					gnTcsJ+nZg/+dSAMIuF8G6EEDEHTwdiY6/zX
-+					WQqgfA8wMfpnZ+8rpBprseoNH5MDhVxVQ7k2
-+					U4w9u5xXgNhhOtTBM+gKi1B9qyo= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					re9WL+24ilv6l7mqsL6U4stMfiIOjB3YxECL
-+					mIfroRgqskpuz1E3/amZm2MrSqilm4Ejdg01
-+					DLypB/3piihQDew/IggKbYvR6fHfPacHt1J2
-+					Mhe57xoFWixS7tWTM2FrWJNq8/LJTdEpOhsR
-+					rWk0Dk1jBR6qFljcu8QZoHHt44Hn7h4aEXv5
-+					WdXfKO+1fRMW15QOhbWyU8YvCORfrtXQ32BI
-+					2D35FgEpWI6gLZcs9iW97H1zx8XeMXeLzRBg
-+					sLv4fLJ5gJOc9Reoa9uaSOyefHH462Bq7Y4q
-+					Fy8zz7lwU59Hruqy050vJ55So5Fb8KY7MMDZ
-+					jV7OIJBfupbEvmGDTw== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					wtVkLK9GQZfFEzUGK1sq7o0q/HbxY+nOt9F4
-+					gm+5o41jCQup3t5dkLkfBhsGqbrIAR+xymUo
-+					pjIoseU1hKKDRM7pWTd+b51gMyKgmhenKyWS
-+					9RrOt1Q0fChEoVr+XgWE9/HhWRpPRp9dTLVx
-+					k6FDiKR/5GxPfJIFQSXXRff6TyBVTdkXYdNQ
-+					dZAT6s5p6VkaJPgpvnnHBsNs2new9/v7KuXu
-+					jAHPIkhdZDvq8NV5/K166txQLE759/6PVnhH
-+					D05wQZFoLa+2WBNKL3jdCiiodmyw9khdxvhl
-+					4f4pG4A6txIptb7QdOc0czbDzOiEqCx99cMl
-+					shOZ5LLz4n8vVLOiAQ== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					Cy3wrexPHDOGUJa8ogxhOfvqwUKSshpHVwG/
-+					DkHA/TPDr9pR/MVY2tQU3tsTKMKXgxxkagbh
-+					4fhdimu3dUcAHOTf6OcfFM2D1GPqxBhHgVJJ
-+					H6Z6KdGIwMpCap1fgvMkarPaVe484s5owwwG
-+					sqbq1/4XtGCCmlDK4KE9zBgYm0zPMZd2ZZOm
-+					cV46n9oYoUR97pLO64PrM+dZ1Y+zW1R9QIyg
-+					WTo9afOZ/IC64eun5dMw52ZbS6513WX/72Vl
-+					AwqMTmfYmwlC29JSgSQVQtZtVs4QMlFcdmQH
-+					uiY7lI42K0tn6autonajT94rIT7xbN6t/yF+
-+					fnRPfoMIJ5T5NONFiA== )
-+public.example.sec.	300	IN HINFO "i386" "FreeBSD"
-+			300	RRSIG	HINFO 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					HYDUN0tUGAuzK5EPKkYI1dKQ9xu5isKcKIYp
-+					bGgrn1M5XLh+jx7oNzGlJxtl3wrfoNNH1Wbx
-+					A0qKHanznYIeIiEAdEVy+e5VMRl74D32ant4
-+					guuFPJTVV3lGu6D1RDy+5EzUGEQoTEhKVA40
-+					g22QkfKE6n4sSlmQyxxd6rUUAiQ= )
-+			300	RRSIG	HINFO 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					OQBSWTqQk7yo7xGQEzTEXYqwPNziSwDiWRQk
-+					L111w9lAGjLqJmvcI7WhIIjzbtArXWHiCv+b
-+					jM8eKLRpsiwpfA2SF9lv9JF9aUMBHxIH9zFI
-+					xpW+i7x/xZ8Qa7okflF7woGZeDYoo/Py46o2
-+					PY5XKK/e+sWfW/cN4eNb1heEkR78BcEUQo15
-+					tv84iuEb/L+UuMS3c3U32/jgt9GSpXoX1vdl
-+					DQw4X4VJGjRV4XWQVlOTbX6aGFEwGE6VQRj/
-+					i4wyfakpdKML8rnlp/FA2XW/5rEED7qWCK+7
-+					DbLTuuYPBxqLQvMA63KQqsfBiTJ0ZKMR3VTi
-+					XFrkYahoAlLv+cIo6g== )
-+			300	RRSIG	HINFO 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					yg668jHohtmU/dhqNYteS4MmACOo1ErZmAzm
-+					eR7yP4mX9cBV4s7l+0ro8cFDKGCowr6IoHCA
-+					emS6vfHFDmHx3NdIqeJWBDsovCNVCX0RAHcn
-+					DNOfTWy2gp0P3kClzegSXl5RVK6F8n+1uzfs
-+					GnZGjA5OyNsMByr0DtGfAHvBvcbNC+tGyoxO
-+					VVh3hNEzWuu1HbEEpKHVla2SHGEUUCHvGbBh
-+					c7NcIc2WZNzIgjqah5vUhgj2fccImxzQfxvC
-+					hQaHNcOGQ41GKS1QW42lKiertl6ivqZuhjH5
-+					CYQdyA4Mj9VyvF8tLRXIfDyl4Et7NXLKxTT9
-+					l0OemRyGnWw+BTdHNw== )
-+			300	RRSIG	HINFO 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					bzKDbXyrkazWFhXhWhfsMcWtY6wTcg035fZU
-+					18rgZ1fAHQsfgRmtD5BiFOa+JVW3snT+eLJK
-+					9U9m+vHeSUyQkNbnxrl0s7RSny2oXbNRes8P
-+					y+cknM3g2mmr4JNXOlAe+kwm6TdzdH4DuUm2
-+					mK3KfFgtagnWHu/j6wE4tHYEuGAgrX7uYVpO
-+					ffalQ1AFO0pyhFmnErk2E072JYSrpAfi/8Fk
-+					lE33sBAr4SmFr1KHnJTrO/WVaAAZhRJqUgbx
-+					eWkzBXwiWwJPkZ0PDY7aYJeHXLLuNz6gECZz
-+					DpY55ofOEFYLNpSo/qZH0DACfZW0cf5MyyHR
-+					zMlkokhK/XcmmEv+LA== )
-+			300	LOC	55 40 15.258 N 12 41 56.378 E 9.57m 10m 10000m 10m
-+			300	RRSIG	LOC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					U1RcS2POfW/akAGCD9RNOSr9MtqE8ZL646mQ
-+					xFUNJWsgOCnc+w47XqB0ohbTMIDL+JSxiZYk
-+					bgcX/9y5OwCR7eyy6drWE8J8Wqs0hbYQXVHk
-+					AVb+4hrXY0XwFBc+outY4dxbagT05S33ki4R
-+					OlDjwoe6NbGV+jvtSlDzKMWN/oE= )
-+			300	RRSIG	LOC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					dywJbQdmETg/tdyYGELZFrNYPATirURA4JvV
-+					d8u+Ejce5X9a2StTHFG8AO5oHVHBob1z/SNp
-+					JKFYBECnGxnTTb5MjZ43n0D/hcbX089HArFN
-+					pT5MMCNlKlU01W2VrlYyMkMu6/KsyFQK6Mcb
-+					Y/7UOu78DWbbePxwijigZmdhPFJM6PYYWLeA
-+					8mJaqX0MmB51o3FtkBEp834s1bxsktFKLI+o
-+					QqSgbreLDF272tDleo9LkM8RwqTNBItHf92c
-+					99y+VRg8+cmP5hAADV0ANoFWmZ8LIKum6tJd
-+					48/kUnHjzSTMRbAPt7lGcw9ItgC074mku4WU
-+					FywoK4EGwQJ7uH49yg== )
-+			300	RRSIG	LOC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					EdCsT05INrfXrxH7OJu9ZYVOerbeluKqTymi
-+					tdatnHH6M85TT4djWnspHnVNsjNSPFy0+56G
-+					N2CHHgXsqMW8p1OYAOzwZ+Ba0t2L3tIkeZ0y
-+					Fo58ROSBwQFl5nNSX5fZR+VOg1nuAhZR88Zf
-+					DM4clTLtCn7zV9TtuBINhqrI0vfXhYBHo5Rh
-+					e97ZBVVcJzNMT8b0ehJ9GjTQ/Zy/XW6UVTF4
-+					RinWj4b9nZtxZMDCJD1fqpkQnAu356ja1Q7B
-+					VgLLRuSi1rAULkISMJipYNowW0uCSdQK9vCH
-+					KIDRskLR5d3DJkmjLSgDbaw3Lqya30/rGSgp
-+					y2tgRWdgS2aEpjAv9w== )
-+			300	RRSIG	LOC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					MGe1S9ZySCoiyDHXhtEuRBFqgFfh6d9j1+8V
-+					QSzpVZZt/D23ykb0kNovytKFnznYSq2mm5i9
-+					1jGIbRkkTCJUmuKEF6o5BKeG5iIe006tDG+n
-+					/2hr81FY58+p3qgY4uaFVcwMAGN5ixuL7J52
-+					QeX8qMrGwnLeS6/USfxyfWtu50nmpgPF7a+J
-+					KaeV7Xy9E35eBtp/LZUzubxEsx78ejlBYb5A
-+					XCLFT1FmxtRktRyQ4RNSOX54sI9XpUs8xqMr
-+					YF3IY0C8atFhXJ42M0pr31SOVJjvF9KAax9Y
-+					I5QucFL+ovQLRYgxVrj+o3OM0akoyd6ea3M6
-+					SxLo0XnQrhTkjr8Q1g== )
-+			300	NSEC	sec-00.example.sec. HINFO LOC RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					i6dgTc+9Y4X+JGSuE9o65dgxKLexkwcsLp99
-+					x/h1iHgEkck0Y0i+d7MDGNg6ZeMA3uuaxnGr
-+					vSntLNBywTMDGQG43aRjn6jZ/OwL/9e/0YNC
-+					wU0PoIsKqg3FKgaPFXGk17dPz5U56Px/nymo
-+					zSero2AS1cAXyihClqKZ7EjeAdI= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					WKK7b9fLcJRs/xI74VSpnCf6sVr4gPG43TUu
-+					etxbTga8TGGHchOzrLhR+l3LVtHkos2Y1p27
-+					bZtYxApqZThMUZ/3fsHwwjhLU3dVNjVtymcy
-+					Au8g2+Km7htzHPJfEsFtlBV1DEjiTnPxx9iS
-+					Ayi6Ib4p1Bp2h1AaltgEM/EbzRtqnBkVq2+j
-+					JF+DRN74dB1ZSWltzNXhZaWNuHi6C+ccXd+Q
-+					A2EVSg5f2O6GzVS+RjueuE6SH/AifFjcU+Wu
-+					p6QyQUe2umElIk4kTmE8RWxFOO8JbDBdX4Hx
-+					CyLcvGFk9XKGmtVpC8oLilxTNXC0pgLI+/Cx
-+					uNvtYbpYweguxAUduw== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					03EHsunl3E31Z3leZefzCfpwXIw5ZSjvwITg
-+					DQJNsSFQ/7xCAozjkuaSbzi26t93/L5ggDdN
-+					zK3qAyxslqbCQhc+ILItcsu8YS1AYHce7ATr
-+					6lg5QUij7eZp6mvCAde+0N1kun2pvgHXakBr
-+					YM+u1ifjJNBwtMFU6DkDYVMvaWGcq+Y48zT6
-+					p7Wdt02EZFrUWAu4ZOSjksRxpsQrTc9AfEch
-+					xMmOEVGuFP2xpVDRYbYE25gSy5qvyoVqgQWm
-+					BgHbCDHzR+9BhInrI9yzhUV64ZGq/wZEOtz6
-+					tj2OAh9f5bp3N0rn/BAqh5c6mDfd3S8K5yix
-+					MXKlpr8ojAhJNXF17g== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					oNhHACRQ6raBdFx4fpCx+UW6OHPUGGyRd2LN
-+					AliBFGKXCXdAED66EJlwjnTTYduegY07zhXu
-+					39DVCsTfNWu3nurjLel1J9LIIGwkspnLnQ3z
-+					tZftNUfVr/PjQNoA7q29TY7B/LxHcGDniBZI
-+					0JfOATi2J4iWRd3UJMMOUAY54FGj+dVzPiCU
-+					cKEt7WSlHDSq98EEsoPYkZTWrTpM46LvC5KI
-+					hgFwpWKbIIzwFNV2C9ykMfLLFRLi3JO4MQbd
-+					qbtxkUV+j2T7NbTWml9OY96Vs9oMQjSlKN/v
-+					CpPPoRqwXyzpsMt6NfznBYNFWV2VGknXIsXu
-+					TDTjFhCaXd5uDEKOwQ== )
-+alias.example.sec.	300	IN DNAME anotherone.sec.
-+			300	RRSIG	DNAME 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					IuMBiJ2cfyjxV1O+K18LbL5OuVk6fG4iAogl
-+					KxuKZi9biDB7UaH6Fd0ShEcM0rUL6MzcmEbg
-+					FovFTTyBL8+O/LhzElse+dGV0hOz/FilEE3m
-+					LZzjb+WB6sh64zSRQTV3vzMgJxs/I60JbVtE
-+					eKJ5ktnNmcCS0T+0Vdw55dX+j+Q= )
-+			300	RRSIG	DNAME 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					WQTSaB4LddH6Y/sQuvqAawmY7bdhTeY7vZD8
-+					YNUvtgx798+DZWKQHmoWD4KDhvqMO3D3rFbM
-+					AvjtZJsamVgHFDVnblBfi1oGKL892nRquFa9
-+					d40XUtKW5d6I6MaYyO6Cnxs0DFNOKC5NUuUE
-+					dKWOx7fuuVaXliZqsGzDESKU6mwiOwrvuSqx
-+					wf20bNXy+NgWHom36L4dOkBdiOWgcJ7fmI0N
-+					XCmVLTRRrzw5E4kIIX1nIysGSW5WyWC6gxz8
-+					9EYBBK5N38eqIHmxwUO9a/8tQcn2PWNqBNMD
-+					LFYiuhweentelGwe8E8yajaLfjBZjmr48Jb4
-+					HNI7A+9xbiCjBseGOQ== )
-+			300	RRSIG	DNAME 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					010KT3MX1e3al35LdCNFqsZT7+TbZerO9AQB
-+					DdaiVgmyQw7+UELxrTEyxPS3V0bMzUc3g5jz
-+					2XHzCo/ch5tFN8zlV7KUzQSqKO9+vt15JSNk
-+					2sSW4jJVK3S7KXH5+YRj0EOPL6O21K2KHwef
-+					VZItT0jxk2COVl58qYa1PQ9DoFZ/mzWwC/ko
-+					jRFwQc6LXFW+kDDzbHoj8JMeRhJOOFUQhRfL
-+					QS5P6CruFekgMJRyeIZabQnqfzgk7yw0YAdR
-+					06X7LlxBwsVeS+un4VHs7+kL4TvaFHTfOgpC
-+					/d1A5ZEeBSlRF3WrwrcqBNlm/DHb7rkn/w/n
-+					osE3j9hC78lfgnm1Lg== )
-+			300	RRSIG	DNAME 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					SIK086vGT9CP6NHhDUzNvbF5e+2Wf3tngnBz
-+					wOXyU78O5HqY6c3urVCwJqnZa6FfgKigfRui
-+					uc6nvCtIIx5/iQvjxKi+3oGGvLiYKJQlJmbe
-+					XOocOddpBKkJ2QEx0VWK6M/1MqrHFtOh5l2A
-+					D4R5j5Ximl/8K/P24Ek7WFnCBqlpBSS5s0SQ
-+					l0oZo2gvZd+GNkiIxIBt20U400p3suKhglEQ
-+					MwdOR/8+XHT2KsqUssmsIYlEPBCBiZsLn0aj
-+					/tu6brATslv/qmsqc+HQMJRbJ5YHCRpbMOAl
-+					rEWgYFEkxachPaRRIVuQwkcTJM3eTjn+D0uK
-+					hdlOiQrBACuchImlBg== )
-+			300	NSEC	cert.example.sec. DNAME RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					SG2SiQMpOH6rJ6ZhQ3EK9bnnGiKL/7LQILSi
-+					D4/agyclVc+vMnfVY9waoA+Jt70MFJEBd32p
-+					GScUcRu9MkpdcZ0MiCCWwsGG+nrufdq+rxFr
-+					+FOX85LZf4v7qp7s0xL1kf6Uol5G6J7rZIcT
-+					yZgWGZfl4WuFSAouPQRnHV/eoqU= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					uIRc9Iio/aaMx8R6vVIuIqMq92y/1iS/mYch
-+					wupYiy4A2oz9AjQNZbtGNFu8gInyWPdZVfRM
-+					gwSVk5Y6xFI303UWSCDSaFpd3VhkcPFToioi
-+					scgtUVI7/v72JOBkhxFrB6nukU923E55ya7L
-+					DCZ0lWnLh6VMvSe3MtDLPyUDQKfCZQVAlmNn
-+					du4S7uWN6vh5CU8aTNwn6A/bOodtOAx3aDjU
-+					m/oFGpn46FGuoYTcnjp3NGUFYOTdLlyWb5wa
-+					V2pS39lJgUHBs69+93RP3Lgkhc6ZmsBP/J5j
-+					vddRQ2kr8sBQ1g768buWyqeE2566mnGi6PoY
-+					lqAEpXO9ReqdPgXqYg== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					xw3R+vgGkofS8s1ihzSnMLoKrEEXxWB60hxL
-+					cl3uJpaXSzayoXwco2dZaUzq/Wa9xFBPE06b
-+					USSpn00JVhPA5UpAWBx1W7aD6pgyXN4Lfpk2
-+					VpjJ/1jjsQEWGZfhvaFnHF2uuPddNaQfWHMX
-+					kZDjjpyWC9wLOusy9/7n67vie+SMI68vwqcU
-+					pOKlrlTgumJ/HxbTvCEDM2jU5+umyaP4ZvIA
-+					mtXSr3r5FUiF5cA5CkrYW0cd5CVivfkHJ9bJ
-+					3wEbUZ4NfImKxHCCgzS37ICNl+yB2ldHTfXy
-+					6Ho3jmteFbvNVRE5IVNrSozcPaGU9xBLZFVg
-+					sle3rAROarz3lLDiBg== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					mF729lkzA2S/Yif4OEuROLkcrLzhValIq/Vs
-+					ahpCu8/LQOZrexKLlC/d9SFaSlQaB8KjLQeF
-+					L0+s+3OvBk+AGcOxDSIlwm08P5lTRM4kvzdY
-+					auZpiNS5rIgLEMM62Yla5mMhvvt+Np/lQ4yA
-+					ISpdjAWaCjuV1xBs8099uIX49YNKBLloknSe
-+					K4MWHIbEagDbxY8qnF2ao89msx7yQQeCun2k
-+					ep4OGnZOWOBMJON0x0InrjUOpQC2XjJPgvIE
-+					XTkl041j3leC8nvzpcTDvD5IDlVswExmFZ3a
-+					inFdWQq97blgbbDItF82MPdrXUSWTAy/qmjR
-+					oUdhgjyO878jx8aicg== )
-+_443._tcp.www.example.sec. 300	IN NSEC	_8443._tcp.www.example.sec. RRSIG NSEC TLSA
-+			300	RRSIG	NSEC 5 5 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					c9om8Z+YcSMHdl9Y9JyXsKtmd4s5dJwnWWBI
-+					XC32Gr2gbo2myvNacNo0EOzlnDndF23he+57
-+					41VeKKE+jCuHPMzZvieq/INcNXu+wuGytWiQ
-+					XTrYQSt3TiejxQdE6OxoxR69RqCyySRBLjDP
-+					WT9fXekxVMbSogR0oLjWsuoCREs= )
-+			300	RRSIG	NSEC 5 5 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					yQC7jAIX7VS4SSN76lt7Tu0meff3EKGD2RKb
-+					hSo0hu9xfRMXlAkxx9W13bnmbg3o5rDD31Wd
-+					1x4xjd408l5eswm8G5IZorNvvlmBJHXE0BSu
-+					dOHrmC5WmfyqlqRx8kEMsoUrMqQTqct+QmtP
-+					rKAKrXdIoSx1kd/76R2YOrzbHWD3ydChvoLy
-+					sfHQEJIPd4tvfuMokWzU/CpMpeyqTzebgGN5
-+					dSB2B++boFu0sfgTTjt/TGlXsgaU1mHBuknz
-+					k0MUvaq+f1oDuw85RGo0/sDAKpkqQVUxW/j4
-+					bLv2BhAFhQGaSsv621WDziYWn02wxEccTP/t
-+					uc8lah+VM9YF/6NjqA== )
-+			300	RRSIG	NSEC 8 5 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					x8TxyxXW/d1su2ijhe449HrUYcjXCLDDlh+/
-+					MwZhh+6O3fdZX/bim/q53XtNCOkoTXl6DMus
-+					Lei/xwbIQYo8f1J7rEe7bvv44U7z9XR5cpoY
-+					bPIXof3EZiEwsqHSb93/UstNpRsDufUeyv4l
-+					cdhJxVM2YLmQJ6v0UjwC452NYg3tTfM8vpMU
-+					YAfgBn3ajsSpek2TEkW5nt2kktNkoydpnbuj
-+					jZk7Pxmw8KbEPt1PO7n9LI80OA8DRkykhoio
-+					8SaXh/OI4sS4Mt+wG5+lJixMDUIT7m4jDW9n
-+					W2skYvPYyaW4fS8Cfp4gwoIJuKpopHpy10oK
-+					f/5s380ql82LvP4uTw== )
-+			300	RRSIG	NSEC 10 5 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					mU1SJISNmam1aeKgThUF/ejRdU3Ltet3NgDy
-+					50W5MaqpPOSXrR7Ag42R3OziFaxjcbuY4MY6
-+					iOIuQQeXh/PcCORCP81+GWI62DxB5ga7hdcd
-+					k2zZHSp1FYgtAWoZ4SflxjOBTkFb79irVLpQ
-+					3a5Z5CyBZka8zZcFr1Y4EgsAvm/4JRB2616E
-+					GJgUbcWxZeL6XHlWHIz+bV3lwv4xctFcmBsh
-+					SsGvtn/2av1Sq0Bl+PlbvAYrPhm/2sY8Rtbj
-+					5JWCI2Shbr2QUFbp6GlSBbS3oOkeLFz+0L2j
-+					dY/CnmRpUHagML3xdd0nhHlMwClFkEEFo5Bm
-+					hXIQvYzFz6SpJhaoGw== )
-+			300	TLSA	0 0 1 (
-+					D2ABDE240D7CD3EE6B4B28C54DF034B97983
-+					A1D16E8A410E4561CB106618E971 )
-+			300	RRSIG	TLSA 5 5 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					m9FBBhkcIdh9DYhNur12tjTfoz5Qtvq11Kwl
-+					oYPz8TiUK9P4wqGa3Ufhf/z5ciaASeMueQaR
-+					8nrGI0y7WD94mHm9Jg2u5BtuZ1z0hJOUuTRk
-+					vETishONzRxv8K9N2W3Jv1ygLMwC7Di1o9D8
-+					S0qxYrzkTHmu8bLJj8oPD04+DIQ= )
-+			300	RRSIG	TLSA 5 5 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					wVp5u5xaoOntqexU/0tiNrAvPD0KxN5Lq1RG
-+					7PkpEMFgR4uf91jgneoIBiUVpTE4agwTO//q
-+					0Qt1JAnTwPAo2GrHcTDut3ZkvIbK6SQERC5b
-+					c+9l1IR6Lt7PBtDW9NqcSiVTh9SzU3plGEtu
-+					KqhAPUzIIAm+kKEDpoOI1JTGsTdJwId0ttSi
-+					Qt4QA6OFkYfdjWxm4qSsregIrTdhNuDtHTA+
-+					dk9XOmlHlCtlpUnxkTE2uqUors2tk811xkWb
-+					aGM+VhFATKRBgNiUt43LkwgCH/Gfordas1fK
-+					UsEXIZzAwp7Z3AdY/4PdhO3OAA8uojqHqTp2
-+					QO0xKJ7UnHueEnXR9g== )
-+			300	RRSIG	TLSA 8 5 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					C6Y2zTg8SKAQBlW5bqGel+4LbcgHjitoxtH1
-+					gUv5h07NWCuS97gKv7H0jtQu9vyKE0szSMkZ
-+					88tHvFfpVOMfsWxkMiRATJaNP0j4bqlhW5z+
-+					48hSfMa0X1jljYVhtxEsXrDqTEUhIv8kZuvM
-+					0IpsMDwSWljCFSmf0rspXeCcnpPPJL64I3IX
-+					j/EZ52MsBoN3ifSTqodpMxs57xtGfi0lGDJP
-+					yvWq2/9Z8BFmzDxvVEPZLvYUCl8w6FbELhgN
-+					QD7fpKqM6TmI2xXmsQaEefvl4um5Va+t+e+U
-+					mW5T6A+GNYRCNyk4VhBV9bKKPukInMJNolPJ
-+					qMbgJ6Gc56V7l3tf5A== )
-+			300	RRSIG	TLSA 10 5 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					EC8RLTAf2ga+FZQVmKQmN7gJxHYFXwQ3FUIQ
-+					fGYQEiF5O7Nwpl5WPmT4062SEw66EW0mw0Rc
-+					Jpq9fXaA2uyf0gWpiuwAlKiLNo/PJNor43Xg
-+					JyIO+XqDIpzW0SQGe6sTmCuNciQvwdORR/yA
-+					iipYsQW402lR1w8mNF+9MzCJa4w9dHuZQdN1
-+					3WvkatYKhplmXxOEdpZ5FlvV5NYEuJi29Mkr
-+					2J05Zr7HLGZErDerRjcQRtZ2Y5NgDTXsgC26
-+					HB9ODan7Zop0bErddBqXAyTU1p6iS7Mm3eWa
-+					5GwVrB94jFBO502HIMIyZbUrVAq7K1PXMRlu
-+					/WzABsxYiy4rXER29Q== )
-+cert.example.sec.	300	IN CERT	URI 0 0 (
-+					V2Ugc2hhbGwgbmVlZCBhIG51bWJlciBvZiBt
-+					YXRoZW1hdGljYWwgaWRlYXMgYW5kIG5vdGF0
-+					aW9ucyBjb25jZXJuaW5nIGZ1bmN0aW9ucyBp
-+					biBnZW5lcmFsLg== )
-+			300	RRSIG	CERT 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					RsaoHrajGSkKePvJDvBsaLjVCJO5Mk2VsTZA
-+					XfNAWUSi7703MqkMlO13RWdQdEmCx56NxG1x
-+					qiS2arILR0fPMo1emt5J0CnZV2FrRk7kbXYG
-+					0kDPmhddvIlvTvF4H2WVd1Nysu2SPH5Ve34F
-+					luIsEWYv2B/XmCqY8QFLJXutqNw= )
-+			300	RRSIG	CERT 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					dEOANGqMChlT1sRhgajcl5XbWFT+cPJbITHa
-+					V4ekQxaKRT5/PZOQCYtSX5iOF6lorg95bkQb
-+					ztIV1IUckp62dBljoQ8123vhZOpSgClDXZqm
-+					YsVinJUx3qKO+XvTEGH+vf/b54f8aywQL3Pv
-+					ojw10OHBm9b2vDfww/lZRvtB+RygnoGz1prX
-+					jt3AKnKhST77NZktFg77aWbbO/WtuWLsxgZf
-+					pckBqB12GSES2r6+6JVST6DE4dTOarCeL14z
-+					Z/eygkwFOvXBSG8RzakMIDM4JRUrWC5XQvoF
-+					WVmZ1CQM4TGKJylgc6UosC+/kEGyYIZeuLd0
-+					iTGYakdsLw++k2XC1g== )
-+			300	RRSIG	CERT 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					ifn21DSpcORCBrZPARt8sL++XfPYx74Ay4Cw
-+					nWqm2tARJex/oE6Frm3iR0BZ0EYvhVjOjP+/
-+					IGlA8LXn95iad5/lk6fY20YA3MVfovN8qt6w
-+					uSbQDewWIVgfjR31NhPK96YFruTq3p/KwSCQ
-+					ekAobJfx9idiN8B0AdhzdvxLdboeABaUmpkm
