From: Tinderbox User <tbox@isc.org>
Date: Sat, 28 Oct 2017 01:12:35 +0000 (+0000)
Subject: regen master
X-Git-Tag: v9.12.0b2~41
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=497f3f913e81afc6d5d66f08a101c500efc8e73e;p=thirdparty%2Fbind9.git

regen master
---

diff --git a/bin/confgen/rndc-confgen.8 b/bin/confgen/rndc-confgen.8
index 5014a9321f9..64de0e3d0f3 100644
--- a/bin/confgen/rndc-confgen.8
+++ b/bin/confgen/rndc-confgen.8
@@ -111,9 +111,7 @@ as directed\&.
 .PP
 \-A \fIalgorithm\fR
 .RS 4
-Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5, or if MD5 was disabled at compile time, hmac\-sha256\&.
-.sp
-Note: Use of hmac\-md5 is no longer recommended, and the default value will be changed to hmac\-sha256 in a future release\&.
+Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-sha256\&.
 .RE
 .PP
 \-b \fIkeysize\fR
diff --git a/bin/confgen/rndc-confgen.html b/bin/confgen/rndc-confgen.html
index ed8bf3afc01..eb7d05139dc 100644
--- a/bin/confgen/rndc-confgen.html
+++ b/bin/confgen/rndc-confgen.html
@@ -113,12 +113,7 @@
           <p>
             Specifies the algorithm to use for the TSIG key.  Available
             choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
-            if MD5 was disabled at compile time, hmac-sha256.
-          </p>
-          <p>
-            Note: Use of hmac-md5 is no longer recommended, and the default
-            value will be changed to hmac-sha256 in a future release.
+            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
           </p>
         </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
diff --git a/bin/python/dnssec-checkds.8 b/bin/python/dnssec-checkds.8
index 7daa90da873..c9e7f047bf1 100644
--- a/bin/python/dnssec-checkds.8
+++ b/bin/python/dnssec-checkds.8
@@ -39,9 +39,7 @@
 dnssec-checkds \- DNSSEC delegation consistency checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-checkds\fR\ 'u
-\fBdnssec\-checkds\fR [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] {zone}
-.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] {zone}
+\fBdnssec\-checkds\fR [\fB\-d\ \fR\fB\fIdig\ path\fR\fR] [\fB\-D\ \fR\fB\fIdsfromkey\ path\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\ \fR\fB\fIfile\fR\fR] {zone}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-checkds\fR
@@ -60,6 +58,12 @@ is specified, then the zone is read from that file to find the DNSKEY records\&.
 Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone\*(Aqs parent\&.
 .RE
 .PP
+\-s \fIfile\fR
+.RS 4
+Specifies a prepared dsset file, such as would be generated by
+\fBdnssec\-signzone\fR, to use as a source for the DS RRset instead of querying the parent\&.
+.RE
+.PP
 \-d \fIdig path\fR
 .RS 4
 Specifies a path to a
diff --git a/bin/python/dnssec-checkds.html b/bin/python/dnssec-checkds.html
index ff841eb90a9..48fc192f159 100644
--- a/bin/python/dnssec-checkds.html
+++ b/bin/python/dnssec-checkds.html
@@ -33,20 +33,13 @@
 <h2>Synopsis</h2>
     <div class="cmdsynopsis"><p>
       <code class="command">dnssec-checkds</code> 
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
        [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
        [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
-       {zone}
-    </p></div>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-dsfromkey</code> 
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
        [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
-       [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
-       [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-s <em class="replaceable"><code>file</code></em></code>]
        {zone}
-   </p></div>
+    </p></div>
   </div>
 
   <div class="refsection">
@@ -79,6 +72,14 @@
             instead of checking for a DS record in the zone's parent.
           </p>
         </dd>
+<dt><span class="term">-s <em class="replaceable"><code>file</code></em></span></dt>
+<dd>
+          <p>
+            Specifies a prepared dsset file, such as would be generated
+            by <span class="command"><strong>dnssec-signzone</strong></span>, to use as a source for
+            the DS RRset instead of querying the parent.
+          </p>
+        </dd>
 <dt><span class="term">-d <em class="replaceable"><code>dig path</code></em></span></dt>
 <dd>
           <p>
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index aa664f4447d..e7fd9179a06 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -6451,7 +6451,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                   server waits on an idle TCP connection before closing
                   it when the client is using the EDNS TCP keepalive
                   option.  The default is 300 (30 seconds), the maximum
-                  is 1200 (two minutes), and the minimum is 1 (one tenth
+                  is 65535 (about 1.8 hours), and the minimum is 1 (one tenth
                   of a second). Values above the maximum or below the minimum
                   will be adjusted with a logged warning.
                   This value may be greater than
@@ -6470,7 +6470,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                   keepalive option. This informs a client of the
                   amount of time it may keep the session open.
                   The default is 300 (30 seconds), the maximum is
-                  1200 (two minutes), and the minimum is 0, which
+                  65535 (about 1.8 hours), and the minimum is 0, which
                   signals that the clients must close TCP connections
                   immediately.  Ordinarily this should be set to the
                   same value as <span class="command"><strong>tcp-keepalive-timeout</strong></span>.
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index e26b7ea5402..a4e7f7c52dc 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -498,6 +498,14 @@
 	  <span class="command"><strong>dnssec-settime</strong></span>, etc. [RT #46149]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  <span class="command"><strong>dnssec-checkds -s</strong></span> specifies a file from
+	  which to read a DS set rather than querying the parent zone.
+	  This can be used to check zone correctness prior to
+	  publication. Thanks to Niall O'Reilly [RT #44667]
+	</p>
+      </li>
 </ul></div>
   </div>
 
