CVE-2024-25638: Insufficient Information (NVD-CWE-noinfo)
value: dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-22T14:15Z
Repository: https://github.com/dnsjava/dnsjava
Language: Java
Files changed: EXAMPLES.md, README.adoc, pom.xml, src/main/java/org/xbill/DNS/A6Record.java, src/main/java/org/xbill/DNS/AAAARecord.java, src/main/java/org/xbill/DNS/AFSDBRecord.java, src/main/java/org/xbill/DNS/APLRecord.java, src/main/java/org/xbill/DNS/ARecord.java, src/main/java/org/xbill/DNS/CAARecord.java, src/main/java/org/xbill/DNS/CDNSKEYRecord.java, src/main/java/org/xbill/DNS/CDSRecord.java, src/main/java/org/xbill/DNS/CERTRecord.java, src/main/java/org/xbill/DNS/CNAMERecord.java, src/main/java/org/xbill/DNS/ClientSubnetOption.java, src/main/java/org/xbill/DNS/CookieOption.java, src/main/java/org/xbill/DNS/DHCIDRecord.java, src/main/java/org/xbill/DNS/DLVRecord.java, src/main/java/org/xbill/DNS/DNAMERecord.java, src/main/java/org/xbill/DNS/DNSKEYRecord.java, src/main/java/org/xbill/DNS/DNSSEC.java, src/main/java/org/xbill/DNS/DSRecord.java, src/main/java/org/xbill/DNS/DohResolver.java, src/main/java/org/xbill/DNS/EDNSOption.java, src/main/java/org/xbill/DNS/ExtendedErrorCodeOption.java, src/main/java/org/xbill/DNS/GPOSRecord.java, src/main/java/org/xbill/DNS/HINFORecord.java, src/main/java/org/xbill/DNS/HTTPSRecord.java, src/main/java/org/xbill/DNS/IPSECKEYRecord.java, src/main/java/org/xbill/DNS/ISDNRecord.java, src/main/java/org/xbill/DNS/KEYRecord.java, src/main/java/org/xbill/DNS/KXRecord.java, src/main/java/org/xbill/DNS/LOCRecord.java, src/main/java/org/xbill/DNS/MBRecord.java, src/main/java/org/xbill/DNS/MDRecord.java, src/main/java/org/xbill/DNS/MFRecord.java, src/main/java/org/xbill/DNS/MGRecord.java, src/main/java/org/xbill/DNS/MINFORecord.java, src/main/java/org/xbill/DNS/MRRecord.java, src/main/java/org/xbill/DNS/MXRecord.java, src/main/java/org/xbill/DNS/NAPTRRecord.java, src/main/java/org/xbill/DNS/NSAPRecord.java, src/main/java/org/xbill/DNS/NSAP_PTRRecord.java, src/main/java/org/xbill/DNS/NSEC3PARAMRecord.java, src/main/java/org/xbill/DNS/NSEC3Record.java, src/main/java/org/xbill/DNS/NSECRecord.java, src/main/java/org/xbill/DNS/NSIDOption.java, src/main/java/org/xbill/DNS/NSRecord.java, src/main/java/org/xbill/DNS/NULLRecord.java, src/main/java/org/xbill/DNS/NXTRecord.java, src/main/java/org/xbill/DNS/NioTcpClient.java, src/main/java/org/xbill/DNS/NioUdpClient.java, src/main/java/org/xbill/DNS/OPENPGPKEYRecord.java, src/main/java/org/xbill/DNS/OPTRecord.java, src/main/java/org/xbill/DNS/Opcode.java, src/main/java/org/xbill/DNS/PTRRecord.java, src/main/java/org/xbill/DNS/PXRecord.java, src/main/java/org/xbill/DNS/RPRecord.java, src/main/java/org/xbill/DNS/RRSIGRecord.java, src/main/java/org/xbill/DNS/RTRecord.java, src/main/java/org/xbill/DNS/SIGRecord.java, src/main/java/org/xbill/DNS/SMIMEARecord.java, src/main/java/org/xbill/DNS/SOARecord.java, src/main/java/org/xbill/DNS/SPFRecord.java, src/main/java/org/xbill/DNS/SRVRecord.java, src/main/java/org/xbill/DNS/SSHFPRecord.java, src/main/java/org/xbill/DNS/SVCBBase.java, src/main/java/org/xbill/DNS/SVCBRecord.java, src/main/java/org/xbill/DNS/TKEYRecord.java, src/main/java/org/xbill/DNS/TLSARecord.java, src/main/java/org/xbill/DNS/TSIG.java, src/main/java/org/xbill/DNS/TSIGRecord.java, src/main/java/org/xbill/DNS/TXTRecord.java, src/main/java/org/xbill/DNS/TcpKeepaliveOption.java, src/main/java/org/xbill/DNS/Type.java, src/main/java/org/xbill/DNS/URIRecord.java, src/main/java/org/xbill/DNS/WKSRecord.java, src/main/java/org/xbill/DNS/X25Record.java, src/main/java/org/xbill/DNS/ZoneMDRecord.java, src/main/java/org/xbill/DNS/lookup/LookupSession.java, src/main/java/org/xbill/DNS/lookup/NoSuchRRSetException.java, src/test/java/org/xbill/DNS/dnssec/ResolveExample.java
Commit date: 2024-07-21 13:34:12 +0200
Commit message: Fix links to RFCs and IANA registries

Diff: diff --git a/EXAMPLES.md b/EXAMPLES.md
index 98229e1b..a6f6d4c6 100644
--- a/EXAMPLES.md
+++ b/EXAMPLES.md
@@ -142,11 +142,11 @@ public class ResolveExample {
         sendAndPrint(sr, "www.dnssec-failed.org.");
         sendAndPrint(sr, "nic.ch.");
 
         // Send the same queries using the validating resolver with the
         // trust anchor of the root zone
-        // http://data.iana.org/root-anchors/root-anchors.xml
+        // https://data.iana.org/root-anchors/root-anchors.xml
         ValidatingResolver vr = new ValidatingResolver(sr);
         vr.loadTrustAnchors(new ByteArrayInputStream(ROOT.getBytes(StandardCharsets.US_ASCII)));
         System.out.println("\n\nValidating resolver:");
         sendAndPrint(vr, "www.dnssec-failed.org.");
         sendAndPrint(vr, "nic.ch.");
diff --git a/README.adoc b/README.adoc
index e4c7e92f..11e92d5b 100644
--- a/README.adoc
+++ b/README.adoc
@@ -128,11 +128,11 @@ If disabled, such records are copied from the upstream and presented to the clie
 |Integer
 |1000
 |5000
 
 .2+|org.jitsi.dnssec.nsec3.iterations.N
-3+a|Maximum iteration count for the NSEC3 hashing function depending on the key size N. The defaults are from https://www.rfc-editor.org/rfc/rfc5155.html#section-10.3[RFC5155].
+3+a|Maximum iteration count for the NSEC3 hashing function depending on the key size N. The defaults are from https://datatracker.ietf.org/doc/html/rfc5155#section-10.3[RFC5155].
 |Integer
 2+a|- 1024 bit keys: 150 iterations
 - 2048 bit keys: 500 iterations
 - 4096 bit keys: 2500 iterations
 
@@ -181,11 +181,11 @@ This is limited to avoid the 'KeyTrap' vulnerability (CVE-2023-50387).
 |2
 
 .2+|dnsjava.dnssec.algorithm_enabled.ID
 3+|Enable or disable a DS/DNSKEY algorithm.
 See
-https://www.rfc-editor.org/rfc/rfc8624.html#section-3.1[RFC8624] for recommended values.
+https://datatracker.ietf.org/doc/html/rfc8624#section-3.1[RFC8624] for recommended values.
 Note that algorithm number 1, `RSAMD5`, is disabled and cannot be enabled with this property.
 |Boolean
 2+|Disable ED448:
 `dnsjava.dnssec.algorithm_enabled.16=false`
 
@@ -196,11 +196,11 @@ Note that algorithm number 1, `RSAMD5`, is disabled and cannot be enabled with t
 |512
 
 .2+|dnsjava.dnssec.digest_enabled.ID
 3+|Enable or disable a DS record digest algorithm.
 See
-https://www.rfc-editor.org/rfc/rfc8624.html#section-3.3[RFC8624] for recommended values.
+https://datatracker.ietf.org/doc/html/rfc8624#section-3.3[RFC8624] for recommended values.
 |Boolean
 2+|Disable SHA.1:
 `dnsjava.dnssec.digest_enabled.1=false`
 
 |===
@@ -246,11 +246,11 @@ Before the import into dnsjava, the resolver was developed as an independent lib
 To migrate from dnssecjava, replace `org.jitsi` with `org.xbill.DNS` in Java packages and `org.jitsi` with `dnsjava` in property prefixes.
 
 Validated, secure responses contain the DNS `AD`-flag, while responses that failed validation return the `SERVFAIL`-RCode.
 Insecure responses return the actual return code without the `AD`-flag set.
 The reason why the validation failed or is insecure is provided as a localized string in the additional section under the record ./65280/TXT (a TXT record for the owner name of the root zone in the private query class `ValidatingResolver.VALIDATION_REASON_QCLASS`).
-The Extended DNS Errors (EDE, https://www.rfc-editor.org/rfc/rfc8914.html[RFC8914]) also provides the failure reason, although in less detail.
+The Extended DNS Errors (EDE, https://datatracker.ietf.org/doc/html/rfc8914[RFC8914]) also provides the failure reason, although in less detail.
 
 The link:EXAMPLES.md[examples] contain a small demo.
 
 [IMPORTANT]
 .Do not use the `ValidatingResolver` standalone.
@@ -262,11 +262,11 @@ Subsequent processing and validation of messages is intricate and best done usin
 dnsjava v3 has significant API changes compared to version 2.1.x and is neither source nor binary compatible.
 The most important changes are:
 
 * Requires at least Java 8
 
-* Uses http://www.slf4j.org/[slf4j] for logging and thus needs `slf4j-api`
+* Uses https://www.slf4j.org/[slf4j] for logging and thus needs `slf4j-api`
 on the classpath
 
 * The link:USAGE.md[command line tools] were moved to the `org.xbill.DNS.tools`
 package
 
diff --git a/pom.xml b/pom.xml
index b5d4b5ce..10e1dbf9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project
-    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"
     xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
 
     <modelVersion>4.0.0</modelVersion>
     <groupId>dnsjava</groupId>
     <artifactId>dnsjava</artifactId>
diff --git a/src/main/java/org/xbill/DNS/A6Record.java b/src/main/java/org/xbill/DNS/A6Record.java
index 3d8441ee..7f191524 100644
--- a/src/main/java/org/xbill/DNS/A6Record.java
+++ b/src/main/java/org/xbill/DNS/A6Record.java
@@ -9,11 +9,12 @@ import java.net.UnknownHostException;
 
 /**
  * A6 Record - maps a domain name to an IPv6 address (historic)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc6563">RFC 6563: Moving A6 to Historic Status</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc6563">RFC 6563: Moving A6 to Historic
+ *     Status</a>
  */
 public class A6Record extends Record {
   private int prefixBits;
   private InetAddress suffix;
   private Name prefix;
diff --git a/src/main/java/org/xbill/DNS/AAAARecord.java b/src/main/java/org/xbill/DNS/AAAARecord.java
index 8721e968..a834c2ff 100644
--- a/src/main/java/org/xbill/DNS/AAAARecord.java
+++ b/src/main/java/org/xbill/DNS/AAAARecord.java
@@ -9,12 +9,12 @@ import java.net.UnknownHostException;
 
 /**
  * IPv6 Address Record - maps a domain name to an IPv6 address
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc3596">RFC 3596: DNS Extensions to Support IP Version
- *     6</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc3596">RFC 3596: DNS Extensions to Support
+ *     IP Version 6</a>
  */
 public class AAAARecord extends Record {
   private byte[] address;
 
   AAAARecord() {}
diff --git a/src/main/java/org/xbill/DNS/AFSDBRecord.java b/src/main/java/org/xbill/DNS/AFSDBRecord.java
index 6a41251b..6ca2f052 100644
--- a/src/main/java/org/xbill/DNS/AFSDBRecord.java
+++ b/src/main/java/org/xbill/DNS/AFSDBRecord.java
@@ -5,11 +5,11 @@ package org.xbill.DNS;
 
 /**
  * AFS Data Base Record - maps a domain name to the name of an AFS cell database server.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
  */
 public class AFSDBRecord extends U16NameBase {
   AFSDBRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/APLRecord.java b/src/main/java/org/xbill/DNS/APLRecord.java
index 3a5d3eee..fab315c6 100644
--- a/src/main/java/org/xbill/DNS/APLRecord.java
+++ b/src/main/java/org/xbill/DNS/APLRecord.java
@@ -17,12 +17,12 @@ import org.xbill.DNS.utils.base16;
 
 /**
  * APL - Address Prefix List.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc3123">RFC 3123: A DNS RR Type for Lists of Address
- *     Prefixes (APL RR)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc3123">RFC 3123: A DNS RR Type for Lists of
+ *     Address Prefixes (APL RR)</a>
  */
 public class APLRecord extends Record {
 
   public static class Element {
     public final int family;
diff --git a/src/main/java/org/xbill/DNS/ARecord.java b/src/main/java/org/xbill/DNS/ARecord.java
index cb0e6fa0..6dedde5d 100644
--- a/src/main/java/org/xbill/DNS/ARecord.java
+++ b/src/main/java/org/xbill/DNS/ARecord.java
@@ -9,12 +9,12 @@ import java.net.UnknownHostException;
 
 /**
  * Address Record - maps a domain name to an Internet address
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class ARecord extends Record {
   private int addr;
 
   ARecord() {}
diff --git a/src/main/java/org/xbill/DNS/CAARecord.java b/src/main/java/org/xbill/DNS/CAARecord.java
index 47a4dd20..2fc61cee 100644
--- a/src/main/java/org/xbill/DNS/CAARecord.java
+++ b/src/main/java/org/xbill/DNS/CAARecord.java
@@ -7,12 +7,12 @@ import java.io.IOException;
 
