84 files changed, 4711 insertions, 2169 deletions

diff --git a/.gitignore b/.gitignore
index 3c739546f..b7dd58739 100644
--- a/.gitignore
+++ b/.gitignore
@@ -46,3 +46,6 @@ src/credential/gnunet-credential
 src/credential/gnunet-service-credential
 src/identity-provider/gnunet-idp
 *.patch
+src/namestore/perf_namestore_api_zone_iteration_flat
+src/namestore/perf_namestore_api_zone_iteration_postgres
+src/namestore/perf_namestore_api_zone_iteration_sqlite
diff --git a/contrib/timeout_watchdog.c b/contrib/timeout_watchdog.c
index 7a0376b9f..fc61a7cc7 100644
--- a/contrib/timeout_watchdog.c
+++ b/contrib/timeout_watchdog.c
@@ -33,12 +33,14 @@
 
 static pid_t child;
 
+
 static void
 sigchld_handler (int val)
 {
   int status = 0;
   int ret = 0;
 
+  (void) val;
   waitpid (child, &status, 0);
   if (WIFEXITED (status) != 0)
     {
@@ -53,6 +55,7 @@ sigchld_handler (int val)
   exit (ret);
 }
 
+
 static void
 sigint_handler (int val)
 {
@@ -60,8 +63,10 @@ sigint_handler (int val)
   exit (val);
 }
 
+
 int
-main (int argc, char *argv[])
+main (int argc,
+      char *argv[])
 {
   int timeout = 0;
   pid_t gpid = 0;
diff --git a/doc/documentation/chapters/installation.texi b/doc/documentation/chapters/installation.texi
index eeb14473b..3a76fb162 100644
--- a/doc/documentation/chapters/installation.texi
+++ b/doc/documentation/chapters/installation.texi
@@ -294,7 +294,7 @@ If you want to be able to enable DEBUG-level log messages, add
 @command{./configure} command.
 @code{DEBUG}-level log messages are in English only and
 should only be useful for developers (or for filing
-really detailed bug reports). 
+really detailed bug reports).
 
 Finally, you probably want to compile @command{gnunet-gtk}, which
 includes @command{gnunet-setup} (a graphical tool for
@@ -389,10 +389,9 @@ For those services, systems with more than one user may require each user
 to specify a different port number in their personal configuration file.
 
 Finally, the user should perform the basic initial setup for the GNU Name
-System (GNS). This is done by running two commands:
+System (GNS) certificate authority. This is done by running:
 
 @example
-$ gnunet-gns-import.sh
 $ gnunet-gns-proxy-setup-ca
 @end example
 
@@ -420,7 +419,7 @@ hosts: files gns [NOTFOUND=return] mdns4_minimal \
 
 @c FIXME: Document new behavior.
 You might want to make sure that @file{/lib/libnss_gns.so.2} exists on
-your system, it should have been created during the installation. 
+your system, it should have been created during the installation.
 
 @node Build instructions for Ubuntu 12.04 using Git
 @section Build instructions for Ubuntu 12.04 using Git
@@ -802,7 +801,7 @@ $ gpg --keyserver pgp.mit.edu --recv-keys A88C8ADD129828D7EAC02E52E22F9BBFEE3485
 @end example
 
 @noindent
-and rerun the gpg --verify command. 
+and rerun the gpg --verify command.
 
 @example
 $ tar xvf gnurl-7.57.0.tar.xz
@@ -1418,7 +1417,7 @@ as a normal user.
 We begin by installing a few Debian packages from stable:
 
 @example
-# apt-get install gcc make python-zbar libltdl-dev libsqlite3-dev \ 
+# apt-get install gcc make python-zbar libltdl-dev libsqlite3-dev \
 libunistring-dev libopus-dev libpulse-dev openssl libglpk-dev texlive \
 libidn11-dev libmysqlclient-dev libpq-dev libarchive-dev libbz2-dev \
 libflac-dev libgif-dev libglib2.0-dev libgtk-3-dev libmpeg2-4-dev \
@@ -1633,7 +1632,7 @@ have to compile it from source:
 @item Unzip the downloaded source tarball using your favourite
 unzipper application In the MSYS shell
 
-@item change to the respective directory 
+@item change to the respective directory
 
 @item Configure glpk for "i686-pc-mingw32":
 
@@ -1781,7 +1780,7 @@ $ make install
 This document is a @b{DEPRECATED} installation guide for GNUnet on
 Windows.
 It will not work for recent GNUnet versions, but maybe it will be of
-some use if problems arise. 
+some use if problems arise.
 
 The Windows build uses a UNIX emulator for Windows,
 @uref{http://www.mingw.org/, MinGW}, to build the executable modules.
@@ -1799,7 +1798,7 @@ We regret any inconvenience, and if you have problems, please report them.
 * Installer::
 * Source::
 @end menu
-     
+
 @node Hardware and OS requirements
 @subsubsection Hardware and OS requirements
 
@@ -1878,7 +1877,7 @@ This batch file opens a shell which is used to invoke the build
 processes.
 MinGW's standard shell (@command{msys.bat}) is not suitable
 because it opens a separate console window.
-On Vista, @command{bash.bat} needs to be run as Administrator. 
+On Vista, @command{bash.bat} needs to be run as Administrator.
 
 @item
 Start @command{bash.sh} and rename
@@ -1948,7 +1947,7 @@ directory (@file{c:\mingw\mingw}).
 
 @item @strong{SQLite}@
 GNUnet uses the SQLite database to store data.
-Get the prebuilt binary from here and unpack it to your MinGW directory. 
+Get the prebuilt binary from here and unpack it to your MinGW directory.
 
 @item @strong{MySQL}@
 As an alternative to SQLite, GNUnet also supports MySQL.
@@ -1984,7 +1983,7 @@ dlltool --input-def ../include/libmySQL.def \
 --output-lib libmysqlclient.a -k
 @end example
 
-@item  Copy include\* to include\mysql\ 
+@item  Copy include\* to include\mysql\
 
 @item  Pass @code{--with-mysql=/c/mysql} to
 @command{./configure} and copy @file{libmysql.dll}
@@ -2082,7 +2081,7 @@ debug information and are quite large. To compile release versions
 (small and fast) set the variable @code{CFLAGS}:
 
 @example
-export CFLAGS='-O2 -march=pentium -fomit-frame-pointer' 
+export CFLAGS='-O2 -march=pentium -fomit-frame-pointer'
 ./configure --prefix=$HOME --with-extractor=$HOME
 @end example
 
@@ -2097,7 +2096,7 @@ located in @file{contrib\win} in the GNUnet source tree.
 @subsubsection Source
 
 @c FIXME: URL
-The sources of all dependencies are available here. 
+The sources of all dependencies are available here.
 
 @c @node Portable GNUnet
 @c @section Portable GNUnet
@@ -2372,7 +2371,7 @@ The hostlist client supports the following proxy types at the moment:
 @end itemize
 
 In addition authentication at the proxy with username and password can be
-configured. 
+configured.
 
 To configure proxy support for the hostlist client in the
 @command{gnunet-setup} tool, select the "hostlist" tab and select
@@ -2521,7 +2520,7 @@ inconsistencies. Some of the other databases do not support repair.
 @item Access mysql as root:
 
 @example
-$ mysql -u root -p 
+$ mysql -u root -p
 @end example
 
 @noindent
@@ -3324,19 +3323,6 @@ steps.
 First of all, GNS needs to be integrated with the operating system. Most
 of this section is about the operating system level integration.
 
-Additionally, each individual user who wants to use the system must also
-initialize their GNS zones. This can be done by running (after starting
-GNUnet)
-
-@example
-$ gnunet-gns-import.sh
-@end example
-
-@noindent
-after the local GNUnet peer has been started. Note that the namestore (in
-particular the namestore database backend) should not be reconfigured
-afterwards (as records are not automatically migrated between backends).
-
 The remainder of this chapter will detail the various methods for
 configuring the use of GNS with your operating system.
 
@@ -3528,7 +3514,7 @@ gnurl --version
 curl 7.56.0 (x86_64-unknown-linux-gnu) libcurl/7.56.0 \
 GnuTLS/3.5.13 zlib/1.2.11 libidn2/2.0.4
 Release-Date: 2017-10-08
-Protocols: http https 
+Protocols: http https
 Features: AsynchDNS IDN IPv6 Largefile NTLM SSL libz \
 TLS-SRP UnixSockets HTTPS-proxy
 @end example
@@ -4125,4 +4111,3 @@ Furthermore, 'make install' will silently fail to set the DNS binaries to
 be owned by group "gnunetdns" unless that group already exists (!).
 An alternative name for the "gnunetdns" group can be specified using the
 @code{--with-gnunetdns=GRPNAME} configure option.
-
diff --git a/doc/man/Makefile.am b/doc/man/Makefile.am
index c40363b59..a6a116dca 100644
--- a/doc/man/Makefile.am
+++ b/doc/man/Makefile.am
@@ -17,7 +17,6 @@ man_MANS = \
   gnunet-ecc.1 \
   gnunet-fs.1 \
   gnunet-gns.1 \
-  gnunet-gns-import.1 \
   gnunet-gns-proxy.1 \
   gnunet-identity.1 \
   gnunet-cadet.1 \
@@ -42,6 +41,7 @@ man_MANS = \
   gnunet-transport-certificate-creation.1 \
   gnunet-unindex.1 \
   gnunet-uri.1 \
-  gnunet-vpn.1
+  gnunet-vpn.1 \
+  gnunet-zoneimport.1
 
 EXTRA_DIST = ${man_MANS}
diff --git a/doc/man/gnunet-fs.1 b/doc/man/gnunet-fs.1
index 53a900b46..65f104d61 100644
--- a/doc/man/gnunet-fs.1
+++ b/doc/man/gnunet-fs.1
@@ -29,10 +29,9 @@ print the version number
 \fB\-V\fR, \fB\-\-verbose\fR
 be verbose
 
-.SH NOTES
 
-
-.SH "REPORTING BUGS"
+.SH BUGS
 Report bugs by using mantis <https://gnunet.org/bugs/> or by sending electronic mail to <gnunet\-developers@gnu.org>
-.SH "SEE ALSO"
+
+.SH SEE ALSO
 \fBgnunet\-publish\fP(1)
diff --git a/doc/man/gnunet-gns-import.1 b/doc/man/gnunet-gns-import.1
deleted file mode 100644
index f90f7f375..000000000
--- a/doc/man/gnunet-gns-import.1
+++ /dev/null
@@ -1,17 +0,0 @@
-.TH GNUNET\-GNS\-IMPORT 1 "Jan 31, 2014" "GNUnet"
-
-.SH NAME
-gnunet\-gns\-import \- import some GNS authorities into your GNS namestore
-
-.SH SYNOPSIS
-.B gnunet\-gns\-import
-.br
-
-.SH DESCRIPTION
-\fBgnunet\-gns\-import\fP calls gnunet-namestore to fetch some GNS authorities into your GNS namestore.
-
-.SH BUGS
-Report bugs by using Mantis <https://gnunet.org/bugs/> or by sending electronic mail to <gnunet\-developers@gnu.org>
-
-.SH SEE ALSO
-gnunet\-gns(1), gnunet\-namestore(1)
diff --git a/doc/man/gnunet-namestore-fcfsd.1 b/doc/man/gnunet-namestore-fcfsd.1
index 3160910d4..8039e796f 100644
--- a/doc/man/gnunet-namestore-fcfsd.1
+++ b/doc/man/gnunet-namestore-fcfsd.1
@@ -13,7 +13,7 @@ Most users will not want to run an FCFS\-zone and thus will not need this progra
 
 \fBgnunet\-gns-fcfsd\fP runs a web server where users can register names to be mapped to their GNS zone.  Names are made available on a First Come First Served basis (hence fcfs).  Registered names do not expire.  The HTTP server is run on the port that is specified in the configuration file in section "[fcfsd]" under the name "HTTPPORT".  The key of the zone in which the names are registered must be specified under the name "ZONEKEY" in the same section.  It is possible to manage gnunet\-gns\-fcfsd using gnunet\-(service\-arm) by starting the daemon using "gnunet\-arm \-i fcfsd" or by setting "FORCESTART=YES" in the "fcfds" section of your configuration.
 
-An FCFS\-zone is run at http://gnunet.org/fcfs/.  The respective zone key can be imported into an individual user's zone using "gnunet-gns-import.sh".  GNS users are encouraged to register their zone with the gnunet.org FCFS authority.
+An FCFS\-zone is run at http://gnunet.org/fcfs/.  GNS users are encouraged to register their zone with the gnunet.org FCFS authority.
 
 If you want to run your own FCFS registrar, you need to first create a pseudonym (using "gnunet\-identity \-C NAME"), and then assign it to be used for the "fcfsd" service using "gnunet\-identity \-e NAME \-s fcfsd".  After that, you can start the FCFSD service (possibly using gnunet\-arm).
 
diff --git a/doc/man/gnunet-zoneimport.1 b/doc/man/gnunet-zoneimport.1
new file mode 100644
index 000000000..06b3a6bcf
--- /dev/null
+++ b/doc/man/gnunet-zoneimport.1
@@ -0,0 +1,47 @@
+.TH GNUNET\-ZONEIMPORT 1 "Apr 23, 2018" "GNUnet"
+
+.SH NAME
+gnunet\-zoneimport \- import DNS zone into GNS zone
+
+.SH SYNOPSIS
+.B gnunet\-zoneimport [IP]+
+.br
+
+.SH DESCRIPTION
+\fBgnunet\-zoneimport\fP reads a list of domain names (FQDN) from stdin and issues DNS queries for each of the domain names given.  It then checks if a local ego with a name matching the domain exists. Specifically, if the domain name is "example.fr", it will check if an ego "fr" exists, while for a domain "example.com.fr" it will look for an ego called "com.fr"). If so, it will convert the DNS records into GNS records (in particular converting NS records and glue records to GNS2DNS records) and add them to the namestore under the label ("example" in the examples above).
+
+The arguments given to gnunet\-zoneimport is a list of IP addresses of DNS servers to query.
+
+gnunet\-zoneimport will usually never terminate: it will check when DNS records expire, and re-issue requests when the old DNS records have expired so that GNS always has the latest data.
+
+gnunet\-zoneimport will issue many DNS queries in parallel, but is rate-limited in various ways, so most DNS servers should easily handle the load.  gnunet\-zoneimport will perform a limited number of retries if queries fail.
+
+gnunet\-zoneimport operates incrementally. It will check if the namestore already has (non-expired) records stored for a given name in the respective zone and not issue those requests again.  Thus, it is fine to restart gnunet\-zoneimport whenever the list of domain names changes.
+
+Finally, gnunet\-zoneimport keeps information for each domain name in memory.  This consumes about 200 bytes per domain name, or 1 GB for 5 million labels.
+
+.SH OPTIONS
+.B
+.IP "\-c FILENAME,  \-\-config=FILENAME"
+Use the configuration file FILENAME.
+.B
+.IP "\-h, \-\-help"
+Print short help on options.
+.B
+.IP "\-s MAPSIZE, \-\-size=MAPSIZE"
+Specifies the size (in number of entries) to use for the main hash map.  The value provided should be at least twice the number of domain names that will be given to the tool. This option is required for very large zones where the number of records encountered is too large for the automatic growth mechanism to work (that one is limited to at most 16 MB allocations for security reasons).  Do not worry about this unless you are importing millions of domain names from a zone.
+
+.SH NOTES
+
+Typical invocaton would be:
+
+$ gnunet\-zoneimport 1.2.3.4 < names.txt
+
+
+
+
+.SH BUGS
+Report bugs by using Mantis <https://gnunet.org/bugs/> or by sending electronic mail to <gnunet\-developers@gnu.org>
+
+.SH SEE ALSO
+gnunet\-gns(1), gnunet\-namestore(1)
diff --git a/src/credential/gnunet-service-credential.c b/src/credential/gnunet-service-credential.c
index a2c339363..399371a2e 100644
--- a/src/credential/gnunet-service-credential.c
+++ b/src/credential/gnunet-service-credential.c
@@ -961,9 +961,11 @@ collect_next (void *cls)
   struct VerifyRequestHandle *vrh = cls;
   vrh->collect_next_task = NULL;
   GNUNET_assert (NULL != vrh->cred_collection_iter);
-  GNUNET_NAMESTORE_zone_iterator_next (vrh->cred_collection_iter);
+  GNUNET_NAMESTORE_zone_iterator_next (vrh->cred_collection_iter,
+                                       1);
 }
 
+
 static void
 handle_cred_collection_cb (void *cls,
                            const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
diff --git a/src/dht/dht.h b/src/dht/dht.h
index 4c994f93a..95ffa33ca 100644
--- a/src/dht/dht.h
+++ b/src/dht/dht.h
@@ -214,11 +214,6 @@ struct GNUNET_DHT_ClientPutMessage
   uint32_t desired_replication_level GNUNET_PACKED;
 
   /**
-   * Unique ID for the PUT message.
-   */
-  uint64_t unique_id GNUNET_PACKED;
-
-  /**
    * How long should this data persist?
    */
   struct GNUNET_TIME_AbsoluteNBO expiration;
@@ -234,30 +229,6 @@ struct GNUNET_DHT_ClientPutMessage
 
 
 /**
- * Message to confirming receipt of PUT, sent from DHT service to clients.
- */
-struct GNUNET_DHT_ClientPutConfirmationMessage
-{
-  /**
-   * Type: #GNUNET_MESSAGE_TYPE_DHT_CLIENT_PUT_OK
-   */
-  struct GNUNET_MessageHeader header;
-
-  /**
-   * Always zero.
-   */
-  uint32_t reserved GNUNET_PACKED;
-
-  /**
-   * Unique ID from the PUT message that is being confirmed.
-   */
-  uint64_t unique_id GNUNET_PACKED;
-
-};
-
-
-
-/**
  * Message to monitor put requests going through peer, DHT service -> clients.
  */
 struct GNUNET_DHT_MonitorPutMessage
diff --git a/src/dht/dht_api.c b/src/dht/dht_api.c
index 42ddc7b60..af0dafbf3 100644
--- a/src/dht/dht_api.c
+++ b/src/dht/dht_api.c
@@ -55,7 +55,7 @@ struct GNUNET_DHT_PutHandle
   /**
    * Continuation to call when done.
    */
-  GNUNET_DHT_PutContinuation cont;
+  GNUNET_SCHEDULER_TaskCallback cont;
 
   /**
    * Main handle to this DHT api
@@ -68,9 +68,9 @@ struct GNUNET_DHT_PutHandle
   void *cont_cls;
 
   /**
-   * Unique ID for the PUT operation.
+   * Envelope from the PUT operation.
    */
-  uint64_t unique_id;
+  struct GNUNET_MQ_Envelope *env;
 
 };
 
@@ -440,7 +440,7 @@ static void
 do_disconnect (struct GNUNET_DHT_Handle *h)
 {
   struct GNUNET_DHT_PutHandle *ph;
-  GNUNET_DHT_PutContinuation cont;
+  GNUNET_SCHEDULER_TaskCallback cont;
   void *cont_cls;
 
   if (NULL == h->mq)
@@ -456,10 +456,10 @@ do_disconnect (struct GNUNET_DHT_Handle *h)
   {
     cont = ph->cont;
     cont_cls = ph->cont_cls;
+    ph->env = NULL;
     GNUNET_DHT_put_cancel (ph);
     if (NULL != cont)
-      cont (cont_cls,
-            GNUNET_SYSERR);
+      cont (cont_cls);
   }
   GNUNET_assert (NULL == h->reconnect_task);
   h->reconnect_task
@@ -818,31 +818,23 @@ handle_client_result (void *cls,
 
 
 /**
- * Process a put confirmation message from the service.
+ * Process a MQ PUT transmission notification.
  *
  * @param cls The DHT handle.
- * @param msg confirmation message from the service.
  */
 static void
-handle_put_confirmation (void *cls,
-                         const struct GNUNET_DHT_ClientPutConfirmationMessage *msg)
+handle_put_cont (void *cls)
 {
-  struct GNUNET_DHT_Handle *handle = cls;
-  struct GNUNET_DHT_PutHandle *ph;
-  GNUNET_DHT_PutContinuation cont;
+  struct GNUNET_DHT_PutHandle *ph = cls;
+  GNUNET_SCHEDULER_TaskCallback cont;
   void *cont_cls;
 
-  for (ph = handle->put_head; NULL != ph; ph = ph->next)
-    if (ph->unique_id == msg->unique_id)
-      break;
-  if (NULL == ph)
-    return;
   cont = ph->cont;
   cont_cls = ph->cont_cls;
+  ph->env = NULL;
   GNUNET_DHT_put_cancel (ph);
   if (NULL != cont)
-    cont (cont_cls,
-          GNUNET_OK);
+    cont (cont_cls);
 }
 
 
@@ -872,10 +864,6 @@ try_connect (struct GNUNET_DHT_Handle *h)
                            GNUNET_MESSAGE_TYPE_DHT_CLIENT_RESULT,
                            struct GNUNET_DHT_ClientResultMessage,
                            h),
-    GNUNET_MQ_hd_fixed_size (put_confirmation,
-                             GNUNET_MESSAGE_TYPE_DHT_CLIENT_PUT_OK,
-                             struct GNUNET_DHT_ClientPutConfirmationMessage,
-                             h),
     GNUNET_MQ_handler_end ()
   };
   if (NULL != h->mq)
@@ -941,8 +929,7 @@ GNUNET_DHT_disconnect (struct GNUNET_DHT_Handle *handle)
   while (NULL != (ph = handle->put_head))
   {
     if (NULL != ph->cont)
-      ph->cont (ph->cont_cls,
-                GNUNET_SYSERR);
+      ph->cont (ph->cont_cls);
     GNUNET_DHT_put_cancel (ph);
   }
   if (NULL != handle->mq)
@@ -989,7 +976,7 @@ GNUNET_DHT_put (struct GNUNET_DHT_Handle *handle,
                 size_t size,
                 const void *data,
                 struct GNUNET_TIME_Absolute exp,
-                GNUNET_DHT_PutContinuation cont,
+                GNUNET_SCHEDULER_TaskCallback cont,
                 void *cont_cls)
 {
   struct GNUNET_MQ_Envelope *env;
@@ -1014,22 +1001,24 @@ GNUNET_DHT_put (struct GNUNET_DHT_Handle *handle,
   ph->dht_handle = handle;
   ph->cont = cont;
   ph->cont_cls = cont_cls;
-  ph->unique_id = ++handle->uid_gen;
   GNUNET_CONTAINER_DLL_insert_tail (handle->put_head,
                                     handle->put_tail,
                                     ph);
   env = GNUNET_MQ_msg_extra (put_msg,
                              size,
                              GNUNET_MESSAGE_TYPE_DHT_CLIENT_PUT);
+  GNUNET_MQ_notify_sent (env,
+                         &handle_put_cont,
+                         ph);
+  ph->env = env;
   put_msg->type = htonl ((uint32_t) type);
   put_msg->options = htonl ((uint32_t) options);
   put_msg->desired_replication_level = htonl (desired_replication_level);
-  put_msg->unique_id = ph->unique_id;
   put_msg->expiration = GNUNET_TIME_absolute_hton (exp);
   put_msg->key = *key;
   GNUNET_memcpy (&put_msg[1],
-          data,
-          size);
+                 data,
+                 size);
   GNUNET_MQ_send (handle->mq,
                   env);
   return ph;
@@ -1052,6 +1041,10 @@ GNUNET_DHT_put_cancel (struct GNUNET_DHT_PutHandle *ph)
 {
   struct GNUNET_DHT_Handle *handle = ph->dht_handle;
 
+  if (NULL != ph->env)
+    GNUNET_MQ_notify_sent (ph->env,
+                           NULL,
+                           NULL);
   GNUNET_CONTAINER_DLL_remove (handle->put_head,
                                handle->put_tail,
                                ph);
diff --git a/src/dht/dht_test_lib.c b/src/dht/dht_test_lib.c
index 4c1bd3057..52d5a3731 100644
--- a/src/dht/dht_test_lib.c
+++ b/src/dht/dht_test_lib.c
@@ -114,7 +114,6 @@ dht_connect_cb (void *cls,
                 const char *emsg)
 {
   struct GNUNET_DHT_TEST_Context *ctx = cls;
-  unsigned int i;
 
   if (NULL != emsg)
   {
@@ -124,10 +123,10 @@ dht_connect_cb (void *cls,
     GNUNET_SCHEDULER_shutdown ();
     return;
   }
-  for (i=0;i<ctx->num_peers;i++)
+  for (unsigned int i=0;i<ctx->num_peers;i++)
     if (op == ctx->ops[i])
       ctx->dhts[i] = ca_result;
-  for (i=0;i<ctx->num_peers;i++)
+  for (unsigned int i=0;i<ctx->num_peers;i++)
     if (NULL == ctx->dhts[i])
       return; /* still some DHT connections missing */
   /* all DHT connections ready! */
@@ -147,9 +146,7 @@ dht_connect_cb (void *cls,
 void
 GNUNET_DHT_TEST_cleanup (struct GNUNET_DHT_TEST_Context *ctx)
 {
-  unsigned int i;
-
-  for (i=0;i<ctx->num_peers;i++)
+  for (unsigned int i=0;i<ctx->num_peers;i++)
     GNUNET_TESTBED_operation_done (ctx->ops[i]);
   GNUNET_free (ctx->ops);
   GNUNET_free (ctx->dhts);
@@ -160,18 +157,17 @@ GNUNET_DHT_TEST_cleanup (struct GNUNET_DHT_TEST_Context *ctx)
 
 static void
 dht_test_run (void *cls,
-             struct GNUNET_TESTBED_RunHandle *h,
+              struct GNUNET_TESTBED_RunHandle *h,
               unsigned int num_peers,
               struct GNUNET_TESTBED_Peer **peers,
               unsigned int links_succeeded,
               unsigned int links_failed)
 {
   struct GNUNET_DHT_TEST_Context *ctx = cls;
-  unsigned int i;
 
   GNUNET_assert (num_peers == ctx->num_peers);
   ctx->peers = peers;
-  for (i=0;i<num_peers;i++)
+  for (unsigned int i=0;i<num_peers;i++)
     ctx->ops[i] = GNUNET_TESTBED_service_connect (ctx,
                                                   peers[i],
                                                   "dht",
diff --git a/src/dht/gnunet-dht-put.c b/src/dht/gnunet-dht-put.c
index f183fe588..db4d04681 100644
--- a/src/dht/gnunet-dht-put.c
+++ b/src/dht/gnunet-dht-put.c
@@ -103,34 +103,12 @@ shutdown_task (void *cls)
  * Signature of the main function of a task.
  *
  * @param cls closure
- * @param success #GNUNET_OK if the PUT was transmitted,
- *                #GNUNET_NO on timeout,
- *                #GNUNET_SYSERR on disconnect from service
- *                after the PUT message was transmitted
- *                (so we don't know if it was received or not)
  */
 static void
-message_sent_cont (void *cls, int success)
+message_sent_cont (void *cls)
 {
-  if (verbose)
-  {
-    switch (success)
-    {
-    case GNUNET_OK:
-      FPRINTF (stderr, "%s `%s'!\n",  _("PUT request sent with key"), GNUNET_h2s_full(&key));
-      break;
-    case GNUNET_NO:
-      FPRINTF (stderr, "%s",  _("Timeout sending PUT request!\n"));
-      break;
-    case GNUNET_SYSERR:
-      FPRINTF (stderr, "%s",  _("PUT request not confirmed!\n"));
-      break;
-    default:
-      GNUNET_break (0);
-      break;
-    }
-  }
-  GNUNET_SCHEDULER_add_now (&shutdown_task, NULL);
+  GNUNET_SCHEDULER_add_now (&shutdown_task,
+                            NULL);
 }
 
 
@@ -160,7 +138,8 @@ run (void *cls,
 
   if (NULL == (dht_handle = GNUNET_DHT_connect (cfg, 1)))
   {
-    FPRINTF (stderr, _("Could not connect to %s service!\n"), "DHT");
+    FPRINTF (stderr,
+             _("Could not connect to DHT service!\n"));
     ret = 1;
     return;
   }
@@ -203,55 +182,47 @@ main (int argc, char *const *argv)
 {
 
   struct GNUNET_GETOPT_CommandLineOption options[] = {
-  
     GNUNET_GETOPT_option_string ('d',
                                  "data",
                                  "DATA",
                                  gettext_noop ("the data to insert under the key"),
                                  &data),
-  
     GNUNET_GETOPT_option_relative_time ('e',
-                                            "expiration",
-                                            "EXPIRATION",
-                                            gettext_noop ("how long to store this entry in the dht (in seconds)"),
-                                            &expiration),
-  
+                                        "expiration",
+                                        "EXPIRATION",
+                                        gettext_noop ("how long to store this entry in the dht (in seconds)"),
+                                        &expiration),
     GNUNET_GETOPT_option_string ('k',
                                  "key",
                                  "KEY",
                                  gettext_noop ("the query key"),
                                  &query_key),
-  
     GNUNET_GETOPT_option_flag ('x',
-                                  "demultiplex",
-                                  gettext_noop ("use DHT's demultiplex everywhere option"),
-                                  &demultixplex_everywhere),
-  
+                               "demultiplex",
+                               gettext_noop ("use DHT's demultiplex everywhere option"),
+                               &demultixplex_everywhere),
     GNUNET_GETOPT_option_uint ('r',
-                                   "replication",
-                                   "LEVEL",
-                                   gettext_noop ("how many replicas to create"),
-                                   &replication),
-  
+                               "replication",
+                               "LEVEL",
+                               gettext_noop ("how many replicas to create"),
+                               &replication),
     GNUNET_GETOPT_option_flag ('R',
-                                  "record",
-                                  gettext_noop ("use DHT's record route option"),
-                                  &record_route),
-  
+                               "record",
+                               gettext_noop ("use DHT's record route option"),
+                               &record_route),
     GNUNET_GETOPT_option_uint ('t',
-                                   "type",
-                                   "TYPE",
-                                   gettext_noop ("the type to insert data as"),
-                                   &query_type),
-  
+                               "type",
+                               "TYPE",
+                               gettext_noop ("the type to insert data as"),
+                               &query_type),
     GNUNET_GETOPT_option_verbose (&verbose),
-  
     GNUNET_GETOPT_OPTION_END
   };
 
 
-  if (GNUNET_OK != GNUNET_STRINGS_get_utf8_args (argc, argv,
-                                                 &argc, &argv))
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_get_utf8_args (argc, argv,
+                                    &argc, &argv))
     return 2;
   expiration = GNUNET_TIME_UNIT_HOURS;
   return (GNUNET_OK ==
diff --git a/src/dht/gnunet-service-dht_clients.c b/src/dht/gnunet-service-dht_clients.c
index cb155c484..503d7867b 100644
--- a/src/dht/gnunet-service-dht_clients.c
+++ b/src/dht/gnunet-service-dht_clients.c
@@ -477,8 +477,6 @@ handle_dht_local_put (void *cls,
   struct ClientHandle *ch = cls;
   struct GNUNET_CONTAINER_BloomFilter *peer_bf;
   uint16_t size;
-  struct GNUNET_MQ_Envelope *env;
-  struct GNUNET_DHT_ClientPutConfirmationMessage *conf;
 
   size = ntohs (dht_msg->header.size);
   GNUNET_STATISTICS_update (GDS_stats,
@@ -537,12 +535,6 @@ handle_dht_local_put (void *cls,
                            &dht_msg[1],
                            size - sizeof (struct GNUNET_DHT_ClientPutMessage));
   GNUNET_CONTAINER_bloomfilter_free (peer_bf);
-  env = GNUNET_MQ_msg (conf,
-                       GNUNET_MESSAGE_TYPE_DHT_CLIENT_PUT_OK);
-  conf->reserved = htonl (0);
-  conf->unique_id = dht_msg->unique_id;
-  GNUNET_MQ_send (ch->mq,
-                  env);
   GNUNET_SERVICE_client_continue (ch->client);
 }
 
diff --git a/src/dht/test_dht_api.c b/src/dht/test_dht_api.c
index 8f4e0ed31..62d121306 100644
--- a/src/dht/test_dht_api.c
+++ b/src/dht/test_dht_api.c
@@ -105,11 +105,9 @@ test_get_iterator (void *cls,
  * Signature of the main function of a task.
  *
  * @param cls closure
- * @param success result of PUT
  */
 static void
-test_get (void *cls,
-          int success)
+test_get (void *cls)
 {
   struct GNUNET_HashCode hash;
 
diff --git a/src/dht/test_dht_topo.c b/src/dht/test_dht_topo.c
index 8be3064f7..79edb2b0c 100644
--- a/src/dht/test_dht_topo.c
+++ b/src/dht/test_dht_topo.c
@@ -332,19 +332,17 @@ dht_get_handler (void *cls,
               "Get successful\n");
 #if 0
   {
-    int i;
-
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "PATH: (get %u, put %u)\n",
                 get_path_length,
                 put_path_length);
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "  LOCAL\n");
-    for (i = get_path_length - 1; i >= 0; i--)
+    for (int i = get_path_length - 1; i >= 0; i--)
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                   "  %s\n",
                   GNUNET_i2s (&get_path[i]));
-    for (i = put_path_length - 1; i >= 0; i--)
+    for (int i = put_path_length - 1; i >= 0; i--)
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                   "  %s\n",
                   GNUNET_i2s (&put_path[i]));
@@ -384,12 +382,11 @@ do_puts (void *cls)
   struct GNUNET_DHT_Handle **hs = cls;
   struct GNUNET_HashCode key;
   struct GNUNET_HashCode value;
-  unsigned int i;
 
   put_task = NULL;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Putting values into DHT\n");
-  for (i = 0; i < NUM_PEERS; i++)
+  for (unsigned int i = 0; i < NUM_PEERS; i++)
   {
     GNUNET_CRYPTO_hash (&i,
                         sizeof (i),
diff --git a/src/dns/dnsstub.c b/src/dns/dnsstub.c
index 6aa2d7b8f..6eb3612c2 100644
--- a/src/dns/dnsstub.c
+++ b/src/dns/dnsstub.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2012 GNUnet e.V.
+     Copyright (C) 2012, 2018 GNUnet e.V.
 
