Commit d5844f6d6e for bind

commit d5844f6d6ef76bb631b91fa0d3f02c0412d040c3
Author: OndÅ™ej Surý <ondrej@isc.org>
Date:   Wed Sep 16 21:31:56 2026 +0200

    Drop the mctx argument from dns_rdata_tostruct()

    Practically every caller passed NULL, so the allocating mode of the
    conversion was dead weight in the API and every call site had to carry
    an extra argument for nothing.  The three callers that did pass a memory
    context (the dyndb sample driver for A/AAAA and catz for APL) never
    needed a private copy either: the source rdata outlives the struct in
    all of them, and the A/AAAA conversions never allocate anyway.

    The contract is now simply that the rdata must persist while the struct
    is in use, which is what all callers already relied on.

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index f1a9446541..3c73dd4b62 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -1848,7 +1848,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 			dns_rdataset_current(rdataset, &rdata);

 			query->lookup->nsfound++;
-			result = dns_rdata_tostruct(&rdata, &ns, NULL);
+			result = dns_rdata_tostruct(&rdata, &ns);
 			check_result(result, "dns_rdata_tostruct");
 			dns_name_format(&ns.name, namestr, sizeof(namestr));
 			dns_rdata_freestruct(&ns);
@@ -3698,7 +3698,7 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,

 				/* Now we have an SOA.  Work with it. */
 				debug("got an SOA");
-				result = dns_rdata_tostruct(&rdata, &soa, NULL);
+				result = dns_rdata_tostruct(&rdata, &soa);
 				check_result(result, "dns_rdata_tostruct");
 				serial = soa.serial;
 				dns_rdata_freestruct(&soa);
diff --git a/bin/dig/host.c b/bin/dig/host.c
index 540f05ea74..0f2e187193 100644
--- a/bin/dig/host.c
+++ b/bin/dig/host.c
@@ -338,7 +338,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		check_result(result, "dns_rdataset_first");
 		dns_rdata_reset(&rdata);
 		dns_rdataset_current(rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &cname, NULL);
+		result = dns_rdata_tostruct(&rdata, &cname);
 		check_result(result, "dns_rdata_tostruct");
 		dns_name_copy(&cname.cname, qname);
 		dns_rdata_freestruct(&cname);
diff --git a/bin/dig/nslookup.c b/bin/dig/nslookup.c
index 584b40fdce..9292c0e382 100644
--- a/bin/dig/nslookup.c
+++ b/bin/dig/nslookup.c
@@ -138,7 +138,7 @@ printsoa(dns_rdata_t *rdata) {
 	isc_result_t result;
 	char namebuf[DNS_NAME_FORMATSIZE];

-	result = dns_rdata_tostruct(rdata, &soa, NULL);
+	result = dns_rdata_tostruct(rdata, &soa);
 	check_result(result, "dns_rdata_tostruct");

 	dns_name_format(&soa.origin, namebuf, sizeof(namebuf));
@@ -336,7 +336,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		check_result(result, "dns_rdataset_first");
 		dns_rdata_reset(&rdata);
 		dns_rdataset_current(rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &cname, NULL);
+		result = dns_rdata_tostruct(&rdata, &cname);
 		check_result(result, "dns_rdata_tostruct");
 		dns_name_copy(&cname.cname, qname);
 		dns_rdata_freestruct(&cname);
diff --git a/bin/dnssec/dnssec-cds.c b/bin/dnssec/dnssec-cds.c
index d57d410fa3..d994dd42eb 100644
--- a/bin/dnssec/dnssec-cds.c
+++ b/bin/dnssec/dnssec-cds.c
@@ -467,7 +467,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 		bool c;

 		dns_rdataset_current(dsset, &dsrdata);
-		result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
+		result = dns_rdata_tostruct(&dsrdata, &ds);
 		check_result(result, "dns_rdata_tostruct(DS)");

 		if (ki->tag != ds.key_tag || ki->algo != ds.algorithm) {
@@ -537,7 +537,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		dns_rdata_init(keyrdata);
 		dns_rdataset_current(keyset, keyrdata);

-		result = dns_rdata_tostruct(keyrdata, &dnskey, NULL);
+		result = dns_rdata_tostruct(keyrdata, &dnskey);
 		check_result(result, "dns_rdata_tostruct(DNSKEY)");
 		ki->algo = dnskey.algorithm;

@@ -607,7 +607,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 		dns_rdata_rrsig_t sig;

 		dns_rdataset_current(sigset, &sigrdata);
-		result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
+		result = dns_rdata_tostruct(&sigrdata, &sig);
 		check_result(result, "dns_rdata_tostruct(RRSIG)");

 		/*
@@ -703,7 +703,7 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
 		int i;

 		dns_rdataset_current(dsset, &dsrdata);
-		result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
+		result = dns_rdata_tostruct(&dsrdata, &ds);
 		check_result(result, "dns_rdata_tostruct(DS)");

 		ds_ok = false;
@@ -738,7 +738,7 @@ ds_from_cds(isc_buffer_t *buf, dns_rdata_t *rds, dns_dsdigest_t dt,

 	REQUIRE(buf != NULL);

-	result = dns_rdata_tostruct(cds, &ds, NULL);
+	result = dns_rdata_tostruct(cds, &ds);
 	check_result(result, "dns_rdata_tostruct(CDS)");
 	ds.common.rdtype = dns_rdatatype_ds;

@@ -890,7 +890,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	ds = isc_mem_cget(isc_g_mctx, n, sizeof(dns_rdata_ds_t));

 	for (i = 0; i < n; i++) {
-		result = dns_rdata_tostruct(&arrdata[i], &ds[i], NULL);
+		result = dns_rdata_tostruct(&arrdata[i], &ds[i]);
 		check_result(result, "dns_rdata_tostruct(DS)");
 	}

diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
index 3ee686fd32..fd9674f0b0 100644
--- a/bin/dnssec/dnssec-dsfromkey.c
+++ b/bin/dnssec/dnssec-dsfromkey.c
@@ -257,7 +257,7 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {

 	dns_rdata_init(&ds);

-	result = dns_rdata_tostruct(rdata, &dnskey, NULL);
+	result = dns_rdata_tostruct(rdata, &dnskey);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't convert DNSKEY");
 	}
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 8eb22a3774..8ef0cca1b8 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -553,7 +553,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,

 			dns_rdataset_current(&sigset, &sigrdata);

-			result = dns_rdata_tostruct(&sigrdata, &rrsig, NULL);
+			result = dns_rdata_tostruct(&sigrdata, &rrsig);
 			check_result(result, "dns_rdata_tostruct");

 			future = isc_serial_lt(now, rrsig.timesigned);
@@ -2117,7 +2117,7 @@ nsec3clean(dns_name_t *name, dns_dbnode_t *node, unsigned int hashalg,
 		dns_rdata_t delrdata = DNS_RDATA_INIT;

 		dns_rdataset_current(&rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
+		result = dns_rdata_tostruct(&rdata, &nsec3);
 		check_result(result, "dns_rdata_tostruct");
 		if (exists && nsec3.hash == hashalg &&
 		    nsec3.iterations == iterations &&
@@ -2887,7 +2887,7 @@ warnifallksk(dns_db_t *db) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(&rdataset, &rdata);

-		result = dns_rdata_tostruct(&rdata, &dnskey, NULL);
+		result = dns_rdata_tostruct(&rdata, &dnskey);
 		check_result(result, "dns_rdata_tostruct");
 		if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0) {
 			have_non_ksk = true;
@@ -2976,7 +2976,7 @@ set_nsec3params(bool update, bool set_salt, bool set_optout, bool set_iter) {
 	result = dns_rdataset_first(&rdataset);
 	check_result(result, "dns_rdataset_first");
 	dns_rdataset_current(&rdataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
+	result = dns_rdata_tostruct(&rdata, &nsec3);
 	check_result(result, "dns_rdata_tostruct");

 	if (!update && set_optout) {
diff --git a/bin/named/server.c b/bin/named/server.c
index 2365b3d0c3..aba3b7d63e 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -6555,7 +6555,7 @@ get_tat_qname(dns_name_t *target, dns_name_t *keyname, dns_keynode_t *keynode) {

 			dns_rdata_reset(&rdata);
 			dns_rdataset_current(&dsset, &rdata);
-			result = dns_rdata_tostruct(&rdata, &ds, NULL);
+			result = dns_rdata_tostruct(&rdata, &ds);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (n < (sizeof(ids) / sizeof(ids[0]))) {
 				ids[n] = ds.key_tag;
@@ -14352,7 +14352,7 @@ mkey_dumpzone(dns_view_t *view, isc_buffer_t *text) {

 			dns_rdata_reset(&rdata);
 			dns_rdataset_current(kdset, &rdata);
-			result = dns_rdata_tostruct(&rdata, &kd, NULL);
+			result = dns_rdata_tostruct(&rdata, &kd);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);

 			dns_rdata_toregion(&rdata, &r);
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 936e89940b..0f70c9b0d6 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -2055,7 +2055,7 @@ parseclass:
 	if (!isdelete && rdata->type == dns_rdatatype_nsec3param) {
 		dns_rdata_nsec3param_t nsec3param;

-		result = dns_rdata_tostruct(rdata, &nsec3param, NULL);
+		result = dns_rdata_tostruct(rdata, &nsec3param);
 		check_result(result, "dns_rdata_tostruct");
 		if (nsec3param.iterations > dns_nsec3_maxiterations()) {
 			fprintf(stderr,
@@ -2477,7 +2477,7 @@ check_tsig_error(dns_rdataset_t *rdataset, isc_buffer_t *b) {
 	result = dns_rdataset_first(rdataset);
 	check_result(result, "dns_rdataset_first");
 	dns_rdataset_current(rdataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &tsig, NULL);
+	result = dns_rdata_tostruct(&rdata, &tsig);
 	check_result(result, "dns_rdata_tostruct");
 	if (tsig.error != 0) {
 		if (isc_buffer_remaininglength(b) < 1) {
@@ -2867,7 +2867,7 @@ lookforsoa:

 	dns_rdata_init(&soarr);
 	dns_rdataset_current(soaset, &soarr);
-	result = dns_rdata_tostruct(&soarr, &soa, NULL);
+	result = dns_rdata_tostruct(&soarr, &soa);
 	check_result(result, "dns_rdata_tostruct");

 	dns_name_init(&primary);
diff --git a/bin/tests/system/dyndb/driver/syncptr.c b/bin/tests/system/dyndb/driver/syncptr.c
index 31174bcfab..fda163aeda 100644
--- a/bin/tests/system/dyndb/driver/syncptr.c
+++ b/bin/tests/system/dyndb/driver/syncptr.c
@@ -138,12 +138,12 @@ syncptr_find_zone(sample_instance_t *inst, dns_rdata_t *rdata, dns_name_t *name,

 	switch (rdata->type) {
 	case dns_rdatatype_a:
-		CHECK(dns_rdata_tostruct(rdata, &ipv4, inst->mctx));
+		CHECK(dns_rdata_tostruct(rdata, &ipv4));
 		isc_netaddr_fromin(&isc_ip, &ipv4.in_addr);
 		break;

 	case dns_rdatatype_aaaa:
-		CHECK(dns_rdata_tostruct(rdata, &ipv6, inst->mctx));
+		CHECK(dns_rdata_tostruct(rdata, &ipv6));
 		isc_netaddr_fromin6(&isc_ip, &ipv6.in6_addr);
 		break;

diff --git a/lib/dns/catz.c b/lib/dns/catz.c
index 43513e3fe3..ef0bcce877 100644
--- a/lib/dns/catz.c
+++ b/lib/dns/catz.c
@@ -1280,7 +1280,7 @@ catz_process_coo(dns_catz_zone_t *catz, dns_label_t *mhash,
 	dns_rdata_init(&rdata);
 	dns_rdataset_current(value, &rdata);

-	RETERR(dns_rdata_tostruct(&rdata, &ptr, NULL));
+	RETERR(dns_rdata_tostruct(&rdata, &ptr));

 	if (dns_name_empty(&ptr.ptr)) {
 		CLEANUP(ISC_R_FAILURE);
@@ -1327,7 +1327,7 @@ catz_process_zones_entry(dns_catz_zone_t *catz, dns_rdataset_t *value,
 	dns_rdata_init(&rdata);
 	dns_rdataset_current(value, &rdata);

