diff --git a/bin/tests/named.conf b/bin/tests/named.conf
index 612ecb99f0..469750e899 100644
--- a/bin/tests/named.conf
+++ b/bin/tests/named.conf
@@ -234,6 +234,8 @@ zone "stub.demo.zone" {
 	allow-transfer { any; };
 	allow-query { any; };
 	max-transfer-time-in 120;	// if not set, global option is used.
+	pubkey 257 255 1 "a useless key";
+	pubkey 257 255 1 "another useless key";
 };
 
 zone "." {
@@ -261,6 +263,7 @@ zone "non-default-acl.demo.zone" {
 		1.2.3.4;
 		5.6.7.8;
 	};
+	pubkey 666 665 664 "key of the beast";
 };
 
 key sample_key {			// for TSIG; supported by parser
diff --git a/bin/tests/nconf_test.c b/bin/tests/nconf_test.c
index 0668f81b81..174c92f469 100644
--- a/bin/tests/nconf_test.c
+++ b/bin/tests/nconf_test.c
@@ -81,7 +81,7 @@ int main (int argc, char **argv) {
 	isc_mem_t *mem = NULL;
 	dns_c_cbks_t callbacks;
 
-#if 0
+#if 1
 	callbacks.zonecbk = NULL;
 	callbacks.zonecbkuap = NULL;
 	callbacks.optscbk = NULL;
diff --git a/lib/dns/config/confacl.c b/lib/dns/config/confacl.c
index 6055182d4e..9d6a898a03 100644
--- a/lib/dns/config/confacl.c
+++ b/lib/dns/config/confacl.c
@@ -27,13 +27,6 @@
 #include <dns/confcommon.h>
 
 
-#define CONFACL_MAGIC	0x4361636cU
-#define CONFACLTABLE_MAGIC 0x32616354U
-
-#define DNS_CONFACL_VALID(confacl) ISC_MAGIC_VALID(confacl, CONFACL_MAGIC)
-#define DNS_CONFACLTABLE_VALID(confacltable) \
-	ISC_MAGIC_VALID(confacltable, CONFACLTABLE_MAGIC)
-
 static isc_result_t acl_delete(isc_log_t *lctx, dns_c_acl_t **aclptr);
 
 
@@ -56,7 +49,7 @@ dns_c_acltable_new(isc_log_t *lctx,
 	}
 
 	table->mem = mem;
-	table->magic = CONFACLTABLE_MAGIC;
+	table->magic = DNS_C_CONFACLTABLE_MAGIC;
 
 	ISC_LIST_INIT(table->acl_list);
 
@@ -78,7 +71,7 @@ dns_c_acltable_delete(isc_log_t *lctx,
 	
 	acltable = *table;
 
-	REQUIRE(DNS_CONFACLTABLE_VALID(acltable));
+	REQUIRE(DNS_C_CONFACLTABLE_VALID(acltable));
 
 	dns_c_acltable_clear(lctx, acltable);
 
@@ -108,7 +101,7 @@ dns_c_acltable_print(isc_log_t *lctx,
 		return;
 	}
 		
-	REQUIRE(DNS_CONFACLTABLE_VALID(table));
+	REQUIRE(DNS_C_CONFACLTABLE_VALID(table));
 			
 	acl = ISC_LIST_HEAD(table->acl_list);
 	while (acl != NULL) {
@@ -131,7 +124,7 @@ dns_c_acltable_clear(isc_log_t *lctx, dns_c_acltable_t *table)
 	dns_c_acl_t *tmpelem;
 	isc_result_t r;
 	
-	REQUIRE(DNS_CONFACLTABLE_VALID(table));
+	REQUIRE(DNS_C_CONFACLTABLE_VALID(table));
 			
 	elem = ISC_LIST_HEAD(table->acl_list);
 	while (elem != NULL) {
@@ -160,7 +153,7 @@ dns_c_acltable_getacl(isc_log_t *lctx, dns_c_acltable_t *table,
 {
 	dns_c_acl_t *elem;
 
-	REQUIRE(DNS_CONFACLTABLE_VALID(table));
+	REQUIRE(DNS_C_CONFACLTABLE_VALID(table));
 	REQUIRE(retval != NULL);
 	REQUIRE(aclname != NULL);
 	REQUIRE(strlen(aclname) > 0);
@@ -177,7 +170,7 @@ dns_c_acltable_getacl(isc_log_t *lctx, dns_c_acltable_t *table,
 	}
 	
 	if (elem != NULL) {
-		REQUIRE(DNS_CONFACL_VALID(elem));
+		REQUIRE(DNS_C_CONFACL_VALID(elem));
 		*retval = elem;
 	}
 
@@ -192,7 +185,7 @@ dns_c_acltable_removeacl(isc_log_t *lctx,
 	dns_c_acl_t *acl;
 	dns_c_acl_t *tmpacl;
 
-	REQUIRE(DNS_CONFACLTABLE_VALID(table));
+	REQUIRE(DNS_C_CONFACLTABLE_VALID(table));
 	REQUIRE(aclname != NULL);
 	
 	acl = ISC_LIST_HEAD(table->acl_list);
@@ -218,7 +211,7 @@ dns_c_acl_new(isc_log_t *lctx,
 {
 	dns_c_acl_t *acl;
 	
-	REQUIRE(DNS_CONFACLTABLE_VALID(table));
+	REQUIRE(DNS_C_CONFACLTABLE_VALID(table));
 	REQUIRE(aclname != NULL);
 	REQUIRE(strlen(aclname) > 0);
 	REQUIRE(newacl != NULL);
@@ -232,7 +225,7 @@ dns_c_acl_new(isc_log_t *lctx,
 	}
 
 	acl->mytable = table;
-	acl->magic = CONFACL_MAGIC;
+	acl->magic = DNS_C_CONFACL_MAGIC;
 	acl->name = NULL;
 	acl->ipml = NULL;
 	acl->is_special = isspecial;
@@ -258,7 +251,7 @@ void
 dns_c_acl_print(isc_log_t *lctx,
 		FILE *fp, int indent, dns_c_acl_t *acl)
 {
-	REQUIRE(DNS_CONFACL_VALID(acl));
+	REQUIRE(DNS_C_CONFACL_VALID(acl));
 	
 	dns_c_printtabs(lctx, fp, indent);
 	fprintf(fp, "acl ");
@@ -285,7 +278,7 @@ dns_c_acl_setipml(isc_log_t *lctx, dns_c_acl_t *acl,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFACL_VALID(acl));
+	REQUIRE(DNS_C_CONFACL_VALID(acl));
 	REQUIRE(ipml != NULL);
 
 	if (acl->ipml != NULL) {
@@ -311,7 +304,7 @@ dns_c_acl_getipmlexpanded(isc_log_t *lctx, isc_mem_t *mem, dns_c_acl_t *acl,
 	dns_c_ipmatchlist_t *newlist;
 	isc_result_t r;
 
-	REQUIRE(DNS_CONFACL_VALID(acl));
+	REQUIRE(DNS_C_CONFACL_VALID(acl));
 	
 	if (acl->ipml == NULL) {
 		newlist = NULL;
@@ -344,7 +337,7 @@ dns_c_acl_expandacls(isc_log_t *lctx, dns_c_acltable_t *table,
 	isc_result_t r;
 	isc_boolean_t isneg;
 
-	REQUIRE(DNS_CONFACLTABLE_VALID(table));
+	REQUIRE(DNS_C_CONFACLTABLE_VALID(table));
 	
 	if (list == NULL) {
 		return (ISC_R_SUCCESS);
@@ -407,7 +400,7 @@ acl_delete(isc_log_t *lctx, dns_c_acl_t **aclptr)
 	
 	acl = *aclptr;
 
-	REQUIRE(DNS_CONFACL_VALID(acl));
+	REQUIRE(DNS_C_CONFACL_VALID(acl));
 
 	mem = acl->mytable->mem;
 
diff --git a/lib/dns/config/confctl.c b/lib/dns/config/confctl.c
index e944f9f4a1..7c29dbcd9a 100644
--- a/lib/dns/config/confctl.c
+++ b/lib/dns/config/confctl.c
@@ -26,13 +26,6 @@
 #include <dns/confctl.h>
 #include <dns/confcommon.h>
 
-#define CONFCTL_MAGIC	0x4363746cU
-#define CONFCTLLIST_MAGIC 0x4354424cU
-
-#define DNS_CONFCTLLIST_VALID(ctllist) \
-	ISC_MAGIC_VALID(ctllist, CONFCTLLIST_MAGIC)
-#define DNS_CONFCTL_VALID(ctl) ISC_MAGIC_VALID(ctl, CONFCTL_MAGIC)
-
 
 isc_result_t
 dns_c_ctrllist_new(isc_log_t *lctx,
@@ -52,7 +45,7 @@ dns_c_ctrllist_new(isc_log_t *lctx,
 	}
 
 	newl->mem = mem;
-	newl->magic = CONFCTLLIST_MAGIC;
+	newl->magic = DNS_C_CONFCTLLIST_MAGIC;
 	
 	ISC_LIST_INIT(newl->elements);
 
@@ -73,7 +66,7 @@ dns_c_ctrllist_print(isc_log_t *lctx,
 		return;
 	}
 
-	REQUIRE(DNS_CONFCTLLIST_VALID(cl));
+	REQUIRE(DNS_C_CONFCTLLIST_VALID(cl));
 	
 	if (ISC_LIST_EMPTY(cl->elements)) {
 		return;
@@ -104,7 +97,7 @@ dns_c_ctrllist_delete(isc_log_t *lctx,
 	
 	clist = *list;
 
-	REQUIRE(DNS_CONFCTLLIST_VALID(clist));
+	REQUIRE(DNS_C_CONFCTLLIST_VALID(clist));
 	
 	ctrl = ISC_LIST_HEAD(clist->elements);
 	while (ctrl != NULL) {
@@ -137,7 +130,7 @@ dns_c_ctrlinet_new(isc_log_t *lctx, isc_mem_t *mem, dns_c_ctrl_t **control,
 		return (ISC_R_NOMEMORY);
 	}
 
-	ctrl->magic = CONFCTL_MAGIC;
+	ctrl->magic = DNS_C_CONFCTL_MAGIC;
 	ctrl->mem = mem;
 	ctrl->control_type = dns_c_inet_control;
 	ctrl->u.inet_v.addr = addr;
@@ -177,7 +170,7 @@ dns_c_ctrlunix_new(isc_log_t *lctx,
 		return (ISC_R_NOMEMORY);
 	}
 
-	ctrl->magic = CONFCTL_MAGIC;
+	ctrl->magic = DNS_C_CONFCTL_MAGIC;
 	ctrl->mem = mem;
 	ctrl->control_type = dns_c_unix_control;
 	ctrl->u.unix_v.pathname = isc_mem_strdup(mem, path);
@@ -211,7 +204,7 @@ dns_c_ctrl_delete(isc_log_t *lctx,
 
 	ctrl = *control;
 
-	REQUIRE(DNS_CONFCTL_VALID(ctrl));
+	REQUIRE(DNS_C_CONFCTL_VALID(ctrl));
 
 	mem = ctrl->mem;
 
@@ -249,7 +242,7 @@ dns_c_ctrl_print(isc_log_t *lctx,
 	short port;
 	dns_c_ipmatchlist_t *iml;
 
-	REQUIRE(DNS_CONFCTL_VALID(ctl));
+	REQUIRE(DNS_C_CONFCTL_VALID(ctl));
 		
 	(void) indent;
 	
diff --git a/lib/dns/config/confctx.c b/lib/dns/config/confctx.c
index 1c8a36437f..03bdc87ca9 100644
--- a/lib/dns/config/confctx.c
+++ b/lib/dns/config/confctx.c
@@ -32,12 +32,6 @@
 
 
 
-#define CONFIG_MAGIC		0x434f4e46U /* CONF */
-#define OPTION_MAGIC		0x4f707473U /* Opts */
-
-#define DNS_CONFCTX_VALID(ctx) ISC_MAGIC_VALID(ctx, CONFIG_MAGIC)
-#define DNS_CONFOPT_VALID(opt) ISC_MAGIC_VALID(opt, OPTION_MAGIC)
-
 /*
  * Bit positions in the flags fields of the dns_c_options_t structure.
  */
@@ -139,7 +133,7 @@ dns_c_ctx_new(isc_log_t *lctx,
 		return (ISC_R_NOMEMORY);
 	}
 
-	cfg->magic = CONFIG_MAGIC;
+	cfg->magic = DNS_C_CONFIG_MAGIC;
 	cfg->mem = mem;
 	cfg->warnings = 0;
 	cfg->errors = 0;
@@ -189,7 +183,7 @@ dns_c_ctx_delete(isc_log_t *lctx,
 
 	REQUIRE(cfg != NULL);
 	REQUIRE(*cfg != NULL);
-	REQUIRE(DNS_CONFCTX_VALID(*cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(*cfg));
 
 	c = *cfg;
 
@@ -235,7 +229,7 @@ dns_c_ctx_setcurrzone(isc_log_t *lctx, dns_c_ctx_t *cfg,
 {
 	(void) lctx;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	cfg->currzone = zone;		/* zone may be NULL */
 
@@ -251,7 +245,7 @@ dns_c_ctx_getcurrzone(isc_log_t *lctx, dns_c_ctx_t *cfg)
 {
 	(void) lctx;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	return (cfg->currzone);
 }
@@ -264,7 +258,7 @@ dns_c_ctx_setcurrview(isc_log_t *lctx, dns_c_ctx_t *cfg,
 {
 	(void) lctx;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	cfg->currview = view;
 
@@ -280,7 +274,7 @@ dns_c_ctx_getcurrview(isc_log_t *lctx, dns_c_ctx_t *cfg)
 {
 	(void) lctx;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	return (cfg->currview);
 }
@@ -292,37 +286,66 @@ dns_c_ctx_print(isc_log_t *lctx,
 		FILE *fp, int indent, dns_c_ctx_t *cfg)
 {
 	REQUIRE(fp != NULL);
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
-	dns_c_logginglist_print(lctx, fp, indent, cfg->logging, ISC_FALSE);
-	fprintf(fp,"\n");
+	if (cfg->logging != NULL) {
+		dns_c_logginglist_print(lctx, fp, indent,
+					cfg->logging, ISC_FALSE);
+		fprintf(fp,"\n");
+	}
 	
-	dns_c_kdeflist_print(lctx, fp, indent, cfg->keydefs);
-	fprintf(fp, "\n");
-
-	dns_c_tkeylist_print(lctx, fp, indent, cfg->trusted_keys);
-	fprintf(fp, "\n");
-
-	dns_c_acltable_print(lctx, fp, indent, cfg->acls);
-	fprintf(fp,"\n");
-
-	dns_c_zonelist_printpreopts(lctx, fp, indent, cfg->zlist);
-	fprintf(fp, "\n");
 	
-	dns_c_ctx_optionsprint(lctx, fp, indent, cfg->options);
-	fprintf(fp,"\n");
-
-	dns_c_zonelist_printpostopts(lctx, fp, indent, cfg->zlist);
-	fprintf(fp, "\n");
-
-	dns_c_viewtable_print(lctx, fp, indent, cfg->views);
-	fprintf(fp, "\n");
+	if (cfg->keydefs != NULL) {
+		dns_c_kdeflist_print(lctx, fp, indent, cfg->keydefs);
+		fprintf(fp, "\n");
+	}
 	
-	dns_c_ctrllist_print(lctx, fp, indent, cfg->controls);
-	fprintf(fp, "\n");
 
-	dns_c_srvlist_print(lctx, fp, indent, cfg->servers);
-	fprintf(fp, "\n");
+	if (cfg->trusted_keys != NULL) {
+		dns_c_tkeylist_print(lctx, fp, indent, cfg->trusted_keys);
+		fprintf(fp, "\n");
+	}
+	
+
+	if (cfg->acls != NULL) {
+		dns_c_acltable_print(lctx, fp, indent, cfg->acls);
+		fprintf(fp,"\n");
+	}
+	
+
+	if (cfg->zlist != NULL) {
+		dns_c_zonelist_printpreopts(lctx, fp, indent, cfg->zlist);
+		fprintf(fp, "\n");
+	}
+	
+	
+	if (cfg->options != NULL) {
+		dns_c_ctx_optionsprint(lctx, fp, indent, cfg->options);
+		fprintf(fp,"\n");
+	}
+	
+
+	if (cfg->zlist != NULL) {
+		dns_c_zonelist_printpostopts(lctx, fp, indent, cfg->zlist);
+		fprintf(fp, "\n");
+	}
+
+	if (cfg->views != NULL) {
+		dns_c_viewtable_print(lctx, fp, indent, cfg->views);
+		fprintf(fp, "\n");
+	}
+	
+	
+	if (cfg->controls != NULL) {
+		dns_c_ctrllist_print(lctx, fp, indent, cfg->controls);
+		fprintf(fp, "\n");
+	}
+	
+
+	if (cfg->servers != NULL) {
+		dns_c_srvlist_print(lctx, fp, indent, cfg->servers);
+		fprintf(fp, "\n");
+	}
 }
 
 
@@ -337,7 +360,7 @@ dns_c_ctx_forwarderprint(isc_log_t *lctx,
 		return;
 	}
 
-	REQUIRE(DNS_CONFOPT_VALID(options));
+	REQUIRE(DNS_C_CONFOPT_VALID(options));
 
 	if (DNS_C_CHECKBIT(FORWARD_BIT, &options->setflags1)) {
 		dns_c_printtabs(lctx, fp, indent);
@@ -362,11 +385,11 @@ dns_c_ctx_getoptions(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(options != NULL);
 	
 	if (cfg->options != NULL) {
-		REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+		REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 	}
 	
 	*options = cfg->options;
@@ -382,7 +405,7 @@ dns_c_ctx_getlogging(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	*retval = cfg->logging;
 
@@ -399,7 +422,7 @@ dns_c_ctx_setlogging(isc_log_t *lctx,
 	isc_result_t res;
 	isc_boolean_t existed;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	existed = ISC_TF(cfg->logging != NULL);
 	
@@ -424,7 +447,7 @@ dns_c_ctx_getkdeflist(isc_log_t *lctx, dns_c_ctx_t *cfg,
 {
 	(void)(lctx);
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
         REQUIRE(retval != NULL);
 
 	*retval = cfg->keydefs;
@@ -443,7 +466,7 @@ dns_c_ctx_setkdeflist(isc_log_t *lctx, dns_c_ctx_t *cfg,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->keydefs != NULL) {
 		dns_c_kdeflist_delete(lctx, &cfg->keydefs);
@@ -472,7 +495,7 @@ dns_c_ctx_addfile_channel(isc_log_t *lctx,
 	dns_c_logchan_t *newc;
 	isc_result_t res;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(name != NULL);
 	REQUIRE(chan != NULL);
 	REQUIRE(cfg->logging != NULL);
@@ -500,7 +523,7 @@ dns_c_ctx_addsyslogchannel(isc_log_t *lctx,
 	dns_c_logchan_t *newc;
 	isc_result_t res;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(name != NULL);
 	REQUIRE(chan != NULL);
 	REQUIRE(cfg->logging != NULL);
@@ -528,7 +551,7 @@ dns_c_ctx_addnullchannel(isc_log_t *lctx,
 	dns_c_logchan_t *newc;
 	isc_result_t res;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(name != NULL);
 	REQUIRE(chan != NULL);
 	REQUIRE(cfg->logging != NULL);
@@ -556,7 +579,7 @@ dns_c_ctx_addcategory(isc_log_t *lctx,
 	dns_c_logcat_t *newc;
 	isc_result_t res;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(newcat != NULL);
 	REQUIRE(cfg->logging != NULL);
 
@@ -582,7 +605,7 @@ dns_c_ctx_currchannel(isc_log_t *lctx,
 
 	(void)lctx;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(channel != NULL);
 	REQUIRE(cfg->logging != NULL);
 
@@ -601,7 +624,7 @@ dns_c_ctx_channeldefinedp(isc_log_t *lctx,
 	isc_result_t res;
 	dns_c_logchan_t *chan;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(name != NULL);
 	REQUIRE(strlen(name) > 0);
 