-+					5e9cC3u3pP0fSAS4GV0ibfSAUNnoMvrTXfmB
-+					Bf5nrzx4Weq+AVEa1yltF6UK/P1VWnGAG/Jf
-+					PcCYh/XFoTcZfGjso9BGln24vEpkrKd3kklx
-+					Hmgw0Ypn0SCM5yhaVRgX2UQtCYFD70BvWrdq
-+					p4PfYBm0TZfUnEbQjw== )
-+			300	RRSIG	CERT 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					IFwmeo5tNfQ95J8yoi4gpJJQJ+IUF9G4wjou
-+					Be4bQYLqP5Or2y3bDzIJ3rRjFxF5Wst5Ovyk
-+					zXwEBShFPuQjBXUDoKtCKICR9/pi3eK1FVff
-+					2xn40PXk8TrfV/xNA9Izfd2T2BmK0m2HBsSW
-+					y4SwyF1sQPPFZC3Z3LpR0yeP5Xo8xD/GUn5C
-+					FbncyR3ex7XYNpBytb25Eyy8+eImzM2D7ZZW
-+					tXucCN1timxMGP1A34zoa63fsT2y3XlD1Ax4
-+					14Vf/Leqmot3h5+85cLbrYbNRAj5SGn2MTO0
-+					dbnGpmbAQrTl5mXQRYXY1VEss+eLb2Wq6Jtb
-+					mF1MJKJHgLzEYI0GBg== )
-+			300	NSEC	c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com.example.sec. CERT RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					YTeprqPKiHtg/ynH/YEPVYktL2Ca2/ZErO41
-+					NVUSnK74tUFC6X9CYdnslXOewT9HLmDthr2E
-+					7jBUlu9XdJKbXuoRdx7WDbuGl/Nxcjh3EIDK
-+					Qi+sVxLE94YQH7gAeYSj0t/HneLhwoRdPf+t
-+					pf7O3SHbb7FuBj+cRjCQZMpHWXs= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					qUEKyNbyf5rnPyUEYv5RU9Piglqs3cdkz/yc
-+					by3B+W+bvPa/bUMHXnQE5uaSmQ4eSIhBcDQW
-+					z+/TKR7zBOIb/wda1wzjjlI3tL2O65UE5s67
-+					fAJrDByQ0zEreXM2RiP8eIdYnea3TENoMrUQ
-+					c/j+Wj1+nEsbesBbfEXVeE730HXMqqCZPRHT
-+					Y8XooxSqBlvY6J/RSS7c/sLYBAc6iHNxni34
-+					y5vj5D/mV+yd9hkZiPe5SHuYwsz9wjhbOY84
-+					ndtakY7DfG3txgI9W47+HA4qWZESGm4bvdnF
-+					OKYZudwMBP2KS74clPqjPoradLRR3EOf7SLH
-+					Y/tgBy62TMYXaNDd/A== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					rwPUoJ+kph5rb8FseqpipqwywBvfyfEGT7JA
-+					FMAF5R4tWePjo8O+6b8WPydJv0eck5JYkPX3
-+					DwJcGBbKiFi8OYt/mdBpxrzhyK2RafMPP0Da
-+					t/swWv1NplkpCztJVjHb2aNAITdofe++Hm11
-+					NHJE20g4wb47rIzOAaf0fPwb2dsEJhGWGy4W
-+					Kb5mpimb26JaKUUy6mmcwfLGo9eLJc5PHA73
-+					iQ3cQ/t5/ffQhIXgS+GvgkSF4NKGCuXfoCf8
-+					4h+brT3IUv8RRQnWrldFEj8n4a309/nomaMg
-+					iZNx3UAebt8DUHl3URtXh/eQ69+enMDIniUs
-+					bn+t9OXBFl8WOWc5TA== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					acAM4O4hfy0zz348eNtTs/eb/Pjq+loT7iZM
-+					XgyRz0dugP8VRSz4vQmHGYY3JvAvpfGQN3GX
-+					aAPDc+Gz0bwM53+4QmOfei4OczpZoi8dSID+
-+					fIBS5TnntB0PpCF72pSMR4yyA9D3QY8PFUXg
-+					d6rPTE4DGYw5w1vTIZBJjW/wMbF7MsVG+7Wu
-+					NGLMFqkX4OSXgeubuWipyL6QkSjMseld3dKM
-+					1IQWDgJeBBhPKOsf1IE/7jVl26/6zISGOOM0
-+					2u8g+DbnmF1uvUXdbmsrCviCary1KJ8h0G6P
-+					8Lh199dYNDdXZat/Vh6xyYgqsov7scSK0yCO
-+					P1FRAWUtLq5SEJls1g== )
-+ns2.example.sec.	300	IN A	5.6.7.8
-+			300	RRSIG	A 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					oSyWhdoAFyep3WDMhrXyH0m8rvVrdmE9hn60
-+					tbC1Jo860HcyrnCzIx8KqC0HsmTmlZmTuhOh
-+					ATOMeUREaloT8ShrhMNJKzgxLJ2FY1kCRS/i
-+					CfwFteHCEXCJ198rExdW4yFVQT94IiyFKoXf
-+					FYe2Zc8yZFHoIBwhklXBJuiYur8= )
-+			300	RRSIG	A 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					20kC0SNVgkIOAfd8S0EBlezuw+Lye/EAX7QB
-+					0G7WPlJXOlDnMxqvTsyjaoETbxLSqo2lZ5zV
-+					Tz92cULBzIra7F61eXnaaB9jVDk51crpOV2P
-+					rU01sYrYpQlPqoC6gXa+o814lglX5ez3nvT+
-+					IzIISSU44yhUIyqSCCVzR5wC69A7QrBzumsf
-+					ZI6YvYjqB/s79nPsqzOqxvtpg7GWRYb1OE1m
-+					cd9zRQPi9+uVrTDF5WLI/UAA5NzPuY8U20L1
-+					/K08/uqKP3K5rdGRgos8hwmXBmSxwnBSS96I
-+					NJaCeIGf96b4cvYDyZ2HQmtS8c1U1iUhPk1d
-+					S5+S5TDnLGwL/XCOYA== )
-+			300	RRSIG	A 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					m9Uk+u+ZJZzPph6KNf5vnyfNWrIByvwQRPg4
-+					Qs8veUo7XDiQUxhbZ0282eprW0TVVFtD1q9i
-+					QTC68cjnsqHCTKd9+QingWdBr0RwuHSxiPpX
-+					8Zbv4LXnskjEbND15gDJ0GRy9W8UgtWoUyuF
-+					3MSK/PCxFuWVftNGnGWCl4iuDZM+Q9C/o8hQ
-+					YI8YK18zgqlOaqSKPqzMiOK1Yobv6direlf0
-+					iYSlWFBHUkm6sgeTihwSPCrLrjVwGqR4Ux3m
-+					4bs+SSy1xIOS2nrGNiu809Lhg9arAzkKg9FB
-+					DusYCJHQ5VyP1kGcpWbQNpT7ur1D52rtNO6C
-+					PudRbNk47qsanIbRcw== )
-+			300	RRSIG	A 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					Z/yfD2G/sWFbFsDqZC20BIoKSjniE89aiSKl
-+					n/hqmwzzx1GgoK/uTDs9LlIdp7zESPifZ5n4
-+					t03pvFxMQgPw5bG5eklQ4Zf/am84DKmIZixz
-+					xaUP+SAMjB0IhdpCRBSnC55knBdHlsMC5ryA
-+					SdBHOcZ5Df6iX57cpon24fXkI8fqWQ7m1MLR
-+					sYXEXs88mFAElh/ARcGIm93T9vwUnk04cxrw
-+					QodpUam47Pjp7C7GY1XExtSSdW+h8KijJarR
-+					tiYYE1dkOPdT0OjzBybRjbuhjaCa7CPPzGm9
-+					tNMph25m6D3Zv9Eay0cvJHYWnbwOZDxO8w9r
-+					QpkYgVpLnMvYRQ4iow== )
-+			300	NSEC	public.example.sec. A RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					QBDT5kIi+hdEXsZ7b7y/ovk5lGRpKiYStdeK
-+					9sKrQvNCC1MLhG8DiT+ssX/66jQEEwZWOBsG
-+					R9f+pkm/Y7jImE2KqXfcI2XTaZvmh7bU1wKF
-+					17PpytMMqj7bvmomvTJwaIZvyzBX7x65Vm0j
-+					B3M1dfQc8AsXruIGlPMyNDJwExM= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					T5wLuqX6ohtXSEIXifG4Yui0TTkNXRkDnaIV
-+					9yJrRjFk/GqgYhWzwj0e89yAup9eZNKoftVA
-+					bdXOCtEhPHL9lPVK2b5NsQ3+E/TSKvjgxbyy
-+					OWAZRkucKKJeQWhzPBbTach3bkEvaWC8fSCH
-+					K3X4/R0GFQ39qY6bgxIH1KtamqypTp77EkE/
-+					B736JUPhGRX96kgEu+bumR0Z5Nqi5m24pg/5
-+					6k+8OL0o4k+SFMP8va1+lryqtpG7eInWRPQ7
-+					F4X8DNAoqttpsmf5v6tOpkpgoB+0gt4tNTaw
-+					6DQDRX0YCCnCBZEVNQbs04qC8Ij1MhyJSPqO
-+					ZOyNSBBNJzdYebkrUw== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					IMXgJDl9M8F6xgSzzFU1GxSpjz6sJ39xRYDj
-+					M9ZRXqmIGtZUbVLYiuGksy9oMX3+mXkRdgGc
-+					COys/CFeVeJ0slUfT1L3I1ZEpCqi0GpPtcNh
-+					muGdvVN0msrbVG3Mfz98vSMg08BJb7r1plPA
-+					D0X1bcO+3NGwx09zHGmrZSlhyGfH+rui4nCK
-+					U6PAlXNHlany8yfzp/t0IWFS/Ryl2Y6nPxiZ
-+					/opY3TJKSIRoXTFgLkxNdiIpyAd8zsbuzq+o
-+					hQ0/joZ8cc6Yrs5zpxksSRvdsKAlqj+BWEvC
-+					8zGYKygQcv73OmOizw8SSZH1Nhs9Bdv+DNra
-+					ka7jzpkOZeE0bA1Jfw== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					HpKVsDx5dLGlLQEKBKAoMrjHhmjccYQepTsK
-+					CDILuW8b/Zpx5wajf95xlcutNHp/nuntr5Eq
-+					U4ou8jqCmhV6qPXnMnPDoQsmEN7S/Gmwe9oh
-+					X6JdmUOX1UimNalp8BycyBwbc9qhCJyadv+d
-+					sKds15udRnbqBDmmPGur51k/1k3cSCMAKzqu
-+					I3QytXqThwqRlWlOWb032LfnVYNEz5Abwck1
-+					XeX5LVc54JBKF1R22yofR9YnDAVBHbVjYt0V
-+					ZHtWBtqUTlY5W0ehffEHOBf8r+N4aCA7LfmC
-+					BQj8tG0xx1zFMPxRvlQh/bC1uRtuH1lChoK1
-+					/ugjjkqZdXRLE9h31g== )
-+sec-02.example.sec.	300	IN IPSECKEY ( 10 0 2 .
- 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
- 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
- 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
-@@ -2063,332 +3001,94 @@
- 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
- 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
- 					zZP5Vd2t )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					l5GfjmKbBuz+kN5Zt6vXuI79OxxgUqd+CKMg
--					HjuzrizNLaLgaI4zV/986SrnxiNn1Q7f6b/v
--					IHKTfJCt0Cz7oZrz6e1feeAFeZJLDF4AWmhY
--					nJmnAouu2bWXpRvGvEC20Jk8to3DaPKb+yvM
--					pCXt1Pv8xZDIJEmUDx/aNpJGJNE= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					yY6veWwWxEb5X1w0LSomZjGKsGegq3jpuAvy
--					FNl29cLzk3O6FKCEQ61vb8st4661tCuFeYkw
--					Llx8VN34VHVHZnE8Bf3AXURjJPAw1exTWM66
--					fd9/htwG2TcaTDp2Jb05HSkmI1fQwKsUpYwH
--					cXDGmVe0ClD4oOJ4OsTnUMsP/DjvP+p8fb/b
--					jFlpUxMUBzybbmSsfog1H0J63l5jL266sB+b
--					8eCofztUfcX9omPZycT1p6qJ/ZaLYe0GnWeL
--					JeMVHLVkP+iwIge5LcfNIZMXeeEtZ3YrnSAf
--					WxKdWNh88OLO7vC9XTgnxDXRKyxPXSH4BwmR
--					Rb1IsKIqtFvDli76Ug== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					yfAMmCbwB2JXh6PAjJxPIWVloV90O4VaJTiy
--					DeVrY7QAI4iTHFFxPlPD0L//UY1Xf86X+ZT2
--					lD3X15tlOEbyZ72OhA/+miQNd3rHxVAip37q
--					Hrkrmi6CtDNRHbxdExjE+NUNTUZH+zn7B/Za
--					kZP+iT/eeV9lhbaExwk6+ACCxD8w1Achdo92
--					tLzH6cA6dVzFPKu0+IeD40gN4d8t2ghJgjJS
--					D0g4xHhYmzwtHA6m5TJHJ2e4P4YuIgp/DCKK
--					FARapMyEjBUQxS8q8Mn7D+ezGjnA6y07rmLx
--					Ov2WoqgdmdI/Xbhpo/U0SrL0lghXARe6PucV
--					cq5x9fCOuT8lSsc9Kw== )
--			300	NSEC	sec-mixed-32.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					l0YvQfuMnpBx9CSQd50J/SFIky8BoS/Xpl9a
--					dCV8GF79Etl6S4/fY7k2VCr2CqB0bR3+Qj02
--					BtTJCqHMrPUjZHL4ug1AUOfPLlsWoE5k0NDm
--					TJi6Fb8f0kPcdpLOSA8ig60b+zMVsyp2GK9i
--					d3d/imAL1SUWNkob2B0g3CoIRM4= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					RnNJWYZ4RSDCxNkn2HgcT3/rIjaZZ/2ZkKRp
--					6tX+ZeWxqk+sRaCvL/mgM8eFCTifi053609l
--					c6OASaUGfcJJwF5amQoU4icYOZV7UJdnz83Y
--					ZVEnUD0ndY2Ix++UOeRCjk2I8H5GfhkL+Kaa
--					Acf7Eg1CXN6PthcSDb2S1ver2QlOm0yuM6A6
--					kJ4CMMWoEtjRAigUGldTQG5Y3ZLoDjhbSQ3v
--					T3e7nncVkLib7NdTHmkpA8uiV9WIIC7fchpA
--					KjIkNC2OHFQaF7f1EbyzbLQ0oJuXEYwcANWX
--					WP9b+nkXhlIXmVEtpHMtoM+L5enYwfqNs8WC
--					NfzISWHmX+GO966T6w== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					wLPBkQlHUAzWgeLiU0w2fe4eCJBJOU32KCPN
--					+7Dnvv6ulBgcuABIZPNg3QSB/RoMt8RqIOSF
--					DOJ4sWB9Q632AXVLQ0zjfWRxj9oNvlFtKI02
--					n0zK3t7azjjAYNDiB2nHwT5HPaBrOnT8Ucel
--					whayIs6iArpERLbk3IuLgux0VRjIfiC8eYG9
--					CyYQZL/lPtaJOe8bmXpoJTPGj/jJLFDwSIU9
--					pID+nedbWSkS0O8fVYHLj8evvNLQqAGhXJLI
--					UKrlGw+siO6VrNp4iFo3k84XJm0ZBDon6Nbf
--					8q/6wN4xrJmZkRH6Ljvn4HVAamFUXvG62apQ
--					EV3rjNRYeQNSbWa0gg== )
--sec-30.example.sec.	300	IN IPSECKEY ( 10 3 0 some.name. )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					rAqWyT3TmNObsQxO0Q2FnG3ZlGAwYkZRCYMv
--					EYuVBhlaaYA7ZDD4RprckK43l/MGPcJkT5h9
--					U4vtJQXnNztWRMpH4Z8jb2LOU1tZzsBiHNjs
--					mQcYlCGmBRXAZ5yi8DsXZTXsjo3iSKUxYNQF
--					GoxS17+zY7P2GrGdVxDZz3K6kXw= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					AfB4UY/rL+H/dMztnW9/Ajhv7e0DTQ+f6hAk
--					PiA0CphU2yQL1Lv6R3X4p4iKWz9CDs/sa37C
--					QlEAoBiUGMqVpHO8vKHREcfn7v8RJCtvzhOz
--					ZmuMiqWsCOhVkS/EJJtxIAyeYVeD2fABWwV3
--					DfmG1sAslzN1SrGj9DY2LiZch3FbyXJRzvTt
--					s5wO/8lnGSj4ws5DaiNMWKt5vvkZneU2otiw
--					9EXGBJGIAyUpGblzvlsasMQ8j6ixrXiva/yX
--					4KSUCa5fNWJfgYllNIzTaEBZkXwcdUYbWvJe
--					bA0ZN6J8ObsnHd2hBLDV2QBl+tV63J4d4EP5
--					tMw/XynRxYFKW1cMRg== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					tMBxGjqgyirIdIZidMt74conTmA1ZmTDZKKP
--					9m5HxBTOG3+oMHsi4KOETVUujTlRFMQruL01
--					Ii4enuob2MJuZQ8Uw7I0q100KaZzBzcAdSaK
--					IIcNWGEThNw5fE9VTOMLMnVxJoJZFwlpDnZP
--					MF26aP+apom2VLMx6t0TYpKAkKYjln+TW0Xb
--					TaKf5lTW9CnOEVLEa9YOUojGFt5HWyz4X0cc
--					LrjH5f1OV3H/TCIpNENr7u+iMBUqt0gfF8l/
--					V3Xa8sm+R4YDII8Zkmj4rIbPzAKmqO5uDFMx
--					shYjiTxued2fAw2a+4dqWMgCbOm1utqEDE2Q
--					dp70f7dYLTy4scQy9g== )
--			300	NSEC	sec-31.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					IM5xqIiOsST2LlMPAdvfmwhXiM4xBsVEOMnK
--					z7W6bYj/R22EzvC1P87j1RlleeHX/rzd1jvR
--					FaDTOWu3vbRO+Z4tfY/TGZOJaocIVqidsPsO
--					M2yWDhRdWhhgq49D0RlfHeSQb7VCIM+Sao0R
--					tQcOqb0HoXsCd1JXdaVmLL7MRG8= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					r+pgljSgBNKaECIwN+MfiquQ557TXPfsYxUA
--					1efqX2cbAlYTFVZPuPsTXSb1frWtdCHzCUeh
--					QhU0oJlDqmgT4nvPyXBnpmvgM691TnZz8Zmw
--					qZP/kE/m4bjgs3KwKXlUsDcW7iTmI2XPfZmX
--					f7BxuBrvV87DS2x4YbHhfshXhLiDdV5od/nC
--					aNLHrbQlYKaV9uWMcdggcMuaGxHn6Q6VgFMX
--					IAXhA6Bl7jnogVjtbE4rCE/E2OaPNoxJMIJ2
--					TnNEvroZxtW8ctZURG9Q8H4riIfaqerPb6hg
--					x9wFi/eujNlQpE/L1RF+EMmyRn38mlm4W1z0
--					10kjKRjbQOWUphDG4Q== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					lFP+AFHKPP4KOaZXDM6yiQp/OYodqhojrTkA
--					ZBdLSGoAZQAGMbb3uzcQUQwFuua9mBPANnsw
--					kHYeyKa67i8CXiVfWFN1bGQ7KCxcCJrRYm5o
--					ePKAf2zoI8aoTtnjROS6CpG6lS2XK7zuc/FB
--					7oBiAG/QPl1gyAWwvk2kRTjxpVoDwyAQnSqe
--					hVxQtdOt7ahOmW+xl9xUQcrLURbv0lanjjyO
--					L0PCnr/LbWi5q7a0VO27QgvOReGJCzm8sCdb
--					3aZOIz8c6rpahqy9WR/u3mA2WkN9OxMsrxHi
--					oETHOaKPzg0ZojW68LAoh2YxSjWaiw6P41RQ
--					5qL9Hh4i9iU5rUrLag== )
--www.example.sec.	300	IN CNAME example.sec.
--			300	RRSIG	CNAME 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					M4e9BUzl1pzv5jJ7jrIxpIgU6UhUnyFJOGs7
--					5LNW93WKd4Edqh5eeStwAdpKzLUN7eVQaYcD
--					+wCaQ7MfazDqC8TaVGRRVGmhmsZkBpZXgQ7I
--					2eETGSY57rMqQqmDYs1dYHIi0AVDDA0/yhFj
--					BlaXl0aqceouM61vU2ovtYI3EIA= )
--			300	RRSIG	CNAME 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					cLYw1vhsQYUI6NSqvwTT8s2CV3atwm/rhekg
--					nUc1MVFZFYGYrxgPT2KAZ0LHg9onbays2kZL
--					wrn2X5VW94eOwhDaA4Kd2wpO0hbuKSbLWn+D
--					HxUtAjdLDjQyXH0s1nfjYSMrjY6BeQWsOIWi
--					2Jt6SCEEt3oZhDWmNflKk30wejR/03eRAdqn
--					BE3X7eZPw6koEKQQV+djGv5dK5d6D9ywcAnA
--					tdiE1cCQt1n8daOuVNB8G2ab3NrlPGQ+yzHF
--					8rdLiNS4OCiopSrk4x5m3mQykzJcExbR3Gb9
--					VSP5wEWkl+GP9a6eEcY6AHWb0ZAL6bnyvUFS
--					XbIX82ewQvjLzbahbw== )
--			300	RRSIG	CNAME 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					U84nYJ9iha0zulQtgH79h4BZy4vRQL57Y13P
--					e+yGYb29AAwJTR3euJWwtKtWRxyXbssyGiBM
--					KaLEEjd29VXLai2ZnWPVDJ48TWHMORj8G4uJ
--					Li0oEZMuBBhIUgYXXEZTQ+u9hw46hiIGGzhF
--					A3QEDOfxXPzi5gqgVtULXbTaaxRptHoSToX+
--					6eANmce7lN5O/bjGWANG2ngf2qbhOBAjFVSW
--					UjFQJyZOME9/VVfqoLXmlvP7sBWSwJCIdVkl
--					CkrYUgcLYT6gF3Ym1FgHqVnYOiNHL24PeI09
--					1kg+SOG5gU24RIBWG14zSpuztU1XCSsje/D3
--					OW1jEQO9VvTQ79pK/w== )
--			300	NSEC	_443._tcp.www.example.sec. CNAME RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					SFkcGKNRIqjuOPIyR7rPoEmNj/1FmJ1KISfL
--					zFVnW4zFsGMRAimqX7H3WhVj3JRqtglEA2M8
--					4RCU2gr2Moqk29Ef0Ab/t8lxCocR0VTtd/ui
--					5f6ZPCoNls/cVc0F2shAFy9uACtg/vOQ0JOQ
--					7pL3DVLCBEeFwaUwohlgMEdyg7c= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					uCFXDUkjfk1oFOep8G8zz3Gzcy9ERqRH8Y59
--					syns+HIL3BvcTE1/Ay53hojkljKeQljnvIZQ
--					dzluDtJEj+BlMNjWgfem08VSHQ54eaGEWZvT
--					yFSAPp0SuXbXPeDrIxNzg0kjAKinkVv9rWef
--					p6WEukS6exUJfWkIcFhYI8/tFT+YQUxxQE6s
--					7xi0IPOldV2re3pJnH0xsptQlTaVZzeVgbCB
--					j+hbATX4vv6arYcRbJf5RMmpqU6Hx439VQyg
--					i7bxwElezV07BmHPG4D5wcKW80NYnONQRfBU
--					xVCx4bmeE5aLnTJB4PitOVH/t+FCrCywboMC
--					FkcNbOeM0uBvx9xePg== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					eclin/1XUGbVezE0CIM3sNn2pESSAonyfnyi
--					EosJopPabPNoucHsW1mXa391ErLx5ua7nxL6
--					2cLdZwxCamGiBWxj9p3ulM9tweJ+BRkEQTNu
--					YjwkphZlCo278m2ZSbVz3wA456AUNyid6tqc
--					jzXUG7xkKcLIqNGJGuPR3Gc+M1ouLZ/6MsNn
--					2VnbsRJg+bqFrccd3F0TUul02td5OBI4FlMn
--					xB77ltqZo3mkIUgwskgoTrNRb0otJoxlYGVq
--					8V1qO0g9Gi4LCzanK+s8CYaE+ImIOV4oJz7G
--					UXS0LAuqIEJJNRWdpeLvRMipYNLzAppAZN4j
--					IaCXa9pE7/iStJGRjw== )
--_8443._tcp.www.example.sec. 300	IN NSEC	example.sec. RRSIG NSEC TLSA
--			300	RRSIG	NSEC 5 5 300 20141212121212 (
--					20121010101010 516 example.sec.
--					rT7/LuOh9UQtWIl1QJ5d/Qcy/YJH+kFRI2rF
--					nEII1DR3yEuAuz/IQBwAbN/Q9RUXdt98Zza0
--					KobvN8o3QVPUkXouJiS5D0GJbmnhU9YUvJoP
--					gxU/ONagplm4eLB8Ehqn0U2z3sOPFuf9nrKH
--					MnadGiVdYMSeqwM8IzWDhluk0GA= )
--			300	RRSIG	NSEC 5 5 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					vZ9JMfyjj1tPn8z1y+87J93N5ZfJIxl2ULyl
--					huGe3agDcbcvCoqW1G3g5j1Rpno2WYF8O40w
--					KVySTltRQtf7EuiEVsvYw2NqgfUaYXbv+xLx
--					wQ3XX0iqBQslY/5GmptTTqKoYyQ0ooWseN1u
--					prLpoNucpKu0k+muBU9tRk6v0NGU/FZz4lwp
--					ozQNVakLHeZlXQZvyZWerg63/dxhmJgaTMeX
--					TGorae+9X8DSEvLxk/CWbEaFHWXlLyPYnat0
--					njeN5leMB15JJfA4Hfa6IrMuRyVkO4GPL8CX
--					DB7YcwELt3A8PCGds6FT6l2Oe8GIcdb4qRQa
--					4aSgi6kwgAXvnHPnZA== )
--			300	RRSIG	NSEC 8 5 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					aeVnnhP5UQu0xtDzs0uq/2kcvsAo2lXiBsqV
--					4dAmwnsdTQFkWQxa1JyqZar6AxRpPEJOTSOB
--					rmuOApn9YbsTbfHhG1/Seh+kKyJdoEQT/oiZ
--					xb6x1tZPPtoyzD5cjIlEVK/mp6e+C8l5sXIi
--					EnonJxeKmtPpC6L+V3wFpTnpNG0OQ8dmcwZF
--					mm/8yKZoT2P3fTmwgQ7IIO3hJ2hmAJJh88aj
--					IxORQd3UK3A1lPcXLXBFKmi2hPCWPLR2oTF5
--					zG0sc5yGmqDtAA8Y9U5Gjfh88fbdiQu0ZGLz
--					MtyaK9PrwLJUoY3+KX8YXQC1WrYOjmYZYgGI
--					LEgtHHbWKUZuzdAihw== )
--			300	TLSA	1 1 2 (
--					92003BA34942DC74152E2F2C408D29ECA5A5
--					20E7F2E06BB944F4DCA346BAF63C1B177615
--					D466F6C4B71C216A50292BD58C9EBDD2F74E
--					38FE51FFD48C43326CBC )
--			300	RRSIG	TLSA 5 5 300 20141212121212 (
--					20121010101010 516 example.sec.