-	RETERR(dns_rdata_tostruct(&rdata, &ptr, NULL));
+	RETERR(dns_rdata_tostruct(&rdata, &ptr));

 	result = isc_ht_find(catz->entries, mhash->base, mhash->length,
 			     (void **)&entry);
@@ -1382,7 +1382,7 @@ catz_process_version(dns_catz_zone_t *catz, dns_rdataset_t *value) {
 	dns_rdata_init(&rdata);
 	dns_rdataset_current(value, &rdata);

-	RETERR(dns_rdata_tostruct(&rdata, &rdatatxt, NULL));
+	RETERR(dns_rdata_tostruct(&rdata, &rdatatxt));

 	CHECK(dns_rdata_txt_first(&rdatatxt));

@@ -1459,20 +1459,20 @@ catz_process_primaries(dns_catz_zone_t *catz, dns_ipkeylist_t *ipkl,
 		dns_rdataset_current(value, &rdata);
 		switch (value->type) {
 		case dns_rdatatype_a:
-			result = dns_rdata_tostruct(&rdata, &rdata_a, NULL);
+			result = dns_rdata_tostruct(&rdata, &rdata_a);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			isc_sockaddr_fromin(&sockaddr, &rdata_a.in_addr, 0);
 			dns_rdata_freestruct(&rdata_a);
 			break;
 		case dns_rdatatype_aaaa:
-			result = dns_rdata_tostruct(&rdata, &rdata_aaaa, NULL);
+			result = dns_rdata_tostruct(&rdata, &rdata_aaaa);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			isc_sockaddr_fromin6(&sockaddr, &rdata_aaaa.in6_addr,
 					     0);
 			dns_rdata_freestruct(&rdata_aaaa);
 			break;
 		case dns_rdatatype_txt:
-			result = dns_rdata_tostruct(&rdata, &rdata_txt, NULL);
+			result = dns_rdata_tostruct(&rdata, &rdata_txt);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);

 			result = dns_rdata_txt_first(&rdata_txt);
@@ -1573,13 +1573,13 @@ catz_process_primaries(dns_catz_zone_t *catz, dns_ipkeylist_t *ipkl,
 		 * port 0 == take the default
 		 */
 		if (value->type == dns_rdatatype_a) {
-			result = dns_rdata_tostruct(&rdata, &rdata_a, NULL);
+			result = dns_rdata_tostruct(&rdata, &rdata_a);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			isc_sockaddr_fromin(&ipkl->addrs[ipkl->count],
 					    &rdata_a.in_addr, 0);
 			dns_rdata_freestruct(&rdata_a);
 		} else {
-			result = dns_rdata_tostruct(&rdata, &rdata_aaaa, NULL);
+			result = dns_rdata_tostruct(&rdata, &rdata_aaaa);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			isc_sockaddr_fromin6(&ipkl->addrs[ipkl->count],
 					     &rdata_aaaa.in6_addr, 0);
@@ -1624,7 +1624,7 @@ catz_process_apl(dns_catz_zone_t *catz, isc_buffer_t **aclbp,
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_rdata_init(&rdata);
 	dns_rdataset_current(value, &rdata);
-	RETERR(dns_rdata_tostruct(&rdata, &rdata_apl, catz->catzs->mctx));
+	RETERR(dns_rdata_tostruct(&rdata, &rdata_apl));
 	isc_buffer_allocate(catz->catzs->mctx, &aclb, 16);
 	for (result = dns_rdata_apl_first(&rdata_apl); result == ISC_R_SUCCESS;
 	     result = dns_rdata_apl_next(&rdata_apl))
@@ -1867,7 +1867,7 @@ dns__catz_update_process(dns_catz_zone_t *catz, const dns_name_t *src_name,
 			RETERR(dns_rdataset_first(rdataset));

 			dns_rdataset_current(rdataset, &rdata);
-			result = dns_rdata_tostruct(&rdata, &soa, NULL);
+			result = dns_rdata_tostruct(&rdata, &soa);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);

 			/*
diff --git a/lib/dns/client.c b/lib/dns/client.c
index f2d128e3a1..2da5b61187 100644
--- a/lib/dns/client.c
+++ b/lib/dns/client.c
@@ -577,7 +577,7 @@ client_resfind(resctx_t *rctx, dns_fetchresponse_t *resp) {
 				goto done;
 			}
 			dns_rdataset_current(trdataset, &rdata);
-			tresult = dns_rdata_tostruct(&rdata, &cname, NULL);
+			tresult = dns_rdata_tostruct(&rdata, &cname);
 			dns_rdata_reset(&rdata);
 			if (tresult != ISC_R_SUCCESS) {
 				goto done;
@@ -613,7 +613,7 @@ client_resfind(resctx_t *rctx, dns_fetchresponse_t *resp) {
 				goto done;
 			}
 			dns_rdataset_current(trdataset, &rdata);
-			tresult = dns_rdata_tostruct(&rdata, &dname, NULL);
+			tresult = dns_rdata_tostruct(&rdata, &dname);
 			dns_rdata_reset(&rdata);
 			if (tresult != ISC_R_SUCCESS) {
 				result = tresult;
diff --git a/lib/dns/deleg.c b/lib/dns/deleg.c
index a23137e47d..bafc663da4 100644
--- a/lib/dns/deleg.c
+++ b/lib/dns/deleg.c
@@ -937,7 +937,7 @@ dns_delegset_fromnsrdataset(isc_mem_t *mctx, dns_rdataset_t *rdataset,
 		dns_rdata_ns_t ns;

 		dns_rdataset_current(rdataset, &rdata);
-		dns_rdata_tostruct(&rdata, &ns, NULL);
+		dns_rdata_tostruct(&rdata, &ns);
 		dns_delegset_addns(delegset, deleg, &ns.name);
 	}

@@ -1204,7 +1204,7 @@ delegdb_rootns_update(void *arg, const dns_name_t *name,
 			dns_rdata_in_a_t a;

 			dns_rdataset_current(rdataset, &rdata);
-			dns_rdata_tostruct(&rdata, &a, NULL);
+			dns_rdata_tostruct(&rdata, &a);
 			addr.type.in = a.in_addr;
 			addr.family = AF_INET;
 			break;
@@ -1213,7 +1213,7 @@ delegdb_rootns_update(void *arg, const dns_name_t *name,
 			dns_rdata_in_aaaa_t aaaa;

 			dns_rdataset_current(rdataset, &rdata);
-			dns_rdata_tostruct(&rdata, &aaaa, NULL);
+			dns_rdata_tostruct(&rdata, &aaaa);
 			addr.type.in6 = aaaa.in6_addr;
 			addr.family = AF_INET6;
 			break;
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 792dd65f5e..a0171cca5b 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -404,7 +404,7 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	REQUIRE(mctx != NULL);
 	REQUIRE(sigrdata != NULL && sigrdata->type == dns_rdatatype_rrsig);

-	RETERR(dns_rdata_tostruct(sigrdata, &sig, NULL));
+	RETERR(dns_rdata_tostruct(sigrdata, &sig));

 	if (set->type != sig.covered) {
 		return DNS_R_SIGINVALID;
@@ -492,7 +492,7 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	if (set->type == dns_rdatatype_nsec) {
 		RETERR(dns_rdataset_first(set));
 		dns_rdataset_current(set, &rdata);
-		RETERR(dns_rdata_tostruct(&rdata, &nsec, NULL));
+		RETERR(dns_rdata_tostruct(&rdata, &nsec));
 		if (!dns_name_issubdomain(&nsec.next, &sig.signer)) {
 			return DNS_R_NOVALIDNSEC;
 		}
@@ -965,7 +965,7 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,
 	CHECK(dns_rdataset_first(msg->sig0));
 	dns_rdataset_current(msg->sig0, &rdata);

-	CHECK(dns_rdata_tostruct(&rdata, &sig, NULL));
+	CHECK(dns_rdata_tostruct(&rdata, &sig));
 	signeedsfree = true;

 	if (sig.labels != 0) {
@@ -1107,14 +1107,14 @@ dns_dnssec_signs(dns_rdata_t *rdata, const dns_name_t *name,
 	if (result != ISC_R_SUCCESS) {
 		return false;
 	}
-	result = dns_rdata_tostruct(rdata, &key, NULL);
+	result = dns_rdata_tostruct(rdata, &key);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	keytag = dst_key_id(dstkey);
 	DNS_RDATASET_FOREACH(sigrdataset) {
 		dns_rdata_t sigrdata = DNS_RDATA_INIT;
 		dns_rdataset_current(sigrdataset, &sigrdata);
-		result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
+		result = dns_rdata_tostruct(&sigrdata, &sig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		if (sig.algorithm == key.algorithm && sig.keyid == keytag) {
@@ -1151,7 +1151,7 @@ dns_dnssec_haszonekey(dns_rdataset_t *keyset) {
 		dns_rdata_dnskey_t key;

 		dns_rdataset_current(keyset, &rdata);
-		dns_rdata_tostruct(&rdata, &key, NULL); /* can't fail */
+		dns_rdata_tostruct(&rdata, &key); /* can't fail */

 		if (dns_dnssec_iszonekey(&key)) {
 			return true;
@@ -1531,7 +1531,7 @@ mark_active_keys(dns_dnsseckeylist_t *keylist, dns_rdataset_t *rrsigs) {

 			dns_rdata_reset(&rdata);
 			dns_rdataset_current(&sigs, &rdata);
-			result = dns_rdata_tostruct(&rdata, &sig, NULL);
+			result = dns_rdata_tostruct(&rdata, &sig);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			sigalg = dst_algorithm_fromdata(
 				sig.algorithm, sig.signature, sig.siglen);
@@ -1605,7 +1605,7 @@ dns_dnssec_keylistfromrdataset(const dns_name_t *origin, dns_kasp_t *kasp,
 			rdata.type == dns_rdatatype_dnskey);
 		REQUIRE(rdata.length > 3);

-		result = dns_rdata_tostruct(&rdata, &keystruct, NULL);
+		result = dns_rdata_tostruct(&rdata, &keystruct);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		algorithm = dst_algorithm_fromdata(
@@ -2473,7 +2473,7 @@ dns_dnssec_matchdskey(dns_name_t *name, dns_rdata_t *dsrdata,
 	dns_rdata_ds_t ds;
 	isc_region_t r;

-	result = dns_rdata_tostruct(dsrdata, &ds, NULL);
+	result = dns_rdata_tostruct(dsrdata, &ds);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	DNS_RDATASET_FOREACH(keyset) {
@@ -2482,7 +2482,7 @@ dns_dnssec_matchdskey(dns_name_t *name, dns_rdata_t *dsrdata,
 		dns_rdata_reset(keyrdata);
 		dns_rdataset_current(keyset, keyrdata);