 /**
  * Certification Authority Authorization
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc6844">RFC 6844: DNS Certification Authority
- *     Authorization (CAA) Resource Record</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc6844">RFC 6844: DNS Certification
+ *     Authority Authorization (CAA) Resource Record</a>
  */
 public class CAARecord extends Record {
   public static class Flags {
     private Flags() {}
 
diff --git a/src/main/java/org/xbill/DNS/CDNSKEYRecord.java b/src/main/java/org/xbill/DNS/CDNSKEYRecord.java
index 88790271..778ac69a 100644
--- a/src/main/java/org/xbill/DNS/CDNSKEYRecord.java
+++ b/src/main/java/org/xbill/DNS/CDNSKEYRecord.java
@@ -5,12 +5,12 @@ import java.security.PublicKey;
 
 /**
  * Child DNSKEY record as specified in RFC 8078.
  *
  * @see DNSSEC
- * @see <a href="https://tools.ietf.org/html/rfc8078">RFC 8078: Managing DS Records from the Parent
- *     via CDS/CDNSKEY</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc8078">RFC 8078: Managing DS Records from
+ *     the Parent via CDS/CDNSKEY</a>
  */
 public class CDNSKEYRecord extends DNSKEYRecord {
   CDNSKEYRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/CDSRecord.java b/src/main/java/org/xbill/DNS/CDSRecord.java
index d3e83829..c9eee1fd 100644
--- a/src/main/java/org/xbill/DNS/CDSRecord.java
+++ b/src/main/java/org/xbill/DNS/CDSRecord.java
@@ -3,12 +3,12 @@ package org.xbill.DNS;
 
 /**
  * Child Delegation Signer record as specified in RFC 8078.
  *
  * @see DNSSEC
- * @see <a href="https://tools.ietf.org/html/rfc8078">RFC 8078: Managing DS Records from the Parent
- *     via CDS/CDNSKEY</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc8078">RFC 8078: Managing DS Records from
+ *     the Parent via CDS/CDNSKEY</a>
  */
 public class CDSRecord extends DSRecord {
   CDSRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/CERTRecord.java b/src/main/java/org/xbill/DNS/CERTRecord.java
index 624f6005..5ab7fd0c 100644
--- a/src/main/java/org/xbill/DNS/CERTRecord.java
+++ b/src/main/java/org/xbill/DNS/CERTRecord.java
@@ -10,12 +10,12 @@ import org.xbill.DNS.utils.base64;
  * Certificate Record - Stores a certificate associated with a name. The certificate might also be
  * associated with a KEYRecord.
  *
  * @see KEYRecord
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4398">RFC 4398: Storing Certificates in the Domain
- *     Name System (DNS)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4398">RFC 4398: Storing Certificates in
+ *     the Domain Name System (DNS)</a>
  */
 public class CERTRecord extends Record {
 
   /** Certificate type identifiers. */
   public static class CertificateType {
diff --git a/src/main/java/org/xbill/DNS/CNAMERecord.java b/src/main/java/org/xbill/DNS/CNAMERecord.java
index 0359cf37..5033d9fe 100644
--- a/src/main/java/org/xbill/DNS/CNAMERecord.java
+++ b/src/main/java/org/xbill/DNS/CNAMERecord.java
@@ -5,12 +5,12 @@ package org.xbill.DNS;
 
 /**
  * CNAME Record - maps an alias to its real name
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class CNAMERecord extends SingleCompressedNameBase {
   CNAMERecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/ClientSubnetOption.java b/src/main/java/org/xbill/DNS/ClientSubnetOption.java
index 8d2730a0..6d8df8d0 100644
--- a/src/main/java/org/xbill/DNS/ClientSubnetOption.java
+++ b/src/main/java/org/xbill/DNS/ClientSubnetOption.java
@@ -5,12 +5,11 @@ package org.xbill.DNS;
 
 import java.net.InetAddress;
 import java.net.UnknownHostException;
 
 /**
- * The Client Subnet EDNS Option, defined in <a href="https://tools.ietf.org/html/rfc7871">Client
- * subnet in DNS requests</a>.
+ * The Client Subnet EDNS Option.
  *
  * <p>The option is used to convey information about the IP address of the originating client, so
  * that an authoritative server can make decisions based on this address, rather than the address of
  * the intermediate caching name server.
  *
@@ -20,10 +19,11 @@ import java.net.UnknownHostException;
  * <p>The wire format of the option contains a 2-byte length field (1 for IPv4, 2 for IPv6), a
  * 1-byte source netmask, a 1-byte scope netmask, and an address truncated to the source netmask
  * length (where the final octet is padded with bits set to 0)
  *
  * @see OPTRecord
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc7871">RFC 7871</a>
  * @author Brian Wellington
  * @author Ming Zhou &lt;mizhou@bnivideo.com&gt;, Beaumaris Networks
  */
 public class ClientSubnetOption extends EDNSOption {
   private int family;
diff --git a/src/main/java/org/xbill/DNS/CookieOption.java b/src/main/java/org/xbill/DNS/CookieOption.java
index 17f22472..5228f31b 100644
--- a/src/main/java/org/xbill/DNS/CookieOption.java
+++ b/src/main/java/org/xbill/DNS/CookieOption.java
@@ -4,13 +4,14 @@ package org.xbill.DNS;
 import java.io.IOException;
 import java.util.Optional;
 import org.xbill.DNS.utils.base16;
 
 /**
- * Cookie EDNS0 Option, as defined in https://tools.ietf.org/html/rfc7873
+ * Cookie EDNS0 Option.
  *
  * @see OPTRecord
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc7873">RFC 7873</a>
  * @author Klaus Malorny
  */
 public class CookieOption extends EDNSOption {
 
   /** client cookie */
diff --git a/src/main/java/org/xbill/DNS/DHCIDRecord.java b/src/main/java/org/xbill/DNS/DHCIDRecord.java
index 827c9767..be394707 100644
--- a/src/main/java/org/xbill/DNS/DHCIDRecord.java
+++ b/src/main/java/org/xbill/DNS/DHCIDRecord.java
@@ -8,12 +8,12 @@ import org.xbill.DNS.utils.base64;
 
 /**
  * DHCID - Dynamic Host Configuration Protocol (DHCP) ID (RFC 4701)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4701">RFC 4701: A DNS Resource Record (RR) for
- *     Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4701">RFC 4701: A DNS Resource Record (RR)
+ *     for Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)</a>
  */
 public class DHCIDRecord extends Record {
   private byte[] data;
 
   DHCIDRecord() {}
diff --git a/src/main/java/org/xbill/DNS/DLVRecord.java b/src/main/java/org/xbill/DNS/DLVRecord.java
index 0c19844b..88d16e45 100644
--- a/src/main/java/org/xbill/DNS/DLVRecord.java
+++ b/src/main/java/org/xbill/DNS/DLVRecord.java
@@ -12,12 +12,12 @@ import org.xbill.DNS.utils.base16;
  *
  * @see DNSSEC
  * @see DSRecord
  * @author David Blacka
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4431">RFC 4431: The DNSSEC Lookaside Validation
- *     (DLV) DNS Resource Record</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4431">RFC 4431: The DNSSEC Lookaside
+ *     Validation (DLV) DNS Resource Record</a>
  */
 public class DLVRecord extends Record {
 
   /**
    * SHA1 digest ID for DLV records.
diff --git a/src/main/java/org/xbill/DNS/DNAMERecord.java b/src/main/java/org/xbill/DNS/DNAMERecord.java
index 429aae5b..d088d8f6 100644
--- a/src/main/java/org/xbill/DNS/DNAMERecord.java
+++ b/src/main/java/org/xbill/DNS/DNAMERecord.java
@@ -5,11 +5,12 @@ package org.xbill.DNS;
 
 /**
  * DNAME Record - maps a nonterminal alias (subtree) to a different domain
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc6672">RFC 6672: DNAME Redirection in the DNS</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc6672">RFC 6672: DNAME Redirection in the
+ *     DNS</a>
  */
 public class DNAMERecord extends SingleNameBase {
   DNAMERecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/DNSKEYRecord.java b/src/main/java/org/xbill/DNS/DNSKEYRecord.java
index d9ae2b05..1b868992 100644
--- a/src/main/java/org/xbill/DNS/DNSKEYRecord.java
+++ b/src/main/java/org/xbill/DNS/DNSKEYRecord.java
@@ -10,12 +10,12 @@ import java.security.PublicKey;
  * Key - contains a cryptographic public key for use by DNS. The data can be converted to objects
  * implementing java.security.interfaces.PublicKey
  *
  * @see DNSSEC
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
- *     Security Extensions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
+ *     DNS Security Extensions</a>
  */
 public class DNSKEYRecord extends KEYBase {
 
   public static class Protocol {
     private Protocol() {}
diff --git a/src/main/java/org/xbill/DNS/DNSSEC.java b/src/main/java/org/xbill/DNS/DNSSEC.java
index 64dba7a2..ff8e7efa 100644
--- a/src/main/java/org/xbill/DNS/DNSSEC.java
+++ b/src/main/java/org/xbill/DNS/DNSSEC.java
@@ -44,12 +44,13 @@ public class DNSSEC {
   /** Domain Name System Security (DNSSEC) Algorithm Numbers. */
   public static class Algorithm {
     private Algorithm() {}
 
     /**
-     * Delete DS record in parent zone, RFC8078.
+     * Delete DS record in parent zone.
      *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8078/">RFC 8078</a>
      * @since 3.5
      */
     public static final int DELETE = 0;
 
     /** RSA/MD5 public key (deprecated) */
@@ -77,31 +78,44 @@ public class DNSSEC {
     public static final int RSASHA512 = 10;
 
     /** GOST R 34.10-2001. This requires an external cryptography provider, such as BouncyCastle. */
     public static final int ECC_GOST = 12;
 
-    /** ECDSA Curve P-256 with SHA-256 public key * */
+    /** ECDSA Curve P-256 with SHA-256 public key. */
     public static final int ECDSAP256SHA256 = 13;
 
-    /** ECDSA Curve P-384 with SHA-384 public key * */
+    /** ECDSA Curve P-384 with SHA-384 public key. */
     public static final int ECDSAP384SHA384 = 14;
 
-    /** Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC, RFC8080 */
+    /**
+     * Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8080/">RFC 8080</a>
+     */
     public static final int ED25519 = 15;
 
-    /** Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC, RFC8080 */
+    /**
+     * Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8080/">RFC 8080</a>
+     */
     public static final int ED448 = 16;
 
     /**
-     * SM2 signing algorithm with SM3 hashing algorithm. <a
-     * href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
+     * SM2 signing algorithm with SM3 hashing algorithm.
+     *
+     * @see <a
+     *     href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
+     * @since 3.6
      */
     public static final int SM2SM3 = 17;
 
     /**
-     * GOST R 34.10-2012 <a
-     * href="https://datatracker.ietf.org/doc/draft-makarenko-gost2012-dnssec/05/">draft-makarenko-gost2012-dnssec-05</a>
+     * GOST R 34.10-2012.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc9558/">RFC 9558</a>
+     * @since 3.6
      */
     public static final int ECC_GOST12 = 23;
 
     /** Indirect keys; the actual key is elsewhere. */
     public static final int INDIRECT = 252;
@@ -167,31 +181,52 @@ public class DNSSEC {
    * @since 3.5
    */
   public static class Digest {
     private Digest() {}
 
-    /** SHA-1, RFC3658. */
+    /**
+     * SHA-1.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc3658/">RFC 3658</a>
+     */
     public static final int SHA1 = 1;
 
-    /** SHA-256, RFC4509. */
+    /**
+     * SHA-256.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc4509/">RFC 4509</a>
+     */
     public static final int SHA256 = 2;
 
-    /** GOST R 34.11-94, RFC5933. */
+    /**
+     * GOST R 34.11-94.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5933/">RFC 5933</a>
+     */
     public static final int GOST3411 = 3;
 
-    /** SHA-384, RFC6605. */
+    /**
+     * SHA-384.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6605/">RFC 6605</a>
+     */
     public static final int SHA384 = 4;
 
     /**
-     * SM3 hashing algorithm. <a
-     * href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
+     * GOST R 34.11-2012.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc9558/">RFC 9558</a>
+     * @since 3.6
      */
     public static final int GOST3411_12 = 5;
 
     /**
-     * GOST R 34.10-2012 <a
-     * href="https://datatracker.ietf.org/doc/draft-makarenko-gost2012-dnssec/05/">draft-makarenko-gost2012-dnssec-05</a>
+     * SM3 hashing algorithm.
+     *
+     * @see <a
+     *     href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
+     * @since 3.6
      */
     public static final int SM3 = 6;
 
     private static final Mnemonic algs =
         new Mnemonic("DNSSEC Digest Algorithm", Mnemonic.CASE_UPPER);
diff --git a/src/main/java/org/xbill/DNS/DSRecord.java b/src/main/java/org/xbill/DNS/DSRecord.java
index c87e7b2b..ab279418 100644
--- a/src/main/java/org/xbill/DNS/DSRecord.java
+++ b/src/main/java/org/xbill/DNS/DSRecord.java
@@ -11,12 +11,12 @@ import org.xbill.DNS.utils.base16;
  * parent zone.
  *
  * @see DNSSEC
  * @author David Blacka
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
- *     Security Extensions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
+ *     DNS Security Extensions</a>
  */
 public class DSRecord extends Record {
 
   /**
    * DS digest constants.
diff --git a/src/main/java/org/xbill/DNS/DohResolver.java b/src/main/java/org/xbill/DNS/DohResolver.java
index 6e7d73f3..0933ef18 100644
--- a/src/main/java/org/xbill/DNS/DohResolver.java
+++ b/src/main/java/org/xbill/DNS/DohResolver.java
@@ -33,13 +33,13 @@ import lombok.Value;
 import lombok.extern.slf4j.Slf4j;
 import org.xbill.DNS.AsyncSemaphore.Permit;
 import org.xbill.DNS.utils.base64;
 