@@ -620,7 +643,7 @@ dns_c_ctx_currcategory(isc_log_t *lctx,
 	dns_c_logginglist_t *llist;
 	isc_result_t res;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(category != NULL);
 
 	res = dns_c_ctx_getlogging(lctx, cfg, &llist);
@@ -648,7 +671,7 @@ dns_c_ctx_setdirectory(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -667,7 +690,7 @@ dns_c_ctx_setversion(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -686,7 +709,7 @@ dns_c_ctx_setdumpfilename(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -705,7 +728,7 @@ dns_c_ctx_setpidfilename(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -724,7 +747,7 @@ dns_c_ctx_setstatsfilename(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -743,7 +766,7 @@ dns_c_ctx_setmemstatsfilename(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -762,7 +785,7 @@ dns_c_ctx_setnamedxfer(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -781,7 +804,7 @@ dns_c_ctx_settkeydomain(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -800,7 +823,7 @@ dns_c_ctx_settkeydhkey(isc_log_t *lctx, dns_c_ctx_t *cfg,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -820,7 +843,7 @@ dns_c_ctx_setmaxncachettl(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -841,7 +864,7 @@ dns_c_ctx_settransfersin(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -862,7 +885,7 @@ dns_c_ctx_settransfersperns(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -883,7 +906,7 @@ dns_c_ctx_settransfersout(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -904,7 +927,7 @@ dns_c_ctx_setmaxlogsizeixfr(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -925,7 +948,7 @@ dns_c_ctx_setcleaninterval(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -946,7 +969,7 @@ dns_c_ctx_setinterfaceinterval(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -967,7 +990,7 @@ dns_c_ctx_setstatsinterval(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -988,7 +1011,7 @@ dns_c_ctx_setheartbeat_interval(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1009,7 +1032,7 @@ dns_c_ctx_setmaxtransfertimein(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1030,7 +1053,7 @@ dns_c_ctx_setdatasize(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1051,7 +1074,7 @@ dns_c_ctx_setstacksize(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1072,7 +1095,7 @@ dns_c_ctx_setcoresize(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1093,7 +1116,7 @@ dns_c_ctx_setfiles(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1114,7 +1137,7 @@ dns_c_ctx_setexpertmode(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1135,7 +1158,7 @@ dns_c_ctx_setfakeiquery(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1156,7 +1179,7 @@ dns_c_ctx_setrecursion(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1177,7 +1200,7 @@ dns_c_ctx_setfetchglue(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1198,7 +1221,7 @@ dns_c_ctx_setnotify(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1219,7 +1242,7 @@ dns_c_ctx_sethoststatistics(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1240,7 +1263,7 @@ dns_c_ctx_setdealloconexit(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1261,7 +1284,7 @@ dns_c_ctx_setuseixfr(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1282,7 +1305,7 @@ dns_c_ctx_setmaintainixfrbase(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1303,7 +1326,7 @@ dns_c_ctx_sethasoldclients(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1324,7 +1347,7 @@ dns_c_ctx_setauthnxdomain(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1345,7 +1368,7 @@ dns_c_ctx_setmultiplecnames(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1366,7 +1389,7 @@ dns_c_ctx_setuseidpool(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1387,7 +1410,7 @@ dns_c_ctx_setrfc2308type1(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1408,7 +1431,7 @@ dns_c_ctx_setdialup(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1430,7 +1453,7 @@ dns_c_ctx_setquerysourceaddr(isc_log_t *lctx,
 	isc_boolean_t existed;
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1454,7 +1477,7 @@ dns_c_ctx_setquerysourceport(isc_log_t *lctx,
 	isc_boolean_t existed;
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1479,7 +1502,7 @@ dns_c_ctx_settransferformat(isc_log_t *lctx,
 	isc_boolean_t existed;
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1505,7 +1528,7 @@ dns_c_ctx_setchecknames(isc_log_t *lctx,
 	isc_boolean_t existed = ISC_FALSE;
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1551,7 +1574,7 @@ dns_c_ctx_setqueryacl(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1574,7 +1597,7 @@ dns_c_ctx_settransferacl(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1597,7 +1620,7 @@ dns_c_ctx_setrecursionacl(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1620,7 +1643,7 @@ dns_c_ctx_setblackhole(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1643,7 +1666,7 @@ dns_c_ctx_settopology(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1666,7 +1689,7 @@ dns_c_ctx_setsortlist(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1689,7 +1712,7 @@ dns_c_ctx_setforward(isc_log_t *lctx,
 	isc_boolean_t existed;
 	isc_result_t res;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1712,7 +1735,7 @@ dns_c_ctx_setforwarders(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1735,7 +1758,7 @@ dns_c_ctx_setrrsetorderlist(isc_log_t *lctx,
 	dns_c_options_t *opts;
 	isc_result_t res;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	res = make_options(lctx, cfg);
 	if (res != ISC_R_SUCCESS) {
@@ -1784,7 +1807,7 @@ dns_c_ctx_addlisten_on(isc_log_t *lctx,
 	isc_result_t res;
 	dns_c_options_t *opts;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(port >= 0 && port <= 65535);
 
 	res = make_options(lctx, cfg);
@@ -1838,7 +1861,7 @@ dns_c_ctx_settrustedkeys(isc_log_t *lctx,
 	dns_c_tkeylist_t *newl;
 	isc_result_t res;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	existed = (cfg->trusted_keys == NULL ? ISC_FALSE : ISC_TRUE);
 
@@ -1875,14 +1898,14 @@ dns_c_ctx_getdirectory(isc_log_t *lctx,
 
 	(void)lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 
 	*retval = cfg->options->directory;
 
@@ -1897,14 +1920,14 @@ dns_c_ctx_getversion(isc_log_t *lctx,
 
 	(void)lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 
 	*retval = cfg->options->version;
 
@@ -1919,14 +1942,14 @@ dns_c_ctx_getdumpfilename(isc_log_t *lctx,
 
 	(void)lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 
 	*retval = cfg->options->dump_filename;
 
@@ -1941,14 +1964,14 @@ dns_c_ctx_getpidfilename(isc_log_t *lctx,
 
 	(void)lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 
 	*retval = cfg->options->pid_filename;
 
@@ -1963,14 +1986,14 @@ dns_c_ctx_getstatsfilename(isc_log_t *lctx,
 
 	(void)lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 
 	*retval = cfg->options->stats_filename;
 
@@ -1984,14 +2007,14 @@ dns_c_ctx_getmemstatsfilename(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 
 	*retval = cfg->options->memstats_filename;
 
@@ -2005,14 +2028,14 @@ dns_c_ctx_getnamedxfer(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 
 	*retval = cfg->options->named_xfer;
 
@@ -2026,14 +2049,14 @@ dns_c_ctx_gettkeydomain(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 
 	*retval = cfg->options->tkeydomain;
 
@@ -2049,7 +2072,7 @@ dns_c_ctx_gettkeydhkey(isc_log_t *lctx, dns_c_ctx_t *cfg,
 	
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(charpval != NULL);
 	REQUIRE(intval != NULL);
 
@@ -2057,7 +2080,7 @@ dns_c_ctx_gettkeydhkey(isc_log_t *lctx, dns_c_ctx_t *cfg,
 		return (ISC_R_NOTFOUND);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 
 	if (cfg->options->tkeydhkeycp == NULL) {
 		res = ISC_R_NOTFOUND;
@@ -2075,14 +2098,14 @@ isc_result_t
 dns_c_ctx_getmaxncachettl(isc_log_t *lctx,
 			  dns_c_ctx_t *cfg, isc_uint32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 	
 	return (cfg_get_uint32(lctx, cfg->options, 
 			       &cfg->options->max_ncache_ttl,
@@ -2096,14 +2119,14 @@ isc_result_t
 dns_c_ctx_gettransfersin(isc_log_t *lctx,
 			 dns_c_ctx_t *cfg, isc_int32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 
 	
 	return (cfg_get_int32(lctx, cfg->options, 
@@ -2118,14 +2141,14 @@ isc_result_t
 dns_c_ctx_gettransfersperns(isc_log_t *lctx,
 			    dns_c_ctx_t *cfg, isc_int32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 		
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 	
 	return (cfg_get_int32(lctx, cfg->options, 
 			      &cfg->options->transfers_per_ns,
@@ -2139,14 +2162,14 @@ isc_result_t
 dns_c_ctx_gettransfersout(isc_log_t *lctx,
 			  dns_c_ctx_t *cfg, isc_int32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 	
 	return (cfg_get_int32(lctx, cfg->options, 
 			      &cfg->options->transfers_out,
@@ -2160,14 +2183,14 @@ isc_result_t
 dns_c_ctx_getmaxlogsizeixfr(isc_log_t *lctx,
 			    dns_c_ctx_t *cfg, isc_int32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 
 	return (cfg_get_int32(lctx, cfg->options, 
 			      &cfg->options->max_log_size_ixfr,
@@ -2181,14 +2204,14 @@ isc_result_t
 dns_c_ctx_getcleaninterval(isc_log_t *lctx,
 			   dns_c_ctx_t *cfg, isc_int32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 
 	return (cfg_get_int32(lctx, cfg->options, 
 			      &cfg->options->clean_interval,
@@ -2202,7 +2225,7 @@ isc_result_t
 dns_c_ctx_getinterfaceinterval(isc_log_t *lctx,
 			       dns_c_ctx_t *cfg, isc_int32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2222,7 +2245,7 @@ isc_result_t
 dns_c_ctx_getstatsinterval(isc_log_t *lctx,
 			   dns_c_ctx_t *cfg, isc_int32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2242,7 +2265,7 @@ isc_result_t
 dns_c_ctx_getheartbeatinterval(isc_log_t *lctx,
 			       dns_c_ctx_t *cfg, isc_int32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2262,7 +2285,7 @@ isc_result_t
 dns_c_ctx_getmaxtransfertimein(isc_log_t *lctx,
 			       dns_c_ctx_t *cfg, isc_int32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2282,7 +2305,7 @@ isc_result_t
 dns_c_ctx_getdatasize(isc_log_t *lctx,
 		      dns_c_ctx_t *cfg, isc_uint32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2302,7 +2325,7 @@ isc_result_t
 dns_c_ctx_getstacksize(isc_log_t *lctx,
 		       dns_c_ctx_t *cfg, isc_uint32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2322,7 +2345,7 @@ isc_result_t
 dns_c_ctx_getcoresize(isc_log_t *lctx,
 		      dns_c_ctx_t *cfg, isc_uint32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2342,7 +2365,7 @@ isc_result_t
 dns_c_ctx_getfiles(isc_log_t *lctx,
 		   dns_c_ctx_t *cfg, isc_uint32_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2362,7 +2385,7 @@ isc_result_t
 dns_c_ctx_getfakeiquery(isc_log_t *lctx,
 			dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2382,7 +2405,7 @@ isc_result_t
 dns_c_ctx_getrecursion(isc_log_t *lctx,
 		       dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2402,7 +2425,7 @@ isc_result_t
 dns_c_ctx_getfetchglue(isc_log_t *lctx,
 		       dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2422,7 +2445,7 @@ isc_result_t
 dns_c_ctx_getnotify(isc_log_t *lctx,
 		    dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2442,7 +2465,7 @@ isc_result_t
 dns_c_ctx_gethoststatistics(isc_log_t *lctx,
 			    dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2462,7 +2485,7 @@ isc_result_t
 dns_c_ctx_getdealloconexit(isc_log_t *lctx,
 			   dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2482,7 +2505,7 @@ isc_result_t
 dns_c_ctx_getuseixfr(isc_log_t *lctx,
 		     dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2502,7 +2525,7 @@ isc_result_t
 dns_c_ctx_getmaintainixfrbase(isc_log_t *lctx,
 			      dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2522,7 +2545,7 @@ isc_result_t
 dns_c_ctx_gethasoldclients(isc_log_t *lctx,
 			   dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2542,7 +2565,7 @@ isc_result_t
 dns_c_ctx_getauth_nx_domain(isc_log_t *lctx,
 			    dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2562,7 +2585,7 @@ isc_result_t
 dns_c_ctx_getmultiplecnames(isc_log_t *lctx,
 			    dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2582,7 +2605,7 @@ isc_result_t
 dns_c_ctx_getuseidpool(isc_log_t *lctx,
 		       dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2602,7 +2625,7 @@ isc_result_t
 dns_c_ctx_getrfc2308type1(isc_log_t *lctx,
 			  dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2622,7 +2645,7 @@ isc_result_t
 dns_c_ctx_getdialup(isc_log_t *lctx,
 		    dns_c_ctx_t *cfg, isc_boolean_t *retval)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2646,7 +2669,7 @@ dns_c_ctx_getquerysourceaddr(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
@@ -2671,7 +2694,7 @@ dns_c_ctx_getquerysourceport(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
@@ -2695,7 +2718,7 @@ dns_c_ctx_gettransferformat(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL) {
@@ -2722,7 +2745,7 @@ dns_c_ctx_getchecknames(isc_log_t *lctx,
 	isc_boolean_t isset = ISC_FALSE;
 	isc_result_t res;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
@@ -2768,7 +2791,7 @@ isc_result_t
 dns_c_ctx_getqueryacl(isc_log_t *lctx,
 		      dns_c_ctx_t *cfg, dns_c_ipmatchlist_t **list)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
@@ -2785,7 +2808,7 @@ isc_result_t
 dns_c_ctx_gettransferacl(isc_log_t *lctx,
 			 dns_c_ctx_t *cfg, dns_c_ipmatchlist_t **list)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
@@ -2802,7 +2825,7 @@ isc_result_t
 dns_c_ctx_getrecursionacl(isc_log_t *lctx,
 			  dns_c_ctx_t *cfg, dns_c_ipmatchlist_t **list)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
@@ -2819,7 +2842,7 @@ isc_result_t
 dns_c_ctx_getblackhole(isc_log_t *lctx,
 		       dns_c_ctx_t *cfg, dns_c_ipmatchlist_t **list)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
@@ -2836,7 +2859,7 @@ isc_result_t
 dns_c_ctx_gettopology(isc_log_t *lctx,
 		      dns_c_ctx_t *cfg, dns_c_ipmatchlist_t **list)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
@@ -2853,7 +2876,7 @@ isc_result_t
 dns_c_ctx_getsortlist(isc_log_t *lctx,
 		      dns_c_ctx_t *cfg, dns_c_ipmatchlist_t **list)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
@@ -2872,7 +2895,7 @@ dns_c_ctx_getlistenlist(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
@@ -2898,7 +2921,7 @@ dns_c_ctx_getforward(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
@@ -2921,7 +2944,7 @@ isc_result_t
 dns_c_ctx_getforwarders(isc_log_t *lctx,
 			dns_c_ctx_t *cfg, dns_c_ipmatchlist_t **list)
 {
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->options == NULL) {
 		return (ISC_R_NOTFOUND);
@@ -2940,7 +2963,7 @@ dns_c_ctx_getrrsetorderlist(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->options == NULL || cfg->options->ordering == NULL) {
@@ -2958,7 +2981,7 @@ dns_c_ctx_gettrustedkeys(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(retval != NULL);
 
 	if (cfg->trusted_keys == NULL) {
@@ -3002,7 +3025,7 @@ dns_c_ctx_optionsnew(isc_log_t *lctx,
 	opts->tkeydhkeyi = 0;
 
 	opts->mem = mem;
-	opts->magic = OPTION_MAGIC;
+	opts->magic = DNS_C_OPTION_MAGIC;
 	opts->flags = 0;
 	opts->max_ncache_ttl = 0;
 	
@@ -3077,7 +3100,7 @@ dns_c_ctx_optionsdelete(isc_log_t *lctx,
 		return (ISC_R_SUCCESS);
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(options));
+	REQUIRE(DNS_C_CONFOPT_VALID(options));
 
 	if (options->directory != NULL) {
 		isc_mem_free(options->mem, options->directory);
@@ -3192,7 +3215,7 @@ dns_c_ctx_optionsprint(isc_log_t *lctx,
 		return;
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(options));
+	REQUIRE(DNS_C_CONFOPT_VALID(options));
 
 #define PRINT_INTEGER(field, bit, name, bitfield)			\
 	if (DNS_C_CHECKBIT(bit, &options->bitfield)) {			\
@@ -3420,11 +3443,17 @@ dns_c_ctx_optionsprint(isc_log_t *lctx,
 		fprintf(fp, ";\n");
 	}
 
-	dns_c_lstnlist_print(lctx, fp, indent + 1, options->listens);
-
+	if (options->listens != NULL) {
+		dns_c_lstnlist_print(lctx, fp, indent + 1,
+				     options->listens);
+	}
+	
 	dns_c_ctx_forwarderprint(lctx, fp, indent + 1, options);
 
-	dns_c_rrsolist_print(lctx, fp, indent + 1, options->ordering);
+	if (options->ordering != NULL) {
+		dns_c_rrsolist_print(lctx, fp, indent + 1, options->ordering);
+	}
+	
 
 	dns_c_printtabs(lctx, fp, indent);
 	fprintf(fp,"};\n");
@@ -3439,7 +3468,7 @@ dns_c_ctx_keydefinedp(isc_log_t *lctx,
 	isc_result_t res;
 	isc_boolean_t rval = ISC_FALSE;
 
-	REQUIRE(DNS_CONFCTX_VALID(ctx));
+	REQUIRE(DNS_C_CONFCTX_VALID(ctx));
 	REQUIRE(keyname != NULL);
 	REQUIRE(strlen(keyname) > 0);
 	
@@ -3468,7 +3497,7 @@ cfg_set_string(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFOPT_VALID(options));
+	REQUIRE(DNS_C_CONFOPT_VALID(options));
 	REQUIRE(field != NULL);
 
 	p = *field;
@@ -3515,7 +3544,7 @@ cfg_set_iplist(isc_log_t *lctx,
 	isc_result_t res;
 	isc_boolean_t existed = ISC_FALSE;
 	
-	REQUIRE(DNS_CONFOPT_VALID(options));
+	REQUIRE(DNS_C_CONFOPT_VALID(options));
 	REQUIRE(fieldaddr != NULL);
 
 	if (*fieldaddr != NULL) {
@@ -3570,7 +3599,7 @@ cfg_set_boolean(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFOPT_VALID(options));
+	REQUIRE(DNS_C_CONFOPT_VALID(options));
 	REQUIRE(setfield != NULL);
 	REQUIRE(fieldaddr != NULL);
 	REQUIRE(bitnumber < DNS_C_SETBITS_SIZE);
@@ -3596,7 +3625,7 @@ cfg_set_int32(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFOPT_VALID(options));
+	REQUIRE(DNS_C_CONFOPT_VALID(options));
 	REQUIRE(setfield != NULL);
 	REQUIRE(fieldaddr != NULL);
 	REQUIRE(bitnumber < DNS_C_SETBITS_SIZE);
@@ -3622,7 +3651,7 @@ cfg_set_uint32(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFOPT_VALID(options));
+	REQUIRE(DNS_C_CONFOPT_VALID(options));
 	REQUIRE(setfield != NULL);
 	REQUIRE(fieldaddr != NULL);
 	REQUIRE(bitnumber < DNS_C_SETBITS_SIZE);
@@ -3646,7 +3675,7 @@ cfg_get_iplist(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFOPT_VALID(options));
+	REQUIRE(DNS_C_CONFOPT_VALID(options));
 	REQUIRE(resval != NULL);
 
 	if (field != NULL && !ISC_LIST_EMPTY(field->elements)) {
@@ -3673,7 +3702,7 @@ cfg_get_boolean(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFOPT_VALID(options));
+	REQUIRE(DNS_C_CONFOPT_VALID(options));
 	REQUIRE(result != NULL);
 	REQUIRE(field != NULL);
 	REQUIRE(setfield != NULL);
@@ -3702,7 +3731,7 @@ cfg_get_int32(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFOPT_VALID(options));
+	REQUIRE(DNS_C_CONFOPT_VALID(options));
 	REQUIRE(result != NULL);
 	REQUIRE(field != NULL);
 	REQUIRE(setfield != NULL);
@@ -3731,7 +3760,7 @@ cfg_get_uint32(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(DNS_CONFOPT_VALID(options));
+	REQUIRE(DNS_C_CONFOPT_VALID(options));
 	REQUIRE(result != NULL);
 	REQUIRE(field != NULL);
 	REQUIRE(setfield != NULL);
@@ -3759,7 +3788,7 @@ acl_init(isc_log_t *lctx,
 	isc_result_t r;
 	static struct in_addr zeroaddr;
 
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	isc_sockaddr_fromin(&addr, &zeroaddr, 0);
 
@@ -3854,7 +3883,7 @@ logging_init (isc_log_t *lctx,
 	dns_c_logcat_t *cat;
 	dns_c_logchan_t *chan;
 	
