CVE-2024-25638 (published 2024-07-22T14:15Z)

dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/dnsjava/dnsjava
commit_details: repo_url: https://github.com/dnsjava/dnsjava
author: Ingo Bauersachs
author_date: 2024-07-21 13:34:12+02:00
msg: Fix links to RFCs and IANA registries
repository: repo_url: https://github.com/dnsjava/dnsjava
repo_name: dnsjava/dnsjava
description: dnsjava - an implementation of the DNS protocol in Java
repo_language: Java
owner: dnsjava
file_changes: filename: EXAMPLES.md
change_type: ModificationType.MODIFY
diff: @@ -144,7 +144,7 @@ public class ResolveExample {
 
         // Send the same queries using the validating resolver with the
         // trust anchor of the root zone
-        // http://data.iana.org/root-anchors/root-anchors.xml
+        // https://data.iana.org/root-anchors/root-anchors.xml
         ValidatingResolver vr = new ValidatingResolver(sr);
         vr.loadTrustAnchors(new ByteArrayInputStream(ROOT.getBytes(StandardCharsets.US_ASCII)));
         System.out.println("\n\nValidating resolver:");

programming_language: Markdown
filename: README.adoc
change_type: ModificationType.MODIFY
diff: @@ -130,7 +130,7 @@ If disabled, such records are copied from the upstream and presented to the clie
 |5000
 
 .2+|org.jitsi.dnssec.nsec3.iterations.N
-3+a|Maximum iteration count for the NSEC3 hashing function depending on the key size N. The defaults are from https://www.rfc-editor.org/rfc/rfc5155.html#section-10.3[RFC5155].
+3+a|Maximum iteration count for the NSEC3 hashing function depending on the key size N. The defaults are from https://datatracker.ietf.org/doc/html/rfc5155#section-10.3[RFC5155].
 |Integer
 2+a|- 1024 bit keys: 150 iterations
 - 2048 bit keys: 500 iterations
@@ -183,7 +183,7 @@ This is limited to avoid the 'KeyTrap' vulnerability (CVE-2023-50387).
 .2+|dnsjava.dnssec.algorithm_enabled.ID
 3+|Enable or disable a DS/DNSKEY algorithm.
 See
-https://www.rfc-editor.org/rfc/rfc8624.html#section-3.1[RFC8624] for recommended values.
+https://datatracker.ietf.org/doc/html/rfc8624#section-3.1[RFC8624] for recommended values.
 Note that algorithm number 1, `RSAMD5`, is disabled and cannot be enabled with this property.
 |Boolean
 2+|Disable ED448:
@@ -198,7 +198,7 @@ Note that algorithm number 1, `RSAMD5`, is disabled and cannot be enabled with t
 .2+|dnsjava.dnssec.digest_enabled.ID
 3+|Enable or disable a DS record digest algorithm.
 See
-https://www.rfc-editor.org/rfc/rfc8624.html#section-3.3[RFC8624] for recommended values.
+https://datatracker.ietf.org/doc/html/rfc8624#section-3.3[RFC8624] for recommended values.
 |Boolean
 2+|Disable SHA.1:
 `dnsjava.dnssec.digest_enabled.1=false`
@@ -248,7 +248,7 @@ To migrate from dnssecjava, replace `org.jitsi` with `org.xbill.DNS` in Java pac
 Validated, secure responses contain the DNS `AD`-flag, while responses that failed validation return the `SERVFAIL`-RCode.
 Insecure responses return the actual return code without the `AD`-flag set.
 The reason why the validation failed or is insecure is provided as a localized string in the additional section under the record ./65280/TXT (a TXT record for the owner name of the root zone in the private query class `ValidatingResolver.VALIDATION_REASON_QCLASS`).
-The Extended DNS Errors (EDE, https://www.rfc-editor.org/rfc/rfc8914.html[RFC8914]) also provides the failure reason, although in less detail.
+The Extended DNS Errors (EDE, https://datatracker.ietf.org/doc/html/rfc8914[RFC8914]) also provides the failure reason, although in less detail.
 
 The link:EXAMPLES.md[examples] contain a small demo.
 
@@ -264,7 +264,7 @@ The most important changes are:
 
 * Requires at least Java 8
 
-* Uses http://www.slf4j.org/[slf4j] for logging and thus needs `slf4j-api`
+* Uses https://www.slf4j.org/[slf4j] for logging and thus needs `slf4j-api`
 on the classpath
 
 * The link:USAGE.md[command line tools] were moved to the `org.xbill.DNS.tools`

programming_language: Markdown
filename: pom.xml
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project
-    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"
     xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
 
     <modelVersion>4.0.0</modelVersion>

programming_language: HTML
filename: A6Record.java
change_type: ModificationType.MODIFY
diff: @@ -11,7 +11,8 @@ import java.net.UnknownHostException;
  * A6 Record - maps a domain name to an IPv6 address (historic)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc6563">RFC 6563: Moving A6 to Historic Status</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc6563">RFC 6563: Moving A6 to Historic
+ *     Status</a>
  */
 public class A6Record extends Record {
   private int prefixBits;

programming_language: Java
filename: AAAARecord.java
change_type: ModificationType.MODIFY
diff: @@ -11,8 +11,8 @@ import java.net.UnknownHostException;
  * IPv6 Address Record - maps a domain name to an IPv6 address
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc3596">RFC 3596: DNS Extensions to Support IP Version
- *     6</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc3596">RFC 3596: DNS Extensions to Support
+ *     IP Version 6</a>
  */
 public class AAAARecord extends Record {
   private byte[] address;

programming_language: Java
filename: AFSDBRecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,7 +7,7 @@ package org.xbill.DNS;
  * AFS Data Base Record - maps a domain name to the name of an AFS cell database server.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
  */
 public class AFSDBRecord extends U16NameBase {
   AFSDBRecord() {}

programming_language: Java
filename: APLRecord.java
change_type: ModificationType.MODIFY
diff: @@ -19,8 +19,8 @@ import org.xbill.DNS.utils.base16;
  * APL - Address Prefix List.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc3123">RFC 3123: A DNS RR Type for Lists of Address
- *     Prefixes (APL RR)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc3123">RFC 3123: A DNS RR Type for Lists of
+ *     Address Prefixes (APL RR)</a>
  */
 public class APLRecord extends Record {
 

programming_language: Java
filename: ARecord.java
change_type: ModificationType.MODIFY
diff: @@ -11,8 +11,8 @@ import java.net.UnknownHostException;
  * Address Record - maps a domain name to an Internet address
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class ARecord extends Record {
   private int addr;

programming_language: Java
filename: CAARecord.java
change_type: ModificationType.MODIFY
diff: @@ -9,8 +9,8 @@ import java.io.IOException;
  * Certification Authority Authorization
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc6844">RFC 6844: DNS Certification Authority
- *     Authorization (CAA) Resource Record</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc6844">RFC 6844: DNS Certification
+ *     Authority Authorization (CAA) Resource Record</a>
  */
 public class CAARecord extends Record {
   public static class Flags {