 /**
- * Proof-of-concept <a href="https://tools.ietf.org/html/rfc8484">DNS over HTTP (DoH)</a> resolver.
- * This class is not suitable for high load scenarios because of the shortcomings of Java's built-in
- * HTTP clients. For more control, implement your own {@link Resolver} using e.g. <a
+ * Proof-of-concept <a href="https://datatracker.ietf.org/doc/html/rfc8484">DNS over HTTP (DoH)</a>
+ * resolver. This class is not suitable for high load scenarios because of the shortcomings of
+ * Java's built-in HTTP clients. For more control, implement your own {@link Resolver} using e.g. <a
  * href="https://github.com/square/okhttp/">OkHttp</a>.
  *
  * <p>On Java 8, it uses HTTP/1.1, which is against the recommendation of RFC 8484 to use HTTP/2 and
  * thus slower. On Java 11 or newer, HTTP/2 is always used, but the built-in HttpClient has its own
  * <a href="https://bugs.openjdk.java.net/browse/JDK-8225647">issues</a> with connection handling.
diff --git a/src/main/java/org/xbill/DNS/EDNSOption.java b/src/main/java/org/xbill/DNS/EDNSOption.java
index 4de7ad1f..81906f83 100644
--- a/src/main/java/org/xbill/DNS/EDNSOption.java
+++ b/src/main/java/org/xbill/DNS/EDNSOption.java
@@ -20,58 +20,133 @@ public abstract class EDNSOption {
    *     DNS EDNS0 Option Codes (OPT)</a>
    */
   public static class Code {
     private Code() {}
 
-    /** Apple's DNS Long-Lived Queries protocol, draft-sekar-dns-llq-06 */
+    /**
+     * Apple's DNS Long-Lived Queries protocol.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8764/">RFC 8764</a>
+     */
     public static final int LLQ = 1;
 
-    /** Dynamic DNS Update Leases, draft-sekar-dns-ul-02 */
+    /**
+     * Dynamic DNS Update Leases.
+     *
+     * @see <a
+     *     href="https://datatracker.ietf.org/doc/html/draft-sekar-dns-ul-03">draft-sekar-dns-ul-03</a>
+     */
     public static final int UL = 2;
 
-    /** Name Server Identifier, RFC 5001 */
+    /**
+     * Name Server Identifier.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5001/">RFC 5001</a>
+     */
     public static final int NSID = 3;
 
-    /** DNSSEC Algorithm Understood (DAU), RFC 6975 */
+    /**
+     * DNSSEC Algorithm Understood (DAU).
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6975/">RFC 6975</a>
+     */
     public static final int DAU = 5;
 
-    /** DNSSEC DS Hash Understood (DHU), RFC 6975 */
+    /**
+     * DNSSEC DS Hash Understood (DHU).
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8764/">RFC 8764</a>
+     */
     public static final int DHU = 6;
 
-    /** DNSSEC NSEC3 Hash Understood (N3U), RFC 6975 */
+    /**
+     * DNSSEC NSEC3 Hash Understood (N3U).
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6975/">RFC 6975</a>
+     */
     public static final int N3U = 7;
 
-    /** Client Subnet, RFC 7871 */
+    /**
+     * Client Subnet.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7871/">RFC 7871</a>
+     */
     public static final int CLIENT_SUBNET = 8;
 
-    /** (EDNS) EXPIRE Option, RFC 7314 */
+    /**
+     * (EDNS) EXPIRE Option.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7314/">RFC 7314</a>
+     */
     public static final int EDNS_EXPIRE = 9;
 
-    /** Cookie, RFC 7873 */
+    /**
+     * Cookie.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7873/">RFC 7873</a>
+     */
     public static final int COOKIE = 10;
 
-    /** TCP Keepalive, RFC 7828 */
+    /**
+     * TCP Keepalive.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7828/">RFC 7828</a>
+     */
     public static final int TCP_KEEPALIVE = 11;
 
-    /** EDNS(0) Padding Option, RFC 7830 */
+    /**
+     * EDNS(0) Padding Option.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7830/">RFC 7830</a>
+     */
     public static final int PADDING = 12;
 
-    /** CHAIN Query Requests in DNS, RFC 7901 */
+    /**
+     * CHAIN Query Requests in DNS.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7901/">RFC 7901</a>
+     */
     public static final int CHAIN = 13;
 
-    /** Signaling Trust Anchor Knowledge in DNS Security Extensions (DNSSEC), RFC 8145 */
+    /**
+     * Signaling Trust Anchor Knowledge in DNS Security Extensions (DNSSEC).
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8145/">RFC 8145</a>
+     */
     public static final int EDNS_KEY_TAG = 14;
 
-    /** Extended DNS Errors, RFC 8914. */
+    /**
+     * Extended DNS Errors.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8914/">RFC 8914</a>
+     */
     public static final int EDNS_EXTENDED_ERROR = 15;
 
-    /** DNS EDNS Tags, draft-bellis-dnsop-edns-tags-01 */
+    /**
+     * DNS EDNS Tags.
+     *
+     * @see <a
+     *     href="https://datatracker.ietf.org/doc/html/draft-bellis-dnsop-edns-tags-01">draft-bellis-dnsop-edns-tags-01</a>
+     */
     public static final int EDNS_CLIENT_TAG = 16;
 
-    /** DNS EDNS Tags, draft-bellis-dnsop-edns-tags-01 */
+    /**
+     * DNS EDNS Tags.
+     *
+     * @see <a
+     *     href="https://datatracker.ietf.org/doc/html/draft-bellis-dnsop-edns-tags-01">draft-bellis-dnsop-edns-tags-01</a>
+     */
     public static final int EDNS_SERVER_TAG = 17;
 
+    /**
+     * Report Channel.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc9567/">RFC 9567</a>
+     * @since 3.6
+     */
+    public static final int REPORT_CHANNEL = 18;
+
     private static final Mnemonic codes =
         new Mnemonic("EDNS Option Codes", Mnemonic.CASE_SENSITIVE);
 
     static {
       codes.setMaximum(0xFFFF);
@@ -93,10 +168,11 @@ public abstract class EDNSOption {
       codes.add(CHAIN, "CHAIN");
       codes.add(EDNS_KEY_TAG, "edns-key-tag");
       codes.add(EDNS_EXTENDED_ERROR, "Extended_DNS_Error");
       codes.add(EDNS_CLIENT_TAG, "EDNS-Client-Tag");
       codes.add(EDNS_SERVER_TAG, "EDNS-Server-Tag");
+      codes.add(REPORT_CHANNEL, "Report-Channel");
     }
 
     /** Converts an EDNS Option Code into its textual representation */
     public static String string(int code) {
       return codes.getText(code);
diff --git a/src/main/java/org/xbill/DNS/ExtendedErrorCodeOption.java b/src/main/java/org/xbill/DNS/ExtendedErrorCodeOption.java
index b1fbcbc2..1c40d571 100644
--- a/src/main/java/org/xbill/DNS/ExtendedErrorCodeOption.java
+++ b/src/main/java/org/xbill/DNS/ExtendedErrorCodeOption.java
@@ -38,11 +38,13 @@ public class ExtendedErrorCodeOption extends EDNSOption {
    */
   public static final int FORGED_ANSWER = 4;
 
   /**
    * The resolver attempted to perform DNSSEC validation, but validation ended in the Indeterminate
-   * state [RFC4035].
+   * state.
+   *
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc4035>RFC 4035</a>
    */
   public static final int DNSSEC_INDETERMINATE = 5;
 
   /**
    * The resolver attempted to perform DNSSEC validation, but validation ended in the Bogus state.
@@ -161,38 +163,37 @@ public class ExtendedErrorCodeOption extends EDNSOption {
 
   /**
    * DNS over QUIC session resumption error.
    *
    * @since 3.6
-   * @see <a href="https://www.rfc-editor.org/rfc/rfc9250.html#section-4.5-3">RFC9250, 4.5</a>
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9250#section-4.5-3">RFC 9250, 4.5</a>
    */
   public static final int TOO_EARLY = 26;
 
   /**
    * The NSEC3 iterations value is not supported.
    *
    * @since 3.6
-   * @see <a href="https://www.rfc-editor.org/rfc/rfc9276.html#section-3.2">RFC9276, 3.2</a>
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9276#section-3.2">RFC 9276, 3.2</a>
    */
   public static final int UNSUPPORTED_NSEC3_ITERATIONS_VALUE = 27;
 
   /**
    * Unable to conform to policy.
    *
    * @since 3.6
    * @see <a
-   *     href="https://datatracker.ietf.org/doc/draft-homburg-dnsop-codcp/01/">draft-homburg-dnsop-codcp,
-   *     12</a>
+   *     href="https://datatracker.ietf.org/doc/draft-homburg-dnsop-codcp/01/">draft-homburg-dnsop-codcp-01</a>
    */
   public static final int UNABLE_TO_CONFORM_TO_POLICY = 28;
 
   /**
    * Result synthesized from aggressive NSEC cache.
    *
    * @since 3.6
    * @see <a href="https://github.com/PowerDNS/pdns/pull/12334">PowerDNS PR#12334</a>
-   * @see <a href="https://datatracker.ietf.org/doc/html/rfc8198">RFC8198</a>
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc8198">RFC 8198</a>
    */
   public static final int SYNTHESIZED = 29;
 
   @Getter private int errorCode;
   @Getter private String text;
diff --git a/src/main/java/org/xbill/DNS/GPOSRecord.java b/src/main/java/org/xbill/DNS/GPOSRecord.java
index 8911b7f4..1566ccd5 100644
--- a/src/main/java/org/xbill/DNS/GPOSRecord.java
+++ b/src/main/java/org/xbill/DNS/GPOSRecord.java
@@ -8,12 +8,12 @@ import java.io.IOException;
 /**
  * Geographical Location - describes the physical location of a host. (withdrawn -- this was a
  * limited early version of {@link LOCRecord})
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1712">RFC 1712: DNS Encoding of Geographical
- *     Location</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1712">RFC 1712: DNS Encoding of
+ *     Geographical Location</a>
  */
 public class GPOSRecord extends Record {
   private byte[] latitude, longitude, altitude;
 
   GPOSRecord() {}
diff --git a/src/main/java/org/xbill/DNS/HINFORecord.java b/src/main/java/org/xbill/DNS/HINFORecord.java
index 6981ee6b..06d32ec4 100644
--- a/src/main/java/org/xbill/DNS/HINFORecord.java
+++ b/src/main/java/org/xbill/DNS/HINFORecord.java
@@ -7,12 +7,12 @@ import java.io.IOException;
 
 /**
  * Host Information - describes the CPU and OS of a host
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class HINFORecord extends Record {
   private byte[] cpu, os;
 
   HINFORecord() {}
diff --git a/src/main/java/org/xbill/DNS/HTTPSRecord.java b/src/main/java/org/xbill/DNS/HTTPSRecord.java
index 56659f48..785401c4 100644
--- a/src/main/java/org/xbill/DNS/HTTPSRecord.java
+++ b/src/main/java/org/xbill/DNS/HTTPSRecord.java
@@ -2,15 +2,14 @@
 package org.xbill.DNS;
 
 import java.util.List;
 
 /**
- * HTTPS Service Location and Parameter Binding Record
+ * HTTPS Service Location and Parameter Binding Record.
  *
- * @see <a
- *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
  * @since 3.3
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
  */
 public class HTTPSRecord extends SVCBBase {
   HTTPSRecord() {}
 
   public HTTPSRecord(
diff --git a/src/main/java/org/xbill/DNS/IPSECKEYRecord.java b/src/main/java/org/xbill/DNS/IPSECKEYRecord.java
index 5a2439d5..59c5be20 100644
--- a/src/main/java/org/xbill/DNS/IPSECKEYRecord.java
+++ b/src/main/java/org/xbill/DNS/IPSECKEYRecord.java
@@ -10,29 +10,41 @@ import org.xbill.DNS.utils.base64;
 
 /**
  * IPsec Keying Material (RFC 4025)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4025">RFC 4025: A Method for Storing IPsec Keying
- *     Material in DNS</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4025">RFC 4025: A Method for Storing IPsec
+ *     Keying Material in DNS</a>
  */
 public class IPSECKEYRecord extends Record {
   /**
    * Algorithm types for IPSECKEY RRs as defined in <a
    * href="https://www.iana.org/assignments/ipseckey-rr-parameters/ipseckey-rr-parameters.xhtml#ipseckey-rr-parameters-1">IPSECKEY
    * Resource Record Parameters</a>.
    */
   public static class Algorithm {
     private Algorithm() {}
 
-    /** A DSA key is present, in the format defined in [RFC2536] */
+    /**
+     * A DSA key is present.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc2536">RFC 2536</a>
+     */
     public static final int DSA = 1;
 
-    /** A RSA key is present, in the format defined in [RFC3110] */
+    /**
+     * A RSA key is present.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc3110">RFC 3110</a>
+     */
     public static final int RSA = 2;
 
-    /** An ECDSA key is present, in the format defined in [RFC6605] */
+    /**
+     * An ECDSA key is present.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6605">RFC 6605</a>
+     */
     public static final int ECDSA = 3;
   }
 
   /**
    * Gateway types for IPSECKEY RRs as defined in <a
diff --git a/src/main/java/org/xbill/DNS/ISDNRecord.java b/src/main/java/org/xbill/DNS/ISDNRecord.java
index 329f4e78..4e275742 100644
--- a/src/main/java/org/xbill/DNS/ISDNRecord.java
+++ b/src/main/java/org/xbill/DNS/ISDNRecord.java
@@ -7,11 +7,11 @@ import java.io.IOException;
 