@@ -543,11 +551,17 @@
 <li class="listitem">
 	<p>
 	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
-	  For compatibility, this is still the default algorithm generated
-	  by <span class="command"><strong>rndc-confgen</strong></span>, but it will print a
-	  warning message. The default algorithm in
-	  <span class="command"><strong>rndc-confgen</strong></span> will be changed to HMAC-SHA256
-	  in a future release. [RT #42272]
+	  The default algorithm generated by <span class="command"><strong>rndc-confgen</strong></span>,
+	  is now HMAC-256, and a warning message will be printed if
+	  HMAC-MD5 is used. [RT #42272]
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  The <span class="command"><strong>isc-hmac-fixup</strong></span> command, which was created
+	  to address an interoperability problem in TSIG keys between
+	  early versions of BIND and other DNS implmentations, is now
+	  obsolete and has been removed. [RT #46411]
 	</p>
       </li>
 </ul></div>
@@ -606,6 +620,16 @@
 	  are not writable by the effective user ID. [RT #46077]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  Initializing keys specified in a <span class="command"><strong>managed-keys</strong></span>
+	  statement or by <span class="command"><strong>dnssec-validation auto;</strong></span> are
+	  now tagged as "initializing", until they have been updated by a
+	  key refresh query. If key maintenance fails to initialize,
+	  this will be visible when running <span class="command"><strong>rndc secroots</strong></span>.
+	  [RT #46267]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  Previously, <span class="command"><strong>update-policy local;</strong></span> accepted
@@ -729,6 +753,12 @@
 	  queries. [RT #45847]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  A new statistics counter has been added to track priming
+	  queries. [RT #46313]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  The <span class="command"><strong>dnssec-signzone -x</strong></span> flag and the
diff --git a/doc/arm/Bv9ARM.ch13.html b/doc/arm/Bv9ARM.ch13.html
index 7d0993a244e..f6ec8a73f11 100644
--- a/doc/arm/Bv9ARM.ch13.html
+++ b/doc/arm/Bv9ARM.ch13.html
@@ -97,9 +97,6 @@
 <span class="refentrytitle"><a href="man.host.html">host</a></span><span class="refpurpose"> &#8212; DNS lookup utility</span>
 </dt>
 <dt>
-<span class="refentrytitle"><a href="man.isc-hmac-fixup.html"><span class="application">isc-hmac-fixup</span></a></span><span class="refpurpose"> &#8212; fixes HMAC keys generated by older versions of BIND</span>
-</dt>
-<dt>
 <span class="refentrytitle"><a href="man.mdig.html"><span class="application">mdig</span></a></span><span class="refpurpose"> &#8212; DNS pipelined lookup utility</span>
 </dt>
 <dt>
@@ -192,7 +189,6 @@
       
       
       
-      
       
       
     </div>
diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html
index 654cd54c2cf..fb3c7ba8f0e 100644
--- a/doc/arm/Bv9ARM.html
+++ b/doc/arm/Bv9ARM.html
@@ -334,9 +334,6 @@
 <span class="refentrytitle"><a href="man.host.html">host</a></span><span class="refpurpose"> &#8212; DNS lookup utility</span>
 </dt>
 <dt>
-<span class="refentrytitle"><a href="man.isc-hmac-fixup.html"><span class="application">isc-hmac-fixup</span></a></span><span class="refpurpose"> &#8212; fixes HMAC keys generated by older versions of BIND</span>
-</dt>
-<dt>
 <span class="refentrytitle"><a href="man.mdig.html"><span class="application">mdig</span></a></span><span class="refpurpose"> &#8212; DNS pipelined lookup utility</span>
 </dt>
 <dt>
diff --git a/doc/arm/man.dnssec-checkds.html b/doc/arm/man.dnssec-checkds.html
index a352098022d..45ed0d34ade 100644
--- a/doc/arm/man.dnssec-checkds.html
+++ b/doc/arm/man.dnssec-checkds.html
@@ -51,20 +51,13 @@
 <h2>Synopsis</h2>
     <div class="cmdsynopsis"><p>
       <code class="command">dnssec-checkds</code> 
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
        [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
        [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
-       {zone}
-    </p></div>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-dsfromkey</code> 
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
        [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
-       [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
-       [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-s <em class="replaceable"><code>file</code></em></code>]
        {zone}
-   </p></div>
+    </p></div>
   </div>
 
