From 1010bfae705257167a39d6751dada03d49954ff6 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Sat, 28 Feb 2015 01:08:59 +0000
Subject: [PATCH] regen v9_10

---
 bin/dig/dig.1                        |   4 +-
 bin/dig/dig.html                     |  20 +-
 bin/named/named.8                    |   4 +-
 bin/named/named.html                 |  16 +-
 bin/nsupdate/nsupdate.1              | 251 ++++-----
 bin/nsupdate/nsupdate.html           | 746 ++++++++++++++-------------
 doc/arm/Bv9ARM.ch09.html             | 219 +-------
 doc/arm/Bv9ARM.ch12.html             |  40 +-
 doc/arm/Bv9ARM.html                  |  14 +-
 doc/arm/man.arpaname.html            |   6 +-
 doc/arm/man.ddns-confgen.html        |   8 +-
 doc/arm/man.delv.html                |  12 +-
 doc/arm/man.dig.html                 |  18 +-
 doc/arm/man.dnssec-checkds.html      |   8 +-
 doc/arm/man.dnssec-coverage.html     |   8 +-
 doc/arm/man.dnssec-dsfromkey.html    |  14 +-
 doc/arm/man.dnssec-importkey.html    |  12 +-
 doc/arm/man.dnssec-keyfromlabel.html |  12 +-
 doc/arm/man.dnssec-keygen.html       |  14 +-
 doc/arm/man.dnssec-revoke.html       |   8 +-
 doc/arm/man.dnssec-settime.html      |  12 +-
 doc/arm/man.dnssec-signzone.html     |  10 +-
 doc/arm/man.dnssec-verify.html       |   8 +-
 doc/arm/man.genrandom.html           |   8 +-
 doc/arm/man.host.html                |   8 +-
 doc/arm/man.isc-hmac-fixup.html      |   8 +-
 doc/arm/man.named-checkconf.html     |  10 +-
 doc/arm/man.named-checkzone.html     |  10 +-
 doc/arm/man.named-journalprint.html  |   6 +-
 doc/arm/man.named-rrchecker.html     |   4 +-
 doc/arm/man.named.html               |  14 +-
 doc/arm/man.nsec3hash.html           |   8 +-
 doc/arm/man.nsupdate.html            | 744 +++++++++++++-------------
 doc/arm/man.rndc-confgen.html        |  10 +-
 doc/arm/man.rndc.conf.html           |  10 +-
 doc/arm/man.rndc.html                |  12 +-
 doc/arm/notes.html                   | 219 +-------
 37 files changed, 1069 insertions(+), 1466 deletions(-)

diff --git a/bin/dig/dig.1 b/bin/dig/dig.1
index f685dc993a..b6377abfd8 100644
--- a/bin/dig/dig.1
+++ b/bin/dig/dig.1
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -667,7 +667,7 @@ RFC1035.
 .PP
 There are probably too many query options.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2011, 2013\-2015 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
diff --git a/bin/dig/dig.html b/bin/dig/dig.html
index a645162cf1..9a6ccd9f0f 100644
--- a/bin/dig/dig.html
+++ b/bin/dig/dig.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -34,7 +34,7 @@
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [global-queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543544"></a><h2>DESCRIPTION</h2>
+<a name="id2543547"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dig</strong></span>
       (domain information groper) is a flexible tool
       for interrogating DNS name servers.  It performs DNS lookups and
@@ -81,7 +81,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543623"></a><h2>SIMPLE USAGE</h2>
+<a name="id2543626"></a><h2>SIMPLE USAGE</h2>
 <p>
       A typical invocation of <span><strong class="command">dig</strong></span> looks like:
       </p>
@@ -134,7 +134,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543726"></a><h2>OPTIONS</h2>
+<a name="id2543730"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -262,7 +262,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544178"></a><h2>QUERY OPTIONS</h2>
+<a name="id2544181"></a><h2>QUERY OPTIONS</h2>
 <p><span><strong class="command">dig</strong></span>
       provides a number of query options which affect
       the way in which lookups are made and the results displayed.  Some of
@@ -648,7 +648,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545608"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2545611"></a><h2>MULTIPLE QUERIES</h2>
 <p>
       The BIND 9 implementation of <span><strong class="command">dig </strong></span>
       supports
@@ -694,7 +694,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545670"></a><h2>IDN SUPPORT</h2>
+<a name="id2545673"></a><h2>IDN SUPPORT</h2>
 <p>
       If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names.
@@ -708,14 +708,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545692"></a><h2>FILES</h2>
+<a name="id2545696"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 <p><code class="filename">${HOME}/.digrc</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545709"></a><h2>SEE ALSO</h2>
+<a name="id2545713"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
@@ -723,7 +723,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545747"></a><h2>BUGS</h2>
+<a name="id2545750"></a><h2>BUGS</h2>
 <p>
       There are probably too many query options.
     </p>
diff --git a/bin/named/named.8 b/bin/named/named.8
index a8d8d3d69f..e216d86081 100644
--- a/bin/named/named.8
+++ b/bin/named/named.8
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2009, 2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2009, 2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -295,7 +295,7 @@ BIND 9 Administrator Reference Manual.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2009, 2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2009, 2011, 2013\-2015 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000, 2001, 2003 Internet Software Consortium.
 .br
diff --git a/bin/named/named.html b/bin/named/named.html
index deedab8c44..18527136a5 100644
--- a/bin/named/named.html
+++ b/bin/named/named.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2009, 2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2009, 2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-D <em class="replaceable"><code>string</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine-name</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-M <em class="replaceable"><code>option</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-U <em class="replaceable"><code>#listeners</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-V</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543524"></a><h2>DESCRIPTION</h2>
+<a name="id2543527"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named</strong></span>
       is a Domain Name System (DNS) server,
       part of the BIND 9 distribution from ISC.  For more
@@ -47,7 +47,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543548"></a><h2>OPTIONS</h2>
+<a name="id2543552"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -266,7 +266,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544222"></a><h2>SIGNALS</h2>
+<a name="id2544226"></a><h2>SIGNALS</h2>
 <p>
       In routine operation, signals should not be used to control
       the nameserver; <span><strong class="command">rndc</strong></span> should be used
@@ -287,7 +287,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544339"></a><h2>CONFIGURATION</h2>
+<a name="id2544274"></a><h2>CONFIGURATION</h2>
 <p>
       The <span><strong class="command">named</strong></span> configuration file is too complex
       to describe in detail here.  A complete description is provided
@@ -304,7 +304,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544375"></a><h2>FILES</h2>
+<a name="id2544378"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
 <dd><p>
@@ -317,7 +317,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544414"></a><h2>SEE ALSO</h2>
+<a name="id2544418"></a><h2>SEE ALSO</h2>
 <p><em class="citetitle">RFC 1033</em>,
       <em class="citetitle">RFC 1034</em>,
       <em class="citetitle">RFC 1035</em>,
@@ -330,7 +330,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544485"></a><h2>AUTHOR</h2>
+<a name="id2544488"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/bin/nsupdate/nsupdate.1 b/bin/nsupdate/nsupdate.1
index 29b5414bf6..ce27b51be9 100644
--- a/bin/nsupdate/nsupdate.1
+++ b/bin/nsupdate/nsupdate.1
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -33,7 +33,7 @@
 nsupdate \- Dynamic DNS update utility
 .SH "SYNOPSIS"
 .HP 9
-\fBnsupdate\fR [\fB\-d\fR] [\fB\-D\fR] [[\fB\-g\fR] | [\fB\-o\fR] | [\fB\-l\fR] | [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIkeyname:secret\fR\fR] | [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-R\ \fR\fB\fIrandomdev\fR\fR] [\fB\-v\fR] [\fB\-T\fR] [\fB\-P\fR] [\fB\-V\fR] [filename]
+\fBnsupdate\fR [\fB\-d\fR] [\fB\-D\fR] [\fB\-L\ \fR\fB\fIlevel\fR\fR] [[\fB\-g\fR] | [\fB\-o\fR] | [\fB\-l\fR] | [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIkeyname:secret\fR\fR] | [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-R\ \fR\fB\fIrandomdev\fR\fR] [\fB\-v\fR] [\fB\-T\fR] [\fB\-P\fR] [\fB\-V\fR] [filename]
 .SH "DESCRIPTION"
 .PP
 \fBnsupdate\fR
@@ -47,53 +47,148 @@ The resource records that are dynamically added or removed with
 \fBnsupdate\fR
 have to be in the same zone. Requests are sent to the zone's master server. This is identified by the MNAME field of the zone's SOA record.
 .PP
-The
-\fB\-d\fR
-option makes
-\fBnsupdate\fR
-operate in debug mode. This provides tracing information about the update requests that are made and the replies received from the name server.
+Transaction signatures can be used to authenticate the Dynamic DNS updates. These use the TSIG resource record type described in RFC 2845 or the SIG(0) record described in RFC 2535 and RFC 2931 or GSS\-TSIG as described in RFC 3645.
 .PP
-The
-\fB\-D\fR
-option makes
+TSIG relies on a shared secret that should only be known to
 \fBnsupdate\fR
-report additional debugging information to
-\fB\-d\fR.
-.PP
-The
-\fB\-L\fR
-option with an integer argument of zero or higher sets the logging debug level. If zero, logging is disabled.
-.PP
-Transaction signatures can be used to authenticate the Dynamic DNS updates. These use the TSIG resource record type described in RFC 2845 or the SIG(0) record described in RFC 2535 and RFC 2931 or GSS\-TSIG as described in RFC 3645. TSIG relies on a shared secret that should only be known to
-\fBnsupdate\fR
-and the name server. Currently, the only supported encryption algorithm for TSIG is HMAC\-MD5, which is defined in RFC 2104. Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. For instance, suitable
+and the name server. For instance, suitable
 \fBkey\fR
 and
 \fBserver\fR
 statements would be added to
 \fI/etc/named.conf\fR
-so that the name server can associate the appropriate secret key and algorithm with the IP address of the client application that will be using TSIG authentication. SIG(0) uses public key cryptography. To use a SIG(0) key, the public key must be stored in a KEY record in a zone served by the name server.
+so that the name server can associate the appropriate secret key and algorithm with the IP address of the client application that will be using TSIG authentication. You can use
+\fBddns\-confgen\fR
+to generate suitable configuration fragments.
 \fBnsupdate\fR
-does not read
-\fI/etc/named.conf\fR.
+uses the
+\fB\-y\fR
+or
+\fB\-k\fR
+options to provide the TSIG shared secret. These options are mutually exclusive.
+.PP
+SIG(0) uses public key cryptography. To use a SIG(0) key, the public key must be stored in a KEY record in a zone served by the name server.
 .PP
 GSS\-TSIG uses Kerberos credentials. Standard GSS\-TSIG mode is switched on with the
 \fB\-g\fR
 flag. A non\-standards\-compliant variant of GSS\-TSIG used by Windows 2000 can be switched on with the
 \fB\-o\fR
 flag.
+.SH "OPTIONS"
 .PP
-\fBnsupdate\fR
-uses the
-\fB\-y\fR
-or
+\-d
+.RS 4
+Debug mode. This provides tracing information about the update requests that are made and the replies received from the name server.
+.RE
+.PP
+\-D
+.RS 4
+Extra debug mode.
+.RE
+.PP
+\-k \fIkeyfile\fR
+.RS 4
+The file containing the TSIG authentication key. Keyfiles may be in two formats: a single file containing a
+\fInamed.conf\fR\-format
+\fBkey\fR
+statement, which may be generated automatically by
+\fBddns\-confgen\fR, or a pair of files whose names are of the format
+\fIK{name}.+157.+{random}.key\fR
+and
+\fIK{name}.+157.+{random}.private\fR, which can be generated by
+\fBdnssec\-keygen\fR. The
 \fB\-k\fR
-option to provide the shared secret needed to generate a TSIG record for authenticating Dynamic DNS update requests, default type HMAC\-MD5. These options are mutually exclusive.
+may also be used to specify a SIG(0) key used to authenticate Dynamic DNS update requests. In this case, the key specified is not an HMAC\-MD5 key.
+.RE
 .PP
-When the
-\fB\-y\fR
-option is used, a signature is generated from
-[\fIhmac:\fR]\fIkeyname:secret.\fR
+\-l
+.RS 4
+Local\-host only mode. This sets the server address to localhost (disabling the
+\fBserver\fR
+so that the server address cannot be overridden). Connections to the local server will use a TSIG key found in
+\fI/var/run/named/session.key\fR, which is automatically generated by
+\fBnamed\fR
+if any local master zone has set
+\fBupdate\-policy\fR
+to
+\fBlocal\fR. The location of this key file can be overridden with the
+\fB\-k\fR
+option.
+.RE
+.PP
+\-L \fIlevel\fR
+.RS 4
+Set the logging debug level. If zero, logging is disabled.
+.RE
+.PP
+\-p \fIport\fR
+.RS 4
+Set the port to use for connections to a name server. The default is 53.
+.RE
+.PP
+\-P
+.RS 4
+Print the list of private BIND\-specific resource record types whose format is understood by
+\fBnsupdate\fR. See also the
+\fB\-T\fR
+option.
+.RE
+.PP
+\-r \fIudpretries\fR
+.RS 4
+The number of UDP retries. The default is 3. If zero, only one update request will be made.
+.RE
+.PP
+\-R \fIrandomdev\fR
+.RS 4
+Where to obtain randomness. If the operating system does not provide a
+\fI/dev/random\fR
+or equivalent device, the default source of randomness is keyboard input.
+\fIrandomdev\fR
+specifies the name of a character device or file containing random data to be used instead of the default. The special value
+\fIkeyboard\fR
+indicates that keyboard input should be used. This option may be specified multiple times.
+.RE
+.PP
+\-t \fItimeout\fR
+.RS 4
+The maximum time an update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout.
+.RE
+.PP
+\-T
+.RS 4
+Print the list of IANA standard resource record types whose format is understood by
+\fBnsupdate\fR.
+\fBnsupdate\fR
+will exit after the lists are printed. The
+\fB\-T\fR
+option can be combined with the
+\fB\-P\fR
+option.
+.sp
+Other types can be entered using "TYPEXXXXX" where "XXXXX" is the decimal value of the type with no leading zeros. The rdata, if present, will be parsed using the UNKNOWN rdata format, (<backslash> <hash> <space> <length> <space> <hexstring>).
+.RE
+.PP
+\-u \fIudptimeout\fR
+.RS 4
+The UDP retry interval. The default is 3 seconds. If zero, the interval will be computed from the timeout interval and number of UDP retries.
+.RE
+.PP
+\-v
+.RS 4
+Use TCP even for small update requests. By default,
+\fBnsupdate\fR
+uses UDP to send update requests to the name server unless they are too large to fit in a UDP request in which case TCP will be used. TCP may be preferable when a batch of update requests is made.
+.RE
+.PP
+\-V
+.RS 4
+Print the version number and exit.
+.RE
+.PP
+\-y \fI[hmac:]\fR\fIkeyname:secret\fR
+.RS 4
+Literal TSIG authentication key.
 \fIkeyname\fR
 is the name of the key, and
 \fIsecret\fR
@@ -108,96 +203,14 @@ hmac\-sha384, or
 hmac\-sha512. If
 \fIhmac\fR
 is not specified, the default is
-hmac\-md5. NOTE: Use of the
+hmac\-md5.
+.sp
+NOTE: Use of the
 \fB\-y\fR
 option is discouraged because the shared secret is supplied as a command line argument in clear text. This may be visible in the output from
 \fBps\fR(1)
 or in a history file maintained by the user's shell.
-.PP
-With the
-\fB\-k\fR
-option,
-\fBnsupdate\fR
-reads the shared secret from the file
-\fIkeyfile\fR. Keyfiles may be in two formats: a single file containing a
-\fInamed.conf\fR\-format
-\fBkey\fR
-statement, which may be generated automatically by
-\fBddns\-confgen\fR, or a pair of files whose names are of the format
-\fIK{name}.+157.+{random}.key\fR
-and
-\fIK{name}.+157.+{random}.private\fR, which can be generated by
-\fBdnssec\-keygen\fR. The
-\fB\-k\fR
-may also be used to specify a SIG(0) key used to authenticate Dynamic DNS update requests. In this case, the key specified is not an HMAC\-MD5 key.
-.PP
-\fBnsupdate\fR
-can be run in a local\-host only mode using the
-\fB\-l\fR
-flag. This sets the server address to localhost (disabling the
-\fBserver\fR
-so that the server address cannot be overridden). Connections to the local server will use a TSIG key found in
-\fI/var/run/named/session.key\fR, which is automatically generated by
-\fBnamed\fR
-if any local master zone has set
-\fBupdate\-policy\fR
-to
-\fBlocal\fR. The location of this key file can be overridden with the
-\fB\-k\fR
-option.
-.PP
-By default,
-\fBnsupdate\fR
-uses UDP to send update requests to the name server unless they are too large to fit in a UDP request in which case TCP will be used. The
-\fB\-v\fR
-option makes
-\fBnsupdate\fR
-use a TCP connection. This may be preferable when a batch of update requests is made.
-.PP
-The
-\fB\-p\fR
-sets the default port number to use for connections to a name server. The default is 53.
-.PP
-The
-\fB\-t\fR
-option sets the maximum time an update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout.
-.PP
-The
-\fB\-u\fR
-option sets the UDP retry interval. The default is 3 seconds. If zero, the interval will be computed from the timeout interval and number of UDP retries.
-.PP
-The
-\fB\-r\fR
-option sets the number of UDP retries. The default is 3. If zero, only one update request will be made.