 /**
  * ISDN - identifies the ISDN number and subaddress associated with a name.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
  */
 public class ISDNRecord extends Record {
   private byte[] address;
   private byte[] subAddress;
 
diff --git a/src/main/java/org/xbill/DNS/KEYRecord.java b/src/main/java/org/xbill/DNS/KEYRecord.java
index f5b40cb2..2335964b 100644
--- a/src/main/java/org/xbill/DNS/KEYRecord.java
+++ b/src/main/java/org/xbill/DNS/KEYRecord.java
@@ -12,14 +12,14 @@ import java.util.StringTokenizer;
  * java.security.interfaces.PublicKey
  *
  * @see DNSSEC
  * @see DNSKEYRecord
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc2535">RFC 2535: Domain Name System Security
- *     Extensions</a>
- * @see <a href="https://tools.ietf.org/html/rfc3755">RFC 3755: Legacy Resolver Compatibility for
- *     Delegation Signer (DS)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2535">RFC 2535: Domain Name System
+ *     Security Extensions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc3755">RFC 3755: Legacy Resolver
+ *     Compatibility for Delegation Signer (DS)</a>
  */
 public class KEYRecord extends KEYBase {
   /** KEY protocol identifiers. */
   public static class Protocol {
 
diff --git a/src/main/java/org/xbill/DNS/KXRecord.java b/src/main/java/org/xbill/DNS/KXRecord.java
index 5918bfae..7ea5cf9f 100644
--- a/src/main/java/org/xbill/DNS/KXRecord.java
+++ b/src/main/java/org/xbill/DNS/KXRecord.java
@@ -5,12 +5,12 @@ package org.xbill.DNS;
 
 /**
  * Key Exchange - delegation of authority
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc2230">RFC 2230: Key Exchange Delegation Record for
- *     the DNS</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2230">RFC 2230: Key Exchange Delegation
+ *     Record for the DNS</a>
  */
 public class KXRecord extends U16NameBase {
   KXRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/LOCRecord.java b/src/main/java/org/xbill/DNS/LOCRecord.java
index 60d57247..25d06dbd 100644
--- a/src/main/java/org/xbill/DNS/LOCRecord.java
+++ b/src/main/java/org/xbill/DNS/LOCRecord.java
@@ -9,12 +9,12 @@ import java.text.NumberFormat;
 
 /**
  * Location - describes the physical location of hosts, networks, subnets.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1876">RFC 1876: A Means for Expressing Location
- *     Information in the Domain Name System</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1876">RFC 1876: A Means for Expressing
+ *     Location Information in the Domain Name System</a>
  */
 public class LOCRecord extends Record {
   private static final NumberFormat w2;
   private static final NumberFormat w3;
   private long size, hPrecision, vPrecision;
diff --git a/src/main/java/org/xbill/DNS/MBRecord.java b/src/main/java/org/xbill/DNS/MBRecord.java
index 626df3f2..a2fbc91e 100644
--- a/src/main/java/org/xbill/DNS/MBRecord.java
+++ b/src/main/java/org/xbill/DNS/MBRecord.java
@@ -5,12 +5,12 @@ package org.xbill.DNS;
 
 /**
  * Mailbox Record - specifies a host containing a mailbox.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class MBRecord extends SingleNameBase {
   MBRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/MDRecord.java b/src/main/java/org/xbill/DNS/MDRecord.java
index 84077db0..78c6a18d 100644
--- a/src/main/java/org/xbill/DNS/MDRecord.java
+++ b/src/main/java/org/xbill/DNS/MDRecord.java
@@ -5,11 +5,11 @@ package org.xbill.DNS;
 
 /**
  * Mail Destination Record - specifies a mail agent which delivers mail for a domain (obsolete)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc973">RFC 973: Domain System Changes and
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc973">RFC 973: Domain System Changes and
  *     Observations</a>
  */
 public class MDRecord extends SingleNameBase {
   MDRecord() {}
 
diff --git a/src/main/java/org/xbill/DNS/MFRecord.java b/src/main/java/org/xbill/DNS/MFRecord.java
index 55828b61..0e0d59c3 100644
--- a/src/main/java/org/xbill/DNS/MFRecord.java
+++ b/src/main/java/org/xbill/DNS/MFRecord.java
@@ -5,11 +5,11 @@ package org.xbill.DNS;
 
 /**
  * Mail Forwarder Record - specifies a mail agent which forwards mail for a domain (obsolete)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc973">RFC 973: Domain System Changes and
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc973">RFC 973: Domain System Changes and
  *     Observations</a>
  */
 public class MFRecord extends SingleNameBase {
   MFRecord() {}
 
diff --git a/src/main/java/org/xbill/DNS/MGRecord.java b/src/main/java/org/xbill/DNS/MGRecord.java
index 4d0d0fb8..fd5077b1 100644
--- a/src/main/java/org/xbill/DNS/MGRecord.java
+++ b/src/main/java/org/xbill/DNS/MGRecord.java
@@ -5,12 +5,12 @@ package org.xbill.DNS;
 
 /**
  * Mail Group Record - specifies a mailbox which is a member of a mail group.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class MGRecord extends SingleNameBase {
   MGRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/MINFORecord.java b/src/main/java/org/xbill/DNS/MINFORecord.java
index 242600ff..a7300954 100644
--- a/src/main/java/org/xbill/DNS/MINFORecord.java
+++ b/src/main/java/org/xbill/DNS/MINFORecord.java
@@ -8,12 +8,12 @@ import java.io.IOException;
 /**
  * Mailbox information Record - lists the address responsible for a mailing list/mailbox and the
  * address to receive error messages relating to the mailing list/mailbox.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class MINFORecord extends Record {
   private Name responsibleAddress;
   private Name errorAddress;
 
diff --git a/src/main/java/org/xbill/DNS/MRRecord.java b/src/main/java/org/xbill/DNS/MRRecord.java
index 574997ef..68e9f152 100644
--- a/src/main/java/org/xbill/DNS/MRRecord.java
+++ b/src/main/java/org/xbill/DNS/MRRecord.java
@@ -5,12 +5,12 @@ package org.xbill.DNS;
 
 /**
  * Mailbox Rename Record - specifies a rename of a mailbox.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class MRRecord extends SingleNameBase {
   MRRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/MXRecord.java b/src/main/java/org/xbill/DNS/MXRecord.java
index 8a6689f8..f5ec13c7 100644
--- a/src/main/java/org/xbill/DNS/MXRecord.java
+++ b/src/main/java/org/xbill/DNS/MXRecord.java
@@ -5,14 +5,14 @@ package org.xbill.DNS;
 
 /**
  * Mail Exchange - specifies where mail to a domain is sent
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
- * @see <a href="https://tools.ietf.org/html/rfc7505">RFC 7505: A "Null MX" No Service Resource
- *     Record for Domains That Accept No Mail</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc7505">RFC 7505: A "Null MX" No Service
+ *     Resource Record for Domains That Accept No Mail</a>
  */
 public class MXRecord extends U16NameBase {
   MXRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/NAPTRRecord.java b/src/main/java/org/xbill/DNS/NAPTRRecord.java
index da3bf9af..6b07fe8b 100644
--- a/src/main/java/org/xbill/DNS/NAPTRRecord.java
+++ b/src/main/java/org/xbill/DNS/NAPTRRecord.java
@@ -8,12 +8,12 @@ import java.io.IOException;
 /**
  * Name Authority Pointer Record - specifies rewrite rule, that when applied to an existing string
  * will produce a new domain.
  *
  * @author Chuck Santos
- * @see <a href="https://tools.ietf.org/html/rfc3403">RFC 3403: Dynamic Delegation Discovery System
- *     (DDDS) Part Three: The Domain Name System (DNS) Database</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc3403">RFC 3403: Dynamic Delegation
+ *     Discovery System (DDDS) Part Three: The Domain Name System (DNS) Database</a>
  */
 public class NAPTRRecord extends Record {
   private int order, preference;
   private byte[] flags, service, regexp;
   private Name replacement;
diff --git a/src/main/java/org/xbill/DNS/NSAPRecord.java b/src/main/java/org/xbill/DNS/NSAPRecord.java
index 3be0047c..8b881757 100644
--- a/src/main/java/org/xbill/DNS/NSAPRecord.java
+++ b/src/main/java/org/xbill/DNS/NSAPRecord.java
@@ -9,11 +9,12 @@ import org.xbill.DNS.utils.base16;
 
 /**
  * NSAP Address Record.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1706">RFC 1706: DNS NSAP Resource Records</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1706">RFC 1706: DNS NSAP Resource
+ *     Records</a>
  */
 public class NSAPRecord extends Record {
   private byte[] address;
 
   NSAPRecord() {}
diff --git a/src/main/java/org/xbill/DNS/NSAP_PTRRecord.java b/src/main/java/org/xbill/DNS/NSAP_PTRRecord.java
index 8e1da00b..478ddd15 100644
--- a/src/main/java/org/xbill/DNS/NSAP_PTRRecord.java
+++ b/src/main/java/org/xbill/DNS/NSAP_PTRRecord.java
@@ -5,11 +5,12 @@ package org.xbill.DNS;
 
 /**
  * NSAP Pointer Record - maps a domain name representing an NSAP Address to a hostname. (obsolete)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1706">RFC 1706: DNS NSAP Resource Records</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1706">RFC 1706: DNS NSAP Resource
+ *     Records</a>
  */
 public class NSAP_PTRRecord extends SingleNameBase {
   NSAP_PTRRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/NSEC3PARAMRecord.java b/src/main/java/org/xbill/DNS/NSEC3PARAMRecord.java
index 9875040f..f82f34c0 100644
--- a/src/main/java/org/xbill/DNS/NSEC3PARAMRecord.java
+++ b/src/main/java/org/xbill/DNS/NSEC3PARAMRecord.java
@@ -13,12 +13,12 @@ import org.xbill.DNS.utils.base16;
  * must include this record at the zone apex to inform authoritative servers that NSEC3 is being
  * used with the given parameters.
  *
  * @author Brian Wellington
  * @author David Blacka
- * @see <a href="https://tools.ietf.org/html/rfc5155">RFC 5155: DNS Security (DNSSEC) Hashed
- *     Authenticated Denial of Existence</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc5155">RFC 5155: DNS Security (DNSSEC)
+ *     Hashed Authenticated Denial of Existence</a>
  */
 public class NSEC3PARAMRecord extends Record {
   private int hashAlg;
   private int flags;
   private int iterations;
diff --git a/src/main/java/org/xbill/DNS/NSEC3Record.java b/src/main/java/org/xbill/DNS/NSEC3Record.java
index 8fe2dfea..b97b3b58 100644
--- a/src/main/java/org/xbill/DNS/NSEC3Record.java
+++ b/src/main/java/org/xbill/DNS/NSEC3Record.java
@@ -16,12 +16,12 @@ import org.xbill.DNS.utils.base32;
  *
  * <p>This replaces the NSEC and NXT records, when used.
  *
  * @author Brian Wellington
  * @author David Blacka
- * @see <a href="https://tools.ietf.org/html/rfc5155">RFC 5155: DNS Security (DNSSEC) Hashed
- *     Authenticated Denial of Existence</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc5155">RFC 5155: DNS Security (DNSSEC)
+ *     Hashed Authenticated Denial of Existence</a>
  */
 public class NSEC3Record extends Record {
 
   public static class Flags {
     /** NSEC3 flags identifiers. */
diff --git a/src/main/java/org/xbill/DNS/NSECRecord.java b/src/main/java/org/xbill/DNS/NSECRecord.java
index cf28f5d9..67375944 100644
--- a/src/main/java/org/xbill/DNS/NSECRecord.java
+++ b/src/main/java/org/xbill/DNS/NSECRecord.java
@@ -12,12 +12,12 @@ import java.io.IOException;
  *
  * <p>This replaces the NXT record.
  *
  * @author Brian Wellington
  * @author David Blacka
- * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
- *     Security Extensions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
+ *     DNS Security Extensions</a>
  */
 public class NSECRecord extends Record {
   private Name next;
   private TypeBitmap types;
 
diff --git a/src/main/java/org/xbill/DNS/NSIDOption.java b/src/main/java/org/xbill/DNS/NSIDOption.java
index 31dcef43..477e36eb 100644
--- a/src/main/java/org/xbill/DNS/NSIDOption.java
+++ b/src/main/java/org/xbill/DNS/NSIDOption.java
@@ -6,12 +6,12 @@ package org.xbill.DNS;
 /**
  * The Name Server Identifier Option
  *
  * @see OPTRecord
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc5001">RFC 5001: DNS Name Server Identifier (NSID)
- *     Option</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc5001">RFC 5001: DNS Name Server Identifier
+ *     (NSID) Option</a>
  */
 public class NSIDOption extends GenericEDNSOption {
   NSIDOption() {
     super(EDNSOption.Code.NSID);
   }
diff --git a/src/main/java/org/xbill/DNS/NSRecord.java b/src/main/java/org/xbill/DNS/NSRecord.java
index 1c48370b..e5a07571 100644
--- a/src/main/java/org/xbill/DNS/NSRecord.java
+++ b/src/main/java/org/xbill/DNS/NSRecord.java
@@ -5,12 +5,12 @@ package org.xbill.DNS;
 
 /**
  * Name Server Record - contains the name server serving the named zone
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class NSRecord extends SingleCompressedNameBase {
   NSRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/NULLRecord.java b/src/main/java/org/xbill/DNS/NULLRecord.java
index 00e1a294..a96554fe 100644
--- a/src/main/java/org/xbill/DNS/NULLRecord.java
+++ b/src/main/java/org/xbill/DNS/NULLRecord.java
@@ -7,12 +7,12 @@ import java.io.IOException;
 
 /**
  * The NULL Record. This has no defined purpose, but can be used to hold arbitrary data.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class NULLRecord extends Record {
   private byte[] data;
 