   <div class="refsection">
@@ -97,6 +90,14 @@
             instead of checking for a DS record in the zone's parent.
           </p>
         </dd>
+<dt><span class="term">-s <em class="replaceable"><code>file</code></em></span></dt>
+<dd>
+          <p>
+            Specifies a prepared dsset file, such as would be generated
+            by <span class="command"><strong>dnssec-signzone</strong></span>, to use as a source for
+            the DS RRset instead of querying the parent.
+          </p>
+        </dd>
 <dt><span class="term">-d <em class="replaceable"><code>dig path</code></em></span></dt>
 <dd>
           <p>
diff --git a/doc/arm/man.host.html b/doc/arm/man.host.html
index de41807dc41..feae32bcf73 100644
--- a/doc/arm/man.host.html
+++ b/doc/arm/man.host.html
@@ -14,7 +14,7 @@
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
 <link rel="prev" href="man.genrandom.html" title="genrandom">
-<link rel="next" href="man.isc-hmac-fixup.html" title="isc-hmac-fixup">
+<link rel="next" href="man.mdig.html" title="mdig">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
 <div class="navheader">
@@ -24,7 +24,7 @@
 <td width="20%" align="left">
 <a accesskey="p" href="man.genrandom.html">Prev</a> </td>
 <th width="60%" align="center">Manual pages</th>
-<td width="20%" align="right"> <a accesskey="n" href="man.isc-hmac-fixup.html">Next</a>
+<td width="20%" align="right"> <a accesskey="n" href="man.mdig.html">Next</a>
 </td>
 </tr>
 </table>
@@ -363,14 +363,14 @@
 <td width="40%" align="left">
 <a accesskey="p" href="man.genrandom.html">Prev</a> </td>
 <td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
-<td width="40%" align="right"> <a accesskey="n" href="man.isc-hmac-fixup.html">Next</a>
+<td width="40%" align="right"> <a accesskey="n" href="man.mdig.html">Next</a>
 </td>
 </tr>
 <tr>
 <td width="40%" align="left" valign="top">
 <span class="application">genrandom</span> </td>
 <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
-<td width="40%" align="right" valign="top"> <span class="application">isc-hmac-fixup</span>
+<td width="40%" align="right" valign="top"> <span class="application">mdig</span>
 </td>
 </tr>
 </table>
diff --git a/doc/arm/man.mdig.html b/doc/arm/man.mdig.html
index 53057007945..c1f8df28c44 100644
--- a/doc/arm/man.mdig.html
+++ b/doc/arm/man.mdig.html
@@ -13,7 +13,7 @@
 <meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
-<link rel="prev" href="man.isc-hmac-fixup.html" title="isc-hmac-fixup">
+<link rel="prev" href="man.host.html" title="host">
 <link rel="next" href="man.named-checkconf.html" title="named-checkconf">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
@@ -22,7 +22,7 @@
 <tr><th colspan="3" align="center"><span class="application">mdig</span></th></tr>
 <tr>
 <td width="20%" align="left">
-<a accesskey="p" href="man.isc-hmac-fixup.html">Prev</a> </td>
+<a accesskey="p" href="man.host.html">Prev</a> </td>
 <th width="60%" align="center">Manual pages</th>
 <td width="20%" align="right"> <a accesskey="n" href="man.named-checkconf.html">Next</a>
 </td>
@@ -84,7 +84,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.22.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.21.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>mdig</strong></span>
       is a multiple/pipelined query version of <span class="command"><strong>dig</strong></span>:
@@ -134,7 +134,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.22.8"></a><h2>ANYWHERE OPTIONS</h2>
+<a name="id-1.14.21.8"></a><h2>ANYWHERE OPTIONS</h2>
 
 
     <p>
@@ -158,7 +158,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.22.9"></a><h2>GLOBAL OPTIONS</h2>
+<a name="id-1.14.21.9"></a><h2>GLOBAL OPTIONS</h2>
 
 
     <p>
@@ -358,7 +358,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.22.10"></a><h2>LOCAL OPTIONS</h2>
+<a name="id-1.14.21.10"></a><h2>LOCAL OPTIONS</h2>
 