-		result = dns_rdata_tostruct(keyrdata, &key, NULL);
+		result = dns_rdata_tostruct(keyrdata, &key);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		dns_rdata_toregion(keyrdata, &r);
diff --git a/lib/dns/include/dns/rdata.h b/lib/dns/include/dns/rdata.h
index 0a9286fd63..c475abd0f6 100644
--- a/lib/dns/include/dns/rdata.h
+++ b/lib/dns/include/dns/rdata.h
@@ -533,13 +533,11 @@ dns_rdata_fromstruct(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
  */

 isc_result_t
-dns_rdata_tostruct(const dns_rdata_t *rdata, void *target, isc_mem_t *mctx);
+dns_rdata_tostruct(const dns_rdata_t *rdata, void *target);
 /*%<
  * Convert an rdata into its C structure representation.
  *
- * If 'mctx' is NULL then 'rdata' must persist while 'target' is being used.
- *
- * If 'mctx' is non NULL then memory will be allocated if required.
+ * The 'rdata' must persist while 'target' is being used.
  *
  * Requires:
  *
diff --git a/lib/dns/keytable.c b/lib/dns/keytable.c
index 9302d05f16..f405e31c7c 100644
--- a/lib/dns/keytable.c
+++ b/lib/dns/keytable.c
@@ -268,7 +268,7 @@ delete_ds(dns_qp_t *qp, dns_keytable_t *keytable, dns_keynode_t *knode,
 	ISC_LIST_FOREACH(knode->dslist->rdata, rdata, link) {
 		if (dns_rdata_compare(rdata, &dsrdata) != 0) {
 			dns_rdata_ds_t ds0;
-			result = dns_rdata_tostruct(rdata, &ds0, NULL);
+			result = dns_rdata_tostruct(rdata, &ds0);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			add_ds(newnode, &ds0, keytable->mctx);
 		}
@@ -613,7 +613,7 @@ keynode_dslist_totext(dns_keynode_t *keynode, isc_buffer_t *text) {
 		dns_rdata_ds_t ds;

 		dns_rdataset_current(&dsset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &ds, NULL);
+		result = dns_rdata_tostruct(&rdata, &ds);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		dns_secalg_format(ds.algorithm, algbuf, sizeof(algbuf));
diff --git a/lib/dns/master.c b/lib/dns/master.c
index 910aaddd06..25b6b9c4c1 100644
--- a/lib/dns/master.c
+++ b/lib/dns/master.c
@@ -1938,8 +1938,7 @@ load_text(dns_loadctx_t *lctx) {

 		if (type == dns_rdatatype_rrsig && lctx->warn_sigexpired) {
 			dns_rdata_rrsig_t sig;
-			result = dns_rdata_tostruct(&rdata[rdcount], &sig,
-						    NULL);
+			result = dns_rdata_tostruct(&rdata[rdcount], &sig);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (isc_serial_lt(sig.timeexpire, lctx->now)) {
 				(*callbacks->warn)(callbacks,
@@ -2804,7 +2803,7 @@ resign_fromlist(dns_rdatalist_t *this, dns_loadctx_t *lctx) {

 	rdata = ISC_LIST_HEAD(this->rdata);
 	INSIST(rdata != NULL);
-	(void)dns_rdata_tostruct(rdata, &sig, NULL);
+	(void)dns_rdata_tostruct(rdata, &sig);
 	if (isc_serial_gt(sig.timesigned, lctx->now)) {
 		when = lctx->now;
 	} else {
@@ -2813,7 +2812,7 @@ resign_fromlist(dns_rdatalist_t *this, dns_loadctx_t *lctx) {

 	rdata = ISC_LIST_NEXT(rdata, link);
 	while (rdata != NULL) {
-		(void)dns_rdata_tostruct(rdata, &sig, NULL);
+		(void)dns_rdata_tostruct(rdata, &sig);
 		if (isc_serial_gt(sig.timesigned, lctx->now)) {
 			when = lctx->now;
 		} else if (sig.timeexpire - lctx->resign < when) {
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 8acac1f57b..4e2c6498eb 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -2902,7 +2902,7 @@ dns_message_signer(dns_message_t *msg, dns_name_t *signer) {
 		INSIST(result == ISC_R_SUCCESS);
 		dns_rdataset_current(msg->sig0, &rdata);

-		RETERR(dns_rdata_tostruct(&rdata, &sig, NULL));
+		RETERR(dns_rdata_tostruct(&rdata, &sig));

 		if (msg->verified_sig && msg->sig0status == dns_rcode_noerror) {
 			result = ISC_R_SUCCESS;
@@ -2919,7 +2919,7 @@ dns_message_signer(dns_message_t *msg, dns_name_t *signer) {
 		INSIST(result == ISC_R_SUCCESS);
 		dns_rdataset_current(msg->tsig, &rdata);

-		result = dns_rdata_tostruct(&rdata, &tsig, NULL);
+		result = dns_rdata_tostruct(&rdata, &tsig);
 		INSIST(result == ISC_R_SUCCESS);
 		if (msg->verified_sig && msg->tsigstatus == dns_rcode_noerror &&
 		    tsig.error == dns_rcode_noerror)
@@ -2983,7 +2983,7 @@ dns_message_dumpsig(dns_message_t *msg, char *txt1) {
 		result = dns_rdataset_first(msg->tsig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		dns_rdataset_current(msg->tsig, &querytsigrdata);
-		result = dns_rdata_tostruct(&querytsigrdata, &querytsig, NULL);
+		result = dns_rdata_tostruct(&querytsigrdata, &querytsig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		hexdump(txt1, "TSIG", querytsig.signature, querytsig.siglen);
 	}
@@ -2992,7 +2992,7 @@ dns_message_dumpsig(dns_message_t *msg, char *txt1) {
 		result = dns_rdataset_first(msg->querytsig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		dns_rdataset_current(msg->querytsig, &querytsigrdata);
-		result = dns_rdata_tostruct(&querytsigrdata, &querytsig, NULL);
+		result = dns_rdata_tostruct(&querytsigrdata, &querytsig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		hexdump(txt1, "QUERYTSIG", querytsig.signature,
 			querytsig.siglen);
@@ -3091,7 +3091,7 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 			return ISC_R_UNEXPECTEDEND;
 		}

-		RETERR(dns_rdata_tostruct(&sigrdata, &sig, NULL));
+		RETERR(dns_rdata_tostruct(&sigrdata, &sig));

 		dns_rdataset_init(&keyset);
 		if (view == NULL) {
@@ -3138,7 +3138,7 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 			isc_region_t r;

 			dns_rdataset_current(&keyset, &keyrdata);
-			dns_rdata_tostruct(&keyrdata, &ks, NULL);
+			dns_rdata_tostruct(&keyrdata, &ks);

 			if (sig.algorithm != ks.algorithm ||
 			    (ks.protocol != DNS_KEYPROTO_DNSSEC &&
diff --git a/lib/dns/ncache.c b/lib/dns/ncache.c
index e0bcc8468a..d316ed2b15 100644
--- a/lib/dns/ncache.c
+++ b/lib/dns/ncache.c
@@ -631,7 +631,7 @@ dns_ncache_getsigrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
 		dns_rdata_reset(&rdata);
 		dns_rdata_fromregion(&rdata, rdataset->rdclass,
 				     dns_rdatatype_rrsig, &sigregion);
-		(void)dns_rdata_tostruct(&rdata, &rrsig, NULL);
+		(void)dns_rdata_tostruct(&rdata, &rrsig);
 		if (rrsig.covered == covers) {
 			isc_buffer_remainingregion(&source, &remaining);
 			result = ISC_R_SUCCESS;
@@ -708,7 +708,7 @@ dns_ncache_current(dns_rdataset_t *ncacherdataset, dns_name_t *found,
 		dns_rdata_reset(&rdata);
 		dns_rdata_fromregion(&rdata, ncacherdataset->rdclass, type,
 				     &sigregion);
-		(void)dns_rdata_tostruct(&rdata, &rrsig, NULL);
+		(void)dns_rdata_tostruct(&rdata, &rrsig);
 		covers = rrsig.covered;
 	} else {
 		covers = dns_rdatatype_none;
diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c
index 61f166a094..acd4ed0f30 100644
--- a/lib/dns/nsec.c
+++ b/lib/dns/nsec.c
@@ -208,7 +208,7 @@ dns_nsec_typepresent(dns_rdata_t *nsec, dns_rdatatype_t type) {
 	REQUIRE(nsec->type == dns_rdatatype_nsec);

 	/* This should never fail */
-	result = dns_rdata_tostruct(nsec, &nsecstruct, NULL);
+	result = dns_rdata_tostruct(nsec, &nsecstruct);
 	INSIST(result == ISC_R_SUCCESS);

 	present = false;
@@ -264,7 +264,7 @@ dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version, dns_diff_t *diff,
 		dns_rdata_t rdata = DNS_RDATA_INIT;

 		dns_rdataset_current(&rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &dnskey, NULL);
+		result = dns_rdata_tostruct(&rdata, &dnskey);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		if (dnskey.algorithm == DST_ALG_RSAMD5 ||
@@ -431,7 +431,7 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
 		return ISC_R_IGNORE;
 	}

-	RETERR(dns_rdata_tostruct(&rdata, &nsec, NULL));
+	RETERR(dns_rdata_tostruct(&rdata, &nsec));
 	relation = dns_name_fullcompare(&nsec.next, name, &order, &nlabels);
 	if (order == 0) {
 		dns_rdata_freestruct(&nsec);
@@ -501,7 +501,7 @@ dns_nsec_is_legal(dns_rdataset_t *nsecset, const dns_name_t *name) {
 		dns_rdataset_current(&rdataset, &rdata);

 		/* must never fail */
-		result = dns_rdata_tostruct(&rdata, &nsec, NULL);
+		result = dns_rdata_tostruct(&rdata, &nsec);
 		INSIST(result == ISC_R_SUCCESS);

 		if (!dns_name_issubdomain(&nsec.next, name) ||
diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index bfbb235aec..0608ea6791 100644
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -188,7 +188,7 @@ dns_nsec3_typepresent(dns_rdata_t *rdata, dns_rdatatype_t type) {
 	REQUIRE(rdata->type == dns_rdatatype_nsec3);

 	/* This should never fail */
-	result = dns_rdata_tostruct(rdata, &nsec3, NULL);
+	result = dns_rdata_tostruct(rdata, &nsec3);
 	INSIST(result == ISC_R_SUCCESS);

 	present = false;
@@ -368,7 +368,7 @@ delnsec3(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	DNS_RDATASET_FOREACH(&rdataset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(&rdataset, &rdata);
-		CHECK(dns_rdata_tostruct(&rdata, &nsec3, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &nsec3));

 		if (!match_nsec3param(&nsec3, nsec3param)) {
 			continue;
@@ -440,7 +440,7 @@ find_nsec3(dns_rdata_nsec3_t *nsec3, dns_rdataset_t *rdataset,
 	DNS_RDATASET_FOREACH(rdataset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(rdataset, &rdata);
-		dns_rdata_tostruct(&rdata, nsec3, NULL);
+		dns_rdata_tostruct(&rdata, nsec3);

 		if (match_nsec3param(nsec3, nsec3param)) {
 			return ISC_R_SUCCESS;
@@ -872,7 +872,7 @@ dns_nsec3_addnsec3s(dns_db_t *db, dns_dbversion_t *version,
 		dns_rdata_t rdata = DNS_RDATA_INIT;

 		dns_rdataset_current(&rdataset, &rdata);
-		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &nsec3param));

 		if (nsec3param.flags != 0) {
 			continue;
@@ -1167,7 +1167,7 @@ dns_nsec3_addnsec3sx(dns_db_t *db, dns_dbversion_t *version,
 		dns_rdata_t rdata = DNS_RDATA_INIT;

 		dns_rdataset_current(&rdataset, &rdata);
-		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &nsec3param));

 		if (nsec3param.flags != 0) {
 			continue;
@@ -1202,7 +1202,7 @@ try_private:
 		{
 			continue;
 		}
-		CHECK(dns_rdata_tostruct(&rdata2, &nsec3param, NULL));
+		CHECK(dns_rdata_tostruct(&rdata2, &nsec3param));

 		if ((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0) {
 			continue;
@@ -1560,7 +1560,7 @@ dns_nsec3_delnsec3sx(dns_db_t *db, dns_dbversion_t *version,
 		dns_rdata_t rdata = DNS_RDATA_INIT;

 		dns_rdataset_current(&rdataset, &rdata);
-		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &nsec3param));

 		if (nsec3param.flags != 0) {
 			continue;
@@ -1599,7 +1599,7 @@ try_private:
 		{
 			continue;
 		}
-		CHECK(dns_rdata_tostruct(&rdata2, &nsec3param, NULL));
+		CHECK(dns_rdata_tostruct(&rdata2, &nsec3param));

 		if ((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0) {
 			continue;
@@ -1662,7 +1662,7 @@ dns_nsec3_activex(dns_db_t *db, dns_dbversion_t *version, bool complete,
 	DNS_RDATASET_FOREACH(&rdataset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(&rdataset, &rdata);
-		dns_rdata_tostruct(&rdata, &nsec3param, NULL);
+		dns_rdata_tostruct(&rdata, &nsec3param);

 		if (nsec3param.flags == 0) {
 			found = true;
@@ -1702,7 +1702,7 @@ try_private:
 			continue;
 		}

-		dns_rdata_tostruct(&rdata2, &nsec3param, NULL);
+		dns_rdata_tostruct(&rdata2, &nsec3param);
 		if (!complete && CREATE(nsec3param.flags)) {
 			found = true;
 			break;
@@ -1763,7 +1763,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,

 	dns_rdataset_current(nsec3set, &rdata);