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 	REQUIRE(cfg->logging == NULL);
 
 	res = dns_c_logginglist_new(lctx, cfg->mem, &cfg->logging);
@@ -3953,7 +3982,7 @@ static isc_result_t
 make_options(isc_log_t *lctx, dns_c_ctx_t *cfg)
 {
 	isc_result_t res = ISC_R_SUCCESS;
-	REQUIRE(DNS_CONFCTX_VALID(cfg));
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
 
 	if (cfg->options == NULL) {
 		res = dns_c_ctx_optionsnew(lctx, cfg->mem, &cfg->options);
@@ -3962,7 +3991,7 @@ make_options(isc_log_t *lctx, dns_c_ctx_t *cfg)
 		}
 	}
 	
-	REQUIRE(DNS_CONFOPT_VALID(cfg->options));
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
 
 	return (res);
 }
diff --git a/lib/dns/config/confip.c b/lib/dns/config/confip.c
index c10a711dcf..fe57631610 100644
--- a/lib/dns/config/confip.c
+++ b/lib/dns/config/confip.c
@@ -27,19 +27,6 @@
 #include <dns/confcommon.h>
 #include <dns/log.h>
 
-#define IPLIST_MAGIC 0x49706c73		/* Ipls */ /* dns_c_iplist */
-#define IPMDIRECT_MAGIC 0x49506d64	/* IPmd */ /* dns_c_ipmatch_direct */
-#define IPMINDIRECT_MAGIC 0x69506d69 	/* iPmi */ /* dns_c_ipmatch_indirect */
-#define IPMELEM_MAGIC 0x49704d65	/* IpMe */ /* dns_c_ipmatch_element */
-#define IPMLIST_MAGIC 0x69706d6c	/* ipml */ /* dns_c_ipmatchlist */
-
-#define DNS_IPLIST_VALID(ipl) ISC_MAGIC_VALID(ipl,IPLIST_MAGIC)
-#define DNS_IPDIRECT_VALID(ipmld) ISC_MAGIC_VALID(ipmld, IPMDIRECT_MAGIC)
-#define DNS_IPINDIRECT_VALID(ipmlid) ISC_MAGIC_VALID(ipmlid, IPMINDIRECT_MAGIC)
-#define DNS_IPMELEM_VALID(impe) ISC_MAGIC_VALID(impe, IPMELEM_MAGIC)
-#define DNS_IPMLIST_VALID(ipml) ISC_MAGIC_VALID(ipml, IPMLIST_MAGIC)
-
-
 /* Flag for dns_c_ipmatch_element */
 #define DNS_C_IPMATCH_NEGATE	0x01	/* match means deny access */
 
@@ -64,7 +51,7 @@ dns_c_ipmatchelement_new(isc_log_t *lctx,
 		return (ISC_R_NOMEMORY);
 	}
 
-	ime->magic = IPMELEM_MAGIC;
+	ime->magic = DNS_C_IPMELEM_MAGIC;
 	ime->type = dns_c_ipmatch_none;
 	ime->flags = 0;
 	memset(&ime->u, 0x0, sizeof ime->u);
@@ -84,7 +71,7 @@ dns_c_ipmatchelement_isneg(isc_log_t *lctx,
 
 	(void) lctx;
 
-	REQUIRE(DNS_IPMELEM_VALID(elem));
+	REQUIRE(DNS_C_IPMELEM_VALID(elem));
 	
 	return (ISC_TF((elem->flags & DNS_C_IPMATCH_NEGATE) ==
 			DNS_C_IPMATCH_NEGATE));
@@ -103,7 +90,7 @@ dns_c_ipmatchelement_delete(isc_log_t *lctx,
 	
 	elem = *ipme;
 
-	REQUIRE(DNS_IPMELEM_VALID(elem));
+	REQUIRE(DNS_C_IPMELEM_VALID(elem));
 	
 	switch (elem->type) {
 	case dns_c_ipmatch_localhost:
@@ -158,7 +145,7 @@ dns_c_ipmatchelement_copy(isc_log_t *lctx,
 
 	REQUIRE(mem != NULL);
 	REQUIRE(dest != NULL);
-	REQUIRE(DNS_IPMELEM_VALID(src));
+	REQUIRE(DNS_C_IPMELEM_VALID(src));
 		
 	result = dns_c_ipmatchelement_new(lctx, mem, &newel);
 	if (result != ISC_R_SUCCESS) {
@@ -212,8 +199,8 @@ isc_boolean_t
 dns_c_ipmatchelement_equal(dns_c_ipmatchelement_t *e1,
 			   dns_c_ipmatchelement_t *e2)
 {
-	REQUIRE(DNS_IPMELEM_VALID(e1));
-	REQUIRE(DNS_IPMELEM_VALID(e2));
+	REQUIRE(DNS_C_IPMELEM_VALID(e1));
+	REQUIRE(DNS_C_IPMELEM_VALID(e2));
 
 	if ((e1->type != e2->type) || (e1->flags != e2->flags))
 		return (ISC_FALSE);
@@ -307,7 +294,7 @@ dns_c_ipmatchindirect_new(isc_log_t *lctx,
 
 	REQUIRE(mem != NULL);
 	REQUIRE(result != NULL);
-	REQUIRE(DNS_IPMLIST_VALID(iml));
+	REQUIRE(DNS_C_IPMLIST_VALID(iml));
 
 	*result = NULL;
 
@@ -437,7 +424,7 @@ isc_result_t
 dns_c_ipmatch_negate(isc_log_t *lctx,
 		     dns_c_ipmatchelement_t *ipe)
 {
-	REQUIRE(DNS_IPMELEM_VALID(ipe));
+	REQUIRE(DNS_C_IPMELEM_VALID(ipe));
 	
 	(void) lctx;
 	
@@ -467,7 +454,7 @@ dns_c_ipmatchlist_new(isc_log_t *lctx,
 		return (ISC_R_NOMEMORY);
 	}
 
-	newlist->magic = IPMLIST_MAGIC;
+	newlist->magic = DNS_C_IPMLIST_MAGIC;
 	newlist->mem = mem;
 	newlist->refcount = 1;
 	
@@ -494,7 +481,7 @@ dns_c_ipmatchlist_detach(isc_log_t *lctx,
 	iml = *ml;
 	*ml = NULL;
 
-	REQUIRE(DNS_IPMLIST_VALID(iml));
+	REQUIRE(DNS_C_IPMLIST_VALID(iml));
 	INSIST(iml->refcount > 0);
 
 	iml->refcount--;
@@ -526,7 +513,7 @@ dns_c_ipmatchlist_attach(isc_log_t *lctx, dns_c_ipmatchlist_t *source,
 
 	(void) lctx;
 
-	REQUIRE(DNS_IPMLIST_VALID(source));
+	REQUIRE(DNS_C_IPMLIST_VALID(source));
 	
 	INSIST(source->refcount > 0);
 
@@ -543,7 +530,7 @@ dns_c_ipmatchlist_empty(isc_log_t *lctx,
 	dns_c_ipmatchelement_t *imptmp;
 	isc_result_t res = ISC_R_SUCCESS;
 
-	REQUIRE(DNS_IPMLIST_VALID(ipml));
+	REQUIRE(DNS_C_IPMLIST_VALID(ipml));
 	
 	ime = ISC_LIST_HEAD(ipml->elements);
 	while (ime != NULL) {
@@ -570,7 +557,7 @@ dns_c_ipmatchlist_copy(isc_log_t *lctx, isc_mem_t *mem,
 
 	REQUIRE(mem != NULL);
 	REQUIRE(dest != NULL);
-	REQUIRE(DNS_IPMLIST_VALID(src));
+	REQUIRE(DNS_C_IPMLIST_VALID(src));
 
 	*dest = NULL;
 
@@ -601,8 +588,8 @@ isc_boolean_t
 dns_c_ipmatchlist_equal(dns_c_ipmatchlist_t *l1, dns_c_ipmatchlist_t *l2) {
 	dns_c_ipmatchelement_t *e1, *e2;
 
-	REQUIRE(l1 == NULL || DNS_IPMLIST_VALID(l1));
-	REQUIRE(l2 == NULL || DNS_IPMLIST_VALID(l2));
+	REQUIRE(l1 == NULL || DNS_C_IPMLIST_VALID(l1));
+	REQUIRE(l2 == NULL || DNS_C_IPMLIST_VALID(l2));
 	
 	if (l1 == NULL && l2 == NULL)
 		return (ISC_TRUE);
@@ -634,8 +621,8 @@ dns_c_ipmatchlist_append(isc_log_t *lctx,
 	dns_c_ipmatchelement_t *ime_copy;
 	isc_result_t result = ISC_R_SUCCESS;
 
-	REQUIRE(DNS_IPMLIST_VALID(dest));
-	REQUIRE(DNS_IPMLIST_VALID(src));
+	REQUIRE(DNS_C_IPMLIST_VALID(dest));
+	REQUIRE(DNS_C_IPMLIST_VALID(src));
 
 	ime = ISC_LIST_HEAD(src->elements);
 	while (ime != NULL) {
@@ -667,7 +654,7 @@ dns_c_ipmatchelement_print(isc_log_t *lctx,
 	int bits;
 
 	REQUIRE(fp != NULL);
-	REQUIRE(DNS_IPMELEM_VALID(ipme));
+	REQUIRE(DNS_C_IPMELEM_VALID(ipme));
 
 	if ((ipme->flags & DNS_C_IPMATCH_NEGATE) == DNS_C_IPMATCH_NEGATE) {
 		fputc('!', fp);
@@ -728,7 +715,7 @@ dns_c_ipmatchlist_print(isc_log_t *lctx,
 {
 	dns_c_ipmatchelement_t *ipme ;
 
-	REQUIRE(DNS_IPMLIST_VALID(ml));
+	REQUIRE(DNS_C_IPMLIST_VALID(ml));
 	REQUIRE(fp != NULL);
 
 	/* no indent on first line. */
@@ -782,7 +769,7 @@ dns_c_iplist_new(isc_log_t *lctx,
 
 	memset(list->ips, 0x0, bytes);
 
-	list->magic = IPLIST_MAGIC;
+	list->magic = DNS_C_IPLIST_MAGIC;
 	list->size = length;
 	list->nextidx = 0;
 	list->mem = mem;
@@ -807,7 +794,7 @@ dns_c_iplist_detach(isc_log_t *lctx,
 	
 	l = *list;
 
-	REQUIRE(DNS_IPLIST_VALID(l));
+	REQUIRE(DNS_C_IPLIST_VALID(l));
 	INSIST(l->refcount > 0);
 
 	l->refcount--;
@@ -829,7 +816,7 @@ dns_c_iplist_attach(isc_log_t *lctx, dns_c_iplist_t *source,
 {
 	(void) lctx;
 
-	REQUIRE(DNS_IPLIST_VALID(source));
+	REQUIRE(DNS_C_IPLIST_VALID(source));
 	INSIST(source->refcount > 0);
 
 	source->refcount++;
@@ -847,7 +834,7 @@ dns_c_iplist_copy(isc_log_t *lctx,
 	isc_uint32_t i;
 
 	REQUIRE(dest != NULL);
-	REQUIRE(DNS_IPLIST_VALID(src));
+	REQUIRE(DNS_C_IPLIST_VALID(src));
 
 	res = dns_c_iplist_new(lctx, mem, src->size, &newl);
 	if (res != ISC_R_SUCCESS) {
@@ -868,8 +855,8 @@ isc_boolean_t
 dns_c_iplist_equal(dns_c_iplist_t *list1, dns_c_iplist_t *list2) {
 	isc_uint32_t i;
 
-	REQUIRE(DNS_IPLIST_VALID(list1));
-	REQUIRE(DNS_IPLIST_VALID(list2));
+	REQUIRE(DNS_C_IPLIST_VALID(list1));
+	REQUIRE(DNS_C_IPLIST_VALID(list2));
 
 	if (list1->nextidx != list2->nextidx)
 		return (ISC_FALSE);
@@ -889,7 +876,7 @@ dns_c_iplist_print(isc_log_t *lctx,
 {
 	isc_uint32_t i;
 
-	REQUIRE(DNS_IPLIST_VALID(list));
+	REQUIRE(DNS_C_IPLIST_VALID(list));
 		
 	fprintf(fp, "{\n");
 
@@ -917,7 +904,7 @@ dns_c_iplist_append(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(DNS_IPLIST_VALID(list));
+	REQUIRE(DNS_C_IPLIST_VALID(list));
 
 	for (i = 0 ; i < list->nextidx ; i++) {
 		if (memcmp(&list->ips[i], &newaddr, sizeof newaddr) == 0) {
@@ -964,7 +951,7 @@ dns_c_iplist_remove(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(DNS_IPLIST_VALID(list));
+	REQUIRE(DNS_C_IPLIST_VALID(list));
 	
 	for (i = 0 ; i < list->nextidx ; i++) {
 		if (memcmp(&list->ips[0], &newaddr, sizeof newaddr) == 0) {
diff --git a/lib/dns/config/confkeys.c b/lib/dns/config/confkeys.c
index 51e392d6c4..2fd1e23d61 100644
--- a/lib/dns/config/confkeys.c
+++ b/lib/dns/config/confkeys.c
@@ -20,16 +20,15 @@
 #include <string.h>
 
 #include <isc/assertions.h>
+#include <isc/magic.h>
 
 #include <dns/result.h>
-
 #include <dns/confkeys.h>
 #include <dns/confcommon.h>
 
 static isc_result_t keyid_delete(isc_log_t *lctx, dns_c_kid_t **ki);
 
 
-
 isc_result_t
 dns_c_kdeflist_new(isc_log_t *lctx,
 		   isc_mem_t *mem, dns_c_kdeflist_t **list)
@@ -47,6 +46,8 @@ dns_c_kdeflist_new(isc_log_t *lctx,
 	}
 
 	newlist->mem = mem;
+	newlist->magic = DNS_C_KDEFLIST_MAGIC;
+	
 	ISC_LIST_INIT(newlist->keydefs);
 
 	*list = newlist;
@@ -65,7 +66,7 @@ dns_c_kdeflist_delete(isc_log_t *lctx,
 	isc_result_t res;
 	
 	REQUIRE(list != NULL);
-	REQUIRE(*list != NULL);
+	REQUIRE(DNS_C_KDEFLIST_VALID(*list));
 
 	l = *list;
 
@@ -79,7 +80,8 @@ dns_c_kdeflist_delete(isc_log_t *lctx,
 		}
 		kd = tmpkd;
 	}
-	
+
+	l->magic = 0;
 	isc_mem_put(l->mem, l, sizeof *l);
 
 	*list = NULL;
@@ -98,7 +100,7 @@ dns_c_kdeflist_copy(isc_log_t *lctx,
 	isc_result_t res;
 
 	REQUIRE(dest != NULL);
-	REQUIRE(src != NULL);
+	REQUIRE(DNS_C_KDEFLIST_VALID(src));
 	
 	res = dns_c_kdeflist_new(lctx, mem, &newlist);
 	if (res != ISC_R_SUCCESS) {
@@ -129,8 +131,8 @@ dns_c_kdeflist_append(isc_log_t *lctx, dns_c_kdeflist_t *list,
 	dns_c_kdef_t *newe;
 	isc_result_t res;
 	
-	REQUIRE(list != NULL);
-	REQUIRE(key != NULL);
+	REQUIRE(DNS_C_KDEFLIST_VALID(list));
+	REQUIRE(DNS_C_KDEF_VALID(key));
 
 	if (copy) {
 		res = dns_c_kdef_copy(lctx, list->mem, &newe, key);
@@ -155,8 +157,9 @@ dns_c_kdeflist_undef(isc_log_t *lctx,
 	dns_c_kdef_t *kd;
 	isc_result_t r;
 
-	REQUIRE(list != NULL);
+	REQUIRE(DNS_C_KDEFLIST_VALID(list));
 	REQUIRE(keyid != NULL);
+	REQUIRE(strlen(keyid) > 0);
 
 	kd = ISC_LIST_HEAD(list->keydefs);
 	while (kd != NULL) {
@@ -188,8 +191,9 @@ dns_c_kdeflist_find(isc_log_t *lctx,
 
 	(void)lctx;
 
-	REQUIRE(list != NULL);
+	REQUIRE(DNS_C_KDEFLIST_VALID(list));
 	REQUIRE(keyid != NULL);
+	REQUIRE(strlen(keyid) > 0);
 
 	kd = ISC_LIST_HEAD(list->keydefs);
 	while (kd != NULL) {
@@ -219,6 +223,7 @@ dns_c_kdeflist_print(isc_log_t *lctx,
 
 	REQUIRE(fp != NULL);
 	REQUIRE(indent >= 0);
+	REQUIRE(DNS_C_KDEFLIST_VALID(list));
 
 	if (list == NULL) {
 		return;
@@ -242,7 +247,10 @@ dns_c_kdef_new(isc_log_t *lctx,
 
 	(void)lctx;
 
-	REQUIRE(list != NULL);
+	REQUIRE(DNS_C_KDEFLIST_VALID(list));
+	REQUIRE(keyid != NULL);
+	REQUIRE(name != NULL);
+	REQUIRE(strlen(name) > 0);
 	
 	kd = isc_mem_get(list->mem, sizeof *kd);
 	if (kd == NULL) {
@@ -253,7 +261,8 @@ dns_c_kdef_new(isc_log_t *lctx,
 	if (kd->keyid == NULL) {
 		isc_mem_put(list->mem, kd, sizeof *kd);
 	}
-	
+
+	kd->magic = DNS_C_KDEF_MAGIC;
 	kd->mylist = list;
 	kd->algorithm = NULL;
 	kd->secret = NULL;
@@ -275,7 +284,7 @@ dns_c_kdef_delete(isc_log_t *lctx, dns_c_kdef_t **keydef)
 	(void)lctx;
 
 	REQUIRE(keydef != NULL);
-	REQUIRE(*keydef != NULL);
+	REQUIRE(DNS_C_KDEF_VALID(*keydef));
 
 	kd = *keydef;
 
@@ -291,6 +300,7 @@ dns_c_kdef_delete(isc_log_t *lctx, dns_c_kdef_t **keydef)
 		isc_mem_free(mem, kd->secret);
 	}
 
+	kd->magic = 0;
 	kd->keyid = NULL;
 	kd->mylist = NULL;
 	kd->algorithm = NULL;
@@ -312,12 +322,13 @@ dns_c_kdef_copy(isc_log_t *lctx, isc_mem_t *mem,
 	dns_c_kdef_t *newk;
 
 	REQUIRE(dest != NULL);
-	REQUIRE(src != NULL);
+	REQUIRE(DNS_C_KDEF_VALID(src));
 	
 	newk = isc_mem_get(mem, sizeof *newk);
 	if (newk == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
+	newk->magic = DNS_C_KDEF_MAGIC;
 	newk->secret = newk->algorithm = newk->keyid = NULL;
 	
 	newk->keyid = isc_mem_strdup(mem, src->keyid);
@@ -352,7 +363,7 @@ dns_c_kdef_print(isc_log_t *lctx,
 	const char *quote = "";
 	
 	REQUIRE(fp != NULL);
-	REQUIRE(keydef != NULL);
+	REQUIRE(DNS_C_KDEF_VALID(keydef));
 
 	if (dns_c_need_quote(lctx, keydef->keyid)) {
 		quote = "\"";
@@ -378,7 +389,9 @@ dns_c_kdef_setalgorithm(isc_log_t *lctx,
 {
 	(void)lctx;
 	
-	REQUIRE(keydef != NULL);
+	REQUIRE(DNS_C_KDEF_VALID(keydef));
+	REQUIRE(algorithm != NULL);
+	REQUIRE(strlen(algorithm) > 0);
 
 	if (keydef->algorithm != NULL) {
 		isc_mem_free(keydef->mylist->mem, keydef->algorithm);
@@ -400,8 +413,10 @@ dns_c_kdef_setsecret(isc_log_t *lctx,
 {
 	(void)lctx;
 	
-	REQUIRE(keydef != NULL);
-
+	REQUIRE(DNS_C_KDEF_VALID(keydef));
+	REQUIRE(secret != NULL);
+	REQUIRE(strlen(secret) > 0);
+	
 	if (keydef->secret != NULL) {
 		isc_mem_free(keydef->mylist->mem, keydef->secret);
 	}
@@ -429,6 +444,7 @@ dns_c_kidlist_new(isc_log_t *lctx,
 		return (ISC_R_NOMEMORY);
 	}
 
+	l->magic = DNS_C_KEYIDLIST_MAGIC;
 	l->mem = mem;
 	*list = l;
 	