 
     <p>
@@ -583,7 +583,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.22.11"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.21.11"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">dig</span>(1)
@@ -597,14 +597,13 @@
 <table width="100%" summary="Navigation footer">
 <tr>
 <td width="40%" align="left">
-<a accesskey="p" href="man.isc-hmac-fixup.html">Prev</a> </td>
+<a accesskey="p" href="man.host.html">Prev</a> </td>
 <td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
 <td width="40%" align="right"> <a accesskey="n" href="man.named-checkconf.html">Next</a>
 </td>
 </tr>
 <tr>
-<td width="40%" align="left" valign="top">
-<span class="application">isc-hmac-fixup</span> </td>
+<td width="40%" align="left" valign="top">host </td>
 <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
 <td width="40%" align="right" valign="top"> <span class="application">named-checkconf</span>
 </td>
diff --git a/doc/arm/man.named-checkconf.html b/doc/arm/man.named-checkconf.html
index 9fe5ca1197d..9f5ebb26c70 100644
--- a/doc/arm/man.named-checkconf.html
+++ b/doc/arm/man.named-checkconf.html
@@ -61,7 +61,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.23.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.22.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>named-checkconf</strong></span>
       checks the syntax, but not the semantics, of a
@@ -83,7 +83,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.23.8"></a><h2>OPTIONS</h2>
+<a name="id-1.14.22.8"></a><h2>OPTIONS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-h</span></dt>
@@ -160,7 +160,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.23.9"></a><h2>RETURN VALUES</h2>
+<a name="id-1.14.22.9"></a><h2>RETURN VALUES</h2>
 
     <p><span class="command"><strong>named-checkconf</strong></span>
       returns an exit status of 1 if
@@ -169,7 +169,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.23.10"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.22.10"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">named</span>(8)
diff --git a/doc/arm/man.named-checkzone.html b/doc/arm/man.named-checkzone.html
index e4b5a582416..27a995e5136 100644
--- a/doc/arm/man.named-checkzone.html
+++ b/doc/arm/man.named-checkzone.html
@@ -111,7 +111,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.24.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.23.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>named-checkzone</strong></span>
       checks the syntax and integrity of a zone file.  It performs the
@@ -133,7 +133,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.24.8"></a><h2>OPTIONS</h2>
+<a name="id-1.14.23.8"></a><h2>OPTIONS</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -421,7 +421,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.24.9"></a><h2>RETURN VALUES</h2>
+<a name="id-1.14.23.9"></a><h2>RETURN VALUES</h2>
 
     <p><span class="command"><strong>named-checkzone</strong></span>
       returns an exit status of 1 if
@@ -430,7 +430,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.24.10"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.23.10"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">named</span>(8)
diff --git a/doc/arm/man.named-journalprint.html b/doc/arm/man.named-journalprint.html
index 48550177ef3..5ad78e342ef 100644
--- a/doc/arm/man.named-journalprint.html
+++ b/doc/arm/man.named-journalprint.html
@@ -56,7 +56,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.25.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.24.7"></a><h2>DESCRIPTION</h2>
 
     <p>
       <span class="command"><strong>named-journalprint</strong></span>
@@ -84,7 +84,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.25.8"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.24.8"></a><h2>SEE ALSO</h2>
 
     <p>
       <span class="citerefentry">
diff --git a/doc/arm/man.named-nzd2nzf.html b/doc/arm/man.named-nzd2nzf.html
index a203fe1113e..541eccd35e4 100644
--- a/doc/arm/man.named-nzd2nzf.html
+++ b/doc/arm/man.named-nzd2nzf.html
@@ -57,7 +57,7 @@
   </div>
 
   <div class="refsect1">
-<a name="id-1.14.26.6"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.25.6"></a><h2>DESCRIPTION</h2>
     
     <p>
       <span class="command"><strong>named-nzd2nzf</strong></span> converts an NZD database to NZF
@@ -71,7 +71,7 @@
   </div>
 
   <div class="refsect1">
-<a name="id-1.14.26.7"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.25.7"></a><h2>ARGUMENTS</h2>
     
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">filename</span></dt>
@@ -85,7 +85,7 @@
   </div>
 
   <div class="refsect1">
-<a name="id-1.14.26.8"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.25.8"></a><h2>SEE ALSO</h2>
     
     <p>
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>
@@ -93,7 +93,7 @@
   </div>
 
   <div class="refsect1">
-<a name="id-1.14.26.9"></a><h2>AUTHOR</h2>
+<a name="id-1.14.25.9"></a><h2>AUTHOR</h2>
     
     <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
diff --git a/doc/arm/man.named-rrchecker.html b/doc/arm/man.named-rrchecker.html
index 805848e0c54..02721cc71cf 100644
--- a/doc/arm/man.named-rrchecker.html
+++ b/doc/arm/man.named-rrchecker.html
@@ -60,7 +60,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.27.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.26.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>named-rrchecker</strong></span>
      read a individual DNS resource record from standard input and checks if it
@@ -90,7 +90,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.27.8"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.26.8"></a><h2>SEE ALSO</h2>
 