-	RETERR(dns_rdata_tostruct(&rdata, &nsec3, NULL));
+	RETERR(dns_rdata_tostruct(&rdata, &nsec3));

 	(*logit)(arg, ISC_LOG_DEBUG(3), "looking for relevant NSEC3");

diff --git a/lib/dns/private.c b/lib/dns/private.c
index 5a50ce7ab4..e3be3131e9 100644
--- a/lib/dns/private.c
+++ b/lib/dns/private.c
@@ -315,7 +315,7 @@ dns_private_totext(dns_rdata_t *private, isc_buffer_t *buf) {
 			CLEANUP(ISC_R_FAILURE);
 		}

-		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &nsec3param));

 		del = ((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0);
 		init = ((nsec3param.flags & DNS_NSEC3FLAG_INITIAL) != 0);
diff --git a/lib/dns/qpzone.c b/lib/dns/qpzone.c
index 8d38dd3b4f..8b841fbd90 100644
--- a/lib/dns/qpzone.c
+++ b/lib/dns/qpzone.c
@@ -1249,8 +1249,8 @@ setnsec3parameters(dns_db_t *db, qpz_version_t *version) {
 			dns_rdata_t rdata = DNS_RDATA_INIT;
 			vecheader_current(&iter, &rdata);

-			isc_result_t result =
-				dns_rdata_tostruct(&rdata, &nsec3param, NULL);
+			isc_result_t result = dns_rdata_tostruct(&rdata,
+								 &nsec3param);
 			INSIST(result == ISC_R_SUCCESS);

 			if (nsec3param.hash != DNS_NSEC3_UNKNOWNALG &&
@@ -2759,7 +2759,7 @@ matchparams(dns_vecheader_t *header, qpz_search_t *search) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		vecheader_current(&iter, &rdata);

-		result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
+		result = dns_rdata_tostruct(&rdata, &nsec3);
 		INSIST(result == ISC_R_SUCCESS);

 		if (nsec3.hash == search->version->hash &&
diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
index 954f414993..32b73d82e8 100644
--- a/lib/dns/rdata.c
+++ b/lib/dns/rdata.c
@@ -1411,9 +1411,10 @@ dns_rdata_fromstruct(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 }

 isc_result_t
-dns_rdata_tostruct(const dns_rdata_t *rdata, void *target, isc_mem_t *mctx) {
+dns_rdata_tostruct(const dns_rdata_t *rdata, void *target) {
 	isc_result_t result = ISC_R_NOTIMPLEMENTED;
 	bool use_default = false;
+	isc_mem_t *mctx = NULL; /* Intentionally NULL */

 	REQUIRE(rdata != NULL);
 	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
@@ -2481,7 +2482,7 @@ dns_rdata_checksvcb(const dns_name_t *owner, const dns_rdata_t *rdata) {
 	REQUIRE(rdata->type == dns_rdatatype_svcb);
 	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));

-	result = dns_rdata_tostruct(rdata, &svcb, NULL);
+	result = dns_rdata_tostruct(rdata, &svcb);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	/*
diff --git a/lib/dns/rdata/in_1/svcb_64.c b/lib/dns/rdata/in_1/svcb_64.c
index f774a3d730..e9e0e21708 100644
--- a/lib/dns/rdata/in_1/svcb_64.c
+++ b/lib/dns/rdata/in_1/svcb_64.c
@@ -1154,8 +1154,7 @@ generic_additionaldata_in_svcb(ARGS_ADDLDATA) {

 				dns_rdataset_current(&rdataset, &current);

-				result = dns_rdata_tostruct(&current, &cname,
-							    NULL);
+				result = dns_rdata_tostruct(&current, &cname);
 				RUNTIME_CHECK(result == ISC_R_SUCCESS);
 				dns_name_copy(&cname.cname, fname);
 				dns_name_clone(fname, &name);
diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
index a756c2ae4b..3da673a102 100644
--- a/lib/dns/rdataset.c
+++ b/lib/dns/rdataset.c
@@ -578,7 +578,7 @@ dns_rdataset_minresign(dns_rdataset_t *rdataset) {
 	result = dns_rdataset_first(rdataset);
 	INSIST(result == ISC_R_SUCCESS);
 	dns_rdataset_current(rdataset, &rdata);
-	(void)dns_rdata_tostruct(&rdata, &sig, NULL);
+	(void)dns_rdata_tostruct(&rdata, &sig);
 	if ((rdata.flags & DNS_RDATA_OFFLINE) != 0) {
 		when = 0;
 	} else {
@@ -589,7 +589,7 @@ dns_rdataset_minresign(dns_rdataset_t *rdataset) {
 	result = dns_rdataset_next(rdataset);
 	while (result == ISC_R_SUCCESS) {
 		dns_rdataset_current(rdataset, &rdata);
-		(void)dns_rdata_tostruct(&rdata, &sig, NULL);
+		(void)dns_rdata_tostruct(&rdata, &sig);
 		if ((rdata.flags & DNS_RDATA_OFFLINE) != 0) {
 			goto next_rr;
 		}
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index e9495b288f..74f0ce535a 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -5433,7 +5433,7 @@ is_minimal_nsec(dns_rdataset_t *nsecset) {
 		dns_rdata_nsec_t nsec;

 		dns_rdataset_current(&rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &nsec, NULL);
+		result = dns_rdata_tostruct(&rdata, &nsec);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		if (nsec.len == sizeof(minimal_typemap) &&
@@ -5765,14 +5765,14 @@ get_and_check_signer_name(dns_name_t *signer, dns_rdataset_t *sigrdataset) {

 	rdata = (dns_rdata_t)DNS_RDATA_INIT;
 	dns_rdataset_current(sigrdataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
+	result = dns_rdata_tostruct(&rdata, &rrsig);
 	INSIST(result == ISC_R_SUCCESS);
 	dns_name_copy(&rrsig.signer, signer);

 	while (dns_rdataset_next(sigrdataset) == ISC_R_SUCCESS) {
 		rdata = (dns_rdata_t)DNS_RDATA_INIT;
 		dns_rdataset_current(sigrdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
+		result = dns_rdata_tostruct(&rdata, &rrsig);
 		INSIST(result == ISC_R_SUCCESS);

 		if (!dns_name_equal(signer, &rrsig.signer)) {
@@ -6141,7 +6141,7 @@ findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name,
 	DNS_RDATASET_FOREACH(sigrdataset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(sigrdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
+		result = dns_rdata_tostruct(&rdata, &rrsig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		/* Wildcard has rrsig.labels < labels - 1. */
 		if (rrsig.labels + 1U >= labels) {
@@ -6882,7 +6882,7 @@ cache_delegglue(fetchctx_t *fctx, dns_message_t *message,
 		isc_netaddr_t addr = { .family = AF_INET };

 		dns_rdataset_current(rdataset, &rdata);
-		dns_rdata_tostruct(&rdata, &a, NULL);
+		dns_rdata_tostruct(&rdata, &a);
 		addr.type.in = a.in_addr;
 		dns_delegset_addaddr(delegset, deleg, &addr);
 		naddrs++;
@@ -6922,7 +6922,7 @@ cache_delegglue6(fetchctx_t *fctx, dns_message_t *message,
 		isc_netaddr_t addr = { .family = AF_INET6 };

 		dns_rdataset_current(rdataset, &rdata);
-		dns_rdata_tostruct(&rdata, &aaaa, NULL);
+		dns_rdata_tostruct(&rdata, &aaaa);
 		addr.type.in6 = aaaa.in6_addr;
 		dns_delegset_addaddr(delegset, deleg, &addr);
 		naddrs++;
@@ -6984,7 +6984,7 @@ cache_delegns(fetchctx_t *fctx, const dns_name_t *name, dns_rdataset_t *nsset,

 		dns_rdataset_current(nsset, &rdata);
 		INSIST(rdata.type == dns_rdatatype_ns);
-		dns_rdata_tostruct(&rdata, &ns, NULL);
+		dns_rdata_tostruct(&rdata, &ns);

 		/* in-domain GLUE */
 		if (dns_name_issubdomain(&ns.name, name)) {
@@ -7214,7 +7214,7 @@ is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname,
 	dns_rdataset_current(rdataset, &rdata);
 	switch (rdataset->type) {
 	case dns_rdatatype_cname:
-		result = dns_rdata_tostruct(&rdata, &cname, NULL);
+		result = dns_rdata_tostruct(&rdata, &cname);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		tname = &cname.cname;
 		break;
@@ -7224,7 +7224,7 @@ is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname,
 		{
 			return true;
 		}
-		result = dns_rdata_tostruct(&rdata, &dname, NULL);
+		result = dns_rdata_tostruct(&rdata, &dname);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		dns_name_init(&prefix);
 		tname = dns_fixedname_initname(&fixed);
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index 3bd0c50f28..38df773f38 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -2694,7 +2694,7 @@ dns_rpz_decode_cname(dns_rpz_zone_t *rpz, dns_rdataset_t *rdataset,
 	result = dns_rdataset_first(rdataset);
 	INSIST(result == ISC_R_SUCCESS);
 	dns_rdataset_current(rdataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &cname, NULL);
+	result = dns_rdata_tostruct(&rdata, &cname);
 	INSIST(result == ISC_R_SUCCESS);
 	dns_rdata_reset(&rdata);

diff --git a/lib/dns/skr.c b/lib/dns/skr.c
index cf057d27cb..362051d1f8 100644
--- a/lib/dns/skr.c
+++ b/lib/dns/skr.c
@@ -153,7 +153,7 @@ dns_skrbundle_getsig(dns_skrbundle_t *bundle, dst_key_t *key,
 		}
 		INSIST(tuple->rdata.type == dns_rdatatype_rrsig);

-		RETERR(dns_rdata_tostruct(&tuple->rdata, &rrsig, NULL));
+		RETERR(dns_rdata_tostruct(&tuple->rdata, &rrsig));

 		/*
 		 * Check if covering type matches, and if the signature is
diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index 6db50c9dce..e3d533de32 100644
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -365,7 +365,7 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
 	}

 	dns_rdataset_current(tkeyset, &rdata);
-	CHECK(dns_rdata_tostruct(&rdata, &tkeyin, NULL));
+	CHECK(dns_rdata_tostruct(&rdata, &tkeyin));

 	if (tkeyin.error != dns_rcode_noerror) {
 		CLEANUP(DNS_R_FORMERR);
@@ -628,10 +628,10 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
 	}

 	CHECK(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
-	CHECK(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
+	CHECK(dns_rdata_tostruct(&rtkeyrdata, &rtkey));

 	CHECK(find_tkey(qmsg, &tkeyname, &qtkeyrdata, DNS_SECTION_ADDITIONAL));
-	CHECK(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
+	CHECK(dns_rdata_tostruct(&qtkeyrdata, &qtkey));

 	if (rtkey.error != dns_rcode_noerror ||
 	    rtkey.mode != DNS_TKEYMODE_GSSAPI ||
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index 7f785200f0..cd40d9619b 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -691,8 +691,8 @@ dns_tsig_sign(dns_message_t *msg) {
 				goto cleanup_context;
 			}
 			dns_rdataset_current(msg->querytsig, &querytsigrdata);
-			result = dns_rdata_tostruct(&querytsigrdata, &querytsig,
-						    NULL);
+			result = dns_rdata_tostruct(&querytsigrdata,
+						    &querytsig);
 			if (result != ISC_R_SUCCESS) {
 				goto cleanup_context;
 			}
@@ -939,12 +939,12 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 	keyname = msg->tsigname;
 	RETERR(dns_rdataset_first(msg->tsig));
 	dns_rdataset_current(msg->tsig, &rdata);
-	RETERR(dns_rdata_tostruct(&rdata, &tsig, NULL));
+	RETERR(dns_rdata_tostruct(&rdata, &tsig));
 	dns_rdata_reset(&rdata);
 	if (response) {
 		RETERR(dns_rdataset_first(msg->querytsig));
 		dns_rdataset_current(msg->querytsig, &rdata);
-		RETERR(dns_rdata_tostruct(&rdata, &querytsig, NULL));
+		RETERR(dns_rdata_tostruct(&rdata, &querytsig));
 	}