--					a6fW+/Hv5PA5jluWFZTSn66JYhM/cKlfWcrB
--					ZtSqAVvqYrMxbARcqMkVkQN8W0eFiZ+6Pqpz
--					cm2jpDLPn9MafMBsM3rc0VxhHPssxghDXAO6
--					eYcyf6HOkw5tNimo7GNXfxsVy0W69994+m6z
--					wWKMTm4gLS8ABjpndjxQpPDSkdM= )
--			300	RRSIG	TLSA 5 5 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					CqUhSqFjikCArbLTOacgjB+RK9d1p20eu7ni
--					kiQx/P0evcYvvLwePeMJZntWcaDx+slpqf1G
--					YoCpNGfV1T61JALjrwyjz10hdEmFNQJ3H7yf
--					Xp29pkK7AqUaDDhk9gvZ7vGyaYUOhLUcdb6O
--					zr4ZFn/T2W1vN9Qj+KklxGTJg9jIIdxeUJOo
--					lAx6UiKE4xDD0bS8sQqG4Ec8+P07/oKyjZR4
--					Wemsrh0TzysiOWW8l944GX3oNQVHA0Cl1RaN
--					HWDp/OhMY9+dsPVtP0kQ3tivyFV/ZgDJGyQi
--					nZWgeLtDhdUo6fHDTWTgz4tOtNnhPC0GgLwB
--					S1IOHv28cPRkn4Mc9A== )
--			300	RRSIG	TLSA 8 5 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					OJTlC1aiTM9UwKHbSFe3q3a1oYdRRMW10lT8
--					gD4boY8aP2dgWDtaMG3khRjSmSessmvHGw7x
--					wUnOnk0M3sY4HnXwK3mioWRNdyPC8jYuZJJ5
--					w9QBEDVvpXwYISm1hi+WD+Q62VeEQ+9Du0uB
--					qKSQKiFi5FE51mYNKmnjQUkoJ25aZ8ykGjk9
--					LStfwcxX/uE1oYpsW1eo73ry2YSxAcUQNMli
--					3BiKHnWV9uLz7Z+YBlSkBylQposQfKCVVv9W
--					Ipq3wyL67dGXRNJ/zdOFVT4FYX5k6Aw8QOkl
--					QLhF1yPx+fVsuM1Ae7Cmq2Bjkr+JAVvRVSBE
--					sxWTVdJmkaTv2lK3Jg== )
--_443._tcp.www.example.sec. 300	IN NSEC	_8443._tcp.www.example.sec. RRSIG NSEC TLSA
--			300	RRSIG	NSEC 5 5 300 20141212121212 (
--					20121010101010 516 example.sec.
--					oKnCz9oWOO9OcUxeeOOPe1pxPnLVRq8k4UKz
--					M5utgsqU687xWJBRtzRwDz4agyT1TPtDMdvm
--					Df2v1pXvx8GgdDYTJZmZTv3lDJ9Nbwrr80AO
--					lGQZgajAbKrMUiwoE9kI5vkPogx/Pnh2JAgu
--					q8hpapOMtMdKdidkshH7RlW2lDY= )
--			300	RRSIG	NSEC 5 5 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					kNbqHCDsVwRs+7jMZ9Q5XwbeDr9xmEg5VZxU
--					9NViIHZHqVd/JJQGCwWGkY5jcToQuLTJ06js
--					2nBsPzzAWNDJGv3HU8Zp4ktYu9HZ0OooE4Fa
--					zN3j1uuqqHqPQGzb8neeKzEcqbV8m3KIWtBI
--					viSSQuoXK/c2zERyed56rGJb2J+TCKIlMa82
--					ZLJpzVVrBFPWuKVtpG2lN6ffs5/HqE4+7JiI
--					UmEhqukUPMeXFcYoXDFx95VyzuIUf3mvhLDN
--					5iXsYTrbcXEN1rybnrfO6esraV983hxvx65S
--					TuEiC+4us9O73NzQQGQVg/FnziSBIPayU5eB
--					9Qj010JsT8TuBImc4A== )
--			300	RRSIG	NSEC 8 5 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					sY1MZuqEvrzYlOCuw8GKrupB1W+E2djH+hYF
--					b8NWkS4deq21EEXNF6KM66npXaALn+e6Jt5p
--					DCTWdxmJzg1V7QXD3++zLREp5L8ICH5OUdgX
--					Xl5YNwxWYj94UcO64oATbLdJ1Y2OM9TMDRvO
--					pVa5OOAh58On24zJqm9BowvGGo13nJN1ibIV
--					lCQc4VThk32kYcn3o9/urzIF02iovp+UPb9e
--					1GYLuCiOgqYqq1te9UAHv965Dz7VKOSG3MuE
--					Ni1lZdOQnZ5LBe2VyVCq9+oV3Zw74S1hevWk
--					Fq8ixFLR+fc+mylEeIVbKEhpGfWvvJE93lk6
--					Vg9n5kpwhkeM1Edbzg== )
--			300	TLSA	0 0 1 (
--					D2ABDE240D7CD3EE6B4B28C54DF034B97983
--					A1D16E8A410E4561CB106618E971 )
--			300	RRSIG	TLSA 5 5 300 20141212121212 (
--					20121010101010 516 example.sec.
--					Q1nMaEHS/5pGGOmds2suU9kHpm5oInEQU29Z
--					JNZ20BWMq2hb1C7GMGJCmB/18IvnxTTCPzLV
--					m0T+9lQo7UPdmNatQlBRFLM1YjPw5KT8CP6m
--					4uWbSbVZWtGN+rx3gon8OFnTcgh667OBOkQg
--					kPBd0yTQY+rTjaMfTcP9EunJm8c= )
--			300	RRSIG	TLSA 5 5 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					d9kmVufd0Y+v0RQ2zAOffwc3kzfcHoh/ejYn
--					NobWJB+jrGM+VyG76BiTd862+Ij67kKOVYY2
--					w4ToTGDvRqCw4ZaGfRt6vcCnfrg9FlCOjwEZ
--					tpJsuf3BtzQXa1bSwJwNC5UBHiGhpD7LN7W0
--					G4YHussYcu4w2iFZTif0TvXN/gSYSDMliTHA
--					5759FTb+MfKb84Ccp/YSKKebHataTXQAYWd4
--					6dr3IeYfjVyqQg6VYEA2qHCIJfsRxN9gDR5K
--					oCzN1bDfatwSO5eV1KVuRgV/adHiPApxpfpR
--					8wPf1Z6Z3RnplVJdT/jnY3SVA/PLzsS8mfOF
--					BF37wLnLKc+Rp9qjbA== )
--			300	RRSIG	TLSA 8 5 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					FTCh6C5jbvXb67BRf3nJgL8iStbsNMe+It0K
--					2v0GKePaE5gzsrJToZpzWhytVA+OpgBdWkAP
--					IYWubejwoGXYp/EDU1FH3SAA3zV5N2W25lfn
--					XULsEWLAr7gCpdeamG6Zg10qOVnfWYB6iSaq
--					xisMO90+luZz61i0J0/wy6aVtraTrn7s+Kpo
--					KHuZdV9hWZzNl+1Uuw+hEzBiWxEQK+0VAh5X
--					3mMqD6f9LgfqaD2L9pmyZI3Un1UBFn6qbbfu
--					zl0Ff149O/9dfRHFrmtrNJBnHindLFh1sRMZ
--					yNXbUcoNrzwfQ/Q9Uzq/ZCGKntrWLB5mHWBx
--					bJj+v7003y9raae4vQ== )
--sec-22.example.sec.	300	IN IPSECKEY ( 10 2 2 2001:2010:1::22
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					KFMeLm5jSyJuu1dYPNjwtFd4Ojx8/o6Rf0BL
-+					P0dRMWwSjAs7ncbP3uMOUdTEnVko6EsjWTHT
-+					dakYr+D/RHiEgH7r95BidEHI5FXFD5tzCKNY
-+					3Jxo1eLw/TSHF5VPMty0/Q8QgwKs3B2lGiFV
-+					5EMy1Gy7sBki9ZTmkts1anW8tA8= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					rFbj5Kieh1vU2CxD/xy7bl/xOasrPpapBXsn
-+					mMijzocDzvrNbxfB0+sKUxdYGgW60oE0t3ds
-+					B8tud5HqfW0XuDeZ2WjpuamefUifeEpU6x8Q
-+					oO3Tecgg2NDSn9A1mlBrgfWybrkLNa5jWuW2
-+					wFKyzHTUOSzqnYsC9MHZz09OszWshcy8Rlds
-+					hKBnMaXRUOzerwtrRZ0zWpllMfQ104F9hTmS
-+					2O31UAUDzsv2TjQ5/Fj/15F1FBWGYMRjP0/W
-+					wdJ7h2d+Fv3XJTzYvH3V/qx3lpEEymfXGirP
-+					Jm9IZLMZiVXeqYKS0MIpbJ8SVp7lBW3rTYt5
-+					aCrivAZ9Gt/oGAVGgw== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					ble1OK51ZiXuHX3RfWNBpt5RbG5yM7wWbIu5
-+					yHe5oD56Fagowo+flqjQ/xQXZ/n8UG7Mbd9L
-+					0jq+gg4SETDl752pw3257a+AvZYtQw+e2iyC
-+					lKLQEofIMwrfJlqRXk/1HO176pqc+h7XDThQ
-+					4gH/RkH5MSWubmG9z6Zli/hM8ndIxebQ7Wgf
-+					3Gqe2+JVzaG1RBgrtxJ7DOmHWOI5+8WOIdTQ
-+					W7XHzjYOY5fqXCSs5Qkr8v6++KKgJgy8Emsr
-+					ttnKTP+yUL23M/UDMmYTM6MhetsyRF10rEUS
-+					CNCOfSYXyBvEeBxUsSWV01/LRcL8XP1fBt24
-+					YdfTDsfKtfUxYu04WQ== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					U9SWYQdm78OqWlARa9Js+gltOM39ndb12Fw2
-+					3OpXe3J4CKXypDVcJ21pPp/u3eH+ju1BKLOE
-+					53/UUUcwXFBmzpQBzfK1g2n6hF3CeHx6PX3i
-+					1Lq5YPDePqBz4XHRCllgOnB4fkISle0uhRlt
-+					MLALW+BAilqVs2JHsi7ooOR5RHbDEadUDJrB
-+					tMaIsqRUEkAtvRRB1VDBgyTiU5k4nrXdeSNY
-+					2rcXYkK7DsRh0mhBX5CYHQJyVKtqlqK7WFCF
-+					SqrMsWUeQlXkLCt7rhsHbsiP9hkEhm0t+Vnf
-+					LCGYQMp5N4TC/UewMq1XBmV7oj4/BdeSIz18
-+					E67MiHX8skvb+NBd/Q== )
-+			300	NSEC	sec-10.example.sec. IPSECKEY RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					WfrxxSuFA4fUfSkH7MPqYBLR5Gu0ciFsIaxc
-+					4RvwDP9RemntRt8q8KfAxpngjd+gDpsWFNpl
-+					HErdcb9Gim/x9jFyu3yb0cHu8/SAxL1HFZiZ
-+					RzG9geX9gQSEgzQVdsDwMxesd4m/5uTdxnm+
-+					hstyplQHPbWzS4hmw3jfBD6qTvQ= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					xtuCY84o2p7fEXud9TFbWA+idFgiKH7EfVZQ
-+					JbPxgxCr6K97EcCDaVz3h6p/buhGPzOkjZIy
-+					fOkwTD/DHpkcRow7ZzoYOHrFL3fPZTLAg98T
-+					E+NxlQkrZQqpfIh3eLM5tuSvJq5kgG4eOc7B
-+					8z0jDArk5CQ0+R+WTD2XhxdYvhBi6qy4SIzv
-+					M1ja6Vel4WoEysx7nzEju+SyVG1SYgx28amR
-+					Db2q+9HO8G6R2aqUmSMKef/Nn2Ci6nMWjgfb
-+					zxGwdMpwNLsSD8zOqni38rUpclrKLYZ6c2Hi
-+					0nED+xlwcZZ30XoWMSKlvuaBP56/s9B3LICY
-+					ev8Gv7693c/7s6YEVw== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					QIW+9Mz6a3qTOQ5q1XgSK++F0BM6LExejjzN
-+					AUsY1Nhdhak6fmk8eNs6OunhVP4JVnFgaREn
-+					jhzjYaQduSnj7kMCcjcu+2s07FjFhO8tUxYa
-+					Yk6gNFhjulbySURFna69mBAH8ZG+WZay1oUa
-+					uBdcJLD57WkuYhg0jZB4W4BCHU9gjzrQyyG5
-+					nu2CTz4v1efVgY1Dt8/fQHs+jMEipwiuZLdO
-+					Nz6bu/orwMfcPWY1HffxB8Nc0exMuDxsdzs4
-+					UiB1D/GTrUjZz0dfwtXqGv2672sDS2PC2d6w
-+					Rt1QVl0W7paa57JUy8t+eGL7c8INMybCUlw6
-+					FlG90wVdfSHTff+uWg== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					OtbnEwYt1s9dhM/rkAgWVl3WRPoNYUXJiRr2
-+					IGkTgZK+YABHNf3XX6Y49AB/S1SxAQQEJLme
-+					suFsUnxGgxbwC60sgKJP1247NRi5R3XpkY6a
-+					3azOYw7qCE2joQvRmf+nEqzWwd5iRRPQixAk
-+					oykADq/LLt+grsoNnNdkqybZvMLJoPY2ViIy
-+					2lJ9E8ArMMfD3dPf5tUR0TTIyBzrvUIi6cx1
-+					gW7gHdvC17aDNPYBMwZgG7umuv2u0CIRqvDo
-+					pHdl8WJKJC8xtRCrVjptVmCPeYnx1e2rYfW8
-+					z5T2AqtX3P7+RxB6+si+r4f4/L1zH7JJDp+h
-+					aqh3e0PJOUmxXtoPHQ== )
-+sec-21.example.sec.	300	IN IPSECKEY ( 10 2 1 2001:2010:1::21
- 					AQO/C76MVA5WN743YYeE537SLNffRZvQ9yxo
- 					QqJP943gqs4QATtnJWHQ1SDWiRE2aXl7SJoy
- 					JAu7jaUTGKWXzStD2wpkBIJ1IZ+avxf8zxRt
-@@ -2400,130 +3100,543 @@
- 					br2pQnZ5ul5NCgkhhcr26IPPiZm2eww6ougs
- 					ogj6kPdSSQYZYayHzVnl8NFQ9uCwbRTryepP
- 					zZP5Vd2t )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					LVpb6IWrv/fkkbRP+/U/4i3za41GlD4BKBgc
--					U8Q272YAusl5Kq0qvRoOvjFqRwbz0BVgtdj2
--					C+BkaKiPs75iw8+pGct96WQHHPCitNxtWod8
--					ZtV39PgnRO2XqkeUDxXjih179ax8Po8LFMyP
--					aqUkkXHUaOyCVA6pmukDDN0JaGo= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					4UrsGwZictKFk5BcOJTTMtg6VADhPm6v9CHl
--					S3czYvvqFxAmV38go7uWorWhgQJhAYSF1p08
--					Rc2M21ou5JQK2M1ifJU7CoT3iyMicRyYgMJl
--					qpa2O4s8wjf4Ikp5n3E7ir34F7uOkLHGDj6P
--					Ll04UNf+5sZnMTqXErJPkxFDG6OBeR8PWQvF
--					DXlbeqlPRL2P1+AmA++tr912JZPTNTsykWtv
--					7pcsv++MB6MZ0c1bMzqza7HAh9zXiKFyS0tL
--					FpWIUN88zdau7QimsIDXSr5rYJ2qRS2UP/JJ
--					RHdCGsjNPkw/wEhGTnvkh7XW5c7c+pG3pt5E
--					ytiqkkeoM7XLUCSj/w== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					qXvlXC9E4JCVNKb40BfrvSW1DYkb5MaqQ6o7
--					ds41koCGdmRSPsFp9W3Ut8/mOGZDLQvU+0sM
--					mRGDuz5CJBHFCUuIy0RqrTcd1Hvb27aptkhr
--					0t40iaRQr3nTZpYFwV+3dp47ux4qhbIg0s09
--					8GB0VZSfmdqvdy4Y5d5p/QzSka/F7it05nWJ
--					IewpgrKf3aa3O0srNwwVUi2ZXzPelibx1J6r
--					o73nxNmNYp8uWkY2tXTvYAfbqvq0+rdUv8H/
--					LxNzKDElvOcat4mX7Wp+Uftp7jgizblFtqHg
--					cASPgfKyNZYGPx5pjVPKbffz8o8XtXZHbtOf
--					3rftFlPcw8fnCSMCLw== )
--			300	NSEC	sec-30.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					IevfxPqRcQEP4aKs8xesSnChDAE/33+a7v9x
--					Uh7eb5CzHJ1PGqwcjDAeJyO6Y2dU5BzwAXv8
--					gNm9MsxRYz2PQxy1rmqYB0aBt+vWHbRUpksP
--					FWOHeDN7KNpszF3r9DO4d593gbckjfC4a9t6
--					wpkvsxy8bv654YWQAlzSe4X1UN8= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					FDC0BlhPEF+0WO1Ft3C+cnUSn0Hl5P7Uc+Ar
--					ukmVZgYVY9ChaujthxcFwwJ+fuNIfk6fuu2L
--					Lr0ya+iuuOpUrMxF/xWxSnMNTOhrysjA6DrQ
--					svSGZGHJPfRcTR1hPZQBiz6wl3oxwwUE9uTR
--					O1J7IDHsL2sZ10jGVIj9YPFhPtcAFUHGMEIt
--					qeauxyZYOP/IZ0AxpXClQ5+zYepHnbcigebE
--					cn3FDSgxDDYHJDz3C9ebuXYzmO4+X6s3wmbQ
--					JDgSFSz2hHdYTv/vPkIkBYBJ4fOMSV+LgltC
--					LnyE9u7m4pR8Q+kijkOD8LU2Bh9++SR4uC2+
--					Et80y6CO/wAbDGJR6Q== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					S1mlTix9jV3mDmRk795AWNBC+ylzCsWXkArn
--					CK6wW7xXdi6vtSnvvhXzov+zVHZNAMwwBkhJ
--					8YLHZcjANtrYHxgre59bAYahwpTUR8lqjJYA
--					RnKvVjGcGZFZPV8CUcY42A4iGCgvl1UiO7Z8
--					m9VzxPJ7LjaLBLhYzdXBqC+SFSyjpz4fAJDf
--					J7juj1rPhb5OnH4Ca2nEWlwQGn7enesNWkU1
--					Yd8QslOMrvbfzmlzB6JKrDecO1aMz+soYbmr
--					TeW7A0VxVvFNdudFtU0fjRgM7lf+IbGEPf5z
--					oQT8kYhBG60XHITDaEcqTQFVN2wPayYUcPji
--					JoTeGda5m0g35bZPjw== )
--sec-00.example.sec.	300	IN IPSECKEY ( 10 0 0 . )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					enZEx05BNsmnCvan+Bhirxn9/GJel5bTDM42
--					eQV7dH0VV11kD/QM3JdhpCmJASFOo1P7puXN
--					WWvRkCnSyokSMwDkOiBBHqzA+XBVKCZMoLNV
--					M9M5OJbXCaOByzHPlJEfEOisNsXHNqgFJzXb
--					8NuNuTLUOHd+z7vAt2/y2rsvmCk= )
--			300	RRSIG	IPSECKEY 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					Q/uFwU74dwroyXluozzM/VZfPm5YIslvHYJ6
--					IPoVOVWkaM8hiYHlN+IxZMuaCtRK9SWyHGZ6
--					++/hqeBW6KezUcpBeOpE49tqNS1lFa2TQCIN
--					o602Z+Uq1ZaNsxNRzCen8nh6aPk+Ma3VMQeZ
--					pjifEf3LKrPNOqcocr+vBrb/yTP4Ns9aMywK
--					Whj18XkkUvZ3Qwc5dmkY24Tr//YlOKieyqNv
--					k2k1HtU7i1igtIa8/EZ1LSID3P1l6MhnSoAc
--					vHmqcEo50kZiHPEBRuP9vMxeLo03C5ogetcA
--					4qSlUsz3PyDKSNXLTn5Oy6WzdnrlZsaQZml5
--					tqE5oOqMAn14NWkZYA== )
--			300	RRSIG	IPSECKEY 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					sWztwS0jdkc+wToR+bYvyH46tiotZ3W/YdsD
--					b30HDNZovIjbKXNLofxglzpvg6EeRnuZi4qD
--					xlC38uoE7Poud7N4l0d7hQbQkz5gdSbHlcII
--					1TmOAmNNyYiE/7kQHYyfpHPPC48p90bSjPOJ
--					S9bHdKKW925Vp3RN3MfI4dhNNH+o4xqPIiLY
--					ZB8jwUHh7zbs0EgWbFiBCtiPsaAq01pAwWp7
--					RCKfJ9w8wE6dq505icDTLhBrWf15QYPNDgXC
--					zjLn9pmT+YGWhs6hgPiW5/y28nbiwID2771P
--					qXy56JjbqSgGBsgHTxE7iBnXr1nyOFrOEyUH
--					V+YrBe5waLIpgn3MxQ== )
--			300	NSEC	sec-01.example.sec. IPSECKEY RRSIG NSEC
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 516 example.sec.
--					L/At1YRILr1Obw284RFZlWU5m1MCYtjJNg/B
--					XUOlcATRaiCPCA4ugZSJz5EWO3j0VFcgMIHN
--					ynyXm9Ng3SoSO67r5KI/DrjhqdXQDWZ5JNBM
--					VrJixQpE3Q6pV3CXvHd9e5z5WZnwB1Ns4p1e
--					S1K/FdSp8uLotwOpedUPS8TEb5o= )
--			300	RRSIG	NSEC 5 3 300 20141212121212 (
--					20121010101010 44427 example.sec.
--					zkP9awQpTKHAzBEAY61Lvbhnn2gEtk4EPYkm
--					4qxVfs9Hcf12X6qRtyK2j1Hb/WuynyhLaZ9O
--					71Zp6isKaG7+gTBGSz1RF+oEcRJRl6r3iRPz
--					0xzL90PcGtREtbUUz/N9BXDbYT2/w3kB89up
--					KewS0/Eb8zV/63YcJqRdurzk4FgJdo5kUb+I
--					Rs4XdZMHMIF5UEvNuKocsevLn1ldP1hpN3a9
--					SFhUL7nsA2XdKRcEPA63MUS6VYYv8OWCKPds
--					z1c+/wvBHksDiGe2+0peC2f7rS6XMoULl1hL
--					czlYssdSkiQveN/K4pQQmUssBhtldKIRq/63
--					adQouGFFSMuEdPL9yg== )
--			300	RRSIG	NSEC 8 3 300 20141212121212 (
--					20121010101010 48381 example.sec.