     <p>
       <em class="citetitle">RFC 1034</em>,
diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html
index 82f7bc73db0..263895854f2 100644
--- a/doc/arm/man.named.conf.html
+++ b/doc/arm/man.named.conf.html
@@ -55,7 +55,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.27.7"></a><h2>DESCRIPTION</h2>
 
     <p><code class="filename">named.conf</code> is the configuration file
       for
@@ -76,7 +76,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.8"></a><h2>ACL</h2>
+<a name="id-1.14.27.8"></a><h2>ACL</h2>
 
     <div class="literallayout"><p><br>
 acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -84,7 +84,7 @@ acl
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.9"></a><h2>CONTROLS</h2>
+<a name="id-1.14.27.9"></a><h2>CONTROLS</h2>
 
     <div class="literallayout"><p><br>
 controls {<br>
@@ -102,7 +102,7 @@ controls
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.10"></a><h2>DLZ</h2>
+<a name="id-1.14.27.10"></a><h2>DLZ</h2>
 
     <div class="literallayout"><p><br>
 dlz <em class="replaceable"><code>string</code></em> {<br>
@@ -113,7 +113,7 @@ dlz
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.11"></a><h2>DYNDB</h2>
+<a name="id-1.14.27.11"></a><h2>DYNDB</h2>
 
     <div class="literallayout"><p><br>
 dyndb <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>quoted_string</code></em> {<br>
@@ -122,7 +122,7 @@ dyndb
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.12"></a><h2>KEY</h2>
+<a name="id-1.14.27.12"></a><h2>KEY</h2>
 
     <div class="literallayout"><p><br>
 key <em class="replaceable"><code>string</code></em> {<br>
@@ -133,7 +133,7 @@ key
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.13"></a><h2>LOGGING</h2>
+<a name="id-1.14.27.13"></a><h2>LOGGING</h2>
 
     <div class="literallayout"><p><br>
 logging {<br>
@@ -155,7 +155,7 @@ logging
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.14"></a><h2>MANAGED-KEYS</h2>
+<a name="id-1.14.27.14"></a><h2>MANAGED-KEYS</h2>
 
     <div class="literallayout"><p><br>
 managed-keys { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>integer</code></em><br>
@@ -164,7 +164,7 @@ managed-keys
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.15"></a><h2>MASTERS</h2>
+<a name="id-1.14.27.15"></a><h2>MASTERS</h2>
 
     <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] [<span class="optional"> dscp<br>
@@ -175,7 +175,7 @@ masters
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.16"></a><h2>OPTIONS</h2>
+<a name="id-1.14.27.16"></a><h2>OPTIONS</h2>
 
     <div class="literallayout"><p><br>
 options {<br>
@@ -466,7 +466,7 @@ options
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.17"></a><h2>SERVER</h2>
+<a name="id-1.14.27.17"></a><h2>SERVER</h2>
 
     <div class="literallayout"><p><br>
 server <em class="replaceable"><code>netprefix</code></em> {<br>
@@ -505,7 +505,7 @@ server
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.18"></a><h2>STATISTICS-CHANNELS</h2>
+<a name="id-1.14.27.18"></a><h2>STATISTICS-CHANNELS</h2>
 
     <div class="literallayout"><p><br>
 statistics-channels {<br>
@@ -518,7 +518,7 @@ statistics-channels
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.19"></a><h2>TRUSTED-KEYS</h2>
+<a name="id-1.14.27.19"></a><h2>TRUSTED-KEYS</h2>
 
     <div class="literallayout"><p><br>
 trusted-keys { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
@@ -527,7 +527,7 @@ trusted-keys
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.20"></a><h2>VIEW</h2>
+<a name="id-1.14.27.20"></a><h2>VIEW</h2>
 
     <div class="literallayout"><p><br>
 view <em class="replaceable"><code>string</code></em> [<span class="optional"> <em class="replaceable"><code>class</code></em> </span>] {<br>
@@ -891,7 +891,7 @@ view
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.21"></a><h2>ZONE</h2>
+<a name="id-1.14.27.21"></a><h2>ZONE</h2>
 
     <div class="literallayout"><p><br>
 zone <em class="replaceable"><code>string</code></em> [<span class="optional"> <em class="replaceable"><code>class</code></em> </span>] {<br>
@@ -991,14 +991,14 @@ zone
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.22"></a><h2>FILES</h2>
+<a name="id-1.14.27.22"></a><h2>FILES</h2>
 