      GNUnet is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
@@ -28,20 +28,15 @@
 #include "gnunet_dnsstub_lib.h"
 
 /**
- * Timeout for an external (Internet-DNS) DNS resolution
- */
-#define REQUEST_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 5)
-
-/**
  * Timeout for retrying DNS queries.
  */
 #define DNS_RETRANSMIT_DELAY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MILLISECONDS, 250)
 
+
 /**
- * How many DNS sockets do we open at most at the same time?
- * (technical socket maximum is this number x2 for IPv4+IPv6)
+ * DNS Server used for resolution.
  */
-#define DNS_SOCKET_MAX 128
+struct DnsServer;
 
 
 /**
@@ -81,19 +76,14 @@ struct GNUNET_DNSSTUB_RequestSocket
   struct GNUNET_SCHEDULER_Task *retry_task;
 
   /**
-   * When should this request time out?
-   */
-  struct GNUNET_TIME_Absolute timeout;
-
-  /**
-   * Address we sent the DNS request to.
+   * Next address we sent the DNS request to.
    */
-  struct sockaddr_storage addr;
+  struct DnsServer *ds_pos;
 
   /**
-   * Number of bytes in @e addr.
+   * Context this request executes in.
    */
-  socklen_t addrlen;
+  struct GNUNET_DNSSTUB_Context *ctx;
 
   /**
    * Query we sent to @e addr.
@@ -109,6 +99,29 @@ struct GNUNET_DNSSTUB_RequestSocket
 
 
 /**
+ * DNS Server used for resolution.
+ */
+struct DnsServer
+{
+
+  /**
+   * Kept in a DLL.
+   */
+  struct DnsServer *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct DnsServer *prev;
+
+  /**
+   * IP address of the DNS resolver.
+   */
+  struct sockaddr_storage ss;
+};
+
+
+/**
  * Handle to the stub resolver.
  */
 struct GNUNET_DNSSTUB_Context
@@ -117,13 +130,28 @@ struct GNUNET_DNSSTUB_Context
   /**
    * Array of all open sockets for DNS requests.
    */
-  struct GNUNET_DNSSTUB_RequestSocket sockets[DNS_SOCKET_MAX];
+  struct GNUNET_DNSSTUB_RequestSocket *sockets;
+
+  /**
+   * DLL of DNS resolvers we use.
+   */
+  struct DnsServer *dns_head;
+
+  /**
+   * DLL of DNS resolvers we use.
+   */
+  struct DnsServer *dns_tail;
+
+  /**
+   * How frequently do we retry requests?
+   */
+  struct GNUNET_TIME_Relative retry_freq;
 
   /**
-   * IP address to use for the DNS server if we are a DNS exit service
-   * (for VPN via cadet); otherwise NULL.
+   * Length of @e sockets array.
    */
-  char *dns_exit;
+  unsigned int num_sockets;
+
 };
 
 
@@ -212,33 +240,21 @@ open_socket (int af)
 
 
 /**
- * Read a DNS response from the (unhindered) UDP-Socket
- *
- * @param cls socket to read from
- */
-static void
-read_response (void *cls);
-
-
-/**
  * Get a socket of the specified address family to send out a
  * UDP DNS request to the Internet.
  *
  * @param ctx the DNSSTUB context
- * @param af desired address family
- * @return NULL on error (given AF not "supported")
+ * @return NULL on error
  */
 static struct GNUNET_DNSSTUB_RequestSocket *
-get_request_socket (struct GNUNET_DNSSTUB_Context *ctx,
-                    int af)
+get_request_socket (struct GNUNET_DNSSTUB_Context *ctx)
 {
   struct GNUNET_DNSSTUB_RequestSocket *rs;
-  struct GNUNET_NETWORK_FDSet *rset;
 
   for (unsigned int i=0;i<256;i++)
   {
     rs = &ctx->sockets[GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE,
-                                                 DNS_SOCKET_MAX)];
+                                                 ctx->num_sockets)];
     if (NULL == rs->rc)
       break;
   }
@@ -246,25 +262,10 @@ get_request_socket (struct GNUNET_DNSSTUB_Context *ctx,
   {
     /* signal "failure" */
     rs->rc (rs->rc_cls,
-            rs,
             NULL,
             0);
     rs->rc = NULL;
   }
-  rs->timeout = GNUNET_TIME_relative_to_absolute (REQUEST_TIMEOUT);
-  switch (af)
-  {
-  case AF_INET:
-    if (NULL == rs->dnsout4)
-      rs->dnsout4 = open_socket (AF_INET);
-    break;
-  case AF_INET6:
-    if (NULL == rs->dnsout6)
-      rs->dnsout6 = open_socket (AF_INET6);
-    break;
-  default:
-    return NULL;
-  }
   if (NULL != rs->read_task)
   {
     GNUNET_SCHEDULER_cancel (rs->read_task);
@@ -280,194 +281,7 @@ get_request_socket (struct GNUNET_DNSSTUB_Context *ctx,
     GNUNET_free (rs->request);
     rs->request = NULL;
   }
-  if ( (NULL == rs->dnsout4) &&
-       (NULL == rs->dnsout6) )
-    return NULL;
-  rset = GNUNET_NETWORK_fdset_create ();
-  if (NULL != rs->dnsout4)
-    GNUNET_NETWORK_fdset_set (rset,
-                              rs->dnsout4);
-  if (NULL != rs->dnsout6)
-    GNUNET_NETWORK_fdset_set (rset,
-                              rs->dnsout6);
-  rs->read_task = GNUNET_SCHEDULER_add_select (GNUNET_SCHEDULER_PRIORITY_DEFAULT,
-                                               REQUEST_TIMEOUT,
-                                               rset,
-                                               NULL,
-                                               &read_response,
-                                               rs);
-  GNUNET_NETWORK_fdset_destroy (rset);
-  return rs;
-}
-
-
-/**
- * Task to (re)transmit the DNS query, possibly repeatedly until
- * we succeed.
- *
- * @param cls our `struct GNUNET_DNSSTUB_RequestSocket *`
- */
-static void
-transmit_query (void *cls)
-{
-  struct GNUNET_DNSSTUB_RequestSocket *rs = cls;
-  struct GNUNET_NETWORK_Handle *ret;
-
-  rs->retry_task = NULL;
-  ret = (NULL != rs->dnsout4) ? rs->dnsout4 : rs->dnsout6;
-  GNUNET_assert (NULL != ret);
-  if (GNUNET_SYSERR ==
-      GNUNET_NETWORK_socket_sendto (ret,
-                                    rs->request,
-                                    rs->request_len,
-                                    (struct sockaddr *) &rs->addr,
-                                    rs->addrlen))
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                _("Failed to send DNS request to %s\n"),
-                GNUNET_a2s ((struct sockaddr *) &rs->addr,
-                            rs->addrlen));
-  else
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                _("Sent DNS request to %s\n"),
-                GNUNET_a2s ((struct sockaddr *) &rs->addr,
-                            rs->addrlen));
-  rs->retry_task = GNUNET_SCHEDULER_add_delayed (DNS_RETRANSMIT_DELAY,
-                                                 &transmit_query,
-                                                 rs);
-}
-
-
-/**
- * Perform DNS resolution.
- *
- * @param ctx stub resolver to use
- * @param sa the socket address
- * @param sa_len the length of @a sa
- * @param request DNS request to transmit
- * @param request_len number of bytes in @a request
- * @param rc function to call with result
- * @param rc_cls closure for @a rc
- * @return socket used for the request, NULL on error
- */
-struct GNUNET_DNSSTUB_RequestSocket *
-GNUNET_DNSSTUB_resolve (struct GNUNET_DNSSTUB_Context *ctx,
-                        const struct sockaddr *sa,
-                        socklen_t sa_len,
-                        const void *request,
-                        size_t request_len,
-                        GNUNET_DNSSTUB_ResultCallback rc,
-                        void *rc_cls)
-{
-  struct GNUNET_DNSSTUB_RequestSocket *rs;
-
-  if (NULL == (rs = get_request_socket (ctx,
-                                        sa->sa_family)))
-    return NULL;
-  GNUNET_assert (NULL == rs->rc);
-  GNUNET_memcpy (&rs->addr,
-                 sa,
-                 sa_len);
-  rs->addrlen = sa_len;
-  rs->rc = rc;
-  rs->rc_cls = rc_cls;
-  rs->request = GNUNET_memdup (request,
-                               request_len);
-  rs->request_len = request_len;
-  rs->retry_task = GNUNET_SCHEDULER_add_now (&transmit_query,
-                                             rs);
-  return rs;
-}
-
-
-/**
- * Perform DNS resolution using our default IP from init.
- *
- * @param ctx stub resolver to use
- * @param request DNS request to transmit
- * @param request_len number of bytes in msg
- * @param rc function to call with result
- * @param rc_cls closure for 'rc'
- * @return socket used for the request, NULL on error
- */
-struct GNUNET_DNSSTUB_RequestSocket *
-GNUNET_DNSSTUB_resolve2 (struct GNUNET_DNSSTUB_Context *ctx,
-                         const void *request,
-                         size_t request_len,
-                         GNUNET_DNSSTUB_ResultCallback rc,
-                         void *rc_cls)
-{
-  int af;
-  struct sockaddr_in v4;
-  struct sockaddr_in6 v6;
-  struct sockaddr *sa;
-  socklen_t salen;
-  struct GNUNET_NETWORK_Handle *dnsout;
-  struct GNUNET_DNSSTUB_RequestSocket *rs;
-
-  memset (&v4, 0, sizeof (v4));
-  memset (&v6, 0, sizeof (v6));
-  if (1 == inet_pton (AF_INET,
-                      ctx->dns_exit,
-                      &v4.sin_addr))
-  {
-    salen = sizeof (v4);
-    v4.sin_family = AF_INET;
-    v4.sin_port = htons (53);
-#if HAVE_SOCKADDR_IN_SIN_LEN
-    v4.sin_len = (u_char) salen;
-#endif
-    sa = (struct sockaddr *) &v4;
-    af = AF_INET;
-  }
-  else if (1 == inet_pton (AF_INET6,
-                           ctx->dns_exit,
-                           &v6.sin6_addr))
-  {
-    salen = sizeof (v6);
-    v6.sin6_family = AF_INET6;
-    v6.sin6_port = htons (53);
-#if HAVE_SOCKADDR_IN_SIN_LEN
-    v6.sin6_len = (u_char) salen;
-#endif
-    sa = (struct sockaddr *) &v6;
-    af = AF_INET6;
-  }
-  else
-  {
-    GNUNET_break (0);
-    return NULL;
-  }
-  if (NULL == (rs = get_request_socket (ctx,
-                                        af)))
-    return NULL;
-  GNUNET_assert (NULL == rs->rc);
-  if (NULL != rs->dnsout4)
-    dnsout = rs->dnsout4;
-  else
-    dnsout = rs->dnsout6;
-  if (NULL == dnsout)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                _("Configured DNS exit `%s' is not working / valid.\n"),
-                ctx->dns_exit);
-    return NULL;
-  }
-  GNUNET_memcpy (&rs->addr,
-                 sa,
-                 salen);
-  rs->addrlen = salen;
-  rs->rc = rc;
-  rs->rc_cls = rc_cls;
-  if (GNUNET_SYSERR ==
-      GNUNET_NETWORK_socket_sendto (dnsout,
-                                    request,
-                                    request_len,
-                                    sa,
-                                    salen))
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                _("Failed to send DNS request to %s\n"),
-                GNUNET_a2s (sa, salen));
-  rs->timeout = GNUNET_TIME_relative_to_absolute (REQUEST_TIMEOUT);
+  rs->ctx = ctx;
   return rs;
 }
 
@@ -484,9 +298,7 @@ static int
 do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
              struct GNUNET_NETWORK_Handle *dnsout)
 {
-  struct sockaddr_storage addr;
-  socklen_t addrlen;
-  struct GNUNET_TUN_DnsHeader *dns;
+  struct GNUNET_DNSSTUB_Context *ctx = rs->ctx;
   ssize_t r;
   int len;
 
@@ -507,9 +319,15 @@ do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
               len);
   {
     unsigned char buf[len] GNUNET_ALIGN;
+    int found;
+    struct sockaddr_storage addr;
+    socklen_t addrlen;
+    struct GNUNET_TUN_DnsHeader *dns;
 
     addrlen = sizeof (addr);
-    memset (&addr, 0, sizeof (addr));
+    memset (&addr,
+            0,
+            sizeof (addr));
     r = GNUNET_NETWORK_socket_recvfrom (dnsout,
                                         buf,
                                         sizeof (buf),
@@ -522,6 +340,24 @@ do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
       GNUNET_NETWORK_socket_close (dnsout);
       return GNUNET_SYSERR;
     }
+    found = GNUNET_NO;
+    for (struct DnsServer *ds = ctx->dns_head; NULL != ds; ds = ds->next)
+    {
+      if (0 == memcmp (&addr,
+                       &ds->ss,
+                       GNUNET_MIN (sizeof (struct sockaddr_storage),
+                                   addrlen)))
+      {
+        found = GNUNET_YES;
+        break;
+      }
+    }
+    if (GNUNET_NO == found)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Received DNS response from server we never asked (ignored)");
+      return GNUNET_NO;
+    }
     if (sizeof (struct GNUNET_TUN_DnsHeader) > r)
     {
       GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
@@ -530,22 +366,15 @@ do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
       return GNUNET_NO;
     }
     dns = (struct GNUNET_TUN_DnsHeader *) buf;
-    if ( (addrlen != rs->addrlen) ||
-         (GNUNET_YES !=
-          GNUNET_TUN_sockaddr_cmp ((struct sockaddr *) &rs->addr,
-                                   (struct sockaddr *) &addr,
-                                   GNUNET_YES)) ||
-       (0 == GNUNET_TIME_absolute_get_remaining (rs->timeout).rel_value_us) )
+    if (NULL == rs->rc)
     {
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Request timeout or invalid sender address; ignoring reply\n");
+                  "Request timeout or cancelled; ignoring reply\n");
       return GNUNET_NO;
     }
-    if (NULL != rs->rc)
-      rs->rc (rs->rc_cls,
-              rs,
-              dns,
-              r);
+    rs->rc (rs->rc_cls,
+            dns,
+            r);
   }
   return GNUNET_OK;
 }
@@ -557,44 +386,21 @@ do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
  * @param cls socket to read from
  */
 static void
-read_response (void *cls)
+read_response (void *cls);
+
+
+/**
+ * Schedule #read_response() task for @a rs.
+ *
+ * @param rs request to schedule read operation for
+ */
+static void
+schedule_read (struct GNUNET_DNSSTUB_RequestSocket *rs)
 {
-  struct GNUNET_DNSSTUB_RequestSocket *rs = cls;
   struct GNUNET_NETWORK_FDSet *rset;
-  const struct GNUNET_SCHEDULER_TaskContext *tc;
-
-  rs->read_task = NULL;
-  tc = GNUNET_SCHEDULER_get_task_context ();
-  if (0 == (tc->reason & GNUNET_SCHEDULER_REASON_READ_READY))
-  {
-    /* signal "failure" (from timeout) */
-    if (NULL != rs->rc)
-    {
-      rs->rc (rs->rc_cls,
-              rs,
-              NULL,
-              0);
-      rs->rc = NULL;
-    }
-    /* timeout */
-    cleanup_rs (rs);
-    return;
-  }
-  /* read and process ready sockets */
-  if ((NULL != rs->dnsout4) &&
-      (GNUNET_NETWORK_fdset_isset (tc->read_ready,
-                                   rs->dnsout4)) &&
-      (GNUNET_SYSERR == do_dns_read (rs,
-                                     rs->dnsout4)))
-    rs->dnsout4 = NULL;
-  if ((NULL != rs->dnsout6) &&
-      (GNUNET_NETWORK_fdset_isset (tc->read_ready,
-                                   rs->dnsout6)) &&
-      (GNUNET_SYSERR == do_dns_read (rs,
-                                     rs->dnsout6)))
-    rs->dnsout6 = NULL;
 
-  /* re-schedule read task */
+  if (NULL != rs->read_task)
+    GNUNET_SCHEDULER_cancel (rs->read_task);
   rset = GNUNET_NETWORK_fdset_create ();
   if (NULL != rs->dnsout4)
     GNUNET_NETWORK_fdset_set (rset,
@@ -603,7 +409,7 @@ read_response (void *cls)
     GNUNET_NETWORK_fdset_set (rset,
                               rs->dnsout6);
   rs->read_task = GNUNET_SCHEDULER_add_select (GNUNET_SCHEDULER_PRIORITY_DEFAULT,
-                                               GNUNET_TIME_absolute_get_remaining (rs->timeout),
+                                               GNUNET_TIME_UNIT_FOREVER_REL,
                                                rset,
                                                NULL,
                                                &read_response,
@@ -613,6 +419,151 @@ read_response (void *cls)
 
 
 /**
+ * Read a DNS response from the (unhindered) UDP-Socket
+ *
+ * @param cls `struct GNUNET_DNSSTUB_RequestSocket` to read from
+ */
+static void
+read_response (void *cls)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs = cls;
+  const struct GNUNET_SCHEDULER_TaskContext *tc;
+
+  rs->read_task = NULL;
+  tc = GNUNET_SCHEDULER_get_task_context ();
+  /* read and process ready sockets */
+  if ( (NULL != rs->dnsout4) &&
+       (GNUNET_NETWORK_fdset_isset (tc->read_ready,
+                                    rs->dnsout4)) &&
+       (GNUNET_SYSERR ==
+        do_dns_read (rs,
+                     rs->dnsout4)) )
+    rs->dnsout4 = NULL;
+  if ( (NULL != rs->dnsout6) &&
+       (GNUNET_NETWORK_fdset_isset (tc->read_ready,
+                                    rs->dnsout6)) &&
+       (GNUNET_SYSERR ==
+        do_dns_read (rs,
+                     rs->dnsout6)) )
+    rs->dnsout6 = NULL;
+  /* re-schedule read task */
+  schedule_read (rs);
+}
+
+
+/**
+ * Task to (re)transmit the DNS query, possibly repeatedly until
+ * we succeed.
+ *
+ * @param cls our `struct GNUNET_DNSSTUB_RequestSocket *`
+ */
+static void
+transmit_query (void *cls)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs = cls;
+  struct GNUNET_DNSSTUB_Context *ctx = rs->ctx;
+  const struct sockaddr *sa;
+  socklen_t salen;
+  struct DnsServer *ds;
+  struct GNUNET_NETWORK_Handle *dnsout;
+
+  rs->retry_task = GNUNET_SCHEDULER_add_delayed (ctx->retry_freq,
+                                                 &transmit_query,
+                                                 rs);
+  ds = rs->ds_pos;
+  rs->ds_pos = ds->next;
+  if (NULL == rs->ds_pos)
+    rs->ds_pos = ctx->dns_head;
+  GNUNET_assert (NULL != ds);
+  dnsout = NULL;
+  switch (ds->ss.ss_family)
+  {
+  case AF_INET:
+    if (NULL == rs->dnsout4)
+      rs->dnsout4 = open_socket (AF_INET);
+    dnsout = rs->dnsout4;
+    sa = (const struct sockaddr *) &ds->ss;
+    salen = sizeof (struct sockaddr_in);
+    break;
+  case AF_INET6:
+    if (NULL == rs->dnsout6)
+      rs->dnsout6 = open_socket (AF_INET6);
+    dnsout = rs->dnsout6;
+    sa = (const struct sockaddr *) &ds->ss;
+    salen = sizeof (struct sockaddr_in6);
+    break;
+  default:
+    return;
+  }
+  if (NULL == dnsout)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to use configure DNS server, skipping\n");
+    return;
+  }
+  if (GNUNET_SYSERR ==
+      GNUNET_NETWORK_socket_sendto (dnsout,
+                                    rs->request,
+                                    rs->request_len,
+                                    sa,
+                                    salen))
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _("Failed to send DNS request to %s\n"),
+                GNUNET_a2s (sa,
+                            salen));
+  else
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                _("Sent DNS request to %s\n"),
+                GNUNET_a2s (sa,
+                            salen));
+  schedule_read (rs);
+}
+
+
+/**
+ * Perform DNS resolution using our default IP from init.
+ *
+ * @param ctx stub resolver to use
+ * @param request DNS request to transmit
+ * @param request_len number of bytes in msg
+ * @param rc function to call with result
+ * @param rc_cls closure for 'rc'
+ * @return socket used for the request, NULL on error
+ */
+struct GNUNET_DNSSTUB_RequestSocket *
+GNUNET_DNSSTUB_resolve (struct GNUNET_DNSSTUB_Context *ctx,
+                         const void *request,
+                         size_t request_len,
+                         GNUNET_DNSSTUB_ResultCallback rc,
+                         void *rc_cls)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs;
+
+  if (NULL == ctx->dns_head)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No DNS server configured for resolution\n");
+    return NULL;
+  }
+  if (NULL == (rs = get_request_socket (ctx)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No request socket available for DNS resolution\n");
+    return NULL;
+  }
+  rs->ds_pos = ctx->dns_head;
+  rs->rc = rc;
+  rs->rc_cls = rc_cls;
+  rs->request = GNUNET_memdup (request,
+                               request_len);
+  rs->request_len = request_len;
+  rs->retry_task = GNUNET_SCHEDULER_add_now (&transmit_query,
+                                             rs);
+  return rs;
+}
+
+
+/**
  * Cancel DNS resolution.
  *
  * @param rs resolution to cancel
@@ -626,28 +577,153 @@ GNUNET_DNSSTUB_resolve_cancel (struct GNUNET_DNSSTUB_RequestSocket *rs)
     GNUNET_SCHEDULER_cancel (rs->retry_task);
     rs->retry_task = NULL;
   }
+  if (NULL != rs->read_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->read_task);
+    rs->read_task = NULL;
+  }
 }
 
 
 /**
  * Start a DNS stub resolver.
  *
- * @param dns_ip target IP address to use
+ * @param num_sockets how many sockets should we open
+ *        in parallel for DNS queries for this stub?
  * @return NULL on error
  */
 struct GNUNET_DNSSTUB_Context *
-GNUNET_DNSSTUB_start (const char *dns_ip)
+GNUNET_DNSSTUB_start (unsigned int num_sockets)
 {
   struct GNUNET_DNSSTUB_Context *ctx;
 
+  if (0 == num_sockets)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
   ctx = GNUNET_new (struct GNUNET_DNSSTUB_Context);
-  if (NULL != dns_ip)
-    ctx->dns_exit = GNUNET_strdup (dns_ip);
+  ctx->num_sockets = num_sockets;
+  ctx->sockets = GNUNET_new_array (num_sockets,
+                                   struct GNUNET_DNSSTUB_RequestSocket);
+  ctx->retry_freq = DNS_RETRANSMIT_DELAY;
   return ctx;
 }
 
 
 /**
+ * Add nameserver for use by the DNSSTUB.  We will use
+ * all provided nameservers for resolution (round-robin).
+ *
+ * @param ctx resolver context to modify
+ * @param dns_ip target IP address to use (as string)
+ * @return #GNUNET_OK on success
+ */
+int
+GNUNET_DNSSTUB_add_dns_ip (struct GNUNET_DNSSTUB_Context *ctx,
+                           const char *dns_ip)
+{
+  struct DnsServer *ds;
+  struct in_addr i4;
+  struct in6_addr i6;
+
+  ds = GNUNET_new (struct DnsServer);
+  if (1 == inet_pton (AF_INET,
+                      dns_ip,
+                      &i4))
+  {
+    struct sockaddr_in *s4 = (struct sockaddr_in *) &ds->ss;
+
+    s4->sin_family = AF_INET;
+    s4->sin_port = htons (53);
+    s4->sin_addr = i4;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    s4->sin_len = (u_char) sizeof (struct sockaddr_in);
+#endif
+  }
+  else if (1 == inet_pton (AF_INET6,
+                           dns_ip,
+                           &i6))
+  {
+    struct sockaddr_in6 *s6 = (struct sockaddr_in6 *) &ds->ss;
+
+    s6->sin6_family = AF_INET6;
+    s6->sin6_port = htons (53);
+    s6->sin6_addr = i6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    s6->sin6_len = (u_char) sizeof (struct sockaddr_in6);
+#endif
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Malformed IP address `%s' for DNS server\n",
+                dns_ip);
+    GNUNET_free (ds);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_CONTAINER_DLL_insert (ctx->dns_head,
+                               ctx->dns_tail,
+                               ds);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add nameserver for use by the DNSSTUB.  We will use
+ * all provided nameservers for resolution (round-robin).
+ *
+ * @param ctx resolver context to modify
+ * @param sa socket address of DNS resolver to use
+ * @return #GNUNET_OK on success
+ */
+int
+GNUNET_DNSSTUB_add_dns_sa (struct GNUNET_DNSSTUB_Context *ctx,
+                           const struct sockaddr *sa)
+{
+  struct DnsServer *ds;
+
+  ds = GNUNET_new (struct DnsServer);
+  switch (sa->sa_family)
+  {
+  case AF_INET:
+    memcpy (&ds->ss,
+            sa,
+            sizeof (struct sockaddr_in));
+    break;
+  case AF_INET6:
+    memcpy (&ds->ss,
+            sa,
+            sizeof (struct sockaddr_in6));
+    break;
+  default:
+    GNUNET_break (0);
+    GNUNET_free (ds);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_CONTAINER_DLL_insert (ctx->dns_head,
+                               ctx->dns_tail,
+                               ds);
+  return GNUNET_OK;
+}
+
+
+/**
+ * How long should we try requests before timing out?
+ * Only effective for requests issued after this call.
+ *
+ * @param ctx resolver context to modify
+ * @param retry_freq how long to wait between retries
+ */
+void
+GNUNET_DNSSTUB_set_retry (struct GNUNET_DNSSTUB_Context *ctx,
+                          struct GNUNET_TIME_Relative retry_freq)
+{
+  ctx->retry_freq = retry_freq;
+}
+
+
+/**
  * Cleanup DNSSTUB resolver.
  *
  * @param ctx stub resolver to clean up
@@ -655,15 +731,18 @@ GNUNET_DNSSTUB_start (const char *dns_ip)
 void
 GNUNET_DNSSTUB_stop (struct GNUNET_DNSSTUB_Context *ctx)
 {
-  unsigned int i;
+  struct DnsServer *ds;
 
-  for (i=0;i<DNS_SOCKET_MAX;i++)
-    cleanup_rs (&ctx->sockets[i]);
-  if (NULL != ctx->dns_exit)
+  while (NULL != (ds = ctx->dns_head))
   {
-    GNUNET_free (ctx->dns_exit);
-    ctx->dns_exit = NULL;
+    GNUNET_CONTAINER_DLL_remove (ctx->dns_head,
+                                 ctx->dns_tail,
+                                 ds);
+    GNUNET_free (ds);
   }
+  for (unsigned int i=0;i<ctx->num_sockets;i++)
+    cleanup_rs (&ctx->sockets[i]);
+  GNUNET_free (ctx->sockets);
   GNUNET_free (ctx);
 }
 
diff --git a/src/dns/gnunet-service-dns.c b/src/dns/gnunet-service-dns.c
index 9feaa8413..39ce7f6e5 100644
--- a/src/dns/gnunet-service-dns.c
+++ b/src/dns/gnunet-service-dns.c
@@ -508,13 +508,11 @@ send_request_to_client (struct RequestRecord *rr,
  * succeeded.
  *
  * @param cls NULL
- * @param rs the socket that received the response
  * @param dns the response itself
  * @param r number of bytes in dns
  */
 static void
 process_dns_result (void *cls,
-                    struct GNUNET_DNSSTUB_RequestSocket *rs,
                     const struct GNUNET_TUN_DnsHeader *dns,
                     size_t r);
 