@@ -447,7 +463,7 @@ dns_c_kidlist_delete(isc_log_t *lctx,
 	isc_result_t r;
 
 	REQUIRE(list != NULL);
-	REQUIRE(*list != NULL);
+	REQUIRE(DNS_C_KEYIDLIST_VALID(*list));
 	
 	l = *list;
 
@@ -462,6 +478,7 @@ dns_c_kidlist_delete(isc_log_t *lctx,
 		ki = tmpki;
 	}
 
+	l->magic = 0;
 	isc_mem_put(l->mem, l, sizeof *l);
 
 	*list = NULL;
@@ -479,11 +496,13 @@ keyid_delete(isc_log_t *lctx,
 	(void)lctx;
 
 	REQUIRE(keyid != NULL);
-	REQUIRE(*keyid != NULL);
+	REQUIRE(DNS_C_KEYID_VALID(*keyid));
 	
 	ki = *keyid;
 
 	isc_mem_free(ki->mylist->mem, ki->keyid);
+
+	ki->magic = 0;
 	isc_mem_put(ki->mylist->mem, ki, sizeof *ki);
 
 	*keyid = NULL;
@@ -499,6 +518,10 @@ dns_c_kidlist_undef(isc_log_t *lctx,
 	dns_c_kid_t *ki;
 	isc_result_t r;
 
+	REQUIRE(DNS_C_KEYIDLIST_VALID(list));
+	REQUIRE(keyid != NULL);
+	REQUIRE(strlen(keyid) > 0);
+	
 	dns_c_kidlist_find(lctx, list, keyid, &ki);
 	
 	if (ki != NULL) {
@@ -521,6 +544,9 @@ dns_c_kidlist_find(isc_log_t *lctx,
 
 	(void)lctx;
 
+	REQUIRE(DNS_C_KEYIDLIST_VALID(list));
+	REQUIRE(keyid != NULL);
+	REQUIRE(strlen(keyid) > 0);
 	REQUIRE(retval != NULL);
 	
 	iter = ISC_LIST_HEAD(list->keyids);
@@ -546,7 +572,7 @@ dns_c_kidlist_print(isc_log_t *lctx, FILE *fp, int indent,
 	const char *quote;
 
 	REQUIRE(fp != NULL);
-	REQUIRE(list != NULL);
+	REQUIRE(DNS_C_KEYIDLIST_VALID(list));
 
 	if (ISC_LIST_EMPTY(list->keyids)) {
 		return;
@@ -584,13 +610,17 @@ dns_c_kid_new(isc_log_t *lctx,
 
 	(void)lctx;
 
-	REQUIRE(list != NULL);
+	REQUIRE(DNS_C_KEYIDLIST_VALID(list));
+	REQUIRE(name != NULL);
+	REQUIRE(strlen(name) > 0);
+	REQUIRE(keyid != NULL);
 	
 	ki = isc_mem_get(list->mem, sizeof *ki);
 	if (ki == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
 
+	ki->magic = DNS_C_KEYID_MAGIC;
 	ki->mylist = list;
 	ki->keyid = isc_mem_strdup(list->mem, name);
 
@@ -602,6 +632,170 @@ dns_c_kid_new(isc_log_t *lctx,
 	return (ISC_R_SUCCESS);
 }
 
+isc_result_t
+dns_c_pklist_new(isc_log_t *lctx, isc_mem_t *mem, dns_c_pklist_t **pklist)
+{
+	dns_c_pklist_t *newl;
+
+	(void) lctx;
+
+	REQUIRE(pklist != NULL);
+
+	newl = isc_mem_get(mem, sizeof *newl);
+	if (newl == NULL) {
+		return (ISC_R_NOMEMORY);
+	}
+
+	newl->mem = mem;
+	newl->magic = DNS_C_PKLIST_MAGIC;
+
+	ISC_LIST_INIT(newl->keylist);
+
+	*pklist = newl;
+	
+	return (ISC_R_SUCCESS);
+}
+
+	
+isc_result_t
+dns_c_pklist_delete(isc_log_t *lctx, dns_c_pklist_t **list)
+{
+	dns_c_pklist_t *l;
+	dns_c_pubkey_t *pk;
+	dns_c_pubkey_t *tmppk;
+	isc_result_t r;
+
+	REQUIRE(list != NULL);
+	REQUIRE(DNS_C_PKLIST_VALID(*list));
+
+	l = *list;
+
+	pk = ISC_LIST_HEAD(l->keylist);
+	while (pk != NULL) {
+		tmppk = ISC_LIST_NEXT(pk, next);
+		ISC_LIST_UNLINK(l->keylist, pk, next);
+		r = dns_c_pubkey_delete(lctx, &pk);
+		if (r != ISC_R_SUCCESS) {
+			return (r);
+		}
+
+		pk = tmppk;
+	}
+
+	l->magic = 0;
+	isc_mem_put(l->mem, l, sizeof *l);
+
+	return (ISC_R_SUCCESS);
+}
+
+
+
+void
+dns_c_pklist_print(isc_log_t *lctx,
+		   FILE *fp, int indent, dns_c_pklist_t *list)
+{
+	dns_c_pubkey_t *pk;
+
+	REQUIRE(fp != NULL);
+	REQUIRE(indent >= 0);
+
+	if (list == NULL) {
+		return;
+	}
+
+	REQUIRE(DNS_C_PKLIST_VALID(list));
+	
+	pk = ISC_LIST_HEAD(list->keylist);
+	while (pk != NULL) {
+		dns_c_pubkey_print(lctx, fp, indent, pk);
+		pk = ISC_LIST_NEXT(pk, next);
+	}
+	fprintf(fp, "\n");
+}
+
+
+
+isc_result_t
+dns_c_pklist_addpubkey(isc_log_t *lctx, dns_c_pklist_t *list,
+		       dns_c_pubkey_t *pkey,
+		       isc_boolean_t deepcopy)
+{
+	dns_c_pubkey_t *pk;
+	isc_result_t r;
+
+	REQUIRE(DNS_C_PKLIST_VALID(list));
+	REQUIRE(DNS_C_PUBKEY_VALID(pkey));
+
+	if (deepcopy) {
+		r = dns_c_pubkey_copy(lctx, list->mem, &pk, pkey);
+		if (r != ISC_R_SUCCESS) {
+			return (r);
+		}
+	} else {
+		pk = pkey;
+	}
+
+	ISC_LIST_APPEND(list->keylist, pk, next);
+
+	return (ISC_R_SUCCESS);
+}
+
+
+isc_result_t
+dns_c_pklist_findpubkey(isc_log_t *lctx, dns_c_pklist_t *list,
+			dns_c_pubkey_t **pubkey, isc_int32_t flags,
+			isc_int32_t protocol, isc_int32_t algorithm,
+			const char *key)
+{
+	dns_c_pubkey_t *pk;
+
+	(void) lctx;
+	
+	REQUIRE(DNS_C_PKLIST_VALID(list));
+	REQUIRE(pubkey != NULL);
+
+	*pubkey = NULL;
+	pk = ISC_LIST_HEAD(list->keylist);
+	while (pk != NULL) {
+		if (pk->flags == flags &&
+		    pk->protocol == protocol &&
+		    pk->algorithm == algorithm &&
+		    strcmp(pk->key, key) == 0) {
+			*pubkey = pk;
+			pk = NULL;
+		} else {
+			pk = ISC_LIST_NEXT(pk, next);
+		}
+	}
+
+	return (*pubkey == NULL ? ISC_R_NOTFOUND : ISC_R_SUCCESS);
+}
+
+
+
+isc_result_t
+dns_c_pklist_rmpubkey(isc_log_t *lctx, dns_c_pklist_t *list,
+		      isc_int32_t flags,
+		      isc_int32_t protocol, isc_int32_t algorithm,
+		      const char *key)
+{
+	dns_c_pubkey_t *pk;
+	isc_result_t r;
+
+	REQUIRE(DNS_C_PKLIST_VALID(list));
+	REQUIRE(key != NULL);
+	REQUIRE(strlen(key) > 0);
+
+	r = dns_c_pklist_findpubkey(lctx, list, &pk, flags, protocol,
+				    algorithm, key);
+	if (r == ISC_R_SUCCESS) {
+		ISC_LIST_UNLINK(list->keylist, pk, next);
+		r = dns_c_pubkey_delete(lctx, &pk);
+	}
+
+	return (r);
+}
+
 
 
 isc_result_t
@@ -615,11 +809,16 @@ dns_c_pubkey_new(isc_log_t *lctx,
 
 	(void)lctx;
 
+	REQUIRE(pubkey != NULL);
+	REQUIRE(key != NULL);
+	REQUIRE(strlen(key) > 0);
+
 	pkey = isc_mem_get(mem, sizeof *pkey);
 	if (pkey == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
 
+	pkey->magic = DNS_C_PUBKEY_MAGIC;
 	pkey->mem = mem;
 	pkey->flags = flags;
 	pkey->protocol = protocol;
@@ -645,7 +844,7 @@ dns_c_pubkey_delete(isc_log_t *lctx,
 	(void)lctx;
 
 	REQUIRE(pubkey != NULL);
-	REQUIRE(*pubkey != NULL);
+	REQUIRE(DNS_C_PUBKEY_VALID(*pubkey));
 
 	pkey = *pubkey;
 
@@ -666,6 +865,9 @@ dns_c_pubkey_copy(isc_log_t *lctx,
 	dns_c_pubkey_t *k;
 	isc_result_t res;
 
+	REQUIRE(DNS_C_PUBKEY_VALID(src));
+	REQUIRE(dest != NULL);
+	
 	res = dns_c_pubkey_new(lctx, mem, src->flags, src->protocol,
 			       src->algorithm, src->key, &k);
 	if (res != ISC_R_SUCCESS) {
@@ -680,10 +882,9 @@ dns_c_pubkey_copy(isc_log_t *lctx,
 isc_boolean_t
 dns_c_pubkey_equal(dns_c_pubkey_t *k1, dns_c_pubkey_t *k2) {
 
-	if (k1 == NULL && k2 == NULL)
-		return (ISC_TRUE);
-	if (k1 == NULL || k2 == NULL)
-		return (ISC_FALSE);
+	REQUIRE(DNS_C_PUBKEY_VALID(k1));
+	REQUIRE(DNS_C_PUBKEY_VALID(k2));
+
 	return (ISC_TF(k1->flags == k2->flags &&
 		k1->protocol == k2->protocol &&
 		k1->algorithm == k2->algorithm &&
@@ -695,12 +896,8 @@ dns_c_pubkey_print(isc_log_t *lctx,
 		   FILE *fp, int indent, dns_c_pubkey_t *pubkey)
 {
 	REQUIRE(fp != NULL);
-	REQUIRE(pubkey != NULL);
+	REQUIRE(DNS_C_PUBKEY_VALID(pubkey));
 
-	if (pubkey == NULL) {
-		return;
-	}
-	
 	dns_c_printtabs(lctx, fp, indent);
 	fprintf(fp, "pubkey %d %d %d \"%s\";\n",
 		pubkey->flags, pubkey->protocol,
@@ -723,6 +920,7 @@ dns_c_tkeylist_new(isc_log_t *lctx,
 		return (ISC_R_NOMEMORY);
 	}
 
+	nl->magic = DNS_C_TKEYLIST_MAGIC;
 	nl->mem = mem;
 	ISC_LIST_INIT(nl->tkeylist);
 
@@ -741,7 +939,7 @@ dns_c_tkeylist_delete(isc_log_t *lctx,
 	isc_result_t res;
 
 	REQUIRE(list != NULL);
-	REQUIRE(*list != NULL);
+	REQUIRE(DNS_C_TKEYLIST_VALID(*list));
 
 	l = *list;
 		
@@ -758,6 +956,7 @@ dns_c_tkeylist_delete(isc_log_t *lctx,
 		tkey = tmptkey;
 	}
 
+	l->magic = 0;
 	isc_mem_put(l->mem, l, sizeof *l);
 
 	*list = NULL;
@@ -776,7 +975,7 @@ dns_c_tkeylist_copy(isc_log_t *lctx,
 	isc_result_t res;
 
 	REQUIRE(dest != NULL);
-	REQUIRE(src != NULL);
+	REQUIRE(DNS_C_TKEYLIST_VALID(src));
 	
 	res = dns_c_tkeylist_new(lctx, mem, &newlist);
 	if (res != ISC_R_SUCCESS) {
@@ -814,8 +1013,9 @@ dns_c_tkeylist_print(isc_log_t *lctx,
 	dns_c_tkey_t *tkey;
 	
 	REQUIRE(fp != NULL);
+	REQUIRE(DNS_C_TKEYLIST_VALID(list));
 	
-	if (list == NULL || ISC_LIST_EMPTY(list->tkeylist)) {
+	if (ISC_LIST_EMPTY(list->tkeylist)) {
 		return;
 	}
 
@@ -839,8 +1039,8 @@ dns_c_tkeylist_append(isc_log_t *lctx,
 	dns_c_tkey_t *newe;
 	isc_result_t res;
 	
-	REQUIRE(list != NULL);
-	REQUIRE(element != NULL);
+	REQUIRE(DNS_C_TKEYLIST_VALID(list));
+	REQUIRE(DNS_C_TKEY_VALID(element));
 
 	if (copy) {
 		res = dns_c_tkey_copy(lctx, list->mem, &newe, element);
@@ -872,6 +1072,7 @@ dns_c_tkey_new(isc_log_t *lctx,
 	REQUIRE(strlen(domain) > 0);
 	REQUIRE(key != NULL);
 	REQUIRE(strlen(key) > 0);
+	REQUIRE(newkey != NULL);
 
 	newk = isc_mem_get(mem, sizeof *newk);
 	if (newk == NULL) {
@@ -886,6 +1087,7 @@ dns_c_tkey_new(isc_log_t *lctx,
 	}
 
 	newk->mem = mem;
+	newk->magic = DNS_C_TKEY_MAGIC;
 
 	newk->domain = isc_mem_strdup(mem, domain);
 	if (newk->domain == NULL) {
@@ -912,7 +1114,7 @@ dns_c_tkey_delete(isc_log_t *lctx,
 	dns_c_tkey_t *tk;
 
 	REQUIRE(tkey != NULL);
-	REQUIRE(*tkey != NULL);
+	REQUIRE(DNS_C_TKEY_VALID(*tkey));
 
 	tk = *tkey;
 
@@ -923,6 +1125,7 @@ dns_c_tkey_delete(isc_log_t *lctx,
 		return (res);
 	}
 
+	tk->magic = 0;
 	isc_mem_put(tk->mem, tk, sizeof *tk);
 	
 	*tkey = NULL;
@@ -940,13 +1143,14 @@ dns_c_tkey_copy(isc_log_t *lctx,
 	isc_result_t res;
 
 	REQUIRE(dest != NULL);
-	REQUIRE(src != NULL);
+	REQUIRE(DNS_C_TKEY_VALID(src));
 
 	newk = isc_mem_get(mem, sizeof *newk);
 	if (newk == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
 
+	newk->magic = DNS_C_TKEY_MAGIC;
 	newk->domain = isc_mem_strdup(mem, src->domain);
 	if (newk->domain == NULL) {
 		isc_mem_put(mem, newk, sizeof *newk);
@@ -974,7 +1178,7 @@ dns_c_tkey_getflags(isc_log_t *lctx,
 {
 	(void)lctx;
 	
-	REQUIRE(tkey != NULL);
+	REQUIRE(DNS_C_TKEY_VALID(tkey));
 
 	*flags = tkey->pubkey->flags;
 
@@ -988,7 +1192,7 @@ dns_c_tkey_getprotocol(isc_log_t *lctx,
 {
 	(void)lctx;
 	
-	REQUIRE(tkey != NULL);
+	REQUIRE(DNS_C_TKEY_VALID(tkey));
 
 	*protocol = tkey->pubkey->protocol;
 
@@ -1002,7 +1206,7 @@ dns_c_tkey_getalgorithm(isc_log_t *lctx,
 {
 	(void)lctx;
 	
-	REQUIRE(tkey != NULL);
+	REQUIRE(DNS_C_TKEY_VALID(tkey));
 
 	*algorithm = tkey->pubkey->algorithm;
 
@@ -1017,7 +1221,7 @@ dns_c_tkey_getkey(isc_log_t *lctx,
 	(void)lctx;
 	
 	REQUIRE(key != NULL);
-	REQUIRE(tkey != NULL);
+	REQUIRE(DNS_C_TKEY_VALID(tkey));
 	
 	*key = tkey->pubkey->key;
 
@@ -1030,7 +1234,7 @@ dns_c_tkey_print(isc_log_t *lctx,
 		 FILE *fp, int indent, dns_c_tkey_t *tkey)
 {
 	REQUIRE(fp != NULL);
-	REQUIRE(tkey != NULL);
+	REQUIRE(DNS_C_TKEY_VALID(tkey));
 
 	dns_c_printtabs(lctx, fp, indent);
 	fprintf(fp, "\"%s\" %d %d %d \"%s\";\n",
diff --git a/lib/dns/config/conflog.c b/lib/dns/config/conflog.c
index cb7a93933d..f5b96f1aaf 100644
--- a/lib/dns/config/conflog.c
+++ b/lib/dns/config/conflog.c
@@ -20,6 +20,7 @@
 #include <string.h>
 
 #include <isc/assertions.h>
+#include <isc/magic.h>
 
 #include <dns/conflog.h>
 #include <dns/confcommon.h>
@@ -31,8 +32,6 @@
 
 #define UNLIM_VERSIONS (-1)		/* XXX check this is right? */
 
-
-
 /*
  * Bit positions in the dns_c_logchan_t structure setflags field.
  */
@@ -47,11 +46,13 @@
 
 
 
-static void print_log_facility(isc_log_t *lctx, FILE *fp, int value);
-static void print_log_severity(isc_log_t *lctx, FILE *fp,
-			       dns_c_logseverity_t severity);
-static void print_log_category(isc_log_t *lctx, FILE *fp,
-			       dns_c_category_t category);
+static void		print_log_facility(isc_log_t *lctx, FILE *fp,
+					   int value);
+static void		print_log_severity(isc_log_t *lctx, FILE *fp,
+					   dns_c_logseverity_t severity);
+static void		print_log_category(isc_log_t *lctx, FILE *fp,
+					   dns_c_category_t category);
+static isc_boolean_t	logginglist_empty(dns_c_logginglist_t *ll);
 
 
 
@@ -71,6 +72,7 @@ dns_c_logginglist_new(isc_log_t *lctx,
 		return (ISC_R_NOMEMORY);
 	}
 
+	newl->magic = DNS_C_LOGLIST_MAGIC;
 	newl->mem = mem;
 	ISC_LIST_INIT(newl->channels);
 	ISC_LIST_INIT(newl->categories);
@@ -91,7 +93,7 @@ dns_c_logginglist_delete(isc_log_t *lctx,
 	isc_result_t res;
 
 	REQUIRE(list != NULL);
-	REQUIRE(*list != NULL);
+	REQUIRE(DNS_C_LOGLIST_VALID(*list));
 	
 	l = *list;
 
@@ -119,6 +121,7 @@ dns_c_logginglist_delete(isc_log_t *lctx,
 		cat = tmpcat;
 	}
 
+	l->magic = 0;
 	isc_mem_put(l->mem, l, sizeof *l);
 
 	*list = NULL;
@@ -139,7 +142,7 @@ dns_c_logginglist_copy(isc_log_t *lctx,
 	isc_result_t res;
 
 	REQUIRE(dest != NULL);
-	REQUIRE(src != NULL);
+	REQUIRE(DNS_C_LOGLIST_VALID(src));
 
 	res = dns_c_logginglist_new(lctx, mem, &newl);
 	if (res != ISC_R_SUCCESS) {
@@ -175,6 +178,35 @@ dns_c_logginglist_copy(isc_log_t *lctx,
 }
 
 
+static isc_boolean_t
+logginglist_empty(dns_c_logginglist_t *ll)
+{
+	dns_c_logchan_t *logchan;
+	dns_c_logcat_t *logcat;
+
+	REQUIRE(DNS_C_LOGLIST_VALID(ll));
+
+	logchan = ISC_LIST_HEAD(ll->channels);
+	while (logchan != NULL) {
+		if (!logchan->predefined) {
+			return ISC_TRUE;
+		}
+		
+		logchan = ISC_LIST_NEXT(logchan, next);
+	}
+	
+	logcat = ISC_LIST_HEAD(ll->categories);
+	while (logcat != NULL) {
+		if (!logcat->predefined) {
+			return ISC_FALSE;
+		}
+		logcat = ISC_LIST_NEXT(logcat, next);
+	}
+
+	return ISC_TRUE;
+}
+
+	
 void
 dns_c_logginglist_print(isc_log_t *lctx,
 			FILE *fp, int indent, dns_c_logginglist_t *ll,
@@ -184,8 +216,9 @@ dns_c_logginglist_print(isc_log_t *lctx,
 	dns_c_logcat_t *logcat;
 