     <p><code class="filename">/etc/named.conf</code>
     </p>
   </div>
 
   <div class="refsection">
-<a name="id-1.14.28.23"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.27.23"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
 	<span class="refentrytitle">ddns-confgen</span>(8)
diff --git a/doc/arm/man.named.html b/doc/arm/man.named.html
index 2efbb982871..4fe60a9087a 100644
--- a/doc/arm/man.named.html
+++ b/doc/arm/man.named.html
@@ -79,7 +79,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.29.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.28.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>named</strong></span>
       is a Domain Name System (DNS) server,
@@ -96,7 +96,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.29.8"></a><h2>OPTIONS</h2>
+<a name="id-1.14.28.8"></a><h2>OPTIONS</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -375,7 +375,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.29.9"></a><h2>SIGNALS</h2>
+<a name="id-1.14.28.9"></a><h2>SIGNALS</h2>
 
     <p>
       In routine operation, signals should not be used to control
@@ -405,7 +405,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.29.10"></a><h2>CONFIGURATION</h2>
+<a name="id-1.14.28.10"></a><h2>CONFIGURATION</h2>
 
     <p>
       The <span class="command"><strong>named</strong></span> configuration file is too complex
@@ -426,7 +426,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.29.11"></a><h2>FILES</h2>
+<a name="id-1.14.28.11"></a><h2>FILES</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -447,7 +447,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.29.12"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.28.12"></a><h2>SEE ALSO</h2>
 
     <p><em class="citetitle">RFC 1033</em>,
       <em class="citetitle">RFC 1034</em>,
diff --git a/doc/arm/man.nsec3hash.html b/doc/arm/man.nsec3hash.html
index 57e737ae639..c4255092357 100644
--- a/doc/arm/man.nsec3hash.html
+++ b/doc/arm/man.nsec3hash.html
@@ -67,7 +67,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.30.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.29.7"></a><h2>DESCRIPTION</h2>
 
     <p>
       <span class="command"><strong>nsec3hash</strong></span> generates an NSEC3 hash based on
@@ -87,7 +87,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.30.8"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.29.8"></a><h2>ARGUMENTS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">salt</span></dt>
@@ -128,7 +128,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.30.9"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.29.9"></a><h2>SEE ALSO</h2>
 
     <p>
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
diff --git a/doc/arm/man.nslookup.html b/doc/arm/man.nslookup.html
index bc102f3453a..cea08fa6c0d 100644
--- a/doc/arm/man.nslookup.html
+++ b/doc/arm/man.nslookup.html
@@ -58,7 +58,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.31.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.30.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>Nslookup</strong></span>
       is a program to query Internet domain name servers.  <span class="command"><strong>Nslookup</strong></span>
@@ -72,7 +72,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.31.8"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.30.8"></a><h2>ARGUMENTS</h2>
 
     <p>
       Interactive mode is entered in the following cases:
@@ -121,7 +121,7 @@ nslookup -query=hinfo  -timeout=10
   </div>
 
   <div class="refsection">
-<a name="id-1.14.31.9"></a><h2>INTERACTIVE COMMANDS</h2>
+<a name="id-1.14.30.9"></a><h2>INTERACTIVE COMMANDS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><code class="constant">host</code> [<span class="optional">server</span>]</span></dt>
@@ -372,7 +372,7 @@ nslookup -query=hinfo  -timeout=10
   </div>
 
   <div class="refsection">
-<a name="id-1.14.31.10"></a><h2>RETURN VALUES</h2>
+<a name="id-1.14.30.10"></a><h2>RETURN VALUES</h2>
     <p>
       <span class="command"><strong>nslookup</strong></span> returns with an exit status of 1
       if any query failed, and 0 otherwise.
@@ -380,14 +380,14 @@ nslookup -query=hinfo  -timeout=10
   </div>
 
   <div class="refsection">
-<a name="id-1.14.31.11"></a><h2>FILES</h2>
+<a name="id-1.14.30.11"></a><h2>FILES</h2>
 
     <p><code class="filename">/etc/resolv.conf</code>
     </p>
   </div>
 
   <div class="refsection">
-<a name="id-1.14.31.12"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.30.12"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">dig</span>(1)
diff --git a/doc/arm/man.nsupdate.html b/doc/arm/man.nsupdate.html
index 75fb2586086..fca3edff40e 100644
--- a/doc/arm/man.nsupdate.html
+++ b/doc/arm/man.nsupdate.html
@@ -78,7 +78,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.31.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>nsupdate</strong></span>
       is used to submit Dynamic DNS Update requests as defined in RFC 2136
@@ -138,7 +138,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.8"></a><h2>OPTIONS</h2>
+<a name="id-1.14.31.8"></a><h2>OPTIONS</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -322,7 +322,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.9"></a><h2>INPUT FORMAT</h2>
+<a name="id-1.14.31.9"></a><h2>INPUT FORMAT</h2>
 
     <p><span class="command"><strong>nsupdate</strong></span>
       reads input from
@@ -686,7 +686,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.10"></a><h2>EXAMPLES</h2>
+<a name="id-1.14.31.10"></a><h2>EXAMPLES</h2>
 