 	/*
@@ -1254,7 +1254,7 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 	 */
 	RETERR(dns_rdataset_first(msg->querytsig));
 	dns_rdataset_current(msg->querytsig, &rdata);
-	RETERR(dns_rdata_tostruct(&rdata, &querytsig, NULL));
+	RETERR(dns_rdata_tostruct(&rdata, &querytsig));
 	dns_rdata_reset(&rdata);

 	/*
@@ -1269,7 +1269,7 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 			goto cleanup_querystruct;
 		}
 		dns_rdataset_current(msg->tsig, &rdata);
-		result = dns_rdata_tostruct(&rdata, &tsig, NULL);
+		result = dns_rdata_tostruct(&rdata, &tsig);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup_querystruct;
 		}
diff --git a/lib/dns/update.c b/lib/dns/update.c
index 6fbb37ccc0..e991263034 100644
--- a/lib/dns/update.c
+++ b/lib/dns/update.c
@@ -1139,7 +1139,7 @@ del_keysigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	DNS_RDATASET_FOREACH(&rdataset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(&rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
+		result = dns_rdata_tostruct(&rdata, &rrsig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		found = false;
 		for (i = 0; i < nkeys; i++) {
@@ -1411,7 +1411,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 					  NULL));
 		CHECK(dns_rdataset_first(&rdataset));
 		dns_rdataset_current(&rdataset, &rdata);
-		CHECK(dns_rdata_tostruct(&rdata, &soa, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &soa));
 		state->nsecttl = ISC_MIN(rdataset.ttl, soa.minimum);
 		dns_rdataset_disassociate(&rdataset);
 		dns_db_detachnode(&node);
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 0440a09215..9936f0637b 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -303,7 +303,7 @@ find_nsec_signer(dns_validator_t *val, dns_rdataset_t *sigp,
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(sigp, &rdata);

-		isc_result_t result = dns_rdata_tostruct(&rdata, &sig, NULL);
+		isc_result_t result = dns_rdata_tostruct(&rdata, &sig);
 		if (result != ISC_R_SUCCESS) {
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "is_insecure_referral: NSEC "
@@ -504,7 +504,7 @@ trynsec3:
 		DNS_RDATASET_FOREACH(&set) {
 			dns_rdata_t rdata = DNS_RDATA_INIT;
 			dns_rdataset_current(&set, &rdata);
-			(void)dns_rdata_tostruct(&rdata, &nsec3, NULL);
+			(void)dns_rdata_tostruct(&rdata, &nsec3);
 			if (nsec3.hash != 1) {
 				continue;
 			}
@@ -1487,7 +1487,7 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
 		isc_region_t r;

 		dns_rdataset_current(rdataset, &rdata);
-		dns_rdata_tostruct(&rdata, &key, NULL); /* can't fail */
+		dns_rdata_tostruct(&rdata, &key); /* can't fail */

 		if (key.algorithm != siginfo->algorithm ||
 		    (key.flags & DNS_KEYFLAG_REVOKE) != 0 ||
@@ -1741,7 +1741,7 @@ selfsigned_dnskey(dns_validator_t *val) {
 		dns_keytag_t keytag;

 		dns_rdataset_current(rdataset, &keyrdata);
-		result = dns_rdata_tostruct(&keyrdata, &key, NULL);
+		result = dns_rdata_tostruct(&keyrdata, &key);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		keytag = compute_keytag(&keyrdata);

@@ -1750,7 +1750,7 @@ selfsigned_dnskey(dns_validator_t *val) {
 			dst_key_t *dstkey = NULL;

 			dns_rdataset_current(sigrdataset, &sigrdata);
-			result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
+			result = dns_rdata_tostruct(&sigrdata, &sig);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);

 			if (sig.algorithm != key.algorithm ||
@@ -2104,7 +2104,7 @@ validate_answer_process(void *arg) {
 		val->siginfo = isc_mem_get(val->view->mctx,
 					   sizeof(*val->siginfo));
 	}
-	CHECK(dns_rdata_tostruct(&val->rdata, val->siginfo, NULL));
+	CHECK(dns_rdata_tostruct(&val->rdata, val->siginfo));

 	/*
 	 * At this point we could check that the signature algorithm
@@ -2363,7 +2363,7 @@ check_signer(dns_validator_t *val, dns_rdata_t *keyrdata, uint16_t keyid,
 		dns_rdata_t rdata = DNS_RDATA_INIT;

 		dns_rdataset_current(&rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &sig, NULL);
+		result = dns_rdata_tostruct(&rdata, &sig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (keyid != sig.keyid || algorithm != sig.algorithm) {
 			continue;
@@ -2509,7 +2509,7 @@ validate_dnskey_dsset(dns_validator_t *val) {
 	unsigned int datalen = 0;

 	dns_rdataset_current(val->dsset, &dsrdata);
-	result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
+	result = dns_rdata_tostruct(&dsrdata, &ds);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	if (ds.digest_type == DNS_DSDIGEST_SHA1 && val->digest_sha1 == false) {
@@ -2610,7 +2610,7 @@ validate_dnskey_dsset(dns_validator_t *val) {
 	 * Figure out if the private algorithm is supported now that we have
 	 * found a matching dnskey.
 	 */
-	dns_rdata_tostruct(&keyrdata, &key, NULL);
+	dns_rdata_tostruct(&keyrdata, &key);
 	if (data == NULL && (ds.algorithm == DNS_KEYALG_PRIVATEDNS ||
 			     ds.algorithm == DNS_KEYALG_PRIVATEOID))
 	{
@@ -2815,7 +2815,7 @@ validate_dnskey(void *arg) {
 	DNS_RDATASET_FOREACH(val->dsset) {
 		dns_rdata_t dsrdata = DNS_RDATA_INIT;
 		dns_rdataset_current(val->dsset, &dsrdata);
-		result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
+		result = dns_rdata_tostruct(&dsrdata, &ds);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		if (!dns_resolver_ds_digest_supported(
@@ -2973,7 +2973,7 @@ valid_nsec_signer(dns_validator_t *val, dns_name_t *name,
 		dns_rdata_rrsig_t sig = { 0 };

 		dns_rdataset_current(sigrdataset, &rdata);
-		CHECK(dns_rdata_tostruct(&rdata, &sig, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &sig));

 		bool equal = dns_name_equal(zonename, &sig.signer);
 		dns_rdata_freestruct(&sig);
@@ -3541,7 +3541,7 @@ check_ds_private(dns_rdataset_t *rdataset) {
 	{
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &ds, NULL);
+		result = dns_rdata_tostruct(&rdata, &ds);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (ds.algorithm == DNS_KEYALG_PRIVATEDNS ||
 		    ds.algorithm == DNS_KEYALG_PRIVATEOID)
@@ -3573,7 +3573,7 @@ check_ds_algs(dns_validator_t *val, dns_name_t *name,
 		size_t datalen = 0;

 		dns_rdataset_current(dsrdataset, &dsrdata);
-		result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
+		result = dns_rdata_tostruct(&dsrdata, &ds);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		/*
@@ -3608,8 +3608,7 @@ check_ds_algs(dns_validator_t *val, dns_name_t *name,
 					seen_private = true;
 					continue;
 				}
-				result = dns_rdata_tostruct(&keyrdata, &key,
-							    NULL);
+				result = dns_rdata_tostruct(&keyrdata, &key);
 				RUNTIME_CHECK(result == ISC_R_SUCCESS);
 				data = key.data;
 				datalen = key.datalen;
diff --git a/lib/dns/view.c b/lib/dns/view.c
index 22c28f00ff..ea43c5d87a 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -2002,7 +2002,7 @@ dns_view_addtrustedkey(dns_view_t *view, dns_rdatatype_t rdtype,
 				 DNS_DECOMPRESS_NEVER, &b));

 	if (rdtype == dns_rdatatype_ds) {
-		CHECK(dns_rdata_tostruct(&rdata, &ds, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &ds));
 	} else {
 		CHECK(dns_ds_fromkeyrdata(name, &rdata, DNS_DSDIGEST_SHA256,
 					  digest, sizeof(digest), &ds));
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 84843ad3db..411236d365 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -2373,7 +2373,7 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
 			dns_rdata_key_t key;
 			dns_rdataset_current(&rdataset, &rdata);

-			result = dns_rdata_tostruct(&rdata, &key, NULL);
+			result = dns_rdata_tostruct(&rdata, &key);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);

 			/*
@@ -2426,7 +2426,7 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
 			dns_rdata_t rdata = DNS_RDATA_INIT;
 			dns_rdataset_current(&rdataset, &rdata);

-			result = dns_rdata_tostruct(&rdata, &ns, NULL);
+			result = dns_rdata_tostruct(&rdata, &ns);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (!zone_check_glue(zone, db, &has_a, &has_aaaa,
 					     &ns.name, name))
@@ -2452,7 +2452,7 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
 			dns_rdataset_current(&rdataset, &rdata);
 			dns_rdata_ds_t ds;

-			result = dns_rdata_tostruct(&rdata, &ds, NULL);
+			result = dns_rdata_tostruct(&rdata, &ds);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			switch (ds.digest_type) {
 			case DNS_DSDIGEST_SHA1:
@@ -2541,7 +2541,7 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
 			dns_rdata_t rdata = DNS_RDATA_INIT;
 			dns_rdataset_current(&rdataset, &rdata);

-			result = dns_rdata_tostruct(&rdata, &mx, NULL);
+			result = dns_rdata_tostruct(&rdata, &mx);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (!zone_check_mx(zone, db, &mx.mx, name)) {
 				ok = false;
@@ -2562,7 +2562,7 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
 			dns_rdata_t rdata = DNS_RDATA_INIT;
 			dns_rdataset_current(&rdataset, &rdata);

-			result = dns_rdata_tostruct(&rdata, &srv, NULL);
+			result = dns_rdata_tostruct(&rdata, &srv);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (!zone_check_srv(zone, db, &srv.target, name)) {
 				ok = false;
@@ -2653,7 +2653,7 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
 			dns_rdata_t rdata = DNS_RDATA_INIT;
 			dns_rdataset_current(&rdataset, &rdata);

-			result = dns_rdata_tostruct(&rdata, &ns, NULL);
+			result = dns_rdata_tostruct(&rdata, &ns);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (zone_is_served_by(zone, db, dns_rdatatype_a,
 					      &ns.name))
@@ -2683,7 +2683,7 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
 			dns_rdata_t rdata = DNS_RDATA_INIT;
 			dns_rdataset_current(&rdataset, &rdata);

-			result = dns_rdata_tostruct(&rdata, &ns, NULL);
+			result = dns_rdata_tostruct(&rdata, &ns);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (zone_is_served_by(zone, db, dns_rdatatype_aaaa,
 					      &ns.name))
@@ -2735,7 +2735,7 @@ zone_check_dnskeys(dns_zone_t *zone, dns_db_t *db) {
 		char algbuf[DNS_SECALG_FORMATSIZE];
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(&rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &dnskey, NULL);
+		result = dns_rdata_tostruct(&rdata, &dnskey);
 		INSIST(result == ISC_R_SUCCESS);

 		/*
@@ -3134,7 +3134,7 @@ resume_addnsec3chain(dns_zone_t *zone) {
 		{
 			continue;
 		}
-		result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
+		result = dns_rdata_tostruct(&rdata, &nsec3param);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0) ||
 		    ((nsec3param.flags & DNS_NSEC3FLAG_CREATE) != 0 && nsec3ok))
@@ -3257,7 +3257,7 @@ check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;

 		dns_rdataset_current(&rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
+		result = dns_rdata_tostruct(&rdata, &nsec3param);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		/*
@@ -3540,7 +3540,7 @@ load_secroots(dns_zone_t *zone, dns_name_t *name, dns_rdataset_t *rdataset) {
 		dns_rdataset_current(rdataset, &rdata);

 		/* Convert rdata to keydata. */
-		result = dns_rdata_tostruct(&rdata, &keydata, NULL);
+		result = dns_rdata_tostruct(&rdata, &keydata);
 		if (result == ISC_R_NOTIMPLEMENTED) {
 			continue;
 		}
@@ -3854,7 +3854,7 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) {

 			dns_rdataset_current(rdataset, &rdata);