 	REQUIRE(fp != NULL);
+	REQUIRE(DNS_C_LOGLIST_VALID(ll));
 
-	if (ll == NULL) {
+	if (logginglist_empty(ll)) {
 		return;
 	}
 
@@ -222,8 +255,8 @@ dns_c_logginglist_addchannel(isc_log_t *lctx,
 	isc_boolean_t existed = ISC_FALSE;
 	isc_boolean_t predefined = ISC_FALSE;
 
-	REQUIRE(list != NULL);
-	REQUIRE(newchan != NULL);
+	REQUIRE(DNS_C_LOGLIST_VALID(list));
+	REQUIRE(DNS_C_LOGCHAN_VALID(newchan));
 
 	if (deepcopy) {
 		res = dns_c_logchan_copy(lctx, list->mem, &newc, newchan);
@@ -272,8 +305,9 @@ dns_c_logginglist_addcategory(isc_log_t *lctx,
 	isc_boolean_t existed = ISC_FALSE;
 	isc_boolean_t predefined = ISC_FALSE;
 
-	REQUIRE(list != NULL);
-	REQUIRE(newcat != NULL);
+	REQUIRE(DNS_C_LOGLIST_VALID(list));
+	REQUIRE(DNS_C_LOGCAT_VALID(newcat));
+	
 
 	if (deepcopy) {
 		res = dns_c_logcat_copy(lctx, list->mem, &newc, newcat);
@@ -320,6 +354,10 @@ dns_c_logginglist_delchannel(isc_log_t *lctx,
 	dns_c_logchan_t *logc;
 	isc_result_t res;
 
+	REQUIRE(DNS_C_LOGLIST_VALID(list));
+	REQUIRE(name != NULL);
+	REQUIRE(strlen(name) > 0);
+
 	res = dns_c_logginglist_chanbyname(lctx, list, name, &logc);
 	if (res == ISC_R_SUCCESS) {
 		ISC_LIST_UNLINK(list->channels, logc, next);
@@ -339,6 +377,10 @@ dns_c_logginglist_delcategory(isc_log_t *lctx,
 	dns_c_logcat_t *logc;
 	isc_result_t res;
 
+	REQUIRE(DNS_C_LOGLIST_VALID(list));
+	REQUIRE(name != NULL);
+	REQUIRE(strlen(name) > 0);
+
 	res = dns_c_logginglist_catbyname(lctx, list, name, &logc);
 	if (res == ISC_R_SUCCESS) {
 		ISC_LIST_UNLINK(list->categories, logc, next);
@@ -360,8 +402,9 @@ dns_c_logginglist_chanbyname(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(list != NULL);
+	REQUIRE(DNS_C_LOGLIST_VALID(list));
 	REQUIRE(name != NULL);
+	REQUIRE(strlen(name) > 0);
 	REQUIRE(chan != NULL);
 
 	logc = ISC_LIST_HEAD(list->channels);
@@ -391,8 +434,9 @@ dns_c_logginglist_catbyname(isc_log_t *lctx,
 	dns_c_category_t cattype;
 	isc_result_t res;
 
-	REQUIRE(list != NULL);
+	REQUIRE(DNS_C_LOGLIST_VALID(list));
 	REQUIRE(name != NULL);
+	REQUIRE(strlen(name) > 0);
 	REQUIRE(cat != NULL);
 
 	res = dns_c_string2category(lctx, name, &cattype);
@@ -414,6 +458,9 @@ dns_c_logginglist_catbytype(isc_log_t *lctx,
 
 	(void) lctx;
 	
+	REQUIRE(DNS_C_LOGLIST_VALID(list));
+	REQUIRE(cat != NULL);
+
 	logc = ISC_LIST_HEAD(list->categories);
 	while (logc != NULL) {
 		if (logc->category == cattype) {
@@ -447,12 +494,15 @@ dns_c_logchan_new(isc_log_t *lctx,
 	(void) lctx;
 	
 	REQUIRE(name != NULL);
+	REQUIRE(strlen(name) > 0);
+	REQUIRE(newchan != NULL);
 
 	newc = isc_mem_get(mem, sizeof *newc);
 	if (newc == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
 
+	newc->magic = DNS_C_LOGCHAN_MAGIC;
 	newc->mem = mem;
 	newc->ctype = ctype;
 	newc->severity = dns_c_log_info;
@@ -497,7 +547,7 @@ dns_c_logchan_delete(isc_log_t *lctx,
 	(void) lctx;
 	
 	REQUIRE(channel != NULL);
-	REQUIRE(*channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(*channel));
 
 	logc = *channel;
 
@@ -517,6 +567,7 @@ dns_c_logchan_delete(isc_log_t *lctx,
 
 	*channel = NULL;
 
+	logc->magic = 0;
 	isc_mem_put(logc->mem, logc, sizeof *logc);
 
 	return (ISC_R_SUCCESS);
@@ -532,7 +583,7 @@ dns_c_logchan_copy(isc_log_t *lctx,
 	isc_result_t res;
 
 	REQUIRE(dest != NULL);
-	REQUIRE(src != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(src));
 
 	res = dns_c_logchan_new(lctx, mem, src->name, src->ctype, &logc);
 	if (res != ISC_R_SUCCESS) {
@@ -573,7 +624,7 @@ dns_c_logchan_print(isc_log_t *lctx,
 		    isc_boolean_t if_predef_too)
 {
 	REQUIRE(fp != NULL);
-	REQUIRE(logchan != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(logchan));
 
 	if (logchan->predefined && !if_predef_too) {
 		return;
@@ -655,7 +706,7 @@ dns_c_logchan_setpath(isc_log_t *lctx,
 {
 	isc_boolean_t existed = ISC_FALSE;
 
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 	REQUIRE(path != NULL);
 	REQUIRE(strlen(path) > 0);
 
@@ -687,7 +738,7 @@ dns_c_logchan_setversions(isc_log_t *lctx,
 {
 	isc_boolean_t existed;
 
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 
 	existed = DNS_C_CHECKBIT(CHAN_VERSIONS_BIT, &channel->setflags);
 
@@ -712,7 +763,7 @@ dns_c_logchan_setsize(isc_log_t *lctx,
 {
 	isc_boolean_t existed;
 
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 
 	if (channel->ctype != dns_c_logchan_file) {
 		isc_log_write(lctx, DNS_LOGCATEGORY_CONFIG,
@@ -737,7 +788,7 @@ dns_c_logchan_setfacility(isc_log_t *lctx,
 {
 	isc_boolean_t existed;
 
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 
 	if (channel->ctype != dns_c_logchan_syslog) {
 		isc_log_write(lctx, DNS_LOGCATEGORY_CONFIG,
@@ -775,7 +826,7 @@ dns_c_logchan_setseverity(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 
 	existed = DNS_C_CHECKBIT(CHAN_SEVERITY_BIT, &channel->setflags);
 
@@ -794,7 +845,7 @@ dns_c_logchan_setdebuglevel(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 
 	if (channel->severity == dns_c_log_debug) {
 		existed = DNS_C_CHECKBIT(CHAN_DEBUG_LEVEL_BIT,
@@ -818,7 +869,7 @@ dns_c_logchan_setprintcat(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 
 	existed = DNS_C_CHECKBIT(CHAN_PCAT_BIT, &channel->setflags);
 
@@ -837,7 +888,7 @@ dns_c_logchan_setprintsev(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 
 	existed = DNS_C_CHECKBIT(CHAN_PSEV_BIT, &channel->setflags);
 
@@ -856,7 +907,7 @@ dns_c_logchan_setprinttime(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 
 	existed = DNS_C_CHECKBIT(CHAN_PTIME_BIT, &channel->setflags);
 
@@ -872,7 +923,7 @@ dns_c_logchan_setpredef(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 
 	channel->predefined = newval;
 
@@ -891,7 +942,7 @@ dns_c_logchan_getpath(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 	REQUIRE(path != NULL);
 
 	if (channel->ctype == dns_c_logchan_file &&
@@ -916,7 +967,7 @@ dns_c_logchan_getversions(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 	REQUIRE(retval != NULL);
 
 	if (channel->ctype == dns_c_logchan_file &&
@@ -941,7 +992,7 @@ dns_c_logchan_getsize(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 	REQUIRE(retval != NULL);
 
 	if (channel->ctype == dns_c_logchan_file &&
@@ -966,7 +1017,7 @@ dns_c_logchan_getfacility(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 	REQUIRE(retval != NULL);
 
 	if (channel->ctype == dns_c_logchan_syslog &&
@@ -993,7 +1044,7 @@ dns_c_logchan_getseverity(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 	REQUIRE(retval != NULL);
 
 	if (DNS_C_CHECKBIT(CHAN_SEVERITY_BIT, &channel->setflags)) {
@@ -1015,7 +1066,7 @@ dns_c_logchan_getdebuglevel(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 	REQUIRE(retval != NULL);
 
 	if (DNS_C_CHECKBIT(CHAN_DEBUG_LEVEL_BIT, &channel->setflags)) {
@@ -1037,7 +1088,7 @@ dns_c_logchan_getprintcat(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 	REQUIRE(retval != NULL);
 
 	if (DNS_C_CHECKBIT(CHAN_PCAT_BIT, &channel->setflags)) {
@@ -1059,7 +1110,7 @@ dns_c_logchan_getprintsev(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 	REQUIRE(retval != NULL);
 
 	if (DNS_C_CHECKBIT(CHAN_PSEV_BIT, &channel->setflags)) {
@@ -1082,7 +1133,7 @@ dns_c_logchan_getprinttime(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 	REQUIRE(retval != NULL);
 
 	if (DNS_C_CHECKBIT(CHAN_PTIME_BIT, &channel->setflags)) {
@@ -1102,7 +1153,7 @@ dns_c_logchan_getpredef(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(channel != NULL);
+	REQUIRE(DNS_C_LOGCHAN_VALID(channel));
 	REQUIRE(retval != NULL);
 
 	*retval = channel->predefined;
@@ -1130,6 +1181,7 @@ dns_c_logcat_new(isc_log_t *lctx,
 		return (ISC_R_NOMEMORY);
 	}
 
+	newc->magic = DNS_C_LOGCAT_MAGIC;
 	newc->mem = mem;
 	newc->category = cat;
 	newc->cnames_len = 2;
@@ -1162,7 +1214,7 @@ dns_c_logcat_delete(isc_log_t *lctx,
 	(void) lctx;
 	
 	REQUIRE(logcat != NULL);
-	REQUIRE(*logcat != NULL);
+	REQUIRE(DNS_C_LOGCAT_VALID(*logcat));
 
 	logc = *logcat;
 	if (logc == NULL) {
@@ -1175,6 +1227,7 @@ dns_c_logcat_delete(isc_log_t *lctx,
 		isc_mem_free(logc->mem, logc->channel_names[i]);
 	}
 
+	logc->magic = 0;
 	isc_mem_put(logc->mem, logc->channel_names,
 		    sizeof (char *) * logc->cnames_len);
 	isc_mem_put(logc->mem, logc, sizeof *logc);
@@ -1194,7 +1247,7 @@ dns_c_logcat_copy(isc_log_t *lctx,
 	isc_result_t res;
 
 	REQUIRE(dest != NULL);
-	REQUIRE(src != NULL);
+	REQUIRE(DNS_C_LOGCAT_VALID(src));
 
 	res = dns_c_logcat_new(lctx, mem, src->category, &newc);
 	if (res != ISC_R_SUCCESS) {
@@ -1221,7 +1274,7 @@ dns_c_logcat_print(isc_log_t *lctx,
 	unsigned int i;
 	
 	REQUIRE(fp != NULL);
-	REQUIRE(logcat != NULL);
+	REQUIRE(DNS_C_LOGCAT_VALID(logcat));
 
 	if (logcat->predefined && !if_predef_too) {
 		return;
@@ -1250,7 +1303,7 @@ dns_c_logcat_addname(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(logcat != NULL);
+	REQUIRE(DNS_C_LOGCAT_VALID(logcat));
 	REQUIRE(name != NULL);
 	REQUIRE(strlen(name) > 0);
 
@@ -1299,7 +1352,7 @@ dns_c_logcat_delname(isc_log_t *lctx,
 
 	(void) lctx;
 	
-	REQUIRE(logcat != NULL);
+	REQUIRE(DNS_C_LOGCAT_VALID(logcat));
 	REQUIRE(name != NULL);
 	REQUIRE(strlen(name) > 0);
 
@@ -1333,7 +1386,7 @@ dns_c_logcat_setpredef(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(logcat != NULL);
+	REQUIRE(DNS_C_LOGCAT_VALID(logcat));
 
 	logcat->predefined = newval;
 
@@ -1347,7 +1400,7 @@ dns_c_logcat_getpredef(isc_log_t *lctx,
 {
 	(void) lctx;
 	
-	REQUIRE(logcat != NULL);
+	REQUIRE(DNS_C_LOGCAT_VALID(logcat));
 	REQUIRE(retval != NULL);
 
 	*retval = logcat->predefined;
diff --git a/lib/dns/config/conflsn.c b/lib/dns/config/conflsn.c
index a481b6aa93..670ea7d1f6 100644
--- a/lib/dns/config/conflsn.c
+++ b/lib/dns/config/conflsn.c
@@ -18,18 +18,14 @@
 #include <config.h>
 
 #include <isc/assertions.h>
+#include <isc/magic.h>
+
 #include <dns/conflsn.h>
 #include <dns/confcommon.h>
 
 #include "confpvt.h"
 
 
-#define LISTEN_MAGIC		0x4c49534eU /* LISN */
-#define LLIST_MAGIC		0x4c6c6973U /* Llis */
-#define CHECK_LISTEN(l)		REQUIRE(DNS_C_VALID_STRUCT(l,LISTEN_MAGIC))
-#define CHECK_LLIST(l)		REQUIRE(DNS_C_VALID_STRUCT(l,LLIST_MAGIC))
-
-
 isc_result_t
 dns_c_lstnon_new(isc_log_t *lctx, isc_mem_t *mem, dns_c_lstnon_t **listen)
 {
@@ -43,7 +39,7 @@ dns_c_lstnon_new(isc_log_t *lctx, isc_mem_t *mem, dns_c_lstnon_t **listen)
 	ll = isc_mem_get(mem, sizeof *ll);
 	ll->mem = mem;
 	ll->port = 0;
-	ll->magic = LISTEN_MAGIC;
+	ll->magic = DNS_C_LISTEN_MAGIC;
 
 	result = dns_c_ipmatchlist_new(lctx, mem, &ll->iml);
 	if (result != ISC_R_SUCCESS) {
@@ -66,12 +62,10 @@ dns_c_lstnon_delete(isc_log_t *lctx, dns_c_lstnon_t **listen)
 	isc_result_t r;
 
 	REQUIRE(listen != NULL);
-	REQUIRE(*listen != NULL);
+	REQUIRE(DNS_C_LISTEN_VALID(*listen));
 
 	lo = *listen;
 
-	CHECK_LISTEN(lo);
-
 	if (lo->iml != NULL) {
 		r = dns_c_ipmatchlist_detach(lctx, &lo->iml);
 	} else
@@ -90,9 +84,9 @@ dns_c_lstnon_setiml(isc_log_t *lctx, dns_c_lstnon_t *listen,
 		    dns_c_ipmatchlist_t *iml, isc_boolean_t deepcopy)
 {
 	isc_result_t result;
-	
-	REQUIRE(listen != NULL);
-	REQUIRE(iml != NULL);
+
+	REQUIRE(DNS_C_LISTEN_VALID(listen));
+	REQUIRE(DNS_C_IPMLIST_VALID(iml));
 
 	if (listen->iml != NULL) {
 		result = dns_c_ipmatchlist_detach(lctx, &listen->iml);
@@ -138,7 +132,7 @@ dns_c_lstnlist_new(isc_log_t *lctx, isc_mem_t *mem, dns_c_lstnlist_t **llist)
 	}
 
 	ll->mem = mem;
-	ll->magic = LLIST_MAGIC;
+	ll->magic = DNS_C_LLIST_MAGIC;
 	ISC_LIST_INIT(ll->elements);
 
 	*llist = ll;
@@ -155,12 +149,10 @@ dns_c_lstnlist_delete(isc_log_t *lctx, dns_c_lstnlist_t **llist)
 	isc_result_t r;
 
 	REQUIRE(llist != NULL);
-	REQUIRE(*llist != NULL);
+	REQUIRE(DNS_C_LISTENLIST_VALID(*llist));
 
 	ll = *llist;
 
-	CHECK_LLIST(ll);
-
 	lo = ISC_LIST_HEAD(ll->elements);
 	while (lo != NULL) {
 		lotmp = ISC_LIST_NEXT(lo, next);
@@ -173,6 +165,7 @@ dns_c_lstnlist_delete(isc_log_t *lctx, dns_c_lstnlist_t **llist)
 		lo = lotmp;
 	}
 
+	ll->magic = 0;
 	isc_mem_put(ll->mem, ll, sizeof *ll);
 
 	*llist = NULL;
@@ -187,12 +180,8 @@ dns_c_lstnlist_print(isc_log_t *lctx, FILE *fp, int indent,
 {
 	dns_c_lstnon_t *lo;
 
-	if (ll == NULL) {
-		return (ISC_R_SUCCESS);
-	}
+	REQUIRE(DNS_C_LISTENLIST_VALID(ll));
 
-	CHECK_LLIST(ll);
-	
 	lo = ISC_LIST_HEAD(ll->elements);
 	while (lo != NULL) {
 		dns_c_printtabs(lctx, fp, indent);
@@ -209,8 +198,7 @@ isc_result_t
 dns_c_lstnon_print(isc_log_t *lctx, FILE *fp, int indent, dns_c_lstnon_t *lo)
 {
 	REQUIRE(lo != NULL);
-	REQUIRE(lo->iml != NULL);
-	CHECK_LISTEN(lo);
+	REQUIRE(DNS_C_LISTEN_VALID(lo));
 	
 	fprintf(fp, "listen-on ");
 	if (lo->port != DNS_C_DEFAULTPORT) {
diff --git a/lib/dns/config/confparser.y b/lib/dns/config/confparser.y
index 5208870afc..319aa15d1d 100644
--- a/lib/dns/config/confparser.y
+++ b/lib/dns/config/confparser.y
@@ -17,7 +17,7 @@
  */
 
 #if !defined(lint) && !defined(SABER)
-static char rcsid[] = "$Id: confparser.y,v 1.26 1999/11/30 22:01:16 gson Exp $";
+static char rcsid[] = "$Id: confparser.y,v 1.27 1999/12/01 16:28:56 brister Exp $";
 #endif /* not lint */
 