--					Lt4gdhFZgltCfgukt7w00G/Cg//MJBLSAKSd
--					gxtXMP20hvZ4QvSCQ9KSGwLq5ntnRMzQFYSv
--					Ew28bIl7SGW4fAPALl9WrXMyQ+WG4Bja6E7U
--					99iYx39j8ZqmTZO/Z2OsH6xM5TPJFO0x/uRY
--					QEBeLl7mFVljPh1wA5NmMw9fRJxSsR27t0ne
--					oelM7uZGYPFaPYis1fWLeH+xheLOXeV5QvHr
--					MZ8H6xsrSXFhdr09q9+SRuWIFI7LG8DLeiAV
--					UaeiJwd5HTbFOEL/x3KcMH5dUISseyYZmr4+
--					RdE8KbTgv/c0xG97k3q5bne9tiBnaYsI+0Z8
--					hBy+OVaiQ83HIRpMZA== )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					goJhatdkze7WqFGplnO28uBT9AHjrsrK54Sb
-+					I13110ffVWk/6DaQhNX3GanFXDcbhi1m0N7B
-+					MbYFIWZX7y3u24Wyuvak180hUqUdcyuA3G+Q
-+					SP9WALt1+7aghjPLWhJ9/igHxC785Cq/Tgf5
-+					+KVMN1RT4pi5l/uZQ5jcKdw6J2o= )
-+			300	RRSIG	IPSECKEY 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					rXrTeN01xY+uebYRE/bhpy2GThFjdfePR+ll
-+					vLe9PzN9GauBsaHCIMl3rr+c4pB0FwVtrGzD
-+					DGodUkbqikHmkzw6gAhx9nAcEGl7jCJpP3Zy
-+					eirRuNTb4HPsXNSniwXSXryMXeBnHanpERsl
-+					4n3bfwvOQlytAqC+X1L0HfvGkSi7DMRGBKK0
-+					yZCHuI11dZehOEVUoBGlWV1o/sBr6YwwLhIG
-+					ImwHzEzunvRRC7e9SiY41nIpm3zGwnbsVVj8
-+					kDGQq9YxOgR5ymFbLhCYAOcM7jSBBQRm4Pcv
-+					WKMijHXzFO2e0fXf1nOsJH5VnQEQTxBWiyRc
-+					D0SCwpkMKHNIK/D3cA== )
-+			300	RRSIG	IPSECKEY 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					T6OZoyEvW0es+JEYsHoM45PIUYcjZjhS8jwy
-+					mCDfL04m7fmyjzfUvK8hR2VVxT+2QR6jg1vp
-+					DnPFUpVrr0jJnuicU2lCdptTSb2/7jQzlpYa
-+					M5b1aaqmlGxCKnSfjWfdeaW4PC/+Oj4yBdPF
-+					DXdKHWgFxWPDOuVIkVtKuD2MgG7G/PVOPYw6
-+					S2qMn6BSesM1UM274wiAWC4+n86aY3rkH3Ly
-+					fgwMP4q6DktOhygDOK082NANVkoGztcVNaH0
-+					pqL/5UoUtgN/4wndeLh8Lb2LrRz818+uZuad
-+					hSyJKB4pN+u1fs/Z1BQfaw5til/PAVh49KNr
-+					IWL3nkNOlCb1pXPuQw== )
-+			300	RRSIG	IPSECKEY 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					v1TyfkvJIwEJ76lle7anDNWl1V/l8m0oHlut
-+					eihGwNdar6EGmH1uyxNDH9RhGvgUVx29to3p
-+					+lWtg1VwYzxXqj+e9TnWOlCfV2MRD856UQ6T
-+					htHk16GVJvzfAwx9rX6KMu2lvCxigz+xePwY
-+					XJALDOlddHif2fk0CgAlOyH2QSc0K7A99rTr
-+					sDaOLYk6qetqRDwe+7XiscNePIc2YFqbbkq5
-+					Isl9qUTYZD8Rli8JiJGIP3Iotywqo21lVTv5
-+					niIgLU955vWfO7QAYbSMubXpyJtTT/wpPXL6
-+					0mjuoJmeKOrTXei+k96gnj0akD6FrRfkzzQr
-+					bADlicW9RVcCNxvOPw== )
-+			300	NSEC	sec-22.example.sec. IPSECKEY RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					OHE2OH6FGv4SzBbJAWGFfmrtxr/0BhA2xU+s
-+					aYg5idShv1LYS+YL/1VRXgNneOsSgF2iDZpM
-+					RAp7liIaKN5ZCZHY09chlwjWFvGUDVqT5J3y
-+					GJ7oolFFw8xB4raX2H6nGuwkq4PTEZcl5OoC
-+					42wat+/Dq8kbSEFtL9Bd3ztcGAk= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					C9oAxEQWQLV1BtoUxvPo/ofqPiFVSKObG7Qu
-+					7Dtb/WgmnkhYztsQtXQYw0a9VJ8/VuDKxvW1
-+					Bky41/VgioLz1iQk2/+4aMeyVBpfLVp/+Iz4
-+					lAldSRUkBQt41XGkWLG3a4msXfGxc0wlOhPe
-+					fd5RV/R36T7tXCFWKw9C+b63we3G73gCJytj
-+					ZWLD2wVP1f7oaWPJWatLiWsfomqnmp5DDUu6
-+					7f8qJ5sNgdRoXIKWXbXX2SBaY8Xm9ot/Nyfb
-+					0jXZGMHhw3rl2LQz3rvR5IGCYTtTWF7yyOQ0
-+					2cyyPkp2/qZNrQF8Cdq5ymSvntSwC5yMx9DC
-+					g5jBBZRK5RlrcNnCjA== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					INMHa0l28dAXSr/0Dk4cKSBWQY8ONmDFWbn0
-+					VyoXVPXCrjFtAPu4C1bBdmhgx9poKz4DRN2j
-+					WQLepltrq+6+rf+lIEMXj3NkLaoSRv3VTEwT
-+					hAKnLv4erWvGAvcWdkzE6FNNOT0T73nwS6Aa
-+					o1M5mdg2DRwqx6Nmvz9heBIbgso4ULzi/KIW
-+					lI6RjZcIIlQPrYBWBtxB2mQ1PYJMjJGMo99f
-+					sq7+LHezKyF0BRktYN0zEUKeV4AYwQmP1o35
-+					o3jDlUlCdusrelEXPykBfNGgtFTTlTo9d+hW
-+					OGWVsQhJzYAU+Hm+VslAP5eF7LhYCX56ddJO
-+					b3/tyfGjTTyZ1Kaztw== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					ZgP1+3VHbAc4NsPSQqS3Sl81SF5AKHFq0A71
-+					0gH/OoNCNvHQHbtmFH922IQsEPJNQA8cXPx7
-+					yFNfE2zgG00v2/Ua91Qj8WxJgfXePtJhZ8Lg
-+					d4bHaGW+tbx7qM53CWrd9vtg9reWVb5/4Xqc
-+					+iUbWHN8zEOIbVeSyOK0Z/94Q683urO23C3E
-+					vj5coGlSHsFu5NyAl/B02mNZusHJ1UZ59sGj
-+					71nJgRw9Vg75QGDr8XTP/AINRNYq7pvlWdrb
-+					pHAEDKVkP7ZwNFzbf75VVY1UAV/sk2Za2sTB
-+					qyMBMRzi/svqhnSqYVfN20Glkv+Snq6YZuTT
-+					Z21Nnpdk58SsOxxFJw== )
-+_8443._tcp.www.example.sec. 300	IN NSEC	example.sec. RRSIG NSEC TLSA
-+			300	RRSIG	NSEC 5 5 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					bB/mN5odg2j9RXrzTyFdm/IIVLNT2JkHsyUQ
-+					gziMnpv3vt5TZryVrkEmInIs/PegcSZFbD+A
-+					Q3m4ww0Yoz7f7a6rkqFbm6iUs/khaISrLF2X
-+					YwPqlPq2MOCfp2P6LaEgoIvmz8QWLmSk4clv
-+					/NbCjL/NgBJqe8RPC7zRymwa9IE= )
-+			300	RRSIG	NSEC 5 5 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					d84Fcjnygh05Ll4LdYC14XYZFiXbaZlLEAOg
-+					SbwGq+kAGohtW2MfKYSMHOt6ynPLNasaAKTN
-+					c3XCL1MuozEIQ9I/+2RyelxYSSMIA7XSHjPS
-+					vw9tQr4JHX8xZDoUCzZRht1VBYnPRadiZx0M
-+					/Dv+iaDM68bEggsu1PhBDvksx+86Uz6Kbk9C
-+					fB5GReS7qpS2jHXgS4xksK3UhUp4zUIql3Xp
-+					E1uf5NF231sw3HXIEIBox1BAZyUBj7ShaNOu
-+					MQg3eg6moAteUxAjubApS3P4UyHaXISOHnzY
-+					fVNEUzpP7ym549S79BG22vhlF6/rxfdFS8hp
-+					+ijBTtHpoKUmy9IYIQ== )
-+			300	RRSIG	NSEC 8 5 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					mn64tEag097G73PBv6nLmaxqjTmSxYUcK7im
-+					niJsDArHlxg7xyP4Bi2jQ7KN644aDc5Ck4PW
-+					SvmnuVNfISX7HIOmxT/oc6gHRmfJ15CiBx3y
-+					xTLmfrfv5nAk9fLErkEdX1+ET39/7hgu5sC9
-+					qOkVvIDBqF0PuuYcF/lXz95gWjhaQ8PSG7WJ
-+					24PejLukdvCaEp7XuQLiJguoUfIkxDdYPnnI
-+					AlNuKyiONntzJuPI96zvQSYQJig69pbHr9k6
-+					7BkuCSbfimYP1g5bveGngxZ+tUQpx1UaHfEV
-+					YPH4ve2JQhhRT/4awhD9VoPdMAp+abdDRqRK
-+					v85EmPPcLz+6NnlqHg== )
-+			300	RRSIG	NSEC 10 5 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					nY6RmMUxCpkOsHMerlf+btKjBbSYCwsfNW9c
-+					7v8zh95f5iFGf1XTRF9TqAugQg7sCAuAPg/t
-+					GfMWw8jFAIZnx/SbRxC80EXDs1wcrfWwk8gF
-+					HgWq4d7g3p94pTDhAtIovHeIdZBDMb2f2k2a
-+					/3Rbrll8RV/QlOBsXlO+lE+T/RNzO6C/Xl0a
-+					wwfALpJPHRpDHwK3+0SRVf6Tlg7oAUHWAhsJ
-+					+XNrixGalx+DCeB6k6KHvw46hAX1j9EzwM8f
-+					8pAYaJfhsfLAvg2qQPN/14SKx0npeRLvq9t2
-+					RS13BTNWUrHoUJ0FID5JaVIwFS+TLFX5XcaM
-+					u1dhgLgOQPN7ZAbLsA== )
-+			300	TLSA	1 1 2 (
-+					92003BA34942DC74152E2F2C408D29ECA5A5
-+					20E7F2E06BB944F4DCA346BAF63C1B177615
-+					D466F6C4B71C216A50292BD58C9EBDD2F74E
-+					38FE51FFD48C43326CBC )
-+			300	RRSIG	TLSA 5 5 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					TS+4QDNXNzLiEd59Gu0osqODeilrR0ewk+4K
-+					J76FS/MWdTby5FRuZoO7dlWknyGcJF8mwsKV
-+					PLR/N6PCmlLmPhOeN+LNxkYCH8xMWNckHIwM
-+					5rY0Y9zWy1n2oG9c4iObczcA7skeoV7xv4if
-+					W71kBgDKeLURupwuXFJs0JEGOkw= )
-+			300	RRSIG	TLSA 5 5 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					CBo+fTtF1ypKVYQKHBlv+Z5lSvpFKkGHdP5G
-+					cjTWyIZKiWANKJWGK8VhEzvDuOTd3oTPK5L7
-+					OABpgyTlypwrTfzMxtz+0sb3dGKAdGAvFWiF
-+					20KSv5iYcYo8tABNvxcJQUVe2iEoQaNtKZAm
-+					Nw6e9Mvzgj6DjhhrpbAOIOQbq8geKfM9mYTQ
-+					dCwDiFdK0PKNHeQquJwbTLofDn2ah7AbOX+9
-+					+9OSiORH0drMMbiAvOx1JSRQGgCXYYEXMg1n
-+					S3EycAH7uyWyauVNBblPnSAA5wQ6SAzRcpKH
-+					C3iYXb70P+1Qwy1AEB3aDdyLKBbi2g4j9bFq
-+					pK/pHwt4kVatWUfvZg== )
-+			300	RRSIG	TLSA 8 5 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					aEqQxblSO8hE1p5DhgwIcuy3Rmm+yzxwGnUf
-+					QQx0RBEzWiIYUoR7BY8hT4q+MRMCjtHkAr7Z
-+					g+Yswjgx2/jaPxgxmKSsmQN9ADamEmuIIIFc
-+					42THiAzdwKdd3MTHDQJ9PrBkjIYike3Nc+xC
-+					jVxnYH0Hk0MlzfDi9pYn035EXINF3Nda2BfS
-+					7c6xLV/SJpaIPE00p9EIKIdYtNYpczzoImVM
-+					YbmIi6B0xoBhfScMi9q3Tarcwrb9B2KIP60K
-+					9n8yVRBVwu6mSsoWw/mGpwiZtwoFZt8tmX0O
-+					5V/sQMkhvP9wWPxGI+NWYeO8Yt+DE3VFnPZM
-+					qmO6t8FbVma6nFgp7w== )
-+			300	RRSIG	TLSA 10 5 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					HpGtSiqI9HWZZPFPkNCgjxteGZ4p+XrL+9Q1
-+					PZBi9BX4GjSNhQ8kXDzNBjhc9OCMfePxXf9g
-+					VukFekCU7n+HSdDVEFnGizSYBmyG0KSktRg4
-+					jG+BrKxmKLLqLN7VpnADQnbzjcRvFILsTrsE
-+					422K2cNlAidZrKiEydOauaoV8Y5XrtHOhckj
-+					7BdpJBTcJhG97AxKm+tRXVAuhwHIvpXf277V
-+					t32b/stuRVaY1mixrDhsyTdqOUui5SA6uxHN
-+					kMWVjx3QSeFpn7BSSQ1/UBjP3CglE0U2dKwI
-+					eCTZpjpS11dkiR/7Hp2juu3FYamF/Yj4nciX
-+					/DxrYrURdHXUkyYYcQ== )
-+www.example.sec.	300	IN CNAME example.sec.
-+			300	RRSIG	CNAME 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					FZ0ONSWPkz+5Aomi5/TA+T1eVEgF/0UJCraG
-+					ZgVCjxw3jO/v3w1ByrR9BpoXPIwf5CA2TkJk
-+					gtGvphzFRrYNF3MEhgOdTRbiLfqpcC1L0pDE
-+					6IAvRU1rSoXZRo3W2Uzmr6I+KGm55Un8pF5X
-+					v1uFVPw7ziaeHnYAZ0b3TXSRX0s= )
-+			300	RRSIG	CNAME 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					DNnNbCbJQz/+9ExNHu+M6nnVmytMbLLgHlXM
-+					w5UjfIbG3EijYDWenUo4ai7K23l3HHCJRZbz
-+					jJITPJZdNUVvN3+bB+RSGeoFwCPCfHkkb/yy
-+					VeXJIQslaSmcBIpwrnlIu4mztwrSzce7WI6c
-+					iKL+K51a8KaqzQX0H9PaEtw7z8KUhSNhO2lV
-+					kbiva/NwDlfsWULjo+r2izTXmMgKU4cgdeG3
-+					8RqmpeMSRLP6H/P9B38pfBpvnrBbEpYiK4BV
-+					5GlLdiETYtQWV3iHsLizYCNCkYhs4b55UNWI
-+					02eVy2jpmeYnNVBx00wqiHBjHy5gkTAn2vNc
-+					LPagUqrpq9PI1xiY5w== )
-+			300	RRSIG	CNAME 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					BbLte7BZWvbNdj+tYuA4kk+u72ckzBxnBcM/
-+					owhFOtB7IZWKd/696MOq2w0MuD2OSqSm7mq3
-+					A3Wnm/3RN0+OQImy464IpKSmXwfHHI7ruxFD
-+					jX79azCcpY6p/BaIzdusSPtIzN/gjpxJnZU2
-+					jTjL2Xx2V3RWoUw+nO3CNJSeH8ltND8hJX8N
-+					V+cH1Mu7eRC3oO5cLZeRuS4QILAVFGgf8ZF+
-+					kWkruQzwc4e4eosgNFOg5WC4VXnPfW3cqWk0
-+					sZTs+q2P21YC9cSBTOIgIxCoczMVQW7GhPLQ
-+					8LIea0faxJ6VjB0qHcaKyd+xpR5Jhe8cRLUS
-+					+40ORu5rOyJMa6386g== )
-+			300	RRSIG	CNAME 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					HoXdx2zby92ALr23GyTVvTZ2sdaJJQH5TeZd
-+					ubz1toQEESDns+8WvS8gkaOWhPaLKLmKIq5E
-+					fdWaacrscexINxk6NlMjNRBiu5dkAuVfYA9a
-+					xOWo/344pACrqKIoboHt2spQvTdIKAmhFuLY
-+					JWV9x3uzXon69k6jcedC+rLumGfJGgodkRim
-+					mxn/LNU1NHdaCoD2Bo7q0nGbJwDIq+Re0WFp
-+					bMLSYJqFHKyYJVhQhhVPHmYtMAgvCFBwulgj
-+					lHU7uUl/+yltjxgkoKnXFS+Bfhe/G84rXBRw
-+					UX9AzTSnt1tCo4ItiSSja/kHjkcGlJJ3Vs4S
-+					h8KDXRRj/FVau4flxw== )
-+			300	NSEC	_443._tcp.www.example.sec. CNAME RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					oaIvvXFtkyugmxcLgpeo7tNMhTidHaI61vHy
-+					qHCZdzZ6L+7vp5sNbZPQevTbAPXhOSPkr5wZ
-+					LcoWtRMZtS9NpFvRJkMiV6aJL/rc/o0hQGBh
-+					TkCnpViK3vPsXiH8kvJSvtQy28hDHoW1nS+V
-+					BjciCsfcXBFqBuJdbz+msoY+B2E= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					iQtijIDg9MYpZaQdctLPcAdUfUHYgS8v9y4M
-+					GlpPwfSg/lyns4vY9HF9jhHO/yhVYriiPAX0
-+					INxdKq0D/9te1BgNOKeWRVkV5hJtj282fAfW
-+					7z8P48eTvOZi4vWPrhYU/UzcEw4qKS15Nep0
-+					U++yhyagqPdV0g8GS6q5hobOvZ+lSNkCL/2l
-+					GcAWLq9QDK/urxNdpYQx2PB85SmAjGaD6tMD
-+					NjToXfttE9MiUUjAscziJ5lcww0WObBDl+6u
-+					mEp/F00wchU7mIbbipzpkURSSL0wxQzhgJ49
-+					30aM3Nlw/P2ItyCL6FbcYiEVhJpQB3jCnjKu
-+					JptAgu3NkCpLdVJnjQ== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					yJ07XSzPqaco0u/ZfUeYRuVKSrG/nuTxpP2e
-+					4gR2eIE8IXcVOp8J9XACvJ85dnqabRkKDea3
-+					04ZA083dXvhn7JRtOnPbG/4TyTsmahl13/fd
-+					4WL+s+nTMBqqk084BuTClr/spKCgLzRF358X
-+					SaQZHtUD+6e8SbOKwDOhUPWp4jn4b7tirgkP
-+					ZJ72Y3k1OwMV8JL3eLwhRbGH5iNDZMDfs4gD
-+					mLGPSQLaleN/Qekcqzo7Hh1wNBfh3eyTy65I
-+					1WhhHCe/L29cqAWAhw+3Fz/zqwyTSepjkwcQ
-+					v2G0jvEJEEYA1bRDqQmKMN586ZbHRVgL2/Mx
-+					GSqdZCWmG3xoxn+Tuw== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					rnsv561ekllNQ3HeYnHvQPFzZBnMEpKt2Maa
-+					2lumqNgrYINBhsAWRjCY+O2PQK0PDf+7r61i
-+					ijKRb8bJDfvjy9G3YZyo3A6ybQ0tq7iLfDfL
-+					H0zLoWyD220CXI5foZDQJJccJrcroFU8t/jN
-+					9oBFAN8xd1mPC7Otd6nEd70fyqH5AM16eih3
-+					K6+EeaB4GKK37kHf8VABMddaDoU9WbwVdrr5
-+					r8NBB78c4jXF3SdyfOqjWhv/Z5ONiuSZQpCa
-+					G3w0y1S987knZpghphycTvQtc0cekgvdxR5B
-+					88vBuEoItgAS7uKWJ6bvHxXic7M4N1XzG07D
-+					mBIdn4oHHDmqJV37rQ== )
-+lets.introduce.some.empty.terminals.example.sec. 300 IN	CNAME example.sec.
-+			300	RRSIG	CNAME 5 7 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					i96ICBMEwhjWsLMqRNNygtCZwba1Gn/r7wrR
-+					ZvMrYzr/HPWRMQwon7/RbEU4kXuQSMpbU+6v
-+					vhcm9QN2K0k/lq67efN1JXNGo6P+L8AsY830
-+					0FwqiW4q/ufnyexoQ1i9cJe3pZ4QO56f9Umq
-+					Qg+m6JBgVHKn6TCVIp6rVJ16y4E= )
-+			300	RRSIG	CNAME 5 7 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					PNhMqeo4gJ1emZy/sNwdkJezO3dORiEvPWC3
-+					EhfIzK1ZagVYQAlo7yfAJ56/Qhsq8+VEcJp8
-+					2tt8J20waiDTbES/FY92Y0i+kSLM11fnZZ9a
-+					plG54D4gQnrv1J0BOjMXnYW573kw88aAciaa
-+					/XX5mP7JtHdItcTiK3hozmq9cTTsfisChitW
-+					S+CqJfiWTRaL0vLDhbfAK/lu5zaCFsTRHXtI
-+					3oQdWjxJANE24OjG83JWWWHc2HBfBdMH0+d9
-+					6kRbUSAoFXxK4uLZDgsXOvDspRhMhZJsq2+z
-+					OB3QPZ6g/n6tbFtMx759a4ZZlR7+k9hleHd7
-+					oo377OcIV1iIerIWpg== )
-+			300	RRSIG	CNAME 8 7 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					EKWV63NnX9sGZGXPdahDUsw4jcrLDWXJDMiN
-+					3D+UTOH3nUPgm2mA7MbGGXPa5emnpaEnJN8Y
-+					NFXTKU+SENXN/fYol03Pm1PKRGbmdbpY8Obi
-+					KrYIHEazypviyTSPmmZjcHd8NOxcX0pDdybC
-+					2mrK3v6K0lOinIeOO/fdHc7/IkS6FmU78/r8
-+					49l9+0oI6yenzOYVz9qHGWUGP040eR8h25uo
-+					tSNxqvoiNmfz/9hsWKLuwaW0v8mNzeuK4o8J
-+					5wkbjc1hemSLUm05ryA75hx5/U+Jt09lLvxP
-+					BhwU7iH+WPTCRO/cxavp/k/H2V9vQynPB9kd
-+					Pt/VwXnM/hbJlbjqZQ== )
-+			300	RRSIG	CNAME 10 7 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					HZBPL0Wqk8WCcTBsMLdefVVsS2aywUC9wgwE
-+					SlDx2kP3+Kuw8udz+s5cPRRj74kiKwholxHK
-+					68/qH3Z+yiLKHXOrlK9gbDROr/w8hyRqgylT
-+					QPvVoPtvffRms/kYck9t1ZtgYpYsUF/VToYX
-+					pY/WvLyb7HH2xDeaiOW0XMQzMgaLdCOFXz6h
-+					rvRbrWG+8LTvPO483RkzkYjgWVbcjaviMm2M
-+					Livb6R6hDcDdUAhq7wyHJOmIOmsoho0prbGO
-+					o2uMVHhvQSELDSFkweP1iu4C7h57ZYQv+bFZ
-+					ZYBgh45wWPj0DazDhqit7X1sgu2qHMPBlhjs
-+					LWpRTSFkPO6T/GXoMg== )
-+			300	NSEC	www.example.sec. CNAME RRSIG NSEC
-+			300	RRSIG	NSEC 5 7 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					ByFYkS41yP8gBlLSknKz3pLdIhYnzXFWsI4u
-+					Y+U12xBy9+l6MCWwgj/RcSGIB5+1FKFeQ/SX
-+					KfXDK7Bnr+DxK7ymPCmNzZBJLdJm8bCLA/S3
-+					YpM9ABg80VbcYW9s5vqXyst8Uf8fvMtal7Zb
-+					a6Z5Q+cC9WQO7wrYtWnSS0WRUok= )
-+			300	RRSIG	NSEC 5 7 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					kJGdpompkai/KaP9fpyplXN0vqsBqsqig57j
-+					fkqKIWhERB2EABBrZF9nAPtdV7axwJEJrViI
-+					iLcHU7lN1YQRO4eYUcxAbcLjXFbr9L75MjpL
-+					POnvcmaB8eG/aW0H6mjvecacU+DN+ykb5Ef2
-+					C5I64PFluL3iXVN6o1xonKpXIdmnj38HMkG2
-+					zFwlQnhRAfFKlih0hBCL8dtzr8OaHHq20aH/
-+					pOm29fuOyLWUliBTZkyg/q43WMKKbiyLVVNL
-+					PXNsicKTYXrQ05oH/EjDkNUtElc+OqJcsRQm
-+					FnQgF60rzOfleNBaLDnZTNO5zMJQ2uwVuD2Z
-+					II8k8l68zj4p7n6zKQ== )
-+			300	RRSIG	NSEC 8 7 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					fblA2SxSL+ZL2oVqUTlbKt4DVZwEbFbxS9U0
-+					s/5QvVmiROWviIRZ7hPXqOTh6uRJYiii+4zz
-+					mMBhjFuw1EJovHMabEvYRdYqBhihR8KhRK36
-+					TYi+tP2r6ByP+O6rBJB2BehyYXqKsFceQpv3
-+					LJY7pxBI2RWDsRQdPSU1WDmYVjBX0YoES8IS
-+					y4l6Lr0Jdlzk1whzgballdu+ZMlq97g+JvsO
-+					arWq7DQBtcgiWs4S7f3fO3PNzE1ltKgsvc2f
-+					mtaCD+g+MpjaDLSRXdxmNw0B3MgYQm3Xj1YB
-+					gL8SYkzvuj4jK9F35AhvLNGeY0h1UyuQIEKP
-+					RmsDN/xIo1C/NY2Xvg== )
-+			300	RRSIG	NSEC 10 7 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					c+G1yL4nXJyEfrwW6wewKSi4RzH8PR/LbiXz
-+					Xdw3l4s4f8bJI7F5SJ/mdAl8qEoQY23euq/u
-+					8lXTok65b70T/n1y1wSj7WBvhEFOLAlh8RcC
-+					kEQ0GHP/qjTM7MPJsDjPjFRXHDwp/2xJcWpE
-+					T970VWXOKd6S01/BQj06yk056L3GvRW9hswE
-+					Oi31T0VLYFcBZacfX12lxRhxwrKRaRAMLuu3
-+					uyZOf9FK3xO6Rit+5HOFRX3YDgI4+RKL9Fjv
-+					+wC/cXGL8nYzUXG4TmtT5kwsheXd5KzphGkW
-+					Knl5KyFJ5tCegS01dx1Qiqox4ujHin5kS8K3
-+					bkgejnhECTn7dZMmPg== )
-+ghost.example.sec.	300	IN NS	ns1.example.sec.
-+			300	IN NS	ns2.example.sec.
-+			300	DS	50458 12 3 (
-+					2E40B2A6CCD2760EC70AF69D1C144064C893
-+					1E53A6B3EEE78BDB9E0BAFBB9C02 )
-+			300	RRSIG	DS 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					iclGupmUkGsPDWdWkuEDKTkYMqD6kCvpAyqS
-+					fZBuDZD4vrpOciINX+iSWzVO4iFNUhzjZRW9
-+					cEbwhA3JDJXcXjDOFQheVWU+2l2+wgsI4LvF
-+					ebykSWuJ/bcXZP17uaulK/XUyXZf08iFOBNQ
-+					6MOQK7LtilTg4x7hD5KHsepvm0M= )
-+			300	RRSIG	DS 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					yC8hYQPjoYu1NY0MSWVvsF+ME/+9Qk+CwUkC
-+					JbdrnGR/BCQn9c+vOjJyVp8JVFqvTR+/MYrF
-+					l/8qNUwPf8ZjWie2MEBb03pTtscY2dZxM4N5
-+					gzWJNeD0BLv9k+z5gIZGchC6P9E0gGiRdGFS
-+					L2IayJ6kPl0UQz98VaJH+hdtgH8Lw+K5EATH
-+					9ZIccq6Ea+VOK+51GB4ttvQuIBKqfh4y2nox
-+					dJdHZH9iGnXoB8BeQoZsh4xMUdpNMjL+JHRc
-+					ZCDazd8EeiDz7x1opJG9LHT4IZ41O7UL3vOP
-+					vejFmXoLbQ8s/d+wOhpJbTTEqmaFm3hAJi5I
-+					dfru4JX94JRntdguaw== )
-+			300	RRSIG	DS 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					ch+jJnF6K4wSqfo0Rg8kNedNkumPgNL96ULu
-+					nqN7R6JA4aZx7wLxFejYWN6ss6aHPFyDMEkT
-+					U8TheY6pBpzD88P7iFhPSjIDI+odzAqsUJGk
-+					CabrMijcDyX6ednOu3JnFUvLr3SS7s2Qvylb
-+					rGVaDLrQDdLJ6oZLMVpGvIIkVFQ5+IP4dhmj
-+					Jb9NvhkEomLQVlWynHVvYCjrR8naPmptKVok
-+					Lymc6BNeYqNJLS7huwcKWrl1B4rJTQL5BeP7
-+					mRwWxJJoZf4XL7nqO1xiJ5onVTYjunseCBiQ
-+					jPmjCV/8c7/arUYrvL8yaFwi6UaRZ5V2MkuV
-+					qfJhlSQv8Q8CpBUIKw== )
-+			300	RRSIG	DS 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					RfhRZ5IfOTfltrfRj5WG9YZA9V+nbcUdYRLy
-+					Kx+fVPXLQde5rWlATNS8bdxh17H2aWAfbG/q
-+					sF+AePm7aSCXSVHRCCgDe5STbsZCumZPU341
-+					0DEx5LEP03YGGMXxu47OjDwFeXmBNY68R1pJ
-+					XZqvTBgcofLFW5lIuzgHOvqAfcfoYfdVMZXN
-+					5bHGbPOYTxRLzOozvHs+CPrxVAgfkAbisPxh
-+					9kKT+Y7gzPFEeHv0gn45eyNZYEz0/3u4mL7K
-+					dHN7HWzo40SOjwwfjMaqnBlaFWZr13GWinpQ
-+					tWqhp4cGIQGyhOexh+nw7oZH1fvpEAuMM/Iv
-+					1EwmI62OiEuAey+onQ== )
-+			300	NSEC	jumphost.example.sec. NS DS RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					B387vqwneeYj2vq2NgMyz7RqY+osCm1GRn9R
-+					dg6ucSC+2siErQ5CHZVw6huRCE3GJrIZeHsB
-+					fehIs0i4Fn3zCHJbn41nbsvCv9lnWvb+x0Zt
-+					RdgcOCaXsZwufczgTCvuzBWv1ujZCoJj4AJm
-+					FFETfNSVwNFoXbr2rljhomm90Hk= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					keFijgNnTGMdfPcoBgTfpklCGxi8kIPvi6z3
-+					NrLEP5QKq5EXUzN//M+1NlzaczzIHBjPLRcK
-+					vdhMnwU6jwhE9U+/209IolARCahz5C2S7CUc
-+					Uv8nugElFvQkHfZN4zOnMWiTJ/l4MFs9lxt6
-+					JCBeNOVt1hoETDKgiphHH1lC1sXCcFaeA4su
-+					JCcHy89n1cuR+iirm6yWuclAIvjYsxyJRJTQ
-+					CHDvsKDSt1qlaslstw0jrI3guqxmiUKol7PD
-+					7+L9MV+VnNwsR6aHu3DuLWRXaMizg+6lTtp4
-+					ahg4LrhywC41KRCDczMK1ON2emH8uTsJIIc7
-+					ONkHvohOex/H3C1D8A== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					p3djDh0TA5LBwzPvtBmJZsjlAs6DPdlmBTk5
-+					ighk6mxU8WuocwwkqbHS686mdrIlaUEMo/oO
-+					RIO4WC+P9jWrkDAFzpYpjqw+zlF/YooKhP3K
-+					qXDUxXHcrPdV1UtEv6iz1ps/1YEbTVwACPZt
-+					Htpzemt+/C2/ZlFr+fuvJqvTkSjA1EuQufX5
-+					Rjp+gG9iUh3Vw33PutCYaLvSN4ksAWcGb7qv
-+					9P9xExBSLGPvtDtCOK9Wheu2whVigh0s+m9s
-+					nbDxbUmbK3AuhnETES+tT+JdnI5fz6UzTik7
-+					e/qHQ4hL2ntopbjdUuxk9K8umzTzSWhf6l17
-+					CfOBN4w9blpdg+7gtA== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					nFdtbKA6VF4Ong9P6CNqLy7KXtfPkJqlaVHK
-+					3ANEcVkKqbcYl6oBJY442RHqHpxUdtn8dvKg
-+					xnwePylEozcaY/GI0Oy3bDIcWjFnlIzW04XW
-+					NuellO0OC9vQ+o3AX0wgNZ3lboKNkHHEUTdF
-+					KOD3gX4z0r1A/D9Lh50e1sVgCGwQj7Bp/Nhb
-+					8m4OU3Kc5UrBOhlS7oC1QWvL2r5HjEcXVCK+
-+					7HSPSwM3h88f3DHvN2BpPZJpuro6ZRRitenM
-+					GG9gZwAt5UxiTFFG4DnriPIxhn2SbqRF0vNJ
-+					kwoejT4rTX+/M1Ht4u4e4p3ad/7Vx6rEvlEJ
-+					bvU12qtqXIFOQdAtRw== )
-+sha384.example.sec.	300	IN NS	ns1.example.sec.