programming_language: Java
filename: CDNSKEYRecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,8 +7,8 @@ import java.security.PublicKey;
  * Child DNSKEY record as specified in RFC 8078.
  *
  * @see DNSSEC
- * @see <a href="https://tools.ietf.org/html/rfc8078">RFC 8078: Managing DS Records from the Parent
- *     via CDS/CDNSKEY</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc8078">RFC 8078: Managing DS Records from
+ *     the Parent via CDS/CDNSKEY</a>
  */
 public class CDNSKEYRecord extends DNSKEYRecord {
   CDNSKEYRecord() {}

programming_language: Java
filename: CDSRecord.java
change_type: ModificationType.MODIFY
diff: @@ -5,8 +5,8 @@ package org.xbill.DNS;
  * Child Delegation Signer record as specified in RFC 8078.
  *
  * @see DNSSEC
- * @see <a href="https://tools.ietf.org/html/rfc8078">RFC 8078: Managing DS Records from the Parent
- *     via CDS/CDNSKEY</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc8078">RFC 8078: Managing DS Records from
+ *     the Parent via CDS/CDNSKEY</a>
  */
 public class CDSRecord extends DSRecord {
   CDSRecord() {}

programming_language: Java
filename: CERTRecord.java
change_type: ModificationType.MODIFY
diff: @@ -12,8 +12,8 @@ import org.xbill.DNS.utils.base64;
  *
  * @see KEYRecord
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4398">RFC 4398: Storing Certificates in the Domain
- *     Name System (DNS)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4398">RFC 4398: Storing Certificates in
+ *     the Domain Name System (DNS)</a>
  */
 public class CERTRecord extends Record {
 

programming_language: Java
filename: CNAMERecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,8 +7,8 @@ package org.xbill.DNS;
  * CNAME Record - maps an alias to its real name
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class CNAMERecord extends SingleCompressedNameBase {
   CNAMERecord() {}

programming_language: Java
filename: ClientSubnetOption.java
change_type: ModificationType.MODIFY
diff: @@ -7,8 +7,7 @@ import java.net.InetAddress;
 import java.net.UnknownHostException;
 
 /**
- * The Client Subnet EDNS Option, defined in <a href="https://tools.ietf.org/html/rfc7871">Client
- * subnet in DNS requests</a>.
+ * The Client Subnet EDNS Option.
  *
  * <p>The option is used to convey information about the IP address of the originating client, so
  * that an authoritative server can make decisions based on this address, rather than the address of
@@ -22,6 +21,7 @@ import java.net.UnknownHostException;
  * length (where the final octet is padded with bits set to 0)
  *
  * @see OPTRecord
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc7871">RFC 7871</a>
  * @author Brian Wellington
  * @author Ming Zhou &lt;mizhou@bnivideo.com&gt;, Beaumaris Networks
  */

programming_language: Java
filename: CookieOption.java
change_type: ModificationType.MODIFY
diff: @@ -6,9 +6,10 @@ import java.util.Optional;
 import org.xbill.DNS.utils.base16;
 
 /**
- * Cookie EDNS0 Option, as defined in https://tools.ietf.org/html/rfc7873
+ * Cookie EDNS0 Option.
  *
  * @see OPTRecord
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc7873">RFC 7873</a>
  * @author Klaus Malorny
  */
 public class CookieOption extends EDNSOption {

programming_language: Java
filename: DHCIDRecord.java
change_type: ModificationType.MODIFY
diff: @@ -10,8 +10,8 @@ import org.xbill.DNS.utils.base64;
  * DHCID - Dynamic Host Configuration Protocol (DHCP) ID (RFC 4701)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4701">RFC 4701: A DNS Resource Record (RR) for
- *     Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4701">RFC 4701: A DNS Resource Record (RR)
+ *     for Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)</a>
  */
 public class DHCIDRecord extends Record {
   private byte[] data;

programming_language: Java
filename: DLVRecord.java
change_type: ModificationType.MODIFY
diff: @@ -14,8 +14,8 @@ import org.xbill.DNS.utils.base16;
  * @see DSRecord
  * @author David Blacka
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4431">RFC 4431: The DNSSEC Lookaside Validation
- *     (DLV) DNS Resource Record</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4431">RFC 4431: The DNSSEC Lookaside
+ *     Validation (DLV) DNS Resource Record</a>
  */
 public class DLVRecord extends Record {
 

programming_language: Java
filename: DNAMERecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,7 +7,8 @@ package org.xbill.DNS;
  * DNAME Record - maps a nonterminal alias (subtree) to a different domain
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc6672">RFC 6672: DNAME Redirection in the DNS</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc6672">RFC 6672: DNAME Redirection in the
+ *     DNS</a>
  */
 public class DNAMERecord extends SingleNameBase {
   DNAMERecord() {}

programming_language: Java
filename: DNSKEYRecord.java
change_type: ModificationType.MODIFY
diff: @@ -12,8 +12,8 @@ import java.security.PublicKey;
  *
  * @see DNSSEC
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
- *     Security Extensions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
+ *     DNS Security Extensions</a>
  */
 public class DNSKEYRecord extends KEYBase {
 

programming_language: Java
filename: DNSSEC.java
change_type: ModificationType.MODIFY
diff: @@ -46,8 +46,9 @@ public class DNSSEC {
     private Algorithm() {}
 
     /**
-     * Delete DS record in parent zone, RFC8078.
+     * Delete DS record in parent zone.
      *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8078/">RFC 8078</a>
      * @since 3.5
      */
     public static final int DELETE = 0;
@@ -79,27 +80,40 @@ public class DNSSEC {
     /** GOST R 34.10-2001. This requires an external cryptography provider, such as BouncyCastle. */
     public static final int ECC_GOST = 12;
 
-    /** ECDSA Curve P-256 with SHA-256 public key * */
+    /** ECDSA Curve P-256 with SHA-256 public key. */
     public static final int ECDSAP256SHA256 = 13;
 
-    /** ECDSA Curve P-384 with SHA-384 public key * */
+    /** ECDSA Curve P-384 with SHA-384 public key. */
     public static final int ECDSAP384SHA384 = 14;
 
-    /** Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC, RFC8080 */
+    /**
+     * Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8080/">RFC 8080</a>
+     */
     public static final int ED25519 = 15;
 
-    /** Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC, RFC8080 */
+    /**
+     * Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8080/">RFC 8080</a>
+     */
     public static final int ED448 = 16;
 
     /**
-     * SM2 signing algorithm with SM3 hashing algorithm. <a
-     * href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
+     * SM2 signing algorithm with SM3 hashing algorithm.
+     *
+     * @see <a
+     *     href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
+     * @since 3.6
      */
     public static final int SM2SM3 = 17;
 
     /**
-     * GOST R 34.10-2012 <a
-     * href="https://datatracker.ietf.org/doc/draft-makarenko-gost2012-dnssec/05/">draft-makarenko-gost2012-dnssec-05</a>
+     * GOST R 34.10-2012.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc9558/">RFC 9558</a>
+     * @since 3.6
      */
     public static final int ECC_GOST12 = 23;
 
@@ -169,27 +183,48 @@ public class DNSSEC {
   public static class Digest {
     private Digest() {}
 
-    /** SHA-1, RFC3658. */
+    /**
+     * SHA-1.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc3658/">RFC 3658</a>
+     */
     public static final int SHA1 = 1;
 