     <p>
       The examples below show how
@@ -742,7 +742,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.11"></a><h2>FILES</h2>
+<a name="id-1.14.31.11"></a><h2>FILES</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -780,7 +780,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.12"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.31.12"></a><h2>SEE ALSO</h2>
 
     <p>
       <em class="citetitle">RFC 2136</em>,
@@ -803,7 +803,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.32.13"></a><h2>BUGS</h2>
+<a name="id-1.14.31.13"></a><h2>BUGS</h2>
 
     <p>
       The TSIG key is redundantly stored in two separate files.
diff --git a/doc/arm/man.pkcs11-destroy.html b/doc/arm/man.pkcs11-destroy.html
index 268f5f7ab72..82add40baa9 100644
--- a/doc/arm/man.pkcs11-destroy.html
+++ b/doc/arm/man.pkcs11-destroy.html
@@ -63,7 +63,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.33.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.32.7"></a><h2>DESCRIPTION</h2>
 
     <p>
       <span class="command"><strong>pkcs11-destroy</strong></span> destroys keys stored in a
@@ -78,7 +78,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.33.8"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.32.8"></a><h2>ARGUMENTS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-m <em class="replaceable"><code>module</code></em></span></dt>
@@ -127,7 +127,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.33.9"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.32.9"></a><h2>SEE ALSO</h2>
 
     <p>
       <span class="citerefentry">
diff --git a/doc/arm/man.pkcs11-keygen.html b/doc/arm/man.pkcs11-keygen.html
index 6a6c55823bc..fe563b85a05 100644
--- a/doc/arm/man.pkcs11-keygen.html
+++ b/doc/arm/man.pkcs11-keygen.html
@@ -66,7 +66,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.34.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.33.7"></a><h2>DESCRIPTION</h2>
 
     <p>
       <span class="command"><strong>pkcs11-keygen</strong></span> causes a PKCS#11 device to generate
@@ -76,7 +76,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.34.8"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.33.8"></a><h2>ARGUMENTS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
@@ -162,7 +162,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.34.9"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.33.9"></a><h2>SEE ALSO</h2>
 
     <p>
       <span class="citerefentry">
diff --git a/doc/arm/man.pkcs11-list.html b/doc/arm/man.pkcs11-list.html
index 415c2ea8d3d..e2162b38b3d 100644
--- a/doc/arm/man.pkcs11-list.html
+++ b/doc/arm/man.pkcs11-list.html
@@ -61,7 +61,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.35.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.34.7"></a><h2>DESCRIPTION</h2>
 
     <p>
       <span class="command"><strong>pkcs11-list</strong></span>
@@ -75,7 +75,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.35.8"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.34.8"></a><h2>ARGUMENTS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-P</span></dt>
@@ -123,7 +123,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.35.9"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.34.9"></a><h2>SEE ALSO</h2>
 
     <p>
       <span class="citerefentry">
diff --git a/doc/arm/man.pkcs11-tokens.html b/doc/arm/man.pkcs11-tokens.html
index 61ec66e8095..3414f11aa33 100644
--- a/doc/arm/man.pkcs11-tokens.html
+++ b/doc/arm/man.pkcs11-tokens.html
@@ -57,7 +57,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.36.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.35.7"></a><h2>DESCRIPTION</h2>
 
     <p>
       <span class="command"><strong>pkcs11-tokens</strong></span>
@@ -67,7 +67,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.36.8"></a><h2>ARGUMENTS</h2>
+<a name="id-1.14.35.8"></a><h2>ARGUMENTS</h2>
 
     <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-m <em class="replaceable"><code>module</code></em></span></dt>
@@ -88,7 +88,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.36.9"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.35.9"></a><h2>SEE ALSO</h2>
 
     <p>
       <span class="citerefentry">
diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html
index dd898c13e7d..42ad7d24cb3 100644
--- a/doc/arm/man.rndc-confgen.html
+++ b/doc/arm/man.rndc-confgen.html
@@ -66,7 +66,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.37.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.36.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>rndc-confgen</strong></span>
       generates configuration files
@@ -85,7 +85,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.37.8"></a><h2>OPTIONS</h2>
+<a name="id-1.14.36.8"></a><h2>OPTIONS</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -131,12 +131,7 @@
           <p>
             Specifies the algorithm to use for the TSIG key.  Available
             choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
-            if MD5 was disabled at compile time, hmac-sha256.
-          </p>
-          <p>
-            Note: Use of hmac-md5 is no longer recommended, and the default
-            value will be changed to hmac-sha256 in a future release.
+            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
           </p>
         </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
@@ -227,7 +222,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.37.9"></a><h2>EXAMPLES</h2>
+<a name="id-1.14.36.9"></a><h2>EXAMPLES</h2>
 