-+			300	IN NS	ns2.example.sec.
-+			3600	DS	10771 14 4 (
-+					72D7B62976CE06438E9C0BF319013CF801F0
-+					9ECC84B8D7E9495F27E305C6A9B0563A9B5F
-+					4D288405C3008A946DF983D6 )
-+			3600	RRSIG	DS 5 3 3600 (
-+					20181212121212 20161010101010 516 example.sec.
-+					pA1orlZuEjb+1rxkN7qvO6gFFg3ebxgM4CqM
-+					TxFhijcBNbdtQ9jR0zOgNgIpb5UsFe0kj//b
-+					+VSKaLT+OtS1bwf5cHvRcgIXGpsTRaGOSEle
-+					bbaw1Wk9h6oALjbZ9vaoYGFas8NeIddklabr
-+					GAcPeJuWdUTlZOPftHhvcKip29s= )
-+			3600	RRSIG	DS 5 3 3600 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					AxvWrRmB91L3EBQaq3IMiAwS1SxB30bbgM+3
-+					xFL1mb0zNUSwV96VlpHGgw5TX3oEXFl3eUp5
-+					KYrxzzkxjZEPwNABysgzaju3ovCJ+w4d5mU6
-+					S0x8mf8HZUOZB0OXqYAeC6Z3B7/cmCfrOCIG
-+					6i3eKZ2vbBJBhGVUDAeEcHblIgeoutbKTHTW
-+					YM5+zCSHA2FcIBYxyp+aPQiLBnZrKsOAL3bS
-+					hcMiOug8tyBL+qGALIA5BUEViwIYWmDGwRAE
-+					SNmsxFTKFNzov9inzZk7THF1iJfCIFBNSoyg
-+					Wd0V1DDm3IwH2XWeQfGcQjIMpkvvENHeYcXX
-+					6WeSgcFwCmLysuARAg== )
-+			3600	RRSIG	DS 8 3 3600 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					KDoVg8SMwz86zyQLZY2KzLkFLWPJvni/2BAt
-+					jTRpL93pDxHoOl8jLs8eI8zjmkoNbquKlpNe
-+					+QHFcspLkLUoiNO/PiJej84Ou2H4rykXUOcM
-+					qzk6B7Svy4Iv4eSi6hUUzcWAy3L6jm+fM/Hq
-+					k5SCBMH+mQ4BYmmY0VnRbOefj1kd89S1foSl
-+					NYH+2U9RRmSf0D4eqIO11aq3RUVcQYFMIlWK
-+					r+BjsRcRn1MQhrAKWG/WMkEDWibIYGjMp/Ub
-+					dMRCGA5hIzVrBqy22756enNdRsoYmmiidpTW
-+					yRCk8APk3cPbR6lPtHdpsjS23lV5fzcsUdXB
-+					rwGeYyOe0MNusvJPuw== )
-+			3600	RRSIG	DS 10 3 3600 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					Jgc6PlkpSUz1I2Fj0GRFW3VH19gl7upEMQf8
-+					32hoT0X770oyo6NbvmovwMiBibUQAVRkR4vY
-+					R7WlTcCTBn+WS/nueu9/Rdu5BFAT2P5uyDCp
-+					OxPS8aFk3PPYvIJs6T/Q+xkM5lgN7qweljwY
-+					EBRPgOznpUypN1PIMj1k76lLFhDqgjAoTpVd
-+					whnE3mo9sEQRnZtHkGY+5ZcVEjrJzp37/Iie
-+					0UfoRYTUxtK/Odm7Nks9HmNWo8VxASizLafY
-+					I1ij2YTLjJiEj6a4V5gd89C+gq9y/dfhats4
-+					/IjF5ImtFpBUGAvQ90+DKCGba1dqKo7+Ub60
-+					8bCo75+TZJYiMWzjkw== )
-+			300	NSEC	lets.introduce.some.empty.terminals.example.sec. NS DS RRSIG NSEC
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 516 example.sec.
-+					qtp/vJ/rxl11yZtvFB1AeRt98JPoEiB7iUo8
-+					//o1B4DNTdRjUQoUlWXo6qCppHiT6X+X0jBn
-+					QF2SQpvUBuvOu3ycWy3v0nBgVp5ZwdTYb2f9
-+					hko4c/sxmcFlRTQ6pWEfiCoSUxsuWWucWtiQ
-+					THEZbUy9AInu/nRAfqC/Nke7/eE= )
-+			300	RRSIG	NSEC 5 3 300 (
-+					20181212121212 20161010101010 44427 example.sec.
-+					afbTauPUX2myihkQu0XMw4bUPe67MGI60HGA
-+					ulUmQMgAJTUMdvzsQTj5u+ywfSzJKK2xz+Rn
-+					euiGXw16/O/BbEoNC3O2rsyzRa1d+x467U1r
-+					X4SZx5QhbRSi7BwmRiaUFJH8e5ZQTwMMws7u
-+					fWx5mGFCDTAp+G+lrnDnGB/QD84AS5UqYLi2
-+					Se+ZQyWH69chcTQEFEyqFXtf90T6sGXiKBG1
-+					908uOXbc7bDP6kSSIfbFUebsgut2tOTI3h8r
-+					YkDwCwgDfqSSkc3bqRHqEqiEtuucdBcdtZ4G
-+					V3bo6rVNGGz4b7Ltrij/lsyergKSLxmn6RGw
-+					wDKSoxIN6OBjj1ThhA== )
-+			300	RRSIG	NSEC 8 3 300 (
-+					20181212121212 20161010101010 48381 example.sec.
-+					pam09BNhE3P0spzFLYYr2Cm1vHZ5DXtVQ1cH
-+					fdc09RER//D9pzZjkJFZN1XArmUyyaL2epps
-+					Zi0mIhroiP+98JdhyjLthpgvyl/3pa8ARVjr
-+					/R08qknRfjkyjUBh2/kopZXZ+hEtnuv78dKa
-+					49lbViT6jbL0giz/uaCdFZo4w8sCCb+FBKW8
-+					tlDlKTciKiZlmScNDeFNZxk0C07OwJ3zRwkU
-+					F87MgvZ9inslXV4qbbKL92VmF9lK485XLxx1
-+					LlDTCvDRkWf8m9f4uRI3DHk7cVjJRhu9P9HR
-+					Sihc3gdVqZIt276vlN0DtVnfFLt97s7QNkHa
-+					srPp3F/Q+3pysTfL2Q== )
-+			300	RRSIG	NSEC 10 3 300 (
-+					20181212121212 20161010101010 1862 example.sec.
-+					GtKFam1EVbVXETNxw36NHJLG4czkGlqHbSMz
-+					6/sGtV1XblNJVFMUXTy5WW31QX5rsYpXHIWZ
-+					XcTsBLAZqLjhxjYKjnXXGgkOQe/ci7EsNG78
-+					pDO8fDb5CqORIEhcocsoCWXOkHCmopQyXlIv
-+					4Hk/3SwKxMhJXt0Ox3DFhuduaPT/NHXTUD+u
-+					vxXpZuc6YrxrpDA28slByf5lAJrpgq6s2Q7E
-+					kPcDOAsXmGDmRQvVR1xn0XN+5Pheysxr/zIQ
-+					9XtN/YUrLn7loSmjS9+3oiDIi1Y6eHnCvQJP
-+					o0pkkTNnEsmUSfVaXdXXkZ47dwuUIw93V/mD
-+					nxxGe2Hc9+F8fRtsaQ== )
-diff -Naur validns-0.8/t/zones/galaxyplus.org validns/t/zones/galaxyplus.org
---- validns-0.8/t/zones/galaxyplus.org	2011-05-16 15:42:03.000000000 -0400
-+++ validns/t/zones/galaxyplus.org	2020-10-05 16:59:29.360681415 -0400
-@@ -18,4 +18,5 @@
- cvs     A 194.28.255.11
- v6		AAAA 2001:2010:1::feef
- text	TXT	"text1" "Another text" "One more"
-+bigtext	TXT	"1" "2" "3" "4" "5" "6" "7" "8" "9" "10" "11" "12" "13" "14" "15" "16" "17" "18" "19" "20" "21" "22" "what is the meaning of this"
- *.meow	CNAME www
-diff -Naur validns-0.8/t/zones/manyerrors.zone validns/t/zones/manyerrors.zone
---- validns-0.8/t/zones/manyerrors.zone	2012-08-13 05:37:10.000000000 -0400
-+++ validns/t/zones/manyerrors.zone	2020-10-05 16:59:29.360681415 -0400
-@@ -112,6 +112,17 @@
-       0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
-             7983a1d16e8a410e4561cb106618e9aa )
- 
-+; policy  bad domain name for SMIMEA
-+smimea IN SMIMEA (
-+      0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
-+            7983a1d16e8a410e4561cb106618e9aa )
-+93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.www IN SMIMEA (
-+      0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
-+            7983a1d16e8a410e4561cb106618e9aa )
-+c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._xmimecert.www IN SMIMEA (
-+      0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
-+            7983a1d16e8a410e4561cb106618e9aa )
-+
- outside.org. A 194.28.255.11
- long.outside.org. A 194.28.255.11
- outsidegalaxyplus.org. A 194.28.255.11
-@@ -156,6 +167,37 @@
- x.y.z.zzzz5 A 5.6.7.8 ; DNAME must not have any children (but z.zzzz5.galaxyplus.org exists) - yuck
- zzzz6 DNAME x.y.dk.  ; fine, no induced error
- 
-+@ CAA          ; CAA flag expected
-+  CAA 0        ; CAA tag expected
-+  CAA 45       ; CAA unrecognized flags value
-+  CAA 0 meow   ; CAA unrecognized tag name
-+  CAA 0 x-y    ; CAA tag is not valid
-+  CAA 0 auth   ; CAA reserved tag name
-+  CAA 0 path   ; CAA reserved tag name
-+  CAA 0 policy ; CAA reserved tag name
-+  CAA 0 issue  ; CAA missing tag value
-+  CAA 0 issue ";"   ; fine
-+  CAA 0 issue ";" blah  ; garbage after valid CAA
-+; commented out things are not validated but probably should be
-+;  CAA 0 issue "hello/world" ; CAA invalid issue domain
-+  CAA 0 issue "example.net" ; fine
-+  CAA 0 issue "example.net ;" ; fine
-+;  CAA 0 issue "example.net ; sometag" ; CAA missing issue parameter value
-+;  CAA 0 issue "example.net ; =sometag" ; CAA missing issue parameter tag
-+;  CAA 0 issue "example.net ; sometag=somevalue othertag=othervalue" ; fine
-+  CAA 0 issuewild ";"   ; fine
-+;  CAA 0 issuewild "hello/world" ; CAA invalid issuewild domain
-+  CAA 0 issuewild "example.net" ; fine
-+  CAA 0 issuewild "example.net ;" ; fine
-+;  CAA 0 issuewild "example.net ; sometag" ; CAA missing issuewild parameter value
-+;  CAA 0 issuewild "example.net ; =sometag" ; CAA missing issuewild parameter tag
-+  CAA 0 issuewild "example.net ; sometag=somevalue othertag=othervalue" ; fine
-+;  CAA 0 iodef "hello-world"    ; CAA iodef value not a URL
-+;  CAA 0 iodef "hello:world"    ; CAA iodef value unrecognized URL
-+  CAA 0 iodef "mailto:tobez@tobez.org"    ; fine
-+  CAA 0 iodef "http://example.net"    ; fine
-+  CAA 128 iodef "https://example.net" ; fine
-+
- @       SOA ns1.catpipe.net. hostmaster.catpipe.net. ( ; skipped again
-             2011011400  ; Serial
-             1H  ; Refresh
-diff -Naur validns-0.8/textparse.c validns/textparse.c
---- validns-0.8/textparse.c	2014-02-11 15:44:53.000000000 -0500
-+++ validns/textparse.c	2020-10-05 16:59:29.360681415 -0400
-@@ -26,975 +26,1060 @@
- 
- int empty_line_or_comment(char *s)
- {
--	while (isspace(*s)) s++;
--	if (!*s) return 1;
--	if (*s == ';')	return 1;
--	return 0;
-+    while (isspace(*s)) s++;
-+    if (!*s) return 1;
-+    if (*s == ';')  return 1;
-+    return 0;
- }
- 
- char *skip_white_space(char *s)
- {
--	while (isspace(*s)) s++;
--	if (*s == ';') {
--		while (*s) s++;
--	}
--	if (*s == 0) {
--		if (file_info->paren_mode) {
--			if (fgets(file_info->buf, 2048, file_info->file)) {
--				file_info->line++;
--				return skip_white_space(file_info->buf);
--			} else {
--				return bitch("unexpected end of file");
--			}
--		}
--	}
--	if (*s == '(') {
--		if (file_info->paren_mode) {
--			return bitch("unexpected opening parenthesis");
--		} else {
--			file_info->paren_mode = 1;
--			s++;
--			return skip_white_space(s);
--		}
--	}
--	if (*s == ')') {
--		if (file_info->paren_mode) {
--			file_info->paren_mode = 0;
--			s++;
--			return skip_white_space(s);
--		} else {
--			return bitch("unexpected closing parenthesis");
--		}
--	}
--	return s;
-+    while (isspace(*s)) s++;
-+    if (*s == ';') {
-+        while (*s) s++;
-+    }
-+    if (*s == 0) {
-+        if (file_info->paren_mode) {
-+            if (read_zone_line()) {
-+                return skip_white_space(file_info->buf);
-+            } else {
-+                return bitch("unexpected end of file");
-+            }
-+        }
-+    }
-+    if (*s == '(') {
-+        if (file_info->paren_mode) {
-+            return bitch("unexpected opening parenthesis");
-+        } else {
-+            file_info->paren_mode = 1;
-+            s++;
-+            return skip_white_space(s);
-+        }
-+    }
-+    if (*s == ')') {
-+        if (file_info->paren_mode) {
-+            file_info->paren_mode = 0;
-+            s++;
-+            return skip_white_space(s);
-+        } else {
-+            return bitch("unexpected closing parenthesis");
-+        }
-+    }
-+    return s;
- }
- 
- static char *extract_name_slow(char **input, char *what, int options)
- {
--	char buf[1024];
--	char *t = buf;
--	char *s = *input;
--	int d, l, ol;
--
--	while (1) {
--		if (isalnum(*s) || *s == '_' || *s == '.' || *s == '-' || *s == '/') {
--			if (t-buf >= 1022)
--				return bitch("name too long");
--			*t++ = *s++;
--		} else if (*s == '\\') {
--			s++;
--			if (isdigit(*s)) {
--				d = *s - '0';
--				s++;
--				if (!isdigit(*s))
--					return bitch("bad escape sequence");
--				d = d*10 + *s - '0';
--				s++;
--				if (!isdigit(*s))
--					return bitch("bad escape sequence");
--				d = d*10 + *s - '0';
--				s++;
--				if (d > 255)
--					return bitch("bad escape sequence");
--				if (d == '.')
--					return bitch("a dot within a label is not currently supported");
--				*((unsigned char *)t) = (unsigned char)d;
--				if (t-buf >= 1022)
--					return bitch("name too long");
--				t++;
--			} else if (*s == '.') {
--				return bitch("a dot within a label is not currently supported");
--			} else if (*s) {
--				if (t-buf >= 1022)
--					return bitch("name too long");
--				*t++ = *s++;
--			} else {
--				return bitch("backslash in the end of the line not parsable");
--			}
--		} else {
--			break;
--		}
--	}
--	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--		return bitch("%s is not valid", what);
--	}
--	*t = '\0';
--
--	l = strlen(buf);
--	if (!l)
--		return bitch("%s should not be empty", what);
--
--	if (buf[l-1] != '.') {
--		if (!G.opt.current_origin) {
--			return bitch("do not know origin to determine %s", what);
--		}
--		ol = strlen(G.opt.current_origin);
--		if (G.opt.current_origin[0] == '.') {
--			if (l + ol >= 1023)
--				return bitch("name too long");
--			strcat(buf, G.opt.current_origin);
--		} else {
--			if (l + ol >= 1022)
--				return bitch("name too long");
--			strcat(buf, ".");
--			strcat(buf, G.opt.current_origin);
--		}
--	}
--
--	t = strchr(buf, '*');
--	if (t && (t != buf || t[1] != '.'))
--		return bitch("%s: bad wildcard", what);
--	if (buf[0] == '.' && buf[1] != '\0')
--		return bitch("%s: name cannot start with a dot", what);
--	if (strstr(buf, ".."))
--		return bitch("%s: empty label in a name", what);
--
--	*input = skip_white_space(s);
--	if (!*input)
--		return NULL;  /* bitching's done elsewhere */
--	if (!(options & KEEP_CAPITALIZATION)) {
--		t = buf;
--		while (*t) {
--			*t = tolower(*t);
--			t++;
--		}
--	}
-+    char buf[1024];
-+    char *t = buf;
-+    char *s = *input;
-+    int d, l, ol;
-+
-+    while (1) {
-+        if (isalnum(*s) || *s == '_' || *s == '.' || *s == '-' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$')) {
-+            if (t-buf >= 1022)
-+                return bitch("name too long");
-+            *t++ = *s++;
-+        } else if (*s == '\\') {
-+            s++;
-+            if (isdigit(*s)) {
-+                d = *s - '0';
-+                s++;
-+                if (!isdigit(*s))
-+                    return bitch("bad escape sequence");
-+                d = d*10 + *s - '0';
-+                s++;
-+                if (!isdigit(*s))
-+                    return bitch("bad escape sequence");
-+                d = d*10 + *s - '0';
-+                s++;
-+                if (d > 255)
-+                    return bitch("bad escape sequence");
-+                if (d == '.')
-+                    return bitch("a dot within a label is not currently supported");
-+                *((unsigned char *)t) = (unsigned char)d;
-+                if (t-buf >= 1022)
-+                    return bitch("name too long");
-+                t++;
-+            } else if (*s == '.') {
-+                return bitch("a dot within a label is not currently supported");
-+            } else if (*s) {
-+                if (t-buf >= 1022)
-+                    return bitch("name too long");
-+                *t++ = *s++;
-+            } else {
-+                return bitch("backslash in the end of the line not parsable");
-+            }
-+        } else {
-+            break;
-+        }
-+    }
-+    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+        return bitch("%s is not valid", what);
-+    }
-+    *t = '\0';
-+
-+    l = strlen(buf);
-+    if (!l)
-+        return bitch("%s should not be empty", what);
-+
-+    if (buf[l-1] != '.') {
-+        if (!file_info->current_origin) {
-+            return bitch("do not know origin to determine %s", what);
-+        }
-+        ol = strlen(file_info->current_origin);
-+        if (file_info->current_origin[0] == '.') {
-+            if (l + ol >= 1023)
-+                return bitch("name too long");
-+            strcat(buf, file_info->current_origin);
-+        } else {
-+            if (l + ol >= 1022)
-+                return bitch("name too long");
-+            strcat(buf, ".");
-+            strcat(buf, file_info->current_origin);
-+        }
-+    }
-+
-+    t = strchr(buf, '*');
-+    if (t && (t != buf || t[1] != '.'))
-+        return bitch("%s: bad wildcard", what);
-+    if (buf[0] == '.' && buf[1] != '\0')
-+        return bitch("%s: name cannot start with a dot", what);
-+    if (strstr(buf, ".."))
-+        return bitch("%s: empty label in a name", what);
-+
-+    *input = skip_white_space(s);
-+    if (!*input)
-+        return NULL;  /* bitching's done elsewhere */
-+    if (!(options & KEEP_CAPITALIZATION)) {
-+        t = buf;
-+        while (*t) {
-+            *t = tolower(*t);
-+            t++;
-+        }
-+    }
- 
--	t = quickstrdup(buf);
--	return t;
-+    t = quickstrdup(buf);
-+    return t;
- }
- 
- char *extract_name(char **input, char *what, int options)
- {
--	char *s = *input;
--	char *r = NULL;
--	char *end = NULL;
--	char c;
--	int wildcard = 0;
--
--	if (*s == '@') {
--		s++;
--		if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--			return bitch("literal @ in %s is not all by itself", what);
--		}
--		if (!G.opt.current_origin) {
--			return bitch("do not know origin to expand @ in %s", what);
--		}
--		r = quickstrdup(G.opt.current_origin);
--	} else {
--		if (!(isalnum(*s) || *s == '_' || *s == '.' || *s == '/')) {
--			if (*s == '*') {
--				wildcard = 1;
--			} else {
--				if (*s == '\\')
--					return extract_name_slow(input, what, options);
--				return bitch("%s expected", what);
--			}
--		}
--		s++;
--		while (isalnum(*s) || *s == '.' || *s == '-' || *s == '_' || *s == '/')
--			s++;
--		if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--			if (*s == '\\')
--				return extract_name_slow(input, what, options);
--			return bitch("%s is not valid", what);
--		}
--		if (!*s)	end = s;
--		c = *s;
--		*s = '\0';
--		if (*(s-1) == '.') {
--			r = quickstrdup(*input);
--		} else {
--			if (!G.opt.current_origin) {
--				return bitch("do not know origin to determine %s", what);
--			}
--			r = getmem(strlen(*input) + 1 + strlen(G.opt.current_origin) + 1);
--			if (G.opt.current_origin[0] == '.') {
--				strcpy(mystpcpy(r, *input), G.opt.current_origin);
--			} else {
--				strcpy(mystpcpy(mystpcpy(r, *input), "."), G.opt.current_origin);
--			}
--		}
--		*s = c;
--	}
--	if (end) {
--		*input = end;
--	} else {
--		*input = skip_white_space(s);
--		if (!*input)
--			return NULL;  /* bitching's done elsewhere */
--	}
--	if (!(options & KEEP_CAPITALIZATION)) {
--		s = r;
--		while (*s) {
--			*s = tolower(*s);
--			s++;
--		}
--	}
--	if (wildcard && r[1] != '.') {
--		return bitch("%s: bad wildcard", what);
--	} else if (r[0] == '.' && r[1] != '\0') {
--		return bitch("%s: name cannot start with a dot", what);
--	}
--	return r;
-+    char *s = *input;
-+    char *r = NULL;
-+    char *end = NULL;
-+    char c;
-+    int wildcard = 0;
-+
-+    if (*s == '@') {
-+        s++;
-+        if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+            return bitch("literal @ in %s is not all by itself", what);
-+        }
-+        if (!file_info->current_origin) {
-+            return bitch("do not know origin to expand @ in %s", what);
-+        }
-+        r = quickstrdup(file_info->current_origin);
-+    } else {
-+        if (!(isalnum(*s) || *s == '_' || *s == '.' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$'))) {
-+            if (*s == '*') {
-+                wildcard = 1;
-+            } else {
-+                if (*s == '\\')
-+                    return extract_name_slow(input, what, options);
-+                return bitch("%s expected", what);
-+            }
-+        }
-+        s++;
-+        while (isalnum(*s) || *s == '.' || *s == '-' || *s == '_' || *s == '/' || ((options & DOLLAR_OK_IN_NAMES) && *s == '$'))
-+            s++;
-+        if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+            if (*s == '\\')
-+                return extract_name_slow(input, what, options);
-+            return bitch("%s is not valid", what);
-+        }
-+        if (!*s)    end = s;
-+        c = *s;
-+        *s = '\0';
-+        if (*(s-1) == '.') {
-+            r = quickstrdup(*input);
-+        } else {
-+            if (!file_info->current_origin) {
-+                return bitch("do not know origin to determine %s", what);
-+            }
-+            r = getmem(strlen(*input) + 1 + strlen(file_info->current_origin) + 1);
-+            if (file_info->current_origin[0] == '.') {
-+                strcpy(mystpcpy(r, *input), file_info->current_origin);
-+            } else {
-+                strcpy(mystpcpy(mystpcpy(r, *input), "."), file_info->current_origin);
-+            }
-+        }
-+        *s = c;
-+    }
-+    if (end) {
-+        *input = end;
-+    } else {
-+        *input = skip_white_space(s);
-+        if (!*input)
-+            return NULL;  /* bitching's done elsewhere */
-+    }
-+    if (!(options & KEEP_CAPITALIZATION)) {
-+        s = r;
-+        while (*s) {
-+            *s = tolower(*s);
-+            s++;
-+        }
-+    }
-+    if (wildcard && r[1] != '.') {
-+        return bitch("%s: bad wildcard", what);
-+    } else if (r[0] == '.' && r[1] != '\0') {
-+        return bitch("%s: name cannot start with a dot", what);
-+    }
-+    return r;
- }
- 
- char *extract_label(char **input, char *what, void *is_temporary)
- {
--	char *s = *input;
--	char *r = NULL;
--	char *end = NULL;
--
--	if (!isalpha(*s)) {
--		return bitch("%s expected", what);
--	}
--	s++;
--	while (isalnum(*s))
--		s++;
--	if (*s && !isspace(*s)) {
--		return bitch("%s is not valid", what);
--	}
--	if (!*s)	end = s;
--	*s++ = '\0';
--	if (is_temporary) {
--		r = quickstrdup_temp(*input);
--	} else {
--		r = quickstrdup(*input);
--	}
--
--	if (end) {
--		*input = end;
--	} else {
--		*input = skip_white_space(s);
--		if (!*input)
--			return NULL;  /* bitching's done elsewhere */
--	}
--	s = r;
--	while (*s) {
--		*s = tolower(*s);
--		s++;
--	}
--	return r;
--}
--
--long long extract_integer(char **input, char *what)
--{
--	char *s = *input;
--	long long r = -1;
--	char *end = NULL;
--	char c;
--
--	if (!isdigit(*s)) {
--		bitch("%s expected", what);
--		return -1;
--	}
--	s++;
--	while (isdigit(*s))
--		s++;
--	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--		bitch("%s is not valid", what);
--		return -1;
--	}
--	if (!*s)	end = s;
--	c = *s;
--	*s = '\0';
--	r = strtoll(*input, NULL, 10);
--	*s = c;
--
--	if (end) {
--		*input = end;
--	} else {
--		*input = skip_white_space(s);
--		if (!*input)
--			return -1;  /* bitching's done elsewhere */
--	}
--	return r;
-+    char *s = *input;
-+    char *r = NULL;
-+    char *end = NULL;
-+
-+    if (!isalpha(*s)) {
-+        return bitch("%s expected", what);
-+    }
-+    s++;
-+    while (isalnum(*s))
-+        s++;
-+    if (*s && !isspace(*s)) {
-+        return bitch("%s is not valid", what);
-+    }
-+    if (!*s)    end = s;
-+    *s++ = '\0';
-+    if (is_temporary) {
-+        r = quickstrdup_temp(*input);
-+    } else {
-+        r = quickstrdup(*input);
-+    }
-+
-+    if (end) {
-+        *input = end;
-+    } else {
-+        *input = skip_white_space(s);
-+        if (!*input)
-+            return NULL;  /* bitching's done elsewhere */
-+    }
-+    s = r;
-+    while (*s) {
-+        *s = tolower(*s);
-+        s++;
-+    }
-+    return r;
-+}
-+
-+long long extract_integer(char **input, char *what, const char *extra_delimiters)
-+{
-+    char *s = *input;
-+    long long r = -1;
-+    char *end = NULL;
-+    char c;
-+
-+    if (!isdigit(*s)) {
-+        bitch("%s expected", what);
-+        return -1;
-+    }
-+    s++;
-+    while (isdigit(*s))
-+        s++;
-+    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+        if (!extra_delimiters || strchr(extra_delimiters, *s) == NULL) {
-+            bitch("%s is not valid", what);
-+            return -1;
-+        }
-+    }
-+    if (!*s)    end = s;
-+    c = *s;
-+    *s = '\0';
-+    r = strtoll(*input, NULL, 10);
-+    *s = c;
-+
-+    if (end) {
-+        *input = end;
-+    } else {
-+        *input = skip_white_space(s);
-+        if (!*input)
-+            return -1;  /* bitching's done elsewhere */
-+    }
-+    return r;
- }
- 
- int extract_double(char **input, char *what, double *val, int skip_m)
- {
--	char *s = *input;
--	char *end = NULL;
--	char *stop;
--	char c;
--	int saw_m = 0;
--
--	while (isdigit(*s) || *s == '+' || *s == '-' || *s == '.')