-.PP
-The
-\fB\-R \fR\fB\fIrandomdev\fR\fR
-option specifies a source of randomness. If the operating system does not provide a
-\fI/dev/random\fR
-or equivalent device, the default source of randomness is keyboard input.
-\fIrandomdev\fR
-specifies the name of a character device or file containing random data to be used instead of the default. The special value
-\fIkeyboard\fR
-indicates that keyboard input should be used. This option may be specified multiple times.
-.PP
-Other types can be entered using "TYPEXXXXX" where "XXXXX" is the decimal value of the type with no leading zeros. The rdata, if present, will be parsed using the UNKNOWN rdata format, (<backslash> <hash> <space> <length> <space> <hexstring>).
-.PP
-The
-\fB\-T\fR
-and
-\fB\-P\fR
-options print out lists of non\-meta types for which the type\-specific presentation formats are known.
-\fB\-T\fR
-prints out the list of IANA\-assigned types.
-\fB\-P\fR
-prints out the list of private types specific to
-\fBnamed\fR. These options may be combined.
-\fBnsupdate\fR
-will exit after the lists are printed.
-.PP
-The \-V option causes
-\fBnsupdate\fR
-to print the version number and exit.
+.RE
 .SH "INPUT FORMAT"
 .PP
 \fBnsupdate\fR
@@ -478,7 +491,7 @@ RFC 2931,
 .PP
 The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
diff --git a/bin/nsupdate/nsupdate.html b/bin/nsupdate/nsupdate.html
index 8649ba9b76..7c524ba619 100644
--- a/bin/nsupdate/nsupdate.html
+++ b/bin/nsupdate/nsupdate.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -29,10 +29,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">nsupdate</code>  [<code class="option">-d</code>] [<code class="option">-D</code>] [[<code class="option">-g</code>] |  [<code class="option">-o</code>] |  [<code class="option">-l</code>] |  [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] |  [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [<code class="option">-T</code>] [<code class="option">-P</code>] [<code class="option">-V</code>] [filename]</p></div>
+<div class="cmdsynopsis"><p><code class="command">nsupdate</code>  [<code class="option">-d</code>] [<code class="option">-D</code>] [<code class="option">-L <em class="replaceable"><code>level</code></em></code>] [[<code class="option">-g</code>] |  [<code class="option">-o</code>] |  [<code class="option">-l</code>] |  [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] |  [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [<code class="option">-T</code>] [<code class="option">-P</code>] [<code class="option">-V</code>] [filename]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543488"></a><h2>DESCRIPTION</h2>
+<a name="id2543499"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">nsupdate</strong></span>
       is used to submit Dynamic DNS Update requests as defined in RFC 2136
       to a name server.
@@ -56,44 +56,31 @@
       Requests are sent to the zone's master server.
       This is identified by the MNAME field of the zone's SOA record.
     </p>
-<p>
-      The
-      <code class="option">-d</code>
-      option makes
-      <span><strong class="command">nsupdate</strong></span>
-      operate in debug mode.
-      This provides tracing information about the update requests that are
-      made and the replies received from the name server.
-    </p>
-<p>
-      The <code class="option">-D</code> option makes <span><strong class="command">nsupdate</strong></span>
-      report additional debugging information to <code class="option">-d</code>.
-    </p>
-<p>
-      The <code class="option">-L</code> option with an integer argument of zero or
-      higher sets the logging debug level.  If zero, logging is disabled.
-    </p>
 <p>
       Transaction signatures can be used to authenticate the Dynamic
       DNS updates.  These use the TSIG resource record type described
       in RFC 2845 or the SIG(0) record described in RFC 2535 and
-      RFC 2931 or GSS-TSIG as described in RFC 3645.  TSIG relies on
+      RFC 2931 or GSS-TSIG as described in RFC 3645.
+    </p>
+<p>
+      TSIG relies on
       a shared secret that should only be known to
-      <span><strong class="command">nsupdate</strong></span> and the name server.  Currently,
-      the only supported encryption algorithm for TSIG is HMAC-MD5,
-      which is defined in RFC 2104.  Once other algorithms are
-      defined for TSIG, applications will need to ensure they select
-      the appropriate algorithm as well as the key when authenticating
-      each other.  For instance, suitable <span class="type">key</span> and
+      <span><strong class="command">nsupdate</strong></span> and the name server.
+      For instance, suitable <span class="type">key</span> and
       <span class="type">server</span> statements would be added to
       <code class="filename">/etc/named.conf</code> so that the name server
       can associate the appropriate secret key and algorithm with
       the IP address of the client application that will be using
-      TSIG authentication.  SIG(0) uses public key cryptography.
+      TSIG authentication. You can use <span><strong class="command">ddns-confgen</strong></span>
+      to generate suitable configuration fragments.
+      <span><strong class="command">nsupdate</strong></span>
+      uses the <code class="option">-y</code> or <code class="option">-k</code> options
+      to provide the TSIG shared secret.  These options are mutually exclusive.
+    </p>
+<p>
+      SIG(0) uses public key cryptography.
       To use a SIG(0) key, the public key must be stored in a KEY
       record in a zone served by the name server.
-      <span><strong class="command">nsupdate</strong></span> does not read
-      <code class="filename">/etc/named.conf</code>.
     </p>
 <p>
       GSS-TSIG uses Kerberos credentials.  Standard GSS-TSIG mode
@@ -101,124 +88,143 @@
       non-standards-compliant variant of GSS-TSIG used by Windows
       2000 can be switched on with the <code class="option">-o</code> flag.
     </p>
-<p><span><strong class="command">nsupdate</strong></span>
-      uses the <code class="option">-y</code> or <code class="option">-k</code> option
-      to provide the shared secret needed to generate a TSIG record
-      for authenticating Dynamic DNS update requests, default type
-      HMAC-MD5.  These options are mutually exclusive. 
-    </p>
-<p>
-      When the <code class="option">-y</code> option is used, a signature is
-      generated from
-      [<span class="optional"><em class="parameter"><code>hmac:</code></em></span>]<em class="parameter"><code>keyname:secret.</code></em>
-      <em class="parameter"><code>keyname</code></em> is the name of the key, and
-      <em class="parameter"><code>secret</code></em> is the base64 encoded shared secret.
-      <em class="parameter"><code>hmac</code></em> is the name of the key algorithm;
-      valid choices are <code class="literal">hmac-md5</code>,
-      <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
-      <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>, or
-      <code class="literal">hmac-sha512</code>.  If <em class="parameter"><code>hmac</code></em>
-      is not specified, the default is <code class="literal">hmac-md5</code>.
-      NOTE: Use of the <code class="option">-y</code> option is discouraged because the
-      shared secret is supplied as a command line argument in clear text.
-      This may be visible in the output from
-      <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
-      or in a history file maintained by the user's shell.
-    </p>
-<p>
-      With the
-      <code class="option">-k</code> option, <span><strong class="command">nsupdate</strong></span> reads
-      the shared secret from the file <em class="parameter"><code>keyfile</code></em>.
-      Keyfiles may be in two formats: a single file containing
-      a <code class="filename">named.conf</code>-format <span><strong class="command">key</strong></span>
-      statement, which may be generated automatically by
-      <span><strong class="command">ddns-confgen</strong></span>, or a pair of files whose names are
-      of the format <code class="filename">K{name}.+157.+{random}.key</code> and
-      <code class="filename">K{name}.+157.+{random}.private</code>, which can be
-      generated by <span><strong class="command">dnssec-keygen</strong></span>.
-      The <code class="option">-k</code> may also be used to specify a SIG(0) key used
-      to authenticate Dynamic DNS update requests.  In this case, the key
-      specified is not an HMAC-MD5 key.
-    </p>
-<p>
-      <span><strong class="command">nsupdate</strong></span> can be run in a local-host only mode
-      using the <code class="option">-l</code> flag.  This sets the server address to
-      localhost (disabling the <span><strong class="command">server</strong></span> so that the server
-      address cannot be overridden).  Connections to the local server will
-      use a TSIG key found in <code class="filename">/var/run/named/session.key</code>,
-      which is automatically generated by <span><strong class="command">named</strong></span> if any
-      local master zone has set <span><strong class="command">update-policy</strong></span> to
-      <span><strong class="command">local</strong></span>.  The location of this key file can be
-      overridden with the <code class="option">-k</code> option.
-    </p>
-<p>
-      By default, <span><strong class="command">nsupdate</strong></span>
-      uses UDP to send update requests to the name server unless they are too
-      large to fit in a UDP request in which case TCP will be used.
-      The
-      <code class="option">-v</code>
-      option makes
-      <span><strong class="command">nsupdate</strong></span>
-      use a TCP connection.
-      This may be preferable when a batch of update requests is made.
-    </p>
-<p>
-      The <code class="option">-p</code> sets the default port number to use for
-      connections to a name server.  The default is 53.
-    </p>
-<p>
-      The <code class="option">-t</code> option sets the maximum time an update request
-      can
-      take before it is aborted.  The default is 300 seconds.  Zero can be
-      used
-      to disable the timeout.
-    </p>
-<p>
-      The <code class="option">-u</code> option sets the UDP retry interval.  The default
-      is
-      3 seconds.  If zero, the interval will be computed from the timeout
-      interval
-      and number of UDP retries.
-    </p>
-<p>
-      The <code class="option">-r</code> option sets the number of UDP retries. The
-      default is
-      3.  If zero, only one update request will be made.
-    </p>
-<p>
-      The <code class="option">-R <em class="replaceable"><code>randomdev</code></em></code> option
-      specifies a source of randomness.  If the operating system
-      does not provide a <code class="filename">/dev/random</code> or
-      equivalent device, the default source of randomness is keyboard
-      input.  <code class="filename">randomdev</code> specifies the name of
-      a character device or file containing random data to be used
-      instead of the default.  The special value
-      <code class="filename">keyboard</code> indicates that keyboard input
-      should be used.  This option may be specified multiple times.
-    </p>
-<p>
-      Other types can be entered using "TYPEXXXXX" where "XXXXX" is the
-      decimal value of the type with no leading zeros.  The rdata,
-      if present, will be parsed using the UNKNOWN rdata format,
-      (&lt;backslash&gt; &lt;hash&gt; &lt;space&gt; &lt;length&gt;
-      &lt;space&gt; &lt;hexstring&gt;).
-    </p>
-<p>
-      The <code class="option">-T</code> and <code class="option">-P</code> options print out
-      lists of non-meta types for which the type-specific presentation
-      formats are known.  <code class="option">-T</code> prints out the list of
-      IANA-assigned types.  <code class="option">-P</code> prints out the list of
-      private types specific to <span><strong class="command">named</strong></span>.  These options
-      may be combined.  <span><strong class="command">nsupdate</strong></span> will exit after the
-      lists are printed.
-    </p>
-<p>
-      The -V option causes <span><strong class="command">nsupdate</strong></span> to print the
-      version number and exit.
-    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543888"></a><h2>INPUT FORMAT</h2>
+<a name="id2543573"></a><h2>OPTIONS</h2>
+<div class="variablelist"><dl>
+<dt><span class="term">-d</span></dt>
+<dd><p>
+	    Debug mode. This provides tracing information about the
+	    update requests that are made and the replies received
+	    from the name server.
+	  </p></dd>
+<dt><span class="term">-D</span></dt>
+<dd><p>
+	    Extra debug mode.
+	  </p></dd>
+<dt><span class="term">-k <em class="replaceable"><code>keyfile</code></em></span></dt>
+<dd><p>
+	    The file containing the TSIG authentication key.
+	    Keyfiles may be in two formats: a single file containing
+	    a <code class="filename">named.conf</code>-format <span><strong class="command">key</strong></span>
+	    statement, which may be generated automatically by
+	    <span><strong class="command">ddns-confgen</strong></span>, or a pair of files whose names are
+	    of the format <code class="filename">K{name}.+157.+{random}.key</code> and
+	    <code class="filename">K{name}.+157.+{random}.private</code>, which can be
+	    generated by <span><strong class="command">dnssec-keygen</strong></span>.
+	    The <code class="option">-k</code> may also be used to specify a SIG(0) key used
+	    to authenticate Dynamic DNS update requests.  In this case, the key
+	    specified is not an HMAC-MD5 key.
+	  </p></dd>
+<dt><span class="term">-l</span></dt>
+<dd><p>
+	    Local-host only mode. This sets the server address to
+	    localhost (disabling the <span><strong class="command">server</strong></span> so that the server
+	    address cannot be overridden).  Connections to the local server will
+	    use a TSIG key found in <code class="filename">/var/run/named/session.key</code>,
+	    which is automatically generated by <span><strong class="command">named</strong></span> if any
+	    local master zone has set <span><strong class="command">update-policy</strong></span> to
+	    <span><strong class="command">local</strong></span>.  The location of this key file can be
+	    overridden with the <code class="option">-k</code> option.
+	  </p></dd>
+<dt><span class="term">-L <em class="replaceable"><code>level</code></em></span></dt>
+<dd><p>
+	    Set the logging debug level.  If zero, logging is disabled.
+	  </p></dd>
+<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
+<dd><p>
+	    Set the port to use for connections to a name server. The
+	    default is 53.
+	  </p></dd>
+<dt><span class="term">-P</span></dt>
+<dd><p>
+	    Print the list of private BIND-specific resource record
+	    types whose format is understood
+	    by <span><strong class="command">nsupdate</strong></span>. See also
+	    the <code class="option">-T</code> option.
+	  </p></dd>
+<dt><span class="term">-r <em class="replaceable"><code>udpretries</code></em></span></dt>
+<dd><p>
+	    The number of UDP retries. The default is 3. If zero, only
+	    one update request will be made.
+	  </p></dd>
+<dt><span class="term">-R <em class="replaceable"><code>randomdev</code></em></span></dt>
+<dd><p>
+	  Where to obtain randomness. If the operating system
+	  does not provide a <code class="filename">/dev/random</code> or
+	  equivalent device, the default source of randomness is keyboard
+	  input.  <code class="filename">randomdev</code> specifies the name of
+	  a character device or file containing random data to be used
+	  instead of the default.  The special value
+	  <code class="filename">keyboard</code> indicates that keyboard input
+	  should be used.  This option may be specified multiple times.
+	</p></dd>
+<dt><span class="term">-t <em class="replaceable"><code>timeout</code></em></span></dt>
+<dd><p>
+	    The maximum time an update request can take before it is
+	    aborted. The default is 300 seconds. Zero can be used to
+	    disable the timeout.
+	  </p></dd>
+<dt><span class="term">-T</span></dt>
+<dd>
+<p>
+	    Print the list of IANA standard resource record types
+	    whose format is understood by <span><strong class="command">nsupdate</strong></span>.
+	    <span><strong class="command">nsupdate</strong></span> will exit after the lists are
+	    printed. The <code class="option">-T</code> option can be combined
+	    with the <code class="option">-P</code> option.
+	  </p>
+<p>
+	    Other types can be entered using "TYPEXXXXX" where "XXXXX" is the
+	    decimal value of the type with no leading zeros.  The rdata,
+	    if present, will be parsed using the UNKNOWN rdata format,
+	    (&lt;backslash&gt; &lt;hash&gt; &lt;space&gt; &lt;length&gt;
+	    &lt;space&gt; &lt;hexstring&gt;).
+	  </p>
+</dd>
+<dt><span class="term">-u <em class="replaceable"><code>udptimeout</code></em></span></dt>
+<dd><p>
+	    The UDP retry interval. The default is 3 seconds. If zero,
+	    the interval will be computed from the timeout interval and
+	    number of UDP retries.
+	  </p></dd>
+<dt><span class="term">-v</span></dt>
+<dd><p>
+	    Use TCP even for small update requests.
+	    By default, <span><strong class="command">nsupdate</strong></span>
+	    uses UDP to send update requests to the name server unless they are too
+	    large to fit in a UDP request in which case TCP will be used.
+	    TCP may be preferable when a batch of update requests is made.
+	  </p></dd>
+<dt><span class="term">-V</span></dt>
+<dd><p>
+	    Print the version number and exit.
+	  </p></dd>
+<dt><span class="term">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></span></dt>
+<dd>
+<p>
+	    Literal TSIG authentication key.
+	    <em class="parameter"><code>keyname</code></em> is the name of the key, and
+	    <em class="parameter"><code>secret</code></em> is the base64 encoded shared secret.
+	    <em class="parameter"><code>hmac</code></em> is the name of the key algorithm;
+	    valid choices are <code class="literal">hmac-md5</code>,
+	    <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
+	    <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>, or
+	    <code class="literal">hmac-sha512</code>.  If <em class="parameter"><code>hmac</code></em>
+	    is not specified, the default is <code class="literal">hmac-md5</code>.
+	  </p>
+<p>
+	    NOTE: Use of the <code class="option">-y</code> option is discouraged because the
+	    shared secret is supplied as a command line argument in clear text.
+	    This may be visible in the output from
+	    <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
+	    or in a history file maintained by the user's shell.
+	  </p>
+</dd>
+</dl></div>
+</div>
+<div class="refsect1" lang="en">
+<a name="id2544090"></a><h2>INPUT FORMAT</h2>
 <p><span><strong class="command">nsupdate</strong></span>
       reads input from
       <em class="parameter"><code>filename</code></em>
@@ -248,270 +254,270 @@
       </p>
 <div class="variablelist"><dl>
 <dt><span class="term">
-              <span><strong class="command">server</strong></span>
-               {servername}
-               [port]
-            </span></dt>
+	      <span><strong class="command">server</strong></span>
+	       {servername}
+	       [port]
+	    </span></dt>
 <dd><p>
-              Sends all dynamic update requests to the name server
-              <em class="parameter"><code>servername</code></em>.