@@ -530,7 +528,6 @@ next_phase (struct RequestRecord *rr)
 {
   struct ClientRecord *cr;
   int nz;
-  socklen_t salen;
 
   if (rr->phase == RP_DROP)
   {
@@ -582,22 +579,27 @@ next_phase (struct RequestRecord *rr)
     next_phase (rr);
     return;
   case RP_QUERY:
+#if 0
+    /* TODO: optionally, use this to forward DNS requests to the
+       *original* DNS server instead of the one we have configured...
+       (but then we need to create a fresh dnsstub for each request
+       *and* manage the timeout) */
     switch (rr->dst_addr.ss_family)
     {
     case AF_INET:
       salen = sizeof (struct sockaddr_in);
+      sa = (const struct sockaddr *) &rr->dst_addr;
       break;
     case AF_INET6:
       salen = sizeof (struct sockaddr_in6);
+      sa = (const struct sockaddr *) &rr->dst_addr;
       break;
     default:
       GNUNET_assert (0);
     }
-
+#endif
     rr->phase = RP_INTERNET_DNS;
     rr->rs = GNUNET_DNSSTUB_resolve (dnsstub,
-                                     (struct sockaddr*) &rr->dst_addr,
-                                     salen,
                                      rr->payload,
                                      rr->payload_length,
                                      &process_dns_result,
@@ -714,13 +716,11 @@ client_disconnect_cb (void *cls,
  * succeeded.
  *
  * @param cls NULL
- * @param rs the socket that received the response
  * @param dns the response itself
  * @param r number of bytes in dns
  */
 static void
 process_dns_result (void *cls,
-                    struct GNUNET_DNSSTUB_RequestSocket *rs,
                     const struct GNUNET_TUN_DnsHeader *dns,
                     size_t r)
 {
@@ -733,8 +733,7 @@ process_dns_result (void *cls,
     return; /* ignore */
 
   rr = &requests[dns->id];
-  if ( (rr->phase != RP_INTERNET_DNS) ||
-       (rr->rs != rs) )
+  if (rr->phase != RP_INTERNET_DNS)
   {
     /* unexpected / bogus reply */
     GNUNET_STATISTICS_update (stats,
@@ -1055,8 +1054,6 @@ run (void *cls,
   char *ipv4mask;
   char *ipv6addr;
   char *ipv6prefix;
-  struct in_addr dns_exit4;
-  struct in6_addr dns_exit6;
   char *dns_exit;
   char *binary;
   int nortsetup;
@@ -1065,24 +1062,26 @@ run (void *cls,
   stats = GNUNET_STATISTICS_create ("dns", cfg);
   GNUNET_SCHEDULER_add_shutdown (&cleanup_task,
                                  cls);
+  dnsstub = GNUNET_DNSSTUB_start (128);
+  /* TODO: support multiple DNS_EXIT servers being configured */
+  /* TODO: see above TODO on using DNS server from original packet.
+     Not sure which is best... */
   dns_exit = NULL;
-  if ( ( (GNUNET_OK !=
-          GNUNET_CONFIGURATION_get_value_string (cfg,
-                                                 "dns",
-                                                 "DNS_EXIT",
-                                                 &dns_exit)) ||
-         ( (1 != inet_pton (AF_INET, dns_exit, &dns_exit4)) &&
-           (1 != inet_pton (AF_INET6, dns_exit, &dns_exit6)) ) ) )
+  if ( (GNUNET_OK !=
+        GNUNET_CONFIGURATION_get_value_string (cfg,
+                                               "dns",
+                                               "DNS_EXIT",
+                                               &dns_exit)) ||
+       (GNUNET_OK !=
+        GNUNET_DNSSTUB_add_dns_ip (dnsstub,
+                                   dns_exit)) )
   {
     GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR,
                                "dns",
                                "DNS_EXIT",
                                _("need a valid IPv4 or IPv6 address\n"));
     GNUNET_free_non_null (dns_exit);
-    dns_exit = NULL;
   }
-  dnsstub = GNUNET_DNSSTUB_start (dns_exit);
-  GNUNET_free_non_null (dns_exit);
   binary = GNUNET_OS_get_libexec_binary_path ("gnunet-helper-dns");
   if (GNUNET_YES !=
       GNUNET_OS_check_helper_binary (binary,
diff --git a/src/dns/gnunet-zoneimport.c b/src/dns/gnunet-zoneimport.c
index 914868af4..860672e7a 100644
--- a/src/dns/gnunet-zoneimport.c
+++ b/src/dns/gnunet-zoneimport.c
@@ -290,13 +290,11 @@ process_record (struct Request *req,
  * Function called with the result of a DNS resolution.
  *
  * @param cls closure with the `struct Request`
- * @param rs socket that received the response
  * @param dns dns response, never NULL
  * @param dns_len number of bytes in @a dns
  */
 static void
 process_result (void *cls,
-                struct GNUNET_DNSSTUB_RequestSocket *rs,
                 const struct GNUNET_TUN_DnsHeader *dns,
                 size_t dns_len)
 {
@@ -407,11 +405,11 @@ submit_req (struct Request *req)
        (pending >= THRESH) )
     return GNUNET_SYSERR;
   GNUNET_assert (NULL == req->rs);
-  req->rs = GNUNET_DNSSTUB_resolve2 (ctx,
-                                     req->raw,
-                                     req->raw_len,
-                                     &process_result,
-                                     req);
+  req->rs = GNUNET_DNSSTUB_resolve (ctx,
+                                    req->raw,
+                                    req->raw_len,
+                                    &process_result,
+                                    req);
   GNUNET_assert (NULL != req->rs);
   req->issue_num++;
   last_request = now;
@@ -561,13 +559,23 @@ main (int argc,
              "Missing required configuration argument\n");
     return -1;
   }
-  ctx = GNUNET_DNSSTUB_start (argv[1]);
+  ctx = GNUNET_DNSSTUB_start (256);
   if (NULL == ctx)
   {
     fprintf (stderr,
              "Failed to initialize GNUnet DNS STUB\n");
     return 1;
   }
+  if (GNUNET_OK !=
+      GNUNET_DNSSTUB_add_dns_ip (ctx,
+                                 argv[1]))
+  {
+    fprintf (stderr,
+             "Failed to use `%s' for DNS resolver\n",
+             argv[1]);
+    return 1;
+  }
+
   while (NULL !=
          fgets (hn,
                 sizeof (hn),
diff --git a/src/exit/gnunet-daemon-exit.c b/src/exit/gnunet-daemon-exit.c
index 0b3cc505a..ae40feea0 100644
--- a/src/exit/gnunet-daemon-exit.c
+++ b/src/exit/gnunet-daemon-exit.c
@@ -458,13 +458,11 @@ GNUNET_NETWORK_STRUCT_END
  * succeeded.
  *
  * @param cls NULL
- * @param rs the socket that received the response
  * @param dns the response itself
  * @param r number of bytes in @a dns
  */
 static void
 process_dns_result (void *cls,
-                    struct GNUNET_DNSSTUB_RequestSocket *rs,
                     const struct GNUNET_TUN_DnsHeader *dns,
                     size_t r)
 {
@@ -479,8 +477,7 @@ process_dns_result (void *cls,
     return;
   /* Handle case that this is a reply to a request from a CADET DNS channel */
   ts = channels[dns->id];
-  if ( (NULL == ts) ||
-       (ts->specifics.dns.rs != rs) )
+  if (NULL == ts)
     return;
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Got a response from the stub resolver for DNS request received via CADET!\n");
@@ -557,11 +554,11 @@ handle_dns_request (void *cls,
                  dlen);
   dout = (struct GNUNET_TUN_DnsHeader *) buf;
   dout->id = ts->specifics.dns.my_id;
-  ts->specifics.dns.rs = GNUNET_DNSSTUB_resolve2 (dnsstub,
-                                                  buf,
-                                                  dlen,
-                                                  &process_dns_result,
-                                                  NULL);
+  ts->specifics.dns.rs = GNUNET_DNSSTUB_resolve (dnsstub,
+                                                 buf,
+                                                 dlen,
+                                                 &process_dns_result,
+                                                 NULL);
   if (NULL == ts->specifics.dns.rs)
   {
     GNUNET_break_op (0);
@@ -3429,16 +3426,11 @@ do_dht_put (void *cls);
  * Schedules the next PUT.
  *
  * @param cls closure, NULL
- * @param success #GNUNET_OK if the operation worked (unused)
  */
 static void
-dht_put_cont (void *cls,
-              int success)
+dht_put_cont (void *cls)
 {
   dht_put = NULL;
-  dht_task = GNUNET_SCHEDULER_add_delayed (DHT_PUT_FREQUENCY,
-                                           &do_dht_put,
-                                           NULL);
 }
 
 
@@ -3453,7 +3445,9 @@ do_dht_put (void *cls)
 {
   struct GNUNET_TIME_Absolute expiration;
 
-  dht_task = NULL;
+  dht_task = GNUNET_SCHEDULER_add_delayed (DHT_PUT_FREQUENCY,
+                                           &do_dht_put,
+                                           NULL);
   expiration = GNUNET_TIME_absolute_ntoh (dns_advertisement.expiration_time);
   if (GNUNET_TIME_absolute_get_remaining (expiration).rel_value_us <
       GNUNET_TIME_UNIT_HOURS.rel_value_us)
@@ -3466,6 +3460,8 @@ do_dht_put (void *cls)
                                            &dns_advertisement.purpose,
                                            &dns_advertisement.signature));
   }
+  if (NULL != dht_put)
+    GNUNET_DHT_put_cancel (dht_put);
   dht_put = GNUNET_DHT_put (dht,
                             &dht_put_key,
                             1 /* replication */,
@@ -3545,25 +3541,23 @@ advertise_dns_exit ()
   };
   char *dns_exit;
   struct GNUNET_HashCode port;
-  struct in_addr dns_exit4;
-  struct in6_addr dns_exit6;
 
   if (GNUNET_YES !=
       GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                             "exit",
                                             "EXIT_DNS"))
     return;
+  GNUNET_assert (NULL != (dnsstub = GNUNET_DNSSTUB_start (128)));
+  dns_exit = NULL;
+  /* TODO: support using multiple DNS resolvers */
   if ( (GNUNET_OK !=
         GNUNET_CONFIGURATION_get_value_string (cfg,
                                                "exit",
                                                "DNS_RESOLVER",
                                                &dns_exit)) ||
-       ( (1 != inet_pton (AF_INET,
-                          dns_exit,
-                          &dns_exit4)) &&
-         (1 != inet_pton (AF_INET6,
-                          dns_exit,
-                          &dns_exit6)) ) )
+       (GNUNET_OK !=
+        GNUNET_DNSSTUB_add_dns_ip (dnsstub,
+                                   dns_exit)) )
   {
     GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR,
                                "dns",
diff --git a/src/fs/gnunet-service-fs_put.c b/src/fs/gnunet-service-fs_put.c
index e8c7f586d..bb8560fff 100644
--- a/src/fs/gnunet-service-fs_put.c
+++ b/src/fs/gnunet-service-fs_put.c
@@ -135,14 +135,9 @@ schedule_next_put (struct PutOperator *po)
  * Continuation called after DHT PUT operation has finished.
  *
  * @param cls type of blocks to gather
- * @param success GNUNET_OK if the PUT was transmitted,
- *                GNUNET_NO on timeout,
- *                GNUNET_SYSERR on disconnect from service
- *                after the PUT message was transmitted
- *                (so we don't know if it was received or not)
  */
 static void
-delay_dht_put_blocks (void *cls, int success)
+delay_dht_put_blocks (void *cls)
 {
   struct PutOperator *po = cls;
 
diff --git a/src/gns/gns.conf.in b/src/gns/gns.conf.in
index d48a213e9..2e49a4c60 100644
--- a/src/gns/gns.conf.in
+++ b/src/gns/gns.conf.in
@@ -22,9 +22,6 @@ MAX_PARALLEL_BACKGROUND_QUERIES = 1000
 # called via NSS or other mechanisms).
 INTERCEPT_DNS = YES
 
-# Using caching (start with namestore), or always ask DHT?
-USE_CACHE = YES
-
 # PREFIX = valgrind --leak-check=full --track-origins=yes
 
 # Zones
diff --git a/src/gns/gns_tld_api.c b/src/gns/gns_tld_api.c
index 293e37140..8a4d03b11 100644
--- a/src/gns/gns_tld_api.c
+++ b/src/gns/gns_tld_api.c
@@ -94,7 +94,7 @@ struct GNUNET_GNS_LookupWithTldRequest
  * @return the part of @a name after the last ".",
  *         or @a name if @a name does not contain a "."
  */
-static const char *
+static char *
 get_tld (const char *name)
 {
   const char *tld;
@@ -105,14 +105,14 @@ get_tld (const char *name)
     tld = name;
   else
     tld++; /* skip the '.' */
-  return tld;
+  return GNUNET_strdup (tld);
 }
 
 
 /**
  * Eat the TLD of the given @a name.
  *
- * @param name a name
+ * @param[in,out] name a name
  */
 static void
 eat_tld (char *name)
@@ -124,7 +124,7 @@ eat_tld (char *name)
                  (unsigned char) '.');
   if (NULL == tld)
     strcpy (name,
-            GNUNET_GNS_MASTERZONE_STR);
+            GNUNET_GNS_EMPTY_LABEL_AT);
   else
     *tld = '\0';
 }
@@ -229,7 +229,7 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle *handle,
                             void *proc_cls)
 {
   struct GNUNET_GNS_LookupWithTldRequest *ltr;
-  const char *tld;
+  char *tld;
   char *dot_tld;
   char *zonestr;
   struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
@@ -251,6 +251,7 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle *handle,
     eat_tld (ltr->name);
     lookup_with_public_key (ltr,
                             &pkey);
+    GNUNET_free (tld);
     return ltr;
   }
 
@@ -277,6 +278,7 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle *handle,
       GNUNET_free (dot_tld);
       GNUNET_free (ltr->name);
       GNUNET_free (ltr);
+      GNUNET_free (tld);
       return NULL;
     }
     GNUNET_free (dot_tld);
@@ -284,6 +286,7 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle *handle,
     eat_tld (ltr->name);
     lookup_with_public_key (ltr,
                             &pkey);
+    GNUNET_free (tld);
     return ltr;
   }
   GNUNET_free (dot_tld);
@@ -301,6 +304,7 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle *handle,
                                            tld,
                                            &identity_zone_cb,
                                            ltr);
+  GNUNET_free (tld);
   if (NULL == ltr->id_op)
   {
     GNUNET_free (ltr->name);
diff --git a/src/gns/gnunet-dns2gns.c b/src/gns/gnunet-dns2gns.c
index 47cc6dde0..bc66f1325 100644
--- a/src/gns/gnunet-dns2gns.c
+++ b/src/gns/gnunet-dns2gns.c
@@ -247,19 +247,16 @@ do_timeout (void *cls)
  * Iterator called on obtained result for a DNS lookup
  *
  * @param cls closure
- * @param rs the request socket
  * @param dns the DNS udp payload
  * @param r size of the DNS payload
  */
 static void
 dns_result_processor (void *cls,
-                      struct GNUNET_DNSSTUB_RequestSocket *rs,
                       const struct GNUNET_TUN_DnsHeader *dns,
                       size_t r)
 {
   struct Request *request = cls;
 
-  (void) rs;
   if (NULL == dns)
   {
     /* DNSSTUB gave up, so we trigger timeout early */
@@ -307,11 +304,11 @@ result_processor (void *cls,
     request->original_request_id = request->packet->id;
     GNUNET_DNSPARSER_free_packet (request->packet);
     request->packet = NULL;
-    request->dns_lookup = GNUNET_DNSSTUB_resolve2 (dns_stub,
-                                                   request->udp_msg,
-                                                   request->udp_msg_size,
-                                                   &dns_result_processor,
-                                                   request);
+    request->dns_lookup = GNUNET_DNSSTUB_resolve (dns_stub,
+                                                  request->udp_msg,
+                                                  request->udp_msg_size,
+                                                  &dns_result_processor,
+                                                  request);
     return;
   }
   packet = request->packet;
@@ -594,8 +591,12 @@ run (void *cls,
                                  NULL);
   if (NULL == (gns = GNUNET_GNS_connect (cfg)))
     return;
-  if (NULL == (dns_stub = GNUNET_DNSSTUB_start (dns_ip)))
+  GNUNET_assert (NULL != (dns_stub = GNUNET_DNSSTUB_start (128)));
+  if (GNUNET_OK !=
+      GNUNET_DNSSTUB_add_dns_ip (dns_stub,
+                                 dns_ip))
   {
+    GNUNET_DNSSTUB_stop (dns_stub);
     GNUNET_GNS_disconnect (gns);
     gns = NULL;
     return;
diff --git a/src/gns/gnunet-gns-proxy.c b/src/gns/gnunet-gns-proxy.c
index 8b9aa599e..08663a57e 100644
--- a/src/gns/gnunet-gns-proxy.c
+++ b/src/gns/gnunet-gns-proxy.c
@@ -855,9 +855,9 @@ mhd_content_cb (void *cls,
     return MHD_CONTENT_READER_END_OF_STREAM;
   }
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Writing %lu/%lu bytes\n",
-              bytes_to_copy,
-              s5r->io_len);
+              "Writing %llu/%llu bytes\n",
+              (unsigned long long) bytes_to_copy,
+              (unsigned long long) s5r->io_len);
   GNUNET_memcpy (buf,
                  s5r->io_buf,
                  bytes_to_copy);
@@ -1307,12 +1307,12 @@ curl_download_cb (void *ptr,
   if (sizeof (s5r->io_buf) - s5r->io_len < total)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Pausing CURL `%s%s' download, not enough space %lu %lu %lu\n",
+                "Pausing CURL `%s%s' download, not enough space %llu %llu %llu\n",
                 s5r->domain,
                 s5r->url,
-                sizeof (s5r->io_buf),
-                s5r->io_len,
-                total);
+                (unsigned long long) sizeof (s5r->io_buf),
+                (unsigned long long) s5r->io_len,
+                (unsigned long long) total);
     return CURL_WRITEFUNC_PAUSE; /* not enough space */
   }
   GNUNET_memcpy (&s5r->io_buf[s5r->io_len],
diff --git a/src/gns/gnunet-service-gns.c b/src/gns/gnunet-service-gns.c
index 90cd47e1d..c376ddfcc 100644
--- a/src/gns/gnunet-service-gns.c
+++ b/src/gns/gnunet-service-gns.c
@@ -229,14 +229,14 @@ GNS_get_tld (const char *name)
 /**
  * Task run during shutdown.
  *
- * @param cls unused
- * @param tc unused
+ * @param cls unused, NULL
  */
 static void
 shutdown_task (void *cls)
 {
   struct GNS_TopLevelDomain *tld;
 
+  (void) cls;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Shutting down!\n");
   GNS_interceptor_done ();
@@ -283,6 +283,7 @@ client_disconnect_cb (void *cls,
   struct ClientLookupHandle *clh;
   struct GnsClient *gc = app_ctx;
 
+  (void) cls;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Client %p disconnected\n",
               client);
@@ -314,6 +315,8 @@ client_connect_cb (void *cls,
                    struct GNUNET_MQ_Handle *mq)
 {
   struct GnsClient *gc;
+
+  (void) cls;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Client %p connected\n",
               client);
@@ -383,6 +386,7 @@ check_lookup (void *cls,
   size_t msg_size;
   const char* name;
 
+  (void) cls;
   msg_size = ntohs (l_msg->header.size);
   if (msg_size < sizeof (struct LookupMessage))
   {
@@ -479,6 +483,8 @@ read_service_conf (void *cls,
   struct GNUNET_CRYPTO_EcdsaPublicKey pk;
   struct GNS_TopLevelDomain *tld;
 
+  (void) cls;
+  (void) section;
   if (option[0] != '.')
     return;
   if (GNUNET_OK !=
diff --git a/src/gns/gnunet-service-gns_resolver.c b/src/gns/gnunet-service-gns_resolver.c
index 94819b040..92e03bc69 100644
--- a/src/gns/gnunet-service-gns_resolver.c
+++ b/src/gns/gnunet-service-gns_resolver.c
@@ -72,6 +72,57 @@
  * DLL to hold the authority chain we had to pass in the resolution
  * process.
  */
+struct AuthorityChain;
+
+
+/**
+ * Element of a resolution process for looking up the
+ * responsible DNS server hostname in a GNS2DNS recursive
+ * resolution.
+ */
+struct Gns2DnsPending
+{
+
+  /**
+   * Kept in a DLL.
+   */
+  struct Gns2DnsPending *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct Gns2DnsPending *prev;
+
+  /**
+   * Context this activity belongs with.
+   */
+  struct AuthorityChain *ac;
+
+  /**
+   * Handle for the resolution of the IP part of the
+   * GNS2DNS record.  Will return to us the addresses
+   * of the DNS resolver to use.
+   */
+  struct GNS_ResolverHandle *rh;
+
+  /**
+   * Handle for DNS resolution of the DNS nameserver.
+   */
+  struct GNUNET_RESOLVER_RequestHandle *dns_rh;
+};
+
+
+/**
+ * Handle to a currenty pending resolution.  On result (positive or
+ * negative) the #GNS_ResultProcessor is called.
+ */
+struct GNS_ResolverHandle;
+
+
+/**
+ * DLL to hold the authority chain we had to pass in the resolution
+ * process.
+ */
 struct AuthorityChain
 {
   /**
@@ -131,11 +182,32 @@ struct AuthorityChain
       char name[GNUNET_DNSPARSER_MAX_NAME_LENGTH + 1];
 
       /**
-       * IP address of the DNS resolver that is authoritative.
-       * (this implementation currently only supports one
-       * IP at a time).
+       * List of resolutions of the 'ip' of the name server that
+       * are still pending.
+       */
+      struct Gns2DnsPending *gp_head;
+
+      /**
+       * Tail of list of resolutions of the 'ip' of the name server that
+       * are still pending.
+       */
+      struct Gns2DnsPending *gp_tail;
+
+      /**
+       * Handle to perform DNS lookups with this authority (in GNS2DNS handling).
+       */
+      struct GNUNET_DNSSTUB_Context *dns_handle;
+
+      /**
+       * Did we succeed in getting an IP address for *any* of the DNS servers listed?
+       * Once we do, we can start with DNS queries.
+       */
+      int found;
+
+      /**
+       * Did we start the recursive resolution via DNS?
        */
-      struct sockaddr_storage dns_ip;
+      int launched;
 
     } dns_authority;
 
@@ -218,34 +290,6 @@ struct VpnContext
 
 
 /**
- * Information we keep during the resolution of an
- * IP address for a DNS server while handling a
- * GNS2DNS record.
- */
-struct Gns2DnsContext
-{
-
-  /**
-   * DNS domain in which the resolution will continue
-   * (first part of the GNS2DNS record).
-   */
-  char *ns;
-
-  /**
-   * Handle for the resolution of the IP part of the
-   * GNS2DNS record.  Will return to us the addresses
-   * of the DNS resolver to use.
-   */
-  struct GNS_ResolverHandle *rh;
-
-  /**
-   * Handle for DNS resolution of the DNS nameserver.
-   */
-  struct GNUNET_RESOLVER_RequestHandle *dns_rh;
-};
-
-
-/**
  * Handle to a currenty pending resolution.  On result (positive or
  * negative) the #GNS_ResultProcessor is called.
  */
@@ -278,12 +322,6 @@ struct GNS_ResolverHandle
   void* proc_cls;
 
   /**
-   * Handle used during GNS2DNS resolution for looking up the
-   * IP address of the DNS server.
-   */
-  struct Gns2DnsContext *g2dc;
-
-  /**
    * Handle for DHT lookups. should be NULL if no lookups are in progress
    */
   struct GNUNET_DHT_GetHandle *get_handle;
@@ -431,11 +469,6 @@ static struct GNUNET_VPN_Handle *vpn_handle;
 static struct GNUNET_DHT_Handle *dht_handle;
 
 /**
- * Handle to perform DNS lookups.
- */
-static struct GNUNET_DNSSTUB_Context *dns_handle;
-
-/**
  * Heap for limiting parallel DHT lookups
  */
 static struct GNUNET_CONTAINER_Heap *dht_lookup_heap;
@@ -468,7 +501,7 @@ static struct CacheOps *co_tail;
 /**
  * Use namecache
  */
-static int use_cache;
+static int disable_cache;
 
 /**
  * Global configuration.
@@ -543,21 +576,53 @@ translate_dot_plus (struct GNS_ResolverHandle *rh,
 
 
 /**
- * Task scheduled to asynchronously fail a resolution.
+ * Wrapper around #GNS_resolver_lookup_cancel() as a task.
+ * Used for delayed cleanup so we can unwind the stack first.
  *
- * @param cls the 'struct GNS_ResolverHandle' of the resolution to fail
+ * @param cls the `struct GNS_ResolverHandle`
  */
 static void
-fail_resolution (void *cls)
+GNS_resolver_lookup_cancel_ (void *cls)
 {
   struct GNS_ResolverHandle *rh = cls;
 
   rh->task_id = NULL;
-  rh->proc (rh->proc_cls, 0, NULL);
   GNS_resolver_lookup_cancel (rh);
 }
 
 
+/**
+ * Function called to asynchronously fail a resolution.
+ *
+ * @param rh the resolution to fail
+ */
+static void
+fail_resolution (struct GNS_ResolverHandle *rh)
+{
+  rh->proc (rh->proc_cls,
+            0,
+            NULL);
+  GNUNET_assert (NULL == rh->task_id);
+  rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                          rh);
+}
+
+
+/**
+ * Function called when a resolution times out.
+ *
+ * @param cls the `struct GNS_ResolverHandle`
+ */
+static void
+timeout_resolution (void *cls)
+{
+  struct GNS_ResolverHandle *rh = cls;
+
+  rh->task_id = NULL;
+  fail_resolution (rh);
+}
+
+
 #if (defined WINDOWS) || (defined DARWIN)
 /* Don't have this on W32, here's a naive implementation
  * Was somehow removed on OS X ...  */
@@ -831,13 +896,11 @@ start_resolver_lookup (void *cls);
  *
  * @param cls the request handle of the resolution that
  *        we were attempting to make
- * @param rs socket that received the response
  * @param dns dns response, never NULL
  * @param dns_len number of bytes in @a dns
  */
 static void
 dns_result_parser (void *cls,
-                   struct GNUNET_DNSSTUB_RequestSocket *rs,
                    const struct GNUNET_TUN_DnsHeader *dns,
                    size_t dns_len)
 {
@@ -845,18 +908,13 @@ dns_result_parser (void *cls,
   struct GNUNET_DNSPARSER_Packet *p;
   const struct GNUNET_DNSPARSER_Record *rec;
   unsigned int rd_count;
-  unsigned int i;
 
-  (void) rs;
   if (NULL == dns)
   {
     rh->dns_request = NULL;
     GNUNET_SCHEDULER_cancel (rh->task_id);
     rh->task_id = NULL;
-    rh->proc (rh->proc_cls,
-              0,
-              NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   if (rh->original_dns_id != dns->id)
@@ -872,6 +930,8 @@ dns_result_parser (void *cls,
                 _("Failed to parse DNS response\n"));
     return;
   }
+
+  /* We got a result from DNS */
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received DNS response for `%s' with %u answers\n",
               rh->ac_tail->label,
@@ -920,8 +980,10 @@ dns_result_parser (void *cls,
 
     buf_off = 0;
     skip = 0;
-    memset (rd, 0, sizeof (rd));
-    for (i=0;i<rd_count;i++)
+    memset (rd,
+            0,
+            sizeof (rd));
+    for (unsigned int i=0;i<rd_count;i++)
     {
       if (i < p->num_answers)
         rec = &p->answers[i];
@@ -1043,9 +1105,12 @@ dns_result_parser (void *cls,
     rh->proc (rh->proc_cls,
               rd_count - skip,
               rd);
-    GNS_resolver_lookup_cancel (rh);
   }
   GNUNET_DNSPARSER_free_packet (p);
+  if (NULL != rh->task_id)
+    GNUNET_SCHEDULER_cancel (rh->task_id); /* should be timeout task */
+  rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                          rh);
 }
 
 
@@ -1061,7 +1126,6 @@ static void
 recursive_dns_resolution (struct GNS_ResolverHandle *rh)
 {
   struct AuthorityChain *ac;
-  socklen_t sa_len;
   struct GNUNET_DNSPARSER_Query *query;
   struct GNUNET_DNSPARSER_Packet *p;
   char *dns_request;
@@ -1074,20 +1138,6 @@ recursive_dns_resolution (struct GNS_ResolverHandle *rh)
               "Starting DNS lookup for `%s'\n",
               ac->label);
   GNUNET_assert (GNUNET_NO == ac->gns_authority);
-  switch (((const struct sockaddr *) &ac->authority_info.dns_authority.dns_ip)->sa_family)
-  {
-  case AF_INET:
-    sa_len = sizeof (struct sockaddr_in);
-    break;
-  case AF_INET6:
-    sa_len = sizeof (struct sockaddr_in6);
-    break;
-  default:
-    GNUNET_break (0);
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
-    return;
-  }
   query = GNUNET_new (struct GNUNET_DNSPARSER_Query);
   query->name = GNUNET_strdup (ac->label);
   query->type = rh->record_type;
@@ -1109,20 +1159,22 @@ recursive_dns_resolution (struct GNS_ResolverHandle *rh)
     rh->proc (rh->proc_cls,
               0,
               NULL);
-    GNS_resolver_lookup_cancel (rh);
+    GNUNET_assert (NULL == rh->task_id);
+    rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                            rh);
   }
   else
   {
     rh->original_dns_id = p->id;
-    rh->dns_request = GNUNET_DNSSTUB_resolve (dns_handle,
-                                              (const struct sockaddr *) &ac->authority_info.dns_authority.dns_ip,
-                                              sa_len,
+    GNUNET_assert (NULL != ac->authority_info.dns_authority.dns_handle);
+    GNUNET_assert (NULL == rh->dns_request);
+    rh->dns_request = GNUNET_DNSSTUB_resolve (ac->authority_info.dns_authority.dns_handle,
                                               dns_request,
                                               dns_request_length,
                                               &dns_result_parser,
                                               rh);
     rh->task_id = GNUNET_SCHEDULER_add_delayed (DNS_LOOKUP_TIMEOUT,
-                                                &fail_resolution,
+                                                &timeout_resolution,
                                                 rh);
   }
   if (GNUNET_SYSERR != ret)
@@ -1293,15 +1345,47 @@ vpn_allocation_cb (void *cls,
 
 
 /**
+ * We have resolved one or more of the nameservers for a
+ * GNS2DNS lookup.  Once we have some of them, begin using
+ * the DNSSTUB resolver.
+ *
+ * @param ac context for GNS2DNS resolution
+ */
+static void
+continue_with_gns2dns (struct AuthorityChain *ac)
+{
+  struct GNS_ResolverHandle *rh = ac->rh;
+
+  if ( (NULL != ac->authority_info.dns_authority.gp_head) &&
+       (GNUNET_NO == ac->authority_info.dns_authority.found) )
+    return; /* more pending and none found yet */
+  if (GNUNET_NO == ac->authority_info.dns_authority.found)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Failed to resolve DNS server for `%s' in GNS2DNS resolution\n",
+                ac->authority_info.dns_authority.name);
+    fail_resolution (rh);
+    return;
+  }
+  if (GNUNET_NO != ac->authority_info.dns_authority.launched)
+    return; /* already running, do not launch again! */
+  /* recurse */
+  ac->authority_info.dns_authority.launched = GNUNET_YES;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Will continue resolution using DNS to resolve `%s'\n",
+              ac->label);
+  GNUNET_assert (NULL == rh->task_id);
+  rh->task_id = GNUNET_SCHEDULER_add_now (&recursive_resolution,
+                                          rh);
+
+}
+
+
+/**
  * We've resolved the IP address for the DNS resolver to use
  * after encountering a GNS2DNS record.
  *
- * TODO: Right now we only foward the request to ONE DNS resolver,
- * even if we get multiple IP addresses back; a correct implementation
- * should try all DNS resolvers.
- *
- * @param cls the `struct GNS_ResolverHandle` where we encountered
- *            the GNS2DNS record
+ * @param cls the `struct Gns2DnsPending` used for this request
  * @param rd_count number of records in @a rd
  * @param rd addresses for the DNS resolver  (presumably)
  */
@@ -1310,136 +1394,96 @@ handle_gns2dns_result (void *cls,
                        unsigned int rd_count,
                        const struct GNUNET_GNSRECORD_Data *rd)
 {
-  struct GNS_ResolverHandle *rh = cls;
-  struct AuthorityChain *ac;
-  struct sockaddr *sa;
-  struct sockaddr_in v4;
-  struct sockaddr_in6 v6;
-  size_t sa_len;
-
-  /* find suitable A/AAAA record */
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Received %u results for IP address of DNS server for GNS2DNS transition\n",
-              rd_count);
-  /* enable cleanup of 'rh' handle that comes next... */
-  if (NULL != rh->g2dc->rh)
+  struct Gns2DnsPending *gp = cls;
+  struct AuthorityChain *ac = gp->ac;
+
+  GNUNET_CONTAINER_DLL_remove (ac->authority_info.dns_authority.gp_head,
+                               ac->authority_info.dns_authority.gp_tail,
+                               gp);
+  /* enable cleanup of 'rh' handle that automatically comes after we return,
+     and which expects 'rh' to be in the #rlh_head DLL. */
+  if (NULL != gp->rh)
   {
     GNUNET_CONTAINER_DLL_insert (rlh_head,
                                  rlh_tail,
-                                 rh->g2dc->rh);
-    rh->g2dc->rh = NULL;
+                                 gp->rh);
+    gp->rh = NULL;
   }
-  sa = NULL;
-  sa_len = 0;
+  GNUNET_free (gp);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received %u results for IP address of DNS server for GNS2DNS transition\n",
+              rd_count);
+  /* find suitable A/AAAA record */
   for (unsigned int j=0;j<rd_count;j++)
   {
     switch (rd[j].record_type)
     {
     case GNUNET_DNSPARSER_TYPE_A:
-      if (sizeof (struct in_addr) != rd[j].data_size)
       {
-        GNUNET_break_op (0);
-        rh->proc (rh->proc_cls, 0, NULL);
-        GNS_resolver_lookup_cancel (rh);
-        return;
-      }
-      /* FIXME: might want to check if we support IPv4 here,
-         and otherwise skip this one and hope we find another */
-      memset (&v4, 0, sizeof (v4));
-      sa_len = sizeof (v4);
-      v4.sin_family = AF_INET;
-      v4.sin_port = htons (53);
+        struct sockaddr_in v4;
+
+        if (sizeof (struct in_addr) != rd[j].data_size)
+        {
+          GNUNET_break_op (0);
+          continue;
+        }
+        memset (&v4,
+                0,
+                sizeof (v4));
+        v4.sin_family = AF_INET;
+        v4.sin_port = htons (53);
 #if HAVE_SOCKADDR_IN_SIN_LEN
-      v4.sin_len = (u_char) sa_len;
+        v4.sin_len = (u_char) sizeof (v4);
 #endif
-      GNUNET_memcpy (&v4.sin_addr,
-              rd[j].data,
-              sizeof (struct in_addr));
-      sa = (struct sockaddr *) &v4;
-      break;
+        GNUNET_memcpy (&v4.sin_addr,
+                       rd[j].data,
+                       sizeof (struct in_addr));
+        if (GNUNET_OK ==
+            GNUNET_DNSSTUB_add_dns_sa (ac->authority_info.dns_authority.dns_handle,
+                                       (const struct sockaddr *) &v4))
+          ac->authority_info.dns_authority.found = GNUNET_YES;
+        break;
+      }
     case GNUNET_DNSPARSER_TYPE_AAAA:
-      if (sizeof (struct in6_addr) != rd[j].data_size)
       {
-        GNUNET_break_op (0);
-        rh->proc (rh->proc_cls, 0, NULL);
-        GNS_resolver_lookup_cancel (rh);
-        return;
-      }
-      /* FIXME: might want to check if we support IPv6 here,
-         and otherwise skip this one and hope we find another */
-      memset (&v6, 0, sizeof (v6));
-      sa_len = sizeof (v6);
-      v6.sin6_family = AF_INET6;
-      v6.sin6_port = htons (53);
+        struct sockaddr_in6 v6;
+
+        if (sizeof (struct in6_addr) != rd[j].data_size)
+        {
+          GNUNET_break_op (0);
+          continue;
+        }
+        /* FIXME: might want to check if we support IPv6 here,
+           and otherwise skip this one and hope we find another */
+        memset (&v6,
+                0,
+                sizeof (v6));
+        v6.sin6_family = AF_INET6;
+        v6.sin6_port = htons (53);
 #if HAVE_SOCKADDR_IN_SIN_LEN
-      v6.sin6_len = (u_char) sa_len;
+        v6.sin6_len = (u_char) sizeof (v6);
 #endif
-      GNUNET_memcpy (&v6.sin6_addr,
-              rd[j].data,
-              sizeof (struct in6_addr));
-      sa = (struct sockaddr *) &v6;
-      break;
+        GNUNET_memcpy (&v6.sin6_addr,
+                       rd[j].data,
+                       sizeof (struct in6_addr));
+        if (GNUNET_OK ==
+            GNUNET_DNSSTUB_add_dns_sa (ac->authority_info.dns_authority.dns_handle,
+                                       (const struct sockaddr *) &v6))
+          ac->authority_info.dns_authority.found = GNUNET_YES;
+        break;
+      }
     default:
       break;
     }
-    if (NULL != sa)
-      break;
-  }
-  if (NULL == sa)
-  {
-    /* we cannot continue; NS without A/AAAA */
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
-    return;
   }
-  /* expand authority chain */
-  ac = GNUNET_new (struct AuthorityChain);
-  ac->rh = rh;
-  GNUNET_assert (strlen (rh->g2dc->ns) <= GNUNET_DNSPARSER_MAX_NAME_LENGTH);
-  strcpy (ac->authority_info.dns_authority.name,
-          rh->g2dc->ns);
-  GNUNET_memcpy (&ac->authority_info.dns_authority.dns_ip,
-          sa,
-          sa_len);
-  /* for DNS recursion, the label is the full DNS name,
-     created from the remainder of the GNS name and the
-     name in the NS record */
-  GNUNET_asprintf (&ac->label,
-                   "%.*s%s%s",
-                   (int) rh->name_resolution_pos,
-                   rh->name,
-                   (0 != rh->name_resolution_pos) ? "." : "",
-                   rh->g2dc->ns);
-  GNUNET_free (rh->g2dc->ns);
-  GNUNET_free (rh->g2dc);
-  rh->g2dc = NULL;
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Will continue resolution using DNS server `%s' to resolve `%s'\n",
-              GNUNET_a2s (sa,
-                          sa_len),
-              ac->label);
-  GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
-                                    rh->ac_tail,
-                                    ac);
-  if (strlen (ac->label) > GNUNET_DNSPARSER_MAX_NAME_LENGTH)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                _("GNS lookup resulted in DNS name that is too long (`%s')\n"),
-                ac->label);
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
-    return;
-  }
-  /* recurse */
-  rh->task_id = GNUNET_SCHEDULER_add_now (&recursive_resolution,
-                                          rh);
+  continue_with_gns2dns (ac);
 }
 