   NULLRecord() {}
diff --git a/src/main/java/org/xbill/DNS/NXTRecord.java b/src/main/java/org/xbill/DNS/NXTRecord.java
index 9c600eda..ac1347fc 100644
--- a/src/main/java/org/xbill/DNS/NXTRecord.java
+++ b/src/main/java/org/xbill/DNS/NXTRecord.java
@@ -10,12 +10,12 @@ import java.util.BitSet;
  * Next name - this record contains the following name in an ordered list of names in the zone, and
  * a set of types for which records exist for this name. The presence of this record in a response
  * signifies a failed query for data in a DNSSEC-signed zone.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc2065">RFC 2065: Domain Name System Security
- *     Extensions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2065">RFC 2065: Domain Name System
+ *     Security Extensions</a>
  */
 public class NXTRecord extends Record {
   private Name next;
   private BitSet bitmap;
 
diff --git a/src/main/java/org/xbill/DNS/NioTcpClient.java b/src/main/java/org/xbill/DNS/NioTcpClient.java
index cbea164a..f2be98e5 100644
--- a/src/main/java/org/xbill/DNS/NioTcpClient.java
+++ b/src/main/java/org/xbill/DNS/NioTcpClient.java
@@ -90,11 +90,11 @@ final class NioTcpClient extends NioClient implements TcpIoClient {
           channel.socket().getLocalSocketAddress(),
           channel.socket().getRemoteSocketAddress(),
           queryData);
 
       // combine length+message to avoid multiple TCP packets
-      // https://tools.ietf.org/html/rfc7766#section-8
+      // https://datatracker.ietf.org/doc/html/rfc7766#section-8
       ByteBuffer buffer = ByteBuffer.allocate(queryData.length + 2);
       buffer.put((byte) (queryData.length >>> 8));
       buffer.put((byte) (queryData.length & 0xFF));
       buffer.put(queryData);
       buffer.flip();
diff --git a/src/main/java/org/xbill/DNS/NioUdpClient.java b/src/main/java/org/xbill/DNS/NioUdpClient.java
index 8a1d387c..ce6607f2 100644
--- a/src/main/java/org/xbill/DNS/NioUdpClient.java
+++ b/src/main/java/org/xbill/DNS/NioUdpClient.java
@@ -28,11 +28,11 @@ final class NioUdpClient extends NioClient implements UdpIoClient {
   private final SecureRandom prng;
   private final Queue<Transaction> registrationQueue = new ConcurrentLinkedQueue<>();
   private final Queue<Transaction> pendingTransactions = new ConcurrentLinkedQueue<>();
 
   NioUdpClient() {
-    // https://tools.ietf.org/html/rfc6335#section-6
+    // https://datatracker.ietf.org/doc/html/rfc6335#section-6
     int ephemeralStartDefault = 49152;
     int ephemeralEndDefault = 65535;
 
     // Linux usually uses 32768-60999
     if (System.getProperty("os.name").toLowerCase().contains("linux")) {
diff --git a/src/main/java/org/xbill/DNS/OPENPGPKEYRecord.java b/src/main/java/org/xbill/DNS/OPENPGPKEYRecord.java
index 1801b8ab..362a905c 100644
--- a/src/main/java/org/xbill/DNS/OPENPGPKEYRecord.java
+++ b/src/main/java/org/xbill/DNS/OPENPGPKEYRecord.java
@@ -7,12 +7,12 @@ import org.xbill.DNS.utils.base64;
 /**
  * OPENPGPKEY Record - Stores an OpenPGP certificate associated with a name.
  *
  * @author Brian Wellington
  * @author Valentin Hauner
- * @see <a href="https://tools.ietf.org/html/rfc7929">RFC 7929: DNS-Based Authentication of Named
- *     Entities (DANE) Bindings for OpenPGP</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc7929">RFC 7929: DNS-Based Authentication
+ *     of Named Entities (DANE) Bindings for OpenPGP</a>
  */
 public class OPENPGPKEYRecord extends Record {
   private byte[] cert;
 
   OPENPGPKEYRecord() {}
diff --git a/src/main/java/org/xbill/DNS/OPTRecord.java b/src/main/java/org/xbill/DNS/OPTRecord.java
index f026113d..a8d7cae8 100644
--- a/src/main/java/org/xbill/DNS/OPTRecord.java
+++ b/src/main/java/org/xbill/DNS/OPTRecord.java
@@ -16,11 +16,12 @@ import java.util.List;
  * <p>EDNS is a method to extend the DNS protocol while providing backwards compatibility and not
  * significantly changing the protocol. This implementation of EDNS is mostly complete at level 0.
  *
  * @see Message
  * @see Resolver
- * @see <a href="https://tools.ietf.org/html/rfc6891">RFC 6891: Extension Mechanisms for DNS</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc6891">RFC 6891: Extension Mechanisms for
+ *     DNS</a>
  * @author Brian Wellington
  */
 public class OPTRecord extends Record {
   private List<EDNSOption> options;
 
diff --git a/src/main/java/org/xbill/DNS/Opcode.java b/src/main/java/org/xbill/DNS/Opcode.java
index 2445736b..b3d9a0da 100644
--- a/src/main/java/org/xbill/DNS/Opcode.java
+++ b/src/main/java/org/xbill/DNS/Opcode.java
@@ -23,11 +23,15 @@ public final class Opcode {
   public static final int NOTIFY = 4;
 
   /** A dynamic update message */
   public static final int UPDATE = 5;
 
-  /** DNS Stateful Operations (DSO, RFC8490) */
+  /**
+   * DNS Stateful Operations (DSO).
+   *
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc8490">RFC 8490</a>
+   */
   public static final int DSO = 6;
 
   private static final Mnemonic opcodes = new Mnemonic("DNS Opcode", Mnemonic.CASE_UPPER);
 
   static {
diff --git a/src/main/java/org/xbill/DNS/PTRRecord.java b/src/main/java/org/xbill/DNS/PTRRecord.java
index 2ecaffec..68c139de 100644
--- a/src/main/java/org/xbill/DNS/PTRRecord.java
+++ b/src/main/java/org/xbill/DNS/PTRRecord.java
@@ -5,12 +5,12 @@ package org.xbill.DNS;
 
 /**
  * Pointer Record - maps a domain name representing an Internet Address to a hostname.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class PTRRecord extends SingleCompressedNameBase {
   PTRRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/PXRecord.java b/src/main/java/org/xbill/DNS/PXRecord.java
index c81db600..135de5df 100644
--- a/src/main/java/org/xbill/DNS/PXRecord.java
+++ b/src/main/java/org/xbill/DNS/PXRecord.java
@@ -7,12 +7,12 @@ import java.io.IOException;
 
 /**
  * X.400 mail mapping record.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc2163">RFC 2163: Using the Internet DNS to Distribute
- *     MIXER Conformant Global Address Mapping (MCGAM)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2163">RFC 2163: Using the Internet DNS to
+ *     Distribute MIXER Conformant Global Address Mapping (MCGAM)</a>
  */
 public class PXRecord extends Record {
   private int preference;
   private Name map822;
   private Name mapX400;
diff --git a/src/main/java/org/xbill/DNS/RPRecord.java b/src/main/java/org/xbill/DNS/RPRecord.java
index 461306b3..93c7eb5e 100644
--- a/src/main/java/org/xbill/DNS/RPRecord.java
+++ b/src/main/java/org/xbill/DNS/RPRecord.java
@@ -9,11 +9,11 @@ import java.io.IOException;
  * Responsible Person Record - lists the mail address of a responsible person and a domain where TXT
  * records are available.
  *
  * @author Tom Scola (tscola@research.att.com)
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
  */
 public class RPRecord extends Record {
   private Name mailbox;
   private Name textDomain;
 
diff --git a/src/main/java/org/xbill/DNS/RRSIGRecord.java b/src/main/java/org/xbill/DNS/RRSIGRecord.java
index 701973ca..a7fef0c8 100644
--- a/src/main/java/org/xbill/DNS/RRSIGRecord.java
+++ b/src/main/java/org/xbill/DNS/RRSIGRecord.java
@@ -12,12 +12,12 @@ import java.util.Date;
  * in a DNSKEY Record.
  *
  * @see RRset
  * @see DNSSEC
  * @see KEYRecord
- * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
- *     Security Extensions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
+ *     DNS Security Extensions</a>
  * @author Brian Wellington
  */
 public class RRSIGRecord extends SIGBase {
   RRSIGRecord() {}
 
diff --git a/src/main/java/org/xbill/DNS/RTRecord.java b/src/main/java/org/xbill/DNS/RTRecord.java
index a66b69e1..143cfecc 100644
--- a/src/main/java/org/xbill/DNS/RTRecord.java
+++ b/src/main/java/org/xbill/DNS/RTRecord.java
@@ -5,12 +5,12 @@ package org.xbill.DNS;
 
 /**
  * Route Through Record - lists a route preference and intermediate host.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class RTRecord extends U16NameBase {
   RTRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/SIGRecord.java b/src/main/java/org/xbill/DNS/SIGRecord.java
index e25c2d05..9a012bd2 100644
--- a/src/main/java/org/xbill/DNS/SIGRecord.java
+++ b/src/main/java/org/xbill/DNS/SIGRecord.java
@@ -11,12 +11,12 @@ import java.util.Date;
  * authenticated by a DNSSEC-capable resolver. The signature is usually generated by a key contained
  * in a KEYRecord
  *
  * @see RRset
  * @see DNSSEC
- * @see KEYRecord <a href="https://tools.ietf.org/html/rfc2535">RFC 2535: Domain Name System
- *     Security Extensions</a>
+ * @see KEYRecord <a href="https://datatracker.ietf.org/doc/html/rfc2535">RFC 2535: Domain Name
+ *     System Security Extensions</a>
  * @author Brian Wellington
  */
 public class SIGRecord extends SIGBase {
   SIGRecord() {}
 
diff --git a/src/main/java/org/xbill/DNS/SMIMEARecord.java b/src/main/java/org/xbill/DNS/SMIMEARecord.java
index fe3b502c..d98302ea 100644
--- a/src/main/java/org/xbill/DNS/SMIMEARecord.java
+++ b/src/main/java/org/xbill/DNS/SMIMEARecord.java
@@ -4,12 +4,12 @@
 package org.xbill.DNS;
 
 /**
  * S/MIME cert association
  *
- * @see <a href="https://tools.ietf.org/html/rfc8162">RFC 8162: Using Secure DNS to Associate
- *     Certificates with Domain Names for S/MIME</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc8162">RFC 8162: Using Secure DNS to
+ *     Associate Certificates with Domain Names for S/MIME</a>
  * @author Brian Wellington
  */
 public class SMIMEARecord extends TLSARecord {
   SMIMEARecord() {}
 
diff --git a/src/main/java/org/xbill/DNS/SOARecord.java b/src/main/java/org/xbill/DNS/SOARecord.java
index 58e97afb..4eceb55d 100644
--- a/src/main/java/org/xbill/DNS/SOARecord.java
+++ b/src/main/java/org/xbill/DNS/SOARecord.java
@@ -7,12 +7,12 @@ import java.io.IOException;
 
 /**
  * Start of Authority - describes properties of a zone.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class SOARecord extends Record {
   private Name host, admin;
   private long serial, refresh, retry, expire, minimum;
 
diff --git a/src/main/java/org/xbill/DNS/SPFRecord.java b/src/main/java/org/xbill/DNS/SPFRecord.java
index 01a993ce..074b4b0f 100644
--- a/src/main/java/org/xbill/DNS/SPFRecord.java
+++ b/src/main/java/org/xbill/DNS/SPFRecord.java
@@ -7,12 +7,12 @@ import java.util.List;
 
 /**
  * Sender Policy Framework (discontinued in RFC 7208)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc7208">RFC 7208: Sender Policy Framework (SPF) for
- *     Authorizing Use of Domains in Email, Version 1</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc7208">RFC 7208: Sender Policy Framework
+ *     (SPF) for Authorizing Use of Domains in Email, Version 1</a>
  */
 public class SPFRecord extends TXTBase {
   SPFRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/SRVRecord.java b/src/main/java/org/xbill/DNS/SRVRecord.java
index be0805a0..b48be11f 100644
--- a/src/main/java/org/xbill/DNS/SRVRecord.java
+++ b/src/main/java/org/xbill/DNS/SRVRecord.java
@@ -9,12 +9,12 @@ import java.io.IOException;
  * Server Selection Record - finds hosts running services in a domain. An SRV record will normally
  * be named _&lt;service&gt;._&lt;protocol&gt;.domain - examples would be _sips._tcp.example.org
  * (for the secure SIP protocol) and _http._tcp.example.com (if HTTP used SRV records)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc2782">RFC 2782: A DNS RR for specifying the location
- *     of services (DNS SRV)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2782">RFC 2782: A DNS RR for specifying
+ *     the location of services (DNS SRV)</a>
  */
 public class SRVRecord extends Record {
   private int priority, weight, port;
   private Name target;
 
diff --git a/src/main/java/org/xbill/DNS/SSHFPRecord.java b/src/main/java/org/xbill/DNS/SSHFPRecord.java
index ccf9a817..4d7e9715 100644
--- a/src/main/java/org/xbill/DNS/SSHFPRecord.java
+++ b/src/main/java/org/xbill/DNS/SSHFPRecord.java
@@ -8,12 +8,12 @@ import org.xbill.DNS.utils.base16;
 
 /**
  * SSH Fingerprint - stores the fingerprint of an SSH host key.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4255">RFC 4255: Using DNS to Securely Publish Secure
- *     Shell (SSH) Key Fingerprints</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4255">RFC 4255: Using DNS to Securely
+ *     Publish Secure Shell (SSH) Key Fingerprints</a>
  */
 public class SSHFPRecord extends Record {
   public static class Algorithm {
     private Algorithm() {}
 
diff --git a/src/main/java/org/xbill/DNS/SVCBBase.java b/src/main/java/org/xbill/DNS/SVCBBase.java
index 2fd377e1..24a60d04 100644
--- a/src/main/java/org/xbill/DNS/SVCBBase.java
+++ b/src/main/java/org/xbill/DNS/SVCBBase.java
@@ -18,13 +18,12 @@ import java.util.stream.Collectors;
 import org.xbill.DNS.utils.base64;
 