-              When no server statement is provided,
-              <span><strong class="command">nsupdate</strong></span>
-              will send updates to the master server of the correct zone.
-              The MNAME field of that zone's SOA record will identify the
-              master
-              server for that zone.
-              <em class="parameter"><code>port</code></em>
-              is the port number on
-              <em class="parameter"><code>servername</code></em>
-              where the dynamic update requests get sent.
-              If no port number is specified, the default DNS port number of
-              53 is
-              used.
-            </p></dd>
+	      Sends all dynamic update requests to the name server
+	      <em class="parameter"><code>servername</code></em>.
+	      When no server statement is provided,
+	      <span><strong class="command">nsupdate</strong></span>
+	      will send updates to the master server of the correct zone.
+	      The MNAME field of that zone's SOA record will identify the
+	      master
+	      server for that zone.
+	      <em class="parameter"><code>port</code></em>
+	      is the port number on
+	      <em class="parameter"><code>servername</code></em>
+	      where the dynamic update requests get sent.
+	      If no port number is specified, the default DNS port number of
+	      53 is
+	      used.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">local</strong></span>
-               {address}
-               [port]
-            </span></dt>
+	      <span><strong class="command">local</strong></span>
+	       {address}
+	       [port]
+	    </span></dt>
 <dd><p>
-              Sends all dynamic update requests using the local
-              <em class="parameter"><code>address</code></em>.
+	      Sends all dynamic update requests using the local
+	      <em class="parameter"><code>address</code></em>.
 
-              When no local statement is provided,
-              <span><strong class="command">nsupdate</strong></span>
-              will send updates using an address and port chosen by the
-              system.
-              <em class="parameter"><code>port</code></em>
-              can additionally be used to make requests come from a specific
-              port.
-              If no port number is specified, the system will assign one.
-            </p></dd>
+	      When no local statement is provided,
+	      <span><strong class="command">nsupdate</strong></span>
+	      will send updates using an address and port chosen by the
+	      system.
+	      <em class="parameter"><code>port</code></em>
+	      can additionally be used to make requests come from a specific
+	      port.
+	      If no port number is specified, the system will assign one.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">zone</strong></span>
-               {zonename}
-            </span></dt>
+	      <span><strong class="command">zone</strong></span>
+	       {zonename}
+	    </span></dt>
 <dd><p>
-              Specifies that all updates are to be made to the zone
-              <em class="parameter"><code>zonename</code></em>.
-              If no
-              <em class="parameter"><code>zone</code></em>
-              statement is provided,
-              <span><strong class="command">nsupdate</strong></span>
-              will attempt determine the correct zone to update based on the
-              rest of the input.
-            </p></dd>
+	      Specifies that all updates are to be made to the zone
+	      <em class="parameter"><code>zonename</code></em>.
+	      If no
+	      <em class="parameter"><code>zone</code></em>
+	      statement is provided,
+	      <span><strong class="command">nsupdate</strong></span>
+	      will attempt determine the correct zone to update based on the
+	      rest of the input.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">class</strong></span>
-               {classname}
-            </span></dt>
+	      <span><strong class="command">class</strong></span>
+	       {classname}
+	    </span></dt>
 <dd><p>
-              Specify the default class.
-              If no <em class="parameter"><code>class</code></em> is specified, the
-              default class is
-              <em class="parameter"><code>IN</code></em>.
-            </p></dd>
+	      Specify the default class.
+	      If no <em class="parameter"><code>class</code></em> is specified, the
+	      default class is
+	      <em class="parameter"><code>IN</code></em>.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">ttl</strong></span>
-               {seconds}
-            </span></dt>
+	      <span><strong class="command">ttl</strong></span>
+	       {seconds}
+	    </span></dt>
 <dd><p>
-              Specify the default time to live for records to be added.
+	      Specify the default time to live for records to be added.
 	      The value <em class="parameter"><code>none</code></em> will clear the default
 	      ttl.
-            </p></dd>
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">key</strong></span>
-               [hmac:] {keyname}
-               {secret}
-            </span></dt>
+	      <span><strong class="command">key</strong></span>
+	       [hmac:] {keyname}
+	       {secret}
+	    </span></dt>
 <dd><p>
-              Specifies that all updates are to be TSIG-signed using the
-              <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>secret</code></em> pair.
-              If <em class="parameter"><code>hmac</code></em> is specified, then it sets the
-              signing algorithm in use; the default is
-              <code class="literal">hmac-md5</code>.  The <span><strong class="command">key</strong></span>
-              command overrides any key specified on the command line via
-              <code class="option">-y</code> or <code class="option">-k</code>.
-            </p></dd>
+	      Specifies that all updates are to be TSIG-signed using the
+	      <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>secret</code></em> pair.
+	      If <em class="parameter"><code>hmac</code></em> is specified, then it sets the
+	      signing algorithm in use; the default is
+	      <code class="literal">hmac-md5</code>.  The <span><strong class="command">key</strong></span>
+	      command overrides any key specified on the command line via
+	      <code class="option">-y</code> or <code class="option">-k</code>.
+	    </p></dd>
 <dt><span class="term">
-            <span><strong class="command">gsstsig</strong></span>
-          </span></dt>
+	    <span><strong class="command">gsstsig</strong></span>
+	  </span></dt>
 <dd><p>
 	      Use GSS-TSIG to sign the updated.  This is equivalent to
 	      specifying <code class="option">-g</code> on the commandline.
-            </p></dd>
+	    </p></dd>
 <dt><span class="term">
-            <span><strong class="command">oldgsstsig</strong></span>
-          </span></dt>
+	    <span><strong class="command">oldgsstsig</strong></span>
+	  </span></dt>
 <dd><p>
 	      Use the Windows 2000 version of GSS-TSIG to sign the updated.
 	      This is equivalent to specifying <code class="option">-o</code> on the
 	      commandline.
-            </p></dd>
+	    </p></dd>
 <dt><span class="term">
-            <span><strong class="command">realm</strong></span>
-             {[<span class="optional">realm_name</span>]}
-          </span></dt>
+	    <span><strong class="command">realm</strong></span>
+	     {[<span class="optional">realm_name</span>]}
+	  </span></dt>
 <dd><p>
 	      When using GSS-TSIG use <em class="parameter"><code>realm_name</code></em> rather
 	      than the default realm in <code class="filename">krb5.conf</code>.  If no
 	      realm is specified the saved realm is cleared.
-            </p></dd>
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">prereq</span>] nxdomain</strong></span>
-               {domain-name}
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">prereq</span>] nxdomain</strong></span>
+	       {domain-name}
+	    </span></dt>
 <dd><p>
-              Requires that no resource record of any type exists with name
-              <em class="parameter"><code>domain-name</code></em>.
-            </p></dd>
+	      Requires that no resource record of any type exists with name
+	      <em class="parameter"><code>domain-name</code></em>.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">prereq</span>] yxdomain</strong></span>
-               {domain-name}
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">prereq</span>] yxdomain</strong></span>
+	       {domain-name}
+	    </span></dt>
 <dd><p>
-              Requires that
-              <em class="parameter"><code>domain-name</code></em>
-              exists (has as at least one resource record, of any type).
-            </p></dd>
+	      Requires that
+	      <em class="parameter"><code>domain-name</code></em>
+	      exists (has as at least one resource record, of any type).
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">prereq</span>] nxrrset</strong></span>
-               {domain-name}
-               [class]
-               {type}
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">prereq</span>] nxrrset</strong></span>
+	       {domain-name}
+	       [class]
+	       {type}
+	    </span></dt>
 <dd><p>
-              Requires that no resource record exists of the specified
-              <em class="parameter"><code>type</code></em>,
-              <em class="parameter"><code>class</code></em>
-              and
-              <em class="parameter"><code>domain-name</code></em>.
-              If
-              <em class="parameter"><code>class</code></em>
-              is omitted, IN (internet) is assumed.
-            </p></dd>
+	      Requires that no resource record exists of the specified
+	      <em class="parameter"><code>type</code></em>,
+	      <em class="parameter"><code>class</code></em>
+	      and
+	      <em class="parameter"><code>domain-name</code></em>.
+	      If
+	      <em class="parameter"><code>class</code></em>
+	      is omitted, IN (internet) is assumed.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span>
-               {domain-name}
-               [class]
-               {type}
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span>
+	       {domain-name}
+	       [class]
+	       {type}
+	    </span></dt>
 <dd><p>
-              This requires that a resource record of the specified
-              <em class="parameter"><code>type</code></em>,
-              <em class="parameter"><code>class</code></em>
-              and
-              <em class="parameter"><code>domain-name</code></em>
-              must exist.
-              If
-              <em class="parameter"><code>class</code></em>
-              is omitted, IN (internet) is assumed.
-            </p></dd>
+	      This requires that a resource record of the specified
+	      <em class="parameter"><code>type</code></em>,
+	      <em class="parameter"><code>class</code></em>
+	      and
+	      <em class="parameter"><code>domain-name</code></em>
+	      must exist.
+	      If
+	      <em class="parameter"><code>class</code></em>
+	      is omitted, IN (internet) is assumed.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span>
-               {domain-name}
-               [class]
-               {type}
-               {data...}
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span>
+	       {domain-name}
+	       [class]
+	       {type}
+	       {data...}
+	    </span></dt>
 <dd><p>
-              The
-              <em class="parameter"><code>data</code></em>
-              from each set of prerequisites of this form
-              sharing a common
-              <em class="parameter"><code>type</code></em>,
-              <em class="parameter"><code>class</code></em>,
-              and
-              <em class="parameter"><code>domain-name</code></em>
-              are combined to form a set of RRs.  This set of RRs must
-              exactly match the set of RRs existing in the zone at the
-              given
-              <em class="parameter"><code>type</code></em>,
-              <em class="parameter"><code>class</code></em>,
-              and
-              <em class="parameter"><code>domain-name</code></em>.
-              The
-              <em class="parameter"><code>data</code></em>
-              are written in the standard text representation of the resource
-              record's
-              RDATA.
-            </p></dd>
+	      The
+	      <em class="parameter"><code>data</code></em>
+	      from each set of prerequisites of this form
+	      sharing a common
+	      <em class="parameter"><code>type</code></em>,
+	      <em class="parameter"><code>class</code></em>,
+	      and
+	      <em class="parameter"><code>domain-name</code></em>
+	      are combined to form a set of RRs.  This set of RRs must
+	      exactly match the set of RRs existing in the zone at the
+	      given
+	      <em class="parameter"><code>type</code></em>,
+	      <em class="parameter"><code>class</code></em>,
+	      and
+	      <em class="parameter"><code>domain-name</code></em>.
+	      The
+	      <em class="parameter"><code>data</code></em>
+	      are written in the standard text representation of the resource
+	      record's
+	      RDATA.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">update</span>] del[<span class="optional">ete</span>]</strong></span>
-               {domain-name}
-               [ttl]
-               [class]
-               [type [data...]]
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">update</span>] del[<span class="optional">ete</span>]</strong></span>
+	       {domain-name}
+	       [ttl]
+	       [class]
+	       [type [data...]]
+	    </span></dt>
 <dd><p>
-              Deletes any resource records named
-              <em class="parameter"><code>domain-name</code></em>.
-              If
-              <em class="parameter"><code>type</code></em>
-              and
-              <em class="parameter"><code>data</code></em>
-              is provided, only matching resource records will be removed.
-              The internet class is assumed if
-              <em class="parameter"><code>class</code></em>
-              is not supplied.  The
-              <em class="parameter"><code>ttl</code></em>
-              is ignored, and is only allowed for compatibility.
-            </p></dd>
+	      Deletes any resource records named
+	      <em class="parameter"><code>domain-name</code></em>.
+	      If
+	      <em class="parameter"><code>type</code></em>
+	      and
+	      <em class="parameter"><code>data</code></em>
+	      is provided, only matching resource records will be removed.
+	      The internet class is assumed if
+	      <em class="parameter"><code>class</code></em>
+	      is not supplied.  The
+	      <em class="parameter"><code>ttl</code></em>
+	      is ignored, and is only allowed for compatibility.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">update</span>] add</strong></span>
-               {domain-name}
-               {ttl}
-               [class]
-               {type}
-               {data...}
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">update</span>] add</strong></span>
+	       {domain-name}
+	       {ttl}
+	       [class]
+	       {type}
+	       {data...}
+	    </span></dt>
 <dd><p>
-              Adds a new resource record with the specified
-              <em class="parameter"><code>ttl</code></em>,
-              <em class="parameter"><code>class</code></em>
-              and
-              <em class="parameter"><code>data</code></em>.
-            </p></dd>
+	      Adds a new resource record with the specified
+	      <em class="parameter"><code>ttl</code></em>,
+	      <em class="parameter"><code>class</code></em>
+	      and
+	      <em class="parameter"><code>data</code></em>.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">show</strong></span>
-            </span></dt>
+	      <span><strong class="command">show</strong></span>
+	    </span></dt>
 <dd><p>
-              Displays the current message, containing all of the
-              prerequisites and
-              updates specified since the last send.
-            </p></dd>
+	      Displays the current message, containing all of the
+	      prerequisites and
+	      updates specified since the last send.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">send</strong></span>
-            </span></dt>
+	      <span><strong class="command">send</strong></span>
+	    </span></dt>
 <dd><p>
-              Sends the current message.  This is equivalent to entering a
-              blank line.
-            </p></dd>
+	      Sends the current message.  This is equivalent to entering a
+	      blank line.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">answer</strong></span>
-            </span></dt>
+	      <span><strong class="command">answer</strong></span>
+	    </span></dt>
 <dd><p>
-              Displays the answer.
-            </p></dd>
+	      Displays the answer.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">debug</strong></span>
-            </span></dt>
+	      <span><strong class="command">debug</strong></span>
+	    </span></dt>
 <dd><p>
-              Turn on debugging.
-            </p></dd>
+	      Turn on debugging.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">version</strong></span>
-            </span></dt>
+	      <span><strong class="command">version</strong></span>
+	    </span></dt>
 <dd><p>
-              Print version number.
-            </p></dd>
+	      Print version number.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">help</strong></span>
-            </span></dt>
+	      <span><strong class="command">help</strong></span>
+	    </span></dt>
 <dd><p>
-              Print a list of commands.
-            </p></dd>
+	      Print a list of commands.
+	    </p></dd>
 </dl></div>
 <p>
     </p>
@@ -520,7 +526,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544861"></a><h2>EXAMPLES</h2>
+<a name="id2544989"></a><h2>EXAMPLES</h2>
 <p>
       The examples below show how
       <span><strong class="command">nsupdate</strong></span>
@@ -574,30 +580,30 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544905"></a><h2>FILES</h2>
+<a name="id2545033"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
 <dd><p>
-            used to identify default name server
-          </p></dd>
+	    used to identify default name server
+	  </p></dd>
 <dt><span class="term"><code class="constant">/var/run/named/session.key</code></span></dt>
 <dd><p>
-            sets the default TSIG key for use in local-only mode
-          </p></dd>
+	    sets the default TSIG key for use in local-only mode
+	  </p></dd>
 <dt><span class="term"><code class="constant">K{name}.+157.+{random}.key</code></span></dt>
 <dd><p>
-            base-64 encoding of HMAC-MD5 key created by
-            <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
-          </p></dd>
+	    base-64 encoding of HMAC-MD5 key created by
+	    <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
+	  </p></dd>
 <dt><span class="term"><code class="constant">K{name}.+157.+{random}.private</code></span></dt>
 <dd><p>
-            base-64 encoding of HMAC-MD5 key created by
-            <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
-          </p></dd>
+	    base-64 encoding of HMAC-MD5 key created by
+	    <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
+	  </p></dd>
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2541985"></a><h2>SEE ALSO</h2>
+<a name="id2545120"></a><h2>SEE ALSO</h2>
 <p>
       <em class="citetitle">RFC 2136</em>,
       <em class="citetitle">RFC 3007</em>,
@@ -612,7 +618,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2542042"></a><h2>BUGS</h2>
+<a name="id2545177"></a><h2>BUGS</h2>
 <p>
       The TSIG key is redundantly stored in two separate files.
       This is a consequence of nsupdate using the DST library
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index a4ff26bf14..ce8f275b56 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -83,65 +83,7 @@
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li>
-<p>
-	  On servers configured to perform DNSSEC validation using
-	  managed trust anchors (i.e., keys configured explicitly
-	  via <span><strong class="command">managed-keys</strong></span>, or implicitly 
-	  via <span><strong class="command">dnssec-validation auto;</strong></span> or
-	  <span><strong class="command">dnssec-lookaside auto;</strong></span>), revoking
-	  a trust anchor and sending a new untrusted replacement
-	  could cause <span><strong class="command">named</strong></span> to crash with an
-	  assertion failure. This could occur in the event of a
-	  botched key rollover, or potentially as a result of a
-	  deliberate attack if the attacker was in position to
-	  monitor the victim's DNS traffic.
-	</p>
-<p>
-	  This flaw was discovered by Jan-Piet Mens, and is
-	  disclosed in CVE-2015-1349. [RT #38344]
-	</p>
-</li>
-<li>
-<p>
-	  A flaw in delegation handling could be exploited to put
-	  <span><strong class="command">named</strong></span> into an infinite loop, in which
-	  each lookup of a name server triggered additional lookups
-	  of more name servers.  This has been addressed by placing
-	  limits on the number of levels of recursion
-	  <span><strong class="command">named</strong></span> will allow (default 7), and
-	  on the number of queries that it will send before
-	  terminating a recursive query (default 50).