-    /** SHA-256, RFC4509. */
+    /**
+     * SHA-256.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc4509/">RFC 4509</a>
+     */
     public static final int SHA256 = 2;
 
-    /** GOST R 34.11-94, RFC5933. */
+    /**
+     * GOST R 34.11-94.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5933/">RFC 5933</a>
+     */
     public static final int GOST3411 = 3;
 
-    /** SHA-384, RFC6605. */
+    /**
+     * SHA-384.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6605/">RFC 6605</a>
+     */
     public static final int SHA384 = 4;
 
     /**
-     * SM3 hashing algorithm. <a
-     * href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
+     * GOST R 34.11-2012.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc9558/">RFC 9558</a>
+     * @since 3.6
      */
     public static final int GOST3411_12 = 5;
 
     /**
-     * GOST R 34.10-2012 <a
-     * href="https://datatracker.ietf.org/doc/draft-makarenko-gost2012-dnssec/05/">draft-makarenko-gost2012-dnssec-05</a>
+     * SM3 hashing algorithm.
+     *
+     * @see <a
+     *     href="https://datatracker.ietf.org/doc/draft-cuiling-dnsop-sm2-alg/15/">draft-cuiling-dnsop-sm2-alg-15</a>
+     * @since 3.6
      */
     public static final int SM3 = 6;
 

programming_language: Java
filename: DSRecord.java
change_type: ModificationType.MODIFY
diff: @@ -13,8 +13,8 @@ import org.xbill.DNS.utils.base16;
  * @see DNSSEC
  * @author David Blacka
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
- *     Security Extensions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
+ *     DNS Security Extensions</a>
  */
 public class DSRecord extends Record {
 

programming_language: Java
filename: DohResolver.java
change_type: ModificationType.MODIFY
diff: @@ -35,9 +35,9 @@ import org.xbill.DNS.AsyncSemaphore.Permit;
 import org.xbill.DNS.utils.base64;
 
 /**
- * Proof-of-concept <a href="https://tools.ietf.org/html/rfc8484">DNS over HTTP (DoH)</a> resolver.
- * This class is not suitable for high load scenarios because of the shortcomings of Java's built-in
- * HTTP clients. For more control, implement your own {@link Resolver} using e.g. <a
+ * Proof-of-concept <a href="https://datatracker.ietf.org/doc/html/rfc8484">DNS over HTTP (DoH)</a>
+ * resolver. This class is not suitable for high load scenarios because of the shortcomings of
+ * Java's built-in HTTP clients. For more control, implement your own {@link Resolver} using e.g. <a
  * href="https://github.com/square/okhttp/">OkHttp</a>.
  *
  * <p>On Java 8, it uses HTTP/1.1, which is against the recommendation of RFC 8484 to use HTTP/2 and

programming_language: Java
filename: EDNSOption.java
change_type: ModificationType.MODIFY
diff: @@ -22,54 +22,129 @@ public abstract class EDNSOption {
   public static class Code {
     private Code() {}
 
-    /** Apple's DNS Long-Lived Queries protocol, draft-sekar-dns-llq-06 */
+    /**
+     * Apple's DNS Long-Lived Queries protocol.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8764/">RFC 8764</a>
+     */
     public static final int LLQ = 1;
 
-    /** Dynamic DNS Update Leases, draft-sekar-dns-ul-02 */
+    /**
+     * Dynamic DNS Update Leases.
+     *
+     * @see <a
+     *     href="https://datatracker.ietf.org/doc/html/draft-sekar-dns-ul-03">draft-sekar-dns-ul-03</a>
+     */
     public static final int UL = 2;
 
-    /** Name Server Identifier, RFC 5001 */
+    /**
+     * Name Server Identifier.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5001/">RFC 5001</a>
+     */
     public static final int NSID = 3;
 
-    /** DNSSEC Algorithm Understood (DAU), RFC 6975 */
+    /**
+     * DNSSEC Algorithm Understood (DAU).
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6975/">RFC 6975</a>
+     */
     public static final int DAU = 5;
 
-    /** DNSSEC DS Hash Understood (DHU), RFC 6975 */
+    /**
+     * DNSSEC DS Hash Understood (DHU).
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8764/">RFC 8764</a>
+     */
     public static final int DHU = 6;
 
-    /** DNSSEC NSEC3 Hash Understood (N3U), RFC 6975 */
+    /**
+     * DNSSEC NSEC3 Hash Understood (N3U).
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6975/">RFC 6975</a>
+     */
     public static final int N3U = 7;
 
-    /** Client Subnet, RFC 7871 */
+    /**
+     * Client Subnet.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7871/">RFC 7871</a>
+     */
     public static final int CLIENT_SUBNET = 8;
 
-    /** (EDNS) EXPIRE Option, RFC 7314 */
+    /**
+     * (EDNS) EXPIRE Option.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7314/">RFC 7314</a>
+     */
     public static final int EDNS_EXPIRE = 9;
 
-    /** Cookie, RFC 7873 */
+    /**
+     * Cookie.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7873/">RFC 7873</a>
+     */
     public static final int COOKIE = 10;
 
-    /** TCP Keepalive, RFC 7828 */
+    /**
+     * TCP Keepalive.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7828/">RFC 7828</a>
+     */
     public static final int TCP_KEEPALIVE = 11;
 
-    /** EDNS(0) Padding Option, RFC 7830 */
+    /**
+     * EDNS(0) Padding Option.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7830/">RFC 7830</a>
+     */
     public static final int PADDING = 12;
 
-    /** CHAIN Query Requests in DNS, RFC 7901 */
+    /**
+     * CHAIN Query Requests in DNS.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc7901/">RFC 7901</a>
+     */
     public static final int CHAIN = 13;
 
-    /** Signaling Trust Anchor Knowledge in DNS Security Extensions (DNSSEC), RFC 8145 */
+    /**
+     * Signaling Trust Anchor Knowledge in DNS Security Extensions (DNSSEC).
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8145/">RFC 8145</a>
+     */
     public static final int EDNS_KEY_TAG = 14;
 
-    /** Extended DNS Errors, RFC 8914. */
+    /**
+     * Extended DNS Errors.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8914/">RFC 8914</a>
+     */
     public static final int EDNS_EXTENDED_ERROR = 15;
 
-    /** DNS EDNS Tags, draft-bellis-dnsop-edns-tags-01 */
+    /**
+     * DNS EDNS Tags.
+     *
+     * @see <a
+     *     href="https://datatracker.ietf.org/doc/html/draft-bellis-dnsop-edns-tags-01">draft-bellis-dnsop-edns-tags-01</a>
+     */
     public static final int EDNS_CLIENT_TAG = 16;
 
-    /** DNS EDNS Tags, draft-bellis-dnsop-edns-tags-01 */
+    /**
+     * DNS EDNS Tags.
+     *
+     * @see <a
+     *     href="https://datatracker.ietf.org/doc/html/draft-bellis-dnsop-edns-tags-01">draft-bellis-dnsop-edns-tags-01</a>
+     */
     public static final int EDNS_SERVER_TAG = 17;
 
+    /**
+     * Report Channel.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc9567/">RFC 9567</a>
+     * @since 3.6
+     */
+    public static final int REPORT_CHANNEL = 18;
+
     private static final Mnemonic codes =
         new Mnemonic("EDNS Option Codes", Mnemonic.CASE_SENSITIVE);
 