--		s++;
--	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--		if (skip_m && (*s == 'm' || *s == 'M')) {
--			saw_m = 1;
--		} else {
--			bitch("%s is not valid", what);
--			return -1;
--		}
--	}
--	if (!*s)	end = s;
--	c = *s;
--	*s = '\0';
--	*val = strtod(*input, &stop);
--	if (*stop != '\0') {
--		*s = c;
--		bitch("%s is not valid", what);
--		return -1;
--	}
--	*s = c;
--
--	if (saw_m) {
--		s++;
--		if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--			bitch("%s is not valid", what);
--			return -1;
--		}
--	}
--
--	if (end) {
--		*input = end;
--	} else {
--		*input = skip_white_space(s);
--		if (!*input)
--			return -1;  /* bitching's done elsewhere */
--	}
--	return 1;
-+    char *s = *input;
-+    char *end = NULL;
-+    char *stop;
-+    char c;
-+    int saw_m = 0;
-+
-+    while (isdigit(*s) || *s == '+' || *s == '-' || *s == '.')
-+        s++;
-+    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+        if (skip_m && (*s == 'm' || *s == 'M')) {
-+            saw_m = 1;
-+        } else {
-+            bitch("%s is not valid", what);
-+            return -1;
-+        }
-+    }
-+    if (!*s)    end = s;
-+    c = *s;
-+    *s = '\0';
-+    *val = strtod(*input, &stop);
-+    if (*stop != '\0') {
-+        *s = c;
-+        bitch("%s is not valid", what);
-+        return -1;
-+    }
-+    *s = c;
-+
-+    if (saw_m) {
-+        s++;
-+        if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+            bitch("%s is not valid", what);
-+            return -1;
-+        }
-+    }
-+
-+    if (end) {
-+        *input = end;
-+    } else {
-+        *input = skip_white_space(s);
-+        if (!*input)
-+            return -1;  /* bitching's done elsewhere */
-+    }
-+    return 1;
- }
- 
- long extract_timevalue(char **input, char *what)
- {
--	char *s = *input;
--	int r = 0, acc = 0;
-+    char *s = *input;
-+    int r = 0, acc = 0;
- 
--	if (!isdigit(*s)) {
--		bitch("%s expected", what);
--		return -1;
--	}
-+    if (!isdigit(*s)) {
-+        bitch("%s expected", what);
-+        return -1;
-+    }
- next_component:
--	r = 0;
--	while (isdigit(*s)) {
--		r *= 10;
--		r += *s - '0';
--		s++;
--	}
--	if (tolower(*s) == 's') {
--		s++;
--	} else if (tolower(*s) == 'm') {
--		r *= 60;
--		s++;
--	} else if (tolower(*s) == 'h') {
--		r *= 3600;
--		s++;
--	} else if (tolower(*s) == 'd') {
--		r *= 86400;
--		s++;
--	} else if (tolower(*s) == 'w') {
--		r *= 604800;
--		s++;
--	}
--	acc += r;
--	if (isdigit(*s)) goto next_component;
--
--	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--		bitch("%s is not valid", what);
--		return -1;
--	}
--	*input = skip_white_space(s);
--	if (!*input)
--		return -1;  /* bitching's done elsewhere */
--	return acc;
-+    r = 0;
-+    while (isdigit(*s)) {
-+        r *= 10;
-+        r += *s - '0';
-+        s++;
-+    }
-+    if (tolower(*s) == 's') {
-+        s++;
-+    } else if (tolower(*s) == 'm') {
-+        r *= 60;
-+        s++;
-+    } else if (tolower(*s) == 'h') {
-+        r *= 3600;
-+        s++;
-+    } else if (tolower(*s) == 'd') {
-+        r *= 86400;
-+        s++;
-+    } else if (tolower(*s) == 'w') {
-+        r *= 604800;
-+        s++;
-+    }
-+    acc += r;
-+    if (isdigit(*s)) goto next_component;
-+
-+    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+        bitch("%s is not valid", what);
-+        return -1;
-+    }
-+    *input = skip_white_space(s);
-+    if (!*input)
-+        return -1;  /* bitching's done elsewhere */
-+    return acc;
- }
- 
- long long extract_timestamp(char **input, char *what)
- {
--	char *s = *input;
--	int year = 0;
--	int month = 0;
--	int day = 0;
--	int hour = 0;
--	int minute = 0;
--	int second = 0;
--	long long epoch = 0;
--	struct tm tm;
--
--	if (!isdigit(*s)) {
--		bitch("%s expected", what);
--		return -1;
--	}
--	year = year*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (!isdigit(*s)) goto looks_like_epoch;
--	year = year*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (!isdigit(*s)) goto looks_like_epoch;
--	year = year*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (!isdigit(*s)) goto looks_like_epoch;
--	year = year*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (!isdigit(*s)) goto looks_like_epoch;
--	month = month*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (!isdigit(*s)) goto looks_like_epoch;
--	month = month*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (!isdigit(*s)) goto looks_like_epoch;
--	day = day*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (!isdigit(*s)) goto looks_like_epoch;
--	day = day*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (!isdigit(*s)) goto looks_like_epoch;
--	hour = hour*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (!isdigit(*s)) goto looks_like_epoch;
--	hour = hour*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (!isdigit(*s)) goto looks_like_epoch;
--	minute = minute*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (!isdigit(*s)) goto looks_like_epoch;
--	minute = minute*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (!isdigit(*s)) goto looks_like_epoch;
--	second = second*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (!isdigit(*s)) goto looks_like_epoch;
--	second = second*10 + *s - '0';
--	epoch = epoch*10 + *s - '0';
--	s++;
--	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--		bitch("%s is not valid", what);
--		return -1;
--	}
--	if (second > 60 || minute > 59 || hour > 23 || day < 1 || day > 31 ||
--		month > 12 || year < 1900 || year > 2037)
--	{
--		bitch("%s is not valid", what);
--		return -1;
--	}
--	memset(&tm, 0, sizeof(tm));
--	tm.tm_sec = second;
--	tm.tm_min = minute;
--	tm.tm_hour = hour;
--	tm.tm_mday = day;
--	tm.tm_mon = month - 1;
--	tm.tm_year = year - 1900;
--	epoch = mktime(&tm);
--	if (epoch < 0) {
--		bitch("%s is not valid", what);
--		return -1;
--	}
-+    char *s = *input;
-+    int year = 0;
-+    int month = 0;
-+    int day = 0;
-+    int hour = 0;
-+    int minute = 0;
-+    int second = 0;
-+    long long epoch = 0;
-+    struct tm tm;
-+
-+    if (!isdigit(*s)) {
-+        bitch("%s expected", what);
-+        return -1;
-+    }
-+    year = year*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (!isdigit(*s)) goto looks_like_epoch;
-+    year = year*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (!isdigit(*s)) goto looks_like_epoch;
-+    year = year*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (!isdigit(*s)) goto looks_like_epoch;
-+    year = year*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (!isdigit(*s)) goto looks_like_epoch;
-+    month = month*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (!isdigit(*s)) goto looks_like_epoch;
-+    month = month*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (!isdigit(*s)) goto looks_like_epoch;
-+    day = day*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (!isdigit(*s)) goto looks_like_epoch;
-+    day = day*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (!isdigit(*s)) goto looks_like_epoch;
-+    hour = hour*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (!isdigit(*s)) goto looks_like_epoch;
-+    hour = hour*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (!isdigit(*s)) goto looks_like_epoch;
-+    minute = minute*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (!isdigit(*s)) goto looks_like_epoch;
-+    minute = minute*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (!isdigit(*s)) goto looks_like_epoch;
-+    second = second*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (!isdigit(*s)) goto looks_like_epoch;
-+    second = second*10 + *s - '0';
-+    epoch = epoch*10 + *s - '0';
-+    s++;
-+    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+        bitch("%s is not valid", what);
-+        return -1;
-+    }
-+    if (second > 60 || minute > 59 || hour > 23 || day < 1 || day > 31 ||
-+        month > 12 || year < 1900 || year > 2037)
-+    {
-+        bitch("%s is not valid", what);
-+        return -1;
-+    }
-+    memset(&tm, 0, sizeof(tm));
-+    tm.tm_sec = second;
-+    tm.tm_min = minute;
-+    tm.tm_hour = hour;
-+    tm.tm_mday = day;
-+    tm.tm_mon = month - 1;
-+    tm.tm_year = year - 1900;
-+    epoch = mktime(&tm);
-+    if (epoch < 0) {
-+        bitch("%s is not valid", what);
-+        return -1;
-+    }
- 
--	goto done;
-+    goto done;
- 
- looks_like_epoch:
--	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--		bitch("%s is not valid", what);
--		return -1;
--	}
-+    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+        bitch("%s is not valid", what);
-+        return -1;
-+    }
- done:
--	*input = skip_white_space(s);
--	if (!*input)
--		return -1;  /* bitching's done elsewhere */
--	return epoch;
-+    *input = skip_white_space(s);
-+    if (!*input)
-+        return -1;  /* bitching's done elsewhere */
-+    return epoch;
- }
- 
- int extract_ipv4(char **input, char *what, struct in_addr *addr)
- {
--	char *s = *input;
--	char c;
-+    char *s = *input;
-+    char c;
- 
--	while (isdigit(*s) || *s == '.') {
--		s++;
--	}
--	if (s == *input) {
--		bitch("%s is not valid", what);
--		return -1;
--	}
--	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--		bitch("%s is not valid", what);
--		return -1;
--	}
--	c = *s;
--	*s = 0;
--	if (inet_pton(AF_INET, *input, addr) != 1) {
--		*s = c;
--		bitch("cannot parse %s", what);
--		return -1;
--	}
--	*s = c;
--	*input = skip_white_space(s);
--	if (!*input) {
--		return -1;  /* bitching's done elsewhere */
--	}
--	return 1;
-+    while (isdigit(*s) || *s == '.') {
-+        s++;
-+    }
-+    if (s == *input) {
-+        bitch("%s is not valid", what);
-+        return -1;
-+    }
-+    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+        bitch("%s is not valid", what);
-+        return -1;
-+    }
-+    c = *s;
-+    *s = 0;
-+    if (inet_pton(AF_INET, *input, addr) != 1) {
-+        *s = c;
-+        bitch("cannot parse %s", what);
-+        return -1;
-+    }
-+    *s = c;
-+    *input = skip_white_space(s);
-+    if (!*input) {
-+        return -1;  /* bitching's done elsewhere */
-+    }
-+    return 1;
- }
- 
- int extract_ipv6(char **input, char *what, struct in6_addr *addr)
- {
--	char *s = *input;
--	char c;
-+    char *s = *input;
-+    char c;
- 
--	while (isdigit(*s) || *s == ':' || *s == '.' ||
--		  (*s >= 'a' && *s <= 'f') || (*s >= 'A' && *s <= 'F'))
--	{
--		s++;
--	}
--	if (s == *input) {
--		bitch("%s is not valid", what);
--		return -1;
--	}
--	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--		bitch("%s is not valid", what);
--		return -1;
--	}
--	c = *s;
--	*s = 0;
--	if (inet_pton(AF_INET6, *input, addr) != 1) {
--		*s = c;
--		bitch("cannot parse %s", what);
--		return -1;
--	}
--	*s = c;
--	*input = skip_white_space(s);
--	if (!*input) {
--		return -1;  /* bitching's done elsewhere */
--	}
--	return 1;
-+    while (isdigit(*s) || *s == ':' || *s == '.' ||
-+          (*s >= 'a' && *s <= 'f') || (*s >= 'A' && *s <= 'F'))
-+    {
-+        s++;
-+    }
-+    if (s == *input) {
-+        bitch("%s is not valid", what);
-+        return -1;
-+    }
-+    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+        bitch("%s is not valid", what);
-+        return -1;
-+    }
-+    c = *s;
-+    *s = 0;
-+    if (inet_pton(AF_INET6, *input, addr) != 1) {
-+        *s = c;
-+        bitch("cannot parse %s", what);
-+        return -1;
-+    }
-+    *s = c;
-+    *input = skip_white_space(s);
-+    if (!*input) {
-+        return -1;  /* bitching's done elsewhere */
-+    }
-+    return 1;
- }
- 
- int extract_u64(char **input, char *what, uint64_t *r)
- {
--	char *s = *input;
--	uint8_t result = 0;
--	unsigned u;
--
--	#define GETHEXBLOCK if (!isxdigit(*s)) { bitch("%s is not valid", what); return -1; } \
--		u = 0; \
--		while (isxdigit(*s)) { \
--			if (isdigit(*s)) { \
--				u = (u << 4) | (*s - '0'); \
--			} else if (*s >= 'a' && *s <= 'f') { \
--				u = (u << 4) | (*s - 'a' + 10); \
--			} else { \
--				u = (u << 4) | (*s - 'A' + 10); \
--			} \
--			s++; \
--		} \
--		if (u > 0xffff) { bitch("%s is not valid, hex out of range", what); return -1; } \
--		result = (result << 16) | u;
--	#define SKIPCOLON if (*s != ':') { bitch("%s is not valid", what); return -1; } s++;
--
--	GETHEXBLOCK; SKIPCOLON;
--	GETHEXBLOCK; SKIPCOLON;
--	GETHEXBLOCK; SKIPCOLON;
--	GETHEXBLOCK;
--	*r = result;
--
--	#undef GETHEXBLOCK
--	#undef SKIPCOLON
--
--	if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--		bitch("%s is not valid", what);
--		return -1;
--	}
--	*input = skip_white_space(s);
--	if (!*input) {
--		return -1;  /* bitching's done elsewhere */
--	}
--	return 1;
-+    char *s = *input;
-+    uint8_t result = 0;
-+    unsigned u;
-+
-+    #define GETHEXBLOCK if (!isxdigit(*s)) { bitch("%s is not valid", what); return -1; } \
-+        u = 0; \
-+        while (isxdigit(*s)) { \
-+            if (isdigit(*s)) { \
-+                u = (u << 4) | (*s - '0'); \
-+            } else if (*s >= 'a' && *s <= 'f') { \
-+                u = (u << 4) | (*s - 'a' + 10); \
-+            } else { \
-+                u = (u << 4) | (*s - 'A' + 10); \
-+            } \
-+            s++; \
-+        } \
-+        if (u > 0xffff) { bitch("%s is not valid, hex out of range", what); return -1; } \
-+        result = (result << 16) | u;
-+    #define SKIPCOLON if (*s != ':') { bitch("%s is not valid", what); return -1; } s++;
-+
-+    GETHEXBLOCK; SKIPCOLON;
-+    GETHEXBLOCK; SKIPCOLON;
-+    GETHEXBLOCK; SKIPCOLON;
-+    GETHEXBLOCK;
-+    *r = result;
-+
-+    #undef GETHEXBLOCK
-+    #undef SKIPCOLON
-+
-+    if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+        bitch("%s is not valid", what);
-+        return -1;
-+    }
-+    *input = skip_white_space(s);
-+    if (!*input) {
-+        return -1;  /* bitching's done elsewhere */
-+    }
-+    return 1;
- }
- 
- struct binary_data bad_binary_data(void)
- {
--	struct binary_data r;
--	r.length = -1;
--	r.data = NULL;
--	return r;
-+    struct binary_data r;
-+    r.length = -1;
-+    r.data = NULL;
-+    return r;
-+}
-+
-+void
-+dump_binary_data(FILE *f, struct binary_data d)
-+{
-+    char *s = d.data;
-+    int mem_len = d.length;
-+    int i;
-+    char o[69];
-+    int pos[] = { 0,3,6,9,12,15,18,21,25,28,31,34,37,40,43,46 };
-+    char hex[] = "0123456789abcdef";
-+
-+    if (mem_len < 0) {
-+        fprintf(f, "<BAD DATA>\n");
-+        return;
-+    }
-+
-+    while (mem_len) {
-+        memset(o, ' ', 67);
-+        o[67] = '\n';
-+        o[68] = 0;
-+        for (i = 0; i < 16 && mem_len > 0; i++, mem_len--, s++) {
-+            o[pos[i]] = hex[*s >> 4];
-+            o[pos[i]+1] = hex[*s & 0x0f];
-+            o[51+i] = isprint(*s) ? *s : '.';
-+        }
-+        fprintf(f, "%s", o);
-+    }
- }
- 
- struct binary_data extract_base64_binary_data(char **input, char *what)
- {
--	char b64[4096];
--	int l64 = 0;
--	char *s = *input;
--	struct binary_data r = bad_binary_data();
--	int bl;
--
--	while (s && *s) {
--		if (!isalnum(*s) && *s != '=' && *s != '+' && *s != '/') {
--			bitch("%s expected", what);
--			return r;
--		}
--		while (isalnum(*s) || *s == '=' || *s == '+' || *s == '/') {
--			if (l64 >= 4095) {
--				bitch("%s is too long", what);
--				return r;
--			}
--			b64[l64++] = *s++;
--		}
--		s = skip_white_space(s);
--	}
--	*input = s;
--	if (!s)	return r;
--	b64[l64] = 0;
--	bl = (l64 * 3 + 3)/4;
--	r.data = getmem(bl);
--	r.length = decode_base64(r.data, b64, bl);
--	if (r.length < 0) {
--		bitch("error decoding base64 %s", what);
--		return r;
--	}
--	return r;
-+    char b64[4096];
-+    int l64 = 0;
-+    char *s = *input;
-+    struct binary_data r = bad_binary_data();
-+    int bl;
-+
-+    while (s && *s) {
-+        if (!isalnum(*s) && *s != '=' && *s != '+' && *s != '/') {
-+            bitch("%s expected", what);
-+            return r;
-+        }
-+        while (isalnum(*s) || *s == '=' || *s == '+' || *s == '/') {
-+            if (l64 >= 4095) {
-+                bitch("%s is too long", what);
-+                return r;
-+            }
-+            b64[l64++] = *s++;
-+        }
-+        s = skip_white_space(s);
-+    }
-+    *input = s;
-+    if (!s) return r;
-+    b64[l64] = 0;
-+    bl = (l64 * 3 + 3)/4;
-+    r.data = getmem(bl);
-+    r.length = decode_base64(r.data, b64, bl);
-+    if (r.length < 0) {
-+        bitch("error decoding base64 %s", what);
-+        return r;
-+    }
-+    return r;
- }
- 
- struct binary_data extract_base32hex_binary_data(char **input, char *what)
- {
--	char b32[4096];
--	int l32 = 0;
--	char *s = *input;
--	struct binary_data r = bad_binary_data();
--	int bl;
--
--	while (
--		   (*s >= 'A' && *s <= 'V') ||
--		   (*s >= 'a' && *s <= 'v') ||
--		   (*s >= '0' && *s <= '9') ||
--		   *s == '=')
--	{
--		if (l32 >= 4095) {
--			bitch("%s is too long", what);
--			return r;
--		}
--		b32[l32++] = *s++;
--	}
--	if (l32 <= 0) {
--		bitch("%s expected", what);
--		return r;
--	}
--
--	s = skip_white_space(s);
--	*input = s;
--	if (!s)	return r;
--
--	b32[l32] = 0;
--	bl = (l32 * 5 + 7)/8;
--	r.data = getmem(bl);
--	r.length = decode_base32hex(r.data, b32, bl);
--	if (r.length < 0) {
--		bitch("error decoding base32hex %s", what);
--		return r;
--	}
--	return r;
-+    char b32[4096];
-+    int l32 = 0;
-+    char *s = *input;
-+    struct binary_data r = bad_binary_data();
-+    int bl;
-+
-+    while (
-+           (*s >= 'A' && *s <= 'V') ||
-+           (*s >= 'a' && *s <= 'v') ||
-+           (*s >= '0' && *s <= '9') ||
-+           *s == '=')
-+    {
-+        if (l32 >= 4095) {
-+            bitch("%s is too long", what);
-+            return r;
-+        }
-+        b32[l32++] = *s++;
-+    }
-+    if (l32 <= 0) {
-+        bitch("%s expected", what);
-+        return r;
-+    }
-+
-+    s = skip_white_space(s);
-+    *input = s;
-+    if (!s) return r;
-+
-+    b32[l32] = 0;
-+    bl = (l32 * 5 + 7)/8;
-+    r.data = getmem(bl);
-+    r.length = decode_base32hex(r.data, b32, bl);
-+    if (r.length < 0) {
-+        bitch("error decoding base32hex %s", what);
-+        return r;
-+    }
-+    return r;
- }
- 
- struct binary_data extract_text(char **input, char *what)
- {
--	char *s = *input;
--	struct binary_data r = bad_binary_data();
--	char *o = getmem_temp(65536);
--	int l = 0;
--	int c;
--
--	if (*s != '"') {
--		bitch("for now, %s must be put in double quotes", what);
--		return r;
--	}
--	s++;
-+    char *s = *input;
-+    struct binary_data r = bad_binary_data();
-+    char *o = getmem_temp(65536);
-+    int l = 0;
-+    int c;
-+
-+    if (*s != '"') {
-+        while (*s && !isspace(*s)) {
-+            o[l++] = *s++;
-+        }
-+        *input = skip_white_space(s);
-+        if (!*input)
-+            return r;  /* bitching's done elsewhere */
-+
-+        o[l] = 0;
-+        r.data = getmem(l+1);
-+        r.length = l;
-+        memcpy(r.data, o, l+1);
-+        return r;
-+    }
-+    s++;
- more_text:
--	while (*s && *s != '"') {
--		if (*s == '\\') {
--			s++;
--			if (*s == 0) {
--				bitch("bad backslash quoting of %s", what);
--				return r;
--			} else if (isdigit(*s)) {
--				c = 0;
--				while (isdigit(*s)) {
--					c = c*10 + *s - '0';
--					s++;
--				}
--				o[l++] = (unsigned char)c;
--			} else {
--				o[l] = *s;
--				goto new_char;
--			}
--		} else {
--			o[l] = *s;
-+    while (*s && *s != '"') {
-+        if (*s == '\\') {
-+            s++;
-+            if (*s == 0) {
-+                bitch("bad backslash quoting of %s", what);
-+                return r;
-+            } else if (isdigit(*s)) {
-+                c = 0;
-+                while (isdigit(*s)) {
-+                    c = c*10 + *s - '0';
-+                    s++;
-+                }
-+                o[l++] = (unsigned char)c;
-+            } else {
-+                o[l] = *s;
-+                goto new_char;
-+            }
-+        } else {
-+            o[l] = *s;
- new_char:
--			if (l >= 65534) {
--				bitch("%s string too long", what);
--				return r;
--			}
--			l++;
--			s++;
--		}
--	}
--	if (!*s) {
--		if (fgets(file_info->buf, 2048, file_info->file)) {
--			file_info->line++;
--			s = file_info->buf;
--			goto more_text;
--		} else {
--			bitch("closing quote not found while parsing %s", what);
--			return r;
--		}
--	}
--	s++;
--	*input = skip_white_space(s);
--	if (!*input)
--		return r;  /* bitching's done elsewhere */
--
--	o[l] = 0;
--	r.data = getmem(l+1);
--	r.length = l;
--	memcpy(r.data, o, l+1);
--	return r;
-+            if (l >= 65534) {
-+                bitch("%s string too long", what);
-+                return r;
-+            }
-+            l++;
-+            s++;
-+        }
-+    }
-+    if (!*s) {
-+        if (read_zone_line()) {
-+            s = file_info->buf;
-+            goto more_text;
-+        } else {
-+            bitch("closing quote not found while parsing %s", what);
-+            return r;
-+        }
-+    }
-+    s++;
-+    *input = skip_white_space(s);
-+    if (!*input)
-+        return r;  /* bitching's done elsewhere */
-+
-+    o[l] = 0;
-+    r.data = getmem(l+1);
-+    r.length = l;
-+    memcpy(r.data, o, l+1);
-+    return r;
- }
- 
- struct binary_data extract_hex_binary_data(char **input, char *what, int eat_whitespace)
- {
--	char hex[4096];
--	char *s = *input;
--	struct binary_data r = bad_binary_data();
--	int hl, hi, hb;
--
--	hex[0] = '0';
--	hl = 1;
--
--	if (s[0] == '0' && (s[1] == 'x' || s[1] == 'X'))
--		s += 2;
--	if (eat_whitespace == EXTRACT_DONT_EAT_WHITESPACE) {
--		while (isxdigit(*s)) {
--			if (hl >= 4095) {
--				bitch("%s is too long", what);
--				return r;
--			}
--			hex[hl] = *s;
--			s++;
--			hl++;
--		}
--		if (*s && !isspace(*s) && *s != ';' && *s != ')') {
--			bitch("%s is not valid", what);
--			return r;
--		}
--		*input = skip_white_space(s);
--	} else if (eat_whitespace == EXTRACT_EAT_WHITESPACE) {
--		while (s && *s) {
--			if (!isxdigit(*s)) {
--				bitch("%s expected", what);
--				return r;
--			}
--			while (isxdigit(*s)) {
--				if (hl >= 4095) {
--					bitch("%s is too long", what);
--					return r;
--				}
--				hex[hl++] = *s++;
--			}
--			s = skip_white_space(s);
--		}
--		*input = s;
--	} else {
--		bitch("%s: internal: invalid eat_whitespace", what);
--	}
--
--	if (!*input)
--		return r;  /* bitching's done elsewhere */
--
--	hb = hl % 2 ? 1 : 0;
--	if (hb == 0)
--		bitch("%s: hex data does not represent whole number of bytes", what);
--	r.data = getmem(hl/2);
--	r.length = hl/2;
--	memset(r.data, 0, r.length);
--	for (hi = 0; hi < hl-hb; hi++) {
--		r.data[hi/2] <<= 4;
--		r.data[hi/2] |= 0x0f & (isdigit(hex[hi+hb]) ? hex[hi+hb] - '0' : tolower(hex[hi+hb]) - 'a' + 10);
--	}
--	return r;
-+    char hex[4096];
-+    char *s = *input;
-+    struct binary_data r = bad_binary_data();
-+    int hl, hi, hb;
-+
-+    hex[0] = '0';
-+    hl = 1;
-+
-+    if (s[0] == '0' && (s[1] == 'x' || s[1] == 'X'))
-+        s += 2;
-+    if (eat_whitespace == EXTRACT_DONT_EAT_WHITESPACE) {
-+        while (isxdigit(*s)) {
-+            if (hl >= 4095) {
-+                bitch("%s is too long", what);
-+                return r;
-+            }
-+            hex[hl] = *s;
-+            s++;
-+            hl++;
-+        }
-+        if (*s && !isspace(*s) && *s != ';' && *s != ')') {
-+            bitch("%s is not valid", what);
-+            return r;
-+        }
-+        *input = skip_white_space(s);
-+    } else if (eat_whitespace == EXTRACT_EAT_WHITESPACE) {
-+        while (s && *s) {
-+            if (!isxdigit(*s)) {
-+                bitch("%s expected", what);
-+                return r;
-+            }
-+            while (isxdigit(*s)) {
-+                if (hl >= 4095) {
-+                    bitch("%s is too long", what);
-+                    return r;
-+                }
-+                hex[hl++] = *s++;
-+            }
-+            s = skip_white_space(s);
-+        }
-+        *input = s;
-+    } else {
-+        bitch("%s: internal: invalid eat_whitespace", what);
-+    }
-+
-+    if (!*input)
-+        return r;  /* bitching's done elsewhere */
-+
-+    hb = hl % 2 ? 1 : 0;
-+    if (hb == 0)
-+        bitch("%s: hex data does not represent whole number of bytes", what);
-+    r.data = getmem(hl/2);
-+    r.length = hl/2;
-+    memset(r.data, 0, r.length);
-+    for (hi = 0; hi < hl-hb; hi++) {
-+        r.data[hi/2] <<= 4;
-+        r.data[hi/2] |= 0x0f & (isdigit(hex[hi+hb]) ? hex[hi+hb] - '0' : tolower(hex[hi+hb]) - 'a' + 10);
-+    }
-+    return r;
- }
- 
- struct binary_data new_set(void)
- {
--	struct binary_data set;
--	set.length = 256*(1+1+32);
--	set.data = getmem_temp(set.length);
--	memset(set.data, 0, set.length);
--	return set;
-+    struct binary_data set;
-+    set.length = 256*(1+1+32);
-+    set.data = getmem_temp(set.length);
-+    memset(set.data, 0, set.length);
-+    return set;
- }
- 
- void add_bit_to_set(struct binary_data *set, int bit)
- {
--	int map;
--	int map_base;
--	int byte;
--
--	if (bit < 0 || bit > 65535)
--		croakx(1, "bitmap index out of range");
--	map = bit / 256;
--	map_base = map*(1+1+32);
--	set->data[map_base] = map;
--	bit = bit & 0xff;
--	byte = bit / 8;
--	if (set->data[map_base + 1] <= byte)
--		set->data[map_base + 1] = byte+1;
--	set->data[map_base + 2 + byte] |= 0x80 >> (bit & 0x07);
-+    int map;
-+    int map_base;
-+    int byte;
-+
-+    if (bit < 0 || bit > 65535)
-+        croakx(1, "bitmap index out of range");
-+    map = bit / 256;
-+    map_base = map*(1+1+32);
-+    set->data[map_base] = map;
-+    bit = bit & 0xff;
-+    byte = bit / 8;
-+    if (set->data[map_base + 1] <= byte)
-+        set->data[map_base + 1] = byte+1;
-+    set->data[map_base + 2 + byte] |= 0x80 >> (bit & 0x07);
- }
- 
- struct binary_data compressed_set(struct binary_data *set)
- {
--	int len = 0;
--	int map;
--	int map_base;
--	struct binary_data r;
--
--	for (map = 0; map <= 255; map++) {
--		map_base = map*(1+1+32);
--		if (set->data[map_base+1]) {
--			len += 2 + set->data[map_base+1];
--		}
--	}
--	r.length = len;
--	r.data = getmem(r.length);
--	len = 0;
--	for (map = 0; map <= 255; map++) {
--		map_base = map*(1+1+32);
--		if (set->data[map_base+1]) {
--			memcpy(&r.data[len], &set->data[map_base], 2 + set->data[map_base+1]);
--			len += 2 + set->data[map_base+1];
--		}
--	}
--	return r;
-+    int len = 0;
-+    int map;
-+    int map_base;
-+    struct binary_data r;
-+
-+    for (map = 0; map <= 255; map++) {
-+        map_base = map*(1+1+32);
-+        if (set->data[map_base+1]) {
-+            len += 2 + set->data[map_base+1];
-+        }
-+    }
-+    r.length = len;
-+    r.data = getmem(r.length);
-+    len = 0;
-+    for (map = 0; map <= 255; map++) {
-+        map_base = map*(1+1+32);
-+        if (set->data[map_base+1]) {
-+            memcpy(&r.data[len], &set->data[map_base], 2 + set->data[map_base+1]);
-+            len += 2 + set->data[map_base+1];
-+        }
-+    }
-+    return r;
- }
- 
- struct binary_data compose_binary_data(const char *fmt, int tmp, ...)