-	</p>
-<p>
-	  The recursion depth limit is configured via the
-	  <code class="option">max-recursion-depth</code> option, and the query limit
-	  via the <code class="option">max-recursion-queries</code> option.
-	</p>
-<p>
-	  The flaw was discovered by Florian Maury of ANSSI, and is
-	  disclosed in CVE-2014-8500. [RT #37580]
-	</p>
-</li>
-<li>
-<p>
-	  Two separate problems were identified in BIND's GeoIP code that
-	  could lead to an assertion failure. One was triggered by use of
-	  both IPv4 and IPv6 address families, the other by referencing
-	  a GeoIP database in <code class="filename">named.conf</code> which was
-	  not installed. Both are covered by CVE-2014-8680. [RT #37672]
-	  [RT #37679]
-	</p>
-<p>
-	  A less serious security flaw was also found in GeoIP: changes
-	  to the <span><strong class="command">geoip-directory</strong></span> option in
-	  <code class="filename">named.conf</code> were ignored when running
-	  <span><strong class="command">rndc reconfig</strong></span>. In theory, this could allow
-	  <span><strong class="command">named</strong></span> to allow access to unintended clients.
-	</p>
-</li>
-</ul></div>
+<div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
@@ -151,169 +93,16 @@
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li><p>
-	  ACLs containing <span><strong class="command">geoip asnum</strong></span> elements were
-	  not correctly matched unless the full organization name was
-	  specified in the ACL (as in
-	  <span><strong class="command">geoip asnum "AS1234 Example, Inc.";</strong></span>).
-	  They can now match against the AS number alone (as in
-	  <span><strong class="command">geoip asnum "AS1234";</strong></span>).
-        </p></li>
-<li><p>
-          When using native PKCS#11 cryptography (i.e.,
-          <span><strong class="command">configure --enable-native-pkcs11</strong></span>) HSM PINs
-          of up to 256 characters can now be used.
-        </p></li>
-<li><p>
-          NXDOMAIN responses to queries of type DS are now cached separately
-          from those for other types. This helps when using "grafted" zones
-          of type forward, for which the parent zone does not contain a
-          delegation, such as local top-level domains.  Previously a query
-          of type DS for such a zone could cause the zone apex to be cached
-          as NXDOMAIN, blocking all subsequent queries.  (Note: This
-          change is only helpful when DNSSEC validation is not enabled.
-          "Grafted" zones without a delegation in the parent are not a
-          recommended configuration.)
-        </p></li>
-<li><p>
-          NOTIFY messages that are sent because a zone has been updated
-          are now given priority above NOTIFY messages that were scheduled
-          when the server started up. This should mitigate delays in zone
-          propagation when servers are restarted frequently.
-        </p></li>
-<li><p>
-          Errors reported when running <span><strong class="command">rndc addzone</strong></span>
-          (e.g., when a zone file cannot be loaded) have been clarified
-          to make it easier to diagnose problems.
-        </p></li>
-<li><p>
-	  Added support for OPENPGPKEY type.
-        </p></li>
-<li><p>
-	  When encountering an authoritative name server whose name is
-	  an alias pointing to another name, the resolver treats
-	  this as an error and skips to the next server. Previously
-	  this happened silently; now the error will be logged to
-	  the newly-created "cname" log category.
-	</p></li>
-<li><p>
-	  If named is not configured to validate the answer then
-	  allow fallback to plain DNS on timeout even when we know
-	  the server supports EDNS.  This will allow the server to
-	  potentially resolve signed queries when TCP is being
-	  blocked.
-	</p></li>
-</ul></div>
+<div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li><p>
-	  <span><strong class="command">dig</strong></span>, <span><strong class="command">host</strong></span> and
-	  <span><strong class="command">nslookup</strong></span> aborted when encountering
-	  a name which, after appending search list elements,
-	  exceeded 255 bytes. Such names are now skipped, but
-	  processing of other names will continue. [RT #36892]
-        </p></li>
-<li><p>
-	  The error message generated when
-	  <span><strong class="command">named-checkzone</strong></span> or
-	  <span><strong class="command">named-checkconf -z</strong></span> encounters a
-	  <code class="option">$TTL</code> directive without a value has
-	  been clarified. [RT #37138]
-        </p></li>
-<li><p>
-	  Semicolon characters (;) included in TXT records were
-	  incorrectly escaped with a backslash when the record was
-	  displayed as text. This is actually only necessary when there
-	  are no quotation marks. [RT #37159]
-        </p></li>
-<li><p>
-	  When files opened for writing by <span><strong class="command">named</strong></span>,
-	  such as zone journal files, were referenced more than once
-	  in <code class="filename">named.conf</code>, it could lead to file
-	  corruption as multiple threads wrote to the same file. This
-	  is now detected when loading <code class="filename">named.conf</code>
-	  and reported as an error. [RT #37172]
-        </p></li>
-<li><p>
-          <span><strong class="command">dnssec-keygen -S</strong></span> failed to generate successor
-          keys for some algorithm types (including ECDSA and GOST) due to
-          a difference in the content of private key files. This has been
-          corrected. [RT #37183]
-        </p></li>
-<li><p>
-          UPDATE messages that arrived too soon after
-          an <span><strong class="command">rndc thaw</strong></span> could be lost. [RT #37233]
-        </p></li>
-<li><p>
-          Forwarding of UPDATE messages did not work when they were
-          signed with SIG(0); they resulted in a BADSIG response code.
-          [RT #37216]
-        </p></li>
-<li><p>
-          When checking for updates to trust anchors listed in
-          <code class="option">managed-keys</code>, <span><strong class="command">named</strong></span>
-          now revalidates keys based on the current set of
-          active trust anchors, without relying on any cached
-          record of previous validation. [RT #37506]
-        </p></li>
-<li><p>
-	  Large-system tuning
-	  (<span><strong class="command">configure --with-tuning=large</strong></span>) caused
-	  problems on some platforms by setting a socket receive
-	  buffer size that was too large.  This is now detected and
-	  corrected at run time. [RT #37187]
-        </p></li>
-<li><p>
-	  When NXDOMAIN redirection is in use, queries for a name
-	  that is present in the redirection zone but a type that
-	  is not present will now return NOERROR instead of NXDOMAIN.
-        </p></li>
-<li><p>
-	  When a zone contained a delegation to an IPv6 name server
-	  but not an IPv4 name server, it was possible for a memory
-	  reference to be left un-freed. This caused an assertion
-	  failure on server shutdown, but was otherwise harmless.
-	  [RT #37796]
-        </p></li>
-<li><p>
-	  Due to an inadvertent removal of code in the previous
-	  release, when <span><strong class="command">named</strong></span> encountered an
-	  authoritative name server which dropped all EDNS queries,
-	  it did not always try plain DNS. This has been corrected.
-	  [RT #37965]
-        </p></li>
-<li><p>
-	  A regression caused nsupdate to use the default recursive servers
-	  rather than the SOA MNAME server when sending the UPDATE.
-        </p></li>
-<li><p>
-	  Adjusted max-recursion-queries to accommodate the smaller
-	  initial packet sizes used in BIND 9.10 and higher when
-	  contacting authoritative servers for the first time.
-        </p></li>
-<li><p>
-	  Built-in "empty" zones did not correctly inherit the
-	  "allow-transfer" ACL from the options or view. [RT #38310]
-        </p></li>
-<li><p>
-	  Two leaks were fixed that could cause <span><strong class="command">named</strong></span>
-	  processes to grow to very large sizes. [RT #38454]
-	</p></li>
-<li><p>
-	  Fixed some bugs in RFC 5011 trust anchor management,
-	  including a memory leak and a possible loss of state
-	  information. [RT #38458]
-	</p></li>
-<li><p>
+<div class="itemizedlist"><ul type="disc"><li><p>
 	  Asynchronous zone loads were not handled correctly when the
 	  zone load was already in progress; this could trigger a crash
 	  in zt.c. [RT #37573]
-	</p></li>
-</ul></div>
+ 	</p></li></ul></div>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
diff --git a/doc/arm/Bv9ARM.ch12.html b/doc/arm/Bv9ARM.ch12.html
index 5374076c94..fc49a80ede 100644
--- a/doc/arm/Bv9ARM.ch12.html
+++ b/doc/arm/Bv9ARM.ch12.html
@@ -47,13 +47,13 @@
 <dl>
 <dt><span class="sect1"><a href="Bv9ARM.ch12.html#bind9.library">BIND 9 DNS Library Support</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612451">Prerequisite</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612460">Compilation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612485">Installation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612584">Known Defects/Restrictions</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612661">The dns.conf File</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612688">Sample Applications</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613933">Library References</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613170">Prerequisite</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612087">Compilation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612112">Installation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612142">Known Defects/Restrictions</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612356">The dns.conf File</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612451">Sample Applications</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613492">Library References</a></span></dt>
 </dl></dd>
 </dl>
 </div>
@@ -89,7 +89,7 @@
 </ul></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612451"></a>Prerequisite</h3></div></div></div>
+<a name="id2613170"></a>Prerequisite</h3></div></div></div>
 <p>GNU make is required to build the export libraries (other
   part of BIND 9 can still be built with other types of make). In
   the reminder of this document, "make" means GNU make. Note that
@@ -98,7 +98,7 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612460"></a>Compilation</h3></div></div></div>
+<a name="id2612087"></a>Compilation</h3></div></div></div>
 <pre class="screen">
 $ <strong class="userinput"><code>./configure --enable-exportlib <em class="replaceable"><code>[other flags]</code></em></code></strong>
 $ <strong class="userinput"><code>make</code></strong>
@@ -113,7 +113,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612485"></a>Installation</h3></div></div></div>
+<a name="id2612112"></a>Installation</h3></div></div></div>
 <pre class="screen">
 $ <strong class="userinput"><code>cd lib/export</code></strong>
 $ <strong class="userinput"><code>make install</code></strong>
@@ -135,7 +135,7 @@ $ <strong class="userinput"><code>make install</code></strong>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612584"></a>Known Defects/Restrictions</h3></div></div></div>
+<a name="id2612142"></a>Known Defects/Restrictions</h3></div></div></div>
 <div class="itemizedlist"><ul type="disc">
 <li><p>Currently, win32 is not supported for the export
       library. (Normal BIND 9 application can be built as
@@ -175,7 +175,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612661"></a>The dns.conf File</h3></div></div></div>
+<a name="id2612356"></a>The dns.conf File</h3></div></div></div>
 <p>The IRS library supports an "advanced" configuration file
   related to the DNS library for configuration parameters that
   would be beyond the capability of the
@@ -193,14 +193,14 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612688"></a>Sample Applications</h3></div></div></div>
+<a name="id2612451"></a>Sample Applications</h3></div></div></div>
 <p>Some sample application programs using this API are
   provided for reference. The following is a brief description of
   these applications.
   </p>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612696"></a>sample: a simple stub resolver utility</h4></div></div></div>
+<a name="id2612459"></a>sample: a simple stub resolver utility</h4></div></div></div>
 <p>
   It sends a query of a given name (of a given optional RR type) to a
   specified recursive server, and prints the result as a list of
@@ -264,7 +264,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612855"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div>
+<a name="id2612550"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div>
 <p>
   Similar to "sample", but accepts a list
   of (query) domain names as a separate file and resolves the names
@@ -305,7 +305,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612908"></a>sample-request: a simple DNS transaction client</h4></div></div></div>
+<a name="id2612808"></a>sample-request: a simple DNS transaction client</h4></div></div></div>
 <p>
   It sends a query to a specified server, and
   prints the response with minimal processing. It doesn't act as a
@@ -346,7 +346,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612972"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div>
+<a name="id2612872"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div>
 <p>
   This is a test program
   to check getaddrinfo() and getnameinfo() behavior. It takes a
@@ -363,7 +363,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612987"></a>sample-update: a simple dynamic update client program</h4></div></div></div>
+<a name="id2612887"></a>sample-update: a simple dynamic update client program</h4></div></div></div>
 <p>
   It accepts a single update command as a
   command-line argument, sends an update request message to the
@@ -458,7 +458,7 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2613801"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div>
+<a name="id2613428"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div>
 <p>
   It checks a set
   of domains to see the name servers of the domains behave
@@ -515,7 +515,7 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2613933"></a>Library References</h3></div></div></div>
+<a name="id2613492"></a>Library References</h3></div></div></div>
 <p>As of this writing, there is no formal "manual" of the
   libraries, except this document, header files (some of them
   provide pretty detailed explanations), and sample application
diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html
index 4deb47945d..e0f0859fae 100644
--- a/doc/arm/Bv9ARM.html
+++ b/doc/arm/Bv9ARM.html
@@ -268,13 +268,13 @@
 <dd><dl>
 <dt><span class="sect1"><a href="Bv9ARM.ch12.html#bind9.library">BIND 9 DNS Library Support</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612451">Prerequisite</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612460">Compilation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612485">Installation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612584">Known Defects/Restrictions</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612661">The dns.conf File</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612688">Sample Applications</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613933">Library References</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613170">Prerequisite</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612087">Compilation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612112">Installation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612142">Known Defects/Restrictions</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612356">The dns.conf File</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2612451">Sample Applications</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch12.html#id2613492">Library References</a></span></dt>
 </dl></dd>
 </dl></dd>
 <dt><span class="reference"><a href="Bv9ARM.ch13.html">I. Manual pages</a></span></dt>
diff --git a/doc/arm/man.arpaname.html b/doc/arm/man.arpaname.html
index 9cd490d170..1def1b825e 100644
--- a/doc/arm/man.arpaname.html
+++ b/doc/arm/man.arpaname.html
@@ -50,20 +50,20 @@
 <div class="cmdsynopsis"><p><code class="command">arpaname</code>  {<em class="replaceable"><code>ipaddress </code></em>...}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2623818"></a><h2>DESCRIPTION</h2>
+<a name="id2621178"></a><h2>DESCRIPTION</h2>
 <p>
       <span><strong class="command">arpaname</strong></span> translates IP addresses (IPv4 and
       IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2663974"></a><h2>SEE ALSO</h2>
+<a name="id2621193"></a><h2>SEE ALSO</h2>
 <p>
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2663988"></a><h2>AUTHOR</h2>
+<a name="id2621207"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.ddns-confgen.html b/doc/arm/man.ddns-confgen.html
index f2e76a84f7..0ce333b4ea 100644
--- a/doc/arm/man.ddns-confgen.html
+++ b/doc/arm/man.ddns-confgen.html
@@ -51,7 +51,7 @@
 <div class="cmdsynopsis"><p><code class="command">ddns-confgen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-q</code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [ -s <em class="replaceable"><code>name</code></em>  |   -z <em class="replaceable"><code>zone</code></em> ]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2661977"></a><h2>DESCRIPTION</h2>
+<a name="id2664321"></a><h2>DESCRIPTION</h2>
 <p>
       <span><strong class="command">tsig-keygen</strong></span> and <span><strong class="command">ddns-confgen</strong></span>
       are invocation methods for a utility that generates keys for use
@@ -87,7 +87,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2662354"></a><h2>OPTIONS</h2>
+<a name="id2664765"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd><p>
@@ -159,7 +159,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2662638"></a><h2>SEE ALSO</h2>
+<a name="id2664982"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">nsupdate</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -167,7 +167,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2662677"></a><h2>AUTHOR</h2>
+<a name="id2665020"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.delv.html b/doc/arm/man.delv.html
index deadfc27ef..736512d83f 100644
--- a/doc/arm/man.delv.html
+++ b/doc/arm/man.delv.html
@@ -53,7 +53,7 @@
 <div class="cmdsynopsis"><p><code class="command">delv</code>  [queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2615890"></a><h2>DESCRIPTION</h2>
+<a name="id2615315"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">delv</strong></span>
       (Domain Entity Lookup &amp; Validation) is a tool for sending
       DNS queries and validating the results, using the the same internal
@@ -96,7 +96,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2615962"></a><h2>SIMPLE USAGE</h2>
+<a name="id2615933"></a><h2>SIMPLE USAGE</h2>
 <p>
       A typical invocation of <span><strong class="command">delv</strong></span> looks like:
       </p>
@@ -151,7 +151,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2616298"></a><h2>OPTIONS</h2>
+<a name="id2616201"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>anchor-file</code></em></span></dt>
 <dd>
@@ -285,7 +285,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2672007"></a><h2>QUERY OPTIONS</h2>
+<a name="id2671569"></a><h2>QUERY OPTIONS</h2>
 <p><span><strong class="command">delv</strong></span>
       provides a number of query options which affect the way results are
       displayed, and in some cases the way lookups are performed.