@@ -95,6 +170,7 @@ public abstract class EDNSOption {
       codes.add(EDNS_EXTENDED_ERROR, "Extended_DNS_Error");
       codes.add(EDNS_CLIENT_TAG, "EDNS-Client-Tag");
       codes.add(EDNS_SERVER_TAG, "EDNS-Server-Tag");
+      codes.add(REPORT_CHANNEL, "Report-Channel");
     }
 
     /** Converts an EDNS Option Code into its textual representation */

programming_language: Java
filename: ExtendedErrorCodeOption.java
change_type: ModificationType.MODIFY
diff: @@ -40,7 +40,9 @@ public class ExtendedErrorCodeOption extends EDNSOption {
 
   /**
    * The resolver attempted to perform DNSSEC validation, but validation ended in the Indeterminate
-   * state [RFC4035].
+   * state.
+   *
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc4035>RFC 4035</a>
    */
   public static final int DNSSEC_INDETERMINATE = 5;
 
@@ -163,7 +165,7 @@ public class ExtendedErrorCodeOption extends EDNSOption {
    * DNS over QUIC session resumption error.
    *
    * @since 3.6
-   * @see <a href="https://www.rfc-editor.org/rfc/rfc9250.html#section-4.5-3">RFC9250, 4.5</a>
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9250#section-4.5-3">RFC 9250, 4.5</a>
    */
   public static final int TOO_EARLY = 26;
 
@@ -171,7 +173,7 @@ public class ExtendedErrorCodeOption extends EDNSOption {
    * The NSEC3 iterations value is not supported.
    *
    * @since 3.6
-   * @see <a href="https://www.rfc-editor.org/rfc/rfc9276.html#section-3.2">RFC9276, 3.2</a>
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9276#section-3.2">RFC 9276, 3.2</a>
    */
   public static final int UNSUPPORTED_NSEC3_ITERATIONS_VALUE = 27;
 
@@ -180,8 +182,7 @@ public class ExtendedErrorCodeOption extends EDNSOption {
    *
    * @since 3.6
    * @see <a
-   *     href="https://datatracker.ietf.org/doc/draft-homburg-dnsop-codcp/01/">draft-homburg-dnsop-codcp,
-   *     12</a>
+   *     href="https://datatracker.ietf.org/doc/draft-homburg-dnsop-codcp/01/">draft-homburg-dnsop-codcp-01</a>
    */
   public static final int UNABLE_TO_CONFORM_TO_POLICY = 28;
 
@@ -190,7 +191,7 @@ public class ExtendedErrorCodeOption extends EDNSOption {
    *
    * @since 3.6
    * @see <a href="https://github.com/PowerDNS/pdns/pull/12334">PowerDNS PR#12334</a>
-   * @see <a href="https://datatracker.ietf.org/doc/html/rfc8198">RFC8198</a>
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc8198">RFC 8198</a>
    */
   public static final int SYNTHESIZED = 29;
 

programming_language: Java
filename: GPOSRecord.java
change_type: ModificationType.MODIFY
diff: @@ -10,8 +10,8 @@ import java.io.IOException;
  * limited early version of {@link LOCRecord})
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1712">RFC 1712: DNS Encoding of Geographical
- *     Location</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1712">RFC 1712: DNS Encoding of
+ *     Geographical Location</a>
  */
 public class GPOSRecord extends Record {
   private byte[] latitude, longitude, altitude;

programming_language: Java
filename: HINFORecord.java
change_type: ModificationType.MODIFY
diff: @@ -9,8 +9,8 @@ import java.io.IOException;
  * Host Information - describes the CPU and OS of a host
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class HINFORecord extends Record {
   private byte[] cpu, os;

programming_language: Java
filename: HTTPSRecord.java
change_type: ModificationType.MODIFY
diff: @@ -4,11 +4,10 @@ package org.xbill.DNS;
 import java.util.List;
 
 /**
- * HTTPS Service Location and Parameter Binding Record
+ * HTTPS Service Location and Parameter Binding Record.
  *
- * @see <a
- *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
  * @since 3.3
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
  */
 public class HTTPSRecord extends SVCBBase {
   HTTPSRecord() {}

programming_language: Java
filename: IPSECKEYRecord.java
change_type: ModificationType.MODIFY
diff: @@ -12,8 +12,8 @@ import org.xbill.DNS.utils.base64;
  * IPsec Keying Material (RFC 4025)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4025">RFC 4025: A Method for Storing IPsec Keying
- *     Material in DNS</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4025">RFC 4025: A Method for Storing IPsec
+ *     Keying Material in DNS</a>
  */
 public class IPSECKEYRecord extends Record {
   /**
@@ -24,13 +24,25 @@ public class IPSECKEYRecord extends Record {
   public static class Algorithm {
     private Algorithm() {}
 
-    /** A DSA key is present, in the format defined in [RFC2536] */
+    /**
+     * A DSA key is present.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc2536">RFC 2536</a>
+     */
     public static final int DSA = 1;
 
-    /** A RSA key is present, in the format defined in [RFC3110] */
+    /**
+     * A RSA key is present.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc3110">RFC 3110</a>
+     */
     public static final int RSA = 2;
 
-    /** An ECDSA key is present, in the format defined in [RFC6605] */
+    /**
+     * An ECDSA key is present.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6605">RFC 6605</a>
+     */
     public static final int ECDSA = 3;
   }
 

programming_language: Java
filename: ISDNRecord.java
change_type: ModificationType.MODIFY
diff: @@ -9,7 +9,7 @@ import java.io.IOException;
  * ISDN - identifies the ISDN number and subaddress associated with a name.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
  */
 public class ISDNRecord extends Record {
   private byte[] address;

programming_language: Java
filename: KEYRecord.java
change_type: ModificationType.MODIFY
diff: @@ -14,10 +14,10 @@ import java.util.StringTokenizer;
  * @see DNSSEC
  * @see DNSKEYRecord
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc2535">RFC 2535: Domain Name System Security
- *     Extensions</a>
- * @see <a href="https://tools.ietf.org/html/rfc3755">RFC 3755: Legacy Resolver Compatibility for
- *     Delegation Signer (DS)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2535">RFC 2535: Domain Name System
+ *     Security Extensions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc3755">RFC 3755: Legacy Resolver
+ *     Compatibility for Delegation Signer (DS)</a>
  */
 public class KEYRecord extends KEYBase {
   /** KEY protocol identifiers. */

programming_language: Java
filename: KXRecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,8 +7,8 @@ package org.xbill.DNS;
  * Key Exchange - delegation of authority
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc2230">RFC 2230: Key Exchange Delegation Record for
- *     the DNS</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2230">RFC 2230: Key Exchange Delegation
+ *     Record for the DNS</a>
  */
 public class KXRecord extends U16NameBase {
   KXRecord() {}

programming_language: Java
filename: LOCRecord.java
change_type: ModificationType.MODIFY
diff: @@ -11,8 +11,8 @@ import java.text.NumberFormat;
  * Location - describes the physical location of hosts, networks, subnets.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1876">RFC 1876: A Means for Expressing Location
- *     Information in the Domain Name System</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1876">RFC 1876: A Means for Expressing
+ *     Location Information in the Domain Name System</a>
  */
 public class LOCRecord extends Record {
   private static final NumberFormat w2;

