Commit 5427eece73 for bind

commit 5427eece73750ea711bb449ed0fc8c6badb957b2
Author: Evan Hunt <each@isc.org>
Date:   Tue Oct 6 14:07:31 2026 -0700

    deprecate NXDOMAIN redirection features

    Add deprecation warnings for the "nxdomain-redirect" option and
    for "type redirect" zones.  Update the documentation to reflect that
    these features are deprecated.

diff --git a/bin/tests/system/checkconf/deprecated.conf b/bin/tests/system/checkconf/deprecated.conf
index b317f14707..4147bd4744 100644
--- a/bin/tests/system/checkconf/deprecated.conf
+++ b/bin/tests/system/checkconf/deprecated.conf
@@ -1,6 +1,7 @@
 options {
 	dnssec-validation yes;
 	max-zone-ttl 600;
+	nxdomain-redirect "example.";
 };

 trust-anchors {
@@ -19,3 +20,8 @@ zone example.com {
 	file "maxttl-bad.db";
 	max-zone-ttl 120;
 };
+
+zone "." {
+	type redirect;
+	file "redirect.db";
+};
diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index 3fae8e4499..1d47f42ba0 100644
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -192,6 +192,8 @@ echo_i "checking named-checkconf deprecate warnings ($n)"
 ret=0
 $CHECKCONF deprecated.conf >checkconf.out$n.1 2>&1 || ret=1
 grep "option 'max-zone-ttl' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
+grep "option 'nxdomain-redirect' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
+grep "type 'redirect' is deprecated" <checkconf.out$n.1 >/dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 # set -i to ignore deprecate warnings
diff --git a/doc/arm/dlz.inc.rst b/doc/arm/dlz.inc.rst
index 4365831cd8..146e0bd4a5 100644
--- a/doc/arm/dlz.inc.rst
+++ b/doc/arm/dlz.inc.rst
@@ -68,21 +68,6 @@ for the best match when a query is received. Instead, zones in this DLZ
 must be separately specified in a zone statement. This allows users to
 configure a zone normally using standard zone-option semantics, but
 specify a different database backend for storage of the zone's data.
-For example, to implement NXDOMAIN redirection using a DLZ module for
-backend storage of redirection rules:
-
-::
-
-       dlz other {
-              database "dlopen driver.so args";
-              search no;
-       };
-
-       zone "." {
-              type redirect;
-              dlz other;
-       };
-

 Sample DLZ Module
 ~~~~~~~~~~~~~~~~~
diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index d5eb06943d..a09e71f02f 100644
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -5610,7 +5610,8 @@ Response Rate Limiting
 NXDOMAIN Redirection
 ^^^^^^^^^^^^^^^^^^^^

-:iscman:`named` supports NXDOMAIN redirection via two methods:
+:iscman:`named` allows NXDOMAIN redirection via two methods. Note that
+both methods are deprecated, and will be removed in a future release.

 -  :any:`Redirect zone <type redirect>`
 -  Redirect namespace
@@ -5625,7 +5626,7 @@ the normal namespace. All the redirect information is contained in the
 zone; there are no delegations.

 .. namedconf:statement:: nxdomain-redirect
-   :tags: query
+   :tags: query, deprecated
    :short: Appends the specified suffix to the original query name, when replacing an NXDOMAIN with a redirect namespace.

    With a redirect namespace (``option { nxdomain-redirect <suffix> };``),
@@ -7093,7 +7094,7 @@ Zone Types
    globally, re-specify the global forwarders.

 .. namedconf:statement:: type redirect
-   :tags: zone
+   :tags: zone, deprecated
    :short: Contains information to answer queries when normal resolution would return NXDOMAIN.

    Redirect zones are used to provide answers to queries when normal
@@ -7129,6 +7130,8 @@ Zone Types
    When using :option:`rndc reload` without specifying a zone name, redirect
    zones are reloaded along with other zones.

+   Redirect zones are deprecated, and will be removed in a future release.
+
 .. namedconf:statement:: in-view
    :tags: view, zone
    :short: Specifies the view in which a given zone is defined.
diff --git a/doc/misc/options b/doc/misc/options
index db0242d286..e5a58cabf5 100644
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -229,7 +229,7 @@ options {
 	nsec3-test-zone <boolean>; // test only
 	nta-lifetime <duration>;
 	nta-recheck <duration>;
-	nxdomain-redirect <string>;
+	nxdomain-redirect <string>; // deprecated
 	parental-source ( <ipv4_address> | * );
 	parental-source-v6 ( <ipv6_address> | * );
 	pid-file ( <quoted_string> | none );
@@ -622,7 +622,7 @@ view <string> [ <class> ] {
 	nsec3-test-zone <boolean>; // test only
 	nta-lifetime <duration>;
 	nta-recheck <duration>;
-	nxdomain-redirect <string>;
+	nxdomain-redirect <string>; // deprecated
 	parental-source ( <ipv4_address> | * );
 	parental-source-v6 ( <ipv6_address> | * );
 	plugin ( query ) <string> [ { <unspecified-text> } ]; // may occur multiple times
diff --git a/lib/isccfg/check.c b/lib/isccfg/check.c
index 490799d774..ce2f888ff1 100644
--- a/lib/isccfg/check.c
+++ b/lib/isccfg/check.c
@@ -3412,6 +3412,9 @@ isccfg_check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		} else if (strcasecmp(typestr, "hint") == 0) {
 			ztype = CFG_ZONE_HINT;
 		} else if (strcasecmp(typestr, "redirect") == 0) {
+			cfg_obj_log(obj, ISC_LOG_WARNING,
+				    "zone '%s': type 'redirect' is deprecated",
+				    znamestr);
 			ztype = CFG_ZONE_REDIRECT;
 		} else {
 			cfg_obj_log(obj, ISC_LOG_ERROR,
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index d96f66fc50..8e29044f52 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -2421,7 +2421,8 @@ static cfg_clausedef_t view_clauses[] = {
 	{ "nosit-udp-size", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
 	{ "nta-lifetime", &cfg_type_duration, 0, NULL },
 	{ "nta-recheck", &cfg_type_duration, 0, NULL },
-	{ "nxdomain-redirect", &cfg_type_astring, 0, NULL },
+	{ "nxdomain-redirect", &cfg_type_astring, CFG_CLAUSEFLAG_DEPRECATED,
+	  NULL },
 	{ "preferred-glue", &cfg_type_astring, 0, NULL },
 	{ "prefetch", &cfg_type_prefetch, 0, prefetch_merge },
 	{ "provide-ixfr", &cfg_type_boolean, 0, NULL },