@@ -465,12 +465,12 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2672523"></a><h2>FILES</h2>
+<a name="id2672085"></a><h2>FILES</h2>
 <p><code class="filename">/etc/bind.keys</code></p>
 <p><code class="filename">/etc/resolv.conf</code></p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2672542"></a><h2>SEE ALSO</h2>
+<a name="id2672104"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <em class="citetitle">RFC4034</em>,
diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html
index 0428752789..f52f76592f 100644
--- a/doc/arm/man.dig.html
+++ b/doc/arm/man.dig.html
@@ -52,7 +52,7 @@
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [global-queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2614014"></a><h2>DESCRIPTION</h2>
+<a name="id2613852"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dig</strong></span>
       (domain information groper) is a flexible tool
       for interrogating DNS name servers.  It performs DNS lookups and
@@ -99,7 +99,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2614117"></a><h2>SIMPLE USAGE</h2>
+<a name="id2613955"></a><h2>SIMPLE USAGE</h2>
 <p>
       A typical invocation of <span><strong class="command">dig</strong></span> looks like:
       </p>
@@ -152,7 +152,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2614243"></a><h2>OPTIONS</h2>
+<a name="id2614081"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -280,7 +280,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2666572"></a><h2>QUERY OPTIONS</h2>
+<a name="id2666615"></a><h2>QUERY OPTIONS</h2>
 <p><span><strong class="command">dig</strong></span>
       provides a number of query options which affect
       the way in which lookups are made and the results displayed.  Some of
@@ -666,7 +666,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667817"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2667860"></a><h2>MULTIPLE QUERIES</h2>
 <p>
       The BIND 9 implementation of <span><strong class="command">dig </strong></span>
       supports
@@ -712,7 +712,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667902"></a><h2>IDN SUPPORT</h2>
+<a name="id2667945"></a><h2>IDN SUPPORT</h2>
 <p>
       If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names.
@@ -726,14 +726,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667931"></a><h2>FILES</h2>
+<a name="id2667974"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 <p><code class="filename">${HOME}/.digrc</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667953"></a><h2>SEE ALSO</h2>
+<a name="id2667995"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
@@ -741,7 +741,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2667990"></a><h2>BUGS</h2>
+<a name="id2668033"></a><h2>BUGS</h2>
 <p>
       There are probably too many query options.
     </p>
diff --git a/doc/arm/man.dnssec-checkds.html b/doc/arm/man.dnssec-checkds.html
index 45097b7e88..d0d6ea1cc4 100644
--- a/doc/arm/man.dnssec-checkds.html
+++ b/doc/arm/man.dnssec-checkds.html
@@ -51,7 +51,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>] [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>] {zone}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2616710"></a><h2>DESCRIPTION</h2>
+<a name="id2617022"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-checkds</strong></span>
       verifies the correctness of Delegation Signer (DS) or DNSSEC
       Lookaside Validation (DLV) resource records for keys in a specified
@@ -59,7 +59,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2616724"></a><h2>OPTIONS</h2>
+<a name="id2617036"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
 <dd><p>
@@ -88,14 +88,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2616894"></a><h2>SEE ALSO</h2>
+<a name="id2617139"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2616929"></a><h2>AUTHOR</h2>
+<a name="id2617173"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.dnssec-coverage.html b/doc/arm/man.dnssec-coverage.html
index f9d6cc8248..a05ba4a2c6 100644
--- a/doc/arm/man.dnssec-coverage.html
+++ b/doc/arm/man.dnssec-coverage.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-coverage</code>  [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>length</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>] [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>] [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>] [<code class="option">-k</code>] [<code class="option">-z</code>] [zone]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2617208"></a><h2>DESCRIPTION</h2>
+<a name="id2617384"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-coverage</strong></span>
       verifies that the DNSSEC keys for a given zone or a set of zones
       have timing metadata set properly to ensure no future lapses in DNSSEC
@@ -78,7 +78,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2617235"></a><h2>OPTIONS</h2>
+<a name="id2617411"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
@@ -192,7 +192,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2617612"></a><h2>SEE ALSO</h2>
+<a name="id2618061"></a><h2>SEE ALSO</h2>
 <p>
       <span class="citerefentry"><span class="refentrytitle">dnssec-checkds</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
@@ -201,7 +201,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2617656"></a><h2>AUTHOR</h2>
+<a name="id2618105"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.dnssec-dsfromkey.html b/doc/arm/man.dnssec-dsfromkey.html
index dd6b3a3c7e..08c254c0df 100644
--- a/doc/arm/man.dnssec-dsfromkey.html
+++ b/doc/arm/man.dnssec-dsfromkey.html
@@ -52,14 +52,14 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2618116"></a><h2>DESCRIPTION</h2>
+<a name="id2618360"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-dsfromkey</strong></span>
       outputs the Delegation Signer (DS) resource record (RR), as defined in
       RFC 3658 and RFC 4509, for the given key(s).
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2618130"></a><h2>OPTIONS</h2>
+<a name="id2618374"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-1</span></dt>
 <dd><p>
@@ -144,7 +144,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2618529"></a><h2>EXAMPLE</h2>
+<a name="id2619182"></a><h2>EXAMPLE</h2>
 <p>
       To build the SHA-256 DS RR from the
       <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
@@ -159,7 +159,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2618565"></a><h2>FILES</h2>
+<a name="id2619219"></a><h2>FILES</h2>
 <p>
       The keyfile can be designed by the key identification
       <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
@@ -173,13 +173,13 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2618606"></a><h2>CAVEAT</h2>
+<a name="id2619260"></a><h2>CAVEAT</h2>
 <p>
       A keyfile error can give a "file not found" even if the file exists.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2618616"></a><h2>SEE ALSO</h2>
+<a name="id2619270"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -189,7 +189,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2620294"></a><h2>AUTHOR</h2>
+<a name="id2619309"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.dnssec-importkey.html b/doc/arm/man.dnssec-importkey.html
index c90a6e602c..c8be80c089 100644
--- a/doc/arm/man.dnssec-importkey.html
+++ b/doc/arm/man.dnssec-importkey.html
@@ -51,7 +51,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  {<code class="option">-f <em class="replaceable"><code>filename</code></em></code>} [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">dnsname</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619025"></a><h2>DESCRIPTION</h2>
+<a name="id2619474"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-importkey</strong></span>
       reads a public DNSKEY record and generates a pair of
       .key/.private files.  The DNSKEY record may be read from an
@@ -71,7 +71,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619189"></a><h2>OPTIONS</h2>
+<a name="id2619501"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-f <em class="replaceable"><code>filename</code></em></span></dt>
 <dd>
@@ -114,7 +114,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619326"></a><h2>TIMING OPTIONS</h2>
+<a name="id2619707"></a><h2>TIMING OPTIONS</h2>
 <p>
       Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
       If the argument begins with a '+' or '-', it is interpreted as
@@ -142,7 +142,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619373"></a><h2>FILES</h2>
+<a name="id2619754"></a><h2>FILES</h2>
 <p>
       A keyfile can be designed by the key identification
       <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
@@ -151,7 +151,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619399"></a><h2>SEE ALSO</h2>
+<a name="id2619780"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -159,7 +159,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619432"></a><h2>AUTHOR</h2>
+<a name="id2620222"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.dnssec-keyfromlabel.html b/doc/arm/man.dnssec-keyfromlabel.html
index 7270a2cfd4..6bab6d67b9 100644
--- a/doc/arm/man.dnssec-keyfromlabel.html
+++ b/doc/arm/man.dnssec-keyfromlabel.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code>  {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y</code>] {name}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619696"></a><h2>DESCRIPTION</h2>
+<a name="id2620827"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-keyfromlabel</strong></span>
       generates a key pair of files that referencing a key object stored
       in a cryptographic hardware service module (HSM).  The private key
@@ -66,7 +66,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2619721"></a><h2>OPTIONS</h2>
+<a name="id2620853"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
@@ -243,7 +243,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2672755"></a><h2>TIMING OPTIONS</h2>
+<a name="id2675184"></a><h2>TIMING OPTIONS</h2>
 <p>
       Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
       If the argument begins with a '+' or '-', it is interpreted as
@@ -315,7 +315,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2672945"></a><h2>GENERATED KEY FILES</h2>
+<a name="id2675305"></a><h2>GENERATED KEY FILES</h2>
 <p>
       When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes
       successfully,
@@ -354,7 +354,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2673038"></a><h2>SEE ALSO</h2>
+<a name="id2675399"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -363,7 +363,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2673212"></a><h2>AUTHOR</h2>
+<a name="id2675436"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.dnssec-keygen.html b/doc/arm/man.dnssec-keygen.html
index 15bfa0afc3..52b40965ba 100644
--- a/doc/arm/man.dnssec-keygen.html
+++ b/doc/arm/man.dnssec-keygen.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-z</code>] {name}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2621156"></a><h2>DESCRIPTION</h2>
+<a name="id2622083"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-keygen</strong></span>
       generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
       and RFC 4034.  It can also generate keys for use with
@@ -64,7 +64,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2621313"></a><h2>OPTIONS</h2>
+<a name="id2622103"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
@@ -287,7 +287,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2675860"></a><h2>TIMING OPTIONS</h2>
+<a name="id2677128"></a><h2>TIMING OPTIONS</h2>
 <p>
       Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
       If the argument begins with a '+' or '-', it is interpreted as
@@ -361,7 +361,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2676050"></a><h2>GENERATED KEYS</h2>
+<a name="id2677386"></a><h2>GENERATED KEYS</h2>
 <p>
       When <span><strong class="command">dnssec-keygen</strong></span> completes
       successfully,
@@ -407,7 +407,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2676157"></a><h2>EXAMPLE</h2>
+<a name="id2677494"></a><h2>EXAMPLE</h2>
 <p>
       To generate a 768-bit DSA key for the domain
       <strong class="userinput"><code>example.com</code></strong>, the following command would be
@@ -428,7 +428,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2676214"></a><h2>SEE ALSO</h2>
+<a name="id2677550"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
       <em class="citetitle">RFC 2539</em>,
@@ -437,7 +437,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2676245"></a><h2>AUTHOR</h2>
+<a name="id2677581"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.dnssec-revoke.html b/doc/arm/man.dnssec-revoke.html
index ddc5e2fd71..ae3b41a605 100644
--- a/doc/arm/man.dnssec-revoke.html
+++ b/doc/arm/man.dnssec-revoke.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-revoke</code>  [<code class="option">-hr</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f</code>] [<code class="option">-R</code>] {keyfile}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2621814"></a><h2>DESCRIPTION</h2>
+<a name="id2624857"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-revoke</strong></span>
       reads a DNSSEC key file, sets the REVOKED bit on the key as defined
       in RFC 5011, and creates a new pair of key files containing the
@@ -58,7 +58,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2621828"></a><h2>OPTIONS</h2>
+<a name="id2624871"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-h</span></dt>
 <dd><p>
@@ -109,14 +109,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2621965"></a><h2>SEE ALSO</h2>
+<a name="id2632654"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
       <em class="citetitle">RFC 5011</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2621990"></a><h2>AUTHOR</h2>
+<a name="id2632679"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.dnssec-settime.html b/doc/arm/man.dnssec-settime.html
index c8f201164f..7cc55e5dfc 100644
--- a/doc/arm/man.dnssec-settime.html
+++ b/doc/arm/man.dnssec-settime.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-settime</code>  [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2623201"></a><h2>DESCRIPTION</h2>
+<a name="id2632797"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-settime</strong></span>
       reads a DNSSEC private key file and sets the key timing metadata
       as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
@@ -76,7 +76,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2623259"></a><h2>OPTIONS</h2>
+<a name="id2632924"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-f</span></dt>
 <dd><p>
@@ -133,7 +133,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2624150"></a><h2>TIMING OPTIONS</h2>
+<a name="id2635795"></a><h2>TIMING OPTIONS</h2>
 <p>
       Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
       If the argument begins with a '+' or '-', it is interpreted as
@@ -212,7 +212,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2624562"></a><h2>PRINTING OPTIONS</h2>
+<a name="id2636480"></a><h2>PRINTING OPTIONS</h2>
 <p>
       <span><strong class="command">dnssec-settime</strong></span> can also be used to print the
       timing metadata associated with a key.
@@ -238,7 +238,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2636384"></a><h2>SEE ALSO</h2>
+<a name="id2636560"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -246,7 +246,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2636417"></a><h2>AUTHOR</h2>
+<a name="id2636593"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html
index 06f1fa4647..2dc5d6654a 100644
--- a/doc/arm/man.dnssec-signzone.html
+++ b/doc/arm/man.dnssec-signzone.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code>  [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-M <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-P</code>] [<code class="option">-p</code>] [<code class="option">-R</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2636581"></a><h2>DESCRIPTION</h2>
+<a name="id2642833"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-signzone</strong></span>
       signs a zone.  It generates
       NSEC and RRSIG records and produces a signed version of the
@@ -61,7 +61,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2636600"></a><h2>OPTIONS</h2>
+<a name="id2642852"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd><p>
@@ -509,7 +509,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2682360"></a><h2>EXAMPLE</h2>
+<a name="id2681785"></a><h2>EXAMPLE</h2>
 <p>
       The following command signs the <strong class="userinput"><code>example.com</code></strong>
       zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span>
@@ -539,14 +539,14 @@ db.example.com.signed
 %</pre>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2682439"></a><h2>SEE ALSO</h2>
+<a name="id2681932"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
       <em class="citetitle">RFC 4033</em>, <em class="citetitle">RFC 4641</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2682467"></a><h2>AUTHOR</h2>
+<a name="id2681960"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.dnssec-verify.html b/doc/arm/man.dnssec-verify.html
index a9545c4dc5..2e54a95ec2 100644
--- a/doc/arm/man.dnssec-verify.html
+++ b/doc/arm/man.dnssec-verify.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-verify</code>  [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-x</code>] [<code class="option">-z</code>] {zonefile}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2633950"></a><h2>DESCRIPTION</h2>
+<a name="id2643138"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-verify</strong></span>
       verifies that a zone is fully signed for each algorithm found
       in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
@@ -58,7 +58,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2633964"></a><h2>OPTIONS</h2>
+<a name="id2643152"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd><p>
@@ -138,7 +138,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2642613"></a><h2>SEE ALSO</h2>
+<a name="id2643335"></a><h2>SEE ALSO</h2>
 <p>
       <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -146,7 +146,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2642638"></a><h2>AUTHOR</h2>
+<a name="id2643838"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.genrandom.html b/doc/arm/man.genrandom.html
index ec5f9f4fc1..cdc4245590 100644
--- a/doc/arm/man.genrandom.html
+++ b/doc/arm/man.genrandom.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">genrandom</code>  [<code class="option">-n <em class="replaceable"><code>number</code></em></code>] {<em class="replaceable"><code>size</code></em>} {<em class="replaceable"><code>filename</code></em>}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2623944"></a><h2>DESCRIPTION</h2>
+<a name="id2665063"></a><h2>DESCRIPTION</h2>
 <p>
       <span><strong class="command">genrandom</strong></span>
       generates a file or a set of files containing a specified quantity
@@ -59,7 +59,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2623959"></a><h2>ARGUMENTS</h2>
+<a name="id2665078"></a><h2>ARGUMENTS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-n <em class="replaceable"><code>number</code></em></span></dt>
 <dd><p>
@@ -77,14 +77,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2664502"></a><h2>SEE ALSO</h2>
+<a name="id2665139"></a><h2>SEE ALSO</h2>
 <p>
       <span class="citerefentry"><span class="refentrytitle">rand</span>(3)</span>,
       <span class="citerefentry"><span class="refentrytitle">arc4random</span>(3)</span>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2664597"></a><h2>AUTHOR</h2>
+<a name="id2665165"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.host.html b/doc/arm/man.host.html
index 78756cf765..566fd74520 100644
--- a/doc/arm/man.host.html
+++ b/doc/arm/man.host.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">host</code>  [<code class="option">-aCdlnrsTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-v</code>] [<code class="option">-V</code>] {name} [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2614523"></a><h2>DESCRIPTION</h2>
+<a name="id2614358"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">host</strong></span>
       is a simple utility for performing DNS lookups.
       It is normally used to convert names to IP addresses and vice versa.
@@ -206,7 +206,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2615187"></a><h2>IDN SUPPORT</h2>
+<a name="id2614953"></a><h2>IDN SUPPORT</h2>
 <p>
       If <span><strong class="command">host</strong></span> has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names. 