 
 /**
  * Function called by the resolver for each address obtained from DNS.
  *
- * @param cls closure, a `struct Gns2DnsContext *`
+ * @param cls closure, a `struct Gns2DnsPending *`
  * @param addr one of the addresses of the host, NULL for the last address
  * @param addrlen length of @a addr
  */
@@ -1448,57 +1492,270 @@ handle_gns2dns_ip (void *cls,
                    const struct sockaddr *addr,
                    socklen_t addrlen)
 {
-  struct Gns2DnsContext *g2dc = cls;
-  struct GNUNET_GNSRECORD_Data rd;
-
+  struct Gns2DnsPending *gp = cls;
+  struct AuthorityChain *ac = gp->ac;
+
+  GNUNET_RESOLVER_request_cancel (gp->dns_rh);
+  GNUNET_CONTAINER_DLL_remove (ac->authority_info.dns_authority.gp_head,
+                               ac->authority_info.dns_authority.gp_tail,
+                               gp);
+  GNUNET_free (gp);
   if (NULL == addr)
   {
     /* DNS resolution failed */
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "Failed to use DNS to resolve name of DNS resolver\n");
-    g2dc->rh->g2dc = NULL;
-    fail_resolution (g2dc->rh);
-    GNUNET_free (g2dc);
   }
-  switch (addr->sa_family)
+  else
   {
-  case AF_INET:
+    if (GNUNET_OK ==
+        GNUNET_DNSSTUB_add_dns_sa (ac->authority_info.dns_authority.dns_handle,
+                                   addr))
+      ac->authority_info.dns_authority.found = GNUNET_YES;
+  }
+  continue_with_gns2dns (ac);
+}
+
+
+/**
+ * We found a CNAME record, perform recursive resolution on it.
+ *
+ * @param rh resolution handle
+ * @param rd record with CNAME to resolve recursively
+ */
+static void
+recursive_cname_resolution (struct GNS_ResolverHandle *rh,
+                            const struct GNUNET_GNSRECORD_Data *rd)
+{
+  char *cname;
+  size_t off;
+
+  off = 0;
+  cname = GNUNET_DNSPARSER_parse_name (rd->data,
+                                       rd->data_size,
+                                       &off);
+  if ( (NULL == cname) ||
+       (off != rd->data_size) )
+  {
+    GNUNET_break_op (0); /* record not well-formed */
+    GNUNET_free_non_null (cname);
+    fail_resolution (rh);
+    return;
+  }
+  handle_gns_cname_result (rh,
+                           cname);
+  GNUNET_free (cname);
+}
+
+
+/**
+ * We found a PKEY record, perform recursive resolution on it.
+ *
+ * @param rh resolution handle
+ * @param rd record with PKEY to resolve recursively
+ */
+static void
+recursive_pkey_resolution (struct GNS_ResolverHandle *rh,
+                           const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct AuthorityChain *ac;
+
+  /* delegation to another zone */
+  if (sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey) !=
+      rd->data_size)
+  {
+    GNUNET_break_op (0);
+    fail_resolution (rh);
+    return;
+  }
+  /* expand authority chain */
+  ac = GNUNET_new (struct AuthorityChain);
+  ac->rh = rh;
+  ac->gns_authority = GNUNET_YES;
+  ac->suggested_shortening_label = NULL;
+  ac->shortening_started = GNUNET_NO;
+  GNUNET_memcpy (&ac->authority_info.gns_authority,
+                 rd->data,
+                 sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey));
+  ac->label = resolver_lookup_get_next_label (rh);
+  /* add AC to tail */
+  GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
+                                    rh->ac_tail,
+                                    ac);
+  /* recurse */
+  rh->task_id = GNUNET_SCHEDULER_add_now (&recursive_resolution,
+                                          rh);
+}
+
+
+/**
+ * We found one or more GNS2DNS records, perform recursive resolution on it.
+ * (to be precise, one or more records in @a rd is GNS2DNS, there may be others,
+ * so this function still needs to check which ones are GNS2DNS).
+ *
+ * @param rh resolution handle
+ * @param rd_count length of the @a rd array
+ * @param rd record with PKEY to resolve recursively
+ * @return #GNUNET_OK if this worked, #GNUNET_SYSERR if no GNS2DNS records were in @a rd
+ */
+static int
+recursive_gns2dns_resolution (struct GNS_ResolverHandle *rh,
+                              unsigned int rd_count,
+                              const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct AuthorityChain *ac;
+  const char *tld;
+  char *ns;
+
+  ns = NULL;
+  /* expand authority chain */
+  ac = GNUNET_new (struct AuthorityChain);
+  ac->rh = rh;
+  ac->authority_info.dns_authority.dns_handle = GNUNET_DNSSTUB_start (4);
+
+  for (unsigned int i=0;i<rd_count;i++)
+  {
+    char *ip;
+    char *n;
+    size_t off;
+    struct Gns2DnsPending *gp;
+    struct GNUNET_CRYPTO_EcdsaPublicKey zone;
+
+    if (GNUNET_GNSRECORD_TYPE_GNS2DNS != rd[i].record_type)
+      continue;
+    off = 0;
+    n = GNUNET_DNSPARSER_parse_name (rd[i].data,
+                                     rd[i].data_size,
+                                     &off);
+    ip = GNUNET_DNSPARSER_parse_name (rd[i].data,
+                                      rd[i].data_size,
+                                      &off);
+    if ( (NULL == n) ||
+         (NULL == ip) ||
+         (off != rd[i].data_size) )
     {
-      const struct sockaddr_in *v4 = (const struct sockaddr_in *) addr;
-
-      GNUNET_assert (sizeof (*v4) == addrlen);
-      rd.data = v4;
-      rd.data_size = sizeof (*v4);
-      rd.expiration_time = UINT64_MAX;
-      rd.record_type = GNUNET_DNSPARSER_TYPE_A;
-      rd.flags = 0;
-      break;
+      GNUNET_break_op (0);
+      GNUNET_free_non_null (n);
+      GNUNET_free_non_null (ip);
+      continue;
     }
-  case AF_INET6:
+    /* resolve 'ip' to determine the IP(s) of the DNS
+       resolver to use for lookup of 'ns' */
+    if (NULL != ns)
     {
-      const struct sockaddr_in6 *v6 = (const struct sockaddr_in6 *) addr;
-
-      GNUNET_assert (sizeof (*v6) == addrlen);
-      rd.data = v6;
-      rd.data_size = sizeof (v6);
-      rd.expiration_time = UINT64_MAX;
-      rd.record_type = GNUNET_DNSPARSER_TYPE_AAAA;
-      rd.flags = 0;
-      break;
+      if (0 != strcasecmp (ns,
+                           n))
+      {
+        /* NS values must all be the same for all GNS2DNS records,
+           anything else leads to insanity */
+        GNUNET_break_op (0);
+        GNUNET_free (n);
+        GNUNET_free (ip);
+        continue;
+      }
+      GNUNET_free (n);
+    }
+    else
+    {
+      ns = n;
     }
-  default:
-    return;
-  }
-  GNUNET_RESOLVER_request_cancel (g2dc->dns_rh);
-  g2dc->dns_rh = NULL;
-  handle_gns2dns_result (g2dc->rh,
-                         1,
-                         &rd);
 
+    /* check if 'ip' is already an IPv4/IPv6 address */
+    if (GNUNET_OK ==
+        GNUNET_DNSSTUB_add_dns_ip (ac->authority_info.dns_authority.dns_handle,
+                                   ip))
+    {
+      ac->authority_info.dns_authority.found = GNUNET_YES;
+      GNUNET_free (ip);
+      continue;
+    }
+    tld = GNS_get_tld (ip);
+    if (0 != strcmp (tld,
+                     "+"))
+    {
+      /* 'ip' is a DNS name */
+      gp = GNUNET_new (struct Gns2DnsPending);
+      gp->ac = ac;
+      GNUNET_CONTAINER_DLL_insert (ac->authority_info.dns_authority.gp_head,
+                                   ac->authority_info.dns_authority.gp_tail,
+                                   gp);
+      gp->dns_rh = GNUNET_RESOLVER_ip_get (ip,
+                                           AF_UNSPEC,
+                                           GNUNET_TIME_UNIT_FOREVER_REL,
+                                           &handle_gns2dns_ip,
+                                           gp);
+      GNUNET_free (ip);
+      continue;
+    }
+    /* 'ip' should be a GNS name */
+    gp = GNUNET_new (struct Gns2DnsPending);
+    gp->ac = ac;
+    GNUNET_CONTAINER_DLL_insert (ac->authority_info.dns_authority.gp_head,
+                                 ac->authority_info.dns_authority.gp_tail,
+                                 gp);
+    gp->rh = GNUNET_new (struct GNS_ResolverHandle);
+    ip = translate_dot_plus (rh,
+                             ip);
+    tld = GNS_get_tld (ip);
+    if (GNUNET_OK !=
+        GNUNET_GNSRECORD_zkey_to_pkey (tld,
+                                       &zone))
+    {
+      GNUNET_break_op (0);
+      GNUNET_free (ip);
+      continue;
+    }
+    gp->rh->authority_zone = zone;
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Resolving `%s' to determine IP address of DNS server for GNS2DNS transition for `%s'\n",
+                ip,
+                ns);
+    gp->rh->name = ip;
+    gp->rh->name_resolution_pos = strlen (ip) - strlen (tld) - 1;
+    gp->rh->proc = &handle_gns2dns_result;
+    gp->rh->proc_cls = gp;
+    gp->rh->record_type = GNUNET_GNSRECORD_TYPE_ANY;
+    gp->rh->options = GNUNET_GNS_LO_DEFAULT;
+    gp->rh->loop_limiter = rh->loop_limiter + 1;
+    gp->rh->task_id
+      = GNUNET_SCHEDULER_add_now (&start_resolver_lookup,
+                                  gp->rh);
+  } /* end 'for all records' */
+
+  if (NULL == ns)
+  {
+    /* not a single GNS2DNS record found */
+    GNUNET_free (ac);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_assert (strlen (ns) <= GNUNET_DNSPARSER_MAX_NAME_LENGTH);
+  strcpy (ac->authority_info.dns_authority.name,
+          ns);
+  /* for DNS recursion, the label is the full DNS name,
+     created from the remainder of the GNS name and the
+     name in the NS record */
+  GNUNET_asprintf (&ac->label,
+                   "%.*s%s%s",
+                   (int) rh->name_resolution_pos,
+                   rh->name,
+                   (0 != rh->name_resolution_pos) ? "." : "",
+                   ns);
+  GNUNET_free (ns);
+  GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
+                                    rh->ac_tail,
+                                    ac);
+  if (strlen (ac->label) > GNUNET_DNSPARSER_MAX_NAME_LENGTH)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _("GNS lookup resulted in DNS name that is too long (`%s')\n"),
+                ac->label);
+    return GNUNET_SYSERR;
+  }
+  continue_with_gns2dns (ac);
+  return GNUNET_OK;
 }
 
 
-
 /**
  * Process a records that were decrypted from a block.
  *
@@ -1512,7 +1769,6 @@ handle_gns_resolution_result (void *cls,
                               const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct GNS_ResolverHandle *rh = cls;
-  struct AuthorityChain *ac;
   struct AuthorityChain *shorten_ac;
   char *cname;
   struct VpnContext *vpn_ctx;
@@ -1532,6 +1788,14 @@ handle_gns_resolution_result (void *cls,
               rh->ac_tail->label,
               GNUNET_GNSRECORD_z2s (&rh->ac_tail->authority_info.gns_authority),
               rd_count);
+  if (0 == rd_count)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _("GNS lookup failed (zero records found)\n"));
+    fail_resolution (rh);
+    return;
+  }
+
   if (0 == rh->name_resolution_pos)
   {
     /* top-level match, are we done yet? */
@@ -1547,9 +1811,8 @@ handle_gns_resolution_result (void *cls,
            (off != rd[0].data_size) )
       {
         GNUNET_break_op (0);
-        rh->proc (rh->proc_cls, 0, NULL);
-        GNS_resolver_lookup_cancel (rh);
         GNUNET_free_non_null (cname);
+        fail_resolution (rh);
         return;
       }
       handle_gns_cname_result (rh,
@@ -1573,8 +1836,7 @@ handle_gns_resolution_result (void *cls,
                 rd[i].data_size)
             {
               GNUNET_break_op (0);
-              rh->proc (rh->proc_cls, 0, NULL);
-              GNS_resolver_lookup_cancel (rh);
+              fail_resolution (rh);
               return;
             }
             vpn = (const struct GNUNET_TUN_GnsVpnRecord *) rd[i].data;
@@ -1582,8 +1844,7 @@ handle_gns_resolution_result (void *cls,
             if ('\0' != vname[rd[i].data_size - 1 - sizeof (struct GNUNET_TUN_GnsVpnRecord)])
             {
               GNUNET_break_op (0);
-              rh->proc (rh->proc_cls, 0, NULL);
-              GNS_resolver_lookup_cancel (rh);
+              fail_resolution (rh);
               return;
             }
             GNUNET_TUN_service_name_to_hash (vname,
@@ -1621,7 +1882,13 @@ handle_gns_resolution_result (void *cls,
             /* delegation to DNS */
             GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                         "Found GNS2DNS record, delegating to DNS!\n");
-            goto do_recurse;
+            if (GNUNET_OK ==
+                recursive_gns2dns_resolution (rh,
+                                              rd_count,
+                                              rd))
+              return;
+            else
+              goto fail;
           }
         default:
           break;
@@ -1823,18 +2090,20 @@ handle_gns_resolution_result (void *cls,
             GNUNET_break_op (0);
             break;
           }
-          GNUNET_memcpy (&pub, rd[i].data, rd[i].data_size);
+          GNUNET_memcpy (&pub,
+                         rd[i].data,
+                         rd[i].data_size);
           rd_off++;
           if (GNUNET_GNSRECORD_TYPE_PKEY != rh->record_type)
           {
-            /* try to resolve "+" */
+            /* try to resolve "@" */
             struct AuthorityChain *ac;
 
             ac = GNUNET_new (struct AuthorityChain);
             ac->rh = rh;
             ac->gns_authority = GNUNET_YES;
             ac->authority_info.gns_authority = pub;
-            ac->label = GNUNET_strdup (GNUNET_GNS_MASTERZONE_STR);
+            ac->label = GNUNET_strdup (GNUNET_GNS_EMPTY_LABEL_AT);
             ac->suggested_shortening_label = NULL;
             ac->shortening_started = GNUNET_NO;
             GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
@@ -1856,7 +2125,13 @@ handle_gns_resolution_result (void *cls,
           }
           GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                       "Found GNS2DNS record, delegating to DNS!\n");
-          goto do_recurse;
+          if (GNUNET_OK ==
+              recursive_gns2dns_resolution (rh,
+                                            rd_count,
+                                            rd))
+            return;
+          else
+            goto fail;
         }
       case GNUNET_GNSRECORD_TYPE_BOX:
         {
@@ -1901,200 +2176,35 @@ handle_gns_resolution_result (void *cls,
     rh->proc (rh->proc_cls,
               rd_off,
               rd_new);
-    GNS_resolver_lookup_cancel (rh);
+    rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                            rh);
     return;
   }
- do_recurse:
-  /* need to recurse, check if we can */
-  for (unsigned int i=0;i<rd_count;i++)
+
+  switch (rd[0].record_type)
   {
-    switch (rd[i].record_type)
-    {
-    case GNUNET_GNSRECORD_TYPE_PKEY:
-      /* delegation to another zone */
-      if (sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey) !=
-          rd[i].data_size)
-      {
-        GNUNET_break_op (0);
-        rh->proc (rh->proc_cls, 0, NULL);
-        GNS_resolver_lookup_cancel (rh);
-        return;
-      }
-      /* expand authority chain */
-      ac = GNUNET_new (struct AuthorityChain);
-      ac->rh = rh;
-      ac->gns_authority = GNUNET_YES;
-      ac->suggested_shortening_label = NULL;
-      ac->shortening_started = GNUNET_NO;
-      GNUNET_memcpy (&ac->authority_info.gns_authority,
-              rd[i].data,
-              sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey));
-      ac->label = resolver_lookup_get_next_label (rh);
-      /* add AC to tail */
-      GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
-                                        rh->ac_tail,
-                                        ac);
-      /* recurse */
-      rh->task_id = GNUNET_SCHEDULER_add_now (&recursive_resolution,
-                                              rh);
+  case GNUNET_DNSPARSER_TYPE_CNAME:
+    GNUNET_break_op (1 == rd_count); /* CNAME should be unique */
+    recursive_cname_resolution (rh,
+                                &rd[0]);
+    return;
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    GNUNET_break_op (1 == rd_count); /* PKEY should be unique */
+    recursive_pkey_resolution (rh,
+                               &rd[0]);
+    return;
+  default:
+    if (GNUNET_OK ==
+        recursive_gns2dns_resolution (rh,
+                                      rd_count,
+                                      rd))
       return;
-    case GNUNET_GNSRECORD_TYPE_GNS2DNS:
-      {
-        /* TODO: Right now we only foward the request to ONE DNS resolver,
-           even if we get multiple IP addresses back; a correct implementation
-           should try all DNS resolvers. */
-        /* resolution continues within DNS */
-        struct Gns2DnsContext *g2dc;
-        char *ip;
-        char *ns;
-        const char *tld;
-        struct GNUNET_CRYPTO_EcdsaPublicKey zone;
-        struct in_addr v4;
-        struct in6_addr v6;
-
-        off = 0;
-        ns = GNUNET_DNSPARSER_parse_name (rd[i].data,
-                                          rd[i].data_size,
-                                          &off);
-        ip = GNUNET_DNSPARSER_parse_name (rd[i].data,
-                                          rd[i].data_size,
-                                          &off);
-        if ( (NULL == ns) ||
-             (NULL == ip) ||
-             (off != rd[i].data_size) )
-        {
-          GNUNET_break_op (0);
-          GNUNET_free_non_null (ns);
-          GNUNET_free_non_null (ip);
-          fail_resolution (rh);
-          return;
-        }
-        /* resolve 'ip' to determine the IP(s) of the DNS
-           resolver to use for lookup of 'ns' */
-        g2dc = GNUNET_new (struct Gns2DnsContext);
-        g2dc->ns = ns;
-        rh->g2dc = g2dc;
-
-        /* check if 'ip' is already an IPv4/IPv6 address */
-        if (1 == inet_pton (AF_INET,
-                            ip,
-                            &v4))
-        {
-          /* name is IPv4 address, pretend it's an A record */
-          struct GNUNET_GNSRECORD_Data rd;
-
-          GNUNET_free (ip);
-          rd.data = &v4;
-          rd.data_size = sizeof (v4);
-          rd.expiration_time = UINT64_MAX;
-          rd.record_type = GNUNET_DNSPARSER_TYPE_A;
-          rd.flags = 0;
-          handle_gns2dns_result (rh,
-                                 1,
-                                 &rd);
-          return;
-        }
-        if (1 == inet_pton (AF_INET6,
-                            ip,
-                            &v6))
-        {
-          /* name is IPv6 address, pretend it's an AAAA record */
-          struct GNUNET_GNSRECORD_Data rd;
-
-          GNUNET_free (ip);
-          rd.data = &v6;
-          rd.data_size = sizeof (v6);
-          rd.expiration_time = UINT64_MAX;
-          rd.record_type = GNUNET_DNSPARSER_TYPE_AAAA;
-          rd.flags = 0;
-          handle_gns2dns_result (rh,
-                                 1,
-                                 &rd);
-          return;
-        }
-
-        tld = GNS_get_tld (ip);
-        if (0 != strcmp (tld,
-                         "+"))
-        {
-          /* 'ip' is a DNS name */
-          g2dc->dns_rh = GNUNET_RESOLVER_ip_get (ip,
-                                                 AF_UNSPEC,
-                                                 GNUNET_TIME_UNIT_FOREVER_REL,
-                                                 &handle_gns2dns_ip,
-                                                 g2dc);
-          GNUNET_free (ip);
-          return;
-        }
-
-        /* 'ip' should be a GNS name */
-        g2dc->rh = GNUNET_new (struct GNS_ResolverHandle);
-
-        ip = translate_dot_plus (rh,
-                                 ip);
-        tld = GNS_get_tld (ip);
-        if (GNUNET_OK !=
-            GNUNET_GNSRECORD_zkey_to_pkey (tld,
-                                           &zone))
-        {
-          GNUNET_break_op (0);
-          GNUNET_free_non_null (ns);
-          GNUNET_free_non_null (ip);
-          GNUNET_free (g2dc);
-          fail_resolution (rh);
-          return;
-        }
-        g2dc->rh->authority_zone = zone;
-        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                    "Resolving `%s' to determine IP address of DNS server for GNS2DNS transition for `%s'\n",
-                    ip,
-                    ns);
-        g2dc->rh->name = ip;
-        g2dc->rh->name_resolution_pos = strlen (ip) - strlen (tld) - 1;
-        g2dc->rh->proc = &handle_gns2dns_result;
-        g2dc->rh->proc_cls = rh;
-        g2dc->rh->record_type = GNUNET_GNSRECORD_TYPE_ANY;
-        g2dc->rh->options = GNUNET_GNS_LO_DEFAULT;
-        g2dc->rh->loop_limiter = rh->loop_limiter + 1;
-        g2dc->rh->task_id
-          = GNUNET_SCHEDULER_add_now (&start_resolver_lookup,
-                                      g2dc->rh);
-        return;
-      }
-    case GNUNET_DNSPARSER_TYPE_CNAME:
-      {
-        char *cname;
-
-        off = 0;
-        cname = GNUNET_DNSPARSER_parse_name (rd[i].data,
-                                             rd[i].data_size,
-                                             &off);
-        if ( (NULL == cname) ||
-             (off != rd[i].data_size) )
-        {
-          GNUNET_break_op (0); /* record not well-formed */
-          rh->proc (rh->proc_cls, 0, NULL);
-          GNS_resolver_lookup_cancel (rh);
-          GNUNET_free_non_null (cname);
-          return;
-        }
-        handle_gns_cname_result (rh,
-                                 cname);
-        GNUNET_free (cname);
-        return;
-      }
-      /* FIXME: handle DNAME */
-    default:
-      /* skip */
-      break;
-    }
+    break;
   }
+ fail:
   GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
               _("GNS lookup recursion failed (no delegation record found)\n"));
-  rh->proc (rh->proc_cls,
-            0,
-            NULL);
-  GNS_resolver_lookup_cancel (rh);
+  fail_resolution (rh);
 }
 
 
@@ -2176,8 +2286,7 @@ handle_dht_response (void *cls,
   {
     /* how did this pass DHT block validation!? */
     GNUNET_break (0);
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   block = data;
@@ -2188,8 +2297,7 @@ handle_dht_response (void *cls,
   {
     /* how did this pass DHT block validation!? */
     GNUNET_break (0);
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   if (GNUNET_OK !=
@@ -2200,8 +2308,7 @@ handle_dht_response (void *cls,
                                       rh))
   {
     GNUNET_break_op (0); /* block was ill-formed */
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   if (0 == GNUNET_TIME_absolute_get_remaining (GNUNET_TIME_absolute_ntoh (block->expiration_time)).rel_value_us)
@@ -2252,8 +2359,7 @@ start_dht_request (struct GNS_ResolverHandle *rh,
     /* fail longest-standing DHT request */
     rx = GNUNET_CONTAINER_heap_peek (dht_lookup_heap);
     GNUNET_assert (NULL != rx);
-    rx->proc (rx->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rx);
+    fail_resolution (rx);
   }
 }
 
@@ -2324,8 +2430,7 @@ handle_namecache_block_response (void *cls,
                 "Resolution failed for `%s' in zone %s (DHT lookup not permitted by configuration)\n",
                 ac->label,
                 GNUNET_GNSRECORD_z2s (&ac->authority_info.gns_authority));
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -2373,7 +2478,7 @@ recursive_gns_resolution_namecache (struct GNS_ResolverHandle *rh)
   GNUNET_GNSRECORD_query_from_public_key (&ac->authority_info.gns_authority,
                                           ac->label,
                                           &query);
-  if (GNUNET_YES == use_cache)
+  if (GNUNET_YES != disable_cache)
   {
     rh->namecache_qe
       = GNUNET_NAMECACHE_lookup_block (namecache_handle,
@@ -2384,7 +2489,8 @@ recursive_gns_resolution_namecache (struct GNS_ResolverHandle *rh)
   }
   else
   {
-    start_dht_request (rh, &query);
+    start_dht_request (rh,
+                       &query);
   }
 }
 
@@ -2408,8 +2514,7 @@ handle_revocation_result (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 _("Zone %s was revoked, resolution fails\n"),
                 GNUNET_GNSRECORD_z2s (&ac->authority_info.gns_authority));
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   recursive_gns_resolution_namecache (rh);
@@ -2453,8 +2558,7 @@ recursive_resolution (void *cls)
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "Encountered unbounded recursion resolving `%s'\n",
                 rh->name);
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   if (GNUNET_YES == rh->ac_tail->gns_authority)
@@ -2491,8 +2595,12 @@ start_resolver_lookup (void *cls)
     rd.expiration_time = UINT64_MAX;
     rd.record_type = GNUNET_DNSPARSER_TYPE_A;
     rd.flags = 0;
-    rh->proc (rh->proc_cls, 1, &rd);
-    GNS_resolver_lookup_cancel (rh);
+    rh->proc (rh->proc_cls,
+              1,
+              &rd);
+    GNUNET_assert (NULL == rh->task_id);
+    rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                            rh);
     return;
   }
   if (1 == inet_pton (AF_INET6,
@@ -2507,8 +2615,12 @@ start_resolver_lookup (void *cls)
     rd.expiration_time = UINT64_MAX;
     rd.record_type = GNUNET_DNSPARSER_TYPE_AAAA;
     rd.flags = 0;
-    rh->proc (rh->proc_cls, 1, &rd);
-    GNS_resolver_lookup_cancel (rh);
+    rh->proc (rh->proc_cls,
+              1,
+              &rd);
+    GNUNET_assert (NULL == rh->task_id);
+    rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                            rh);
     return;
   }
 
@@ -2518,8 +2630,8 @@ start_resolver_lookup (void *cls)
   ac->suggested_shortening_label = NULL;
   if (NULL == ac->label)
     /* name was just the "TLD", so we default to label
-       #GNUNET_GNS_MASTERZONE_STR */
-    ac->label = GNUNET_strdup (GNUNET_GNS_MASTERZONE_STR);
+       #GNUNET_GNS_EMPTY_LABEL_AT */
+    ac->label = GNUNET_strdup (GNUNET_GNS_EMPTY_LABEL_AT);
   ac->gns_authority = GNUNET_YES;
   ac->authority_info.gns_authority = rh->authority_zone;
   GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
@@ -2587,37 +2699,51 @@ GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
   GNUNET_CONTAINER_DLL_remove (rlh_head,
                                rlh_tail,
                                rh);
+  if (NULL != rh->dns_request)
+  {
+    GNUNET_DNSSTUB_resolve_cancel (rh->dns_request);
+    rh->dns_request = NULL;
+  }
   while (NULL != (ac = rh->ac_head))
   {
     GNUNET_CONTAINER_DLL_remove (rh->ac_head,
                                  rh->ac_tail,
                                  ac);
+    if (GNUNET_NO == ac->gns_authority)
+    {
+      struct Gns2DnsPending *gp;
+
+      while (NULL != (gp = ac->authority_info.dns_authority.gp_head))
+      {
+        GNUNET_CONTAINER_DLL_remove (ac->authority_info.dns_authority.gp_head,
+                                     ac->authority_info.dns_authority.gp_tail,
+                                     gp);
+        if (NULL != gp->rh)
+        {
+          /* rh->g2dc->rh is NOT in the DLL yet, so to enable us
+             using GNS_resolver_lookup_cancel here, we need to
+             add it first... */
+          GNUNET_CONTAINER_DLL_insert (rlh_head,
+                                       rlh_tail,
+                                       gp->rh);
+          GNUNET_assert (NULL == gp->rh->task_id);
+          gp->rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                                      gp->rh);
+          gp->rh = NULL;
+        }
+        if (NULL != gp->dns_rh)
+        {
+          GNUNET_RESOLVER_request_cancel (gp->dns_rh);
+          gp->dns_rh = NULL;
+        }
+        GNUNET_free (gp);
+      }
+      GNUNET_DNSSTUB_stop (ac->authority_info.dns_authority.dns_handle);
+    }
     GNUNET_free (ac->label);
     GNUNET_free_non_null (ac->suggested_shortening_label);
     GNUNET_free (ac);
   }
-  if (NULL != rh->g2dc)
-  {
-    /* rh->g2dc->rh is NOT in the DLL yet, so to enable us
-       using GNS_resolver_lookup_cancel here, we need to
-       add it first... */
-    if (NULL != rh->g2dc->rh)
-    {
-      GNUNET_CONTAINER_DLL_insert (rlh_head,
-                                   rlh_tail,
-                                   rh->g2dc->rh);
-      GNS_resolver_lookup_cancel (rh->g2dc->rh);
-      rh->g2dc->rh = NULL;
-    }
-    if (NULL != rh->g2dc->dns_rh)
-    {
-      GNUNET_RESOLVER_request_cancel (rh->g2dc->dns_rh);
-      rh->g2dc->rh = NULL;
-    }
-    GNUNET_free (rh->g2dc->ns);
-    GNUNET_free (rh->g2dc);
-    rh->g2dc = NULL;
-  }
   if (NULL != rh->task_id)
   {
     GNUNET_SCHEDULER_cancel (rh->task_id);
@@ -2639,11 +2765,6 @@ GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
     GNUNET_free (vpn_ctx->rd_data);
     GNUNET_free (vpn_ctx);
   }
-  if (NULL != rh->dns_request)
-  {
-    GNUNET_DNSSTUB_resolve_cancel (rh->dns_request);
-    rh->dns_request = NULL;
-  }
   if (NULL != rh->namecache_qe)
   {
     GNUNET_NAMECACHE_cancel (rh->namecache_qe);
@@ -2690,34 +2811,18 @@ GNS_resolver_init (struct GNUNET_NAMECACHE_Handle *nc,
                    const struct GNUNET_CONFIGURATION_Handle *c,
                    unsigned long long max_bg_queries)
 {
-  char *dns_ip;
-
   cfg = c;
   namecache_handle = nc;
   dht_handle = dht;
   dht_lookup_heap =
     GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
   max_allowed_background_queries = max_bg_queries;
-  if (GNUNET_SYSERR == (use_cache =
-                        GNUNET_CONFIGURATION_get_value_yesno (c,
-                                                              "gns",
-                                                              "USE_CACHE")))
-    use_cache = GNUNET_YES;
-  if (GNUNET_NO == use_cache)
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+  disable_cache = GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                                        "namecache",
+                                                        "DISABLE");
+  if (GNUNET_YES == disable_cache)
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "Namecache disabled\n");
-
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_string (c,
-                                             "gns",
-                                             "DNS_RESOLVER",
-                                             &dns_ip))
-  {
-    /* user did not specify DNS resolver, use 8.8.8.8 */
-    dns_ip = GNUNET_strdup ("8.8.8.8");
-  }
-  dns_handle = GNUNET_DNSSTUB_start (dns_ip);
-  GNUNET_free (dns_ip);
   vpn_handle = GNUNET_VPN_connect (cfg);
 }
 