 #include <config.h>
@@ -2428,6 +2428,7 @@ view_option: L_ALLOW_QUERY L_LBRACE address_match_list L_RBRACE
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set view allow-query.");
+			break;
                 }
         }
         | zone_stmt;
@@ -2709,6 +2710,7 @@ zone_option: L_FILE L_QSTRING
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set zone master port.");
+			break;
                 }
 
                 tmpres = dns_c_zone_setmasterips(logcontext, zone,
@@ -2726,6 +2728,7 @@ zone_option: L_FILE L_QSTRING
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set zone masters ips.");
+			break;
                 }
         }
         | L_TRANSFER_SOURCE maybe_wild_addr
@@ -2749,6 +2752,7 @@ zone_option: L_FILE L_QSTRING
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set zone transfer-source.");
+			break;
                 }
         }
         | L_CHECK_NAMES check_names_opt
@@ -2772,6 +2776,7 @@ zone_option: L_FILE L_QSTRING
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set zone check-names.");
+			break;
                 }
         }
         | L_ALLOW_UPDATE L_LBRACE address_match_list L_RBRACE
@@ -2796,6 +2801,7 @@ zone_option: L_FILE L_QSTRING
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set zone allow-update.");
+                        break;
                 }
         }
         | L_ALLOW_QUERY L_LBRACE address_match_list L_RBRACE
@@ -2820,6 +2826,7 @@ zone_option: L_FILE L_QSTRING
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set zone allow-query.");
+                        break;
                 }
         }
         | L_ALLOW_TRANSFER L_LBRACE address_match_list L_RBRACE
@@ -2844,6 +2851,7 @@ zone_option: L_FILE L_QSTRING
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set zone allow-transfer.");
+                        break;
                 }
         }
         | L_FORWARD zone_forward_opt
@@ -2867,6 +2875,7 @@ zone_option: L_FILE L_QSTRING
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set zone forward.");
+                        break;
                 }
         }
         | L_FORWARDERS L_LBRACE opt_zone_forwarders_list L_RBRACE
@@ -2932,6 +2941,7 @@ zone_option: L_FILE L_QSTRING
                         parser_error(ISC_FALSE,
                                      "Failed to set zone "
                                      "max-transfer-time-in.");
+                        break;
                 }
         }
         | L_MAX_LOG_SIZE_IXFR L_INTEGER
@@ -2955,6 +2965,7 @@ zone_option: L_FILE L_QSTRING
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set zone max-ixfr-log-size.");
+                        break;
                 }
         }
         | L_NOTIFY yea_or_nay
@@ -2978,6 +2989,7 @@ zone_option: L_FILE L_QSTRING
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set zone notify.");
+                        break;
                 }
         }
         | L_MAINTAIN_IXFR_BASE yea_or_nay
@@ -3001,6 +3013,7 @@ zone_option: L_FILE L_QSTRING
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set zone maintain-ixfr-base.");
+                        break;
                 }
         }
         | L_PUBKEY L_INTEGER L_INTEGER L_INTEGER L_QSTRING
@@ -3019,14 +3032,9 @@ zone_option: L_FILE L_QSTRING
                         YYABORT;
                 }
                 
-                tmpres = dns_c_zone_setpubkey(logcontext, zone, pubkey,
+                tmpres = dns_c_zone_addpubkey(logcontext, zone, pubkey,
                                               ISC_FALSE);
                 switch (tmpres) {
-                case ISC_R_EXISTS:
-                        parser_warning(ISC_FALSE,
-                                       "Redefining zone pubkey.");
-                        break;
-
                 case ISC_R_SUCCESS:
                         /* nothing */
                         break;
@@ -3034,7 +3042,8 @@ zone_option: L_FILE L_QSTRING
                 default:
                         dns_c_pubkey_delete(logcontext, &pubkey);
                         parser_error(ISC_FALSE,
-                                     "Failed to set zone pubkey.");
+                                     "Failed to add a zone pubkey.");
+			break;
                 }
 
                 isc_mem_free(memctx, $5);
@@ -3061,6 +3070,7 @@ zone_option: L_FILE L_QSTRING
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set zone also-notify.");
+                        break;
                 }
         }
         | L_DIALUP yea_or_nay
@@ -3084,6 +3094,7 @@ zone_option: L_FILE L_QSTRING
                 default:
                         parser_error(ISC_FALSE,
                                      "Failed to set zone dialup.");
+                        break;
                 }
         }
         ;
@@ -3775,6 +3786,7 @@ token_to_text(int token, YYSTYPE lval) {
                                         sizeof buffer - 1);
                                 buffer[sizeof buffer - 1] = '\0';
                         }
+                        break;
                 }
         }
 
diff --git a/lib/dns/config/confpvt.h b/lib/dns/config/confpvt.h
index 07eedff7f9..4c3f8a3ea6 100644
--- a/lib/dns/config/confpvt.h
+++ b/lib/dns/config/confpvt.h
@@ -38,8 +38,4 @@
 #define DNS_C_CHECKBIT(bit,flags) \
      ISC_TF((*(flags) & ((dns_c_setbits_t)1 << (bit))) == ((dns_c_setbits_t)1 << (bit)))
 
-#define DNS_C_VALID_STRUCT(p,m)		((p) != NULL && (p)->magic == m)
-
-
-
 #endif
diff --git a/lib/dns/config/confrrset.c b/lib/dns/config/confrrset.c
index 79da589a15..69ed0b0cdf 100644
--- a/lib/dns/config/confrrset.c
+++ b/lib/dns/config/confrrset.c
@@ -18,6 +18,7 @@
 #include <config.h>
 
 #include <isc/assertions.h>
+#include <isc/magic.h>
 
 #include <dns/confrrset.h>
 #include <dns/confcommon.h>
@@ -28,7 +29,7 @@ dns_c_rrsolist_clear(isc_log_t *lctx, dns_c_rrsolist_t *olist)
 {
 	dns_c_rrso_t *elem;
 	
-	REQUIRE(olist != NULL);
+	REQUIRE(DNS_C_RRSOLIST_VALID(olist));
 
 	elem = ISC_LIST_HEAD(olist->elements);
 	while (elem != NULL) {
@@ -49,8 +50,8 @@ dns_c_rrsolist_append(isc_log_t *lctx, dns_c_rrsolist_t *dest,
 	dns_c_rrso_t *newelem;
 	isc_result_t res;
 
-	REQUIRE(dest != NULL);
-	REQUIRE(src != NULL);
+	REQUIRE(DNS_C_RRSOLIST_VALID(dest));
+	REQUIRE(DNS_C_RRSOLIST_VALID(src));
 
 	oldelem = ISC_LIST_HEAD(src->elements);
 	while (oldelem != NULL) {
@@ -81,6 +82,7 @@ dns_c_rrsolist_new(isc_log_t *lctx, isc_mem_t *mem, dns_c_rrsolist_t **rval)
 	
 	ISC_LIST_INIT(ro->elements);
 	ro->mem = mem;
+	ro->magic = DNS_C_RRSOLIST_MAGIC;
 
 	*rval = ro;
 	
@@ -109,6 +111,7 @@ dns_c_rrso_new(isc_log_t *lctx, isc_mem_t *mem, dns_c_rrso_t **res,
 		return (ISC_R_NOMEMORY);
 	}
 
+	newo->magic = DNS_C_RRSO_MAGIC;
 	newo->mem = mem;
 	newo->otype = otype;
 	newo->oclass = oclass;
@@ -117,6 +120,7 @@ dns_c_rrso_new(isc_log_t *lctx, isc_mem_t *mem, dns_c_rrso_t **res,
 
 	newo->name = isc_mem_strdup(mem, name);
 	if (newo->name == NULL) {
+		newo->magic = 0;
 		isc_mem_put(mem, newo, sizeof *newo);
 		return (ISC_R_NOMEMORY);
 	}
@@ -135,7 +139,7 @@ dns_c_rrsolist_delete(isc_log_t *lctx, dns_c_rrsolist_t **list)
 	isc_result_t r;
 
 	REQUIRE(list != NULL);
-	REQUIRE(*list != NULL);
+	REQUIRE(DNS_C_RRSOLIST_VALID(*list));
 
 	l = *list;
 
@@ -151,6 +155,7 @@ dns_c_rrsolist_delete(isc_log_t *lctx, dns_c_rrsolist_t **list)
 		elem = q;
 	}
 
+	l->magic = 0;
 	isc_mem_put(l->mem, l, sizeof *l);
 
 	*list = NULL;
@@ -167,13 +172,14 @@ dns_c_rrso_delete(isc_log_t *lctx, dns_c_rrso_t **order)
 	(void)lctx;
 	
 	REQUIRE(order != NULL);
-	REQUIRE(*order != NULL);
+	REQUIRE(DNS_C_RRSO_VALID(*order));
 
 	oldo = *order;
 
 	REQUIRE(oldo->name != NULL);
 	isc_mem_free(oldo->mem, oldo->name);
 
+	oldo->magic = 0;
 	isc_mem_put(oldo->mem, oldo, sizeof *oldo);
 
 	*order = NULL;
@@ -189,9 +195,8 @@ dns_c_rrso_copy(isc_log_t *lctx, isc_mem_t *mem, dns_c_rrso_t **dest,
 	dns_c_rrso_t *newo;
 	isc_result_t res;
 
-	REQUIRE(mem != NULL);
-	REQUIRE(dest != NULL);
-	REQUIRE(source != NULL);
+	REQUIRE(DNS_C_RRSO_VALID(*dest));
+	REQUIRE(DNS_C_RRSO_VALID(source));
 
 	res = dns_c_rrso_new(lctx, mem, &newo, source->oclass,
 			     source->otype, source->name,
@@ -215,6 +220,9 @@ dns_c_rrsolist_copy(isc_log_t *lctx, isc_mem_t *mem, dns_c_rrsolist_t **dest,
 	dns_c_rrso_t *elem;
 	dns_c_rrso_t *newe;
 	dns_result_t res;
+
+	REQUIRE(DNS_C_RRSOLIST_VALID(source));
+	REQUIRE(dest != NULL);
 	
 	res = dns_c_rrsolist_new(lctx, mem, &nlist);
 	if (res != DNS_R_SUCCESS) {
@@ -246,9 +254,7 @@ dns_c_rrsolist_print(isc_log_t *lctx, FILE *fp, int indent,
 {
 	dns_c_rrso_t *or;
 
-	if (rrlist == NULL) {
-		return;
-	}
+	REQUIRE(DNS_C_RRSOLIST_VALID(rrlist));
 	
 	if (ISC_LIST_EMPTY(rrlist->elements)) {
 		return;
@@ -272,8 +278,10 @@ dns_c_rrsolist_print(isc_log_t *lctx, FILE *fp, int indent,
 void
 dns_c_rrso_print(isc_log_t *lctx, FILE *fp, int indent, dns_c_rrso_t *order)
 {
+	REQUIRE(DNS_C_RRSO_VALID(order));
+	
 	dns_c_printtabs(lctx, fp, indent);
-
+	
 	fputs("class ", fp);
 	if (order->oclass == dns_rdataclass_any) {
 		fputc('*', fp);
diff --git a/lib/dns/config/confserv.c b/lib/dns/config/confserv.c
index c591538745..0a8a5753fa 100644
--- a/lib/dns/config/confserv.c
+++ b/lib/dns/config/confserv.c
@@ -22,6 +22,7 @@
 #include <string.h>
 
 #include <isc/assertions.h>
+#include <isc/magic.h>
 #include <isc/net.h>
 
 #include <dns/confserv.h>
@@ -55,6 +56,7 @@ dns_c_srvlist_new(isc_log_t *lctx, isc_mem_t *mem, dns_c_srvlist_t **list)
 	
 	ISC_LIST_INIT(l->elements);
 	l->mem = mem;
+	l->magic = DNS_C_SRVLIST_MAGIC;
 
 	*list = l;
 
@@ -70,7 +72,7 @@ dns_c_srvlist_delete(isc_log_t *lctx, dns_c_srvlist_t **list)
 	isc_result_t r;
 	
 	REQUIRE(list != NULL);
-	REQUIRE(*list != NULL);
+	REQUIRE(DNS_C_SRVLIST_VALID(*list));
 
 	l = *list;
 
@@ -85,6 +87,8 @@ dns_c_srvlist_delete(isc_log_t *lctx, dns_c_srvlist_t **list)
 		
 		server = stmp;
 	}
+
+	l->magic = 0;
 	isc_mem_put(l->mem, l, sizeof *l);
 
 	*list = NULL;
@@ -100,10 +104,7 @@ dns_c_srvlist_print(isc_log_t *lctx, FILE *fp, int indent,
 	dns_c_srv_t *server;
 	
 	REQUIRE(fp != NULL);
-
-	if (servers == NULL) {
-		return;
-	}
+	REQUIRE(DNS_C_SRVLIST_VALID(servers));
 
 	server = ISC_LIST_HEAD(servers->elements);
 	while (server != NULL) {
@@ -128,14 +129,10 @@ dns_c_srvlist_servbyaddr(isc_log_t *lctx, dns_c_srvlist_t *servers,
 	(void) lctx;
 	
 	REQUIRE(retval != NULL);
-
-	if (servers == NULL) {
-		return (ISC_R_NOTFOUND);
-	}
+	REQUIRE(DNS_C_SRVLIST_VALID(servers));
 
 	server = ISC_LIST_HEAD(servers->elements);
 	while (server != NULL) {
-
 		if (isc_sockaddr_eqaddr(&addr, &server->address)) {
 			break;
 		}
@@ -165,13 +162,13 @@ dns_c_srv_new(isc_log_t *lctx, isc_mem_t *mem, isc_sockaddr_t addr,
 	(void) lctx;
 	
 	REQUIRE(server != NULL);
-	REQUIRE(mem != NULL);
 
 	serv = isc_mem_get(mem, sizeof *serv);
 	if (serv == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
 
+	serv->magic = DNS_C_SRV_MAGIC;
 	serv->address = addr;
 	serv->mem = mem;
 	serv->bogus = ISC_FALSE;
@@ -197,12 +194,13 @@ dns_c_srv_delete(isc_log_t *lctx, dns_c_srv_t **server)
 	isc_mem_t *mem;
 	
 	REQUIRE(server != NULL);
-	REQUIRE(*server != NULL);
+	REQUIRE(DNS_C_SRV_VALID(*server));
 
 	serv = *server;
 
 	mem = serv->mem;
 	serv->mem = NULL;
+	serv->magic = 0;
 
 	if (serv->keys != NULL)
 		dns_c_kidlist_delete(lctx, &serv->keys);
@@ -218,7 +216,7 @@ dns_c_srv_delete(isc_log_t *lctx, dns_c_srv_t **server)
 void
 dns_c_srv_print(isc_log_t *lctx, FILE *fp, int indent, dns_c_srv_t *server)
 {
-	REQUIRE(server != NULL);
+	REQUIRE(DNS_C_SRV_VALID(server));
 	REQUIRE(fp != NULL);
 
 	dns_c_printtabs(lctx, fp, indent);
@@ -264,7 +262,7 @@ dns_c_srv_setbogus(isc_log_t *lctx, dns_c_srv_t *server, isc_boolean_t newval)
 {
 	(void) lctx;
 	
-	REQUIRE(server != NULL);
+	REQUIRE(DNS_C_SRV_VALID(server));
 
 	server->bogus = newval;
 	DNS_C_SETBIT(BOGUS_BIT, &server->bitflags);
@@ -279,7 +277,7 @@ dns_c_srv_getbogus(isc_log_t *lctx, dns_c_srv_t *server,
 {
 	(void) lctx;
 	
-	REQUIRE(server != NULL);
+	REQUIRE(DNS_C_SRV_VALID(server));
 	REQUIRE(retval != NULL);
 
 	if (DNS_C_CHECKBIT(BOGUS_BIT, &server->bitflags)) {
@@ -297,7 +295,7 @@ dns_c_srv_setsupportixfr(isc_log_t *lctx, dns_c_srv_t *server,
 {
 	(void) lctx;
 	
-	REQUIRE(server != NULL);
+	REQUIRE(DNS_C_SRV_VALID(server));
 
 	server->support_ixfr = newval;
 	DNS_C_SETBIT(SUPPORT_IXFR_BIT, &server->bitflags);
@@ -311,7 +309,7 @@ dns_c_srv_getsupportixfr(isc_log_t *lctx, dns_c_srv_t *server,
 {
 	(void) lctx;
 	
-	REQUIRE(server != NULL);
+	REQUIRE(DNS_C_SRV_VALID(server));
 	REQUIRE(retval != NULL);
 
 	if (DNS_C_CHECKBIT(SUPPORT_IXFR_BIT, &server->bitflags)) {
@@ -329,7 +327,7 @@ dns_c_srv_settransfers(isc_log_t *lctx, dns_c_srv_t *server,
 {
 	(void) lctx;
 	
-	REQUIRE(server != NULL);
+	REQUIRE(DNS_C_SRV_VALID(server));
 
 	server->transfers = newval;
 	DNS_C_SETBIT(TRANSFERS_BIT, &server->bitflags);
@@ -344,7 +342,7 @@ dns_c_srv_gettransfers(isc_log_t *lctx, dns_c_srv_t *server,
 {
 	(void) lctx;
 	
-	REQUIRE(server != NULL);
+	REQUIRE(DNS_C_SRV_VALID(server));
 	REQUIRE(retval != NULL);
 
 	if (DNS_C_CHECKBIT(TRANSFERS_BIT, &server->bitflags)) {
@@ -362,7 +360,7 @@ dns_c_srv_settransferformat(isc_log_t *lctx, dns_c_srv_t *server,
 {
 	(void) lctx;
 	
-	REQUIRE(server != NULL);
+	REQUIRE(DNS_C_SRV_VALID(server));
 
 	server->transfer_format = newval;
 	DNS_C_SETBIT(SERVER_TRANSFER_FORMAT_BIT, &server->bitflags);
@@ -377,7 +375,7 @@ dns_c_srv_gettransferformat(isc_log_t *lctx, dns_c_srv_t *server,
 {
 	(void) lctx;
 	
-	REQUIRE(server != NULL);
+	REQUIRE(DNS_C_SRV_VALID(server));
 	REQUIRE(retval != NULL);
 	
 	if (DNS_C_CHECKBIT(SERVER_TRANSFER_FORMAT_BIT, &server->bitflags)) {
diff --git a/lib/dns/config/confview.c b/lib/dns/config/confview.c
index 47087e5e94..fa536757e0 100644
--- a/lib/dns/config/confview.c
+++ b/lib/dns/config/confview.c
@@ -20,8 +20,10 @@
 #include <sys/types.h>
 
 #include <isc/assertions.h>
+#include <isc/magic.h>
 #include <isc/net.h>
 
+#include <dns/confacl.h>
 #include <dns/confzone.h>
 #include <dns/confcommon.h>
 #include <dns/confview.h>
@@ -36,7 +38,6 @@ dns_c_viewtable_new(isc_log_t *lctx,
 {
 	dns_c_viewtable_t *table;
 	
-	REQUIRE(mem != NULL);
 	REQUIRE(viewtable != NULL);
 
 	table = isc_mem_get(mem, sizeof *table);
@@ -47,6 +48,7 @@ dns_c_viewtable_new(isc_log_t *lctx,
 		return (ISC_R_NOMEMORY);
 	}
 
+	table->magic = DNS_C_VIEWTABLE_MAGIC;
 	table->mem = mem;
 
 	ISC_LIST_INIT(table->views);
@@ -64,13 +66,14 @@ dns_c_viewtable_delete(isc_log_t *lctx,
 	dns_c_viewtable_t *table;
 	
 	REQUIRE(viewtable != NULL);
-	REQUIRE(*viewtable != NULL);
+	REQUIRE(DNS_C_VIEWTABLE_VALID(*viewtable));
 
 	table = *viewtable;
 	*viewtable = NULL;
 	
 	dns_c_viewtable_clear(lctx, table);
 
+	table->magic = 0;
 	isc_mem_put(table->mem, table, sizeof *table);
 
 	return (ISC_R_SUCCESS);
@@ -83,8 +86,8 @@ dns_c_viewtable_addview(isc_log_t *lctx,
 {
 	(void) lctx;			/* lint */
 	
-	REQUIRE(viewtable != NULL);
-	REQUIRE(view != NULL);
+	REQUIRE(DNS_C_VIEWTABLE_VALID(viewtable));
+	REQUIRE(DNS_C_VIEW_VALID(view));
 	
 	ISC_LIST_APPEND(viewtable->views, view, next);
 }
@@ -97,8 +100,8 @@ dns_c_viewtable_rmview(isc_log_t *lctx,
 {
 	(void) lctx;			/* lint */
 	
-	REQUIRE(viewtable != NULL);
-	REQUIRE(view != NULL);
+	REQUIRE(DNS_C_VIEWTABLE_VALID(viewtable));
+	REQUIRE(DNS_C_VIEW_VALID(view));
 	
 	ISC_LIST_UNLINK(viewtable->views, view, next);
 }
@@ -113,7 +116,7 @@ dns_c_viewtable_clear(isc_log_t *lctx,
 	dns_c_view_t *tmpelem;
 	isc_result_t r;
 	
-	REQUIRE(table != NULL);
+	REQUIRE(DNS_C_VIEWTABLE_VALID(table));
 	
 	elem = ISC_LIST_HEAD(table->views);
 	while (elem != NULL) {
@@ -147,7 +150,7 @@ dns_c_viewtable_viewbyname(isc_log_t *lctx,
 
 	(void) lctx;			/* lint */
 	
-	REQUIRE(viewtable != NULL);
+	REQUIRE(DNS_C_VIEWTABLE_VALID(viewtable));
 	REQUIRE(retval != NULL);
 	REQUIRE(viewname != NULL);
 	REQUIRE(strlen(viewname) > 0);
@@ -178,6 +181,8 @@ dns_c_viewtable_rmviewbyname(isc_log_t *lctx,
 	dns_c_view_t *view;
 	isc_result_t res;
 