programming_language: Java
filename: MBRecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,8 +7,8 @@ package org.xbill.DNS;
  * Mailbox Record - specifies a host containing a mailbox.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class MBRecord extends SingleNameBase {
   MBRecord() {}

programming_language: Java
filename: MDRecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,7 +7,7 @@ package org.xbill.DNS;
  * Mail Destination Record - specifies a mail agent which delivers mail for a domain (obsolete)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc973">RFC 973: Domain System Changes and
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc973">RFC 973: Domain System Changes and
  *     Observations</a>
  */
 public class MDRecord extends SingleNameBase {

programming_language: Java
filename: MFRecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,7 +7,7 @@ package org.xbill.DNS;
  * Mail Forwarder Record - specifies a mail agent which forwards mail for a domain (obsolete)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc973">RFC 973: Domain System Changes and
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc973">RFC 973: Domain System Changes and
  *     Observations</a>
  */
 public class MFRecord extends SingleNameBase {

programming_language: Java
filename: MGRecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,8 +7,8 @@ package org.xbill.DNS;
  * Mail Group Record - specifies a mailbox which is a member of a mail group.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class MGRecord extends SingleNameBase {
   MGRecord() {}

programming_language: Java
filename: MINFORecord.java
change_type: ModificationType.MODIFY
diff: @@ -10,8 +10,8 @@ import java.io.IOException;
  * address to receive error messages relating to the mailing list/mailbox.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class MINFORecord extends Record {
   private Name responsibleAddress;

programming_language: Java
filename: MRRecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,8 +7,8 @@ package org.xbill.DNS;
  * Mailbox Rename Record - specifies a rename of a mailbox.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc883">RFC 883: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc883">RFC 883: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class MRRecord extends SingleNameBase {
   MRRecord() {}

programming_language: Java
filename: MXRecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,10 +7,10 @@ package org.xbill.DNS;
  * Mail Exchange - specifies where mail to a domain is sent
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
- * @see <a href="https://tools.ietf.org/html/rfc7505">RFC 7505: A "Null MX" No Service Resource
- *     Record for Domains That Accept No Mail</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc7505">RFC 7505: A "Null MX" No Service
+ *     Resource Record for Domains That Accept No Mail</a>
  */
 public class MXRecord extends U16NameBase {
   MXRecord() {}

programming_language: Java
filename: NAPTRRecord.java
change_type: ModificationType.MODIFY
diff: @@ -10,8 +10,8 @@ import java.io.IOException;
  * will produce a new domain.
  *
  * @author Chuck Santos
- * @see <a href="https://tools.ietf.org/html/rfc3403">RFC 3403: Dynamic Delegation Discovery System
- *     (DDDS) Part Three: The Domain Name System (DNS) Database</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc3403">RFC 3403: Dynamic Delegation
+ *     Discovery System (DDDS) Part Three: The Domain Name System (DNS) Database</a>
  */
 public class NAPTRRecord extends Record {
   private int order, preference;

programming_language: Java
filename: NSAPRecord.java
change_type: ModificationType.MODIFY
diff: @@ -11,7 +11,8 @@ import org.xbill.DNS.utils.base16;
  * NSAP Address Record.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1706">RFC 1706: DNS NSAP Resource Records</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1706">RFC 1706: DNS NSAP Resource
+ *     Records</a>
  */
 public class NSAPRecord extends Record {
   private byte[] address;

programming_language: Java
filename: NSAP_PTRRecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,7 +7,8 @@ package org.xbill.DNS;
  * NSAP Pointer Record - maps a domain name representing an NSAP Address to a hostname. (obsolete)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1706">RFC 1706: DNS NSAP Resource Records</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1706">RFC 1706: DNS NSAP Resource
+ *     Records</a>
  */
 public class NSAP_PTRRecord extends SingleNameBase {
   NSAP_PTRRecord() {}

programming_language: Java
filename: NSEC3PARAMRecord.java
change_type: ModificationType.MODIFY
diff: @@ -15,8 +15,8 @@ import org.xbill.DNS.utils.base16;
  *
  * @author Brian Wellington
  * @author David Blacka
- * @see <a href="https://tools.ietf.org/html/rfc5155">RFC 5155: DNS Security (DNSSEC) Hashed
- *     Authenticated Denial of Existence</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc5155">RFC 5155: DNS Security (DNSSEC)
+ *     Hashed Authenticated Denial of Existence</a>
  */
 public class NSEC3PARAMRecord extends Record {
   private int hashAlg;

programming_language: Java
filename: NSEC3Record.java
change_type: ModificationType.MODIFY
diff: @@ -18,8 +18,8 @@ import org.xbill.DNS.utils.base32;
  *
  * @author Brian Wellington
  * @author David Blacka
- * @see <a href="https://tools.ietf.org/html/rfc5155">RFC 5155: DNS Security (DNSSEC) Hashed
- *     Authenticated Denial of Existence</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc5155">RFC 5155: DNS Security (DNSSEC)
+ *     Hashed Authenticated Denial of Existence</a>
  */
 public class NSEC3Record extends Record {
 

programming_language: Java
filename: NSECRecord.java
change_type: ModificationType.MODIFY
diff: @@ -14,8 +14,8 @@ import java.io.IOException;
  *
  * @author Brian Wellington
  * @author David Blacka
- * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
- *     Security Extensions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
+ *     DNS Security Extensions</a>
  */
 public class NSECRecord extends Record {
   private Name next;

programming_language: Java
filename: NSIDOption.java
change_type: ModificationType.MODIFY
diff: @@ -8,8 +8,8 @@ package org.xbill.DNS;
  *
  * @see OPTRecord
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc5001">RFC 5001: DNS Name Server Identifier (NSID)
- *     Option</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc5001">RFC 5001: DNS Name Server Identifier
+ *     (NSID) Option</a>
  */
 public class NSIDOption extends GenericEDNSOption {
   NSIDOption() {

programming_language: Java
filename: NSRecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,8 +7,8 @@ package org.xbill.DNS;
  * Name Server Record - contains the name server serving the named zone
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class NSRecord extends SingleCompressedNameBase {
   NSRecord() {}

programming_language: Java
filename: NULLRecord.java
change_type: ModificationType.MODIFY
diff: @@ -9,8 +9,8 @@ import java.io.IOException;
  * The NULL Record. This has no defined purpose, but can be used to hold arbitrary data.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class NULLRecord extends Record {
   private byte[] data;

programming_language: Java
filename: NXTRecord.java
change_type: ModificationType.MODIFY
diff: @@ -12,8 +12,8 @@ import java.util.BitSet;
  * signifies a failed query for data in a DNSSEC-signed zone.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc2065">RFC 2065: Domain Name System Security
- *     Extensions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2065">RFC 2065: Domain Name System
+ *     Security Extensions</a>
  */
 public class NXTRecord extends Record {
   private Name next;

programming_language: Java
filename: NioTcpClient.java
change_type: ModificationType.MODIFY
diff: @@ -92,7 +92,7 @@ final class NioTcpClient extends NioClient implements TcpIoClient {
           queryData);
 