 /**
  * Implements common functionality for SVCB and HTTPS records
  *
- * @see <a
- *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
  * @since 3.3
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
  */
 public abstract class SVCBBase extends Record {
   protected int svcPriority;
   protected Name targetName;
   protected final Map<Integer, ParameterBase> svcParams;
diff --git a/src/main/java/org/xbill/DNS/SVCBRecord.java b/src/main/java/org/xbill/DNS/SVCBRecord.java
index bed4de00..1785e52e 100644
--- a/src/main/java/org/xbill/DNS/SVCBRecord.java
+++ b/src/main/java/org/xbill/DNS/SVCBRecord.java
@@ -4,13 +4,12 @@ package org.xbill.DNS;
 import java.util.List;
 
 /**
  * Service Location and Parameter Binding Record
  *
- * @see <a
- *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
  * @since 3.3
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
  */
 public class SVCBRecord extends SVCBBase {
   SVCBRecord() {}
 
   public SVCBRecord(
diff --git a/src/main/java/org/xbill/DNS/TKEYRecord.java b/src/main/java/org/xbill/DNS/TKEYRecord.java
index 0664604a..27b5bb11 100644
--- a/src/main/java/org/xbill/DNS/TKEYRecord.java
+++ b/src/main/java/org/xbill/DNS/TKEYRecord.java
@@ -11,12 +11,12 @@ import org.xbill.DNS.utils.base64;
 /**
  * Transaction Key - used to compute and/or securely transport a shared secret to be used with TSIG.
  *
  * @see TSIG
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc2930">RFC 2930: Secret Key Establishment for DNS
- *     (TKEY RR)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2930">RFC 2930: Secret Key Establishment
+ *     for DNS (TKEY RR)</a>
  */
 public class TKEYRecord extends Record {
   private Name alg;
   private Instant timeInception;
   private Instant timeExpire;
diff --git a/src/main/java/org/xbill/DNS/TLSARecord.java b/src/main/java/org/xbill/DNS/TLSARecord.java
index 14991803..46714fce 100644
--- a/src/main/java/org/xbill/DNS/TLSARecord.java
+++ b/src/main/java/org/xbill/DNS/TLSARecord.java
@@ -8,12 +8,12 @@ import org.xbill.DNS.utils.base16;
 
 /**
  * Transport Layer Security Authentication
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc6698">RFC 6698: The DNS-Based Authentication of
- *     Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc6698">RFC 6698: The DNS-Based
+ *     Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA</a>
  */
 public class TLSARecord extends Record {
   public static class CertificateUsage {
     private CertificateUsage() {}
 
@@ -24,27 +24,43 @@ public class TLSARecord extends Record {
   }
 
   public static class Selector {
     private Selector() {}
 
-    /** Full certificate; the Certificate binary structure defined in [RFC5280] */
+    /**
+     * Full certificate; the Certificate binary structure.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5280">RFC 5280</a>
+     */
     public static final int FULL_CERTIFICATE = 0;
 
-    /** SubjectPublicKeyInfo; DER-encoded binary structure defined in [RFC5280] */
+    /**
+     * SubjectPublicKeyInfo; DER-encoded binary structure.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5280">RFC 5280</a>
+     */
     public static final int SUBJECT_PUBLIC_KEY_INFO = 1;
   }
 
   public static class MatchingType {
     private MatchingType() {}
 
     /** Exact match on selected content */
     public static final int EXACT = 0;
 
-    /** SHA-256 hash of selected content [RFC6234] */
+    /**
+     * SHA-256 hash of selected content.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6234">RFC 6234</a>
+     */
     public static final int SHA256 = 1;
 
-    /** SHA-512 hash of selected content [RFC6234] */
+    /**
+     * SHA-512 hash of selected content.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6234">RFC 6234</a>
+     */
     public static final int SHA512 = 2;
   }
 
   private int certificateUsage;
   private int selector;
diff --git a/src/main/java/org/xbill/DNS/TSIG.java b/src/main/java/org/xbill/DNS/TSIG.java
index 29ecbea1..ac62da9e 100644
--- a/src/main/java/org/xbill/DNS/TSIG.java
+++ b/src/main/java/org/xbill/DNS/TSIG.java
@@ -663,11 +663,11 @@ public class TSIG {
     if (badsig != Rcode.NOERROR) {
       return badsig;
     }
 
     // validate time after the signature, as per
-    // https://www.rfc-editor.org/rfc/rfc8945.html#section-5.4
+    // https://datatracker.ietf.org/doc/html/rfc8945#section-5.4
     int badtime = verifyTime(tsig);
     if (badtime != Rcode.NOERROR) {
       return badtime;
     }
 
@@ -802,11 +802,11 @@ public class TSIG {
 
     /**
      * Creates an instance to sign multiple message for use in a stream.
      *
      * <p>This class creates a {@link TSIGRecord} on every message to conform with <a
-     * href="https://www.rfc-editor.org/rfc/rfc8945.html#section-5.3.1">RFC 8945, 5.3.1</a>.
+     * href="https://datatracker.ietf.org/doc/html/rfc8945#section-5.3.1">RFC 8945, 5.3.1</a>.
      *
      * @param key The TSIG key used to create the signature records.
      * @param queryTsig The initial TSIG records, e.g. from a query to a server.
      */
     public StreamGenerator(TSIG key, TSIGRecord queryTsig) {
diff --git a/src/main/java/org/xbill/DNS/TSIGRecord.java b/src/main/java/org/xbill/DNS/TSIGRecord.java
index 2296994a..fd00e0b1 100644
--- a/src/main/java/org/xbill/DNS/TSIGRecord.java
+++ b/src/main/java/org/xbill/DNS/TSIGRecord.java
@@ -13,11 +13,11 @@ import org.xbill.DNS.utils.base64;
  * Transaction Signature - this record is automatically generated by the resolver. TSIG records
  * provide transaction security between the sender and receiver of a message, using a shared key.
  *
  * @see Resolver
  * @see TSIG
- * @see <a href="https://tools.ietf.org/html/rfc2845">RFC 2845: Secret Key Transaction
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2845">RFC 2845: Secret Key Transaction
  *     Authentication for DNS (TSIG)</a>
  * @author Brian Wellington
  */
 public class TSIGRecord extends Record {
   private Name alg;
diff --git a/src/main/java/org/xbill/DNS/TXTRecord.java b/src/main/java/org/xbill/DNS/TXTRecord.java
index 6f338e45..221555f2 100644
--- a/src/main/java/org/xbill/DNS/TXTRecord.java
+++ b/src/main/java/org/xbill/DNS/TXTRecord.java
@@ -7,12 +7,12 @@ import java.util.List;
 
 /**
  * Text - stores text strings
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class TXTRecord extends TXTBase {
   TXTRecord() {}
 
   /**
diff --git a/src/main/java/org/xbill/DNS/TcpKeepaliveOption.java b/src/main/java/org/xbill/DNS/TcpKeepaliveOption.java
index ea426987..f9e279f0 100644
--- a/src/main/java/org/xbill/DNS/TcpKeepaliveOption.java
+++ b/src/main/java/org/xbill/DNS/TcpKeepaliveOption.java
@@ -5,11 +5,11 @@ import java.io.IOException;
 import java.time.Duration;
 import java.util.Optional;
 import java.util.OptionalInt;
 
 /**
- * TCP Keepalive EDNS0 Option, as defined in https://tools.ietf.org/html/rfc7828
+ * TCP Keepalive EDNS0 Option, as defined in https://datatracker.ietf.org/doc/html/rfc7828
  *
  * @see OPTRecord
  * @author Klaus Malorny
  */
 public class TcpKeepaliveOption extends EDNSOption {
diff --git a/src/main/java/org/xbill/DNS/Type.java b/src/main/java/org/xbill/DNS/Type.java
index 84ce9434..c579bf23 100644
--- a/src/main/java/org/xbill/DNS/Type.java
+++ b/src/main/java/org/xbill/DNS/Type.java
@@ -102,22 +102,22 @@ public final class Type {
 
   /** {@link NXTRecord Next valid name in zone} */
   public static final int NXT = 30;
 
   /**
-   * Endpoint identifier
+   * DNS Resource Records for Nimrod Routing Architecture, Endpoint identifier.
    *
-   * @see <a href="https://tools.ietf.org/html/draft-ietf-nimrod-dns-00">DNS Resource Records for
-   *     Nimrod Routing Architecture</a>
+   * @see <a
+   *     href="https://datatracker.ietf.org/doc/draft-ietf-nimrod-dns/">draft-ietf-nimrod-dns</a>
    */
   public static final int EID = 31;
 
   /**
-   * Nimrod locator
+   * DNS Resource Records for Nimrod Routing Architecture, Nimrod locator.
    *
-   * @see <a href="https://tools.ietf.org/html/draft-ietf-nimrod-dns-00">DNS Resource Records for
-   *     Nimrod Routing Architecture</a>
+   * @see <a
+   *     href="https://datatracker.ietf.org/doc/draft-ietf-nimrod-dns/">draft-ietf-nimrod-dns</a>
    */
   public static final int NIMLOC = 32;
 
   /** {@link SRVRecord Server selection} */
   public static final int SRV = 33;
@@ -186,27 +186,28 @@ public final class Type {
   public static final int HIP = 55;
 
   /**
    * Zone Status (ZS).
    *
-   * @see <a href="https://tools.ietf.org/html/draft-reid-dnsext-zs-01">draft-reid-dnsext-zs-01</a>
+   * @see <a
+   *     href="https://datatracker.ietf.org/doc/html/draft-reid-dnsext-zs-01">draft-reid-dnsext-zs-01</a>
    */
   public static final int NINFO = 56;
 
   /**
    * RKEY DNS Resource Record, used for encryption of NAPTR records.
    *
    * @see <a
-   *     href="https://tools.ietf.org/html/draft-reid-dnsext-rkey-00">draft-reid-dnsext-rkey-00</a>
+   *     href="https://datatracker.ietf.org/doc/html/draft-reid-dnsext-zs-01">draft-reid-dnsext-rkey-01</a>
    */
   public static final int RKEY = 57;
 
   /**
    * DNSSEC Trust Anchor History Service.
    *
    * @see <a
-   *     href="https://tools.ietf.org/html/draft-wijngaards-dnsop-trust-history-02">draft-wijngaards-dnsop-trust-history-02</a>
+   *     href="https://datatracker.ietf.org/doc/html/draft-wijngaards-dnsop-trust-history-02">draft-wijngaards-dnsop-trust-history-02</a>
    */
   public static final int TALINK = 58;
 
   /** {@link CDSRecord Child Delegation Signer} */
   public static final int CDS = 59;
@@ -224,20 +225,18 @@ public final class Type {
   public static final int ZONEMD = 63;
 
   /**
    * Service Location and Parameter Binding
    *
-   * @see <a
-   *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
    */
   public static final int SVCB = 64;
 
   /**
    * HTTPS Service Location and Parameter Binding
    *
-   * @see <a
-   *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
    */
   public static final int HTTPS = 65;
 
   /** {@link SPFRecord Sender Policy Framework} */
   public static final int SPF = 99;
diff --git a/src/main/java/org/xbill/DNS/URIRecord.java b/src/main/java/org/xbill/DNS/URIRecord.java
index c1035bb5..f36e2587 100644
--- a/src/main/java/org/xbill/DNS/URIRecord.java
+++ b/src/main/java/org/xbill/DNS/URIRecord.java
@@ -8,12 +8,12 @@ import java.io.IOException;
 
 /**
  * Uniform Resource Identifier (URI) DNS Resource Record
  *
  * @author Anthony Kirby
- * @see <a href="https://tools.ietf.org/html/rfc7553">RFC 7553: The Uniform Resource Identifier
- *     (URI) DNS Resource Record</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc7553">RFC 7553: The Uniform Resource
+ *     Identifier (URI) DNS Resource Record</a>
  */
 public class URIRecord extends Record {
   private int priority, weight;
   private byte[] target;
 
diff --git a/src/main/java/org/xbill/DNS/WKSRecord.java b/src/main/java/org/xbill/DNS/WKSRecord.java
index dfac7d85..d7266509 100644
--- a/src/main/java/org/xbill/DNS/WKSRecord.java
+++ b/src/main/java/org/xbill/DNS/WKSRecord.java
@@ -12,18 +12,18 @@ import java.util.List;
 
 /**
  * Well Known Services - Lists services offered by this host.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class WKSRecord extends Record {
   /**
    * IP protocol identifiers. This is basically copied out of RFC 1010.
    *
-   * @see <a href="https://tools.ietf.org/html/rfc1010">RFC 1010: Assigned Numbers</a>
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc1010">RFC 1010: Assigned Numbers</a>
    */
   public static class Protocol {
 
     private Protocol() {}
 
diff --git a/src/main/java/org/xbill/DNS/X25Record.java b/src/main/java/org/xbill/DNS/X25Record.java
index 80ec9c2f..9b2ca5d8 100644
--- a/src/main/java/org/xbill/DNS/X25Record.java
+++ b/src/main/java/org/xbill/DNS/X25Record.java
@@ -8,11 +8,11 @@ import java.io.IOException;
 /**
  * X25 - identifies the PSDN (Public Switched Data Network) address in the X.121 numbering plan
  * associated with a name.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
  */
 public class X25Record extends Record {
   private byte[] address;
 
   X25Record() {}
diff --git a/src/main/java/org/xbill/DNS/ZoneMDRecord.java b/src/main/java/org/xbill/DNS/ZoneMDRecord.java
index da7b4dbb..d44120b3 100644
--- a/src/main/java/org/xbill/DNS/ZoneMDRecord.java
+++ b/src/main/java/org/xbill/DNS/ZoneMDRecord.java
@@ -10,11 +10,11 @@ import org.xbill.DNS.utils.base16;
 