+	REQUIRE(DNS_C_VIEWTABLE_VALID(viewtable));
+	
 	res = dns_c_viewtable_viewbyname(lctx, viewtable, name, &view);
 	if (res == ISC_R_SUCCESS) {
 		ISC_LIST_UNLINK(viewtable->views, view, next);
@@ -207,6 +212,7 @@ dns_c_view_new(isc_log_t *lctx,
 	/* XXXJAB not portable -- should set each field */
 	memset(view, 0x0, sizeof *view); 
 
+	view->magic = DNS_C_VIEW_MAGIC;
 	view->mem = mem;
 	view->name = isc_mem_strdup(mem, name);
 	if (view->name == NULL) {
@@ -231,11 +237,8 @@ dns_c_viewtable_print(isc_log_t *lctx,
 
 	REQUIRE(fp != NULL);
 	REQUIRE(indent >= 0);
+	REQUIRE(DNS_C_VIEWTABLE_VALID(table));
 
-	if (table == NULL) {
-		return;
-	}
-		
 	view = ISC_LIST_HEAD(table->views);
 	while (view != NULL) {
 		dns_c_view_print(lctx, fp, indent, view);
@@ -249,6 +252,8 @@ void
 dns_c_view_print(isc_log_t *lctx,
 		 FILE *fp, int indent, dns_c_view_t *view)
 {
+	REQUIRE(DNS_C_VIEW_VALID(view));
+	
 	dns_c_printtabs(lctx, fp, indent);
 	fprintf(fp, "view \"%s\" {\n", view->name);
 
@@ -275,8 +280,8 @@ dns_c_view_setallowquery(isc_log_t *lctx,
 {
 	isc_result_t res;
 	
-	REQUIRE(view != NULL);
-	REQUIRE(ipml != NULL);
+	REQUIRE(DNS_C_VIEW_VALID(view));
+	REQUIRE(DNS_C_IPMLIST_VALID(ipml));
 
 	if (view->allowquery != NULL) {
 		dns_c_ipmatchlist_detach(lctx, &view->allowquery);
@@ -304,6 +309,10 @@ dns_c_view_getallowqueryexpanded(isc_log_t *lctx,
 	dns_c_ipmatchlist_t *newlist;
 	isc_result_t r;
 
+	REQUIRE(DNS_C_VIEW_VALID(view));
+	REQUIRE(DNS_C_CONFACLTABLE_VALID(acltable));
+	REQUIRE(retval != NULL);
+	
 	if (view->allowquery == NULL) {
 		newlist = NULL;
 		r = ISC_R_SUCCESS;
@@ -330,7 +339,7 @@ dns_c_view_delete(isc_log_t *lctx,
 	dns_c_view_t *view;
 	
 	REQUIRE(viewptr != NULL);
-	REQUIRE(*viewptr != NULL);
+	REQUIRE(DNS_C_VIEW_VALID(*viewptr));
 
 	view = *viewptr;
 
@@ -339,6 +348,7 @@ dns_c_view_delete(isc_log_t *lctx,
 	if (view->allowquery != NULL)
 		dns_c_ipmatchlist_detach(lctx, &view->allowquery);
 
+	view->magic = 0;
 	isc_mem_put(view->mem, view, sizeof *view);
 	
 	return (ISC_R_SUCCESS);
@@ -350,7 +360,7 @@ dns_c_view_getname(isc_log_t *lctx, dns_c_view_t *view, const char **retval)
 {
 	(void) lctx;
 	
-	REQUIRE(view != NULL);
+	REQUIRE(DNS_C_VIEW_VALID(view));
 	REQUIRE(retval != NULL);
 
 	*retval = view->name;
diff --git a/lib/dns/config/confzone.c b/lib/dns/config/confzone.c
index f497cdf42b..587e10aa81 100644
--- a/lib/dns/config/confzone.c
+++ b/lib/dns/config/confzone.c
@@ -1032,7 +1032,7 @@ dns_c_zone_setixfrbase(isc_log_t *lctx, dns_c_zone_t *zone, const char *newval)
 isc_result_t
 dns_c_zone_setixfrtmp(isc_log_t *lctx, dns_c_zone_t *zone, const char *newval)
 {
-	isc_boolean_t existed;
+  isc_boolean_t existed;
 	char **p = NULL;
 	
 	REQUIRE(zone != NULL);
@@ -1082,33 +1082,34 @@ dns_c_zone_setixfrtmp(isc_log_t *lctx, dns_c_zone_t *zone, const char *newval)
 
 
 isc_result_t
-dns_c_zone_setpubkey(isc_log_t *lctx, dns_c_zone_t *zone,
+dns_c_zone_addpubkey(isc_log_t *lctx, dns_c_zone_t *zone,
 		     dns_c_pubkey_t *pubkey,
 		     isc_boolean_t deepcopy)
 {
-	isc_boolean_t existed;
-	dns_c_pubkey_t **p = NULL;
+	dns_c_pklist_t **p = NULL;
 	isc_result_t res;
 	
-	REQUIRE(zone != NULL);
-
 	switch (zone->ztype) {
 	case dns_c_zone_master:
-		p = &zone->u.mzone.pubkey;
+		p = &zone->u.mzone.pubkeylist;
 		break;
 			
 	case dns_c_zone_slave:
-		p = &zone->u.szone.pubkey;
+		p = &zone->u.szone.pubkeylist;
 		break;
 		
 	case dns_c_zone_stub:
-		p = &zone->u.tzone.pubkey;
+		p = &zone->u.tzone.pubkeylist;
 		break;
 		
 	case dns_c_zone_hint:
+#if 1
+		p = &zone->u.hzone.pubkeylist;
+#else
 		isc_log_write(lctx, DNS_LOGCATEGORY_CONFIG,
 			      DNS_LOGMODULE_CONFIG, ISC_LOG_CRITICAL,
 			      "Hint zones do not have a pubkey field");
+#endif 
 		return (ISC_R_FAILURE);
 			
 	case dns_c_zone_forward:
@@ -1118,24 +1119,15 @@ dns_c_zone_setpubkey(isc_log_t *lctx, dns_c_zone_t *zone,
 		return (ISC_R_FAILURE);
 	}
 
-	if (*p != NULL) {
-		existed = ISC_TRUE;
-		dns_c_pubkey_delete(lctx, p);
-	} else {
-		existed = ISC_FALSE;
-	}
-
-	if (deepcopy) {
-		res = dns_c_pubkey_copy(lctx, zone->mem, p, pubkey);
-	} else {
-		*p = pubkey;
-		res = ISC_R_SUCCESS;
-	}
-
-	if (res == ISC_R_SUCCESS && existed) {
-		res = ISC_R_EXISTS;
+	if (*p == NULL) {
+		res = dns_c_pklist_new(lctx, zone->mem, p);
+		if (res != ISC_R_SUCCESS) {
+			return (res);
+		}
 	}
 	
+	res = dns_c_pklist_addpubkey(lctx, *p, pubkey, deepcopy);
+
 	return (res);
 }
 
@@ -2073,10 +2065,10 @@ dns_c_zone_getixfrtmp(isc_log_t *lctx, dns_c_zone_t *zone, const char **retval)
 
 
 isc_result_t
-dns_c_zone_getpubkey(isc_log_t *lctx, dns_c_zone_t *zone,
-		     dns_c_pubkey_t **retval)
+dns_c_zone_getpubkeylist(isc_log_t *lctx, dns_c_zone_t *zone,
+			 dns_c_pklist_t **retval)
 {
-	dns_c_pubkey_t *p = NULL;
+	dns_c_pklist_t *p = NULL;
 	isc_result_t res;
 	
 	REQUIRE(zone != NULL);
@@ -2084,21 +2076,25 @@ dns_c_zone_getpubkey(isc_log_t *lctx, dns_c_zone_t *zone,
 
 	switch (zone->ztype) {
 	case dns_c_zone_master:
-		p = zone->u.mzone.pubkey;
+		p = zone->u.mzone.pubkeylist;
 		break;
 			
 	case dns_c_zone_slave:
-		p = zone->u.szone.pubkey;
+		p = zone->u.szone.pubkeylist;
 		break;
 		
 	case dns_c_zone_stub:
-		p = zone->u.tzone.pubkey;
+		p = zone->u.tzone.pubkeylist;
 		break;
 		
 	case dns_c_zone_hint:
+#if 1
+		p = zone->u.hzone.pubkeylist;
+#else	
 		isc_log_write(lctx, DNS_LOGCATEGORY_CONFIG,
 			      DNS_LOGMODULE_CONFIG, ISC_LOG_CRITICAL,
 			      "Hint zones do not have a pubkey field");
+#endif	
 		return (ISC_R_FAILURE);
 			
 	case dns_c_zone_forward:
@@ -2584,9 +2580,9 @@ master_zone_print(isc_log_t *lctx, FILE *fp, int indent,
 		fprintf(fp, "ixfr-tmp-file \"%s\";\n", mzone->ixfr_tmp);
 	}
 
-	if (mzone->pubkey != NULL) {
+	if (mzone->pubkeylist != NULL) {
 		dns_c_printtabs(lctx, fp, indent);
-		dns_c_pubkey_print(lctx, fp, indent, mzone->pubkey);
+		dns_c_pklist_print(lctx, fp, indent, mzone->pubkeylist);
 	}
 
 	if (DNS_C_CHECKBIT(MZ_FORWARD_BIT, &mzone->setflags)) {
@@ -2697,9 +2693,9 @@ slave_zone_print(isc_log_t *lctx, FILE *fp, int indent,
 	}
 
 
-	if (szone->pubkey != NULL) {
+	if (szone->pubkeylist != NULL) {
 		dns_c_printtabs(lctx, fp, indent);
-		dns_c_pubkey_print(lctx, fp, indent, szone->pubkey);
+		dns_c_pklist_print(lctx, fp, indent, szone->pubkeylist);
 	}
 
 	if (DNS_C_CHECKBIT(SZ_FORWARD_BIT, &szone->setflags)) {
@@ -2786,9 +2782,9 @@ stub_zone_print(isc_log_t *lctx, FILE *fp, int indent, dns_c_stubzone_t *tzone)
 			tzone->max_trans_time_in);
 	}
 	
-	if (tzone->pubkey != NULL) {
+	if (tzone->pubkeylist != NULL) {
 		dns_c_printtabs(lctx, fp, indent);
-		dns_c_pubkey_print(lctx, fp, indent, tzone->pubkey);
+		dns_c_pklist_print(lctx, fp, indent, tzone->pubkeylist);
 	}
 
 	if (DNS_C_CHECKBIT(TZ_FORWARD_BIT, &tzone->setflags)) {
@@ -2821,6 +2817,11 @@ hint_zone_print(isc_log_t *lctx, FILE *fp, int indent, dns_c_hintzone_t *hzone)
 			dns_c_nameseverity2string(lctx, hzone->check_names,
 						  ISC_TRUE));
 	}
+
+	if (hzone->pubkeylist != NULL) {
+		dns_c_printtabs(lctx, fp, indent);
+		dns_c_pklist_print(lctx, fp, indent, hzone->pubkeylist);
+	}
 }
 
 
@@ -2862,7 +2863,7 @@ master_zone_init(isc_log_t *lctx, dns_c_masterzone_t *mzone)
 	mzone->also_notify = NULL;
 	mzone->ixfr_base = NULL;
 	mzone->ixfr_tmp = NULL;
-	mzone->pubkey = NULL;
+	mzone->pubkeylist = NULL;
 	mzone->forwarders = NULL;
 
 	memset(&mzone->setflags, 0x0, sizeof (mzone->setflags));
@@ -2884,7 +2885,7 @@ slave_zone_init(isc_log_t *lctx, dns_c_slavezone_t *szone)
 	szone->allow_query = NULL;
 	szone->allow_transfer = NULL;
 	szone->also_notify = NULL;
-	szone->pubkey = NULL;
+	szone->pubkeylist = NULL;
 	szone->forwarders = NULL;
 
 	memset(&szone->setflags, 0x0, sizeof (szone->setflags));
@@ -2903,7 +2904,7 @@ stub_zone_init(isc_log_t *lctx, dns_c_stubzone_t *tzone)
 	tzone->allow_update = NULL;
 	tzone->allow_query = NULL;
 	tzone->allow_transfer = NULL;
-	tzone->pubkey = NULL;
+	tzone->pubkeylist = NULL;
 	tzone->forwarders = NULL;
 
 	memset(&tzone->setflags, 0x0, sizeof (tzone->setflags));
@@ -2918,6 +2919,7 @@ hint_zone_init(isc_log_t *lctx, dns_c_hintzone_t *hzone)
 	(void) lctx;
 	
 	hzone->file = NULL;
+	hzone->pubkeylist = NULL;
 	memset(&hzone->setflags, 0x0, sizeof (hzone->setflags));
 
 	return (ISC_R_SUCCESS);
@@ -3009,8 +3011,8 @@ master_zone_clear(isc_log_t *lctx, isc_mem_t *mem, dns_c_masterzone_t *mzone)
 		isc_mem_free(mem, mzone->ixfr_tmp);
 	}
 
-	if (mzone->pubkey != NULL)
-		dns_c_pubkey_delete(lctx, &mzone->pubkey);
+	if (mzone->pubkeylist != NULL)
+		dns_c_pklist_delete(lctx, &mzone->pubkeylist);
 
 	if (mzone->forwarders != NULL)
 		dns_c_iplist_detach(lctx, &mzone->forwarders);
@@ -3056,6 +3058,9 @@ slave_zone_clear(isc_log_t *lctx, isc_mem_t *mem, dns_c_slavezone_t *szone)
 	if (szone->forwarders != NULL)
 		dns_c_iplist_detach(lctx, &szone->forwarders);
 	
+	if (szone->pubkeylist != NULL)
+		dns_c_pklist_delete(lctx, &szone->pubkeylist);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -3084,6 +3089,8 @@ stub_zone_clear(isc_log_t *lctx, isc_mem_t *mem, dns_c_stubzone_t *tzone)
 	if (tzone->allow_transfer != NULL)
 		dns_c_ipmatchlist_detach(lctx, &tzone->allow_transfer);
 	
+	if (tzone->pubkeylist != NULL)
+		dns_c_pklist_delete(lctx, &tzone->pubkeylist);
 	
 	return (ISC_R_SUCCESS);
 }
@@ -3118,6 +3125,9 @@ hint_zone_clear(isc_log_t *lctx, isc_mem_t *mem, dns_c_hintzone_t *hzone)
 		isc_mem_free(mem, hzone->file);
 	}
 	
+	if (hzone->pubkeylist != NULL)
+		dns_c_pklist_delete(lctx, &hzone->pubkeylist);
+	
 	return (ISC_R_SUCCESS);
 }
 
diff --git a/lib/dns/include/dns/confacl.h b/lib/dns/include/dns/confacl.h
index 752e309a38..406622744b 100644
--- a/lib/dns/include/dns/confacl.h
+++ b/lib/dns/include/dns/confacl.h
@@ -63,6 +63,16 @@
 
 #include <dns/confip.h>
 
+
+#define DNS_C_CONFACL_MAGIC	0x4361636cU
+#define DNS_C_CONFACLTABLE_MAGIC 0x32616354U
+
+#define DNS_C_CONFACL_VALID(confacl) \
+	ISC_MAGIC_VALID(confacl, DNS_C_CONFACL_MAGIC)
+#define DNS_C_CONFACLTABLE_VALID(confacltable) \
+	ISC_MAGIC_VALID(confacltable, DNS_C_CONFACLTABLE_MAGIC)
+
+
 /***
  *** Types
  ***/
diff --git a/lib/dns/include/dns/confctl.h b/lib/dns/include/dns/confctl.h
index 9a6ee027d2..c025e11928 100644
--- a/lib/dns/include/dns/confctl.h
+++ b/lib/dns/include/dns/confctl.h
@@ -65,6 +65,16 @@
 #include <dns/confip.h>
 
 
+#define DNS_C_CONFCTL_MAGIC	0x4363746cU
+#define DNS_C_CONFCTLLIST_MAGIC	0x4354424cU
+
+#define DNS_C_CONFCTLLIST_VALID(ptr) \
+		ISC_MAGIC_VALID(ptr, DNS_C_CONFCTLLIST_MAGIC)
+#define DNS_C_CONFCTL_VALID(ptr) \
+		ISC_MAGIC_VALID(ptr, DNS_C_CONFCTL_MAGIC)
+
+
+
 /***
  *** Types
  ***/
diff --git a/lib/dns/include/dns/confctx.h b/lib/dns/include/dns/confctx.h
index eaa2075a9d..038d3a72f8 100644
--- a/lib/dns/include/dns/confctx.h
+++ b/lib/dns/include/dns/confctx.h
@@ -69,6 +69,13 @@
 #include <dns/confcache.h>
 #include <dns/confresolv.h>
 
+#define DNS_C_CONFIG_MAGIC		0x434f4e46U /* CONF */
+#define DNS_C_OPTION_MAGIC		0x4f707473U /* Opts */
+
+#define DNS_C_CONFCTX_VALID(ptr) ISC_MAGIC_VALID(ptr, DNS_C_CONFIG_MAGIC)
+#define DNS_C_CONFOPT_VALID(ptr) ISC_MAGIC_VALID(ptr, DNS_C_OPTION_MAGIC)
+
+
 
 /***
  *** Types
diff --git a/lib/dns/include/dns/confip.h b/lib/dns/include/dns/confip.h
index fb39e789dc..2d6bdc2e18 100644
--- a/lib/dns/include/dns/confip.h
+++ b/lib/dns/include/dns/confip.h
@@ -63,6 +63,22 @@
 #include <dns/confcommon.h>
 
 
+#define DNS_C_IPLIST_MAGIC 0x49706c73	/* Ipls */ /* dns_c_iplist */
+#define DNS_C_IPMDIRECT_MAGIC 0x49506d64 /* IPmd */ /* dns_c_ipmatch_direct */
+#define DNS_C_IPMINDIRECT_MAGIC 0x69506d69 /* iPmi */ /* dns_c_ipmatch_indirect */
+#define DNS_C_IPMELEM_MAGIC 0x49704d65	/* IpMe */ /* dns_c_ipmatch_element */
+#define DNS_C_IPMLIST_MAGIC 0x69706d6c	/* ipml */ /* dns_c_ipmatchlist */
+
+#define DNS_C_IPLIST_VALID(ptr)	ISC_MAGIC_VALID(ptr,DNS_C_IPLIST_MAGIC)
+#define DNS_C_IPDIRECT_VALID(ptr) ISC_MAGIC_VALID(ptr, DNS_C_IPMDIRECT_MAGIC)
+#define DNS_C_IPINDIRECT_VALID(ptr) \
+	ISC_MAGIC_VALID(ptr, DNS_C_IPMINDIRECT_MAGIC)
+#define DNS_C_IPMELEM_VALID(ptr) ISC_MAGIC_VALID(ptr, DNS_C_IPMELEM_MAGIC)
+#define DNS_C_IPMLIST_VALID(ptr) ISC_MAGIC_VALID(ptr, DNS_C_IPMLIST_MAGIC)
+
+
+
+
 /***
  *** Types
  ***/
diff --git a/lib/dns/include/dns/confkeys.h b/lib/dns/include/dns/confkeys.h
index 219da794a7..4a7d850128 100644
--- a/lib/dns/include/dns/confkeys.h
+++ b/lib/dns/include/dns/confkeys.h
@@ -61,6 +61,25 @@
 #include <dns/log.h>
 