       // combine length+message to avoid multiple TCP packets
-      // https://tools.ietf.org/html/rfc7766#section-8
+      // https://datatracker.ietf.org/doc/html/rfc7766#section-8
       ByteBuffer buffer = ByteBuffer.allocate(queryData.length + 2);
       buffer.put((byte) (queryData.length >>> 8));
       buffer.put((byte) (queryData.length & 0xFF));

programming_language: Java
filename: NioUdpClient.java
change_type: ModificationType.MODIFY
diff: @@ -30,7 +30,7 @@ final class NioUdpClient extends NioClient implements UdpIoClient {
   private final Queue<Transaction> pendingTransactions = new ConcurrentLinkedQueue<>();
 
   NioUdpClient() {
-    // https://tools.ietf.org/html/rfc6335#section-6
+    // https://datatracker.ietf.org/doc/html/rfc6335#section-6
     int ephemeralStartDefault = 49152;
     int ephemeralEndDefault = 65535;
 

programming_language: Java
filename: OPENPGPKEYRecord.java
change_type: ModificationType.MODIFY
diff: @@ -9,8 +9,8 @@ import org.xbill.DNS.utils.base64;
  *
  * @author Brian Wellington
  * @author Valentin Hauner
- * @see <a href="https://tools.ietf.org/html/rfc7929">RFC 7929: DNS-Based Authentication of Named
- *     Entities (DANE) Bindings for OpenPGP</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc7929">RFC 7929: DNS-Based Authentication
+ *     of Named Entities (DANE) Bindings for OpenPGP</a>
  */
 public class OPENPGPKEYRecord extends Record {
   private byte[] cert;

programming_language: Java
filename: OPTRecord.java
change_type: ModificationType.MODIFY
diff: @@ -18,7 +18,8 @@ import java.util.List;
  *
  * @see Message
  * @see Resolver
- * @see <a href="https://tools.ietf.org/html/rfc6891">RFC 6891: Extension Mechanisms for DNS</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc6891">RFC 6891: Extension Mechanisms for
+ *     DNS</a>
  * @author Brian Wellington
  */
 public class OPTRecord extends Record {

programming_language: Java
filename: Opcode.java
change_type: ModificationType.MODIFY
diff: @@ -25,7 +25,11 @@ public final class Opcode {
   /** A dynamic update message */
   public static final int UPDATE = 5;
 
-  /** DNS Stateful Operations (DSO, RFC8490) */
+  /**
+   * DNS Stateful Operations (DSO).
+   *
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc8490">RFC 8490</a>
+   */
   public static final int DSO = 6;
 
   private static final Mnemonic opcodes = new Mnemonic("DNS Opcode", Mnemonic.CASE_UPPER);

programming_language: Java
filename: PTRRecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,8 +7,8 @@ package org.xbill.DNS;
  * Pointer Record - maps a domain name representing an Internet Address to a hostname.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class PTRRecord extends SingleCompressedNameBase {
   PTRRecord() {}

programming_language: Java
filename: PXRecord.java
change_type: ModificationType.MODIFY
diff: @@ -9,8 +9,8 @@ import java.io.IOException;
  * X.400 mail mapping record.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc2163">RFC 2163: Using the Internet DNS to Distribute
- *     MIXER Conformant Global Address Mapping (MCGAM)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2163">RFC 2163: Using the Internet DNS to
+ *     Distribute MIXER Conformant Global Address Mapping (MCGAM)</a>
  */
 public class PXRecord extends Record {
   private int preference;

programming_language: Java
filename: RPRecord.java
change_type: ModificationType.MODIFY
diff: @@ -11,7 +11,7 @@ import java.io.IOException;
  *
  * @author Tom Scola (tscola@research.att.com)
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
  */
 public class RPRecord extends Record {
   private Name mailbox;

programming_language: Java
filename: RRSIGRecord.java
change_type: ModificationType.MODIFY
diff: @@ -14,8 +14,8 @@ import java.util.Date;
  * @see RRset
  * @see DNSSEC
  * @see KEYRecord
- * @see <a href="https://tools.ietf.org/html/rfc4034">RFC 4034: Resource Records for the DNS
- *     Security Extensions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4034">RFC 4034: Resource Records for the
+ *     DNS Security Extensions</a>
  * @author Brian Wellington
  */
 public class RRSIGRecord extends SIGBase {

programming_language: Java
filename: RTRecord.java
change_type: ModificationType.MODIFY
diff: @@ -7,8 +7,8 @@ package org.xbill.DNS;
  * Route Through Record - lists a route preference and intermediate host.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class RTRecord extends U16NameBase {
   RTRecord() {}

programming_language: Java
filename: SIGRecord.java
change_type: ModificationType.MODIFY
diff: @@ -13,8 +13,8 @@ import java.util.Date;
  *
  * @see RRset
  * @see DNSSEC
- * @see KEYRecord <a href="https://tools.ietf.org/html/rfc2535">RFC 2535: Domain Name System
- *     Security Extensions</a>
+ * @see KEYRecord <a href="https://datatracker.ietf.org/doc/html/rfc2535">RFC 2535: Domain Name
+ *     System Security Extensions</a>
  * @author Brian Wellington
  */
 public class SIGRecord extends SIGBase {

programming_language: Java
filename: SMIMEARecord.java
change_type: ModificationType.MODIFY
diff: @@ -6,8 +6,8 @@ package org.xbill.DNS;
 /**
  * S/MIME cert association
  *
- * @see <a href="https://tools.ietf.org/html/rfc8162">RFC 8162: Using Secure DNS to Associate
- *     Certificates with Domain Names for S/MIME</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc8162">RFC 8162: Using Secure DNS to
+ *     Associate Certificates with Domain Names for S/MIME</a>
  * @author Brian Wellington
  */
 public class SMIMEARecord extends TLSARecord {

programming_language: Java
filename: SOARecord.java
change_type: ModificationType.MODIFY
diff: @@ -9,8 +9,8 @@ import java.io.IOException;
  * Start of Authority - describes properties of a zone.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class SOARecord extends Record {
   private Name host, admin;

programming_language: Java
filename: SPFRecord.java
change_type: ModificationType.MODIFY
diff: @@ -9,8 +9,8 @@ import java.util.List;
  * Sender Policy Framework (discontinued in RFC 7208)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc7208">RFC 7208: Sender Policy Framework (SPF) for
- *     Authorizing Use of Domains in Email, Version 1</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc7208">RFC 7208: Sender Policy Framework
+ *     (SPF) for Authorizing Use of Domains in Email, Version 1</a>
  */
 public class SPFRecord extends TXTBase {
   SPFRecord() {}

programming_language: Java
filename: SRVRecord.java
change_type: ModificationType.MODIFY
diff: @@ -11,8 +11,8 @@ import java.io.IOException;
  * (for the secure SIP protocol) and _http._tcp.example.com (if HTTP used SRV records)
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc2782">RFC 2782: A DNS RR for specifying the location
- *     of services (DNS SRV)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2782">RFC 2782: A DNS RR for specifying
+ *     the location of services (DNS SRV)</a>
  */
 public class SRVRecord extends Record {
   private int priority, weight, port;