@@ -220,12 +220,12 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2615216"></a><h2>FILES</h2>
+<a name="id2614982"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2615229"></a><h2>SEE ALSO</h2>
+<a name="id2614996"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
     </p>
diff --git a/doc/arm/man.isc-hmac-fixup.html b/doc/arm/man.isc-hmac-fixup.html
index 457a4e82c9..42cb8746de 100644
--- a/doc/arm/man.isc-hmac-fixup.html
+++ b/doc/arm/man.isc-hmac-fixup.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">isc-hmac-fixup</code>  {<em class="replaceable"><code>algorithm</code></em>} {<em class="replaceable"><code>secret</code></em>}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2664858"></a><h2>DESCRIPTION</h2>
+<a name="id2622146"></a><h2>DESCRIPTION</h2>
 <p>
       Versions of BIND 9 up to and including BIND 9.6 had a bug causing
       HMAC-SHA* TSIG keys which were longer than the digest length of the
@@ -76,7 +76,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2664886"></a><h2>SECURITY CONSIDERATIONS</h2>
+<a name="id2622173"></a><h2>SECURITY CONSIDERATIONS</h2>
 <p>
       Secrets that have been converted by <span><strong class="command">isc-hmac-fixup</strong></span>
       are shortened, but as this is how the HMAC protocol works in
@@ -87,14 +87,14 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2664902"></a><h2>SEE ALSO</h2>
+<a name="id2622189"></a><h2>SEE ALSO</h2>
 <p>
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
       <em class="citetitle">RFC 2104</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2664919"></a><h2>AUTHOR</h2>
+<a name="id2665488"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.named-checkconf.html b/doc/arm/man.named-checkconf.html
index e6a9299c72..ed38b9eb03 100644
--- a/doc/arm/man.named-checkconf.html
+++ b/doc/arm/man.named-checkconf.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-h</code>] [<code class="option">-v</code>] [<code class="option">-j</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename} [<code class="option">-p</code>] [<code class="option">-x</code>] [<code class="option">-z</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2642738"></a><h2>DESCRIPTION</h2>
+<a name="id2643938"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-checkconf</strong></span>
       checks the syntax, but not the semantics, of a
       <span><strong class="command">named</strong></span> configuration file.  The file is parsed
@@ -70,7 +70,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2642808"></a><h2>OPTIONS</h2>
+<a name="id2644008"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-h</span></dt>
 <dd><p>
@@ -119,21 +119,21 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2643032"></a><h2>RETURN VALUES</h2>
+<a name="id2644164"></a><h2>RETURN VALUES</h2>
 <p><span><strong class="command">named-checkconf</strong></span>
       returns an exit status of 1 if
       errors were detected and 0 otherwise.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2643046"></a><h2>SEE ALSO</h2>
+<a name="id2644178"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2643076"></a><h2>AUTHOR</h2>
+<a name="id2644208"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.named-checkzone.html b/doc/arm/man.named-checkzone.html
index 7669998971..5bfd5274ba 100644
--- a/doc/arm/man.named-checkzone.html
+++ b/doc/arm/man.named-checkzone.html
@@ -51,7 +51,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-compilezone</code>  [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-J <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-l <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {<code class="option">-o <em class="replaceable"><code>filename</code></em></code>} {zonename} {filename}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2684976"></a><h2>DESCRIPTION</h2>
+<a name="id2684332"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
       checks the syntax and integrity of a zone file.  It performs the
       same checks as <span><strong class="command">named</strong></span> does when loading a
@@ -71,7 +71,7 @@
      </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2685026"></a><h2>OPTIONS</h2>
+<a name="id2684382"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-d</span></dt>
 <dd><p>
@@ -305,14 +305,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2685995"></a><h2>RETURN VALUES</h2>
+<a name="id2685420"></a><h2>RETURN VALUES</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
       returns an exit status of 1 if
       errors were detected and 0 otherwise.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2686009"></a><h2>SEE ALSO</h2>
+<a name="id2685434"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
       <em class="citetitle">RFC 1035</em>,
@@ -320,7 +320,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2686042"></a><h2>AUTHOR</h2>
+<a name="id2685467"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.named-journalprint.html b/doc/arm/man.named-journalprint.html
index 7aadb2c6e2..b3c0613724 100644
--- a/doc/arm/man.named-journalprint.html
+++ b/doc/arm/man.named-journalprint.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-journalprint</code>  {<em class="replaceable"><code>journal</code></em>}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2622185"></a><h2>DESCRIPTION</h2>
+<a name="id2618678"></a><h2>DESCRIPTION</h2>
 <p>
       <span><strong class="command">named-journalprint</strong></span>
       prints the contents of a zone journal file in a human-readable
@@ -76,7 +76,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2646602"></a><h2>SEE ALSO</h2>
+<a name="id2651424"></a><h2>SEE ALSO</h2>
 <p>
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">nsupdate</span>(8)</span>,
@@ -84,7 +84,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2646633"></a><h2>AUTHOR</h2>
+<a name="id2651454"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.named-rrchecker.html b/doc/arm/man.named-rrchecker.html
index 68254fe350..1c88603e49 100644
--- a/doc/arm/man.named-rrchecker.html
+++ b/doc/arm/man.named-rrchecker.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-rrchecker</code>  [<code class="option">-h</code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-p</code>] [<code class="option">-u</code>] [<code class="option">-C</code>] [<code class="option">-T</code>] [<code class="option">-P</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2622325"></a><h2>DESCRIPTION</h2>
+<a name="id2652268"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-rrchecker</strong></span>
      read a individual DNS resource record from standard input and checks if it
      is syntactically correct.
@@ -78,7 +78,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2653306"></a><h2>SEE ALSO</h2>
+<a name="id2652325"></a><h2>SEE ALSO</h2>
 <p>
       <em class="citetitle">RFC 1034</em>,
       <em class="citetitle">RFC 1035</em>,
diff --git a/doc/arm/man.named.html b/doc/arm/man.named.html
index 1257510d1b..348763d9ae 100644
--- a/doc/arm/man.named.html
+++ b/doc/arm/man.named.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-D <em class="replaceable"><code>string</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine-name</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-M <em class="replaceable"><code>option</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-U <em class="replaceable"><code>#listeners</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-V</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2645880"></a><h2>DESCRIPTION</h2>
+<a name="id2646267"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named</strong></span>
       is a Domain Name System (DNS) server,
       part of the BIND 9 distribution from ISC.  For more
@@ -65,7 +65,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2645911"></a><h2>OPTIONS</h2>
+<a name="id2646844"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -284,7 +284,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2686212"></a><h2>SIGNALS</h2>
+<a name="id2685848"></a><h2>SIGNALS</h2>
 <p>
       In routine operation, signals should not be used to control
       the nameserver; <span><strong class="command">rndc</strong></span> should be used
@@ -305,7 +305,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2686262"></a><h2>CONFIGURATION</h2>
+<a name="id2685898"></a><h2>CONFIGURATION</h2>
 <p>
       The <span><strong class="command">named</strong></span> configuration file is too complex
       to describe in detail here.  A complete description is provided
@@ -322,7 +322,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2686379"></a><h2>FILES</h2>
+<a name="id2685947"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
 <dd><p>
@@ -335,7 +335,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2686423"></a><h2>SEE ALSO</h2>
+<a name="id2685991"></a><h2>SEE ALSO</h2>
 <p><em class="citetitle">RFC 1033</em>,
       <em class="citetitle">RFC 1034</em>,
       <em class="citetitle">RFC 1035</em>,
@@ -348,7 +348,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2686493"></a><h2>AUTHOR</h2>
+<a name="id2686061"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.nsec3hash.html b/doc/arm/man.nsec3hash.html
index b539f8ce7d..b2ea7a22cb 100644
--- a/doc/arm/man.nsec3hash.html
+++ b/doc/arm/man.nsec3hash.html
@@ -48,7 +48,7 @@
 <div class="cmdsynopsis"><p><code class="command">nsec3hash</code>  {<em class="replaceable"><code>salt</code></em>} {<em class="replaceable"><code>algorithm</code></em>} {<em class="replaceable"><code>iterations</code></em>} {<em class="replaceable"><code>domain</code></em>}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2624960"></a><h2>DESCRIPTION</h2>
+<a name="id2622524"></a><h2>DESCRIPTION</h2>
 <p>
       <span><strong class="command">nsec3hash</strong></span> generates an NSEC3 hash based on
       a set of NSEC3 parameters.  This can be used to check the validity
@@ -56,7 +56,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2624974"></a><h2>ARGUMENTS</h2>
+<a name="id2665547"></a><h2>ARGUMENTS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">salt</span></dt>
 <dd><p>
@@ -80,14 +80,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665041"></a><h2>SEE ALSO</h2>
+<a name="id2665609"></a><h2>SEE ALSO</h2>
 <p>
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
       <em class="citetitle">RFC 5155</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665058"></a><h2>AUTHOR</h2>
+<a name="id2665626"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.nsupdate.html b/doc/arm/man.nsupdate.html
index 1c9ae0b8b1..6e5cac5d2e 100644
--- a/doc/arm/man.nsupdate.html
+++ b/doc/arm/man.nsupdate.html
@@ -47,10 +47,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">nsupdate</code>  [<code class="option">-d</code>] [<code class="option">-D</code>] [[<code class="option">-g</code>] |  [<code class="option">-o</code>] |  [<code class="option">-l</code>] |  [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] |  [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [<code class="option">-T</code>] [<code class="option">-P</code>] [<code class="option">-V</code>] [filename]</p></div>
+<div class="cmdsynopsis"><p><code class="command">nsupdate</code>  [<code class="option">-d</code>] [<code class="option">-D</code>] [<code class="option">-L <em class="replaceable"><code>level</code></em></code>] [[<code class="option">-g</code>] |  [<code class="option">-o</code>] |  [<code class="option">-l</code>] |  [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] |  [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [<code class="option">-T</code>] [<code class="option">-P</code>] [<code class="option">-V</code>] [filename]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2653803"></a><h2>DESCRIPTION</h2>
+<a name="id2653091"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">nsupdate</strong></span>
       is used to submit Dynamic DNS Update requests as defined in RFC 2136
       to a name server.
@@ -74,44 +74,31 @@
       Requests are sent to the zone's master server.
       This is identified by the MNAME field of the zone's SOA record.
     </p>
-<p>
-      The
-      <code class="option">-d</code>
-      option makes
-      <span><strong class="command">nsupdate</strong></span>
-      operate in debug mode.
-      This provides tracing information about the update requests that are
-      made and the replies received from the name server.
-    </p>
-<p>
-      The <code class="option">-D</code> option makes <span><strong class="command">nsupdate</strong></span>
-      report additional debugging information to <code class="option">-d</code>.
-    </p>
-<p>
-      The <code class="option">-L</code> option with an integer argument of zero or
-      higher sets the logging debug level.  If zero, logging is disabled.
-    </p>
 <p>
       Transaction signatures can be used to authenticate the Dynamic
       DNS updates.  These use the TSIG resource record type described
       in RFC 2845 or the SIG(0) record described in RFC 2535 and
-      RFC 2931 or GSS-TSIG as described in RFC 3645.  TSIG relies on
+      RFC 2931 or GSS-TSIG as described in RFC 3645.
+    </p>
+<p>
+      TSIG relies on
       a shared secret that should only be known to
-      <span><strong class="command">nsupdate</strong></span> and the name server.  Currently,
-      the only supported encryption algorithm for TSIG is HMAC-MD5,
-      which is defined in RFC 2104.  Once other algorithms are
-      defined for TSIG, applications will need to ensure they select
-      the appropriate algorithm as well as the key when authenticating
-      each other.  For instance, suitable <span class="type">key</span> and
+      <span><strong class="command">nsupdate</strong></span> and the name server.
+      For instance, suitable <span class="type">key</span> and
       <span class="type">server</span> statements would be added to
       <code class="filename">/etc/named.conf</code> so that the name server
       can associate the appropriate secret key and algorithm with
       the IP address of the client application that will be using
-      TSIG authentication.  SIG(0) uses public key cryptography.
+      TSIG authentication. You can use <span><strong class="command">ddns-confgen</strong></span>
+      to generate suitable configuration fragments.
+      <span><strong class="command">nsupdate</strong></span>
+      uses the <code class="option">-y</code> or <code class="option">-k</code> options
+      to provide the TSIG shared secret.  These options are mutually exclusive.
+    </p>
+<p>
+      SIG(0) uses public key cryptography.
       To use a SIG(0) key, the public key must be stored in a KEY
       record in a zone served by the name server.
-      <span><strong class="command">nsupdate</strong></span> does not read
-      <code class="filename">/etc/named.conf</code>.
     </p>
 <p>
       GSS-TSIG uses Kerberos credentials.  Standard GSS-TSIG mode
@@ -119,124 +106,143 @@
       non-standards-compliant variant of GSS-TSIG used by Windows
       2000 can be switched on with the <code class="option">-o</code> flag.
     </p>
-<p><span><strong class="command">nsupdate</strong></span>
-      uses the <code class="option">-y</code> or <code class="option">-k</code> option
-      to provide the shared secret needed to generate a TSIG record
-      for authenticating Dynamic DNS update requests, default type
-      HMAC-MD5.  These options are mutually exclusive. 
-    </p>
-<p>
-      When the <code class="option">-y</code> option is used, a signature is
-      generated from
-      [<span class="optional"><em class="parameter"><code>hmac:</code></em></span>]<em class="parameter"><code>keyname:secret.</code></em>
-      <em class="parameter"><code>keyname</code></em> is the name of the key, and
-      <em class="parameter"><code>secret</code></em> is the base64 encoded shared secret.
-      <em class="parameter"><code>hmac</code></em> is the name of the key algorithm;
-      valid choices are <code class="literal">hmac-md5</code>,
-      <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
-      <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>, or
-      <code class="literal">hmac-sha512</code>.  If <em class="parameter"><code>hmac</code></em>
-      is not specified, the default is <code class="literal">hmac-md5</code>.
-      NOTE: Use of the <code class="option">-y</code> option is discouraged because the
-      shared secret is supplied as a command line argument in clear text.
-      This may be visible in the output from
-      <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
-      or in a history file maintained by the user's shell.
-    </p>
-<p>
-      With the
-      <code class="option">-k</code> option, <span><strong class="command">nsupdate</strong></span> reads
-      the shared secret from the file <em class="parameter"><code>keyfile</code></em>.
-      Keyfiles may be in two formats: a single file containing
-      a <code class="filename">named.conf</code>-format <span><strong class="command">key</strong></span>
-      statement, which may be generated automatically by
-      <span><strong class="command">ddns-confgen</strong></span>, or a pair of files whose names are
-      of the format <code class="filename">K{name}.+157.+{random}.key</code> and
-      <code class="filename">K{name}.+157.+{random}.private</code>, which can be
-      generated by <span><strong class="command">dnssec-keygen</strong></span>.
-      The <code class="option">-k</code> may also be used to specify a SIG(0) key used
-      to authenticate Dynamic DNS update requests.  In this case, the key
-      specified is not an HMAC-MD5 key.
-    </p>
-<p>
-      <span><strong class="command">nsupdate</strong></span> can be run in a local-host only mode
-      using the <code class="option">-l</code> flag.  This sets the server address to
-      localhost (disabling the <span><strong class="command">server</strong></span> so that the server
-      address cannot be overridden).  Connections to the local server will
-      use a TSIG key found in <code class="filename">/var/run/named/session.key</code>,
-      which is automatically generated by <span><strong class="command">named</strong></span> if any
-      local master zone has set <span><strong class="command">update-policy</strong></span> to
-      <span><strong class="command">local</strong></span>.  The location of this key file can be
-      overridden with the <code class="option">-k</code> option.
-    </p>
-<p>
-      By default, <span><strong class="command">nsupdate</strong></span>
-      uses UDP to send update requests to the name server unless they are too
-      large to fit in a UDP request in which case TCP will be used.
-      The
-      <code class="option">-v</code>
-      option makes
-      <span><strong class="command">nsupdate</strong></span>
-      use a TCP connection.
-      This may be preferable when a batch of update requests is made.
-    </p>
-<p>
-      The <code class="option">-p</code> sets the default port number to use for
-      connections to a name server.  The default is 53.
-    </p>
-<p>
-      The <code class="option">-t</code> option sets the maximum time an update request
-      can
-      take before it is aborted.  The default is 300 seconds.  Zero can be
-      used
-      to disable the timeout.
-    </p>
-<p>
-      The <code class="option">-u</code> option sets the UDP retry interval.  The default
-      is
-      3 seconds.  If zero, the interval will be computed from the timeout
-      interval
-      and number of UDP retries.
-    </p>
-<p>
-      The <code class="option">-r</code> option sets the number of UDP retries. The
-      default is
-      3.  If zero, only one update request will be made.
-    </p>
-<p>
-      The <code class="option">-R <em class="replaceable"><code>randomdev</code></em></code> option
-      specifies a source of randomness.  If the operating system
-      does not provide a <code class="filename">/dev/random</code> or
-      equivalent device, the default source of randomness is keyboard
-      input.  <code class="filename">randomdev</code> specifies the name of
-      a character device or file containing random data to be used
-      instead of the default.  The special value
-      <code class="filename">keyboard</code> indicates that keyboard input
-      should be used.  This option may be specified multiple times.
-    </p>
-<p>
-      Other types can be entered using "TYPEXXXXX" where "XXXXX" is the
-      decimal value of the type with no leading zeros.  The rdata,
-      if present, will be parsed using the UNKNOWN rdata format,
-      (&lt;backslash&gt; &lt;hash&gt; &lt;space&gt; &lt;length&gt;
-      &lt;space&gt; &lt;hexstring&gt;).
-    </p>
-<p>
-      The <code class="option">-T</code> and <code class="option">-P</code> options print out
-      lists of non-meta types for which the type-specific presentation
-      formats are known.  <code class="option">-T</code> prints out the list of
-      IANA-assigned types.  <code class="option">-P</code> prints out the list of
-      private types specific to <span><strong class="command">named</strong></span>.  These options
-      may be combined.  <span><strong class="command">nsupdate</strong></span> will exit after the
-      lists are printed.
-    </p>
-<p>
-      The -V option causes <span><strong class="command">nsupdate</strong></span> to print the
-      version number and exit.
-    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2686726"></a><h2>INPUT FORMAT</h2>
+<a name="id2653179"></a><h2>OPTIONS</h2>
+<div class="variablelist"><dl>
+<dt><span class="term">-d</span></dt>
+<dd><p>
+	    Debug mode. This provides tracing information about the
+	    update requests that are made and the replies received
+	    from the name server.
+	  </p></dd>
+<dt><span class="term">-D</span></dt>
+<dd><p>
+	    Extra debug mode.
+	  </p></dd>
+<dt><span class="term">-k <em class="replaceable"><code>keyfile</code></em></span></dt>
+<dd><p>
+	    The file containing the TSIG authentication key.
+	    Keyfiles may be in two formats: a single file containing
+	    a <code class="filename">named.conf</code>-format <span><strong class="command">key</strong></span>
+	    statement, which may be generated automatically by
+	    <span><strong class="command">ddns-confgen</strong></span>, or a pair of files whose names are
+	    of the format <code class="filename">K{name}.+157.+{random}.key</code> and
+	    <code class="filename">K{name}.+157.+{random}.private</code>, which can be
+	    generated by <span><strong class="command">dnssec-keygen</strong></span>.