 
+#define DNS_C_TKEY_MAGIC		0x544b4559 /* TKEY */
+#define DNS_C_TKEYLIST_MAGIC		0x544b4c53 /* TKLS */
+#define DNS_C_PUBKEY_MAGIC		0x5055424b /* PUBK */
+#define DNS_C_PKLIST_MAGIC		0x504b4c53 /* PKLS */
+#define DNS_C_KDEF_MAGIC		0x4b444546 /* KDEF */
+#define DNS_C_KDEFLIST_MAGIC		0x4b4c5354 /* KLST */
+#define DNS_C_KEYID_MAGIC		0x4b455949 /* KEYI */
+#define DNS_C_KEYIDLIST_MAGIC		0x4b494c53 /* KILS */
+
+#define DNS_C_TKEY_VALID(ptr)	   ISC_MAGIC_VALID(ptr, DNS_C_TKEY_MAGIC)
+#define DNS_C_TKEYLIST_VALID(ptr)  ISC_MAGIC_VALID(ptr, DNS_C_TKEYLIST_MAGIC)
+#define DNS_C_PUBKEY_VALID(ptr)	   ISC_MAGIC_VALID(ptr, DNS_C_PUBKEY_MAGIC)
+#define DNS_C_PKLIST_VALID(ptr)	   ISC_MAGIC_VALID(ptr, DNS_C_PKLIST_MAGIC)
+#define DNS_C_KDEF_VALID(ptr)	   ISC_MAGIC_VALID(ptr, DNS_C_KDEF_MAGIC)
+#define DNS_C_KDEFLIST_VALID(ptr)  ISC_MAGIC_VALID(ptr, DNS_C_KDEFLIST_MAGIC)
+#define DNS_C_KEYID_VALID(ptr)	   ISC_MAGIC_VALID(ptr, DNS_C_KEYID_MAGIC)
+#define DNS_C_KEYIDLIST_VALID(ptr) ISC_MAGIC_VALID(ptr, DNS_C_KEYIDLIST_MAGIC)
+
+
 
 /***
  *** Types
@@ -68,6 +87,7 @@
 
 
 typedef struct dns_c_pubkey		dns_c_pubkey_t;
+typedef struct dns_c_pklist		dns_c_pklist_t;
 typedef struct dns_c_tkey		dns_c_tkey_t;
 typedef struct dns_c_tkey_list		dns_c_tkeylist_t;
 typedef struct dns_c_kdef		dns_c_kdef_t;
@@ -79,6 +99,7 @@ typedef struct dns_c_kid_list		dns_c_kidlist_t;
 /* The type for holding a trusted key value. */
 struct dns_c_tkey
 {
+	isc_uint32_t		magic;
 	isc_mem_t	       *mem;
 	
 	char		       *domain;
@@ -90,6 +111,7 @@ struct dns_c_tkey
 /* A list of trusted keys. */
 struct dns_c_tkey_list
 {
+	isc_uint32_t		magic;
 	isc_mem_t	       *mem;
 
 	ISC_LIST(dns_c_tkey_t)	tkeylist;
@@ -99,17 +121,30 @@ struct dns_c_tkey_list
 /* A public key value */
 struct dns_c_pubkey
 {
+	isc_uint32_t	magic;
 	isc_mem_t      *mem;
 	isc_int32_t	flags;
 	isc_int32_t	protocol;
 	isc_int32_t	algorithm;
 	char	       *key;
+
+	ISC_LINK(dns_c_pubkey_t)	next;
+};
+
+/* A list of pubkeys */
+struct dns_c_pklist
+{
+	isc_uint32_t			magic;
+	isc_mem_t		       *mem;
+
+	ISC_LIST(dns_c_pubkey_t)	keylist;
 };
 
 
 /* A private key definition from a 'key' statement */
 struct dns_c_kdef 
 {
+	isc_uint32_t		magic;
 	dns_c_kdeflist_t      *mylist;	
 
 	char		       *keyid;
@@ -123,6 +158,7 @@ struct dns_c_kdef
 /* A list of private keys */
 struct dns_c_kdef_list
 {
+	isc_uint32_t		magic;
 	isc_mem_t	       *mem;
 
 	ISC_LIST(dns_c_kdef_t)	keydefs;
@@ -132,6 +168,7 @@ struct dns_c_kdef_list
 /* A key id for in a server statement 'keys' list */
 struct dns_c_kid
 {
+	isc_uint32_t		magic;
 	dns_c_kidlist_t	      *mylist;
 	char		       *keyid;
 
@@ -143,6 +180,7 @@ struct dns_c_kid
 struct dns_c_kid_list
 {
 	isc_mem_t	       *mem;
+	isc_uint32_t		magic;
 
 	ISC_LIST(dns_c_kid_t)	keyids;
 };
@@ -152,6 +190,29 @@ struct dns_c_kid_list
  *** Functions
  ***/
 
+isc_result_t	dns_c_pklist_new(isc_log_t *lctx, isc_mem_t *mem,
+                                 dns_c_pklist_t **pklist);
+isc_result_t	dns_c_pklist_delete(isc_log_t *lctx, dns_c_pklist_t **list);
+isc_result_t	dns_c_pklist_addpubkey(isc_log_t *lctx, dns_c_pklist_t *list,
+                                       dns_c_pubkey_t *pkey,
+                                       isc_boolean_t deepcopy);
+isc_result_t	dns_c_pklist_findpubkey(isc_log_t *lctx, dns_c_pklist_t *list,
+					dns_c_pubkey_t **pubkey,
+					isc_int32_t flags,
+					isc_int32_t protocol,
+					isc_int32_t algorithm,
+					const char *key);
+isc_result_t	dns_c_pklist_rmpubkey(isc_log_t *lctx, dns_c_pklist_t *list,
+				      isc_int32_t flags,
+				      isc_int32_t protocol,
+				      isc_int32_t algorithm,
+				      const char *key);
+void		dns_c_pklist_print(isc_log_t *lctx,
+				   FILE *fp, int indent,
+				   dns_c_pklist_t *pubkey);
+
+
+
 isc_result_t	dns_c_pubkey_new(isc_log_t *lctx,
 				 isc_mem_t *mem, isc_int32_t flags,
 				 isc_int32_t protocol,
diff --git a/lib/dns/include/dns/conflog.h b/lib/dns/include/dns/conflog.h
index 85761a4e9b..fa0354e3e0 100644
--- a/lib/dns/include/dns/conflog.h
+++ b/lib/dns/include/dns/conflog.h
@@ -60,6 +60,15 @@
 
 #include <dns/confcommon.h>
 
+#define DNS_C_LOGCHAN_MAGIC		0x4c434841 /* LCHA */
+#define DNS_C_LOGCAT_MAGIC		0x4c434154 /* LCAT */
+#define DNS_C_LOGLIST_MAGIC		0x4c4c5354 /* LLST */
+
+
+#define DNS_C_LOGCHAN_VALID(ptr) ISC_MAGIC_VALID(ptr, DNS_C_LOGCHAN_MAGIC)
+#define DNS_C_LOGCAT_VALID(ptr)	ISC_MAGIC_VALID(ptr, DNS_C_LOGCAT_MAGIC)
+#define DNS_C_LOGLIST_VALID(ptr) ISC_MAGIC_VALID(ptr, DNS_C_LOGLIST_MAGIC)
+
 
 /***
  *** Types
@@ -72,8 +81,9 @@ typedef struct dns_c_logging_list	dns_c_logginglist_t;
 /* The structure that holds the list of channel and category definitions */
 struct dns_c_logging_list
 {
+	isc_uint32_t			magic;
 	isc_mem_t		       *mem;
-
+	
 	ISC_LIST(dns_c_logchan_t)	channels;
 	ISC_LIST(dns_c_logcat_t)	categories;
 };
@@ -82,6 +92,7 @@ struct dns_c_logging_list
 /* Definition of a logging channel */
 struct dns_c_logchan
 {
+	isc_uint32_t			magic;
 	isc_mem_t		       *mem;
 
 	char			       *name;
@@ -120,6 +131,7 @@ struct dns_c_logchan
 /* Structure for holding a category definition */
 struct dns_c_logcat
 {
+	isc_uint32_t			magic;
 	isc_mem_t		       *mem;
 
 	dns_c_category_t		category;
diff --git a/lib/dns/include/dns/conflsn.h b/lib/dns/include/dns/conflsn.h
index cb903b83a6..536d9cdd72 100644
--- a/lib/dns/include/dns/conflsn.h
+++ b/lib/dns/include/dns/conflsn.h
@@ -62,6 +62,14 @@
 
 #include <dns/confip.h>
 
+#define DNS_C_LISTEN_MAGIC	0x4c49534eU /* LISN */
+#define DNS_C_LLIST_MAGIC		0x4c6c6973U /* Llis */
+
+#define DNS_C_LISTEN_VALID(l)	ISC_MAGIC_VALID(l, DNS_C_LISTEN_MAGIC)
+#define DNS_C_LISTENLIST_VALID(l) ISC_MAGIC_VALID(l, DNS_C_LLIST_MAGIC)
+
+
+
 /***
  *** Types
  ***/
diff --git a/lib/dns/include/dns/confrrset.h b/lib/dns/include/dns/confrrset.h
index 8326ff7866..ef631249b3 100644
--- a/lib/dns/include/dns/confrrset.h
+++ b/lib/dns/include/dns/confrrset.h
@@ -59,6 +59,14 @@
 #include <dns/confcommon.h>
 
 
+#define DNS_C_RRSOLIST_MAGIC		0x5252534c /* RRSL */
+#define DNS_C_RRSO_MAGIC			0x7272736f /* rrso */
+
+#define DNS_C_RRSOLIST_VALID(ptr) ISC_MAGIC_VALID(ptr, DNS_C_RRSOLIST_MAGIC)
+#define DNS_C_RRSO_VALID(ptr)	ISC_MAGIC_VALID(ptr, DNS_C_RRSO_MAGIC)
+
+
+
 /***
  *** Types
  ***/
@@ -70,6 +78,8 @@ typedef struct dns_c_rrso_list		dns_c_rrsolist_t;
 
 struct dns_c_rrso 
 {
+	isc_uint32_t		magic;
+	
 	isc_mem_t	       *mem;
 	
 	dns_rdataclass_t	oclass;
@@ -83,6 +93,8 @@ struct dns_c_rrso
 
 struct dns_c_rrso_list
 {
+	isc_uint32_t		magic;
+	
 	isc_mem_t	       *mem;
 
 	ISC_LIST(dns_c_rrso_t)	elements;
diff --git a/lib/dns/include/dns/confserv.h b/lib/dns/include/dns/confserv.h
index 7852d8070e..d19391b585 100644
--- a/lib/dns/include/dns/confserv.h
+++ b/lib/dns/include/dns/confserv.h
@@ -60,6 +60,14 @@
 #include <dns/confcommon.h>
 #include <dns/confkeys.h>
 
+
+#define DNS_C_SRVLIST_MAGIC	0x7365524c /* seRL */
+#define DNS_C_SRV_MAGIC		0x53457276 /* SErv */
+
+#define DNS_C_SRVLIST_VALID(ptr) ISC_MAGIC_VALID(ptr, DNS_C_SRVLIST_MAGIC)
+#define DNS_C_SRV_VALID(ptr)	 ISC_MAGIC_VALID(ptr, DNS_C_SRV_MAGIC)
+
+
 /***
  *** Types
  ***/
@@ -69,6 +77,8 @@ typedef struct dns_c_srv_list		dns_c_srvlist_t;
 
 struct dns_c_srv_list
 {
+	isc_uint32_t		magic;
+	
 	isc_mem_t	       *mem;
 
 	ISC_LIST(dns_c_srv_t) elements;
@@ -77,6 +87,8 @@ struct dns_c_srv_list
 
 struct dns_c_srv 
 {
+	isc_uint32_t		magic;
+	
 	isc_mem_t	       *mem;
 
 	isc_sockaddr_t		address;
diff --git a/lib/dns/include/dns/confview.h b/lib/dns/include/dns/confview.h
index e09acfc3fb..0f8a401db4 100644
--- a/lib/dns/include/dns/confview.h
+++ b/lib/dns/include/dns/confview.h
@@ -73,7 +73,11 @@
 #include <dns/conflsn.h>
 #include <dns/confrrset.h>
 
+#define DNS_C_VIEWTABLE_MAGIC		0x76497774 /* vIwt */
+#define DNS_C_VIEW_MAGIC 		0x56696557 /* VieW */
 
+#define DNS_C_VIEWTABLE_VALID(ptr)  ISC_MAGIC_VALID(ptr, DNS_C_VIEWTABLE_MAGIC)
+#define DNS_C_VIEW_VALID(ptr)       ISC_MAGIC_VALID(ptr, DNS_C_VIEW_MAGIC)
 /***
  *** Types
  ***/
@@ -84,6 +88,8 @@ typedef struct dns_c_viewtable		dns_c_viewtable_t;
 
 struct dns_c_viewtable
 {
+	isc_uint32_t		magic;
+	
 	isc_mem_t	       *mem;
 
 	ISC_LIST(dns_c_view_t)	views;
@@ -92,6 +98,8 @@ struct dns_c_viewtable
 
 struct dns_c_view
 {
+	isc_uint32_t		magic;
+	
 	isc_mem_t	       *mem;
 	
 	char 		       *name;
diff --git a/lib/dns/include/dns/confzone.h b/lib/dns/include/dns/confzone.h
index 1d0510ed55..4962e83658 100644
--- a/lib/dns/include/dns/confzone.h
+++ b/lib/dns/include/dns/confzone.h
@@ -111,7 +111,7 @@ struct dns_c_master_zone
 	char		       *ixfr_tmp;
 	isc_int32_t		max_ixfr_log;
 	isc_boolean_t		maint_ixfr_base;
-	dns_c_pubkey_t	       *pubkey;
+	dns_c_pklist_t	       *pubkeylist;
 
 	dns_c_forw_t		forward;
 	dns_c_iplist_t	       *forwarders;
@@ -134,7 +134,7 @@ struct dns_c_slave_zone
 	char		       *ixfr_tmp;
 	isc_boolean_t		maint_ixfr_base;
 	isc_int32_t		max_ixfr_log;
-	dns_c_pubkey_t	       *pubkey;
+	dns_c_pklist_t	       *pubkeylist;
 	in_port_t		master_port;
 	dns_c_iplist_t	       *master_ips;
 	isc_sockaddr_t		transfer_source;
@@ -155,7 +155,7 @@ struct dns_c_stub_zone
 	dns_c_ipmatchlist_t    *allow_query;
 	dns_c_ipmatchlist_t    *allow_transfer; /* should be here??? */
 	isc_boolean_t		dialup;
-	dns_c_pubkey_t	       *pubkey;
+	dns_c_pklist_t	       *pubkeylist;
 	in_port_t		master_port;
 	dns_c_iplist_t	       *master_ips;
 	isc_sockaddr_t		transfer_source; 
@@ -183,6 +183,7 @@ struct dns_c_hint_zone
 {
 	char		       *file;
 	dns_c_severity_t	check_names;
+	dns_c_pklist_t	       *pubkeylist;
 
 	dns_c_setbits_t		setflags;
 };
@@ -279,7 +280,7 @@ isc_result_t	dns_c_zone_setixfrbase(isc_log_t *lctx, dns_c_zone_t *zone,
 				       const char *newval);
 isc_result_t	dns_c_zone_setixfrtmp(isc_log_t *lctx, dns_c_zone_t *zone,
 				      const char *newval);
-isc_result_t	dns_c_zone_setpubkey(isc_log_t *lctx, dns_c_zone_t *zone,
+isc_result_t	dns_c_zone_addpubkey(isc_log_t *lctx, dns_c_zone_t *zone,
 				     dns_c_pubkey_t *pubkey,
 				     isc_boolean_t deepcopy);
 isc_result_t	dns_c_zone_setmasterport(isc_log_t *lctx, dns_c_zone_t *zone,
@@ -328,8 +329,8 @@ isc_result_t	dns_c_zone_getixfrbase(isc_log_t *lctx, dns_c_zone_t *zone,
 				       const char **retval);
 isc_result_t	dns_c_zone_getixfrtmp(isc_log_t *lctx, dns_c_zone_t *zone,
 				      const char **retval);
-isc_result_t	dns_c_zone_getpubkey(isc_log_t *lctx, dns_c_zone_t *zone,
-				     dns_c_pubkey_t **retval);
+isc_result_t	dns_c_zone_getpubkeylist(isc_log_t *lctx, dns_c_zone_t *zone,
+				     dns_c_pklist_t **retval);
 isc_result_t	dns_c_zone_getmasterport(isc_log_t *lctx, dns_c_zone_t *zone,
 					 in_port_t *retval);
 isc_result_t	dns_c_zone_getmasterips(isc_log_t *lctx, dns_c_zone_t *zone,
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index f8ac09da98..dd70a81b85 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
- /* $Id: zone.c,v 1.36 1999/11/17 21:52:32 brister Exp $ */
+ /* $Id: zone.c,v 1.37 1999/12/01 16:28:53 brister Exp $ */
 
 #include <config.h>
 
@@ -2393,6 +2393,7 @@ dns_zone_copy(isc_log_t *lctx, dns_c_ctx_t *ctx, dns_c_zone_t *czone,
 	dns_c_severity_t severity;
 	dns_c_iplist_t *iplist = NULL;
 	dns_c_pubkey_t *pubkey = NULL;
+	dns_c_pklist_t *pubkeylist = NULL;
 	isc_uint32_t i;
 	isc_sockaddr_t sockaddr;
 	isc_int32_t xfrtime;
@@ -2486,13 +2487,25 @@ dns_zone_copy(isc_log_t *lctx, dns_c_ctx_t *ctx, dns_c_zone_t *czone,
 		} else
 			dns_zone_clearnotify(zone);
 
+#if 1					/* XXX brister */
+		
+		iresult = dns_c_zone_getpubkeylist(lctx, czone, &pubkeylist);
+		if (iresult == ISC_R_SUCCESS) {
+			pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
+		}
+		dns_zone_setpubkey(zone, pubkey);
+
+#else
+		
 		iresult = dns_c_zone_getpubkey(lctx, czone, &pubkey);
 		if (iresult == ISC_R_SUCCESS)
 			dns_zone_setpubkey(zone, pubkey);
 		else
 			dns_zone_setpubkey(zone, NULL);
 		break;
-
+		
+#endif	
+		
 	case dns_c_zone_forward:
 #ifdef notyet
 		/*
@@ -2526,12 +2539,24 @@ dns_zone_copy(isc_log_t *lctx, dns_c_ctx_t *ctx, dns_c_zone_t *czone,
 		} else
 			dns_zone_clearqueryacl(zone);
 
+#if 1					/* XXX brister */
+		
+		iresult = dns_c_zone_getpubkeylist(lctx, czone, &pubkeylist);
+		if (iresult == ISC_R_SUCCESS) {
+			pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
+		}
+		dns_zone_setpubkey(zone, pubkey);
+
+#else
+		
 		iresult = dns_c_zone_getpubkey(lctx, czone, &pubkey);
 		if (iresult == ISC_R_SUCCESS)
 			dns_zone_setpubkey(zone, pubkey);
 		else
 			dns_zone_setpubkey(zone, NULL);
 
+#endif
+		
 		iresult = dns_c_zone_getmasterport(lctx, czone, &port);
 		if (iresult != ISC_R_SUCCESS)
 			port = 53;
@@ -2584,12 +2609,24 @@ dns_zone_copy(isc_log_t *lctx, dns_c_ctx_t *ctx, dns_c_zone_t *czone,
 		} else
 			dns_zone_clearqueryacl(zone);
 
+#if 1					/* XXX brister */
+		
+		iresult = dns_c_zone_getpubkeylist(lctx, czone, &pubkeylist);
+		if (iresult == ISC_R_SUCCESS) {
+			pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
+		}
+		dns_zone_setpubkey(zone, pubkey);
+
+#else
+		
 		iresult = dns_c_zone_getpubkey(lctx, czone, &pubkey);
 		if (iresult == ISC_R_SUCCESS)
 			dns_zone_setpubkey(zone, pubkey);
 		else
 			dns_zone_setpubkey(zone, NULL);
 
+#endif	
+
 		iresult = dns_c_zone_getmasterport(lctx, czone, &port);
 		if (iresult != ISC_R_SUCCESS)
 			port = 53;
@@ -2635,12 +2672,24 @@ dns_zone_copy(isc_log_t *lctx, dns_c_ctx_t *ctx, dns_c_zone_t *czone,
 		else
 			dns_zone_setchecknames(zone, dns_c_severity_fail);
 
+#if 1					/* XXX brister */
+		
+		iresult = dns_c_zone_getpubkeylist(lctx, czone, &pubkeylist);
+		if (iresult == ISC_R_SUCCESS) {
+			pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
+		}
+		dns_zone_setpubkey(zone, pubkey);
+
+#else
+		
 		iresult = dns_c_zone_getpubkey(lctx, czone, &pubkey);
 		if (iresult == ISC_R_SUCCESS)
 			dns_zone_setpubkey(zone, pubkey);
 		else
 			dns_zone_setpubkey(zone, NULL);
 		break;
+
+#endif	
 	}
 
 	return (DNS_R_SUCCESS);