programming_language: Java
filename: SSHFPRecord.java
change_type: ModificationType.MODIFY
diff: @@ -10,8 +10,8 @@ import org.xbill.DNS.utils.base16;
  * SSH Fingerprint - stores the fingerprint of an SSH host key.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc4255">RFC 4255: Using DNS to Securely Publish Secure
- *     Shell (SSH) Key Fingerprints</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc4255">RFC 4255: Using DNS to Securely
+ *     Publish Secure Shell (SSH) Key Fingerprints</a>
  */
 public class SSHFPRecord extends Record {
   public static class Algorithm {

programming_language: Java
filename: SVCBBase.java
change_type: ModificationType.MODIFY
diff: @@ -20,9 +20,8 @@ import org.xbill.DNS.utils.base64;
 /**
  * Implements common functionality for SVCB and HTTPS records
  *
- * @see <a
- *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
  * @since 3.3
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
  */
 public abstract class SVCBBase extends Record {
   protected int svcPriority;

programming_language: Java
filename: SVCBRecord.java
change_type: ModificationType.MODIFY
diff: @@ -6,9 +6,8 @@ import java.util.List;
 /**
  * Service Location and Parameter Binding Record
  *
- * @see <a
- *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
  * @since 3.3
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
  */
 public class SVCBRecord extends SVCBBase {
   SVCBRecord() {}

programming_language: Java
filename: TKEYRecord.java
change_type: ModificationType.MODIFY
diff: @@ -13,8 +13,8 @@ import org.xbill.DNS.utils.base64;
  *
  * @see TSIG
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc2930">RFC 2930: Secret Key Establishment for DNS
- *     (TKEY RR)</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2930">RFC 2930: Secret Key Establishment
+ *     for DNS (TKEY RR)</a>
  */
 public class TKEYRecord extends Record {
   private Name alg;

programming_language: Java
filename: TLSARecord.java
change_type: ModificationType.MODIFY
diff: @@ -10,8 +10,8 @@ import org.xbill.DNS.utils.base16;
  * Transport Layer Security Authentication
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc6698">RFC 6698: The DNS-Based Authentication of
- *     Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc6698">RFC 6698: The DNS-Based
+ *     Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA</a>
  */
 public class TLSARecord extends Record {
   public static class CertificateUsage {
@@ -26,10 +26,18 @@ public class TLSARecord extends Record {
   public static class Selector {
     private Selector() {}
 
-    /** Full certificate; the Certificate binary structure defined in [RFC5280] */
+    /**
+     * Full certificate; the Certificate binary structure.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5280">RFC 5280</a>
+     */
     public static final int FULL_CERTIFICATE = 0;
 
-    /** SubjectPublicKeyInfo; DER-encoded binary structure defined in [RFC5280] */
+    /**
+     * SubjectPublicKeyInfo; DER-encoded binary structure.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc5280">RFC 5280</a>
+     */
     public static final int SUBJECT_PUBLIC_KEY_INFO = 1;
   }
 
@@ -39,10 +47,18 @@ public class TLSARecord extends Record {
     /** Exact match on selected content */
     public static final int EXACT = 0;
 
-    /** SHA-256 hash of selected content [RFC6234] */
+    /**
+     * SHA-256 hash of selected content.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6234">RFC 6234</a>
+     */
     public static final int SHA256 = 1;
 
-    /** SHA-512 hash of selected content [RFC6234] */
+    /**
+     * SHA-512 hash of selected content.
+     *
+     * @see <a href="https://datatracker.ietf.org/doc/html/rfc6234">RFC 6234</a>
+     */
     public static final int SHA512 = 2;
   }
 

programming_language: Java
filename: TSIG.java
change_type: ModificationType.MODIFY
diff: @@ -665,7 +665,7 @@ public class TSIG {
     }
 
     // validate time after the signature, as per
-    // https://www.rfc-editor.org/rfc/rfc8945.html#section-5.4
+    // https://datatracker.ietf.org/doc/html/rfc8945#section-5.4
     int badtime = verifyTime(tsig);
     if (badtime != Rcode.NOERROR) {
       return badtime;
@@ -804,7 +804,7 @@ public class TSIG {
      * Creates an instance to sign multiple message for use in a stream.
      *
      * <p>This class creates a {@link TSIGRecord} on every message to conform with <a
-     * href="https://www.rfc-editor.org/rfc/rfc8945.html#section-5.3.1">RFC 8945, 5.3.1</a>.
+     * href="https://datatracker.ietf.org/doc/html/rfc8945#section-5.3.1">RFC 8945, 5.3.1</a>.
      *
      * @param key The TSIG key used to create the signature records.
      * @param queryTsig The initial TSIG records, e.g. from a query to a server.

programming_language: Java
filename: TSIGRecord.java
change_type: ModificationType.MODIFY
diff: @@ -15,7 +15,7 @@ import org.xbill.DNS.utils.base64;
  *
  * @see Resolver
  * @see TSIG
- * @see <a href="https://tools.ietf.org/html/rfc2845">RFC 2845: Secret Key Transaction
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2845">RFC 2845: Secret Key Transaction
  *     Authentication for DNS (TSIG)</a>
  * @author Brian Wellington
  */

programming_language: Java
filename: TXTRecord.java
change_type: ModificationType.MODIFY
diff: @@ -9,8 +9,8 @@ import java.util.List;
  * Text - stores text strings
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class TXTRecord extends TXTBase {
   TXTRecord() {}

programming_language: Java
filename: TcpKeepaliveOption.java
change_type: ModificationType.MODIFY
diff: @@ -7,7 +7,7 @@ import java.util.Optional;
 import java.util.OptionalInt;
 
 /**
- * TCP Keepalive EDNS0 Option, as defined in https://tools.ietf.org/html/rfc7828
+ * TCP Keepalive EDNS0 Option, as defined in https://datatracker.ietf.org/doc/html/rfc7828
  *
  * @see OPTRecord
  * @author Klaus Malorny

programming_language: Java
filename: Type.java
change_type: ModificationType.MODIFY
diff: @@ -104,18 +104,18 @@ public final class Type {
   public static final int NXT = 30;
 
   /**
-   * Endpoint identifier
+   * DNS Resource Records for Nimrod Routing Architecture, Endpoint identifier.
    *
-   * @see <a href="https://tools.ietf.org/html/draft-ietf-nimrod-dns-00">DNS Resource Records for
-   *     Nimrod Routing Architecture</a>
+   * @see <a
+   *     href="https://datatracker.ietf.org/doc/draft-ietf-nimrod-dns/">draft-ietf-nimrod-dns</a>
    */
   public static final int EID = 31;
 
   /**
-   * Nimrod locator
+   * DNS Resource Records for Nimrod Routing Architecture, Nimrod locator.
    *
-   * @see <a href="https://tools.ietf.org/html/draft-ietf-nimrod-dns-00">DNS Resource Records for
-   *     Nimrod Routing Architecture</a>
+   * @see <a
+   *     href="https://datatracker.ietf.org/doc/draft-ietf-nimrod-dns/">draft-ietf-nimrod-dns</a>
    */
   public static final int NIMLOC = 32;
 