+	    The <code class="option">-k</code> may also be used to specify a SIG(0) key used
+	    to authenticate Dynamic DNS update requests.  In this case, the key
+	    specified is not an HMAC-MD5 key.
+	  </p></dd>
+<dt><span class="term">-l</span></dt>
+<dd><p>
+	    Local-host only mode. This sets the server address to
+	    localhost (disabling the <span><strong class="command">server</strong></span> so that the server
+	    address cannot be overridden).  Connections to the local server will
+	    use a TSIG key found in <code class="filename">/var/run/named/session.key</code>,
+	    which is automatically generated by <span><strong class="command">named</strong></span> if any
+	    local master zone has set <span><strong class="command">update-policy</strong></span> to
+	    <span><strong class="command">local</strong></span>.  The location of this key file can be
+	    overridden with the <code class="option">-k</code> option.
+	  </p></dd>
+<dt><span class="term">-L <em class="replaceable"><code>level</code></em></span></dt>
+<dd><p>
+	    Set the logging debug level.  If zero, logging is disabled.
+	  </p></dd>
+<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
+<dd><p>
+	    Set the port to use for connections to a name server. The
+	    default is 53.
+	  </p></dd>
+<dt><span class="term">-P</span></dt>
+<dd><p>
+	    Print the list of private BIND-specific resource record
+	    types whose format is understood
+	    by <span><strong class="command">nsupdate</strong></span>. See also
+	    the <code class="option">-T</code> option.
+	  </p></dd>
+<dt><span class="term">-r <em class="replaceable"><code>udpretries</code></em></span></dt>
+<dd><p>
+	    The number of UDP retries. The default is 3. If zero, only
+	    one update request will be made.
+	  </p></dd>
+<dt><span class="term">-R <em class="replaceable"><code>randomdev</code></em></span></dt>
+<dd><p>
+	  Where to obtain randomness. If the operating system
+	  does not provide a <code class="filename">/dev/random</code> or
+	  equivalent device, the default source of randomness is keyboard
+	  input.  <code class="filename">randomdev</code> specifies the name of
+	  a character device or file containing random data to be used
+	  instead of the default.  The special value
+	  <code class="filename">keyboard</code> indicates that keyboard input
+	  should be used.  This option may be specified multiple times.
+	</p></dd>
+<dt><span class="term">-t <em class="replaceable"><code>timeout</code></em></span></dt>
+<dd><p>
+	    The maximum time an update request can take before it is
+	    aborted. The default is 300 seconds. Zero can be used to
+	    disable the timeout.
+	  </p></dd>
+<dt><span class="term">-T</span></dt>
+<dd>
+<p>
+	    Print the list of IANA standard resource record types
+	    whose format is understood by <span><strong class="command">nsupdate</strong></span>.
+	    <span><strong class="command">nsupdate</strong></span> will exit after the lists are
+	    printed. The <code class="option">-T</code> option can be combined
+	    with the <code class="option">-P</code> option.
+	  </p>
+<p>
+	    Other types can be entered using "TYPEXXXXX" where "XXXXX" is the
+	    decimal value of the type with no leading zeros.  The rdata,
+	    if present, will be parsed using the UNKNOWN rdata format,
+	    (&lt;backslash&gt; &lt;hash&gt; &lt;space&gt; &lt;length&gt;
+	    &lt;space&gt; &lt;hexstring&gt;).
+	  </p>
+</dd>
+<dt><span class="term">-u <em class="replaceable"><code>udptimeout</code></em></span></dt>
+<dd><p>
+	    The UDP retry interval. The default is 3 seconds. If zero,
+	    the interval will be computed from the timeout interval and
+	    number of UDP retries.
+	  </p></dd>
+<dt><span class="term">-v</span></dt>
+<dd><p>
+	    Use TCP even for small update requests.
+	    By default, <span><strong class="command">nsupdate</strong></span>
+	    uses UDP to send update requests to the name server unless they are too
+	    large to fit in a UDP request in which case TCP will be used.
+	    TCP may be preferable when a batch of update requests is made.
+	  </p></dd>
+<dt><span class="term">-V</span></dt>
+<dd><p>
+	    Print the version number and exit.
+	  </p></dd>
+<dt><span class="term">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></span></dt>
+<dd>
+<p>
+	    Literal TSIG authentication key.
+	    <em class="parameter"><code>keyname</code></em> is the name of the key, and
+	    <em class="parameter"><code>secret</code></em> is the base64 encoded shared secret.
+	    <em class="parameter"><code>hmac</code></em> is the name of the key algorithm;
+	    valid choices are <code class="literal">hmac-md5</code>,
+	    <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
+	    <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>, or
+	    <code class="literal">hmac-sha512</code>.  If <em class="parameter"><code>hmac</code></em>
+	    is not specified, the default is <code class="literal">hmac-md5</code>.
+	  </p>
+<p>
+	    NOTE: Use of the <code class="option">-y</code> option is discouraged because the
+	    shared secret is supplied as a command line argument in clear text.
+	    This may be visible in the output from
+	    <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
+	    or in a history file maintained by the user's shell.
+	  </p>
+</dd>
+</dl></div>
+</div>
+<div class="refsect1" lang="en">
+<a name="id2686390"></a><h2>INPUT FORMAT</h2>
 <p><span><strong class="command">nsupdate</strong></span>
       reads input from
       <em class="parameter"><code>filename</code></em>
@@ -266,270 +272,270 @@
       </p>
 <div class="variablelist"><dl>
 <dt><span class="term">
-              <span><strong class="command">server</strong></span>
-               {servername}
-               [port]
-            </span></dt>
+	      <span><strong class="command">server</strong></span>
+	       {servername}
+	       [port]
+	    </span></dt>
 <dd><p>
-              Sends all dynamic update requests to the name server
-              <em class="parameter"><code>servername</code></em>.
-              When no server statement is provided,
-              <span><strong class="command">nsupdate</strong></span>
-              will send updates to the master server of the correct zone.
-              The MNAME field of that zone's SOA record will identify the
-              master
-              server for that zone.
-              <em class="parameter"><code>port</code></em>
-              is the port number on
-              <em class="parameter"><code>servername</code></em>
-              where the dynamic update requests get sent.
-              If no port number is specified, the default DNS port number of
-              53 is
-              used.
-            </p></dd>
+	      Sends all dynamic update requests to the name server
+	      <em class="parameter"><code>servername</code></em>.
+	      When no server statement is provided,
+	      <span><strong class="command">nsupdate</strong></span>
+	      will send updates to the master server of the correct zone.
+	      The MNAME field of that zone's SOA record will identify the
+	      master
+	      server for that zone.
+	      <em class="parameter"><code>port</code></em>
+	      is the port number on
+	      <em class="parameter"><code>servername</code></em>
+	      where the dynamic update requests get sent.
+	      If no port number is specified, the default DNS port number of
+	      53 is
+	      used.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">local</strong></span>
-               {address}
-               [port]
-            </span></dt>
+	      <span><strong class="command">local</strong></span>
+	       {address}
+	       [port]
+	    </span></dt>
 <dd><p>
-              Sends all dynamic update requests using the local
-              <em class="parameter"><code>address</code></em>.
+	      Sends all dynamic update requests using the local
+	      <em class="parameter"><code>address</code></em>.
 
-              When no local statement is provided,
-              <span><strong class="command">nsupdate</strong></span>
-              will send updates using an address and port chosen by the
-              system.
-              <em class="parameter"><code>port</code></em>
-              can additionally be used to make requests come from a specific
-              port.
-              If no port number is specified, the system will assign one.
-            </p></dd>
+	      When no local statement is provided,
+	      <span><strong class="command">nsupdate</strong></span>
+	      will send updates using an address and port chosen by the
+	      system.
+	      <em class="parameter"><code>port</code></em>
+	      can additionally be used to make requests come from a specific
+	      port.
+	      If no port number is specified, the system will assign one.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">zone</strong></span>
-               {zonename}
-            </span></dt>
+	      <span><strong class="command">zone</strong></span>
+	       {zonename}
+	    </span></dt>
 <dd><p>
-              Specifies that all updates are to be made to the zone
-              <em class="parameter"><code>zonename</code></em>.
-              If no
-              <em class="parameter"><code>zone</code></em>
-              statement is provided,
-              <span><strong class="command">nsupdate</strong></span>
-              will attempt determine the correct zone to update based on the
-              rest of the input.
-            </p></dd>
+	      Specifies that all updates are to be made to the zone
+	      <em class="parameter"><code>zonename</code></em>.
+	      If no
+	      <em class="parameter"><code>zone</code></em>
+	      statement is provided,
+	      <span><strong class="command">nsupdate</strong></span>
+	      will attempt determine the correct zone to update based on the
+	      rest of the input.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">class</strong></span>
-               {classname}
-            </span></dt>
+	      <span><strong class="command">class</strong></span>
+	       {classname}
+	    </span></dt>
 <dd><p>
-              Specify the default class.
-              If no <em class="parameter"><code>class</code></em> is specified, the
-              default class is
-              <em class="parameter"><code>IN</code></em>.
-            </p></dd>
+	      Specify the default class.
+	      If no <em class="parameter"><code>class</code></em> is specified, the
+	      default class is
+	      <em class="parameter"><code>IN</code></em>.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">ttl</strong></span>
-               {seconds}
-            </span></dt>
+	      <span><strong class="command">ttl</strong></span>
+	       {seconds}
+	    </span></dt>
 <dd><p>
-              Specify the default time to live for records to be added.
+	      Specify the default time to live for records to be added.
 	      The value <em class="parameter"><code>none</code></em> will clear the default
 	      ttl.
-            </p></dd>
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">key</strong></span>
-               [hmac:] {keyname}
-               {secret}
-            </span></dt>
+	      <span><strong class="command">key</strong></span>
+	       [hmac:] {keyname}
+	       {secret}
+	    </span></dt>
 <dd><p>
-              Specifies that all updates are to be TSIG-signed using the
-              <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>secret</code></em> pair.
-              If <em class="parameter"><code>hmac</code></em> is specified, then it sets the
-              signing algorithm in use; the default is
-              <code class="literal">hmac-md5</code>.  The <span><strong class="command">key</strong></span>
-              command overrides any key specified on the command line via
-              <code class="option">-y</code> or <code class="option">-k</code>.
-            </p></dd>
+	      Specifies that all updates are to be TSIG-signed using the
+	      <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>secret</code></em> pair.
+	      If <em class="parameter"><code>hmac</code></em> is specified, then it sets the
+	      signing algorithm in use; the default is
+	      <code class="literal">hmac-md5</code>.  The <span><strong class="command">key</strong></span>
+	      command overrides any key specified on the command line via
+	      <code class="option">-y</code> or <code class="option">-k</code>.
+	    </p></dd>
 <dt><span class="term">
-            <span><strong class="command">gsstsig</strong></span>
-          </span></dt>
+	    <span><strong class="command">gsstsig</strong></span>
+	  </span></dt>
 <dd><p>
 	      Use GSS-TSIG to sign the updated.  This is equivalent to
 	      specifying <code class="option">-g</code> on the commandline.
-            </p></dd>
+	    </p></dd>
 <dt><span class="term">
-            <span><strong class="command">oldgsstsig</strong></span>
-          </span></dt>
+	    <span><strong class="command">oldgsstsig</strong></span>
+	  </span></dt>
 <dd><p>
 	      Use the Windows 2000 version of GSS-TSIG to sign the updated.
 	      This is equivalent to specifying <code class="option">-o</code> on the
 	      commandline.
-            </p></dd>
+	    </p></dd>
 <dt><span class="term">
-            <span><strong class="command">realm</strong></span>
-             {[<span class="optional">realm_name</span>]}
-          </span></dt>
+	    <span><strong class="command">realm</strong></span>
+	     {[<span class="optional">realm_name</span>]}
+	  </span></dt>
 <dd><p>
 	      When using GSS-TSIG use <em class="parameter"><code>realm_name</code></em> rather
 	      than the default realm in <code class="filename">krb5.conf</code>.  If no
 	      realm is specified the saved realm is cleared.
-            </p></dd>
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">prereq</span>] nxdomain</strong></span>
-               {domain-name}
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">prereq</span>] nxdomain</strong></span>
+	       {domain-name}
+	    </span></dt>
 <dd><p>
-              Requires that no resource record of any type exists with name
-              <em class="parameter"><code>domain-name</code></em>.
-            </p></dd>
+	      Requires that no resource record of any type exists with name
+	      <em class="parameter"><code>domain-name</code></em>.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">prereq</span>] yxdomain</strong></span>
-               {domain-name}
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">prereq</span>] yxdomain</strong></span>
+	       {domain-name}
+	    </span></dt>
 <dd><p>
-              Requires that
-              <em class="parameter"><code>domain-name</code></em>
-              exists (has as at least one resource record, of any type).
-            </p></dd>
+	      Requires that
+	      <em class="parameter"><code>domain-name</code></em>
+	      exists (has as at least one resource record, of any type).
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">prereq</span>] nxrrset</strong></span>
-               {domain-name}
-               [class]
-               {type}
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">prereq</span>] nxrrset</strong></span>
+	       {domain-name}
+	       [class]
+	       {type}
+	    </span></dt>
 <dd><p>
-              Requires that no resource record exists of the specified
-              <em class="parameter"><code>type</code></em>,
-              <em class="parameter"><code>class</code></em>
-              and
-              <em class="parameter"><code>domain-name</code></em>.
-              If
-              <em class="parameter"><code>class</code></em>
-              is omitted, IN (internet) is assumed.
-            </p></dd>
+	      Requires that no resource record exists of the specified
+	      <em class="parameter"><code>type</code></em>,
+	      <em class="parameter"><code>class</code></em>
+	      and
+	      <em class="parameter"><code>domain-name</code></em>.
+	      If
+	      <em class="parameter"><code>class</code></em>
+	      is omitted, IN (internet) is assumed.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span>
-               {domain-name}
-               [class]
-               {type}
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span>
+	       {domain-name}
+	       [class]
+	       {type}
+	    </span></dt>
 <dd><p>
-              This requires that a resource record of the specified
-              <em class="parameter"><code>type</code></em>,
-              <em class="parameter"><code>class</code></em>
-              and
-              <em class="parameter"><code>domain-name</code></em>
-              must exist.
-              If
-              <em class="parameter"><code>class</code></em>
-              is omitted, IN (internet) is assumed.
-            </p></dd>
+	      This requires that a resource record of the specified
+	      <em class="parameter"><code>type</code></em>,
+	      <em class="parameter"><code>class</code></em>
+	      and
+	      <em class="parameter"><code>domain-name</code></em>
+	      must exist.
+	      If
+	      <em class="parameter"><code>class</code></em>
+	      is omitted, IN (internet) is assumed.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span>
-               {domain-name}
-               [class]
-               {type}
-               {data...}
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">prereq</span>] yxrrset</strong></span>
+	       {domain-name}
+	       [class]
+	       {type}
+	       {data...}
+	    </span></dt>
 <dd><p>
-              The
-              <em class="parameter"><code>data</code></em>
-              from each set of prerequisites of this form
-              sharing a common
-              <em class="parameter"><code>type</code></em>,
-              <em class="parameter"><code>class</code></em>,
-              and
-              <em class="parameter"><code>domain-name</code></em>
-              are combined to form a set of RRs.  This set of RRs must
-              exactly match the set of RRs existing in the zone at the
-              given
-              <em class="parameter"><code>type</code></em>,
-              <em class="parameter"><code>class</code></em>,
-              and
-              <em class="parameter"><code>domain-name</code></em>.
-              The
-              <em class="parameter"><code>data</code></em>
-              are written in the standard text representation of the resource
-              record's
-              RDATA.
-            </p></dd>
+	      The
+	      <em class="parameter"><code>data</code></em>
+	      from each set of prerequisites of this form
+	      sharing a common
+	      <em class="parameter"><code>type</code></em>,
+	      <em class="parameter"><code>class</code></em>,
+	      and
+	      <em class="parameter"><code>domain-name</code></em>
+	      are combined to form a set of RRs.  This set of RRs must
+	      exactly match the set of RRs existing in the zone at the
+	      given
+	      <em class="parameter"><code>type</code></em>,
+	      <em class="parameter"><code>class</code></em>,
+	      and
+	      <em class="parameter"><code>domain-name</code></em>.
+	      The
+	      <em class="parameter"><code>data</code></em>
+	      are written in the standard text representation of the resource
+	      record's
+	      RDATA.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">update</span>] del[<span class="optional">ete</span>]</strong></span>
-               {domain-name}
-               [ttl]
-               [class]
-               [type [data...]]
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">update</span>] del[<span class="optional">ete</span>]</strong></span>
+	       {domain-name}
+	       [ttl]
+	       [class]
+	       [type [data...]]
+	    </span></dt>
 <dd><p>
-              Deletes any resource records named
-              <em class="parameter"><code>domain-name</code></em>.
-              If
-              <em class="parameter"><code>type</code></em>
-              and
-              <em class="parameter"><code>data</code></em>
-              is provided, only matching resource records will be removed.
-              The internet class is assumed if
-              <em class="parameter"><code>class</code></em>
-              is not supplied.  The
-              <em class="parameter"><code>ttl</code></em>
-              is ignored, and is only allowed for compatibility.
-            </p></dd>
+	      Deletes any resource records named
+	      <em class="parameter"><code>domain-name</code></em>.
+	      If
+	      <em class="parameter"><code>type</code></em>
+	      and
+	      <em class="parameter"><code>data</code></em>
+	      is provided, only matching resource records will be removed.