 /**
  * ZONEMD Resource record.
  *
  * @since 3.6
- * @see <a href="https://www.rfc-editor.org/rfc/rfc8976.html">RFC8976</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc8976">RFC 8976</a>
  */
 public class ZoneMDRecord extends Record {
   /**
    * ZONEMD Schemes.
    *
@@ -115,12 +115,12 @@ public class ZoneMDRecord extends Record {
     }
   }
 
   /**
    * A 32-bit unsigned integer in network byte order. It is the serial number from the zone's SOA
-   * record (<a href="https://www.rfc-editor.org/rfc/rfc1035.html">RFC1035, Section 3.3.13]</a>) for
-   * which the zone digest was generated.
+   * record (<a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035, Section 3.3.13]</a>)
+   * for which the zone digest was generated.
    */
   @Getter private long serial;
 
   /**
    * An 8-bit unsigned integer that identifies the methods by which data is collated and presented
diff --git a/src/main/java/org/xbill/DNS/lookup/LookupSession.java b/src/main/java/org/xbill/DNS/lookup/LookupSession.java
index f188d113..5ebc36ca 100644
--- a/src/main/java/org/xbill/DNS/lookup/LookupSession.java
+++ b/src/main/java/org/xbill/DNS/lookup/LookupSession.java
@@ -558,11 +558,11 @@ public class LookupSession {
   }
 
   private Message maybeAddToCache(Message message) {
     for (RRset set : message.getSectionRRsets(Section.ANSWER)) {
       if ((set.getType() == Type.CNAME || set.getType() == Type.DNAME) && set.size() != 1) {
-        throw new InvalidZoneDataException("Multiple CNAME RRs not allowed, see RFC1034 3.6.2");
+        throw new InvalidZoneDataException("Multiple CNAME RRs not allowed, see RFC 1034 3.6.2");
       }
     }
     Optional.ofNullable(caches.get(message.getQuestion().getDClass()))
         .ifPresent(cache -> cache.addMessage(message));
     return message;
diff --git a/src/main/java/org/xbill/DNS/lookup/NoSuchRRSetException.java b/src/main/java/org/xbill/DNS/lookup/NoSuchRRSetException.java
index 1cc178ff..bc6d0f4d 100644
--- a/src/main/java/org/xbill/DNS/lookup/NoSuchRRSetException.java
+++ b/src/main/java/org/xbill/DNS/lookup/NoSuchRRSetException.java
@@ -3,13 +3,14 @@ package org.xbill.DNS.lookup;
 
 import org.xbill.DNS.Name;
 
 /**
  * Thrown to indicate that records of the name and type queried does not exist, corresponding to the
- * {@link org.xbill.DNS.Rcode#NXRRSET} return code as specified in RFC2136 Section 2.2.
+ * {@link org.xbill.DNS.Rcode#NXRRSET} return code as specified in RFC 2136, Section 2.2.
  *
  * @since 3.4
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2136#section-2">RFC 2136</a>
  */
 public class NoSuchRRSetException extends LookupFailedException {
   public NoSuchRRSetException(Name name, int type) {
     this(name, type, false);
   }
diff --git a/src/test/java/org/xbill/DNS/dnssec/ResolveExample.java b/src/test/java/org/xbill/DNS/dnssec/ResolveExample.java
index bcc7f18a..f578f0ae 100644
--- a/src/test/java/org/xbill/DNS/dnssec/ResolveExample.java
+++ b/src/test/java/org/xbill/DNS/dnssec/ResolveExample.java
@@ -19,20 +19,20 @@ import org.xbill.DNS.Type;
 
 class ResolveExample {
   static String ROOT =
       ". IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
 
-  static void main(String[] args) throws Exception {
+  public static void main(String[] args) throws Exception {
     // Send two sample queries using a standard DNSJAVA resolver
     SimpleResolver sr = new SimpleResolver("8.8.8.8");
     System.out.println("Standard resolver:");
     sendAndPrint(sr, "www.dnssec-failed.org.");
     sendAndPrint(sr, "www.isc.org.");
 
     // Send the same queries using the validating resolver with the
     // trust anchor of the root zone
-    // http://data.iana.org/root-anchors/root-anchors.xml
+    // https://data.iana.org/root-anchors/root-anchors.xml
     ValidatingResolver vr = new ValidatingResolver(sr);
     vr.loadTrustAnchors(new ByteArrayInputStream(ROOT.getBytes("ASCII")));
     vr.loadTrustAnchors(new ByteArrayInputStream(ROOT.getBytes(StandardCharsets.US_ASCII)));
     System.out.println("\n\nValidating resolver:");
     sendAndPrint(vr, "www.dnssec-failed.org.");

Vulnerable code:         // http://data.iana.org/root-anchors/root-anchors.xml
3+a|Maximum iteration count for the NSEC3 hashing function depending on the key size N. The defaults are from https://www.rfc-editor.org/rfc/rfc5155.html#section-10.3[RFC5155].
https://www.rfc-editor.org/rfc/rfc8624.html#section-3.1[RFC8624] for recommended values.
https://www.rfc-editor.org/rfc/rfc8624.html#section-3.3[RFC8624] for recommended values.
The Extended DNS Errors (EDE, https://www.rfc-editor.org/rfc/rfc8914.html[RFC8914]) also provides the failure reason, although in less detail.
* Uses http://www.slf4j.org/[slf4j] for logging and thus needs `slf4j-api`
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
 * @see <a href="https://tools.ietf.org/html/rfc6563">RFC 6563: Moving A6 to Historic Status</a>
 * @see <a href="https://tools.ietf.org/html/rfc3596">RFC 3596: DNS Extensions to Support IP Version
 *     6</a>
 * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://tools.ietf.org/html/rfc3123">RFC 3123: A DNS RR Type for Lists of Address
 *     Prefixes (APL RR)</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc6844">RFC 6844: DNS Certification Authority
 *     Authorization (CAA) Resource Record</a>
 * @see <a href="https://tools.ietf.org/html/rfc8078">RFC 8078: Managing DS Records from the Parent
 *     via CDS/CDNSKEY</a>
 * @see <a href="https://tools.ietf.org/html/rfc8078">RFC 8078: Managing DS Records from the Parent
 *     via CDS/CDNSKEY</a>
 * @see <a href="https://tools.ietf.org/html/rfc4398">RFC 4398: Storing Certificates in the Domain
 *     Name System (DNS)</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * The Client Subnet EDNS Option, defined in <a href="https://tools.ietf.org/html/rfc7871">Client
 * subnet in DNS requests</a>.
 * Cookie EDNS0 Option, as defined in https://tools.ietf.org/html/rfc7873
 * @see <a href="https://tools.ietf.org/html/rfc4701">RFC 4701: A DNS Resource Record (RR) for
 *     Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)</a>
 * @see <a href="https://tools.ietf.org/html/rfc4431">RFC 4431: The DNSSEC Lookaside Validation
 *     (DLV) DNS Resource Record</a>
 * @see <a href="https://tools.ietf.org/html/rfc6672">RFC 6672: DNAME Redirection in the DNS</a>
 * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
 *     Security Extensions</a>
     * Delete DS record in parent zone, RFC8078.
    /** ECDSA Curve P-256 with SHA-256 public key * */
    /** ECDSA Curve P-384 with SHA-384 public key * */
    /** Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC, RFC8080 */
    /** Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC, RFC8080 */
     * SM2 signing algorithm with SM3 hashing algorithm. <a
     * href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
     * GOST R 34.10-2012 <a
     * href="https://datatracker.ietf.org/doc/draft-makarenko-gost2012-dnssec/05/">draft-makarenko-gost2012-dnssec-05</a>
    /** SHA-1, RFC3658. */
    /** SHA-256, RFC4509. */
    /** GOST R 34.11-94, RFC5933. */
    /** SHA-384, RFC6605. */
     * SM3 hashing algorithm. <a
     * href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
     * GOST R 34.10-2012 <a
     * href="https://datatracker.ietf.org/doc/draft-makarenko-gost2012-dnssec/05/">draft-makarenko-gost2012-dnssec-05</a>
 * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
 *     Security Extensions</a>
 * Proof-of-concept <a href="https://tools.ietf.org/html/rfc8484">DNS over HTTP (DoH)</a> resolver.
 * This class is not suitable for high load scenarios because of the shortcomings of Java's built-in
 * HTTP clients. For more control, implement your own {@link Resolver} using e.g. <a
    /** Apple's DNS Long-Lived Queries protocol, draft-sekar-dns-llq-06 */
    /** Dynamic DNS Update Leases, draft-sekar-dns-ul-02 */
    /** Name Server Identifier, RFC 5001 */
    /** DNSSEC Algorithm Understood (DAU), RFC 6975 */
    /** DNSSEC DS Hash Understood (DHU), RFC 6975 */
    /** DNSSEC NSEC3 Hash Understood (N3U), RFC 6975 */
    /** Client Subnet, RFC 7871 */
    /** (EDNS) EXPIRE Option, RFC 7314 */
    /** Cookie, RFC 7873 */
    /** TCP Keepalive, RFC 7828 */
    /** EDNS(0) Padding Option, RFC 7830 */
    /** CHAIN Query Requests in DNS, RFC 7901 */
    /** Signaling Trust Anchor Knowledge in DNS Security Extensions (DNSSEC), RFC 8145 */
    /** Extended DNS Errors, RFC 8914. */
    /** DNS EDNS Tags, draft-bellis-dnsop-edns-tags-01 */
    /** DNS EDNS Tags, draft-bellis-dnsop-edns-tags-01 */
   * state [RFC4035].
   * @see <a href="https://www.rfc-editor.org/rfc/rfc9250.html#section-4.5-3">RFC9250, 4.5</a>
   * @see <a href="https://www.rfc-editor.org/rfc/rfc9276.html#section-3.2">RFC9276, 3.2</a>
   *     href="https://datatracker.ietf.org/doc/draft-homburg-dnsop-codcp/01/">draft-homburg-dnsop-codcp,
   *     12</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc8198">RFC8198</a>
 * @see <a href="https://tools.ietf.org/html/rfc1712">RFC 1712: DNS Encoding of Geographical
 *     Location</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * HTTPS Service Location and Parameter Binding Record
 * @see <a
 *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
 * @see <a href="https://tools.ietf.org/html/rfc4025">RFC 4025: A Method for Storing IPsec Keying
 *     Material in DNS</a>
    /** A DSA key is present, in the format defined in [RFC2536] */
    /** A RSA key is present, in the format defined in [RFC3110] */
    /** An ECDSA key is present, in the format defined in [RFC6605] */
 * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://tools.ietf.org/html/rfc2535">RFC 2535: Domain Name System Security
 *     Extensions</a>
 * @see <a href="https://tools.ietf.org/html/rfc3755">RFC 3755: Legacy Resolver Compatibility for
 *     Delegation Signer (DS)</a>
 * @see <a href="https://tools.ietf.org/html/rfc2230">RFC 2230: Key Exchange Delegation Record for
 *     the DNS</a>
 * @see <a href="https://tools.ietf.org/html/rfc1876">RFC 1876: A Means for Expressing Location
 *     Information in the Domain Name System</a>
 * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc973">RFC 973: Domain System Changes and
 * @see <a href="https://tools.ietf.org/html/rfc973">RFC 973: Domain System Changes and
 * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc7505">RFC 7505: A "Null MX" No Service Resource
 *     Record for Domains That Accept No Mail</a>
 * @see <a href="https://tools.ietf.org/html/rfc3403">RFC 3403: Dynamic Delegation Discovery System
 *     (DDDS) Part Three: The Domain Name System (DNS) Database</a>
 * @see <a href="https://tools.ietf.org/html/rfc1706">RFC 1706: DNS NSAP Resource Records</a>
 * @see <a href="https://tools.ietf.org/html/rfc1706">RFC 1706: DNS NSAP Resource Records</a>
 * @see <a href="https://tools.ietf.org/html/rfc5155">RFC 5155: DNS Security (DNSSEC) Hashed
 *     Authenticated Denial of Existence</a>
 * @see <a href="https://tools.ietf.org/html/rfc5155">RFC 5155: DNS Security (DNSSEC) Hashed
 *     Authenticated Denial of Existence</a>
 * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
 *     Security Extensions</a>
 * @see <a href="https://tools.ietf.org/html/rfc5001">RFC 5001: DNS Name Server Identifier (NSID)
 *     Option</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc2065">RFC 2065: Domain Name System Security
 *     Extensions</a>
      // https://tools.ietf.org/html/rfc7766#section-8
    // https://tools.ietf.org/html/rfc6335#section-6
 * @see <a href="https://tools.ietf.org/html/rfc7929">RFC 7929: DNS-Based Authentication of Named
 *     Entities (DANE) Bindings for OpenPGP</a>
 * @see <a href="https://tools.ietf.org/html/rfc6891">RFC 6891: Extension Mechanisms for DNS</a>
  /** DNS Stateful Operations (DSO, RFC8490) */
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc2163">RFC 2163: Using the Internet DNS to Distribute
 *     MIXER Conformant Global Address Mapping (MCGAM)</a>
 * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
 *     Security Extensions</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see KEYRecord <a href="https://tools.ietf.org/html/rfc2535">RFC 2535: Domain Name System
 *     Security Extensions</a>
 * @see <a href="https://tools.ietf.org/html/rfc8162">RFC 8162: Using Secure DNS to Associate
 *     Certificates with Domain Names for S/MIME</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * @see <a href="https://tools.ietf.org/html/rfc7208">RFC 7208: Sender Policy Framework (SPF) for
 *     Authorizing Use of Domains in Email, Version 1</a>
 * @see <a href="https://tools.ietf.org/html/rfc2782">RFC 2782: A DNS RR for specifying the location
 *     of services (DNS SRV)</a>
 * @see <a href="https://tools.ietf.org/html/rfc4255">RFC 4255: Using DNS to Securely Publish Secure
 *     Shell (SSH) Key Fingerprints</a>
 * @see <a
 *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
 * @see <a
 *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
 * @see <a href="https://tools.ietf.org/html/rfc2930">RFC 2930: Secret Key Establishment for DNS
 *     (TKEY RR)</a>
 * @see <a href="https://tools.ietf.org/html/rfc6698">RFC 6698: The DNS-Based Authentication of
 *     Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA</a>
    /** Full certificate; the Certificate binary structure defined in [RFC5280] */
    /** SubjectPublicKeyInfo; DER-encoded binary structure defined in [RFC5280] */
    /** SHA-256 hash of selected content [RFC6234] */
    /** SHA-512 hash of selected content [RFC6234] */
    // https://www.rfc-editor.org/rfc/rfc8945.html#section-5.4
     * href="https://www.rfc-editor.org/rfc/rfc8945.html#section-5.3.1">RFC 8945, 5.3.1</a>.
 * @see <a href="https://tools.ietf.org/html/rfc2845">RFC 2845: Secret Key Transaction
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
 * TCP Keepalive EDNS0 Option, as defined in https://tools.ietf.org/html/rfc7828
   * Endpoint identifier
   * @see <a href="https://tools.ietf.org/html/draft-ietf-nimrod-dns-00">DNS Resource Records for
   *     Nimrod Routing Architecture</a>
   * Nimrod locator
   * @see <a href="https://tools.ietf.org/html/draft-ietf-nimrod-dns-00">DNS Resource Records for
   *     Nimrod Routing Architecture</a>
   * @see <a href="https://tools.ietf.org/html/draft-reid-dnsext-zs-01">draft-reid-dnsext-zs-01</a>
   *     href="https://tools.ietf.org/html/draft-reid-dnsext-rkey-00">draft-reid-dnsext-rkey-00</a>
   *     href="https://tools.ietf.org/html/draft-wijngaards-dnsop-trust-history-02">draft-wijngaards-dnsop-trust-history-02</a>
   * @see <a
   *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
   * @see <a
   *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
 * @see <a href="https://tools.ietf.org/html/rfc7553">RFC 7553: The Uniform Resource Identifier
 *     (URI) DNS Resource Record</a>
 * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
 *     Specification</a>
   * @see <a href="https://tools.ietf.org/html/rfc1010">RFC 1010: Assigned Numbers</a>
 * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://www.rfc-editor.org/rfc/rfc8976.html">RFC8976</a>
   * record (<a href="https://www.rfc-editor.org/rfc/rfc1035.html">RFC1035, Section 3.3.13]</a>) for
   * which the zone digest was generated.
        throw new InvalidZoneDataException("Multiple CNAME RRs not allowed, see RFC1034 3.6.2");
 * {@link org.xbill.DNS.Rcode#NXRRSET} return code as specified in RFC2136 Section 2.2.
  static void main(String[] args) throws Exception {
    // http://data.iana.org/root-anchors/root-anchors.xml
Fixed code:         // https://data.iana.org/root-anchors/root-anchors.xml
3+a|Maximum iteration count for the NSEC3 hashing function depending on the key size N. The defaults are from https://datatracker.ietf.org/doc/html/rfc5155#section-10.3[RFC5155].
https://datatracker.ietf.org/doc/html/rfc8624#section-3.1[RFC8624] for recommended values.
https://datatracker.ietf.org/doc/html/rfc8624#section-3.3[RFC8624] for recommended values.
The Extended DNS Errors (EDE, https://datatracker.ietf.org/doc/html/rfc8914[RFC8914]) also provides the failure reason, although in less detail.
* Uses https://www.slf4j.org/[slf4j] for logging and thus needs `slf4j-api`
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc6563">RFC 6563: Moving A6 to Historic
 *     Status</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc3596">RFC 3596: DNS Extensions to Support
 *     IP Version 6</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc3123">RFC 3123: A DNS RR Type for Lists of
 *     Address Prefixes (APL RR)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc6844">RFC 6844: DNS Certification
 *     Authority Authorization (CAA) Resource Record</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc8078">RFC 8078: Managing DS Records from
 *     the Parent via CDS/CDNSKEY</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc8078">RFC 8078: Managing DS Records from
 *     the Parent via CDS/CDNSKEY</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4398">RFC 4398: Storing Certificates in
 *     the Domain Name System (DNS)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * The Client Subnet EDNS Option.
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc7871">RFC 7871</a>
 * Cookie EDNS0 Option.
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc7873">RFC 7873</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4701">RFC 4701: A DNS Resource Record (RR)
 *     for Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4431">RFC 4431: The DNSSEC Lookaside
 *     Validation (DLV) DNS Resource Record</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc6672">RFC 6672: DNAME Redirection in the
 *     DNS</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
 *     DNS Security Extensions</a>
     * Delete DS record in parent zone.
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8078/">RFC 8078</a>
    /** ECDSA Curve P-256 with SHA-256 public key. */
    /** ECDSA Curve P-384 with SHA-384 public key. */
    /**
     * Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8080/">RFC 8080</a>
     */
    /**
     * Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8080/">RFC 8080</a>
     */
     * SM2 signing algorithm with SM3 hashing algorithm.
     *
     * @see <a
     *     href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
     * @since 3.6
     * GOST R 34.10-2012.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc9558/">RFC 9558</a>
     * @since 3.6
    /**
     * SHA-1.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc3658/">RFC 3658</a>
     */
    /**
     * SHA-256.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc4509/">RFC 4509</a>
     */
    /**
     * GOST R 34.11-94.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5933/">RFC 5933</a>
     */
    /**
     * SHA-384.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6605/">RFC 6605</a>
     */
     * GOST R 34.11-2012.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc9558/">RFC 9558</a>
     * @since 3.6
     * SM3 hashing algorithm.
     *
     * @see <a
     *     href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
     * @since 3.6
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
 *     DNS Security Extensions</a>
 * Proof-of-concept <a href="https://datatracker.ietf.org/doc/html/rfc8484">DNS over HTTP (DoH)</a>
 * resolver. This class is not suitable for high load scenarios because of the shortcomings of
 * Java's built-in HTTP clients. For more control, implement your own {@link Resolver} using e.g. <a
    /**
     * Apple's DNS Long-Lived Queries protocol.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8764/">RFC 8764</a>
     */
    /**
     * Dynamic DNS Update Leases.
     *
     * @see <a
     *     href="https://datatracker.ietf.org/doc/html/draft-sekar-dns-ul-03">draft-sekar-dns-ul-03</a>
     */
    /**
     * Name Server Identifier.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5001/">RFC 5001</a>
     */
    /**
     * DNSSEC Algorithm Understood (DAU).
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6975/">RFC 6975</a>
     */
    /**
     * DNSSEC DS Hash Understood (DHU).
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8764/">RFC 8764</a>
     */
    /**
     * DNSSEC NSEC3 Hash Understood (N3U).
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6975/">RFC 6975</a>
     */
    /**
     * Client Subnet.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7871/">RFC 7871</a>
     */
    /**
     * (EDNS) EXPIRE Option.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7314/">RFC 7314</a>
     */
    /**
     * Cookie.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7873/">RFC 7873</a>
     */
    /**
     * TCP Keepalive.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7828/">RFC 7828</a>
     */
    /**
     * EDNS(0) Padding Option.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7830/">RFC 7830</a>
     */
    /**
     * CHAIN Query Requests in DNS.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7901/">RFC 7901</a>
     */
    /**
     * Signaling Trust Anchor Knowledge in DNS Security Extensions (DNSSEC).
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8145/">RFC 8145</a>
     */
    /**
     * Extended DNS Errors.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8914/">RFC 8914</a>
     */
    /**
     * DNS EDNS Tags.
     *
     * @see <a
     *     href="https://datatracker.ietf.org/doc/html/draft-bellis-dnsop-edns-tags-01">draft-bellis-dnsop-edns-tags-01</a>
     */
    /**
     * DNS EDNS Tags.
     *
     * @see <a
     *     href="https://datatracker.ietf.org/doc/html/draft-bellis-dnsop-edns-tags-01">draft-bellis-dnsop-edns-tags-01</a>
     */
    /**
     * Report Channel.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc9567/">RFC 9567</a>
     * @since 3.6
     */
    public static final int REPORT_CHANNEL = 18;