@@ -188,7 +188,8 @@ public final class Type {
   /**
    * Zone Status (ZS).
    *
-   * @see <a href="https://tools.ietf.org/html/draft-reid-dnsext-zs-01">draft-reid-dnsext-zs-01</a>
+   * @see <a
+   *     href="https://datatracker.ietf.org/doc/html/draft-reid-dnsext-zs-01">draft-reid-dnsext-zs-01</a>
    */
   public static final int NINFO = 56;
 
@@ -196,7 +197,7 @@ public final class Type {
    * RKEY DNS Resource Record, used for encryption of NAPTR records.
    *
    * @see <a
-   *     href="https://tools.ietf.org/html/draft-reid-dnsext-rkey-00">draft-reid-dnsext-rkey-00</a>
+   *     href="https://datatracker.ietf.org/doc/html/draft-reid-dnsext-zs-01">draft-reid-dnsext-rkey-01</a>
    */
   public static final int RKEY = 57;
 
@@ -204,7 +205,7 @@ public final class Type {
    * DNSSEC Trust Anchor History Service.
    *
    * @see <a
-   *     href="https://tools.ietf.org/html/draft-wijngaards-dnsop-trust-history-02">draft-wijngaards-dnsop-trust-history-02</a>
+   *     href="https://datatracker.ietf.org/doc/html/draft-wijngaards-dnsop-trust-history-02">draft-wijngaards-dnsop-trust-history-02</a>
    */
   public static final int TALINK = 58;
 
@@ -226,16 +227,14 @@ public final class Type {
   /**
    * Service Location and Parameter Binding
    *
-   * @see <a
-   *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
    */
   public static final int SVCB = 64;
 
   /**
    * HTTPS Service Location and Parameter Binding
    *
-   * @see <a
-   *     href="https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-06">draft-ietf-dnsop-svcb-https</a>
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc9460">RFC 9460</a>
    */
   public static final int HTTPS = 65;
 

programming_language: Java
filename: URIRecord.java
change_type: ModificationType.MODIFY
diff: @@ -10,8 +10,8 @@ import java.io.IOException;
  * Uniform Resource Identifier (URI) DNS Resource Record
  *
  * @author Anthony Kirby
- * @see <a href="https://tools.ietf.org/html/rfc7553">RFC 7553: The Uniform Resource Identifier
- *     (URI) DNS Resource Record</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc7553">RFC 7553: The Uniform Resource
+ *     Identifier (URI) DNS Resource Record</a>
  */
 public class URIRecord extends Record {
   private int priority, weight;

programming_language: Java
filename: WKSRecord.java
change_type: ModificationType.MODIFY
diff: @@ -14,14 +14,14 @@ import java.util.List;
  * Well Known Services - Lists services offered by this host.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035: Domain Names - Implementation and
- *     Specification</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035: Domain Names -
+ *     Implementation and Specification</a>
  */
 public class WKSRecord extends Record {
   /**
    * IP protocol identifiers. This is basically copied out of RFC 1010.
    *
-   * @see <a href="https://tools.ietf.org/html/rfc1010">RFC 1010: Assigned Numbers</a>
+   * @see <a href="https://datatracker.ietf.org/doc/html/rfc1010">RFC 1010: Assigned Numbers</a>
    */
   public static class Protocol {
 

programming_language: Java
filename: X25Record.java
change_type: ModificationType.MODIFY
diff: @@ -10,7 +10,7 @@ import java.io.IOException;
  * associated with a name.
  *
  * @author Brian Wellington
- * @see <a href="https://tools.ietf.org/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc1183">RFC 1183: New DNS RR Definitions</a>
  */
 public class X25Record extends Record {
   private byte[] address;

programming_language: Java
filename: ZoneMDRecord.java
change_type: ModificationType.MODIFY
diff: @@ -12,7 +12,7 @@ import org.xbill.DNS.utils.base16;
  * ZONEMD Resource record.
  *
  * @since 3.6
- * @see <a href="https://www.rfc-editor.org/rfc/rfc8976.html">RFC8976</a>
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc8976">RFC 8976</a>
  */
 public class ZoneMDRecord extends Record {
   /**
@@ -117,8 +117,8 @@ public class ZoneMDRecord extends Record {
 
   /**
    * A 32-bit unsigned integer in network byte order. It is the serial number from the zone's SOA
-   * record (<a href="https://www.rfc-editor.org/rfc/rfc1035.html">RFC1035, Section 3.3.13]</a>) for
-   * which the zone digest was generated.
+   * record (<a href="https://datatracker.ietf.org/doc/html/rfc1035">RFC 1035, Section 3.3.13]</a>)
+   * for which the zone digest was generated.
    */
   @Getter private long serial;
 

programming_language: Java
filename: LookupSession.java
change_type: ModificationType.MODIFY
diff: @@ -560,7 +560,7 @@ public class LookupSession {
   private Message maybeAddToCache(Message message) {
     for (RRset set : message.getSectionRRsets(Section.ANSWER)) {
       if ((set.getType() == Type.CNAME || set.getType() == Type.DNAME) && set.size() != 1) {
-        throw new InvalidZoneDataException("Multiple CNAME RRs not allowed, see RFC1034 3.6.2");
+        throw new InvalidZoneDataException("Multiple CNAME RRs not allowed, see RFC 1034 3.6.2");
       }
     }
     Optional.ofNullable(caches.get(message.getQuestion().getDClass()))

programming_language: Java
filename: NoSuchRRSetException.java
change_type: ModificationType.MODIFY
diff: @@ -5,9 +5,10 @@ import org.xbill.DNS.Name;
 
 /**
  * Thrown to indicate that records of the name and type queried does not exist, corresponding to the
- * {@link org.xbill.DNS.Rcode#NXRRSET} return code as specified in RFC2136 Section 2.2.
+ * {@link org.xbill.DNS.Rcode#NXRRSET} return code as specified in RFC 2136, Section 2.2.
  *
  * @since 3.4
+ * @see <a href="https://datatracker.ietf.org/doc/html/rfc2136#section-2">RFC 2136</a>
  */
 public class NoSuchRRSetException extends LookupFailedException {
   public NoSuchRRSetException(Name name, int type) {

programming_language: Java
filename: ResolveExample.java
change_type: ModificationType.MODIFY
diff: @@ -21,7 +21,7 @@ class ResolveExample {
   static String ROOT =
       ". IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
 
-  static void main(String[] args) throws Exception {
+  public static void main(String[] args) throws Exception {
     // Send two sample queries using a standard DNSJAVA resolver
     SimpleResolver sr = new SimpleResolver("8.8.8.8");
     System.out.println("Standard resolver:");
@@ -30,7 +30,7 @@ class ResolveExample {
 
     // Send the same queries using the validating resolver with the
     // trust anchor of the root zone
-    // http://data.iana.org/root-anchors/root-anchors.xml
+    // https://data.iana.org/root-anchors/root-anchors.xml
     ValidatingResolver vr = new ValidatingResolver(sr);
     vr.loadTrustAnchors(new ByteArrayInputStream(ROOT.getBytes("ASCII")));
     vr.loadTrustAnchors(new ByteArrayInputStream(ROOT.getBytes(StandardCharsets.US_ASCII)));

programming_language: Java