-			iresult = dns_rdata_tostruct(&rdata, &keydata, NULL);
+			iresult = dns_rdata_tostruct(&rdata, &keydata);
 			/* Do we have a valid placeholder KEYDATA record? */
 			if (iresult == ISC_R_SUCCESS && keydata.flags == 0 &&
 			    keydata.protocol == 0 && keydata.algorithm == 0)
@@ -4719,7 +4719,7 @@ zone_count_ns_rr(dns_zone_t *zone, dns_db_t *db, dns_dbnode_t *node,
 			dns_rdata_t rdata = DNS_RDATA_INIT;
 			dns_rdataset_current(&rdataset, &rdata);

-			result = dns_rdata_tostruct(&rdata, &ns, NULL);
+			result = dns_rdata_tostruct(&rdata, &ns);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (dns_name_issubdomain(&ns.name, &zone->origin) &&
 			    !zone_check_ns(zone, db, version, &ns.name, logit))
@@ -4788,7 +4788,7 @@ zone_load_soa_rr(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		count++;
 		if (count == 1) {
 			dns_rdata_soa_t soa;
-			result = dns_rdata_tostruct(&rdata, &soa, NULL);
+			result = dns_rdata_tostruct(&rdata, &soa);
 			SET_SOA_VALUES(rdataset.ttl, soa.serial, soa.refresh,
 				       soa.retry, soa.expire, soa.minimum);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -5545,7 +5545,7 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 		dst_algorithm_t algorithm;

 		dns_rdataset_current(&rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
+		result = dns_rdata_tostruct(&rdata, &rrsig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		algorithm = dst_algorithm_fromdata(
 			rrsig.algorithm, rrsig.signature, rrsig.siglen);
@@ -6218,7 +6218,7 @@ signed_with_good_key(dns_zone_t *zone, dns_db_t *db, dns_dbnode_t *node,
 	DNS_RDATASET_FOREACH(&rdataset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(&rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
+		result = dns_rdata_tostruct(&rdata, &rrsig);
 		INSIST(result == ISC_R_SUCCESS);
 		dst_algorithm_t algorithm;
 		algorithm = dst_algorithm_fromdata(
@@ -6731,7 +6731,7 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
 	if (result == ISC_R_SUCCESS) {
 		CHECK(dns_rdataset_first(&rdataset));
 		dns_rdataset_current(&rdataset, &rdata);
-		CHECK(dns_rdata_tostruct(&rdata, &soa, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &soa));
 		ttl = soa.minimum;
 		dns_rdata_reset(&rdata);
 	}
@@ -6751,7 +6751,7 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
 	 */
 	DNS_RDATASET_FOREACH(&rdataset) {
 		dns_rdataset_current(&rdataset, &rdata);
-		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &nsec3param));

 		if (nsec3param.hash != chain->nsec3param.hash ||
 		    (active && nsec3param.flags != 0) ||
@@ -6785,7 +6785,7 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
 	if (rdataset.ttl != ttl) {
 		DNS_RDATASET_FOREACH(&rdataset) {
 			dns_rdataset_current(&rdataset, &rdata);
-			CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
+			CHECK(dns_rdata_tostruct(&rdata, &nsec3param));

 			if (nsec3param.hash != chain->nsec3param.hash ||
 			    (active && nsec3param.flags != 0) ||
@@ -6836,7 +6836,7 @@ try_private:
 		{
 			continue;
 		}
-		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &nsec3param));
 		dns_rdata_reset(&rdata);

 		if ((!nsec3ok &&
@@ -6932,7 +6932,7 @@ deletematchingnsec3(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node,
 		dns_rdata_t rdata = DNS_RDATA_INIT;

 		dns_rdataset_current(&rdataset, &rdata);
-		CHECK(dns_rdata_tostruct(&rdata, &nsec3, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &nsec3));
 		if (nsec3.hash != param->hash ||
 		    nsec3.iterations != param->iterations ||
 		    nsec3.salt.length != param->salt.length ||
@@ -6993,7 +6993,7 @@ need_nsec_chain(dns_db_t *db, dns_dbversion_t *ver,
 	DNS_RDATASET_FOREACH(&rdataset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(&rdataset, &rdata);
-		CHECK(dns_rdata_tostruct(&rdata, &myparam, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &myparam));

 		/*
 		 * Ignore any NSEC3PARAM removals.
@@ -7979,7 +7979,7 @@ del_sig(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
 			dst_algorithm_t sigalg;

 			dns_rdataset_current(&rdataset, &rdata);
-			CHECK(dns_rdata_tostruct(&rdata, &rrsig, NULL));
+			CHECK(dns_rdata_tostruct(&rdata, &rrsig));

 			sigalg = dst_algorithm_fromdata(
 				rrsig.algorithm, rrsig.signature, rrsig.siglen);
@@ -8683,7 +8683,7 @@ normalize_key(dns_rdata_t *rr, dns_rdata_t *target, unsigned char *data,

 	switch (rr->type) {
 	case dns_rdatatype_dnskey:
-		result = dns_rdata_tostruct(rr, &dnskey, NULL);
+		result = dns_rdata_tostruct(rr, &dnskey);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		dnskey.flags &= ~DNS_KEYFLAG_REVOKE;
 		result = dns_rdata_fromstruct(target, rr->rdclass,
@@ -8691,7 +8691,7 @@ normalize_key(dns_rdata_t *rr, dns_rdata_t *target, unsigned char *data,
 					      &buf);
 		break;
 	case dns_rdatatype_keydata:
-		result = dns_rdata_tostruct(rr, &keydata, NULL);
+		result = dns_rdata_tostruct(rr, &keydata);
 		if (result == ISC_R_UNEXPECTEDEND) {
 			return result;
 		}
@@ -8784,7 +8784,7 @@ refresh_time(dns_zonefetch_t *fetch, bool retry) {
 	}

 	dns_rdataset_current(sigset, &sigrr);
-	result = dns_rdata_tostruct(&sigrr, &sig, NULL);
+	result = dns_rdata_tostruct(&sigrr, &sig);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	if (!retry) {
@@ -8858,7 +8858,7 @@ minimal_update(dns_zonefetch_t *fetch, dns_dbversion_t *ver, dns_diff_t *diff) {
 				    0, &rdata));

 		/* Update refresh timer */
-		result = dns_rdata_tostruct(&rdata, &keydata, NULL);
+		result = dns_rdata_tostruct(&rdata, &keydata);
 		if (result == ISC_R_UNEXPECTEDEND) {
 			continue;
 		}
@@ -8926,7 +8926,7 @@ revocable(dns_zonefetch_t *fetch, dns_rdata_keydata_t *keydata) {
 		dns_rdata_t sigrr = DNS_RDATA_INIT;

 		dns_rdataset_current(&fetch->sigset, &sigrr);
-		result = dns_rdata_tostruct(&sigrr, &sig, NULL);
+		result = dns_rdata_tostruct(&sigrr, &sig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		algorithm = dst_algorithm_fromdata(sig.algorithm, sig.signature,
@@ -9120,7 +9120,7 @@ keyfetch_done(dns_zonefetch_t *fetch, isc_result_t eresult) {
 			dns_rdata_t sigrr = DNS_RDATA_INIT;

 			dns_rdataset_current(dnskeysigs, &sigrr);
-			dns_rdata_tostruct(&sigrr, &sig, NULL);
+			dns_rdata_tostruct(&sigrr, &sig);

 			DNS_RDATASET_FOREACH(&dsset) {
 				dns_rdata_t dsrdata = DNS_RDATA_INIT;
@@ -9128,7 +9128,7 @@ keyfetch_done(dns_zonefetch_t *fetch, isc_result_t eresult) {

 				dns_rdata_reset(&dsrdata);
 				dns_rdataset_current(&dsset, &dsrdata);
-				dns_rdata_tostruct(&dsrdata, &ds, NULL);
+				dns_rdata_tostruct(&dsrdata, &ds);

 				if (ds.key_tag != sig.keyid ||
 				    ds.algorithm != sig.algorithm)
@@ -9211,7 +9211,7 @@ anchors_done:

 		dns_rdata_reset(&keydatarr);
 		dns_rdataset_current(keydataset, &keydatarr);
-		result = dns_rdata_tostruct(&keydatarr, &keydata, NULL);
+		result = dns_rdata_tostruct(&keydatarr, &keydata);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		dns_keydata_todnskey(&keydata, &dnskey, NULL);
@@ -9338,7 +9338,7 @@ anchors_done:
 		dns_keytag_t keytag;

 		dns_rdataset_current(dnskeys, &dnskeyrr);
-		result = dns_rdata_tostruct(&dnskeyrr, &dnskey, NULL);
+		result = dns_rdata_tostruct(&dnskeyrr, &dnskey);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		/* Skip ZSK's */
@@ -9379,7 +9379,7 @@ anchors_done:
 		if (matchkey(keydataset, &dnskeyrr)) {
 			dns_rdata_reset(&keydatarr);
 			dns_rdataset_current(keydataset, &keydatarr);
-			result = dns_rdata_tostruct(&keydatarr, &keydata, NULL);
+			result = dns_rdata_tostruct(&keydatarr, &keydata);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);

 			if (revoked && revocable(fetch, &keydata)) {
@@ -9558,7 +9558,7 @@ anchors_done:
 					    &keydatarr));
 		} else if (newkey) {
 			/* Convert DNSKEY to KEYDATA */
-			result = dns_rdata_tostruct(&dnskeyrr, &dnskey, NULL);
+			result = dns_rdata_tostruct(&dnskeyrr, &dnskey);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			dns_keydata_fromdnskey(&keydata, &dnskey, 0, 0, 0,
 					       NULL);
@@ -9580,7 +9580,7 @@ anchors_done:

 		if (trustkey) {
 			/* Trust this key. */
-			result = dns_rdata_tostruct(&dnskeyrr, &dnskey, NULL);
+			result = dns_rdata_tostruct(&dnskeyrr, &dnskey);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			trust_key(zone, keyname, &dnskey, false);
 		}
@@ -9710,7 +9710,7 @@ zone_refreshkeys(dns_zone_t *zone) {
 		DNS_RDATASET_FOREACH(kdset) {
 			dns_rdata_t rdata = DNS_RDATA_INIT;
 			dns_rdataset_current(kdset, &rdata);
-			result = dns_rdata_tostruct(&rdata, &kd, NULL);
+			result = dns_rdata_tostruct(&rdata, &kd);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);

 			/* Removal timer expired? */
@@ -11045,7 +11045,7 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 		goto cleanup3;
 	}
 	dns_rdataset_current(&soardset, &soardata);
-	result = dns_rdata_tostruct(&soardata, &soa, NULL);
+	result = dns_rdata_tostruct(&soardata, &soa);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_name_dup(&soa.origin, zone->mctx, &primary);
 	serial = soa.serial;
@@ -11173,7 +11173,7 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {

 		dns_notify_t *notify = NULL;

-		result = dns_rdata_tostruct(&rdata, &ns, NULL);
+		result = dns_rdata_tostruct(&rdata, &ns);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		/*
@@ -11642,7 +11642,7 @@ save_nsrrset(dns_message_t *message, dns_name_t *name,
 	DNS_RDATASET_FOREACH(nsrdataset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(nsrdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &ns, NULL);
+		result = dns_rdata_tostruct(&rdata, &ns);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		if (!dns_name_issubdomain(&ns.name, name)) {
@@ -12365,7 +12365,7 @@ refresh_callback(void *arg) {
 	}

 	dns_rdataset_current(rdataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &soa, NULL);
+	result = dns_rdata_tostruct(&rdata, &soa);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	serial = soa.serial;
@@ -13521,7 +13521,7 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
 			unsigned int soacount;

 			dns_rdataset_current(rdataset, &rdata);
-			result = dns_rdata_tostruct(&rdata, &soa, NULL);
+			result = dns_rdata_tostruct(&rdata, &soa);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			serial = soa.serial;
 			have_serial = true;
@@ -13810,7 +13810,7 @@ cdnskey_inuse(dns_zone_t *zone, dns_rdata_t *rdata,
 	isc_result_t result;
 	dns_rdata_cdnskey_t cdnskey;