      codes.add(REPORT_CHANNEL, "Report-Channel");
   * state.
   *
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc4035>RFC 4035</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9250#section-4.5-3">RFC 9250, 4.5</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9276#section-3.2">RFC 9276, 3.2</a>
   *     href="https://datatracker.ietf.org/doc/draft-homburg-dnsop-codcp/01/">draft-homburg-dnsop-codcp-01</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc8198">RFC 8198</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1712">RFC 1712: DNS Encoding of
 *     Geographical Location</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * HTTPS Service Location and Parameter Binding Record.
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4025">RFC 4025: A Method for Storing IPsec
 *     Keying Material in DNS</a>
    /**
     * A DSA key is present.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc2536">RFC 2536</a>
     */
    /**
     * A RSA key is present.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc3110">RFC 3110</a>
     */
    /**
     * An ECDSA key is present.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6605">RFC 6605</a>
     */
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2535">RFC 2535: Domain Name System
 *     Security Extensions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc3755">RFC 3755: Legacy Resolver
 *     Compatibility for Delegation Signer (DS)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2230">RFC 2230: Key Exchange Delegation
 *     Record for the DNS</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1876">RFC 1876: A Means for Expressing
 *     Location Information in the Domain Name System</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc973">RFC 973: Domain System Changes and
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc973">RFC 973: Domain System Changes and
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc7505">RFC 7505: A "Null MX" No Service
 *     Resource Record for Domains That Accept No Mail</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc3403">RFC 3403: Dynamic Delegation
 *     Discovery System (DDDS) Part Three: The Domain Name System (DNS) Database</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1706">RFC 1706: DNS NSAP Resource
 *     Records</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1706">RFC 1706: DNS NSAP Resource
 *     Records</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc5155">RFC 5155: DNS Security (DNSSEC)
 *     Hashed Authenticated Denial of Existence</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc5155">RFC 5155: DNS Security (DNSSEC)
 *     Hashed Authenticated Denial of Existence</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
 *     DNS Security Extensions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc5001">RFC 5001: DNS Name Server Identifier
 *     (NSID) Option</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2065">RFC 2065: Domain Name System
 *     Security Extensions</a>
      // https://datatracker.ietf.org/doc/html/rfc7766#section-8
    // https://datatracker.ietf.org/doc/html/rfc6335#section-6
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc7929">RFC 7929: DNS-Based Authentication
 *     of Named Entities (DANE) Bindings for OpenPGP</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc6891">RFC 6891: Extension Mechanisms for
 *     DNS</a>
  /**
   * DNS Stateful Operations (DSO).
   *
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc8490">RFC 8490</a>
   */
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2163">RFC 2163: Using the Internet DNS to
 *     Distribute MIXER Conformant Global Address Mapping (MCGAM)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
 *     DNS Security Extensions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see KEYRecord <a href="https://datatracker.ietf.org/doc/html/rfc2535">RFC 2535: Domain Name
 *     System Security Extensions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc8162">RFC 8162: Using Secure DNS to
 *     Associate Certificates with Domain Names for S/MIME</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc7208">RFC 7208: Sender Policy Framework
 *     (SPF) for Authorizing Use of Domains in Email, Version 1</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2782">RFC 2782: A DNS RR for specifying
 *     the location of services (DNS SRV)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc4255">RFC 4255: Using DNS to Securely
 *     Publish Secure Shell (SSH) Key Fingerprints</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2930">RFC 2930: Secret Key Establishment
 *     for DNS (TKEY RR)</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc6698">RFC 6698: The DNS-Based
 *     Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA</a>
    /**
     * Full certificate; the Certificate binary structure.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5280">RFC 5280</a>
     */
    /**
     * SubjectPublicKeyInfo; DER-encoded binary structure.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5280">RFC 5280</a>
     */
    /**
     * SHA-256 hash of selected content.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6234">RFC 6234</a>
     */
    /**
     * SHA-512 hash of selected content.
     *
     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6234">RFC 6234</a>
     */
    // https://datatracker.ietf.org/doc/html/rfc8945#section-5.4
     * href="https://datatracker.ietf.org/doc/html/rfc8945#section-5.3.1">RFC 8945, 5.3.1</a>.
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2845">RFC 2845: Secret Key Transaction
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
 * TCP Keepalive EDNS0 Option, as defined in https://datatracker.ietf.org/doc/html/rfc7828
   * DNS Resource Records for Nimrod Routing Architecture, Endpoint identifier.
   * @see <a
   *     href="https://datatracker.ietf.org/doc/draft-ietf-nimrod-dns/">draft-ietf-nimrod-dns</a>
   * DNS Resource Records for Nimrod Routing Architecture, Nimrod locator.
   * @see <a
   *     href="https://datatracker.ietf.org/doc/draft-ietf-nimrod-dns/">draft-ietf-nimrod-dns</a>
   * @see <a
   *     href="https://datatracker.ietf.org/doc/html/draft-reid-dnsext-zs-01">draft-reid-dnsext-zs-01</a>
   *     href="https://datatracker.ietf.org/doc/html/draft-reid-dnsext-zs-01">draft-reid-dnsext-rkey-01</a>
   *     href="https://datatracker.ietf.org/doc/html/draft-wijngaards-dnsop-trust-history-02">draft-wijngaards-dnsop-trust-history-02</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc7553">RFC 7553: The Uniform Resource
 *     Identifier (URI) DNS Resource Record</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
 *     Implementation and Specification</a>
   * @see <a href="https://datatracker.ietf.org/doc/html/rfc1010">RFC 1010: Assigned Numbers</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc8976">RFC 8976</a>
   * record (<a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035, Section 3.3.13]</a>)
   * for which the zone digest was generated.
        throw new InvalidZoneDataException("Multiple CNAME RRs not allowed, see RFC 1034 3.6.2");
 * {@link org.xbill.DNS.Rcode#NXRRSET} return code as specified in RFC 2136, Section 2.2.
 * @see <a href="https://datatracker.ietf.org/doc/html/rfc2136#section-2">RFC 2136</a>
  public static void main(String[] args) throws Exception {
    // https://data.iana.org/root-anchors/root-anchors.xml