+	      The internet class is assumed if
+	      <em class="parameter"><code>class</code></em>
+	      is not supplied.  The
+	      <em class="parameter"><code>ttl</code></em>
+	      is ignored, and is only allowed for compatibility.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">[<span class="optional">update</span>] add</strong></span>
-               {domain-name}
-               {ttl}
-               [class]
-               {type}
-               {data...}
-            </span></dt>
+	      <span><strong class="command">[<span class="optional">update</span>] add</strong></span>
+	       {domain-name}
+	       {ttl}
+	       [class]
+	       {type}
+	       {data...}
+	    </span></dt>
 <dd><p>
-              Adds a new resource record with the specified
-              <em class="parameter"><code>ttl</code></em>,
-              <em class="parameter"><code>class</code></em>
-              and
-              <em class="parameter"><code>data</code></em>.
-            </p></dd>
+	      Adds a new resource record with the specified
+	      <em class="parameter"><code>ttl</code></em>,
+	      <em class="parameter"><code>class</code></em>
+	      and
+	      <em class="parameter"><code>data</code></em>.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">show</strong></span>
-            </span></dt>
+	      <span><strong class="command">show</strong></span>
+	    </span></dt>
 <dd><p>
-              Displays the current message, containing all of the
-              prerequisites and
-              updates specified since the last send.
-            </p></dd>
+	      Displays the current message, containing all of the
+	      prerequisites and
+	      updates specified since the last send.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">send</strong></span>
-            </span></dt>
+	      <span><strong class="command">send</strong></span>
+	    </span></dt>
 <dd><p>
-              Sends the current message.  This is equivalent to entering a
-              blank line.
-            </p></dd>
+	      Sends the current message.  This is equivalent to entering a
+	      blank line.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">answer</strong></span>
-            </span></dt>
+	      <span><strong class="command">answer</strong></span>
+	    </span></dt>
 <dd><p>
-              Displays the answer.
-            </p></dd>
+	      Displays the answer.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">debug</strong></span>
-            </span></dt>
+	      <span><strong class="command">debug</strong></span>
+	    </span></dt>
 <dd><p>
-              Turn on debugging.
-            </p></dd>
+	      Turn on debugging.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">version</strong></span>
-            </span></dt>
+	      <span><strong class="command">version</strong></span>
+	    </span></dt>
 <dd><p>
-              Print version number.
-            </p></dd>
+	      Print version number.
+	    </p></dd>
 <dt><span class="term">
-              <span><strong class="command">help</strong></span>
-            </span></dt>
+	      <span><strong class="command">help</strong></span>
+	    </span></dt>
 <dd><p>
-              Print a list of commands.
-            </p></dd>
+	      Print a list of commands.
+	    </p></dd>
 </dl></div>
 <p>
     </p>
@@ -538,7 +544,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2687847"></a><h2>EXAMPLES</h2>
+<a name="id2687436"></a><h2>EXAMPLES</h2>
 <p>
       The examples below show how
       <span><strong class="command">nsupdate</strong></span>
@@ -592,30 +598,30 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2687965"></a><h2>FILES</h2>
+<a name="id2687555"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
 <dd><p>
-            used to identify default name server
-          </p></dd>
+	    used to identify default name server
+	  </p></dd>
 <dt><span class="term"><code class="constant">/var/run/named/session.key</code></span></dt>
 <dd><p>
-            sets the default TSIG key for use in local-only mode
-          </p></dd>
+	    sets the default TSIG key for use in local-only mode
+	  </p></dd>
 <dt><span class="term"><code class="constant">K{name}.+157.+{random}.key</code></span></dt>
 <dd><p>
-            base-64 encoding of HMAC-MD5 key created by
-            <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
-          </p></dd>
+	    base-64 encoding of HMAC-MD5 key created by
+	    <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
+	  </p></dd>
 <dt><span class="term"><code class="constant">K{name}.+157.+{random}.private</code></span></dt>
 <dd><p>
-            base-64 encoding of HMAC-MD5 key created by
-            <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
-          </p></dd>
+	    base-64 encoding of HMAC-MD5 key created by
+	    <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
+	  </p></dd>
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2688049"></a><h2>SEE ALSO</h2>
+<a name="id2687641"></a><h2>SEE ALSO</h2>
 <p>
       <em class="citetitle">RFC 2136</em>,
       <em class="citetitle">RFC 3007</em>,
@@ -630,7 +636,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2688106"></a><h2>BUGS</h2>
+<a name="id2687699"></a><h2>BUGS</h2>
 <p>
       The TSIG key is redundantly stored in two separate files.
       This is a consequence of nsupdate using the DST library
diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html
index 781fbf1e87..05d618cde0 100644
--- a/doc/arm/man.rndc-confgen.html
+++ b/doc/arm/man.rndc-confgen.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc-confgen</code>  [<code class="option">-a</code>] [<code class="option">-A <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [<code class="option">-s <em class="replaceable"><code>address</code></em></code>] [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2659636"></a><h2>DESCRIPTION</h2>
+<a name="id2658771"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc-confgen</strong></span>
       generates configuration files
       for <span><strong class="command">rndc</strong></span>.  It can be used as a
@@ -66,7 +66,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2659702"></a><h2>OPTIONS</h2>
+<a name="id2658837"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd>
@@ -180,7 +180,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2661607"></a><h2>EXAMPLES</h2>
+<a name="id2661425"></a><h2>EXAMPLES</h2>
 <p>
       To allow <span><strong class="command">rndc</strong></span> to be used with
       no manual configuration, run
@@ -197,7 +197,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2663165"></a><h2>SEE ALSO</h2>
+<a name="id2665372"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -205,7 +205,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2663204"></a><h2>AUTHOR</h2>
+<a name="id2665411"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.rndc.conf.html b/doc/arm/man.rndc.conf.html
index 1073e79bf2..a452b64461 100644
--- a/doc/arm/man.rndc.conf.html
+++ b/doc/arm/man.rndc.conf.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2622645"></a><h2>DESCRIPTION</h2>
+<a name="id2620073"></a><h2>DESCRIPTION</h2>
 <p><code class="filename">rndc.conf</code> is the configuration file
       for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control
       utility.  This file has a similar structure and syntax to
@@ -136,7 +136,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2659203"></a><h2>EXAMPLE</h2>
+<a name="id2654651"></a><h2>EXAMPLE</h2>
 <pre class="programlisting">
       options {
         default-server  localhost;
@@ -210,7 +210,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2659324"></a><h2>NAME SERVER CONFIGURATION</h2>
+<a name="id2655182"></a><h2>NAME SERVER CONFIGURATION</h2>
 <p>
       The name server must be configured to accept rndc connections and
       to recognize the key specified in the <code class="filename">rndc.conf</code>
@@ -220,7 +220,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2659418"></a><h2>SEE ALSO</h2>
+<a name="id2655208"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">mmencode</span>(1)</span>,
@@ -228,7 +228,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2659457"></a><h2>AUTHOR</h2>
+<a name="id2655246"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html
index 501d1431c1..43a58177e9 100644
--- a/doc/arm/man.rndc.html
+++ b/doc/arm/man.rndc.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc</code>  [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-q</code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2657912"></a><h2>DESCRIPTION</h2>
+<a name="id2654112"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc</strong></span>
       controls the operation of a name
       server.  It supersedes the <span><strong class="command">ndc</strong></span> utility
@@ -81,7 +81,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2658508"></a><h2>OPTIONS</h2>
+<a name="id2654162"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
 <dd><p>
@@ -152,7 +152,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2688221"></a><h2>COMMANDS</h2>
+<a name="id2654452"></a><h2>COMMANDS</h2>
 <p>
       A list of commands supported by <span><strong class="command">rndc</strong></span> can
       be seen by running <span><strong class="command">rndc</strong></span> without arguments.
@@ -537,7 +537,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2689682"></a><h2>LIMITATIONS</h2>
+<a name="id2688885"></a><h2>LIMITATIONS</h2>
 <p>
       There is currently no way to provide the shared secret for a
       <code class="option">key_id</code> without using the configuration file.
@@ -547,7 +547,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2689700"></a><h2>SEE ALSO</h2>
+<a name="id2688971"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -557,7 +557,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2689755"></a><h2>AUTHOR</h2>
+<a name="id2689027"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index 82c50fb6da..1ef88c9a5e 100644
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -44,65 +44,7 @@
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li>
-<p>
-	  On servers configured to perform DNSSEC validation using
-	  managed trust anchors (i.e., keys configured explicitly
-	  via <span><strong class="command">managed-keys</strong></span>, or implicitly 
-	  via <span><strong class="command">dnssec-validation auto;</strong></span> or
-	  <span><strong class="command">dnssec-lookaside auto;</strong></span>), revoking
-	  a trust anchor and sending a new untrusted replacement
-	  could cause <span><strong class="command">named</strong></span> to crash with an
-	  assertion failure. This could occur in the event of a
-	  botched key rollover, or potentially as a result of a
-	  deliberate attack if the attacker was in position to
-	  monitor the victim's DNS traffic.
-	</p>
-<p>
-	  This flaw was discovered by Jan-Piet Mens, and is
-	  disclosed in CVE-2015-1349. [RT #38344]
-	</p>
-</li>
-<li>
-<p>
-	  A flaw in delegation handling could be exploited to put
-	  <span><strong class="command">named</strong></span> into an infinite loop, in which
-	  each lookup of a name server triggered additional lookups
-	  of more name servers.  This has been addressed by placing
-	  limits on the number of levels of recursion
-	  <span><strong class="command">named</strong></span> will allow (default 7), and
-	  on the number of queries that it will send before
-	  terminating a recursive query (default 50).
-	</p>
-<p>
-	  The recursion depth limit is configured via the
-	  <code class="option">max-recursion-depth</code> option, and the query limit
-	  via the <code class="option">max-recursion-queries</code> option.
-	</p>
-<p>
-	  The flaw was discovered by Florian Maury of ANSSI, and is
-	  disclosed in CVE-2014-8500. [RT #37580]
-	</p>
-</li>
-<li>
-<p>
-	  Two separate problems were identified in BIND's GeoIP code that
-	  could lead to an assertion failure. One was triggered by use of
-	  both IPv4 and IPv6 address families, the other by referencing
-	  a GeoIP database in <code class="filename">named.conf</code> which was
-	  not installed. Both are covered by CVE-2014-8680. [RT #37672]
-	  [RT #37679]
-	</p>
-<p>
-	  A less serious security flaw was also found in GeoIP: changes
-	  to the <span><strong class="command">geoip-directory</strong></span> option in
-	  <code class="filename">named.conf</code> were ignored when running
-	  <span><strong class="command">rndc reconfig</strong></span>. In theory, this could allow
-	  <span><strong class="command">named</strong></span> to allow access to unintended clients.
-	</p>
-</li>
-</ul></div>
+<div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
@@ -112,169 +54,16 @@
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li><p>
-	  ACLs containing <span><strong class="command">geoip asnum</strong></span> elements were
-	  not correctly matched unless the full organization name was
-	  specified in the ACL (as in
-	  <span><strong class="command">geoip asnum "AS1234 Example, Inc.";</strong></span>).
-	  They can now match against the AS number alone (as in
-	  <span><strong class="command">geoip asnum "AS1234";</strong></span>).
-        </p></li>
-<li><p>
-          When using native PKCS#11 cryptography (i.e.,
-          <span><strong class="command">configure --enable-native-pkcs11</strong></span>) HSM PINs
-          of up to 256 characters can now be used.
-        </p></li>
-<li><p>
-          NXDOMAIN responses to queries of type DS are now cached separately
-          from those for other types. This helps when using "grafted" zones
-          of type forward, for which the parent zone does not contain a
-          delegation, such as local top-level domains.  Previously a query
-          of type DS for such a zone could cause the zone apex to be cached
-          as NXDOMAIN, blocking all subsequent queries.  (Note: This
-          change is only helpful when DNSSEC validation is not enabled.
-          "Grafted" zones without a delegation in the parent are not a
-          recommended configuration.)
-        </p></li>
-<li><p>
-          NOTIFY messages that are sent because a zone has been updated
-          are now given priority above NOTIFY messages that were scheduled
-          when the server started up. This should mitigate delays in zone
-          propagation when servers are restarted frequently.
-        </p></li>
-<li><p>
-          Errors reported when running <span><strong class="command">rndc addzone</strong></span>
-          (e.g., when a zone file cannot be loaded) have been clarified
-          to make it easier to diagnose problems.
-        </p></li>
-<li><p>
-	  Added support for OPENPGPKEY type.
-        </p></li>
-<li><p>
-	  When encountering an authoritative name server whose name is
-	  an alias pointing to another name, the resolver treats
-	  this as an error and skips to the next server. Previously
-	  this happened silently; now the error will be logged to
-	  the newly-created "cname" log category.
-	</p></li>
-<li><p>
-	  If named is not configured to validate the answer then
-	  allow fallback to plain DNS on timeout even when we know
-	  the server supports EDNS.  This will allow the server to
-	  potentially resolve signed queries when TCP is being
-	  blocked.
-	</p></li>
-</ul></div>
+<div class="itemizedlist"><ul type="disc"><li><p>None</p></li></ul></div>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-<div class="itemizedlist"><ul type="disc">
-<li><p>
-	  <span><strong class="command">dig</strong></span>, <span><strong class="command">host</strong></span> and
-	  <span><strong class="command">nslookup</strong></span> aborted when encountering
-	  a name which, after appending search list elements,
-	  exceeded 255 bytes. Such names are now skipped, but
-	  processing of other names will continue. [RT #36892]
-        </p></li>
-<li><p>
-	  The error message generated when
-	  <span><strong class="command">named-checkzone</strong></span> or
-	  <span><strong class="command">named-checkconf -z</strong></span> encounters a
-	  <code class="option">$TTL</code> directive without a value has
-	  been clarified. [RT #37138]
-        </p></li>
-<li><p>
-	  Semicolon characters (;) included in TXT records were
-	  incorrectly escaped with a backslash when the record was
-	  displayed as text. This is actually only necessary when there
-	  are no quotation marks. [RT #37159]
-        </p></li>
-<li><p>
-	  When files opened for writing by <span><strong class="command">named</strong></span>,
-	  such as zone journal files, were referenced more than once
-	  in <code class="filename">named.conf</code>, it could lead to file
-	  corruption as multiple threads wrote to the same file. This
-	  is now detected when loading <code class="filename">named.conf</code>
-	  and reported as an error. [RT #37172]
-        </p></li>
-<li><p>
-          <span><strong class="command">dnssec-keygen -S</strong></span> failed to generate successor
-          keys for some algorithm types (including ECDSA and GOST) due to
-          a difference in the content of private key files. This has been
-          corrected. [RT #37183]
-        </p></li>
-<li><p>
-          UPDATE messages that arrived too soon after
-          an <span><strong class="command">rndc thaw</strong></span> could be lost. [RT #37233]
-        </p></li>
-<li><p>
-          Forwarding of UPDATE messages did not work when they were
-          signed with SIG(0); they resulted in a BADSIG response code.
-          [RT #37216]
-        </p></li>
-<li><p>
-          When checking for updates to trust anchors listed in
-          <code class="option">managed-keys</code>, <span><strong class="command">named</strong></span>
-          now revalidates keys based on the current set of
-          active trust anchors, without relying on any cached
-          record of previous validation. [RT #37506]
-        </p></li>
-<li><p>
-	  Large-system tuning
-	  (<span><strong class="command">configure --with-tuning=large</strong></span>) caused
-	  problems on some platforms by setting a socket receive
-	  buffer size that was too large.  This is now detected and
-	  corrected at run time. [RT #37187]
-        </p></li>
-<li><p>
-	  When NXDOMAIN redirection is in use, queries for a name
-	  that is present in the redirection zone but a type that
-	  is not present will now return NOERROR instead of NXDOMAIN.
-        </p></li>
-<li><p>
-	  When a zone contained a delegation to an IPv6 name server
-	  but not an IPv4 name server, it was possible for a memory
-	  reference to be left un-freed. This caused an assertion
-	  failure on server shutdown, but was otherwise harmless.
-	  [RT #37796]
-        </p></li>
-<li><p>
-	  Due to an inadvertent removal of code in the previous
-	  release, when <span><strong class="command">named</strong></span> encountered an
-	  authoritative name server which dropped all EDNS queries,
-	  it did not always try plain DNS. This has been corrected.
-	  [RT #37965]
-        </p></li>
-<li><p>
-	  A regression caused nsupdate to use the default recursive servers
-	  rather than the SOA MNAME server when sending the UPDATE.
-        </p></li>
-<li><p>
-	  Adjusted max-recursion-queries to accommodate the smaller
-	  initial packet sizes used in BIND 9.10 and higher when
-	  contacting authoritative servers for the first time.
-        </p></li>
-<li><p>
-	  Built-in "empty" zones did not correctly inherit the
-	  "allow-transfer" ACL from the options or view. [RT #38310]
-        </p></li>
-<li><p>
-	  Two leaks were fixed that could cause <span><strong class="command">named</strong></span>
-	  processes to grow to very large sizes. [RT #38454]
-	</p></li>
-<li><p>
-	  Fixed some bugs in RFC 5011 trust anchor management,
-	  including a memory leak and a possible loss of state
-	  information. [RT #38458]
-	</p></li>
-<li><p>
+<div class="itemizedlist"><ul type="disc"><li><p>
 	  Asynchronous zone loads were not handled correctly when the
 	  zone load was already in progress; this could trigger a crash
 	  in zt.c. [RT #37573]
-	</p></li>
-</ul></div>
+ 	</p></li></ul></div>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">