-	result = dns_rdata_tostruct(rdata, &cdnskey, NULL);
+	result = dns_rdata_tostruct(rdata, &cdnskey);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "dns_rdata_tostruct(cdnskey) failed: %s",
@@ -13847,7 +13847,7 @@ cds_inuse(dns_zone_t *zone, dns_rdata_t *rdata, dns_dnsseckeylist_t *keylist,
 	isc_result_t result;
 	dns_rdata_ds_t cds;

-	result = dns_rdata_tostruct(rdata, &cds, NULL);
+	result = dns_rdata_tostruct(rdata, &cds);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "dns_rdata_tostruct(cds) failed: %s",
@@ -14279,10 +14279,10 @@ sync_secure_db(dns_zone_t *seczone, dns_zone_t *raw, dns_db_t *secdb,
 	}

 	if (oldtuple != NULL && newtuple != NULL) {
-		result = dns_rdata_tostruct(&oldtuple->rdata, &oldsoa, NULL);
+		result = dns_rdata_tostruct(&oldtuple->rdata, &oldsoa);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

-		result = dns_rdata_tostruct(&newtuple->rdata, &newsoa, NULL);
+		result = dns_rdata_tostruct(&newtuple->rdata, &newsoa);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		/*
@@ -14822,7 +14822,7 @@ checkandaddsoa(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	result = dns_rdataset_first(rdataset);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_rdataset_current(rdataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &soa, NULL);
+	result = dns_rdata_tostruct(&rdata, &soa);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	if (isc_serial_gt(soa.serial, oldserial)) {
@@ -16642,7 +16642,7 @@ add_signing_records(dns_db_t *db, dns_rdatatype_t privatetype,
 			continue;
 		}

-		result = dns_rdata_tostruct(&tuple->rdata, &dnskey, NULL);
+		result = dns_rdata_tostruct(&tuple->rdata, &dnskey);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if ((dnskey.flags & DNS_KEYOWNER_ZONE) == 0) {
 			dns_diff_unlink(diff, tuple);
@@ -16910,7 +16910,7 @@ signed_with_alg(dns_rdataset_t *rdataset, dst_algorithm_t alg) {
 		dns_rdata_rrsig_t rrsig;

 		dns_rdataset_current(rdataset, &rdata);
-		dns_rdata_tostruct(&rdata, &rrsig, NULL);
+		dns_rdata_tostruct(&rdata, &rrsig);
 		sigalg = dst_algorithm_fromdata(rrsig.algorithm,
 						rrsig.signature, rrsig.siglen);
 		if (sigalg == alg) {
@@ -17247,7 +17247,7 @@ checkds_done(void *arg) {
 			unsigned char keybuf[DNS_RDATA_MAXLENGTH];

 			dns_rdataset_current(ds_rrset, &rdata);
-			r = dns_rdata_tostruct(&rdata, &ds, NULL);
+			r = dns_rdata_tostruct(&rdata, &ds);
 			if (r != ISC_R_SUCCESS) {
 				continue;
 			}
@@ -17935,7 +17935,7 @@ nsfetch_checkds(dns_zonefetch_t *fetch, isc_result_t eresult) {
 		bool isqueued;

 		dns_rdataset_current(nsrrset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &ns, NULL);
+		result = dns_rdata_tostruct(&rdata, &ns);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		dns_rdata_reset(&rdata);
@@ -18222,7 +18222,7 @@ dsyncfetch_done(dns_zonefetch_t *fetch, isc_result_t eresult) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;

 		dns_rdataset_current(rrset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &dsync, NULL);
+		result = dns_rdata_tostruct(&rdata, &dsync);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		dns_rdata_reset(&rdata);
@@ -19212,7 +19212,7 @@ zone_rekey(dns_zone_t *zone) {
 				continue;
 			}

-			result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
+			result = dns_rdata_tostruct(&rdata, &nsec3param);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (nsec3param.flags == 0) {
 				continue;
@@ -19541,7 +19541,7 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
 				CLEANUP(DNS_R_BADCDS);
 			}

-			CHECK(dns_rdata_tostruct(&crdata, &structcds, NULL));
+			CHECK(dns_rdata_tostruct(&crdata, &structcds));

 			/*
 			 * Log deprecated CDS digest types.
@@ -19579,7 +19579,7 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {

 					dns_rdataset_current(&dnskey, &rdata);
 					dns_rdata_tostruct(&rdata,
-							   &structdnskey, NULL);
+							   &structdnskey);

 					if (structdnskey.algorithm ==
 					    structcds.algorithm)
@@ -19601,8 +19601,8 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
 				if (result != ISC_R_SUCCESS) {
 					CLEANUP(DNS_R_BADCDS);
 				}
-				CHECK(dns_rdata_tostruct(&rdata, &structdnskey,
-							 NULL));
+				CHECK(dns_rdata_tostruct(&rdata,
+							 &structdnskey));
 				dnskeyalg = dst_algorithm_fromdata(
 					structdnskey.algorithm,
 					structdnskey.data,
@@ -19652,8 +19652,7 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
 				CLEANUP(DNS_R_BADCDNSKEY);
 			}

-			CHECK(dns_rdata_tostruct(&crdata, &structcdnskey,
-						 NULL));
+			CHECK(dns_rdata_tostruct(&crdata, &structcdnskey));
 			cdnskeyalg = dst_algorithm_fromdata(
 				structcdnskey.algorithm, structcdnskey.data,
 				structcdnskey.datalen);
@@ -19666,8 +19665,8 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
 				dst_algorithm_t dnskeyalg;

 				dns_rdataset_current(&dnskey, &rdata);
-				CHECK(dns_rdata_tostruct(&rdata, &structdnskey,
-							 NULL));
+				CHECK(dns_rdata_tostruct(&rdata,
+							 &structdnskey));
 				dnskeyalg = dst_algorithm_fromdata(
 					structdnskey.algorithm,
 					structdnskey.data,
@@ -20317,7 +20316,7 @@ dns__zone_lookup_nsec3param(dns_zone_t *zone, dns_rdata_nsec3param_t *lookup,
 	DNS_RDATASET_FOREACH(&rdataset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(&rdataset, &rdata);
-		dns_rdata_tostruct(&rdata, &nsec3param, NULL);
+		dns_rdata_tostruct(&rdata, &nsec3param);

 		/* Check parameters. */
 		if (nsec3param.hash != lookup->hash) {
diff --git a/lib/dns/zoneverify.c b/lib/dns/zoneverify.c
index 3d5ea5048f..cebfb3c09a 100644
--- a/lib/dns/zoneverify.c
+++ b/lib/dns/zoneverify.c
@@ -172,7 +172,7 @@ goodsig(const vctx_t *vctx, dns_rdata_t *sigrdata, const dns_name_t *name,
 	isc_result_t result;
 	dst_algorithm_t algorithm;

-	result = dns_rdata_tostruct(sigrdata, &sig, NULL);
+	result = dns_rdata_tostruct(sigrdata, &sig);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	algorithm = dst_algorithm_fromdata(sig.algorithm, sig.signature,
@@ -199,7 +199,7 @@ nsec_bitmap_equal(dns_rdata_nsec_t *nsec, dns_rdata_t *rdata) {
 	isc_result_t result;
 	dns_rdata_nsec_t tmpnsec;

-	result = dns_rdata_tostruct(rdata, &tmpnsec, NULL);
+	result = dns_rdata_tostruct(rdata, &tmpnsec);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	if (nsec->len != tmpnsec.len ||
@@ -243,7 +243,7 @@ verifynsec(const vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node,
 	}

 	dns_rdataset_current(&rdataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &nsec, NULL);
+	result = dns_rdata_tostruct(&rdata, &nsec);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	/* Check next name is consistent */
@@ -427,7 +427,7 @@ find_nsec3_match(const dns_rdata_nsec3param_t *nsec3param,
 	DNS_RDATASET_FOREACH(rdataset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(rdataset, &rdata);
-		dns_rdata_tostruct(&rdata, nsec3_match, NULL);
+		dns_rdata_tostruct(&rdata, nsec3_match);
 		if (nsec3_match->hash == nsec3param->hash &&
 		    nsec3_match->next.length == rhsize &&
 		    nsec3_match->iterations == nsec3param->iterations &&
@@ -493,7 +493,7 @@ match_nsec3(const vctx_t *vctx, const dns_name_t *name,
 	{
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
+		result = dns_rdata_tostruct(&rdata, &nsec3);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (nsec3.hash == nsec3param->hash &&
 		    nsec3.iterations == nsec3param->iterations &&
@@ -528,7 +528,7 @@ innsec3params(const dns_rdata_nsec3_t *nsec3, dns_rdataset_t *nsec3paramset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;

 		dns_rdataset_current(nsec3paramset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
+		result = dns_rdata_tostruct(&rdata, &nsec3param);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (nsec3param.flags == 0 && nsec3param.hash == nsec3->hash &&
 		    nsec3param.iterations == nsec3->iterations &&
@@ -577,7 +577,7 @@ record_found(const vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node,
 	DNS_RDATASET_FOREACH(&rdataset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(&rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
+		result = dns_rdata_tostruct(&rdata, &nsec3);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (nsec3.next.length != isc_buffer_usedlength(&b)) {
 			continue;
@@ -643,7 +643,7 @@ isoptout(const vctx_t *vctx, const dns_rdata_nsec3param_t *nsec3param,

 	dns_rdataset_current(&rdataset, &rdata);

-	result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
+	result = dns_rdata_tostruct(&rdata, &nsec3);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	*optout = ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) != 0);

@@ -749,7 +749,7 @@ verifynsec3s(const vctx_t *vctx, const dns_name_t *name,

 		dns_rdataset_current(nsec3paramset, &rdata);

-		result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
+		result = dns_rdata_tostruct(&rdata, &nsec3param);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		/* Skip unusable NSEC3PARAM records. */
@@ -831,7 +831,7 @@ verifyset(vctx_t *vctx, dns_rdataset_t *rdataset, const dns_name_t *name,
 		dst_algorithm_t algorithm;

 		dns_rdataset_current(&sigrdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &sig, NULL);
+		result = dns_rdata_tostruct(&rdata, &sig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (rdataset->ttl != sig.originalttl) {
 			dns_name_format(name, namebuf, sizeof(namebuf));
@@ -1358,7 +1358,7 @@ check_apex_rrsets(vctx_t *vctx) {
 			dns_rdata_nsec3param_t nsec3param;

 			dns_rdataset_current(&vctx->nsec3paramset, &rdata);
-			result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
+			result = dns_rdata_tostruct(&rdata, &nsec3param);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (nsec3param.flags != 0 ||
 			    nsec3param.iterations > DNS_NSEC3_MAXITERATIONS ||
@@ -1477,7 +1477,7 @@ check_dnskey_sigs(vctx_t *vctx, const dns_rdata_dnskey_t *dnskey,

 			dns_rdata_reset(&dsrdata);
 			dns_rdataset_current(&dsset, &dsrdata);
-			result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
+			result = dns_rdata_tostruct(&dsrdata, &ds);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);

 			if (ds.key_tag != dst_key_id(key) ||
@@ -1530,7 +1530,7 @@ check_dnskey(vctx_t *vctx) {
 	DNS_RDATASET_FOREACH(&vctx->keyset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(&vctx->keyset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &dnskey, NULL);
+		result = dns_rdata_tostruct(&rdata, &dnskey);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		is_ksk = ((dnskey.flags & DNS_KEYFLAG_KSK) != 0);

diff --git a/lib/ns/query.c b/lib/ns/query.c
index c68959c532..a10474d922 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -4053,7 +4053,7 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 			dns_rdata_t nsrdata = DNS_RDATA_INIT;

 			dns_rdataset_current(st->r.ns_rdataset, &nsrdata);
-			result = dns_rdata_tostruct(&nsrdata, &ns, NULL);
+			result = dns_rdata_tostruct(&nsrdata, &ns);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			dns_rdata_reset(&nsrdata);