@@ -2734,7 +2839,9 @@ GNS_resolver_done ()
   /* abort active resolutions */
   while (NULL != (rh = rlh_head))
   {
-    rh->proc (rh->proc_cls, 0, NULL);
+    rh->proc (rh->proc_cls,
+              0,
+              NULL);
     GNS_resolver_lookup_cancel (rh);
   }
   while (NULL != (co = co_head))
@@ -2747,8 +2854,6 @@ GNS_resolver_done ()
   }
   GNUNET_CONTAINER_heap_destroy (dht_lookup_heap);
   dht_lookup_heap = NULL;
-  GNUNET_DNSSTUB_stop (dns_handle);
-  dns_handle = NULL;
   GNUNET_VPN_disconnect (vpn_handle);
   vpn_handle = NULL;
   dht_handle = NULL;
diff --git a/src/gns/test_gns_lookup.conf b/src/gns/test_gns_lookup.conf
index ea8c7c3fc..a9a2345c7 100644
--- a/src/gns/test_gns_lookup.conf
+++ b/src/gns/test_gns_lookup.conf
@@ -10,7 +10,7 @@ AUTOSTART = YES
 PLUGINS =
 
 [gns]
-#PREFIX = valgrind --leak-check=full --track-origins=yes
+# PREFIX = valgrind --leak-check=full --track-origins=yes
 AUTOSTART = YES
 AUTO_IMPORT_PKEY = YES
 MAX_PARALLEL_BACKGROUND_QUERIES = 10
diff --git a/src/gnsrecord/gnsrecord_crypto.c b/src/gnsrecord/gnsrecord_crypto.c
index 0fab97f06..cebc842f3 100644
--- a/src/gnsrecord/gnsrecord_crypto.c
+++ b/src/gnsrecord/gnsrecord_crypto.c
@@ -72,6 +72,7 @@ derive_block_aes_key (struct GNUNET_CRYPTO_SymmetricInitializationVector *iv,
  * Sign name and records
  *
  * @param key the private key
+ * @param pkey associated public key
  * @param expire block expiration
  * @param label the name for the records
  * @param rd record data
@@ -79,29 +80,29 @@ derive_block_aes_key (struct GNUNET_CRYPTO_SymmetricInitializationVector *iv,
  * @return NULL on error (block too large)
  */
 struct GNUNET_GNSRECORD_Block *
-GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
-                               struct GNUNET_TIME_Absolute expire,
-                               const char *label,
-                               const struct GNUNET_GNSRECORD_Data *rd,
-                               unsigned int rd_count)
+block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+              const struct GNUNET_CRYPTO_EcdsaPublicKey *pkey,
+              struct GNUNET_TIME_Absolute expire,
+              const char *label,
+              const struct GNUNET_GNSRECORD_Data *rd,
+              unsigned int rd_count)
 {
-  size_t payload_len = GNUNET_GNSRECORD_records_get_size (rd_count, rd);
+  size_t payload_len = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                          rd);
   char payload[sizeof (uint32_t) + payload_len];
   struct GNUNET_GNSRECORD_Block *block;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
   struct GNUNET_CRYPTO_EcdsaPrivateKey *dkey;
   struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
   struct GNUNET_CRYPTO_SymmetricSessionKey skey;
   struct GNUNET_GNSRECORD_Data rdc[rd_count];
   uint32_t rd_count_nbo;
-  unsigned int i;
   struct GNUNET_TIME_Absolute now;
 
   if (payload_len > GNUNET_GNSRECORD_MAX_BLOCK_SIZE)
     return NULL;
   /* convert relative to absolute times */
   now = GNUNET_TIME_absolute_get ();
-  for (i=0;i<rd_count;i++)
+  for (unsigned int i=0;i<rd_count;i++)
   {
     rdc[i] = rd[i];
     if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
@@ -116,13 +117,19 @@ GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
   }
   /* serialize */
   rd_count_nbo = htonl (rd_count);
-  GNUNET_memcpy (payload, &rd_count_nbo, sizeof (uint32_t));
+  GNUNET_memcpy (payload,
+                 &rd_count_nbo,
+                 sizeof (uint32_t));
   GNUNET_assert (payload_len ==
-                 GNUNET_GNSRECORD_records_serialize (rd_count, rdc,
-                                                     payload_len, &payload[sizeof (uint32_t)]));
+                 GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                     rdc,
+                                                     payload_len,
+                                                     &payload[sizeof (uint32_t)]));
   block = GNUNET_malloc (sizeof (struct GNUNET_GNSRECORD_Block) +
-                         sizeof (uint32_t) + payload_len);
-  block->purpose.size = htonl (sizeof (uint32_t) + payload_len +
+                         sizeof (uint32_t) +
+                         payload_len);
+  block->purpose.size = htonl (sizeof (uint32_t) +
+                               payload_len +
                                sizeof (struct GNUNET_CRYPTO_EccSignaturePurpose) +
                                sizeof (struct GNUNET_TIME_AbsoluteNBO));
   block->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
@@ -132,18 +139,21 @@ GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
                                                  label,
                                                  "gns");
   GNUNET_CRYPTO_ecdsa_key_get_public (dkey,
-                                    &block->derived_key);
-  GNUNET_CRYPTO_ecdsa_key_get_public (key,
-                                    &pkey);
-  derive_block_aes_key (&iv, &skey, label, &pkey);
+                                      &block->derived_key);
+  derive_block_aes_key (&iv,
+                        &skey,
+                        label,
+                        pkey);
   GNUNET_break (payload_len + sizeof (uint32_t) ==
-                GNUNET_CRYPTO_symmetric_encrypt (payload, payload_len + sizeof (uint32_t),
-                                                 &skey, &iv,
+                GNUNET_CRYPTO_symmetric_encrypt (payload,
+                                                 payload_len + sizeof (uint32_t),
+                                                 &skey,
+                                                 &iv,
                                                  &block[1]));
   if (GNUNET_OK !=
       GNUNET_CRYPTO_ecdsa_sign (dkey,
-                              &block->purpose,
-                              &block->signature))
+                                &block->purpose,
+                                &block->signature))
   {
     GNUNET_break (0);
     GNUNET_free (dkey);
@@ -156,6 +166,97 @@ GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
 
 
 /**
+ * Sign name and records
+ *
+ * @param key the private key
+ * @param expire block expiration
+ * @param label the name for the records
+ * @param rd record data
+ * @param rd_count number of records
+ * @return NULL on error (block too large)
+ */
+struct GNUNET_GNSRECORD_Block *
+GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+                               struct GNUNET_TIME_Absolute expire,
+                               const char *label,
+                               const struct GNUNET_GNSRECORD_Data *rd,
+                               unsigned int rd_count)
+{
+  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+
+  GNUNET_CRYPTO_ecdsa_key_get_public (key,
+                                      &pkey);
+  return block_create (key,
+                       &pkey,
+                       expire,
+                       label,
+                       rd,
+                       rd_count);
+}
+
+
+/**
+ * Line in cache mapping private keys to public keys.
+ */
+struct KeyCacheLine
+{
+  /**
+   * A private key.
+   */
+  struct GNUNET_CRYPTO_EcdsaPrivateKey key;
+
+  /**
+   * Associated public key.
+   */
+  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+
+};
+
+
+/**
+ * Sign name and records, cache derived public key (also keeps the
+ * private key in static memory, so do not use this function if
+ * keeping the private key in the process'es RAM is a major issue).
+ *
+ * @param key the private key
+ * @param expire block expiration
+ * @param label the name for the records
+ * @param rd record data
+ * @param rd_count number of records
+ * @return NULL on error (block too large)
+ */
+struct GNUNET_GNSRECORD_Block *
+GNUNET_GNSRECORD_block_create2 (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+                                struct GNUNET_TIME_Absolute expire,
+                                const char *label,
+                                const struct GNUNET_GNSRECORD_Data *rd,
+                                unsigned int rd_count)
+{
+#define CSIZE 64
+  static struct KeyCacheLine cache[CSIZE];
+  struct KeyCacheLine *line;
+
+  line = &cache[(*(unsigned int *) key) % CSIZE];
+  if (0 != memcmp (&line->key,
+                   key,
+                   sizeof (*key)))
+  {
+    /* cache miss, recompute */
+    line->key = *key;
+    GNUNET_CRYPTO_ecdsa_key_get_public (key,
+                                        &line->pkey);
+  }
+  return block_create (key,
+                       &line->pkey,
+                       expire,
+                       label,
+                       rd,
+                       rd_count);
+}
+
+
+
+/**
  * Check if a signature is valid.  This API is used by the GNS Block
  * to validate signatures received from the network.
  *
@@ -166,9 +267,9 @@ int
 GNUNET_GNSRECORD_block_verify (const struct GNUNET_GNSRECORD_Block *block)
 {
   return GNUNET_CRYPTO_ecdsa_verify (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN,
-                                   &block->purpose,
-                                   &block->signature,
-                                   &block->derived_key);
+                                     &block->purpose,
+                                     &block->signature,
+                                     &block->derived_key);
 }
 
 
@@ -224,9 +325,7 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
     }
     {
       struct GNUNET_GNSRECORD_Data rd[rd_count];
-      unsigned int i;
       unsigned int j;
-      unsigned int k;
       struct GNUNET_TIME_Absolute now;
 
       if (GNUNET_OK !=
@@ -241,7 +340,7 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
       /* hide expired records */
       now = GNUNET_TIME_absolute_get ();
       j = 0;
-      for (i=0;i<rd_count;i++)
+      for (unsigned int i=0;i<rd_count;i++)
       {
         if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
         {
@@ -254,7 +353,7 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
         {
           int include_record = GNUNET_YES;
           /* Shadow record, figure out if we have a not expired active record */
-          for (k=0;k<rd_count;k++)
+          for (unsigned int k=0;k<rd_count;k++)
           {
             if (k == i)
               continue;
@@ -283,7 +382,9 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
       }
       rd_count = j;
       if (NULL != proc)
-        proc (proc_cls, rd_count, (0 != rd_count) ? rd : NULL);
+        proc (proc_cls,
+              rd_count,
+              (0 != rd_count) ? rd : NULL);
     }
   }
   return GNUNET_OK;
@@ -304,8 +405,11 @@ GNUNET_GNSRECORD_query_from_private_key (const struct GNUNET_CRYPTO_EcdsaPrivate
 {
   struct GNUNET_CRYPTO_EcdsaPublicKey pub;
 
-  GNUNET_CRYPTO_ecdsa_key_get_public (zone, &pub);
-  GNUNET_GNSRECORD_query_from_public_key (&pub, label, query);
+  GNUNET_CRYPTO_ecdsa_key_get_public (zone,
+                                      &pub);
+  GNUNET_GNSRECORD_query_from_public_key (&pub,
+                                          label,
+                                          query);
 }
 
 
@@ -323,8 +427,13 @@ GNUNET_GNSRECORD_query_from_public_key (const struct GNUNET_CRYPTO_EcdsaPublicKe
 {
   struct GNUNET_CRYPTO_EcdsaPublicKey pd;
 
-  GNUNET_CRYPTO_ecdsa_public_key_derive (pub, label, "gns", &pd);
-  GNUNET_CRYPTO_hash (&pd, sizeof (pd), query);
+  GNUNET_CRYPTO_ecdsa_public_key_derive (pub,
+                                         label,
+                                         "gns",
+                                         &pd);
+  GNUNET_CRYPTO_hash (&pd,
+                      sizeof (pd),
+                      query);
 }
 
 
diff --git a/src/gnsrecord/gnsrecord_misc.c b/src/gnsrecord/gnsrecord_misc.c
index 3c1ead437..05f56cf70 100644
--- a/src/gnsrecord/gnsrecord_misc.c
+++ b/src/gnsrecord/gnsrecord_misc.c
@@ -152,8 +152,6 @@ struct GNUNET_TIME_Absolute
 GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
                                              const struct GNUNET_GNSRECORD_Data *rd)
 {
-  unsigned int c;
-  unsigned int c2;
   struct GNUNET_TIME_Absolute expire;
   struct GNUNET_TIME_Absolute at;
   struct GNUNET_TIME_Relative rt;
@@ -163,7 +161,7 @@ GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
   if (NULL == rd)
     return GNUNET_TIME_UNIT_ZERO_ABS;
   expire = GNUNET_TIME_UNIT_FOREVER_ABS;
-  for (c = 0; c < rd_count; c++)
+  for (unsigned int c = 0; c < rd_count; c++)
   {
     if (0 != (rd[c].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
     {
@@ -175,12 +173,12 @@ GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
       at.abs_value_us = rd[c].expiration_time;
     }
 
-    for (c2 = 0; c2 < rd_count; c2++)
+    for (unsigned int c2 = 0; c2 < rd_count; c2++)
     {
       /* Check for shadow record */
-      if ((c == c2) ||
-          (rd[c].record_type != rd[c2].record_type) ||
-          (0 == (rd[c2].flags & GNUNET_GNSRECORD_RF_SHADOW_RECORD)))
+      if ( (c == c2) ||
+           (rd[c].record_type != rd[c2].record_type) ||
+           (0 == (rd[c2].flags & GNUNET_GNSRECORD_RF_SHADOW_RECORD)) )
           continue;
       /* We have a shadow record */
       if (0 != (rd[c2].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
@@ -192,9 +190,11 @@ GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
       {
         at_shadow.abs_value_us = rd[c2].expiration_time;
       }
-      at = GNUNET_TIME_absolute_max (at, at_shadow);
+      at = GNUNET_TIME_absolute_max (at,
+                                     at_shadow);
     }
-    expire = GNUNET_TIME_absolute_min (at, expire);
+    expire = GNUNET_TIME_absolute_min (at, 
+                                       expire);
   }
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Determined expiration time for block with %u records to be %s\n",
diff --git a/src/gnsrecord/test_gnsrecord_crypto.c b/src/gnsrecord/test_gnsrecord_crypto.c
index 24fe2ad36..1df3f3730 100644
--- a/src/gnsrecord/test_gnsrecord_crypto.c
+++ b/src/gnsrecord/test_gnsrecord_crypto.c
@@ -52,11 +52,10 @@ static int res;
 static struct GNUNET_GNSRECORD_Data *
 create_record (int count)
 {
-  unsigned int c;
   struct GNUNET_GNSRECORD_Data *rd;
 
   rd = GNUNET_malloc (count * sizeof (struct GNUNET_GNSRECORD_Data));
-  for (c = 0; c < count; c++)
+  for (unsigned int c = 0; c < count; c++)
   {
     rd[c].expiration_time = GNUNET_TIME_absolute_get().abs_value_us + 1000000000;
     rd[c].record_type = TEST_RECORD_TYPE;
@@ -74,17 +73,19 @@ rd_decrypt_cb (void *cls,
                const struct GNUNET_GNSRECORD_Data *rd)
 {
   char rd_cmp_data[TEST_RECORD_DATALEN];
-  int c;
 
   GNUNET_assert (RECORDS == rd_count);
   GNUNET_assert (NULL != rd);
-
-  memset (rd_cmp_data, 'a', TEST_RECORD_DATALEN);
-  for (c = 0; c < rd_count; c++)
+  memset (rd_cmp_data,
+          'a',
+          TEST_RECORD_DATALEN);
+  for (unsigned int c = 0; c < rd_count; c++)
   {
     GNUNET_assert (TEST_RECORD_TYPE == rd[c].record_type);
     GNUNET_assert (TEST_RECORD_DATALEN == rd[c].data_size);
-    GNUNET_assert (0 == memcmp (&rd_cmp_data, rd[c].data, TEST_RECORD_DATALEN));
+    GNUNET_assert (0 == memcmp (&rd_cmp_data,
+                                rd[c].data,
+                                TEST_RECORD_DATALEN));
   }
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Block was decrypted successfully \n");
@@ -93,37 +94,53 @@ rd_decrypt_cb (void *cls,
 }
 
 static void
-run (void *cls, char *const *args, const char *cfgfile,
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
      const struct GNUNET_CONFIGURATION_Handle *cfg)
 {
   struct GNUNET_GNSRECORD_Block *block;
   struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+  struct GNUNET_HashCode query_pub;
+  struct GNUNET_HashCode query_priv;
 
-  /* load privat key */
-  char *hostkey_file;
-  GNUNET_asprintf(&hostkey_file,
-                  "zonefiles%s%s",
-                  DIR_SEPARATOR_STR,
-                  "N0UJMP015AFUNR2BTNM3FKPBLG38913BL8IDMCO2H0A1LIB81960.zkey");
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Using zonekey file `%s'\n",
-              hostkey_file);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create_from_file(hostkey_file);
-  GNUNET_free (hostkey_file);
-  GNUNET_assert (privkey != NULL);
+  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
+  GNUNET_assert (NULL != privkey);
   struct GNUNET_TIME_Absolute expire = GNUNET_TIME_absolute_get();
-  /* get public key */
-  GNUNET_CRYPTO_ecdsa_key_get_public(privkey, &pubkey);
 
+  /* get public key */
+  GNUNET_CRYPTO_ecdsa_key_get_public (privkey,
+                                      &pubkey);
+
+  /* test query derivation */
+  GNUNET_GNSRECORD_query_from_private_key (privkey,
+                                           "testlabel",
+                                           &query_priv);
+  GNUNET_GNSRECORD_query_from_public_key (&pubkey,
+                                          "testlabel",
+                                          &query_pub);
+  GNUNET_assert (0 == memcmp (&query_priv,
+                              &query_pub,
+                              sizeof (struct GNUNET_HashCode)));
   /* create record */
   s_name = "DUMMY.dummy.gnunet";
   s_rd = create_record (RECORDS);
 
   /* Create block */
-  GNUNET_assert (NULL != (block = GNUNET_GNSRECORD_block_create (privkey, expire,s_name, s_rd, RECORDS)));
-  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_verify (block));
-  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_decrypt (block, &pubkey, s_name, &rd_decrypt_cb, s_name));
-
+  GNUNET_assert (NULL != (block =
+                          GNUNET_GNSRECORD_block_create (privkey,
+                                                         expire,
+                                                         s_name,
+                                                         s_rd,
+                                                         RECORDS)));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_GNSRECORD_block_verify (block));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_GNSRECORD_block_decrypt (block,
+                                                 &pubkey,
+                                                 s_name,
+                                                 &rd_decrypt_cb,
+                                                 s_name));
   GNUNET_free (block);
 }
 
@@ -131,7 +148,8 @@ run (void *cls, char *const *args, const char *cfgfile,
 int
 main (int argc, char *argv[])
 {
-  static char *const argvx[] = { "test-gnsrecord-crypto",
+  static char *const argvx[] = {
+    "test-gnsrecord-crypto",
     NULL
   };
   static struct GNUNET_GETOPT_CommandLineOption options[] = {
@@ -139,8 +157,11 @@ main (int argc, char *argv[])
   };
 
   res = 1;
-  GNUNET_PROGRAM_run ((sizeof (argvx) / sizeof (char *)) - 1, argvx, "test-namestore-api",
-                      "nohelp", options, &run, &res);
+  GNUNET_PROGRAM_run ((sizeof (argvx) / sizeof (char *)) - 1,
+                      argvx,
+                      "test-gnsrecord-crypto",
+                      "nohelp", options,
+                      &run, &res);
   return res;
 }
 
diff --git a/src/identity-provider/gnunet-service-identity-provider.c b/src/identity-provider/gnunet-service-identity-provider.c
index 572202c3f..6afb7bb05 100644
--- a/src/identity-provider/gnunet-service-identity-provider.c
+++ b/src/identity-provider/gnunet-service-identity-provider.c
@@ -2190,12 +2190,15 @@ attr_iter_cb (void *cls,
 
   if (rd_count != 1)
   {
-    GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it);
+    GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it,
+                                         1);
     return;
   }
 
-  if (GNUNET_GNSRECORD_TYPE_ID_ATTR != rd->record_type) {
-    GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it);
+  if (GNUNET_GNSRECORD_TYPE_ID_ATTR != rd->record_type)
+  {
+    GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it,
+                                         1);
     return;
   }
   attr_ver = ntohl(*((uint32_t*)rd->data));
@@ -2209,8 +2212,10 @@ attr_iter_cb (void *cls,
                                             rd->data_size-sizeof (uint32_t),
                                             key,
                                             (void**)&attr_ser);
-  if (GNUNET_SYSERR == msg_extra_len) {
-    GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it);
+  if (GNUNET_SYSERR == msg_extra_len)
+  {
+    GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it,
+                                         1);
     return;
   }
 
@@ -2253,13 +2258,15 @@ iterate_after_abe_bootstrap (void *cls,
                                                      ai);
 }
 
-void
+
+static void
 iterate_next_after_abe_bootstrap (void *cls,
                                   struct GNUNET_ABE_AbeMasterKey *abe_key)
 {
   struct AttributeIterator *ai = cls;
   ai->abe_key = abe_key;
-  GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it);
+  GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it,
+                                       1);
 }
 
 
diff --git a/src/identity-provider/plugin_rest_openid_connect.c b/src/identity-provider/plugin_rest_openid_connect.c
index 7e8054e60..125bb98f6 100644
--- a/src/identity-provider/plugin_rest_openid_connect.c
+++ b/src/identity-provider/plugin_rest_openid_connect.c
@@ -1076,16 +1076,19 @@ namestore_iteration_callback (
     }
   }
 
-  GNUNET_NAMESTORE_zone_iterator_next (handle->namestore_handle_it);
+  GNUNET_NAMESTORE_zone_iterator_next (handle->namestore_handle_it,
+                                       1);
 }
 
+
 /**
  * Iteration over all results finished, build final
  * response.
  *
  * @param cls the `struct RequestHandle`
  */
-static void namestore_iteration_finished (void *cls)
+static void
+namestore_iteration_finished (void *cls)
 {
   struct RequestHandle *handle = cls;
   struct GNUNET_HashCode cache_key;
diff --git a/src/include/gnunet_dht_service.h b/src/include/gnunet_dht_service.h
index d798482e3..a4c63889e 100644
--- a/src/include/gnunet_dht_service.h
+++ b/src/include/gnunet_dht_service.h
@@ -142,22 +142,6 @@ struct GNUNET_DHT_PutHandle;
 
 
 /**
- * Type of a PUT continuation.  You must not call
- * #GNUNET_DHT_disconnect in this continuation.
- *
- * @param cls closure
- * @param success #GNUNET_OK if the PUT was transmitted,
- *                #GNUNET_NO on timeout,
- *                #GNUNET_SYSERR on disconnect from service
- *                after the PUT message was transmitted
- *                (so we don't know if it was received or not)
- */
-typedef void
-(*GNUNET_DHT_PutContinuation)(void *cls,
-                              int success);
-
-
-/**
  * Perform a PUT operation storing data in the DHT.
  *
  * @param handle handle to DHT service
@@ -184,7 +168,7 @@ GNUNET_DHT_put (struct GNUNET_DHT_Handle *handle,
                 size_t size,
                 const void *data,
                 struct GNUNET_TIME_Absolute exp,
-                GNUNET_DHT_PutContinuation cont,
+                GNUNET_SCHEDULER_TaskCallback cont,
                 void *cont_cls);
 
 
diff --git a/src/include/gnunet_dnsstub_lib.h b/src/include/gnunet_dnsstub_lib.h
index 1c3305f7b..41e30d044 100644
--- a/src/include/gnunet_dnsstub_lib.h
+++ b/src/include/gnunet_dnsstub_lib.h
@@ -1,6 +1,6 @@
 /*
       This file is part of GNUnet
-      Copyright (C) 2012 GNUnet e.V.
+      Copyright (C) 2012, 2018 GNUnet e.V.
 
       GNUnet is free software; you can redistribute it and/or modify
       it under the terms of the GNU General Public License as published
@@ -48,14 +48,52 @@ struct GNUNET_DNSSTUB_RequestSocket;
 /**
  * Start a DNS stub resolver.
  *
- * @param dns_ip target IP address to use
+ * @param num_sockets how many sockets should we open
+ *        in parallel for DNS queries for this stub?
  * @return NULL on error
  */
 struct GNUNET_DNSSTUB_Context *
-GNUNET_DNSSTUB_start (const char *dns_ip);
+GNUNET_DNSSTUB_start (unsigned int num_sockets);
 
 
 /**
+ * Add nameserver for use by the DNSSTUB.  We will use
+ * all provided nameservers for resolution (round-robin).
+ *
+ * @param ctx resolver context to modify
+ * @param dns_ip target IP address to use (as string)
+ * @return #GNUNET_OK on success
+ */
+int
+GNUNET_DNSSTUB_add_dns_ip (struct GNUNET_DNSSTUB_Context *ctx,
+                           const char *dns_ip);
+
+
+/**
+ * Add nameserver for use by the DNSSTUB.  We will use
+ * all provided nameservers for resolution (round-robin).
+ *
+ * @param ctx resolver context to modify
+ * @param sa socket address of DNS resolver to use
+ * @return #GNUNET_OK on success
+ */
+int
+GNUNET_DNSSTUB_add_dns_sa (struct GNUNET_DNSSTUB_Context *ctx,
+                           const struct sockaddr *sa);
+
+
+/**
+ * How long should we try requests before timing out?
+ * Only effective for requests issued after this call.
+ *
+ * @param ctx resolver context to modify
+ * @param retry_frequ how long to wait between retries
+ */
+void
+GNUNET_DNSSTUB_set_retry (struct GNUNET_DNSSTUB_Context *ctx,
+                          struct GNUNET_TIME_Relative retry_freq);
+
+/**
  * Cleanup DNSSTUB resolver.
  *
  * @param ctx stub resolver to clean up
@@ -66,57 +104,36 @@ GNUNET_DNSSTUB_stop (struct GNUNET_DNSSTUB_Context *ctx);
 
 /**
  * Function called with the result of a DNS resolution.
+ * Once this function is called, the resolution request
+ * is automatically cancelled / cleaned up.  In particular,
+ * the function will only be called once.
  *
  * @param cls closure
- * @param rs socket that received the response
- * @param dns dns response, never NULL
+ * @param dns dns response, NULL on hard error (i.e. timeout)
  * @param dns_len number of bytes in @a dns
  */
 typedef void
 (*GNUNET_DNSSTUB_ResultCallback)(void *cls,
-                                 struct GNUNET_DNSSTUB_RequestSocket *rs,
                                  const struct GNUNET_TUN_DnsHeader *dns,
                                  size_t dns_len);
 
 
 /**
- * Perform DNS resolution using given address.
- *
- * @param ctx stub resolver to use
- * @param sa the socket address
- * @param sa_len the socket length
- * @param request DNS request to transmit
- * @param request_len number of bytes in msg
- * @param rc function to call with result
- * @param rc_cls closure for @a rc
- * @return socket used for the request, NULL on error
- */
-struct GNUNET_DNSSTUB_RequestSocket *
-GNUNET_DNSSTUB_resolve (struct GNUNET_DNSSTUB_Context *ctx,
-                        const struct sockaddr *sa,
-                        socklen_t sa_len,
-                        const void *request,
-                        size_t request_len,
-                        GNUNET_DNSSTUB_ResultCallback rc,
-                        void *rc_cls);
-
-
-/**
  * Perform DNS resolution using our default IP from init.
  *
  * @param ctx stub resolver to use
  * @param request DNS request to transmit
  * @param request_len number of bytes in msg
- * @param rc function to call with result
+ * @param rc function to call with result (once)
  * @param rc_cls closure for @a rc
  * @return socket used for the request, NULL on error
  */
 struct GNUNET_DNSSTUB_RequestSocket *
-GNUNET_DNSSTUB_resolve2 (struct GNUNET_DNSSTUB_Context *ctx,
-                         const void *request,
-                         size_t request_len,
-                         GNUNET_DNSSTUB_ResultCallback rc,
-                         void *rc_cls);
+GNUNET_DNSSTUB_resolve (struct GNUNET_DNSSTUB_Context *ctx,
+                        const void *request,
+                        size_t request_len,
+                        GNUNET_DNSSTUB_ResultCallback rc,
+                        void *rc_cls);
 
 
 /**
diff --git a/src/include/gnunet_gns_service.h b/src/include/gnunet_gns_service.h
index 8c1f64783..ff3110406 100644
--- a/src/include/gnunet_gns_service.h
+++ b/src/include/gnunet_gns_service.h
@@ -48,13 +48,10 @@ extern "C"
 
 
 /**
- * String we use to indicate the local master zone or a
- * root entry in the current zone.
- *
- * FIXME: probably should be changed to "@" and renamed
- * (this name is confusing!)
+ * String we use to indicate an empty label (top-level
+ * entry in the zone).  DNS uses "@", so do we.
  */
-#define GNUNET_GNS_MASTERZONE_STR "+"
+#define GNUNET_GNS_EMPTY_LABEL_AT "@"
 
 /**
  * Connection to the GNS service.
diff --git a/src/include/gnunet_gnsrecord_lib.h b/src/include/gnunet_gnsrecord_lib.h
index d03b4db3b..38346ada3 100644
--- a/src/include/gnunet_gnsrecord_lib.h
+++ b/src/include/gnunet_gnsrecord_lib.h
@@ -342,9 +342,10 @@ GNUNET_NETWORK_STRUCT_END
  * @param rd_count number of entries in @a rd array
  * @param rd array of records with data to store
  */
-typedef void (*GNUNET_GNSRECORD_RecordCallback) (void *cls,
-                                                 unsigned int rd_count,
-                                                 const struct GNUNET_GNSRECORD_Data *rd);
+typedef void
+(*GNUNET_GNSRECORD_RecordCallback) (void *cls,
+                                    unsigned int rd_count,
+                                    const struct GNUNET_GNSRECORD_Data *rd);
 
 
 
@@ -557,6 +558,25 @@ GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
 
 
 /**
+ * Sign name and records, cache derived public key (also keeps the
+ * private key in static memory, so do not use this function if
+ * keeping the private key in the process'es RAM is a major issue).
+ *
+ * @param key the private key
+ * @param expire block expiration
+ * @param label the name for the records
+ * @param rd record data
+ * @param rd_count number of records in @a rd
+ */
+struct GNUNET_GNSRECORD_Block *
+GNUNET_GNSRECORD_block_create2 (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+                                struct GNUNET_TIME_Absolute expire,
+                                const char *label,
+                                const struct GNUNET_GNSRECORD_Data *rd,
+                                unsigned int rd_count);
+
+
+/**
  * Check if a signature is valid.  This API is used by the GNS Block
  * to validate signatures received from the network.
  *
diff --git a/src/include/gnunet_namestore_plugin.h b/src/include/gnunet_namestore_plugin.h
index 3ebf48987..e15068222 100644
--- a/src/include/gnunet_namestore_plugin.h
+++ b/src/include/gnunet_namestore_plugin.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2012, 2013 GNUnet e.V.
+     Copyright (C) 2012, 2013, 2018 GNUnet e.V.
 