- {
--	va_list ap;
--	const char *args;
--	int sz;
--	struct binary_data bd;
--	struct binary_data r;
--	char *t;
--	uint8_t b1;
--	uint16_t b2;
--	uint32_t b4;
--	uint64_t b8;
--
--	va_start(ap, tmp);
--	args = fmt;
--	sz = 0;
--	while (*args) {
--		switch (*args++) {
--		case '1':
--			va_arg(ap, unsigned int);
--			sz += 1;
--			break;
--		case '2':
--			va_arg(ap, unsigned int);
--			sz += 2;
--			break;
--		case '4':
--			va_arg(ap, unsigned int);
--			sz += 4;
--			break;
--		case '8':
--			va_arg(ap, uint64_t);
--			sz += 8;
--			break;
--		case 'd':
--			bd = va_arg(ap, struct binary_data);
--			sz += bd.length;
--			break;
--		case 'b':
--			bd = va_arg(ap, struct binary_data);
--			if (bd.length > 255)
--				croak(5, "compose_binary_data: 'b' data too long");
--			sz += bd.length + 1;
--			break;
--		case 'B':
--			bd = va_arg(ap, struct binary_data);
--			if (bd.length > 65535)
--				croak(5, "compose_binary_data: 'B' data too long");
--			sz += bd.length + 2;
--			break;
--		default:
--			croak(5, "compose_binary_data: bad format");
--		}
--	}
--	va_end(ap);
--
--	r.length = sz;
--	r.data = tmp ? getmem_temp(sz) : getmem(sz);
--	t = r.data;
--	va_start(ap, tmp);
--	args = fmt;
--	while (*args) {
--		switch (*args++) {
--		case '1':
--			b1 = (uint8_t)va_arg(ap, unsigned int);
--			memcpy(t, &b1, 1);
--			t += 1;
--			break;
--		case '2':
--			b2 = htons(va_arg(ap, unsigned int));
--			memcpy(t, &b2, 2);
--			t += 2;
--			break;
--		case '4':
--			b4 = htonl(va_arg(ap, unsigned int));
--			memcpy(t, &b4, 4);
--			t += 4;
--			break;
--		case '8':
--			b8 = htonl(va_arg(ap, uint64_t));
--			memcpy(t, &b8, 8);
--			t += 8;
--			break;
--		case 'd':
--			bd = va_arg(ap, struct binary_data);
--			memcpy(t, bd.data, bd.length);
--			t += bd.length;
--			break;
--		case 'b':
--			bd = va_arg(ap, struct binary_data);
--			b1 = (uint8_t)bd.length;
--			memcpy(t, &b1, 1);
--			t += 1;
--			memcpy(t, bd.data, bd.length);
--			t += bd.length;
--			break;
--		case 'B':
--			bd = va_arg(ap, struct binary_data);
--			b2 = htons(bd.length);
--			memcpy(t, &b2, 2);
--			t += 2;
--			memcpy(t, bd.data, bd.length);
--			t += bd.length;
--			break;
--		default:
--			croak(5, "compose_binary_data: bad format");
--		}
--	}
--	va_end(ap);
--	return r;
-+    va_list ap;
-+    const char *args;
-+    int sz;
-+    struct binary_data bd;
-+    struct binary_data r;
-+    char *t;
-+    uint8_t b1;
-+    uint16_t b2;
-+    uint32_t b4;
-+    uint64_t b8;
-+    char *bs;
-+    int bsl;
-+
-+    va_start(ap, tmp);
-+    args = fmt;
-+    sz = 0;
-+    while (*args) {
-+        switch (*args++) {
-+        case '1':
-+            va_arg(ap, unsigned int);
-+            sz += 1;
-+            break;
-+        case '2':
-+            va_arg(ap, unsigned int);
-+            sz += 2;
-+            break;
-+        case '4':
-+            va_arg(ap, unsigned int);
-+            sz += 4;
-+            break;
-+        case '8':
-+            va_arg(ap, uint64_t);
-+            sz += 8;
-+            break;
-+        case 'd':
-+            bd = va_arg(ap, struct binary_data);
-+            sz += bd.length;
-+            break;
-+        case 'b':
-+            bd = va_arg(ap, struct binary_data);
-+            if (bd.length > 255)
-+                croak(5, "compose_binary_data: 'b' data too long");
-+            sz += bd.length + 1;
-+            break;
-+        case 'B':
-+            bd = va_arg(ap, struct binary_data);
-+            if (bd.length > 65535)
-+                croak(5, "compose_binary_data: 'B' data too long");
-+            sz += bd.length + 2;
-+            break;
-+        case 's':
-+            bs = va_arg(ap, char *);
-+            bsl = strlen(bs);
-+            if (bsl > 255)
-+                croak(5, "compose_binary_data: 's' string too long");
-+            sz += bsl + 1;
-+            break;
-+        default:
-+            croak(5, "compose_binary_data: bad format");
-+        }
-+    }
-+    va_end(ap);
-+
-+    r.length = sz;
-+    r.data = tmp ? getmem_temp(sz) : getmem(sz);
-+    t = r.data;
-+    va_start(ap, tmp);
-+    args = fmt;
-+    while (*args) {
-+        switch (*args++) {
-+        case '1':
-+            b1 = (uint8_t)va_arg(ap, unsigned int);
-+            memcpy(t, &b1, 1);
-+            t += 1;
-+            break;
-+        case '2':
-+            b2 = htons(va_arg(ap, unsigned int));
-+            memcpy(t, &b2, 2);
-+            t += 2;
-+            break;
-+        case '4':
-+            b4 = htonl(va_arg(ap, unsigned int));
-+            memcpy(t, &b4, 4);
-+            t += 4;
-+            break;
-+        case '8':
-+            b8 = htonl(va_arg(ap, uint64_t));
-+            memcpy(t, &b8, 8);
-+            t += 8;
-+            break;
-+        case 'd':
-+            bd = va_arg(ap, struct binary_data);
-+            memcpy(t, bd.data, bd.length);
-+            t += bd.length;
-+            break;
-+        case 'b':
-+            bd = va_arg(ap, struct binary_data);
-+            b1 = (uint8_t)bd.length;
-+            memcpy(t, &b1, 1);
-+            t += 1;
-+            memcpy(t, bd.data, bd.length);
-+            t += bd.length;
-+            break;
-+        case 'B':
-+            bd = va_arg(ap, struct binary_data);
-+            b2 = htons(bd.length);
-+            memcpy(t, &b2, 2);
-+            t += 2;
-+            memcpy(t, bd.data, bd.length);
-+            t += bd.length;
-+            break;
-+        case 's':
-+            bs = va_arg(ap, char *);
-+            bsl = strlen(bs);
-+            b1 = (uint8_t)bsl;
-+            memcpy(t, &b1, 1);
-+            t += 1;
-+            memcpy(t, bs, bsl);
-+            t += bsl;
-+            break;
-+        default:
-+            croak(5, "compose_binary_data: bad format");
-+        }
-+    }
-+    va_end(ap);
-+    return r;
- }
- 
- /* implementation taken from FreeBSD's libc (minus the __restrict keyword) */
- char *
- mystpcpy(char *to, const char *from)
- {
--	for (; (*to = *from); ++from, ++to);
--	return(to);
-+    for (; (*to = *from); ++from, ++to);
-+    return(to);
- }
-+
-+size_t
-+mystrlcat(char *dst, const char *src, size_t siz)
-+{
-+    char *d = dst;
-+    const char *s = src;
-+    size_t n = siz;
-+    size_t dlen;
-+
-+    /* Find the end of dst and adjust bytes left but don't go past end */
-+    while (n-- != 0 && *d != '\0')
-+        d++;
-+    dlen = d - dst;
-+    n = siz - dlen;
-+
-+    if (n == 0)
-+        return(dlen + strlen(s));
-+    while (*s != '\0') {
-+        if (n != 1) {
-+            *d++ = *s;
-+            n--;
-+        }
-+        s++;
-+    }
-+    *d = '\0';
-+
-+    return(dlen + (s - src));       /* count does not include NUL */
-+}
-+
-diff -Naur validns-0.8/textparse.h validns/textparse.h
---- validns-0.8/textparse.h	2014-02-11 15:45:46.000000000 -0500
-+++ validns/textparse.h	2020-10-05 16:59:29.361681424 -0400
-@@ -12,10 +12,12 @@
- #include <sys/types.h>
- 
- struct binary_data {
--	int length;
--	char *data;
-+    int length;
-+    char *data;
- };
- 
-+void dump_binary_data(FILE *f, struct binary_data d);
-+
- struct binary_data compose_binary_data(const char *fmt, int tmp, ...);
- /*
-  * Format:
-@@ -28,17 +30,21 @@
-  * B - another binary structure, will incorporate its data,
-  *     and prepend the length as a 16-bit word in NBO,
-  *     fatal error on overflow
-+ * s - a NULL-terminated string, will incorporate the string
-+ *     without the NULL byte, and prepend the string length as a byte
-+ *     (fatal error on overflow)
-  * tmp : allocate temp storage if true, permanent if false
-  *
-  */
- 
- #define KEEP_CAPITALIZATION 32
-+#define DOLLAR_OK_IN_NAMES  64
- 
- int empty_line_or_comment(char *s);
- char *skip_white_space(char *s);
- char *extract_name(char **input, char *what, int options);
- char *extract_label(char **input, char *what, void *is_temporary);
--long long extract_integer(char **input, char *what);
-+long long extract_integer(char **input, char *what, const char *extra_delimiters);
- long extract_timevalue(char **input, char *what);
- long long extract_timestamp(char **input, char *what);
- int extract_ipv4(char **input, char *what, struct in_addr *addr);
-@@ -59,7 +65,9 @@
- void add_bit_to_set(struct binary_data *set, int bit);
- struct binary_data compressed_set(struct binary_data *set);
- 
--/* stpcpy(3) is not available everywhere */
--char *mystpcpy(char *to, const char *from);
-+char *mystpcpy(char *to, const char *from); /* stpcpy(3) is not available everywhere */
-+size_t mystrlcat(char *dst, const char *src, size_t siz); /* so is strlcat */
-+
-+char *read_zone_line(void);
- 
- #endif
-diff -Naur validns-0.8/threads.c validns/threads.c
---- validns-0.8/threads.c	2011-10-31 16:46:21.000000000 -0400
-+++ validns/threads.c	2020-10-05 16:59:29.361681424 -0400
-@@ -7,10 +7,10 @@
- #include <sys/sysctl.h>
- #endif
- 
--/*	supposedly,
--	#if defined(PTW32_VERSION) || defined(__hpux)
--		return pthread_num_processors_np();
--	but I cannot verify that at the moment
-+/*  supposedly,
-+    #if defined(PTW32_VERSION) || defined(__hpux)
-+        return pthread_num_processors_np();
-+    but I cannot verify that at the moment
- */
- 
- #if defined(__GLIBC__)
-@@ -18,16 +18,16 @@
- #elif defined(__APPLE__) || defined(__FreeBSD__)
- int ncpus(void)
- {
--	int count;
--	size_t size=sizeof(count);
--	return sysctlbyname("hw.ncpu",&count,&size,NULL,0) ? 0 : count;
-+    int count;
-+    size_t size=sizeof(count);
-+    return sysctlbyname("hw.ncpu",&count,&size,NULL,0) ? 0 : count;
- }
- #else
- int ncpus(void) { return 0; }  /* "Don't know */
- #endif
- 
--/*	Supposedly, sysconf() can also be used in some cases:
--	#include <unistd.h>
--	int const count=sysconf(_SC_NPROCESSORS_ONLN);
--	return (count>0)?count:0;
-+/*  Supposedly, sysconf() can also be used in some cases:
-+    #include <unistd.h>
-+    int const count=sysconf(_SC_NPROCESSORS_ONLN);
-+    return (count>0)?count:0;
- */
-diff -Naur validns-0.8/tlsa.c validns/tlsa.c
---- validns-0.8/tlsa.c	2014-02-11 15:46:23.000000000 -0500
-+++ validns/tlsa.c	2020-10-05 16:59:29.361681424 -0400
-@@ -21,101 +21,133 @@
- 
- /* See http://www.rfc-editor.org/internet-drafts/draft-ietf-dane-protocol-23.txt
-  * for TLSA description.
-+ * See https://tools.ietf.org/html/draft-ietf-dane-smime-16
-+ * for SMIMEA description.
-  */
- 
--static struct rr* tlsa_parse(char *name, long ttl, int type, char *s)
-+static struct rr* tlsa_smimea_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_tlsa *rr = getmem(sizeof(*rr));
--	int cert_usage, selector, matching_type;
-+    struct rr_tlsa_smimea *rr = getmem(sizeof(*rr));
-+    int cert_usage, selector, matching_type;
- 
--	cert_usage = extract_integer(&s, "certificate usage field");
--	if (cert_usage < 0)	return NULL;
--	if (cert_usage > 3)
--		return bitch("bad certificate usage field");
--	rr->cert_usage = cert_usage;
--
--	selector = extract_integer(&s, "selector field");
--	if (selector < 0)	return NULL;
--	if (selector > 1)
--		return bitch("bad selector field");
--	rr->selector = selector;
--
--	matching_type = extract_integer(&s, "matching type field");
--	if (matching_type < 0)	return NULL;
--	if (matching_type > 2)
--		return bitch("bad matching type field");
--	rr->matching_type = matching_type;
--
--	rr->association_data = extract_hex_binary_data(&s, "certificate association data", EXTRACT_EAT_WHITESPACE);
--	if (rr->association_data.length < 0)	return NULL;
--	switch (rr->matching_type) {
--	case 1:
--		if (rr->association_data.length != SHA256_BYTES)
--			return bitch("bad SHA-256 hash length");
--		break;
--	case 2:
--		if (rr->association_data.length != SHA512_BYTES)
--			return bitch("bad SHA-512 hash length");
--		break;
--	}
--
--	if (*s) {
--		return bitch("garbage after valid TLSA data");
--	}
--	return store_record(type, name, ttl, rr);
-+    cert_usage = extract_integer(&s, "certificate usage field", NULL);
-+    if (cert_usage < 0) return NULL;
-+    if (cert_usage > 3)
-+        return bitch("bad certificate usage field");
-+    rr->cert_usage = cert_usage;
-+
-+    selector = extract_integer(&s, "selector field", NULL);
-+    if (selector < 0)   return NULL;
-+    if (selector > 1)
-+        return bitch("bad selector field");
-+    rr->selector = selector;
-+
-+    matching_type = extract_integer(&s, "matching type field", NULL);
-+    if (matching_type < 0)  return NULL;
-+    if (matching_type > 2)
-+        return bitch("bad matching type field");
-+    rr->matching_type = matching_type;
-+
-+    rr->association_data = extract_hex_binary_data(&s, "certificate association data", EXTRACT_EAT_WHITESPACE);
-+    if (rr->association_data.length < 0)    return NULL;
-+    switch (rr->matching_type) {
-+    case 1:
-+        if (rr->association_data.length != SHA256_BYTES)
-+            return bitch("bad SHA-256 hash length");
-+        break;
-+    case 2:
-+        if (rr->association_data.length != SHA512_BYTES)
-+            return bitch("bad SHA-512 hash length");
-+        break;
-+    }
-+
-+    if (*s) {
-+        return bitch("garbage after valid %s data", type == T_TLSA ? "TLSA" : "SMIMEA");
-+    }
-+    return store_record(type, name, ttl, rr);
- }
- 
--static char* tlsa_human(struct rr *rrv)
-+static char* tlsa_smimea_human(struct rr *rrv)
- {
--	RRCAST(tlsa);
-+    RRCAST(tlsa_smimea);
-     char s[1024];
- 
-     snprintf(s, 1024, "%d %d %d ...",
--		rr->cert_usage, rr->selector, rr->matching_type);
-+        rr->cert_usage, rr->selector, rr->matching_type);
-     return quickstrdup_temp(s);
- }
- 
--static struct binary_data tlsa_wirerdata(struct rr *rrv)
-+static struct binary_data tlsa_smimea_wirerdata(struct rr *rrv)
- {
--	RRCAST(tlsa);
-+    RRCAST(tlsa_smimea);
- 
--	return compose_binary_data("111d", 1,
--		rr->cert_usage, rr->selector, rr->matching_type,
--		rr->association_data);
-+    return compose_binary_data("111d", 1,
-+        rr->cert_usage, rr->selector, rr->matching_type,
-+        rr->association_data);
- }
- 
- static void* tlsa_validate_set(struct rr_set *rr_set)
- {
--	struct rr *rr;
--	struct named_rr *named_rr;
--	char *s;
--	int port = 0;
--	int len;
--
--	if (G.opt.policy_checks[POLICY_TLSA_HOST]) {
--		rr = rr_set->tail;
--		named_rr = rr_set->named_rr;
--
--		/* _25._tcp.mail.example.com. */
--		s = named_rr->name;
--		if (*s != '_') {
-+    struct rr *rr;
-+    struct named_rr *named_rr;
-+    char *s;
-+    int port = 0;
-+    int len;
-+
-+    if (G.opt.policy_checks[POLICY_TLSA_HOST]) {
-+        rr = rr_set->tail;
-+        named_rr = rr_set->named_rr;
-+
-+        /* _25._tcp.mail.example.com. */
-+        s = named_rr->name;
-+        if (*s != '_') {
- not_a_prefixed_domain_name:
--			return moan(rr->file_name, rr->line, "not a proper prefixed DNS domain name");
--		}
--		s++;
--		while (isdigit(*s)) {
--			port = port * 10  + *s - '0';
--			s++;
--		}
--		if (port <= 0 || port > 65535)	goto not_a_prefixed_domain_name;
--		if (*s++ != '.')	goto not_a_prefixed_domain_name;
--		len = strlen(s);
--		if (len < 6)	goto not_a_prefixed_domain_name;
--		if (memcmp(s, "_tcp.", 5) != 0 &&
--			memcmp(s, "_udp.", 5) != 0 &&
--			memcmp(s, "_sctp.", 6) != 0)	goto not_a_prefixed_domain_name;
--	}
--	return NULL;
-+            return moan(rr->file_name, rr->line, "not a proper prefixed DNS domain name");
-+        }
-+        s++;
-+        while (isdigit(*s)) {
-+            port = port * 10  + *s - '0';
-+            s++;
-+        }
-+        if (port <= 0 || port > 65535)  goto not_a_prefixed_domain_name;
-+        if (*s++ != '.')    goto not_a_prefixed_domain_name;
-+        len = strlen(s);
-+        if (len < 6)    goto not_a_prefixed_domain_name;
-+        if (memcmp(s, "_tcp.", 5) != 0 &&
-+            memcmp(s, "_udp.", 5) != 0 &&
-+            memcmp(s, "_sctp.", 6) != 0)    goto not_a_prefixed_domain_name;
-+    }
-+    return NULL;
- }
- 
--struct rr_methods tlsa_methods = { tlsa_parse, tlsa_human, tlsa_wirerdata, tlsa_validate_set, NULL };
-+static void* smimea_validate_set(struct rr_set *rr_set)
-+{
-+    struct rr *rr;
-+    struct named_rr *named_rr;
-+    char *s;
-+    int hash_len = 0;
-+    int len;
-+
-+    if (G.opt.policy_checks[POLICY_SMIMEA_HOST]) {
-+        rr = rr_set->tail;
-+        named_rr = rr_set->named_rr;
-+
-+        /* c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com. */
-+        s = named_rr->name;
-+        while (isxdigit(*s)) {
-+            hash_len++;
-+            s++;
-+        }
-+        if (*s++ != '.' || hash_len != 56) {
-+not_a_proper_smimea_domainname:
-+            return moan(rr->file_name, rr->line, "not a proper domain name for an SMIMEA record");
-+        }
-+        len = strlen(s);
-+        if (len < 11)    goto not_a_proper_smimea_domainname;
-+        if (memcmp(s, "_smimecert.", 11) != 0)    goto not_a_proper_smimea_domainname;
-+    }
-+    return NULL;
-+}
-+
-+struct rr_methods tlsa_methods = { tlsa_smimea_parse, tlsa_smimea_human, tlsa_smimea_wirerdata, tlsa_validate_set, NULL };
-+struct rr_methods smimea_methods = { tlsa_smimea_parse, tlsa_smimea_human, tlsa_smimea_wirerdata, smimea_validate_set, NULL };
-diff -Naur validns-0.8/txt.c validns/txt.c
---- validns-0.8/txt.c	2014-02-11 15:45:53.000000000 -0500
-+++ validns/txt.c	2020-10-05 16:59:29.361681424 -0400
-@@ -22,62 +22,72 @@
- 
- static struct rr *txt_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_txt *rr;
--	struct binary_data txt[20];
--	int i;
--
--	i = 0;
--	while (*s) {
--		if (i >= 20)
--			return bitch("program limit: too many text segments");
--		txt[i] = extract_text(&s, "text segment");
--		if (txt[i].length < 0)
--			return NULL;
--		if (txt[i].length > 255)
--			return bitch("TXT segment too long");
--		i++;
--	}
--	if (i == 0)
--		return bitch("empty text record");
--
--   	rr = getmem(sizeof(*rr) + sizeof(struct binary_data) * (i-1));
--	rr->count = i;
--	for (i = 0; i < rr->count; i++) {
--		rr->txt[i] = txt[i];
--	}
-+    struct rr_txt *rr;
-+    struct binary_data txt;
-+    struct rr_txt_segment *first = NULL;
-+    struct rr_txt_segment *last  = NULL;
-+    struct rr_txt_segment *cur   = NULL;
-+    int i;
-+
-+    i = 0;
-+    while (*s) {
-+        freeall_temp();
-+        txt = extract_text(&s, "text segment");
-+        if (txt.length < 0)
-+            return NULL;
-+        if (txt.length > 255)
-+            return bitch("TXT segment too long");
-+        i++;
-+        cur = getmem(sizeof(*cur));
-+        cur->txt = txt;
-+        cur->next = NULL;
-+        if (!first)
-+            first = cur;
-+        if (last)
-+            last->next = cur;
-+        last = cur;
-+    }
-+    if (i == 0)
-+        return bitch("empty text record");
-+
-+    rr = getmem(sizeof(*rr));
-+    rr->count = i;
-+    rr->txt = first;
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* txt_human(struct rr *rrv)
- {
--	RRCAST(txt);
-+    RRCAST(txt);
-     char ss[1024];
--	int i;
--	char *s = ss;
--	int l;
--
--	for (i = 0; i < rr->count; i++) {
--		/* XXX would be nice to escape " with \ in strings */
--		l = snprintf(s, 1024-(s-ss), "\"%s\" ", rr->txt[i].data);
--		s += l;
--	}
-+    char *s = ss;
-+    int l;
-+    struct rr_txt_segment *seg = rr->txt;
-+
-+    while (seg) {
-+        /* XXX would be nice to escape " with \ in strings */
-+        l = snprintf(s, 1024-(s-ss), "\"%s\" ", seg->txt.data);
-+        s += l;
-+        seg = seg->next;
-+    }
-     return quickstrdup_temp(ss);
- }
- 
- static struct binary_data txt_wirerdata(struct rr *rrv)
- {
--	RRCAST(txt);
--	struct binary_data r, t;
--	int i;
--
--	r = bad_binary_data();
--	t.length = 0;
--	t.data = NULL;
--	for (i = 0; i < rr->count; i++) {
--		r = compose_binary_data("db", 1, t, rr->txt[i]);
--		t = r;
--	}
-+    RRCAST(txt);
-+    struct binary_data r, t;
-+    struct rr_txt_segment *seg = rr->txt;
-+
-+    r = bad_binary_data();
-+    t.length = 0;
-+    t.data = NULL;
-+    while (seg) {
-+        r = compose_binary_data("db", 1, t, seg->txt);
-+        t = r;
-+        seg = seg->next;
-+    }
-     return r;
- }
- 
-diff -Naur validns-0.8/usage.mdwn validns/usage.mdwn
---- validns-0.8/usage.mdwn	2020-10-05 16:54:14.347790456 -0400
-+++ validns/usage.mdwn	2020-10-05 16:59:29.361681424 -0400
-@@ -48,6 +48,8 @@
- 	- ns-alias
- 	- rp-txt-exists
- 	- tlsa-host
-+	- ksk-exists
-+	- smimea-host
- 	- all
- 
- -n *N*
-@@ -59,14 +61,15 @@
- :   quiet - do not produce any output
- 
- -s
--:   print validation summary/stats
--
---x
--:   skip printing 'time taken' in summary/stats
-+:   Print validation summary/stats.