     <p>
       To allow <span class="command"><strong>rndc</strong></span> to be used with
@@ -246,7 +241,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.37.10"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.36.10"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">rndc</span>(8)
diff --git a/doc/arm/man.rndc.conf.html b/doc/arm/man.rndc.conf.html
index f9b0318b992..33ececfb52d 100644
--- a/doc/arm/man.rndc.conf.html
+++ b/doc/arm/man.rndc.conf.html
@@ -55,7 +55,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.38.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.37.7"></a><h2>DESCRIPTION</h2>
 
     <p><code class="filename">rndc.conf</code> is the configuration file
       for <span class="command"><strong>rndc</strong></span>, the BIND 9 name server control
@@ -143,7 +143,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.38.8"></a><h2>EXAMPLE</h2>
+<a name="id-1.14.37.8"></a><h2>EXAMPLE</h2>
 
 
     <pre class="programlisting">
@@ -221,7 +221,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.38.9"></a><h2>NAME SERVER CONFIGURATION</h2>
+<a name="id-1.14.37.9"></a><h2>NAME SERVER CONFIGURATION</h2>
 
     <p>
       The name server must be configured to accept rndc connections and
@@ -233,7 +233,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.38.10"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.37.10"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">rndc</span>(8)
diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html
index 5709f3cd66d..571a1acb6c3 100644
--- a/doc/arm/man.rndc.html
+++ b/doc/arm/man.rndc.html
@@ -67,7 +67,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.39.7"></a><h2>DESCRIPTION</h2>
+<a name="id-1.14.38.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>rndc</strong></span>
       controls the operation of a name
@@ -100,7 +100,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.39.8"></a><h2>OPTIONS</h2>
+<a name="id-1.14.38.8"></a><h2>OPTIONS</h2>
 
 
     <div class="variablelist"><dl class="variablelist">
@@ -210,7 +210,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.39.9"></a><h2>COMMANDS</h2>
+<a name="id-1.14.38.9"></a><h2>COMMANDS</h2>
 
     <p>
       A list of commands supported by <span class="command"><strong>rndc</strong></span> can
@@ -945,7 +945,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.39.10"></a><h2>LIMITATIONS</h2>
+<a name="id-1.14.38.10"></a><h2>LIMITATIONS</h2>
 
     <p>
       There is currently no way to provide the shared secret for a
@@ -957,7 +957,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.14.39.11"></a><h2>SEE ALSO</h2>
+<a name="id-1.14.38.11"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
 	<span class="refentrytitle">rndc.conf</span>(5)
diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index 5bf12334e43..4e0e53c3ca9 100644
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -458,6 +458,14 @@
 	  <span class="command"><strong>dnssec-settime</strong></span>, etc. [RT #46149]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  <span class="command"><strong>dnssec-checkds -s</strong></span> specifies a file from
+	  which to read a DS set rather than querying the parent zone.
+	  This can be used to check zone correctness prior to
+	  publication. Thanks to Niall O'Reilly [RT #44667]
+	</p>
+      </li>
 </ul></div>
   </div>
 
@@ -503,11 +511,17 @@
 <li class="listitem">
 	<p>
 	  The use of HMAC-MD5 for RNDC keys is no longer recommended.
-	  For compatibility, this is still the default algorithm generated
-	  by <span class="command"><strong>rndc-confgen</strong></span>, but it will print a
-	  warning message. The default algorithm in
-	  <span class="command"><strong>rndc-confgen</strong></span> will be changed to HMAC-SHA256
-	  in a future release. [RT #42272]
+	  The default algorithm generated by <span class="command"><strong>rndc-confgen</strong></span>,
+	  is now HMAC-256, and a warning message will be printed if
+	  HMAC-MD5 is used. [RT #42272]
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  The <span class="command"><strong>isc-hmac-fixup</strong></span> command, which was created
+	  to address an interoperability problem in TSIG keys between
+	  early versions of BIND and other DNS implmentations, is now
+	  obsolete and has been removed. [RT #46411]
 	</p>
       </li>
 </ul></div>
@@ -566,6 +580,16 @@
 	  are not writable by the effective user ID. [RT #46077]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  Initializing keys specified in a <span class="command"><strong>managed-keys</strong></span>
+	  statement or by <span class="command"><strong>dnssec-validation auto;</strong></span> are
+	  now tagged as "initializing", until they have been updated by a
+	  key refresh query. If key maintenance fails to initialize,
+	  this will be visible when running <span class="command"><strong>rndc secroots</strong></span>.
+	  [RT #46267]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  Previously, <span class="command"><strong>update-policy local;</strong></span> accepted
@@ -689,6 +713,12 @@
 	  queries. [RT #45847]
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  A new statistics counter has been added to track priming
+	  queries. [RT #46313]
+	</p>
+      </li>
 <li class="listitem">
 	<p>
 	  The <span class="command"><strong>dnssec-signzone -x</strong></span> flag and the