      GNUnet is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
@@ -47,6 +47,7 @@ extern "C"
  * Function called for each matching record.
  *
  * @param cls closure
+ * @param serial unique serial number of the record
  * @param zone_key private key of the zone
  * @param label name that is being mapped (at most 255 characters long)
  * @param rd_count number of entries in @a rd array
@@ -54,6 +55,7 @@ extern "C"
  */
 typedef void
 (*GNUNET_NAMESTORE_RecordIterator) (void *cls,
+                                    uint64_t serial,
                                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *private_key,
                                     const char *label,
                                     unsigned int rd_count,
@@ -97,7 +99,7 @@ struct GNUNET_NAMESTORE_PluginFunctions
    * @param label name of the record in the zone
    * @param iter function to call with the result
    * @param iter_cls closure for @a iter
-   * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+   * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
    */
   int
   (*lookup_records) (void *cls,
@@ -109,19 +111,21 @@ struct GNUNET_NAMESTORE_PluginFunctions
 
   /**
    * Iterate over the results for a particular zone in the
-   * datastore.  Will return at most one result to the iterator.
+   * datastore.  Will return at most @a limit results to the iterator.
    *
    * @param cls closure (internal context for the plugin)
    * @param zone private key of the zone, NULL for all zones
-   * @param offset offset in the list of all matching records
+   * @param serial serial (to exclude) in the list of matching records
+   * @param limit maximum number of results to return to @a iter
    * @param iter function to call with the result
    * @param iter_cls closure for @a iter
-   * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+   * @return #GNUNET_OK on success, #GNUNET_NO if there were no more results, #GNUNET_SYSERR on error
    */
   int
   (*iterate_records) (void *cls,
                       const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
-                      uint64_t offset,
+                      uint64_t serial,
+                      uint64_t limit,
                       GNUNET_NAMESTORE_RecordIterator iter,
                       void *iter_cls);
 
diff --git a/src/include/gnunet_namestore_service.h b/src/include/gnunet_namestore_service.h
index f8c2eaf3b..4828f72ad 100644
--- a/src/include/gnunet_namestore_service.h
+++ b/src/include/gnunet_namestore_service.h
@@ -267,9 +267,12 @@ GNUNET_NAMESTORE_zone_iteration_start (struct GNUNET_NAMESTORE_Handle *h,
  * for the next record.
  *
  * @param it the iterator
+ * @param limit number of records to return to the iterator in one shot
+ *         (before #GNUNET_NAMESTORE_zone_iterator_next is to be called again)
  */
 void
-GNUNET_NAMESTORE_zone_iterator_next (struct GNUNET_NAMESTORE_ZoneIterator *it);
+GNUNET_NAMESTORE_zone_iterator_next (struct GNUNET_NAMESTORE_ZoneIterator *it,
+                                     uint64_t limit);
 
 
 /**
diff --git a/src/include/gnunet_protocols.h b/src/include/gnunet_protocols.h
index d692b28ff..bf1b48679 100644
--- a/src/include/gnunet_protocols.h
+++ b/src/include/gnunet_protocols.h
@@ -624,11 +624,6 @@ extern "C"
 #define GNUNET_MESSAGE_TYPE_DHT_MONITOR_STOP             154
 
 /**
- * Acknowledge receiving PUT request
- */
-#define GNUNET_MESSAGE_TYPE_DHT_CLIENT_PUT_OK             155
-
-/**
  * Certain results are already known to the client, filter those.
  */
 #define GNUNET_MESSAGE_TYPE_DHT_CLIENT_GET_RESULTS_KNOWN             156
diff --git a/src/namecache/namecache.conf.in b/src/namecache/namecache.conf.in
index 236cafecd..becd34187 100644
--- a/src/namecache/namecache.conf.in
+++ b/src/namecache/namecache.conf.in
@@ -11,6 +11,11 @@ ACCEPT_FROM = 127.0.0.1;
 ACCEPT_FROM6 = ::1;
 DATABASE = sqlite
 
+# Disables use of caching by GNS. Useful for systems that
+# publish very large zones and are CPU bound, if they do not
+# also do a large number of lookups.
+DISABLE = NO
+
 [namecache-sqlite]
 FILENAME = $GNUNET_DATA_HOME/namecache/sqlite.db
 
diff --git a/src/namecache/plugin_namecache_sqlite.c b/src/namecache/plugin_namecache_sqlite.c
index 37d6d3b62..e0f64a6b0 100644
--- a/src/namecache/plugin_namecache_sqlite.c
+++ b/src/namecache/plugin_namecache_sqlite.c
@@ -136,13 +136,16 @@ create_indices (sqlite3 * dbh)
 {
   /* create indices */
   if ( (SQLITE_OK !=
-        sqlite3_exec (dbh, "CREATE INDEX IF NOT EXISTS ir_query_hash ON ns096blocks (query,expiration_time)",
+        sqlite3_exec (dbh,
+                      "CREATE INDEX IF NOT EXISTS ir_query_hash ON ns096blocks (query,expiration_time)",
                       NULL, NULL, NULL)) ||
        (SQLITE_OK !=
-        sqlite3_exec (dbh, "CREATE INDEX IF NOT EXISTS ir_block_expiration ON ns096blocks (expiration_time)",
+        sqlite3_exec (dbh,
+                      "CREATE INDEX IF NOT EXISTS ir_block_expiration ON ns096blocks (expiration_time)",
                       NULL, NULL, NULL)) )
     LOG (GNUNET_ERROR_TYPE_ERROR,
-         "Failed to create indices: %s\n", sqlite3_errmsg (dbh));
+         "Failed to create indices: %s\n",
+         sqlite3_errmsg (dbh));
 }
 
 
@@ -208,28 +211,44 @@ database_setup (struct Plugin *plugin)
     return GNUNET_SYSERR;
   }
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA temp_store=MEMORY", NULL, NULL,
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA temp_store=MEMORY",
+                       NULL, NULL,
                        ENULL));
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA synchronous=NORMAL", NULL, NULL,
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA synchronous=NORMAL",
+                       NULL, NULL,
                        ENULL));
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA legacy_file_format=OFF", NULL, NULL,
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA legacy_file_format=OFF",
+                       NULL, NULL,
                        ENULL));
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA auto_vacuum=INCREMENTAL", NULL,
-                       NULL, ENULL));
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA auto_vacuum=INCREMENTAL",
+                       NULL, NULL,
+                       ENULL));
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA encoding=\"UTF-8\"", NULL,
-                       NULL, ENULL));
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA encoding=\"UTF-8\"",
+                       NULL, NULL,
+                       ENULL));
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA locking_mode=EXCLUSIVE", NULL, NULL,
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA locking_mode=EXCLUSIVE",
+                       NULL, NULL,
                        ENULL));
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA page_size=4092", NULL, NULL,
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA page_size=4092",
+                       NULL, NULL,
                        ENULL));
 
-  CHECK (SQLITE_OK == sqlite3_busy_timeout (plugin->dbh, BUSY_TIMEOUT_MS));
+  CHECK (SQLITE_OK ==
+         sqlite3_busy_timeout (plugin->dbh,
+                               BUSY_TIMEOUT_MS));
 
 
   /* Create tables */
@@ -237,17 +256,19 @@ database_setup (struct Plugin *plugin)
          sq_prepare (plugin->dbh,
                      "SELECT 1 FROM sqlite_master WHERE tbl_name = 'ns096blocks'",
                      &stmt));
-  if ((sqlite3_step (stmt) == SQLITE_DONE) &&
-      (sqlite3_exec
-       (plugin->dbh,
-        "CREATE TABLE ns096blocks ("
-        " query BLOB NOT NULL,"
-        " block BLOB NOT NULL,"
-        " expiration_time INT8 NOT NULL"
-        ")",
-        NULL, NULL, NULL) != SQLITE_OK))
+  if ( (sqlite3_step (stmt) == SQLITE_DONE) &&
+       (SQLITE_OK !=
+        sqlite3_exec (plugin->dbh,
+                      "CREATE TABLE ns096blocks ("
+                      " query BLOB NOT NULL,"
+                      " block BLOB NOT NULL,"
+                      " expiration_time INT8 NOT NULL"
+                      ")",
+                      NULL, NULL, NULL)) )
   {
-    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR, "sqlite3_exec");
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR,
+                "sqlite3_exec");
     sqlite3_finalize (stmt);
     return GNUNET_SYSERR;
   }
@@ -411,11 +432,11 @@ namecache_sqlite_cache_block (void *cls,
   GNUNET_CRYPTO_hash (&block->derived_key,
                       sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey),
                       &query);
-  fprintf (stderr,
-           "Caching new version of block %s (expires %llu)\n",
-           GNUNET_h2s (&query),
-           (unsigned long long) expiration.abs_value_us);
   expiration = GNUNET_TIME_absolute_ntoh (block->expiration_time);
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Caching new version of block %s (expires %s)\n",
+              GNUNET_h2s (&query),
+              GNUNET_STRINGS_absolute_time_to_string (expiration));
   if (block_size > 64 * 65536)
   {
     GNUNET_break (0);
diff --git a/src/namestore/.gitignore b/src/namestore/.gitignore
index 9a4c615ba..e56271eac 100644
--- a/src/namestore/.gitignore
+++ b/src/namestore/.gitignore
@@ -20,3 +20,51 @@ test_plugin_namestore_postgres
 test_plugin_namestore_sqlite
 test_plugin_namestore_flat
 gnunet-zoneimport
+test_namestore_api_lookup_nick_flat
+test_namestore_api_lookup_nick_postgres
+test_namestore_api_lookup_nick_sqlite
+test_namestore_api_lookup_private_flat
+test_namestore_api_lookup_private_postgres
+test_namestore_api_lookup_private_sqlite
+test_namestore_api_lookup_public_flat
+test_namestore_api_lookup_public_postgres
+test_namestore_api_lookup_public_sqlite
+test_namestore_api_lookup_shadow_filter_flat
+test_namestore_api_lookup_shadow_filter_postgres
+test_namestore_api_lookup_shadow_filter_sqlite
+test_namestore_api_lookup_shadow_flat
+test_namestore_api_lookup_shadow_postgres
+test_namestore_api_lookup_shadow_sqlite
+test_namestore_api_monitoring_existing_flat
+test_namestore_api_monitoring_existing_postgres
+test_namestore_api_monitoring_existing_sqlite
+test_namestore_api_monitoring_flat
+test_namestore_api_monitoring_postgres
+test_namestore_api_monitoring_sqlite
+test_namestore_api_remove_flat
+test_namestore_api_remove_not_existing_record_flat
+test_namestore_api_remove_not_existing_record_postgres
+test_namestore_api_remove_not_existing_record_sqlite
+test_namestore_api_remove_postgres
+test_namestore_api_remove_sqlite
+test_namestore_api_store_flat
+test_namestore_api_store_postgres
+test_namestore_api_store_sqlite
+test_namestore_api_store_update_flat
+test_namestore_api_store_update_postgres
+test_namestore_api_store_update_sqlite
+test_namestore_api_zone_iteration_flat
+test_namestore_api_zone_iteration_nick_flat
+test_namestore_api_zone_iteration_nick_postgres
+test_namestore_api_zone_iteration_nick_sqlite
+test_namestore_api_zone_iteration_postgres
+test_namestore_api_zone_iteration_specific_zone_flat
+test_namestore_api_zone_iteration_specific_zone_postgres
+test_namestore_api_zone_iteration_specific_zone_sqlite
+test_namestore_api_zone_iteration_sqlite
+test_namestore_api_zone_iteration_stop_flat
+test_namestore_api_zone_iteration_stop_postgres
+test_namestore_api_zone_iteration_stop_sqlite
+test_namestore_api_zone_to_name_flat
+test_namestore_api_zone_to_name_postgres
+test_namestore_api_zone_to_name_sqlite
diff --git a/src/namestore/Makefile.am b/src/namestore/Makefile.am
index fd8f8054f..fa85cc060 100644
--- a/src/namestore/Makefile.am
+++ b/src/namestore/Makefile.am
@@ -20,74 +20,81 @@ if USE_COVERAGE
   XLIBS = -lgcov
 endif
 
-if HAVE_EXPERIMENTAL
 FLAT_PLUGIN = libgnunet_plugin_namestore_flat.la
 if HAVE_TESTING
-FLAT_TESTS = test_plugin_namestore_flat
-endif
+FLAT_TESTS = test_plugin_namestore_flat \
+ test_namestore_api_store_flat \
+ test_namestore_api_store_update_flat \
+ test_namestore_api_remove_flat \
+ test_namestore_api_zone_iteration_flat \
+ test_namestore_api_lookup_nick_flat \
+ test_namestore_api_monitoring_flat \
+ test_namestore_api_lookup_public_flat \
+ test_namestore_api_lookup_private_flat \
+ test_namestore_api_lookup_shadow_flat \
+ test_namestore_api_lookup_shadow_filter_flat \
+ test_namestore_api_remove_not_existing_record_flat \
+ test_namestore_api_zone_iteration_nick_flat \
+ test_namestore_api_zone_iteration_specific_zone_flat \
+ test_namestore_api_zone_iteration_stop_flat \
+ test_namestore_api_monitoring_existing_flat \
+ test_namestore_api_zone_to_name_flat \
+ perf_namestore_api_zone_iteration_flat
 endif
 
 if HAVE_SQLITE
 SQLITE_PLUGIN = libgnunet_plugin_namestore_sqlite.la
 if HAVE_TESTING
-SQLITE_TESTS = test_plugin_namestore_sqlite
+SQLITE_TESTS = test_plugin_namestore_sqlite \
+ test_namestore_api_store_sqlite \
+ test_namestore_api_store_update_sqlite \
+ test_namestore_api_zone_iteration_sqlite \
+ test_namestore_api_remove_sqlite \
+ test_namestore_api_lookup_nick_sqlite \
+ test_namestore_api_monitoring_sqlite \
+ test_namestore_api_lookup_public_sqlite \
+ test_namestore_api_lookup_private_sqlite \
+ test_namestore_api_lookup_shadow_sqlite \
+ test_namestore_api_lookup_shadow_filter_sqlite \
+ test_namestore_api_remove_not_existing_record_sqlite \
+ test_namestore_api_zone_iteration_nick_sqlite \
+ test_namestore_api_zone_iteration_specific_zone_sqlite \
+ test_namestore_api_zone_iteration_stop_sqlite \
+ test_namestore_api_monitoring_existing_sqlite \
+ test_namestore_api_zone_to_name_sqlite \
+ perf_namestore_api_zone_iteration_sqlite
 endif
 endif
 
 if HAVE_POSTGRESQL
-# postgres doesn't even build yet; thus: experimental!
 POSTGRES_PLUGIN = libgnunet_plugin_namestore_postgres.la
 if HAVE_TESTING
-POSTGRES_TESTS = test_plugin_namestore_postgres
-endif
+POSTGRES_TESTS = test_plugin_namestore_postgres \
+ test_namestore_api_store_postgres \
+ test_namestore_api_store_update_postgres \
+ test_namestore_api_remove_postgres \
+ test_namestore_api_zone_iteration_postgres \
+ test_namestore_api_lookup_nick_postgres \
+ test_namestore_api_monitoring_postgres \
+ test_namestore_api_lookup_public_postgres \
+ test_namestore_api_lookup_private_postgres \
+ test_namestore_api_lookup_shadow_postgres \
+ test_namestore_api_lookup_shadow_filter_postgres \
+ test_namestore_api_remove_not_existing_record_postgres \
+ test_namestore_api_zone_iteration_nick_postgres \
+ test_namestore_api_zone_iteration_specific_zone_postgres \
+ test_namestore_api_zone_iteration_stop_postgres \
+ test_namestore_api_monitoring_existing_postgres \
+ test_namestore_api_zone_to_name_postgres \
+ perf_namestore_api_zone_iteration_postgres
 endif
-
-# testcases do not even build yet; thus: experimental!
-if HAVE_TESTING
-TESTING_TESTS = \
- test_namestore_api_store.nc \
- test_namestore_api_store_update.nc \
- test_namestore_api_lookup_public.nc \
- test_namestore_api_lookup_private.nc \
- test_namestore_api_lookup_nick.nc \
- test_namestore_api_lookup_shadow.nc \
- test_namestore_api_lookup_shadow_filter.nc \
- test_namestore_api_remove.nc \
- test_namestore_api_remove_not_existing_record.nc \
- test_namestore_api_zone_iteration.nc \
- test_namestore_api_zone_iteration_nick.nc \
- test_namestore_api_zone_iteration_specific_zone.nc \
- test_namestore_api_zone_iteration_stop.nc \
- test_namestore_api_monitoring.nc \
- test_namestore_api_monitoring_existing.nc \
- test_namestore_api_zone_to_name
 endif
 
-# Declare .nc (NO-CONCURRENCY) as a test extension so that we can impart
-# sequential execution order for them
-TEST_EXTENSIONS = .nc
-test_namestore_api_store.log: test_namestore_api_store_update.log
-test_namestore_api_store_update.log: test_namestore_api_lookup_public.log
-test_namestore_api_lookup_public.log: test_namestore_api_lookup_private.log
-test_namestore_api_lookup_private.log: test_namestore_api_lookup_nick.log
-test_namestore_api_lookup_nick.log: test_namestore_api_lookup_shadow.log
-test_namestore_api_lookup_shadow.log: test_namestore_api_lookup_shadow_filter.log
-test_namestore_api_lookup_shadow_filter.log: test_namestore_api_remove.log
-test_namestore_api_remove.log: test_namestore_api_remove_not_existing_record.log
-test_namestore_api_remove_not_existing_record.log: test_namestore_api_zone_iteration.log
-test_namestore_api_zone_iteration.log: test_namestore_api_zone_iteration_nick.log
-test_namestore_api_zone_iteration_nick.log: test_namestore_api_zone_iteration_specific_zone.log
-test_namestore_api_zone_iteration_specific_zone.log: test_namestore_api_zone_iteration_stop.log
-test_namestore_api_zone_iteration_stop.log: test_namestore_api_monitoring.log
-test_namestore_api_monitoring.log: test_namestore_api_monitoring_existing.log
-
-
 if HAVE_SQLITE
 check_PROGRAMS = \
  $(SQLITE_TESTS) \
  $(POSTGRES_TESTS) \
- $(FLAT_TESTS) \
- $(TESTING_TESTS)
+ $(FLAT_TESTS)
 endif
 
 if HAVE_MHD
@@ -124,9 +131,7 @@ libexec_PROGRAMS = \
  gnunet-service-namestore
 
 bin_PROGRAMS = \
- gnunet-namestore
-
-noinst_PROGRAMS = \
+ gnunet-namestore \
  gnunet-zoneimport
 
 if HAVE_MHD
@@ -139,6 +144,7 @@ gnunet_zoneimport_SOURCES = \
  gnunet-zoneimport.c
 gnunet_zoneimport_LDADD = \
   libgnunetnamestore.la \
+  $(top_builddir)/src/statistics/libgnunetstatistics.la \
   $(top_builddir)/src/identity/libgnunetidentity.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/dns/libgnunetdnsparser.la \
@@ -234,135 +240,423 @@ libgnunet_plugin_rest_namestore_la_LDFLAGS = \
  $(GN_PLUGIN_LDFLAGS)
 
 
-test_namestore_api_store_nc_SOURCES = \
+test_namestore_api_store_flat_SOURCES = \
+ test_namestore_api_store.c
+test_namestore_api_store_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_store_sqlite_SOURCES = \
+ test_namestore_api_store.c
+test_namestore_api_store_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_store_postgres_SOURCES = \
  test_namestore_api_store.c
-test_namestore_api_store_nc_LDADD = \
+test_namestore_api_store_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_store_update_flat_SOURCES = \
+ test_namestore_api_store_update.c
+test_namestore_api_store_update_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_store_update_sqlite_SOURCES = \
+ test_namestore_api_store_update.c
+test_namestore_api_store_update_sqlite_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_store_update_nc_SOURCES = \
+test_namestore_api_store_update_postgres_SOURCES = \
  test_namestore_api_store_update.c
-test_namestore_api_store_update_nc_LDADD = \
+test_namestore_api_store_update_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_public_flat_SOURCES = \
+ test_namestore_api_lookup_public.c
+test_namestore_api_lookup_public_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_public_sqlite_SOURCES = \
+ test_namestore_api_lookup_public.c
+test_namestore_api_lookup_public_sqlite_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_lookup_public_nc_SOURCES = \
+test_namestore_api_lookup_public_postgres_SOURCES = \
  test_namestore_api_lookup_public.c
-test_namestore_api_lookup_public_nc_LDADD = \
+test_namestore_api_lookup_public_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_nick_sqlite_SOURCES = \
+ test_namestore_api_lookup_nick.c
+test_namestore_api_lookup_nick_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_nick_postgres_SOURCES = \
+ test_namestore_api_lookup_nick.c
+test_namestore_api_lookup_nick_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_lookup_nick_nc_SOURCES = \
+test_namestore_api_lookup_nick_flat_SOURCES = \
  test_namestore_api_lookup_nick.c
-test_namestore_api_lookup_nick_nc_LDADD = \
+test_namestore_api_lookup_nick_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_private_flat_SOURCES = \
+ test_namestore_api_lookup_private.c
+test_namestore_api_lookup_private_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_private_sqlite_SOURCES = \
+ test_namestore_api_lookup_private.c
+test_namestore_api_lookup_private_sqlite_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_lookup_private_nc_SOURCES = \
+test_namestore_api_lookup_private_postgres_SOURCES = \
  test_namestore_api_lookup_private.c
-test_namestore_api_lookup_private_nc_LDADD = \
+test_namestore_api_lookup_private_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_shadow_flat_SOURCES = \
+ test_namestore_api_lookup_shadow.c
+test_namestore_api_lookup_shadow_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_shadow_sqlite_SOURCES = \
+ test_namestore_api_lookup_shadow.c
+test_namestore_api_lookup_shadow_sqlite_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_lookup_shadow_nc_SOURCES = \
+test_namestore_api_lookup_shadow_postgres_SOURCES = \
  test_namestore_api_lookup_shadow.c
-test_namestore_api_lookup_shadow_nc_LDADD = \
+test_namestore_api_lookup_shadow_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_shadow_filter_flat_SOURCES = \
+ test_namestore_api_lookup_shadow_filter.c
+test_namestore_api_lookup_shadow_filter_flat_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_lookup_shadow_filter_nc_SOURCES = \
+test_namestore_api_lookup_shadow_filter_sqlite_SOURCES = \
+ test_namestore_api_lookup_shadow_filter.c
+test_namestore_api_lookup_shadow_filter_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+test_namestore_api_lookup_shadow_filter_postgres_SOURCES = \
  test_namestore_api_lookup_shadow_filter.c
-test_namestore_api_lookup_shadow_filter_nc_LDADD = \
+test_namestore_api_lookup_shadow_filter_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_remove_nc_SOURCES = \
+test_namestore_api_remove_sqlite_SOURCES = \
+ test_namestore_api_remove.c
+test_namestore_api_remove_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_remove_postgres_SOURCES = \
  test_namestore_api_remove.c
-test_namestore_api_remove_nc_LDADD = \
+test_namestore_api_remove_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   libgnunetnamestore.la
 
-test_namestore_api_remove_not_existing_record_nc_SOURCES = \
+test_namestore_api_remove_flat_SOURCES = \
+ test_namestore_api_remove.c
+test_namestore_api_remove_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_remove_not_existing_record_flat_SOURCES = \
+ test_namestore_api_remove_not_existing_record.c
+test_namestore_api_remove_not_existing_record_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_remove_not_existing_record_sqlite_SOURCES = \
+ test_namestore_api_remove_not_existing_record.c
+test_namestore_api_remove_not_existing_record_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_remove_not_existing_record_postgres_SOURCES = \
  test_namestore_api_remove_not_existing_record.c
-test_namestore_api_remove_not_existing_record_nc_LDADD = \
+test_namestore_api_remove_not_existing_record_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   libgnunetnamestore.la
 
-test_namestore_api_zone_to_name_SOURCES = \
+test_namestore_api_zone_to_name_flat_SOURCES = \
+ test_namestore_api_zone_to_name.c
+test_namestore_api_zone_to_name_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_to_name_sqlite_SOURCES = \
+ test_namestore_api_zone_to_name.c
+test_namestore_api_zone_to_name_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_to_name_postgres_SOURCES = \
  test_namestore_api_zone_to_name.c
-test_namestore_api_zone_to_name_LDADD = \
+test_namestore_api_zone_to_name_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   libgnunetnamestore.la
 
-test_namestore_api_monitoring_nc_SOURCES = \
+test_namestore_api_monitoring_flat_SOURCES = \
+ test_namestore_api_monitoring.c
+test_namestore_api_monitoring_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  libgnunetnamestore.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/util/libgnunetutil.la
+
+test_namestore_api_monitoring_sqlite_SOURCES = \
+ test_namestore_api_monitoring.c
+test_namestore_api_monitoring_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  libgnunetnamestore.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/util/libgnunetutil.la
+
+test_namestore_api_monitoring_postgres_SOURCES = \
  test_namestore_api_monitoring.c
-test_namestore_api_monitoring_nc_LDADD = \
+test_namestore_api_monitoring_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  libgnunetnamestore.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/util/libgnunetutil.la
+
+test_namestore_api_monitoring_existing_flat_SOURCES = \
+ test_namestore_api_monitoring_existing.c
+test_namestore_api_monitoring_existing_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  libgnunetnamestore.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/util/libgnunetutil.la
+
+test_namestore_api_monitoring_existing_sqlite_SOURCES = \
+ test_namestore_api_monitoring_existing.c
+test_namestore_api_monitoring_existing_sqlite_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   libgnunetnamestore.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/util/libgnunetutil.la
 
-test_namestore_api_monitoring_existing_nc_SOURCES = \
+test_namestore_api_monitoring_existing_postgres_SOURCES = \
  test_namestore_api_monitoring_existing.c
-test_namestore_api_monitoring_existing_nc_LDADD = \
+test_namestore_api_monitoring_existing_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   libgnunetnamestore.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/util/libgnunetutil.la
 
-test_namestore_api_zone_iteration_nc_SOURCES = \
+test_namestore_api_zone_iteration_flat_SOURCES = \
  test_namestore_api_zone_iteration.c
-test_namestore_api_zone_iteration_nc_LDADD = \
+test_namestore_api_zone_iteration_flat_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   libgnunetnamestore.la
 
-test_namestore_api_zone_iteration_nick_nc_SOURCES = \
+test_namestore_api_zone_iteration_sqlite_SOURCES = \
+ test_namestore_api_zone_iteration.c
+test_namestore_api_zone_iteration_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_postgres_SOURCES = \
+ test_namestore_api_zone_iteration.c
+test_namestore_api_zone_iteration_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+perf_namestore_api_zone_iteration_postgres_SOURCES = \
+ perf_namestore_api_zone_iteration.c
+perf_namestore_api_zone_iteration_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+perf_namestore_api_zone_iteration_sqlite_SOURCES = \
+ perf_namestore_api_zone_iteration.c
+perf_namestore_api_zone_iteration_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+perf_namestore_api_zone_iteration_flat_SOURCES = \
+ perf_namestore_api_zone_iteration.c
+perf_namestore_api_zone_iteration_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_nick_flat_SOURCES = \
  test_namestore_api_zone_iteration_nick.c
-test_namestore_api_zone_iteration_nick_nc_LDADD = \
+test_namestore_api_zone_iteration_nick_flat_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   libgnunetnamestore.la
 
+test_namestore_api_zone_iteration_nick_sqlite_SOURCES = \
+ test_namestore_api_zone_iteration_nick.c
+test_namestore_api_zone_iteration_nick_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
 
-test_namestore_api_zone_iteration_specific_zone_nc_SOURCES = \
+test_namestore_api_zone_iteration_nick_postgres_SOURCES = \
+ test_namestore_api_zone_iteration_nick.c
+test_namestore_api_zone_iteration_nick_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_specific_zone_flat_SOURCES = \
+ test_namestore_api_zone_iteration_specific_zone.c
+test_namestore_api_zone_iteration_specific_zone_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_specific_zone_sqlite_SOURCES = \
  test_namestore_api_zone_iteration_specific_zone.c
-test_namestore_api_zone_iteration_specific_zone_nc_LDADD = \
+test_namestore_api_zone_iteration_specific_zone_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_specific_zone_postgres_SOURCES = \
+ test_namestore_api_zone_iteration_specific_zone.c
+test_namestore_api_zone_iteration_specific_zone_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_stop_flat_SOURCES = \
+ test_namestore_api_zone_iteration_stop.c
+test_namestore_api_zone_iteration_stop_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_stop_sqlite_SOURCES = \
+ test_namestore_api_zone_iteration_stop.c
+test_namestore_api_zone_iteration_stop_sqlite_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   libgnunetnamestore.la
 
-test_namestore_api_zone_iteration_stop_nc_SOURCES = \
+test_namestore_api_zone_iteration_stop_postgres_SOURCES = \
  test_namestore_api_zone_iteration_stop.c
-test_namestore_api_zone_iteration_stop_nc_LDADD = \
+test_namestore_api_zone_iteration_stop_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
@@ -393,6 +687,12 @@ check_SCRIPTS = \
 
 EXTRA_DIST = \
   test_namestore_api.conf \
+  test_namestore_api_postgres.conf \
+  test_namestore_api_sqlite.conf \
+  test_namestore_api_flat.conf \
+  perf_namestore_api_postgres.conf \
+  perf_namestore_api_sqlite.conf \
+  perf_namestore_api_flat.conf \
   test_plugin_namestore_sqlite.conf \
   test_plugin_namestore_postgres.conf \
   test_plugin_namestore_flat.conf \
diff --git a/src/namestore/gnunet-namestore-fcfsd.c b/src/namestore/gnunet-namestore-fcfsd.c
index ddd609918..903253b1a 100644
--- a/src/namestore/gnunet-namestore-fcfsd.c
+++ b/src/namestore/gnunet-namestore-fcfsd.c
@@ -324,15 +324,18 @@ iterate_cb (void *cls,
   char* pkey;
   char* new_buf;
 
+  (void) zone_key;
   if (1 != rd_len)
   {
-    GNUNET_NAMESTORE_zone_iterator_next (zr->list_it);
+    GNUNET_NAMESTORE_zone_iterator_next (zr->list_it,
+                                         1);
     return;
   }
 
   if (GNUNET_GNSRECORD_TYPE_PKEY != rd->record_type)
   {
-    GNUNET_NAMESTORE_zone_iterator_next (zr->list_it);
+    GNUNET_NAMESTORE_zone_iterator_next (zr->list_it,
+                                         1);
     return;
   }
 
@@ -343,7 +346,8 @@ iterate_cb (void *cls,
   if (NULL == pkey)
   {
     GNUNET_break (0);
-    GNUNET_NAMESTORE_zone_iterator_next (zr->list_it);
+    GNUNET_NAMESTORE_zone_iterator_next (zr->list_it,
+                                         1);
     return;
   }
   if (bytes_free < (strlen (name) + strlen (pkey) + 40))
@@ -359,7 +363,8 @@ iterate_cb (void *cls,
            name,
            pkey);
   zr->write_offset = strlen (zr->zoneinfo);
-  GNUNET_NAMESTORE_zone_iterator_next (zr->list_it);
+  GNUNET_NAMESTORE_zone_iterator_next (zr->list_it,
+                                       1);
   GNUNET_free (pkey);
 }
 
@@ -435,6 +440,7 @@ fill_s_reply (const char *info,
   char *reply;
   struct MHD_Response *response;
 
+  (void) request;
   GNUNET_asprintf (&reply,
                    SUBMIT_PAGE,
                    info,
@@ -583,6 +589,8 @@ zone_to_name_cb (void *cls,
   struct Request *request = cls;
   struct GNUNET_GNSRECORD_Data r;
 