@@ -4285,7 +4285,7 @@ again:
 		result = dns_rdataset_first(rdataset);
 		INSIST(result == ISC_R_SUCCESS);
 		dns_rdataset_current(rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
+		result = dns_rdata_tostruct(&rdata, &nsec3);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		dns_rdata_reset(&rdata);
 		optout = ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) != 0);
@@ -4344,7 +4344,7 @@ dns64_ttl(dns_db_t *db, dns_dbversion_t *version) {
 	CHECK(dns_rdataset_first(&rdataset));

 	dns_rdataset_current(&rdataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &soa, NULL);
+	result = dns_rdata_tostruct(&rdata, &soa);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	ttl = ISC_MIN(rdataset.ttl, soa.minimum);

@@ -6861,7 +6861,7 @@ query_checkrpz(query_ctx_t *qctx, isc_result_t result) {
 			result = dns_rdataset_first(qctx->rdataset);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			dns_rdataset_current(qctx->rdataset, &rdata);
-			result = dns_rdata_tostruct(&rdata, &cname, NULL);
+			result = dns_rdata_tostruct(&rdata, &cname);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			dns_rdata_reset(&rdata);

@@ -7009,7 +7009,7 @@ has_ta(query_ctx_t *qctx) {

 			dns_rdata_reset(&rdata);
 			dns_rdataset_current(&dsset, &rdata);
-			result = dns_rdata_tostruct(&rdata, &ds, NULL);
+			result = dns_rdata_tostruct(&rdata, &ds);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (ds.key_tag == sentinel) {
 				dns_keynode_detach(&keynode);
@@ -7598,7 +7598,7 @@ query_getexpire(query_ctx_t *qctx) {
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		dns_rdataset_current(qctx->rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &soa, NULL);
+		result = dns_rdata_tostruct(&rdata, &soa);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		qctx->client->inner.expire = soa.expire;
@@ -8838,7 +8838,7 @@ query_addnxrrsetnsec(query_ctx_t *qctx) {

 	dns_rdata_init(&sigrdata);
 	dns_rdataset_current(qctx->sigrdataset, &sigrdata);
-	result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
+	result = dns_rdata_tostruct(&sigrdata, &sig);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	labels = dns_name_countlabels(qctx->fname);
@@ -9068,7 +9068,7 @@ query_synthttl(dns_rdataset_t *soardataset, dns_rdataset_t *sigsoardataset,
 	result = dns_rdataset_first(soardataset);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_rdataset_current(soardataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &soa, NULL);
+	result = dns_rdata_tostruct(&rdata, &soa);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	ttl = ISC_MIN(soa.minimum, soardataset->ttl);
@@ -9239,7 +9239,7 @@ query_synthcnamewildcard(query_ctx_t *qctx, dns_rdataset_t *rdataset,
 	}

 	dns_rdataset_current(rdataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &cname, NULL);
+	result = dns_rdata_tostruct(&rdata, &cname);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_rdata_reset(&rdata);

@@ -9366,7 +9366,7 @@ checksignames(dns_name_t *signer, dns_rdataset_t *sigrdataset) {
 		dns_rdata_rrsig_t rrsig;

 		dns_rdataset_current(sigrdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
+		result = dns_rdata_tostruct(&rdata, &rrsig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		if (dns_name_empty(signer)) {
@@ -9858,7 +9858,7 @@ query_cname(query_ctx_t *qctx) {
 	}

 	dns_rdataset_current(trdataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &cname, NULL);
+	result = dns_rdata_tostruct(&rdata, &cname);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_rdata_reset(&rdata);

@@ -9957,7 +9957,7 @@ query_dname(query_ctx_t *qctx) {
 	}

 	dns_rdataset_current(trdataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &dname, NULL);
+	result = dns_rdata_tostruct(&rdata, &dname);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_rdata_reset(&rdata);

@@ -10223,7 +10223,7 @@ query_addsoa(query_ctx_t *qctx, unsigned int override_ttl,
 		result = dns_rdataset_first(rdataset);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		dns_rdataset_current(rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &soa, NULL);
+		result = dns_rdata_tostruct(&rdata, &soa);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);

 		if (override_ttl != UINT32_MAX && override_ttl < rdataset->ttl)
@@ -10764,7 +10764,7 @@ again:
 		}
 		if (result == ISC_R_SUCCESS) {
 			dns_rdataset_current(rdataset, &rdata);
-			result = dns_rdata_tostruct(&rdata, &nsec, NULL);
+			result = dns_rdata_tostruct(&rdata, &nsec);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			(void)dns_name_fullcompare(name, fname, &order,
 						   &olabels);
diff --git a/lib/ns/update.c b/lib/ns/update.c
index 0ff8e6aeff..8426079e8a 100644
--- a/lib/ns/update.c
+++ b/lib/ns/update.c
@@ -855,12 +855,12 @@ ssu_checkrule(void *data, dns_rdataset_t *rrset) {
 			dns_rdata_t rdata = DNS_RDATA_INIT;
 			dns_rdataset_current(&rdataset, &rdata);
 			if (rrset->type == dns_rdatatype_ptr) {
-				result = dns_rdata_tostruct(&rdata, &ptr, NULL);
+				result = dns_rdata_tostruct(&rdata, &ptr);
 				RUNTIME_CHECK(result == ISC_R_SUCCESS);
 				target = &ptr.ptr;
 			}
 			if (rrset->type == dns_rdatatype_srv) {
-				result = dns_rdata_tostruct(&rdata, &srv, NULL);
+				result = dns_rdata_tostruct(&rdata, &srv);
 				RUNTIME_CHECK(result == ISC_R_SUCCESS);
 				target = &srv.target;
 			}
@@ -910,14 +910,14 @@ ssu_checkrr(void *data, rr_t *rr) {
 	bool answer;

 	if (rr->rdata.type == dns_rdatatype_ptr) {
-		result = dns_rdata_tostruct(&rr->rdata, &ptr, NULL);
+		result = dns_rdata_tostruct(&rr->rdata, &ptr);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		target = &ptr.ptr;
 	}
 	if (rr->rdata.rdclass == dns_rdataclass_in &&
 	    rr->rdata.type == dns_rdatatype_srv)
 	{
-		result = dns_rdata_tostruct(&rr->rdata, &srv, NULL);
+		result = dns_rdata_tostruct(&rr->rdata, &srv);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		target = &srv.target;
 	}
@@ -1288,9 +1288,9 @@ replaces_p(dns_zone_t *zone ISC_ATTR_UNUSED, dns_rdata_t *update_rr,
 		 * Replace existing RRSIG with the same keyid,
 		 * covered and algorithm.
 		 */
-		result = dns_rdata_tostruct(db_rr, &dbsig, NULL);
+		result = dns_rdata_tostruct(db_rr, &dbsig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		result = dns_rdata_tostruct(update_rr, &updatesig, NULL);
+		result = dns_rdata_tostruct(update_rr, &updatesig);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (dbsig.keyid == updatesig.keyid &&
 		    dbsig.covered == updatesig.covered &&
@@ -1718,7 +1718,7 @@ send_update(ns_client_t *client, dns_zone_t *zone) {
 			     update_class == dns_rdataclass_none) &&
 			    rdata.type == dns_rdatatype_ptr)
 			{
-				result = dns_rdata_tostruct(&rdata, &ptr, NULL);
+				result = dns_rdata_tostruct(&rdata, &ptr);
 				RUNTIME_CHECK(result == ISC_R_SUCCESS);
 				target = &ptr.ptr;
 			}
@@ -1727,7 +1727,7 @@ send_update(ns_client_t *client, dns_zone_t *zone) {
 			     update_class == dns_rdataclass_none) &&
 			    rdata.type == dns_rdatatype_srv)
 			{
-				result = dns_rdata_tostruct(&rdata, &srv, NULL);
+				result = dns_rdata_tostruct(&rdata, &srv);
 				RUNTIME_CHECK(result == ISC_R_SUCCESS);
 				target = &srv.target;
 			}
@@ -2037,7 +2037,7 @@ check_mx(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 			continue;
 		}

-		result = dns_rdata_tostruct(&t->rdata, &mx, NULL);
+		result = dns_rdata_tostruct(&t->rdata, &mx);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		/*
 		 * Check if we will error out if we attempt to reload the
@@ -2183,7 +2183,7 @@ get_iterations(dns_db_t *db, dns_dbversion_t *ver, dns_rdatatype_t privatetype,
 	DNS_RDATASET_FOREACH(&rdataset) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(&rdataset, &rdata);
-		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &nsec3param));
 		if ((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0) {
 			continue;
 		}
@@ -2217,7 +2217,7 @@ try_private:
 		{
 			continue;
 		}
-		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
+		CHECK(dns_rdata_tostruct(&rdata, &nsec3param));
 		if ((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0) {
 			continue;
 		}
diff --git a/tests/dns/nsec3_test.c b/tests/dns/nsec3_test.c
index 319dda0f59..6b21031b5e 100644
--- a/tests/dns/nsec3_test.c
+++ b/tests/dns/nsec3_test.c
@@ -82,7 +82,7 @@ nsec3param_salttotext_test(const nsec3param_salttotext_test_params_t *params) {
 		&rdata, dns_rdataclass_in, dns_rdatatype_nsec3param, buf,
 		sizeof(buf), params->nsec3param_text, false);
 	assert_int_equal(result, ISC_R_SUCCESS);
-	result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
+	result = dns_rdata_tostruct(&rdata, &nsec3param);
 	assert_int_equal(result, ISC_R_SUCCESS);

 	/*
diff --git a/tests/dns/rdata_test.c b/tests/dns/rdata_test.c
index 40f84f3810..ce40884f7a 100644
--- a/tests/dns/rdata_test.c
+++ b/tests/dns/rdata_test.c
@@ -273,7 +273,7 @@ check_struct_conversions(dns_rdata_t *rdata, size_t structsize,
 	/*
 	 * Convert from uncompressed wire form into type-specific struct.
 	 */
-	result = dns_rdata_tostruct(rdata, rdata_struct, NULL);
+	result = dns_rdata_tostruct(rdata, rdata_struct);
 	detect_uncleared_libcrypto_error();
 	assert_int_equal(result, ISC_R_SUCCESS);

diff --git a/tests/dns/sigs_test.c b/tests/dns/sigs_test.c
index a8dfd32079..ef8dd1ed2c 100644
--- a/tests/dns/sigs_test.c
+++ b/tests/dns/sigs_test.c
@@ -149,7 +149,7 @@ compare_tuples(const zonediff_t *expected, dns_difftuple_t *found,
 		/*
 		 * The signature must cover an RRset of type 'expected->type'.
 		 */
-		result = dns_rdata_tostruct(&found->rdata, &rrsig, NULL);
+		result = dns_rdata_tostruct(&found->rdata, &rrsig);
 		assert_int_equal(result, ISC_R_SUCCESS);
 		isc_buffer_init(&typebuf, found_covers, sizeof(found_covers));
 		result = dns_rdatatype_totext(rrsig.covered, &typebuf);
diff --git a/tests/dns/skr_test.c b/tests/dns/skr_test.c
index 54e9b1311d..a151680200 100644
--- a/tests/dns/skr_test.c
+++ b/tests/dns/skr_test.c
@@ -329,7 +329,7 @@ check_rrsig(dns_skrbundle_t *bundle, skr__testbundle_t *tb,

 		assert_int_equal(cmp, 0);

-		r = dns_rdata_tostruct(&sigrdata, &sig, NULL);
+		r = dns_rdata_tostruct(&sigrdata, &sig);
 		assert_int_equal(r, ISC_R_SUCCESS);

 		assert_int_equal(sig.timesigned, tb->inception);
diff --git a/tests/dns/tsig_test.c b/tests/dns/tsig_test.c
index d162ccce18..851378086b 100644
--- a/tests/dns/tsig_test.c
+++ b/tests/dns/tsig_test.c
@@ -60,7 +60,7 @@ add_mac(dst_context_t *tsigctx, isc_buffer_t *buf) {
 	dns_rdata_fromregion(&rdata, dns_rdataclass_any, dns_rdatatype_tsig,
 			     &r);
 	isc_buffer_init(&databuf, tsigbuf, sizeof(tsigbuf));
-	CHECK(dns_rdata_tostruct(&rdata, &tsig, NULL));
+	CHECK(dns_rdata_tostruct(&rdata, &tsig));
 	isc_buffer_putuint16(&databuf, tsig.siglen);
 	isc_buffer_putmem(&databuf, tsig.signature, tsig.siglen);
 	isc_buffer_usedregion(&databuf, &r);