-+    If specified twice, also print record counts by type.
- 
- -v
- :   be extra verbose
- 
-+-M
-+:   use SOA MINTTL as the default TTL when no TTL specified
-+
- -I *path*
- :   use this path for $INCLUDE files
- 
-@@ -133,12 +136,12 @@
- - TXT domain name mentioned in RP record must have
-   a corresponding TXT record if it is within the zone
- - domain name of a TLSA record must be a proper prefixed DNS name
-+- a KSK key must exist in a signed zone
-+- domain name must have the form which is proper for an SMIMEA record
- 
- # BUGS
- 
- - textual segments in *TXT* and *HINFO* must be enclosed in double quotes;
--- there cannot be more than 20 textual segments in a *TXT* record;
--- *$INCLUDE* directive is not implemented;
- - a dot within a label is not currently supported;
- 
- If at least one NSEC3 record uses opt-out flag,
-diff -Naur validns-0.8/validns.1 validns/validns.1
---- validns-0.8/validns.1	2020-10-05 16:54:14.347790456 -0400
-+++ validns/validns.1	2020-10-05 16:59:29.361681424 -0400
-@@ -1,4 +1,4 @@
--.TH VALIDNS 1 "April 2011" 
-+.TH "VALIDNS" "1" "April 2011" "" ""
- .SH NAME
- .PP
- validns \- DNS and DSNSEC zone file validator
-@@ -53,6 +53,10 @@
- .IP \[bu] 2
- tlsa\-host
- .IP \[bu] 2
-+ksk\-exists
-+.IP \[bu] 2
-+smimea\-host
-+.IP \[bu] 2
- all
- .RE
- .TP
-@@ -69,17 +73,18 @@
- .RE
- .TP
- .B \-s
--print validation summary/stats
-+Print validation summary/stats.
-+If specified twice, also print record counts by type.
- .RS
- .RE
- .TP
--.B -x
--skip printing timing summary/stats
-+.B \-v
-+be extra verbose
- .RS
- .RE
- .TP
--.B \-v
--be extra verbose
-+.B \-M
-+use SOA MINTTL as the default TTL when no TTL specified
- .RS
- .RE
- .TP
-@@ -183,15 +188,15 @@
- record if it is within the zone
- .IP \[bu] 2
- domain name of a TLSA record must be a proper prefixed DNS name
-+.IP \[bu] 2
-+a KSK key must exist in a signed zone
-+.IP \[bu] 2
-+domain name must have the form which is proper for an SMIMEA record
- .SH BUGS
- .IP \[bu] 2
- textual segments in \f[I]TXT\f[] and \f[I]HINFO\f[] must be enclosed in
- double quotes;
- .IP \[bu] 2
--there cannot be more than 20 textual segments in a \f[I]TXT\f[] record;
--.IP \[bu] 2
--\f[I]$INCLUDE\f[] directive is not implemented;
--.IP \[bu] 2
- a dot within a label is not currently supported;
- .PP
- If at least one NSEC3 record uses opt\-out flag, \f[C]validns\f[]
-diff -Naur validns-0.8/x25.c validns/x25.c
---- validns-0.8/x25.c	2014-02-11 15:46:55.000000000 -0500
-+++ validns/x25.c	2020-10-05 16:59:29.361681424 -0400
-@@ -23,40 +23,40 @@
- 
- static struct rr *x25_parse(char *name, long ttl, int type, char *s)
- {
--	struct rr_x25 *rr = getmem(sizeof(*rr));
--	int i;
-+    struct rr_x25 *rr = getmem(sizeof(*rr));
-+    int i;
- 
--	rr->psdn_address = extract_text(&s, "PSDN-address");
--	if (rr->psdn_address.length < 0)
--		return NULL;
--	if (rr->psdn_address.length > 255)
--		return bitch("PSDN-address too long");
--	if (rr->psdn_address.length < 4)
--		return bitch("PSDN-address too short");
--	for (i = 0; i < rr->psdn_address.length; i++) {
--		if (!isdigit(rr->psdn_address.data[i]))
--			return bitch("PSDN-address contains non-digits");
--	}
--
--	if (*s) {
--		return bitch("garbage after valid X25 data");
--	}
-+    rr->psdn_address = extract_text(&s, "PSDN-address");
-+    if (rr->psdn_address.length < 0)
-+        return NULL;
-+    if (rr->psdn_address.length > 255)
-+        return bitch("PSDN-address too long");
-+    if (rr->psdn_address.length < 4)
-+        return bitch("PSDN-address too short");
-+    for (i = 0; i < rr->psdn_address.length; i++) {
-+        if (!isdigit(rr->psdn_address.data[i]))
-+            return bitch("PSDN-address contains non-digits");
-+    }
-+
-+    if (*s) {
-+        return bitch("garbage after valid X25 data");
-+    }
- 
--	return store_record(type, name, ttl, rr);
-+    return store_record(type, name, ttl, rr);
- }
- 
- static char* x25_human(struct rr *rrv)
- {
--	RRCAST(x25);
-+    RRCAST(x25);
- 
-     return rr->psdn_address.data;
- }
- 
- static struct binary_data x25_wirerdata(struct rr *rrv)
- {
--	RRCAST(x25);
-+    RRCAST(x25);
- 
--	return compose_binary_data("b", 1, rr->psdn_address);
-+    return compose_binary_data("b", 1, rr->psdn_address);
- }
- 
- struct rr_methods x25_methods = { x25_parse, x25_human, x25_wirerdata, NULL, NULL };
diff --git a/validns-0.8-openssl-1.1.patch b/validns-0.8-openssl-1.1.patch
deleted file mode 100644
index f20384c..0000000
--- a/validns-0.8-openssl-1.1.patch
+++ /dev/null
@@ -1,248 +0,0 @@
-From: Author: "Chris West (Faux)" <git@goeswhere.com>
-Date: Fri, 22 Feb 2019 23:39:34 +0100
-Subject: [PATCH] fix compilation on openssl 1.1
-
-BTS: https://bugs.debian.org/859784
-bigeasy: drop locking, check for OOM during allocation.
-Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
----
- dnskey.c      |  9 +++++--
- nsec3checks.c | 29 +++++++++++++---------
- rrsig.c       | 69 ++++++++++++++-------------------------------------
- 3 files changed, 42 insertions(+), 65 deletions(-)
-
-diff --git a/dnskey.c b/dnskey.c
-index fecc62abfd21..fda220c14d08 100644
---- a/dnskey.c
-+++ b/dnskey.c
-@@ -154,6 +154,7 @@ int dnskey_build_pkey(struct rr_dnskey *rr)
- 		unsigned int e_bytes;
- 		unsigned char *pk;
- 		int l;
-+		BIGNUM *n, *e;
- 
- 		rsa = RSA_new();
- 		if (!rsa)
-@@ -174,11 +175,15 @@ int dnskey_build_pkey(struct rr_dnskey *rr)
- 		if (l < e_bytes) /* public key is too short */
- 			goto done;
- 
--		rsa->e = BN_bin2bn(pk, e_bytes, NULL);
-+		e = BN_bin2bn(pk, e_bytes, NULL);
- 		pk += e_bytes;
- 		l -= e_bytes;
- 
--		rsa->n = BN_bin2bn(pk, l, NULL);
-+		n = BN_bin2bn(pk, l, NULL);
-+		if (!e || !n)
-+			goto done;
-+
-+		RSA_set0_key(rsa, n, e, NULL);
- 
- 		pkey = EVP_PKEY_new();
- 		if (!pkey)
-diff --git a/nsec3checks.c b/nsec3checks.c
-index 69c655345bad..2abac9efa1bf 100644
---- a/nsec3checks.c
-+++ b/nsec3checks.c
-@@ -28,7 +28,7 @@
- static struct binary_data name2hash(char *name, struct rr *param)
- {
-     struct rr_nsec3param *p = (struct rr_nsec3param *)param;
--	EVP_MD_CTX ctx;
-+	EVP_MD_CTX *ctx;
- 	unsigned char md0[EVP_MAX_MD_SIZE];
- 	unsigned char md1[EVP_MAX_MD_SIZE];
- 	unsigned char *md[2];
-@@ -45,26 +45,31 @@ static struct binary_data name2hash(char *name, struct rr *param)
- 
- 	/* XXX Maybe use Init_ex and Final_ex for speed? */
- 
--	EVP_MD_CTX_init(&ctx);
--	if (EVP_DigestInit(&ctx, EVP_sha1()) != 1)
-+	ctx = EVP_MD_CTX_new();
-+	if (ctx == NULL)
- 		return r;
--	digest_size = EVP_MD_CTX_size(&ctx);
--	EVP_DigestUpdate(&ctx, wire_name.data, wire_name.length);
--	EVP_DigestUpdate(&ctx, p->salt.data, p->salt.length);
--	EVP_DigestFinal(&ctx, md[mdi], NULL);
-+	if (EVP_DigestInit(ctx, EVP_sha1()) != 1)
-+		goto out;
-+	digest_size = EVP_MD_CTX_size(ctx);
-+	EVP_DigestUpdate(ctx, wire_name.data, wire_name.length);
-+	EVP_DigestUpdate(ctx, p->salt.data, p->salt.length);
-+	EVP_DigestFinal(ctx, md[mdi], NULL);
- 
- 	for (i = 0; i < p->iterations; i++) {
--		if (EVP_DigestInit(&ctx, EVP_sha1()) != 1)
--			return r;
--		EVP_DigestUpdate(&ctx, md[mdi], digest_size);
-+		if (EVP_DigestInit(ctx, EVP_sha1()) != 1)
-+			goto out;
-+
-+		EVP_DigestUpdate(ctx, md[mdi], digest_size);
- 		mdi = (mdi + 1) % 2;
--		EVP_DigestUpdate(&ctx, p->salt.data, p->salt.length);
--		EVP_DigestFinal(&ctx, md[mdi], NULL);
-+		EVP_DigestUpdate(ctx, p->salt.data, p->salt.length);
-+		EVP_DigestFinal(ctx, md[mdi], NULL);
- 	}
- 
- 	r.length = digest_size;
- 	r.data = getmem(digest_size);
- 	memcpy(r.data, md[mdi], digest_size);
-+out:
-+	EVP_MD_CTX_free(ctx);
- 	return r;
- }
- 
-diff --git a/rrsig.c b/rrsig.c
-index 81f24b4c49da..0a9e864285d0 100644
---- a/rrsig.c
-+++ b/rrsig.c
-@@ -26,7 +26,7 @@
- struct verification_data
- {
- 	struct verification_data *next;
--	EVP_MD_CTX ctx;
-+	EVP_MD_CTX *ctx;
- 	struct rr_dnskey *key;
- 	struct rr_rrsig *rr;
- 	int ok;
-@@ -180,7 +180,7 @@ void *verification_thread(void *dummy)
- 		if (d) {
- 			int r;
- 			d->next = NULL;
--			r = EVP_VerifyFinal(&d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
-+			r = EVP_VerifyFinal(d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
- 			if (r == 1) {
- 				d->ok = 1;
- 			} else {
-@@ -232,7 +232,7 @@ static void schedule_verification(struct verification_data *d)
- 	} else {
- 		int r;
- 		G.stats.signatures_verified++;
--		r = EVP_VerifyFinal(&d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
-+		r = EVP_VerifyFinal(d->ctx, (unsigned char *)d->rr->signature.data, d->rr->signature.length, d->key->pkey);
- 		if (r == 1) {
- 			d->ok = 1;
- 		} else {
-@@ -250,21 +250,24 @@ static int verify_signature(struct verification_data *d, struct rr_set *signed_s
- 	struct rr *signed_rr;
- 	int i;
- 
--	EVP_MD_CTX_init(&d->ctx);
-+	d->ctx = EVP_MD_CTX_new();
-+	if (!d->ctx)
-+		return 0;
-+
- 	switch (d->rr->algorithm) {
- 	case ALG_DSA:
- 	case ALG_RSASHA1:
- 	case ALG_DSA_NSEC3_SHA1:
- 	case ALG_RSASHA1_NSEC3_SHA1:
--		if (EVP_VerifyInit(&d->ctx, EVP_sha1()) != 1)
-+		if (EVP_VerifyInit(d->ctx, EVP_sha1()) != 1)
- 			return 0;
- 		break;
- 	case ALG_RSASHA256:
--		if (EVP_VerifyInit(&d->ctx, EVP_sha256()) != 1)
-+		if (EVP_VerifyInit(d->ctx, EVP_sha256()) != 1)
- 			return 0;
- 		break;
- 	case ALG_RSASHA512:
--		if (EVP_VerifyInit(&d->ctx, EVP_sha512()) != 1)
-+		if (EVP_VerifyInit(d->ctx, EVP_sha512()) != 1)
- 			return 0;
- 		break;
- 	default:
-@@ -274,7 +277,7 @@ static int verify_signature(struct verification_data *d, struct rr_set *signed_s
- 	chunk = rrsig_wirerdata_ex(&d->rr->rr, 0);
- 	if (chunk.length < 0)
- 		return 0;
--	EVP_VerifyUpdate(&d->ctx, chunk.data, chunk.length);
-+	EVP_VerifyUpdate(d->ctx, chunk.data, chunk.length);
- 
- 	set = getmem_temp(sizeof(*set) * signed_set->count);
- 
-@@ -294,12 +297,12 @@ static int verify_signature(struct verification_data *d, struct rr_set *signed_s
- 		chunk = name2wire_name(signed_set->named_rr->name);
- 		if (chunk.length < 0)
- 			return 0;
--		EVP_VerifyUpdate(&d->ctx, chunk.data, chunk.length);
--		b2 = htons(set[i].rr->rdtype);    EVP_VerifyUpdate(&d->ctx, &b2, 2);
--		b2 = htons(1);  /* class IN */   EVP_VerifyUpdate(&d->ctx, &b2, 2);
--		b4 = htonl(set[i].rr->ttl);       EVP_VerifyUpdate(&d->ctx, &b4, 4);
--		b2 = htons(set[i].wired.length); EVP_VerifyUpdate(&d->ctx, &b2, 2);
--		EVP_VerifyUpdate(&d->ctx, set[i].wired.data, set[i].wired.length);
-+		EVP_VerifyUpdate(d->ctx, chunk.data, chunk.length);
-+		b2 = htons(set[i].rr->rdtype);    EVP_VerifyUpdate(d->ctx, &b2, 2);
-+		b2 = htons(1);  /* class IN */   EVP_VerifyUpdate(d->ctx, &b2, 2);
-+		b4 = htonl(set[i].rr->ttl);       EVP_VerifyUpdate(d->ctx, &b4, 4);
-+		b2 = htons(set[i].wired.length); EVP_VerifyUpdate(d->ctx, &b2, 2);
-+		EVP_VerifyUpdate(d->ctx, set[i].wired.data, set[i].wired.length);
- 	}
- 
- 	schedule_verification(d);
-@@ -371,49 +374,12 @@ static void *rrsig_validate(struct rr *rrv)
- 	return rr;
- }
- 
--static pthread_mutex_t *lock_cs;
--static long *lock_count;
--
--static unsigned long pthreads_thread_id(void)
--{
--	unsigned long ret;
--
--	ret=(unsigned long)pthread_self();
--	return(ret);
--}
--
--static void pthreads_locking_callback(int mode, int type, char *file, int line)
--{
--	if (mode & CRYPTO_LOCK) {
--		pthread_mutex_lock(&(lock_cs[type]));
--		lock_count[type]++;
--	} else {
--		pthread_mutex_unlock(&(lock_cs[type]));
--	}
--}
--
- void verify_all_keys(void)
- {
- 	struct keys_to_verify *k = all_keys_to_verify;
- 	int i;
- 	struct timespec sleep_time;
- 
--	ERR_load_crypto_strings();
--	if (G.opt.n_threads > 1) {
--		lock_cs = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
--		lock_count = OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long));
--		for (i = 0; i < CRYPTO_num_locks(); i++) {
--			lock_count[i] = 0;
--			pthread_mutex_init(&lock_cs[i],NULL);
--		}
--
--		CRYPTO_set_id_callback((unsigned long (*)())pthreads_thread_id);
--		CRYPTO_set_locking_callback((void (*)())pthreads_locking_callback);
--
--		if (pthread_mutex_init(&queue_lock, NULL) != 0)
--			croak(1, "pthread_mutex_init");
--	}
--
- 	while (k) {
- 		freeall_temp();
- 		for (i = 0; i < k->n_keys; i++) {
-@@ -446,6 +412,7 @@ void verify_all_keys(void)
- 				if (k->to_verify[i].openssl_error != 0)
- 					e = k->to_verify[i].openssl_error;
- 			}
-+			EVP_MD_CTX_free(k->to_verify[i].ctx);
- 		}
- 		if (!ok) {
- 			struct named_rr *named_rr;
--- 
-2.20.1
-
diff --git a/validns-0.8-s390-mempool.patch b/validns-0.8-s390-mempool.patch
deleted file mode 100644
index 6cad683..0000000
--- a/validns-0.8-s390-mempool.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff -Naur validns-0.8-orig/mempool.c validns-0.8/mempool.c
---- validns-0.8-orig/mempool.c	2014-02-11 15:47:03.000000000 -0500
-+++ validns-0.8/mempool.c	2020-10-05 20:53:47.014892762 -0400
-@@ -91,12 +91,16 @@
- 
- char *quickstrdup(char *s)
- {
-+	if (s == NULL)
-+		return NULL;
- 	char *r = getmem(strlen(s)+1);
--	return strcpy(r, s);
-+	return strncpy(r, s, strlen(r) -1);
- }
- 
- char *quickstrdup_temp(char *s)
- {
-+	if (s == NULL)
-+		return NULL;
- 	char *r = getmem_temp(strlen(s)+1);
--	return strcpy(r, s);
-+	return strncpy(r, s, strlen(r) -1);
- }
diff --git a/validns-0.8-timing.patch b/validns-0.8-timing.patch
deleted file mode 100644
index e085a6e..0000000
--- a/validns-0.8-timing.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-diff -Naur validns-0.8-orig/common.h validns-0.8/common.h
---- validns-0.8-orig/common.h	2020-10-05 17:25:53.814455909 -0400
-+++ validns-0.8/common.h	2020-10-05 17:26:58.696957376 -0400
-@@ -72,6 +72,7 @@
- 		int die_on_first_error;
- 		int no_output;
- 		int summary;
-+		int notiming;
- 		int verbose;
- 		char *include_path;
- 		int include_path_specified;
-diff -Naur validns-0.8-orig/main.c validns-0.8/main.c
---- validns-0.8-orig/main.c	2020-10-05 17:25:53.815455917 -0400
-+++ validns-0.8/main.c	2020-10-05 17:28:34.536698118 -0400
-@@ -447,6 +447,7 @@
- 	fprintf(stderr, "\t-n N\t\tuse N worker threads\n");
- 	fprintf(stderr, "\t-q\t\tquiet - do not produce any output\n");
- 	fprintf(stderr, "\t-s\t\tprint validation summary/stats\n");
-+	fprintf(stderr, "\t-x\t\tskip printing 'time taken' entry in summary/stats\n");
- 	fprintf(stderr, "\t-v\t\tbe extra verbose\n");
- 	fprintf(stderr, "\t-I path\tuse this path for $INCLUDE files\n");
- 	fprintf(stderr, "\t-z origin\tuse this origin as initial $ORIGIN\n");
-@@ -523,7 +524,7 @@
- 	struct timeval start, stop;
- 
- 	initialize_globals();
--	while ((o = getopt(argc, argv, "fhMqsvI:z:t:p:n:")) != -1) {
-+	while ((o = getopt(argc, argv, "fhMqsxvI:z:t:p:n:")) != -1) {
- 		switch(o) {
- 		case 'h':
- 			usage(NULL);
-@@ -540,6 +541,9 @@
- 		case 's':
- 			G.opt.summary = 1;
- 			break;
-+		case 'x':
-+			G.opt.notiming = 1;
-+			break;
- 		case 'v':
- 			G.opt.verbose = 1;
- 			break;
-@@ -635,8 +639,10 @@
- 			   "                     %d\n", G.stats.not_authoritative);
- 		printf("validation errors:   %d\n", G.stats.error_count);
- 		printf("signatures verified: %d\n", G.stats.signatures_verified);
--		printf("time taken:          %.3fs\n",
-+		if (!G.opt.notiming) {
-+			printf("time taken:          %.3fs\n",
- 			   stop.tv_sec - start.tv_sec + (stop.tv_usec - start.tv_usec)/1000000.);
-+		}
- 	}
- 	return G.exit_code;
- }
-diff -Naur validns-0.8-orig/usage.mdwn validns-0.8/usage.mdwn
---- validns-0.8-orig/usage.mdwn	2020-10-05 17:25:53.817455933 -0400
-+++ validns-0.8/usage.mdwn	2020-10-05 17:28:54.400851630 -0400
-@@ -62,6 +62,9 @@
- -s
- :   print validation summary/stats
- 
-+-x
-+:   skip printing 'time taken' in summary/stats
-+
- -v
- :   be extra verbose
- 
-diff -Naur validns-0.8-orig/validns.1 validns-0.8/validns.1
---- validns-0.8-orig/validns.1	2020-10-05 17:25:53.818455940 -0400
-+++ validns-0.8/validns.1	2020-10-05 17:29:25.670093291 -0400
-@@ -75,6 +75,11 @@
- .RS
- .RE
- .TP
-+.B -x
-+skip printing timing summary/stats
-+.RS
-+.RE
-+.TP
- .B \-v
- be extra verbose
- .RS
diff --git a/validns.spec b/validns.spec
deleted file mode 100644
index 81e05b6..0000000
--- a/validns.spec
+++ /dev/null
@@ -1,160 +0,0 @@
-%global _hardened_build 1
-
-Summary: DNS and DNSSEC zone file validator
-Name: validns
-Version: 0.8
-Release: 24%{?dist}
-License: BSD
-Url:  http://www.validns.net/
-Source: http://www.validns.net/download/%{name}-%{version}.tar.gz
-
-Patch1: validns-0.8-Wformat-truncation.patch
-Patch2: validns-0.8-git20160720.patch
-Patch3: validns-0.8-Makefile.patch
-Patch4: validns-0.8-openssl-1.1.patch
-Patch5: validns-0.8-timing.patch
-Patch6: validns-0.8-s390-mempool.patch
-
-BuildRequires: make
-BuildRequires:  gcc
-BuildRequires: Judy-devel, openssl-devel
-
-%description
-DNS and DNSSEC zone file validator. It comes with no man page and no
-useful README or information, but it's a nice tool anyway :)
-
-%prep
-%autosetup -p1
-
-%build
-%make_build
-gzip validns.1
-
-%install
-mkdir -p %{buildroot}/%{_bindir} %{buildroot}/%{_mandir}/man1/
-install -m 755 validns %{buildroot}/%{_bindir}/
-cp -a validns.1.gz %{buildroot}/%{_mandir}/man1/
-
-%files
-%doc LICENSE README
-%{_bindir}/validns
-%{_mandir}/man1/validns.1.gz
-
-%changelog
-* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-24
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-23
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-22
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 0.8-21
-- Rebuilt with OpenSSL 3.0.0
-
-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-20
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-19
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Mon Oct  5 17:30:51 EDT 2020 Paul Wouters <pwouters@redhat.com> - 0.8-18
-- Resolves: rhbz#1879707 FTBFS: Remove compat-openssl10 requirement
-- Resolves: rhbz#1865601 validns: FTBFS in Fedora rawhide/f33
-- Resolves: rhbz#1880829 F34FailsToInstall: validns
-- Updated notiming patch (-x) notiming patch (-x)
-- Pulled in git20160720 updates
-- Workaround for s390x strcpy issues in mempool.c
-
-* Mon Oct  5 17:03:05 EDT 2020 Paul Wouters <pwouters@redhat.com> - 0.8-17
-- Port to openssl-1.1 based on github and https://github.com/tobez/validns/pull/64
-
-* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-16
-- Second attempt - Rebuilt for
-  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-15
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-14
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-13
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-12
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-11
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Sun Feb 11 2018 Filipe Rosset <rosset.filipe@gmail.com> - 0.8-10
-- Fix FTBFS on rawhide, use compat-openssl10-devel until upstream port to 1.1
-
-* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-9
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
-* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-8
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Fri Feb 05 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
-
-* Fri Jun 19 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.8-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
-
-* Mon Aug 18 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.8-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
-
-* Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.8-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
-
-* Tue Feb 11 2014 Paul Wouters <pwouters@redhat.com> - 0.8-1
-- Updated to 0.8 for sha-384 support in DS records
-
-* Sun Aug 04 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.7-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
-
-* Tue Apr 16 2013 Paul Wouters <pwouters@redhat.com> - 0.7-1
-- Updated to 0.7.
-- Removed some el-5 only spec attributes
-
-* Fri Feb 15 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
-
-* Fri Oct 12 2012 Paul Wouters <pwouters@redhat.com> - 0.6-2
-- Added -x option to skip timing info in statistics
-
-* Thu Oct 04 2012 Paul Wouters <pwouters@redhat.com> - 0.6-1
-- Updated to 0.6, which incorporates all patches
-
-* Thu Oct 04 2012 Paul Wouters <pwouters@redhat.com> - 0.5-4
-- Pullup from git for NSEC3 glue record handling fix
-
-* Fri Aug 24 2012 Paul Wouters <pwouters@redhat.com> - 0.5-3
-- Patch for handling NSEC/NSEC3 camelcasing
-- Support TLSA records
-
-* Sun Jul 22 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.5-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
-
-* Thu Jun 07 2012 Paul Wouters <pwouters@redhat.com> - 0.5-1
-- Updated to 0.5 which supports Parallelize signature verification
-- Install man page
-
-* Tue May 01 2012 Paul Wouters <pwouters@redhat.com> - 0.4-1
-- Updated to 0.4 which fixes a TXT record parsing bug
-
-* Tue Feb 28 2012 Paul Wouters <pwouters@redhat.com> - 0.3-2
-- Added missing BuildRequire for openssl-devel
-
-* Mon Feb 13 2012 Paul Wouters <pwouters@redhat.com> - 0.3-1
-- Initial package
-