+  (void) rd;
+  (void) zone_key;
   request->qe = NULL;
   if (0 != rd_count)
   {
@@ -640,6 +648,9 @@ lookup_block_processor (void *cls,
 {
   struct Request *request = cls;
 
+  (void) label;
+  (void) rd;
+  (void) zone;
   request->qe = NULL;
   if (0 == rd_count)
   {
@@ -711,6 +722,8 @@ create_response (void *cls,
   struct GNUNET_CRYPTO_EcdsaPublicKey pub;
   int ret;
 
+  (void) cls;
+  (void) version;
   if ( (0 == strcmp (method, MHD_HTTP_METHOD_GET)) ||
        (0 == strcmp (method, MHD_HTTP_METHOD_HEAD)) )
     {
diff --git a/src/namestore/gnunet-namestore.c b/src/namestore/gnunet-namestore.c
index 9a1805af4..d329dcb3b 100644
--- a/src/namestore/gnunet-namestore.c
+++ b/src/namestore/gnunet-namestore.c
@@ -398,7 +398,8 @@ display_record (void *cls,
   if ( (NULL != name) &&
        (0 != strcmp (name, rname)) )
   {
-    GNUNET_NAMESTORE_zone_iterator_next (list_it);
+    GNUNET_NAMESTORE_zone_iterator_next (list_it,
+                                         1);
     return;
   }
   FPRINTF (stdout,
@@ -408,7 +409,7 @@ display_record (void *cls,
   {
     if ( (GNUNET_GNSRECORD_TYPE_NICK == rd[i].record_type) &&
          (0 != strcmp (rname,
-                       GNUNET_GNS_MASTERZONE_STR)) )
+                       GNUNET_GNS_EMPTY_LABEL_AT)) )
       continue;
     typestring = GNUNET_GNSRECORD_number_to_typename (rd[i].record_type);
     s = GNUNET_GNSRECORD_value_to_string (rd[i].record_type,
@@ -441,7 +442,8 @@ display_record (void *cls,
     GNUNET_free (s);
   }
   FPRINTF (stdout, "%s", "\n");
-  GNUNET_NAMESTORE_zone_iterator_next (list_it);
+  GNUNET_NAMESTORE_zone_iterator_next (list_it,
+                                       1);
 }
 
 
@@ -659,6 +661,8 @@ handle_reverse_lookup (void *cls,
 {
   (void) cls;
   (void) zone;
+  (void) rd_count;
+  (void) rd;
   reverse_qe = NULL;
   if (NULL == label)
     FPRINTF (stdout,
@@ -710,6 +714,7 @@ del_monitor (void *cls,
   char *vs;
 
   (void) cls;
+  (void) zone;
   del_qe = NULL;
   if (0 == rd_count)
   {
@@ -1090,6 +1095,9 @@ id_connect_cb (void *cls,
 {
   const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
 
+  (void) cls;
+  (void) ctx;
+  (void) name;
   if (NULL == ego)
   {
     get_default = GNUNET_IDENTITY_get (idh,
diff --git a/src/namestore/gnunet-service-namestore.c b/src/namestore/gnunet-service-namestore.c
index 3a3291c07..fa189dbc3 100644
--- a/src/namestore/gnunet-service-namestore.c
+++ b/src/namestore/gnunet-service-namestore.c
@@ -31,6 +31,7 @@
 #include "gnunet_namecache_service.h"
 #include "gnunet_namestore_service.h"
 #include "gnunet_namestore_plugin.h"
+#include "gnunet_statistics_service.h"
 #include "gnunet_signatures.h"
 #include "namestore.h"
 
@@ -74,6 +75,15 @@ struct ZoneIteration
   struct GNUNET_CRYPTO_EcdsaPrivateKey zone;
 
   /**
+   * Last sequence number in the zone iteration used to address next
+   * result of the zone iteration in the store
+   *
+   * Initialy set to 0.
+   * Updated in #zone_iterate_proc()
+   */
+  uint64_t seq;
+
+  /**
    * The operation id fot the zone iteration in the response for the client
    */
   uint32_t request_id;
@@ -82,8 +92,8 @@ struct ZoneIteration
    * Offset of the zone iteration used to address next result of the zone
    * iteration in the store
    *
-   * Initialy set to 0 in handle_iteration_start
-   * Incremented with by every call to handle_iteration_next
+   * Initialy set to 0 in #handle_iteration_start
+   * Incremented with by every call to #handle_iteration_next
    */
   uint32_t offset;
 
@@ -151,13 +161,13 @@ struct ZoneMonitor
   struct GNUNET_SCHEDULER_Task *task;
 
   /**
-   * Offset of the zone iteration used to address next result of the zone
-   * iteration in the store
+   * Last sequence number in the zone iteration used to address next
+   * result of the zone iteration in the store
    *
    * Initialy set to 0.
-   * Incremented with by every call to #handle_iteration_next
+   * Updated in #monitor_iterate_cb()
    */
-  uint32_t offset;
+  uint64_t seq;
 
 };
 
@@ -206,6 +216,11 @@ static const struct GNUNET_CRYPTO_EcdsaPrivateKey zero;
 static const struct GNUNET_CONFIGURATION_Handle *GSN_cfg;
 
 /**
+ * Handle to the statistics service
+ */
+static struct GNUNET_STATISTICS_Handle *statistics;
+
+/**
  * Namecache handle.
  */
 static struct GNUNET_NAMECACHE_Handle *namecache;
@@ -245,6 +260,18 @@ static struct ZoneMonitor *monitor_tail;
  */
 static struct GNUNET_NotificationContext *monitor_nc;
 
+/**
+ * Optimize block insertion by caching map of private keys to
+ * public keys in memory?
+ */
+static int cache_keys;
+
+/**
+ * Use the namecache? Doing so creates additional cryptographic
+ * operations whenever we touch a record.
+ */
+static int disable_namecache;
+
 
 /**
  * Task run during shutdown.
@@ -269,8 +296,11 @@ cleanup_task (void *cls)
                                  cop);
     GNUNET_free (cop);
   }
-  GNUNET_NAMECACHE_disconnect (namecache);
-  namecache = NULL;
+  if (NULL != namecache)
+  {
+    GNUNET_NAMECACHE_disconnect (namecache);
+    namecache = NULL;
+  }
   GNUNET_break (NULL == GNUNET_PLUGIN_unload (db_lib_name,
                                               GSN_database));
   GNUNET_free (db_lib_name);
@@ -280,6 +310,12 @@ cleanup_task (void *cls)
     GNUNET_notification_context_destroy (monitor_nc);
     monitor_nc = NULL;
   }
+  if (NULL != statistics)
+  {
+    GNUNET_STATISTICS_destroy (statistics,
+                               GNUNET_NO);
+    statistics = NULL;
+  }
 }
 
 
@@ -362,18 +398,20 @@ client_connect_cb (void *cls,
 
 
 /**
- * Function called with the records for the #GNUNET_GNS_MASTERZONE_STR
+ * Function called with the records for the #GNUNET_GNS_EMPTY_LABEL_AT
  * label in the zone.  Used to locate the #GNUNET_GNSRECORD_TYPE_NICK
  * record, which (if found) is then copied to @a cls for future use.
  *
  * @param cls a `struct GNUNET_GNSRECORD_Data **` for storing the nick (if found)
+ * @param seq sequence number of the record
  * @param private_key the private key of the zone (unused)
- * @param label should be #GNUNET_GNS_MASTERZONE_STR
+ * @param label should be #GNUNET_GNS_EMPTY_LABEL_AT
  * @param rd_count number of records in @a rd
  * @param rd records stored under @a label in the zone
  */
 static void
 lookup_nick_it (void *cls,
+                uint64_t seq,
                 const struct GNUNET_CRYPTO_EcdsaPrivateKey *private_key,
                 const char *label,
                 unsigned int rd_count,
@@ -382,7 +420,8 @@ lookup_nick_it (void *cls,
   struct GNUNET_GNSRECORD_Data **res = cls;
 
   (void) private_key;
-  if (0 != strcmp (label, GNUNET_GNS_MASTERZONE_STR))
+  (void) seq;
+  if (0 != strcmp (label, GNUNET_GNS_EMPTY_LABEL_AT))
   {
     GNUNET_break (0);
     return;
@@ -423,14 +462,14 @@ get_nick_record (const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone)
   nick = NULL;
   res = GSN_database->lookup_records (GSN_database->cls,
                                       zone,
-                                      GNUNET_GNS_MASTERZONE_STR,
+                                      GNUNET_GNS_EMPTY_LABEL_AT,
                                       &lookup_nick_it,
                                       &nick);
   if ( (GNUNET_OK != res) ||
        (NULL == nick) )
   {
     GNUNET_CRYPTO_ecdsa_key_get_public (zone, &pub);
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO | GNUNET_ERROR_TYPE_BULK,
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG | GNUNET_ERROR_TYPE_BULK,
                 "No nick name set for zone `%s'\n",
                 GNUNET_GNSRECORD_z2s (&pub));
     return NULL;
@@ -439,9 +478,24 @@ get_nick_record (const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone)
 }
 
 
+/**
+ * Merge the nick record @a nick_rd with the rest of the
+ * record set given in @a rd2.  Store the result in @a rdc_res
+ * and @a rd_res.  The @a nick_rd's expiration time is set to
+ * the maximum expiration time of all of the records in @a rd2.
+ *
+ * @param nick_rd the nick record to integrate
+ * @param rd2_length length of the @a rd2 array
+ * @param rd2 array of records
+ * @param rdc_res[out] length of the resulting @a rd_res array
+ * @param rd_res[out] set to an array of records,
+ *                    including @a nick_rd and @a rd2;
+ *           all of the variable-size 'data' fields in @a rd2 are
+ *           allocated in the same chunk of memory!
+ */
 static void
 merge_with_nick_records (const struct GNUNET_GNSRECORD_Data *nick_rd,
-                         unsigned int rdc2,
+                         unsigned int rd2_length,
                          const struct GNUNET_GNSRECORD_Data *rd2,
                          unsigned int *rdc_res,
                          struct GNUNET_GNSRECORD_Data **rd_res)
@@ -452,24 +506,22 @@ merge_with_nick_records (const struct GNUNET_GNSRECORD_Data *nick_rd,
   int record_offset;
   size_t data_offset;
 
-  (*rdc_res) = 1 + rdc2;
-  if (0 == 1 + rdc2)
+  (*rdc_res) = 1 + rd2_length;
+  if (0 == 1 + rd2_length)
   {
     (*rd_res) = NULL;
     return;
   }
-
   req = 0;
   for (unsigned int c=0; c< 1; c++)
     req += sizeof (struct GNUNET_GNSRECORD_Data) + nick_rd[c].data_size;
-  for (unsigned int c=0; c< rdc2; c++)
+  for (unsigned int c=0; c< rd2_length; c++)
     req += sizeof (struct GNUNET_GNSRECORD_Data) + rd2[c].data_size;
   (*rd_res) = GNUNET_malloc (req);
-  data = (char *) &(*rd_res)[1 + rdc2];
+  data = (char *) &(*rd_res)[1 + rd2_length];
   data_offset = 0;
   latest_expiration = 0;
-
-  for (unsigned int c=0; c< rdc2; c++)
+  for (unsigned int c=0; c< rd2_length; c++)
   {
     if (0 != (rd2[c].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
     {
@@ -486,17 +538,15 @@ merge_with_nick_records (const struct GNUNET_GNSRECORD_Data *nick_rd,
                    rd2[c].data_size);
     data_offset += (*rd_res)[c].data_size;
   }
-  record_offset = rdc2;
-  for (unsigned int c=0; c< 1; c++)
-  {
-    (*rd_res)[c+record_offset] = nick_rd[c];
-    (*rd_res)[c+record_offset].expiration_time = latest_expiration;
-    (*rd_res)[c+record_offset].data = (void *) &data[data_offset];
-    GNUNET_memcpy ((void *) (*rd_res)[c+record_offset].data,
-                   nick_rd[c].data,
-                   nick_rd[c].data_size);
-    data_offset += (*rd_res)[c+record_offset].data_size;
-  }
+  /* append nick */
+  record_offset = rd2_length;
+  (*rd_res)[record_offset] = *nick_rd;
+  (*rd_res)[record_offset].expiration_time = latest_expiration;
+  (*rd_res)[record_offset].data = (void *) &data[data_offset];
+  GNUNET_memcpy ((void *) (*rd_res)[record_offset].data,
+                 nick_rd->data,
+                 nick_rd->data_size);
+  data_offset += (*rd_res)[record_offset].data_size;
   GNUNET_assert (req == (sizeof (struct GNUNET_GNSRECORD_Data)) * (*rdc_res) + data_offset);
 }
 
@@ -531,7 +581,9 @@ send_lookup_response (struct NamestoreClient *nc,
   char *rd_ser;
 
   nick = get_nick_record (zone_key);
-  if ((NULL != nick) && (0 != strcmp(name, GNUNET_GNS_MASTERZONE_STR)))
+  if ( (NULL != nick) &&
+       (0 != strcmp (name,
+                     GNUNET_GNS_EMPTY_LABEL_AT)))
   {
     nick->flags = (nick->flags | GNUNET_GNSRECORD_RF_PRIVATE) ^ GNUNET_GNSRECORD_RF_PRIVATE;
     merge_with_nick_records (nick,
@@ -569,6 +621,10 @@ send_lookup_response (struct NamestoreClient *nc,
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Sending RECORD_RESULT message with %u records\n",
               res_count);
+  GNUNET_STATISTICS_update (statistics,
+                            "Record sets sent to clients",
+                            1,
+                            GNUNET_NO);
   GNUNET_MQ_send (nc->mq,
                   env);
   if (rd != res)
@@ -659,6 +715,7 @@ refresh_block (struct NamestoreClient *nc,
   struct GNUNET_GNSRECORD_Data *nick;
   struct GNUNET_GNSRECORD_Data *res;
   unsigned int res_count;
+  struct GNUNET_TIME_Absolute exp_time;
 
   nick = get_nick_record (zone_key);
   res_count = rd_count;
@@ -672,26 +729,51 @@ refresh_block (struct NamestoreClient *nc,
                              &res);
     GNUNET_free (nick);
   }
-
   if (0 == res_count)
-    block = GNUNET_GNSRECORD_block_create (zone_key,
-                                           GNUNET_TIME_UNIT_ZERO_ABS,
-                                           name,
-                                           res, rd_count);
+  {
+    send_store_response (nc,
+                         GNUNET_OK,
+                         rid);
+    return; /* no data, no need to update cache */
+  }
+  if (GNUNET_YES == disable_namecache)
+  {
+    GNUNET_STATISTICS_update (statistics,
+                              "Namecache updates skipped (NC disabled)",
+                              1,
+                              GNUNET_NO);
+    send_store_response (nc,
+                         GNUNET_OK,
+                         rid);
+    return;
+  }
+  exp_time = GNUNET_GNSRECORD_record_get_expiration_time (res_count,
+                                                          res);
+  if (cache_keys)
+    block = GNUNET_GNSRECORD_block_create2 (zone_key,
+                                            exp_time,
+                                            name,
+                                            res,
+                                            res_count);
   else
     block = GNUNET_GNSRECORD_block_create (zone_key,
-                                           GNUNET_GNSRECORD_record_get_expiration_time (res_count,
-                                               res),
+                                           exp_time,
                                            name,
-                                           res, res_count);
+                                           res,
+                                           res_count);
   GNUNET_assert (NULL != block);
   GNUNET_CRYPTO_ecdsa_key_get_public (zone_key,
                                       &pkey);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Caching block for label `%s' with %u records in zone `%s' in namecache\n",
+              "Caching block for label `%s' with %u records and expiration %s in zone `%s' in namecache\n",
               name,
               res_count,
+              GNUNET_STRINGS_absolute_time_to_string (exp_time),
               GNUNET_GNSRECORD_z2s (&pkey));
+  GNUNET_STATISTICS_update (statistics,
+                            "Namecache updates pushed",
+                            1,
+                            GNUNET_NO);
   cop = GNUNET_new (struct CacheOperation);
   cop->nc = nc;
   cop->rid = rid;
@@ -746,9 +828,11 @@ struct RecordLookupContext
 
 /**
  * FIXME.
+ * @param seq sequence number of the record
  */
 static void
 lookup_it (void *cls,
+           uint64_t seq,
            const struct GNUNET_CRYPTO_EcdsaPrivateKey *private_key,
            const char *label,
            unsigned int rd_count,
@@ -759,23 +843,26 @@ lookup_it (void *cls,
   unsigned int rdc_res;
 
   (void) private_key;
-  if (0 == strcmp (label, rlc->label))
+  (void) seq;
+  if (0 == strcmp (label,
+                   rlc->label))
   {
     rlc->found = GNUNET_YES;
     if (0 != rd_count)
     {
       if ( (NULL != rlc->nick) &&
            (0 != strcmp (label,
-                         GNUNET_GNS_MASTERZONE_STR)) )
+                         GNUNET_GNS_EMPTY_LABEL_AT)) )
       {
         /* Merge */
         rd_res = NULL;
         rdc_res = 0;
         rlc->nick->flags = (rlc->nick->flags | GNUNET_GNSRECORD_RF_PRIVATE) ^ GNUNET_GNSRECORD_RF_PRIVATE;
         merge_with_nick_records (rlc->nick,
-                                 rd_count, rd,
-                                 &rdc_res, &rd_res);
-
+                                 rd_count,
+                                 rd,
+                                 &rdc_res,
+                                 &rd_res);
         rlc->rd_ser_len = GNUNET_GNSRECORD_records_get_size (rdc_res,
                                                              rd_res);
         rlc->res_rd_count = rdc_res;
@@ -945,7 +1032,8 @@ check_record_store (void *cls,
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  if ((0 == name_len) || (name_len > MAX_NAME_LEN))
+  if ( (0 == name_len) ||
+       (name_len > MAX_NAME_LEN) )
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -979,7 +1067,6 @@ handle_record_store (void *cls,
   const char *rd_ser;
   unsigned int rd_count;
   int res;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
   struct ZoneMonitor *zm;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -1006,8 +1093,6 @@ handle_record_store (void *cls,
     }
 
     /* Extracting and converting private key */
-    GNUNET_CRYPTO_ecdsa_key_get_public (&rp_msg->private_key,
-                                        &pubkey);
     conv_name = GNUNET_GNSRECORD_string_to_lowercase (name_tmp);
     if (NULL == conv_name)
     {
@@ -1018,18 +1103,16 @@ handle_record_store (void *cls,
       return;
     }
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Creating %u records for name `%s' in zone `%s'\n",
+                "Creating %u records for name `%s'\n",
                 (unsigned int) rd_count,
-                conv_name,
-                GNUNET_GNSRECORD_z2s (&pubkey));
-
+                conv_name);
     if ( (0 == rd_count) &&
          (GNUNET_NO ==
-          GSN_database->iterate_records (GSN_database->cls,
-                                         &rp_msg->private_key,
-                                         0,
-                                         NULL,
-                                         0)) )
+          GSN_database->lookup_records (GSN_database->cls,
+                                        &rp_msg->private_key,
+                                        conv_name,
+                                        NULL,
+                                        0)) )
     {
       /* This name does not exist, so cannot be removed */
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -1043,12 +1126,12 @@ handle_record_store (void *cls,
       unsigned int rd_clean_off;
 
       /* remove "NICK" records, unless this is for the
-         #GNUNET_GNS_MASTERZONE_STR label */
+         #GNUNET_GNS_EMPTY_LABEL_AT label */
       rd_clean_off = 0;
       for (unsigned int i=0;i<rd_count;i++)
       {
         rd_clean[rd_clean_off] = rd[i];
-        if ( (0 == strcmp (GNUNET_GNS_MASTERZONE_STR,
+        if ( (0 == strcmp (GNUNET_GNS_EMPTY_LABEL_AT,
                            conv_name)) ||
              (GNUNET_GNSRECORD_TYPE_NICK != rd[i].record_type) )
           rd_clean_off++;
@@ -1062,7 +1145,8 @@ handle_record_store (void *cls,
       {
         for (zm = monitor_head; NULL != zm; zm = zm->next)
         {
-          if ( (0 == memcmp (&rp_msg->private_key, &zm->zone,
+          if ( (0 == memcmp (&rp_msg->private_key,
+                             &zm->zone,
                              sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey))) ||
                (0 == memcmp (&zm->zone,
                              &zero,
@@ -1142,6 +1226,7 @@ struct ZoneToNameCtx
  * Zone to name iterator
  *
  * @param cls struct ZoneToNameCtx *
+ * @param seq sequence number of the record
  * @param zone_key the zone key
  * @param name name
  * @param rd_count number of records in @a rd
@@ -1149,6 +1234,7 @@ struct ZoneToNameCtx
  */
 static void
 handle_zone_to_name_it (void *cls,
+                        uint64_t seq,
                         const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
                         const char *name,
                         unsigned int rd_count,
@@ -1164,6 +1250,7 @@ handle_zone_to_name_it (void *cls,
   char *name_tmp;
   char *rd_tmp;
 
+  (void) seq;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Found result for zone-to-name lookup: `%s'\n",
               name);
@@ -1252,29 +1339,6 @@ handle_zone_to_name (void *cls,
 
 
 /**
- * Zone iteration processor result
- */
-enum ZoneIterationResult
-{
-  /**
-   * Iteration start.
-   */
-  IT_START = 0,
-
-  /**
-   * Found records,
-   * Continue to iterate with next iteration_next call
-   */
-  IT_SUCCESS_MORE_AVAILABLE = 1,
-
-  /**
-   * Iteration complete
-   */
-  IT_SUCCESS_NOT_MORE_RESULTS_AVAILABLE = 2
-};
-
-
-/**
  * Context for record remove operations passed from
  * #run_zone_iteration_round to #zone_iterate_proc as closure
  */
@@ -1286,13 +1350,9 @@ struct ZoneIterationProcResult
   struct ZoneIteration *zi;
 
   /**
-   * Iteration result: iteration done?
-   * #IT_SUCCESS_MORE_AVAILABLE:  if there may be more results overall but
-   * we got one for now and have sent it to the client
-   * #IT_SUCCESS_NOT_MORE_RESULTS_AVAILABLE: if there are no further results,
-   * #IT_START: if we are still trying to find a result.
+   * Number of results left to be returned in this iteration.
    */
-  int res_iteration_finished;
+  uint64_t limit;
 
 };
 
@@ -1300,7 +1360,8 @@ struct ZoneIterationProcResult
 /**
  * Process results for zone iteration from database
  *
- * @param cls struct ZoneIterationProcResult *proc
+ * @param cls struct ZoneIterationProcResult
+ * @param seq sequence number of the record
  * @param zone_key the zone key
  * @param name name
  * @param rd_count number of records for this name
@@ -1308,6 +1369,7 @@ struct ZoneIterationProcResult
  */
 static void
 zone_iterate_proc (void *cls,
+                   uint64_t seq,
                    const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
                    const char *name,
                    unsigned int rd_count,
@@ -1316,21 +1378,28 @@ zone_iterate_proc (void *cls,
   struct ZoneIterationProcResult *proc = cls;
   int do_refresh_block;
 
-  if ((NULL == zone_key) && (NULL == name))
+  if ( (NULL == zone_key) &&
+       (NULL == name) )
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Iteration done\n");
-    proc->res_iteration_finished = IT_SUCCESS_NOT_MORE_RESULTS_AVAILABLE;
     return;
   }
-  if ((NULL == zone_key) || (NULL == name))
+  if ( (NULL == zone_key) ||
+       (NULL == name) )
   {
     /* what is this!? should never happen */
-    proc->res_iteration_finished = IT_START;
     GNUNET_break (0);
     return;
   }
-  proc->res_iteration_finished = IT_SUCCESS_MORE_AVAILABLE;
+  if (0 == proc->limit)
+  {
+    /* what is this!? should never happen */
+    GNUNET_break (0);
+    return;
+  }
+  proc->limit--;
+  proc->zi->seq = seq;
   send_lookup_response (proc->zi->nc,
                         proc->zi->request_id,
                         zone_key,
@@ -1351,7 +1420,6 @@ zone_iterate_proc (void *cls,
                    name,
                    rd_count,
                    rd);
-
 }
 
 
@@ -1359,41 +1427,58 @@ zone_iterate_proc (void *cls,
  * Perform the next round of the zone iteration.
  *
  * @param zi zone iterator to process
+ * @param limit number of results to return in one pass
  */
 static void
-run_zone_iteration_round (struct ZoneIteration *zi)
+run_zone_iteration_round (struct ZoneIteration *zi,
+                          uint64_t limit)
 {
   struct ZoneIterationProcResult proc;
   struct GNUNET_MQ_Envelope *env;
   struct RecordResultMessage *rrm;
-  int ret;
+  struct GNUNET_TIME_Absolute start;
+  struct GNUNET_TIME_Relative duration;
 
-  memset (&proc, 0, sizeof (proc));
+  memset (&proc,
+          0,
+          sizeof (proc));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Asked to return up to %llu records at position %llu\n",
+              (unsigned long long) limit,
+              (unsigned long long) zi->seq);
   proc.zi = zi;
-  proc.res_iteration_finished = IT_START;
-  while (IT_START == proc.res_iteration_finished)
-  {
-    if (GNUNET_SYSERR ==
-        (ret = GSN_database->iterate_records (GSN_database->cls,
-                                              (0 == memcmp (&zi->zone, &zero, sizeof (zero)))
-                                              ? NULL
-                                              : &zi->zone,
-                                              zi->offset,
-                                              &zone_iterate_proc, &proc)))
-    {
-      GNUNET_break (0);
-      break;
-    }
-    if (GNUNET_NO == ret)
-      proc.res_iteration_finished = IT_SUCCESS_NOT_MORE_RESULTS_AVAILABLE;
-    zi->offset++;
-  }
-  if (IT_SUCCESS_MORE_AVAILABLE == proc.res_iteration_finished)
+  proc.limit = limit;
+  start = GNUNET_TIME_absolute_get ();
+  GNUNET_break (GNUNET_SYSERR !=
+                GSN_database->iterate_records (GSN_database->cls,
+                                               (0 == memcmp (&zi->zone,
+                                                             &zero,
+                                                             sizeof (zero)))
+                                               ? NULL
+                                               : &zi->zone,
+                                               zi->seq,
+                                               limit,
+                                               &zone_iterate_proc,
+                                               &proc));
+  duration = GNUNET_TIME_absolute_get_duration (start);
+  duration = GNUNET_TIME_relative_divide (duration,
+                                          limit - proc.limit);
+  GNUNET_STATISTICS_set (statistics,
+                         "NAMESTORE iteration delay (μs/record)",
+                         duration.rel_value_us,
+                         GNUNET_NO);
+  if (0 == proc.limit)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "More results available\n");
-    return; /* more results later */
+                "Returned %llu results, more results available\n",
+                (unsigned long long) limit);
+    return; /* more results later after we get the
+               #GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_NEXT message */
   }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Completed iteration after %llu/%llu results\n",
+              (unsigned long long) (limit - proc.limit),
+              (unsigned long long) limit);
   /* send empty response to indicate end of list */
   env = GNUNET_MQ_msg (rrm,
                        GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_RESULT);
@@ -1431,7 +1516,8 @@ handle_iteration_start (void *cls,
   GNUNET_CONTAINER_DLL_insert (nc->op_head,
                                nc->op_tail,
                                zi);
-  run_zone_iteration_round (zi);
+  run_zone_iteration_round (zi,
+                            1);
   GNUNET_SERVICE_client_continue (nc->client);
 }
 
@@ -1451,8 +1537,7 @@ handle_iteration_stop (void *cls,
   uint32_t rid;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Received `%s' message\n",
-              "ZONE_ITERATION_STOP");
+              "Received ZONE_ITERATION_STOP message\n");
   rid = ntohl (zis_msg->gns_header.r_id);
   for (zi = nc->op_head; NULL != zi; zi = zi->next)
     if (zi->request_id == rid)
@@ -1484,10 +1569,16 @@ handle_iteration_next (void *cls,
   struct NamestoreClient *nc = cls;
   struct ZoneIteration *zi;
   uint32_t rid;
+  uint64_t limit;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received ZONE_ITERATION_NEXT message\n");
+  GNUNET_STATISTICS_update (statistics,
+                            "Iteration NEXT messages received",
+                            1,
+                            GNUNET_NO);
   rid = ntohl (zis_msg->gns_header.r_id);
+  limit = GNUNET_ntohll (zis_msg->limit);
   for (zi = nc->op_head; NULL != zi; zi = zi->next)
     if (zi->request_id == rid)
       break;
@@ -1497,7 +1588,8 @@ handle_iteration_next (void *cls,
     GNUNET_SERVICE_client_drop (nc->client);
     return;
   }
-  run_zone_iteration_round (zi);
+  run_zone_iteration_round (zi,
+                            limit);
   GNUNET_SERVICE_client_continue (nc->client);
 }
 
@@ -1533,6 +1625,7 @@ monitor_next (void *cls);
  * A #GNUNET_NAMESTORE_RecordIterator for monitors.
  *
  * @param cls a 'struct ZoneMonitor *' with information about the monitor
+ * @param seq sequence number of the record
  * @param zone_key zone key of the zone
  * @param name name
  * @param rd_count number of records in @a rd
@@ -1540,6 +1633,7 @@ monitor_next (void *cls);
  */
 static void
 monitor_iterate_cb (void *cls,
+                    uint64_t seq,
                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
                     const char *name,
                     unsigned int rd_count,
@@ -1547,12 +1641,17 @@ monitor_iterate_cb (void *cls,
 {
   struct ZoneMonitor *zm = cls;
 
+  zm->seq = seq;
   if (NULL == name)
   {
     /* finished with iteration */
     monitor_sync (zm);
     return;
   }
+  GNUNET_STATISTICS_update (statistics,
+                            "Monitor notifications sent",
+                            1,
+                            GNUNET_NO);
   send_lookup_response (zm->nc,
                         0,
                         zone_key,
@@ -1598,7 +1697,7 @@ handle_monitor_start (void *cls,
 
 
 /**
- * Obtain the next datum during the zone monitor's zone intiial iteration.
+ * Obtain the next datum during the zone monitor's zone initial iteration.
  *
  * @param cls zone monitor that does its initial iteration
  */
@@ -1615,7 +1714,8 @@ monitor_next (void *cls)
                                                      sizeof (zero)))
                                        ? NULL
                                        : &zm->zone,
-                                       zm->offset++,
+                                       zm->seq,
+                                       1,
                                        &monitor_iterate_cb,
                                        zm);
   if (GNUNET_SYSERR == ret)
@@ -1650,9 +1750,19 @@ run (void *cls,
   (void) service;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Starting namestore service\n");
+  cache_keys = GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                                     "namestore",
+                                                     "CACHE_KEYS");
+  disable_namecache = GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                                            "namecache",
+                                                            "DISABLE");
   GSN_cfg = cfg;
   monitor_nc = GNUNET_notification_context_create (1);
-  namecache = GNUNET_NAMECACHE_connect (cfg);
+  if (GNUNET_YES != disable_namecache)
+  {
+    namecache = GNUNET_NAMECACHE_connect (cfg);
+    GNUNET_assert (NULL != namecache);
+  }
   /* Loading database plugin */
   if (GNUNET_OK !=
       GNUNET_CONFIGURATION_get_value_string (cfg,
@@ -1668,6 +1778,8 @@ run (void *cls,
   GSN_database = GNUNET_PLUGIN_load (db_lib_name,
                                      (void *) GSN_cfg);
   GNUNET_free (database);
+  statistics = GNUNET_STATISTICS_create ("namestore",
+                                         cfg);
   GNUNET_SCHEDULER_add_shutdown (&cleanup_task,
                                  NULL);
   if (NULL == GSN_database)
diff --git a/src/namestore/gnunet-zoneimport.c b/src/namestore/gnunet-zoneimport.c
index 4f4151c94..0fd0a4ab8 100644
--- a/src/namestore/gnunet-zoneimport.c
+++ b/src/namestore/gnunet-zoneimport.c
@@ -21,9 +21,6 @@
  * @file src/namestore/gnunet-zoneimport.c
  * @brief import a DNS zone for publication in GNS, incremental
  * @author Christian Grothoff
- *
- * TODO:
- * - set NICKname for zone's records
  */
 #include "platform.h"
 #include <gnunet_util_lib.h>
@@ -31,13 +28,14 @@
 #include <gnunet_dnsparser_lib.h>
 #include <gnunet_gnsrecord_lib.h>
 #include <gnunet_namestore_service.h>
+#include <gnunet_statistics_service.h>
 #include <gnunet_identity_service.h>
 
 
 /**
  * Maximum number of queries pending at the same time.
  */
-#define THRESH 20
+#define THRESH 100
 
 /**
  * TIME_THRESH is in usecs.  How quickly do we submit fresh queries.
@@ -51,10 +49,20 @@
 #define MAX_RETRIES 5
 
 /**
- * After how many lookups should we always sync to disk?
+ * How many DNS requests do we at most issue in rapid series?
+ */
+#define MAX_SERIES 10
+
+/**
+ * How long do we wait at least between series of requests?
  */
-#define TRANSACTION_SYNC_FREQ 100
+#define SERIES_DELAY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MICROSECONDS, 10)
 
+/**
+ * How many requests do we request from NAMESTORE in one batch
+ * during our initial iteration?
+ */
+#define NS_BATCH_SIZE 1024
 
 /**
  * Some zones may include authoritative records for other
@@ -112,7 +120,9 @@ struct Record
 
 
 /**
- * Request we should make.
+ * Request we should make.  We keep this struct in memory per request,
+ * thus optimizing it is crucial for the overall memory consumption of
+ * the zone importer.
  */
 struct Request
 {
@@ -149,21 +159,13 @@ struct Request
   struct GNUNET_DNSSTUB_RequestSocket *rs;
 
   /**
-   * Raw DNS query.
-   */
-  void *raw;
-
-  /**
-   * Hostname we are resolving.
+   * Hostname we are resolving, allocated at the end of
+   * this struct (optimizing memory consumption by reducing
+   * total number of allocations).
    */
   char *hostname;
 
   /**
-   * Label (without TLD) which we are resolving.
-   */
-  char *label;
-
-  /**
    * Namestore operation pending for this record.
    */
   struct GNUNET_NAMESTORE_QueueEntry *qe;
@@ -174,12 +176,6 @@ struct Request
   const struct Zone *zone;
 
   /**
-   * Answer we got back and are currently parsing, or NULL
-   * if not active.
-   */
-  struct GNUNET_DNSPARSER_Packet *p;
-
-  /**
    * At what time does the (earliest) of the returned records
    * for this name expire? At this point, we need to re-fetch
    * the record.
@@ -187,20 +183,18 @@ struct Request
   struct GNUNET_TIME_Absolute expires;
 
   /**
-   * Number of bytes in @e raw.
+   * While we are fetching the record, the value is set to the
+   * starting time of the DNS operation.  While doing a
+   * NAMESTORE store, again set to the start time of the
+   * NAMESTORE operation.
    */
-  size_t raw_len;
-
-  /**
-   * When did we last issue this request?
-   */
-  time_t time;
+  struct GNUNET_TIME_Absolute op_start_time;
 
   /**
    * How often did we issue this query? (And failed, reset
    * to zero once we were successful.)
    */
-  int issue_num;
+  unsigned int issue_num;
 
   /**
    * random 16-bit DNS query identifier.
@@ -210,6 +204,14 @@ struct Request
 
 
 /**
+ * Command-line argument specifying desired size of the hash map with
+ * all of our pending names.  Usually, we use an automatically growing
+ * map, but this is only OK up to about a million entries.  Above that
+ * number, the user must explicitly specify the size at startup.
+ */
+static unsigned int map_size = 1024;
+
+/**
  * Handle to the identity service.
  */
 static struct GNUNET_IDENTITY_Handle *id;
@@ -220,21 +222,36 @@ static struct GNUNET_IDENTITY_Handle *id;
 static struct GNUNET_NAMESTORE_Handle *ns;
 
 /**
+ * Handle to the statistics service.
+ */
+static struct GNUNET_STATISTICS_Handle *stats;
+
+/**
  * Context for DNS resolution.
  */
 static struct GNUNET_DNSSTUB_Context *ctx;
 
 /**
- * The number of queries that are outstanding
+ * The number of DNS queries that are outstanding
  */
 static unsigned int pending;
 
 /**
+ * The number of NAMESTORE record store operations that are outstanding
+ */
+static unsigned int pending_rs;
+
+/**
  * Number of lookups we performed overall.
  */
 static unsigned int lookups;
 
 /**
+ * Number of records we had cached.
+ */
+static unsigned int cached;
+
+/**
  * How many hostnames did we reject (malformed).
  */
 static unsigned int rejects;
@@ -250,6 +267,11 @@ static unsigned int failures;
 static unsigned int records;
 
 /**
+ * Number of record sets given to namestore.
+ */
+static unsigned int record_sets;
+
+/**
  * Heap of all requests to perform, sorted by
  * the time we should next do the request (i.e. by expires).
  */
@@ -271,9 +293,16 @@ static struct Request *req_tail;
 static struct GNUNET_SCHEDULER_Task *t;
 
 /**
- * Which DNS server do we use for queries?
+ * Hash map of requests for which we may still get a response from
+ * the namestore.  Set to NULL once the initial namestore iteration
+ * is done.
+ */
+static struct GNUNET_CONTAINER_MultiHashMap *ns_pending;
+
+/**
+ * Current zone iteration handle.
  */
-static char *dns_server;
+static struct GNUNET_NAMESTORE_ZoneIterator *zone_it;
 
 /**
  * Head of list of zones we are managing.
@@ -285,6 +314,47 @@ static struct Zone *zone_head;
  */
 static struct Zone *zone_tail;
 
+/**
+ * After how many more results must #ns_lookup_result_cb() ask
+ * the namestore for more?
+ */
+static uint64_t ns_iterator_trigger_next;
+
+/**
+ * Number of DNS requests counted in latency total.
+ */
+static uint64_t total_dns_latency_cnt;
+
+/**
+ * Sum of DNS latencies observed.
+ */
+static struct GNUNET_TIME_Relative total_dns_latency;
+
+/**
+ * Number of records processed (DNS lookup, no NAMESTORE) in total.
+ */
+static uint64_t total_reg_proc_dns;
+
+/**
+ * Number of records processed (DNS lookup, with NAMESTORE) in total.
+ */
+static uint64_t total_reg_proc_dns_ns;
+
+/**
+ * Start time of the regular processing.
+ */
+static struct GNUNET_TIME_Absolute start_time_reg_proc;
+
+/**
+ * Last time we worked before going idle.
+ */
+static struct GNUNET_TIME_Absolute sleep_time_reg_proc;
+
+/**
+ * Time we slept just waiting for work.
+ */
+static struct GNUNET_TIME_Relative idle_time;
+
 
 /**
  * Callback for #for_all_records
@@ -335,15 +405,107 @@ for_all_records (const struct GNUNET_DNSPARSER_Packet *p,
 
 
 /**
- * Free @a req and data structures reachable from it.
+ * Return just the label of the hostname in @a req.
  *
- * @param req request to free
+ * @param req request to process hostname of
+ * @return statically allocated pointer to the label,
+ *         overwritten upon the next request!
+ */
+static const char *
+get_label (struct Request *req)
+{
+  static char label[64];
+  const char *dot;
+
+  dot = strchr (req->hostname,
+                (unsigned char) '.');
+  if (NULL == dot)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (((size_t) (dot - req->hostname)) >= sizeof (label))
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  memcpy (label,
+          req->hostname,
+          dot - req->hostname);
+  label[dot - req->hostname] = '\0';
+  return label;
+}
+
+
+/**
+ * Build DNS query for @a hostname.
+ *
+ * @param hostname host to build query for
+ * @param raw_size[out] number of bytes in the query
+ * @return NULL on error, otherwise pointer to statically (!)
+ *         allocated query buffer
+ */
+static void *
+build_dns_query (struct Request *req,
+                 size_t *raw_size)
+{
+  static char raw[512];
+  char *rawp;
+  struct GNUNET_DNSPARSER_Packet p;
+  struct GNUNET_DNSPARSER_Query q;
+
+  q.name = (char *) req->hostname;
+  q.type = GNUNET_DNSPARSER_TYPE_NS;
+  q.dns_traffic_class = GNUNET_TUN_DNS_CLASS_INTERNET;
+
+  memset (&p,
+          0,
+          sizeof (p));
+  p.num_queries = 1;
+  p.queries = &q;
+  p.id = req->id;
+  if (GNUNET_OK !=
+      GNUNET_DNSPARSER_pack (&p,
+                             UINT16_MAX,
+                             &rawp,
+                             raw_size))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to pack query for hostname `%s'\n",
+                req->hostname);
+    rejects++;
+    return NULL;
+  }
+  if (*raw_size > sizeof (raw))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to pack query for hostname `%s'\n",
+                req->hostname);
+    rejects++;
+    GNUNET_break (0);
+    GNUNET_free (rawp);
+    return NULL;
+  }
+  memcpy (raw,
+          rawp,
+          *raw_size);
+  GNUNET_free (rawp);
+  return raw;
+}
+
+
+
+/**
+ * Free records associated with @a req.
+ *
+ * @param req request to free records of
  */
 static void
-free_request (struct Request *req)
+free_records (struct Request *req)
 {
   struct Record *rec;
 
+  /* Free records */
   while (NULL != (rec = req->rec_head))
   {
     GNUNET_CONTAINER_DLL_remove (req->rec_head,
@@ -351,9 +513,18 @@ free_request (struct Request *req)
                                  rec);
     GNUNET_free (rec);
   }
-  GNUNET_free (req->hostname);
-  GNUNET_free (req->label);
-  GNUNET_free (req->raw);
+}
+
+
+/**
+ * Free @a req and data structures reachable from it.
+ *
+ * @param req request to free
+ */
+static void
+free_request (struct Request *req)
+{
+  free_records (req);
   GNUNET_free (req);
 }
 
@@ -382,6 +553,7 @@ insert_sorted (struct Request *req)
   {
     if (NULL != t)
       GNUNET_SCHEDULER_cancel (t);
+    sleep_time_reg_proc = GNUNET_TIME_absolute_get ();
     t = GNUNET_SCHEDULER_add_at (req->expires,
                                  &process_queue,
                                  NULL);
@@ -564,16 +736,35 @@ check_for_glue (void *cls,
 
 
 /**
+ * Closure for #process_record().
+ */
+struct ProcessRecordContext
+{
+  /**
+   * Answer we got back and are currently parsing, or NULL
+   * if not active.
+   */
+  struct GNUNET_DNSPARSER_Packet *p;
+
+  /**
+   * Request we are processing.
+   */
+  struct Request *req;
+};
+
+
+/**
  * We received @a rec for @a req. Remember the answer.
  *
- * @param cls a `struct Request`
+ * @param cls a `struct ProcessRecordContext`
  * @param rec response
  */
 static void
 process_record (void *cls,
                 const struct GNUNET_DNSPARSER_Record *rec)
 {
-  struct Request *req = cls;
+  struct ProcessRecordContext *prc = cls;
+  struct Request *req = prc->req;
   char dst[65536];
   size_t dst_len;
   size_t off;
@@ -585,7 +776,7 @@ process_record (void *cls,
                        req->hostname))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "DNS returned record for `%s' of type %u while resolving `%s'\n",
+                "DNS returned record from zone `%s' of type %u while resolving `%s'\n",
                 rec->name,
                 (unsigned int) rec->type,
                 req->hostname);
@@ -600,6 +791,10 @@ process_record (void *cls,
                 req->hostname);
     return; /* record expired */
   }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "DNS returned record that expires at %s for `%s'\n",
+              GNUNET_STRINGS_absolute_time_to_string (rec->expiration_time),
+              req->hostname);
   switch (rec->type)
   {
   case GNUNET_DNSPARSER_TYPE_NS:
@@ -610,7 +805,7 @@ process_record (void *cls,
       gc.req = req;
       gc.ns = rec->data.hostname;
       gc.found = GNUNET_NO;
-      for_all_records (req->p,
+      for_all_records (prc->p,
                        &check_for_glue,
                        &gc);
       if ( (GNUNET_NO == gc.found) &&
@@ -665,10 +860,10 @@ process_record (void *cls,
     break;
   case GNUNET_DNSPARSER_TYPE_DNAME:
     /* No support for DNAME in GNS yet! FIXME: support later! */
-    fprintf (stdout,
-             "FIXME: not supported: %s DNAME %s\n",
-             rec->name,
-             rec->data.hostname);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "FIXME: not supported: %s DNAME %s\n",
+                rec->name,
+                rec->data.hostname);
     break;
   case GNUNET_DNSPARSER_TYPE_MX:
     if (GNUNET_OK ==
@@ -794,10 +989,10 @@ store_completed_cb (void *cls,
                     int32_t success,
                     const char *emsg)
 {
+  static struct GNUNET_TIME_Absolute last;
   struct Request *req = cls;
 
   req->qe = NULL;
-  pending--;
   if (GNUNET_SYSERR == success)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
@@ -807,9 +1002,75 @@ store_completed_cb (void *cls,
   }
   else
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                "Stored records under `%s'\n",
-                req->label);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Stored records under `%s' (%d)\n",
+                req->hostname,
+                success);
+  }
+  total_reg_proc_dns_ns++; /* finished regular processing */
+  pending_rs--;
+  free_records (req);
+  /* compute NAMESTORE statistics */
+  {
+    static uint64_t total_ns_latency_cnt;
+    static struct GNUNET_TIME_Relative total_ns_latency;
+    struct GNUNET_TIME_Relative ns_latency;
+
+    ns_latency = GNUNET_TIME_absolute_get_duration (req->op_start_time);
+    total_ns_latency = GNUNET_TIME_relative_add (total_ns_latency,
+                                                 ns_latency);
+    if (0 == total_ns_latency_cnt)
+      last = GNUNET_TIME_absolute_get ();
+    total_ns_latency_cnt++;
+    if (0 == (total_ns_latency_cnt % 1000))
+    {
+      struct GNUNET_TIME_Relative delta;
+
+      delta = GNUNET_TIME_absolute_get_duration (last);
+      last = GNUNET_TIME_absolute_get ();
+      fprintf (stderr,
+               "Processed 1000 records in %s\n",
+               GNUNET_STRINGS_relative_time_to_string (delta,
+                                                       GNUNET_YES));
+      GNUNET_STATISTICS_set (stats,
+                             "# average NAMESTORE PUT latency (μs)",
+                             total_ns_latency.rel_value_us / total_ns_latency_cnt,
+                             GNUNET_NO);
+    }
+  }
+  /* compute and publish overall velocity */
+  if (0 == (total_reg_proc_dns_ns % 100) )
+  {
+    struct GNUNET_TIME_Relative runtime;
+
+    runtime = GNUNET_TIME_absolute_get_duration (start_time_reg_proc);
+    runtime = GNUNET_TIME_relative_subtract (runtime,
+                                             idle_time);
+    runtime = GNUNET_TIME_relative_divide (runtime,
+                                           total_reg_proc_dns + total_reg_proc_dns_ns);
+    GNUNET_STATISTICS_set (stats,
+                           "# Regular processing completed without NAMESTORE",
+                           total_reg_proc_dns,
+                           GNUNET_NO);
+    GNUNET_STATISTICS_set (stats,
+                           "# Regular processing completed with NAMESTORE PUT",
+                           total_reg_proc_dns_ns,
+                           GNUNET_NO);
+    GNUNET_STATISTICS_set (stats,
+                           "# average request processing latency (μs)",
+                           runtime.rel_value_us,
+                           GNUNET_NO);
+    GNUNET_STATISTICS_set (stats,
+                           "# total time spent idle (μs)",
+                           idle_time.rel_value_us,
+                           GNUNET_NO);
+  }
+
+  if (NULL == t)
+  {
+    sleep_time_reg_proc = GNUNET_TIME_absolute_get ();
+    t = GNUNET_SCHEDULER_add_now (&process_queue,
+                                  NULL);
   }
 }
 
@@ -818,13 +1079,11 @@ store_completed_cb (void *cls,
  * Function called with the result of a DNS resolution.
  *
  * @param cls closure with the `struct Request`
- * @param rs socket that received the response
  * @param dns dns response, never NULL
  * @param dns_len number of bytes in @a dns
  */
 static void
 process_result (void *cls,
-                struct GNUNET_DNSSTUB_RequestSocket *rs,
                 const struct GNUNET_TUN_DnsHeader *dns,
                 size_t dns_len)
 {
@@ -833,7 +1092,6 @@ process_result (void *cls,
   struct GNUNET_DNSPARSER_Packet *p;
   unsigned int rd_count;
 
-  (void) rs;
   GNUNET_assert (NULL == req->hn);
   if (NULL == dns)
   {
@@ -842,26 +1100,50 @@ process_result (void *cls,
                                  req_tail,
                                  req);
     pending--;
+    if (NULL == t)
+    {
+      sleep_time_reg_proc = GNUNET_TIME_absolute_get ();
+      t = GNUNET_SCHEDULER_add_now (&process_queue,
+                                    NULL);
+    }
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 "Stub gave up on DNS reply for `%s'\n",
                 req->hostname);
+    GNUNET_STATISTICS_update (stats,
+                              "# DNS lookups timed out",
+                              1,
+                              GNUNET_NO);
     if (req->issue_num > MAX_RETRIES)
     {
       failures++;
       free_request (req);
+      GNUNET_STATISTICS_update (stats,
+                                "# requests given up on",
+                                1,
+                                GNUNET_NO);
       return;
     }
+    total_reg_proc_dns++;
     req->rs = NULL;
     insert_sorted (req);
     return;
   }
   if (req->id != dns->id)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "DNS ID did not match request, ignoring reply\n");
+    GNUNET_STATISTICS_update (stats,
+                              "# DNS ID missmatches",
+                              1,
+                              GNUNET_NO);
     return;
+  }
   GNUNET_CONTAINER_DLL_remove (req_head,
                                req_tail,
                                req);
   GNUNET_DNSSTUB_resolve_cancel (req->rs);
   req->rs = NULL;
+  pending--;
   p = GNUNET_DNSPARSER_parse ((const char *) dns,
                               dns_len);
   if (NULL == p)
@@ -869,35 +1151,59 @@ process_result (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 "Failed to parse DNS reply for `%s'\n",
                 req->hostname);
+    GNUNET_STATISTICS_update (stats,
+                              "# DNS parser errors",
+                              1,
+                              GNUNET_NO);
+    if (NULL == t)
+    {
+      sleep_time_reg_proc = GNUNET_TIME_absolute_get ();
+      t = GNUNET_SCHEDULER_add_now (&process_queue,
+                                    NULL);
+    }
     if (req->issue_num > MAX_RETRIES)
     {
       failures++;
-      insert_sorted (req);
-      pending--;
+      free_request (req);
+      GNUNET_STATISTICS_update (stats,
+                                "# requests given up on",
+                                1,
+                                GNUNET_NO);
       return;
     }
     insert_sorted (req);
-    pending--;
     return;
   }
-  /* Free old/legacy records */
-  while (NULL != (rec = req->rec_head))
-  {
-    GNUNET_CONTAINER_DLL_remove (req->rec_head,
-                                 req->rec_tail,
-                                 rec);
-    GNUNET_free (rec);
-  }
   /* import new records */
   req->issue_num = 0; /* success, reset counter! */
-  req->p = p;
-  for_all_records (p,
-                   &process_record,
-                   req);
-  req->p = NULL;
+  {
+    struct ProcessRecordContext prc = {
+      .req = req,
+      .p = p
+    };
+
+    for_all_records (p,
+                     &process_record,
+                     &prc);
+  }
   GNUNET_DNSPARSER_free_packet (p);
   /* count records found, determine minimum expiration time */
   req->expires = GNUNET_TIME_UNIT_FOREVER_ABS;
+  {
+    struct GNUNET_TIME_Relative dns_latency;
+
+    dns_latency = GNUNET_TIME_absolute_get_duration (req->op_start_time);
+    total_dns_latency = GNUNET_TIME_relative_add (total_dns_latency,
+                                                  dns_latency);
+    total_dns_latency_cnt++;
+    if (0 == (total_dns_latency_cnt % 1000))
+    {
+      GNUNET_STATISTICS_set (stats,
+                             "# average DNS lookup latency (μs)",
+                             total_dns_latency.rel_value_us / total_dns_latency_cnt,
+                             GNUNET_NO);
+    }
+  }
   rd_count = 0;
   for (rec = req->rec_head; NULL != rec; rec = rec->next)
   {
@@ -915,8 +1221,18 @@ process_result (void *cls,
   /* Instead of going for SOA, simplified for now to look each
      day in case we got an empty response */
   if (0 == rd_count)
+  {
     req->expires
       = GNUNET_TIME_relative_to_absolute (GNUNET_TIME_UNIT_DAYS);
+    GNUNET_STATISTICS_update (stats,
+                              "# empty DNS replies (usually NXDOMAIN)",
+                              1,
+                              GNUNET_NO);
+  }
+  else
+  {
+    record_sets++;
+  }
   /* convert records to namestore import format */
   {
     struct GNUNET_GNSRECORD_Data rd[GNUNET_NZL(rd_count)];
@@ -925,67 +1241,22 @@ process_result (void *cls,
     /* convert linked list into array */
     for (rec = req->rec_head; NULL != rec; rec =rec->next)
       rd[off++] = rec->grd;
+    pending_rs++;
+    req->op_start_time = GNUNET_TIME_absolute_get ();
     req->qe = GNUNET_NAMESTORE_records_store (ns,
                                               &req->zone->key,
-                                              req->label,
+                                              get_label (req),
                                               rd_count,
                                               rd,
                                               &store_completed_cb,
                                               req);
+    GNUNET_assert (NULL != req->qe);
   }
   insert_sorted (req);
 }
 
 
 /**
- * Submit a request to DNS unless we need to slow down because
- * we are at the rate limit.
- *
- * @param req request to submit
- * @return #GNUNET_OK if request was submitted
- *         #GNUNET_NO if request was already submitted
- *         #GNUNET_SYSERR if we are at the rate limit
- */
-static int
-submit_req (struct Request *req)
-{
-  static struct GNUNET_TIME_Absolute last_request;
-  struct GNUNET_TIME_Absolute now;
-
-  if (NULL != req->qe)
-    return GNUNET_NO; /* namestore op still pending */
-  if (NULL != req->rs)
-  {
-    GNUNET_break (0);
-    return GNUNET_NO; /* already submitted */
-  }
-  now = GNUNET_TIME_absolute_get ();
-  if ( (now.abs_value_us - last_request.abs_value_us < TIME_THRESH) ||
-       (pending >= THRESH) )
-    return GNUNET_SYSERR;
-  GNUNET_CONTAINER_DLL_insert (req_head,
-                               req_tail,
-                               req);
-  GNUNET_assert (NULL == req->rs);
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-              "Requesting resolution for `%s'\n",
-              req->hostname);
-  req->rs = GNUNET_DNSSTUB_resolve2 (ctx,
-                                     req->raw,
-                                     req->raw_len,
-                                     &process_result,
-                                     req);
-  GNUNET_assert (NULL != req->rs);
-  req->issue_num++;
-  last_request = now;
-  lookups++;
-  pending++;
-  req->time = time (NULL);
-  return GNUNET_OK;
-}
-
-
-/**
  * Process as many requests as possible from the queue.
  *
  * @param cls NULL
@@ -994,26 +1265,79 @@ static void
 process_queue (void *cls)
 {
   struct Request *req;
+  unsigned int series;
+  void *raw;
+  size_t raw_size;
+  struct GNUNET_TIME_Relative delay;
 
   (void) cls;
+  delay = GNUNET_TIME_absolute_get_duration (sleep_time_reg_proc);
+  idle_time = GNUNET_TIME_relative_add (idle_time,
+                                        delay);
+  series = 0;
   t = NULL;
-  while (1)
+  while (pending + pending_rs < THRESH)
   {
     req = GNUNET_CONTAINER_heap_peek (req_heap);
     if (NULL == req)
       break;
+    if (NULL != req->qe)
+      return; /* namestore op still pending */
+    if (NULL != req->rs)
+    {
+      GNUNET_break (0);
+      return; /* already submitted */
+    }
     if (GNUNET_TIME_absolute_get_remaining (req->expires).rel_value_us > 0)
       break;
-    if (GNUNET_OK != submit_req (req))
-      break;
     GNUNET_assert (req ==
                    GNUNET_CONTAINER_heap_remove_root (req_heap));
     req->hn = NULL;
+    GNUNET_CONTAINER_DLL_insert (req_head,
+                                 req_tail,
+                                 req);
+    GNUNET_assert (NULL == req->rs);
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Requesting resolution for `%s'\n",
+                req->hostname);
+    raw = build_dns_query (req,
+                           &raw_size);
+    if (NULL == raw)
+    {
+      GNUNET_break (0);
+      free_request (req);
+      continue;
+    }
+    req->op_start_time = GNUNET_TIME_absolute_get ();
+    req->rs = GNUNET_DNSSTUB_resolve (ctx,
+                                      raw,
+                                      raw_size,
+                                      &process_result,
+                                      req);
+    GNUNET_assert (NULL != req->rs);
+    req->issue_num++;
+    lookups++;
+    pending++;
+    series++;
+    if (series > MAX_SERIES)
+      break;
+  }
+  if (pending + pending_rs >= THRESH)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Stopped processing queue (%u+%u/%u)]\n",
+                pending,
+                pending_rs,
+                THRESH);
+    return; /* wait for replies */
   }
-
   req = GNUNET_CONTAINER_heap_peek (req_heap);
   if (NULL == req)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Stopped processing queue: empty queue\n");
     return;
+  }
   if (GNUNET_TIME_absolute_get_remaining (req->expires).rel_value_us > 0)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_INFO,
@@ -1022,20 +1346,43 @@ process_queue (void *cls)
                 req->hostname);
     if (NULL != t)
       GNUNET_SCHEDULER_cancel (t);
+    sleep_time_reg_proc = GNUNET_TIME_absolute_get ();
     t = GNUNET_SCHEDULER_add_at (req->expires,
                                  &process_queue,
                                  NULL);
+    return;
   }
-  else
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Throttling for 1ms\n");
-    if (NULL != t)
-      GNUNET_SCHEDULER_cancel (t);
-    t = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_MILLISECONDS,
-                                      &process_queue,
-                                      NULL);
-  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Throttling\n");
+  if (NULL != t)
+    GNUNET_SCHEDULER_cancel (t);
+  sleep_time_reg_proc = GNUNET_TIME_absolute_get ();
+  t = GNUNET_SCHEDULER_add_delayed (SERIES_DELAY,
+                                    &process_queue,
+                                    NULL);
+}
+
+
+/**
+ * Iterator called during #do_shutdown() to free requests in
+ * the #ns_pending map.
+ *
+ * @param cls NULL
+ * @param key unused
+ * @param value the `struct Request` to free
+ * @return #GNUNET_OK
+ */
+static int
+free_request_it (void *cls,
+                 const struct GNUNET_HashCode *key,
+                 void *value)
+{
+  struct Request *req = value;
+
+  (void) cls;
+  (void) key;
+  free_request (req);
+  return GNUNET_OK;
 }
 
 
@@ -1061,33 +1408,50 @@ do_shutdown (void *cls)
     GNUNET_SCHEDULER_cancel (t);
     t = NULL;
   }
-  if (NULL != ns)
-  {
-    GNUNET_NAMESTORE_disconnect (ns);
-    ns = NULL;
-  }
-  if (NULL != ctx)
-  {
-    GNUNET_DNSSTUB_stop (ctx);
-    ctx = NULL;
-  }
   while (NULL != (req = req_head))
   {
     GNUNET_CONTAINER_DLL_remove (req_head,
                                  req_tail,
                                  req);
+    if (NULL != req->qe)
+      GNUNET_NAMESTORE_cancel (req->qe);
     free_request (req);
   }
   while (NULL != (req = GNUNET_CONTAINER_heap_remove_root (req_heap)))
   {
     req->hn = NULL;
+    if (NULL != req->qe)
+      GNUNET_NAMESTORE_cancel (req->qe);
     free_request (req);
   }
+  if (NULL != zone_it)
+  {
+    GNUNET_NAMESTORE_zone_iteration_stop (zone_it);
+    zone_it = NULL;
+  }
+  if (NULL != ns)
+  {
+    GNUNET_NAMESTORE_disconnect (ns);
+    ns = NULL;
+  }
+  if (NULL != ctx)
+  {
+    GNUNET_DNSSTUB_stop (ctx);
+    ctx = NULL;
+  }
   if (NULL != req_heap)
   {
     GNUNET_CONTAINER_heap_destroy (req_heap);
     req_heap = NULL;
   }
+  if (NULL != ns_pending)
+  {
+    GNUNET_CONTAINER_multihashmap_iterate (ns_pending,
+                                           &free_request_it,
+                                           NULL);
+    GNUNET_CONTAINER_multihashmap_destroy (ns_pending);
+    ns_pending = NULL;
+  }
   while (NULL != (zone = zone_head))
   {
     GNUNET_CONTAINER_DLL_remove (zone_head,
@@ -1096,52 +1460,93 @@ do_shutdown (void *cls)
     GNUNET_free (zone->domain);
     GNUNET_free (zone);
   }
+  if (NULL != stats)
+  {
+    GNUNET_STATISTICS_destroy (stats, GNUNET_NO);
+    stats = NULL;
+  }
 }
 
 
 /**
  * Function called if #GNUNET_NAMESTORE_records_lookup() failed.
- * Continues resolution based on assumption namestore has no data.
+ * Just logs an error.
  *
- * @param cls a `struct Request`
+ * @param cls a `struct Zone`
  */
 static void
 ns_lookup_error_cb (void *cls)
 {
-  struct Request *req = cls;
+  struct Zone *zone = cls;
 
-  req->qe = NULL;
   GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-              "Failed to load data from namestore for `%s'\n",
-              req->label);
-  insert_sorted (req);
+              "Failed to load data from namestore for zone `%s'\n",
+              zone->domain);
 }
 
 
 /**
  * Process a record that was stored in the namestore.
  *
- * @param cls a `struct Request *`
- * @param zone private key of the zone
+ * @param cls a `struct Zone *`
+ * @param key private key of the zone
  * @param label label of the records
  * @param rd_count number of entries in @a rd array, 0 if label was deleted
  * @param rd array of records with data to store
  */
 static void
 ns_lookup_result_cb (void *cls,
-                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
                      const char *label,
                      unsigned int rd_count,
                      const struct GNUNET_GNSRECORD_Data *rd)
 {
-  struct Request *req = cls;
+  struct Zone *zone = cls;
+  struct Request *req;
+  struct GNUNET_HashCode hc;
+  char *fqdn;
 
-  req->qe = NULL;
-  GNUNET_break (0 == memcmp (zone,
+  ns_iterator_trigger_next--;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Obtained NAMESTORE reply, %llu left in round\n",
+              (unsigned long long) ns_iterator_trigger_next);
+  if (0 == ns_iterator_trigger_next)
+  {
+    ns_iterator_trigger_next = NS_BATCH_SIZE;
+    GNUNET_STATISTICS_update (stats,
+                              "# NAMESTORE records requested from cache",
+                              ns_iterator_trigger_next,
+                              GNUNET_NO);
+    GNUNET_NAMESTORE_zone_iterator_next (zone_it,
+                                         ns_iterator_trigger_next);
+  }
+  GNUNET_asprintf (&fqdn,
+                   "%s.%s",
+                   label,
+                   zone->domain);
+  GNUNET_CRYPTO_hash (fqdn,
+                      strlen (fqdn) + 1,
+                      &hc);
+  GNUNET_free (fqdn);
+  req = GNUNET_CONTAINER_multihashmap_get (ns_pending,
+                                           &hc);
+  if (NULL == req)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Ignoring record `%s' in zone `%s': not on my list!\n",
+                label,
+                zone->domain);
+    return;
+  }
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONTAINER_multihashmap_remove (ns_pending,
+                                                       &hc,
+                                                       req));
+  GNUNET_break (0 == memcmp (key,
                              &req->zone->key,
-                             sizeof (*zone)));
+                             sizeof (*key)));
   GNUNET_break (0 == strcasecmp (label,
-                                 req->label));
+                                 get_label (req)));
   for (unsigned int i=0;i<rd_count;i++)
   {
     struct GNUNET_TIME_Absolute at;
@@ -1157,12 +1562,13 @@ ns_lookup_result_cb (void *cls,
   {
     GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                 "Empty record set in namestore for `%s'\n",
-                req->label);
+                req->hostname);
   }
   else
   {
     unsigned int pos = 0;
 
+    cached++;
     req->expires = GNUNET_TIME_UNIT_FOREVER_ABS;
     for (struct Record *rec = req->rec_head;
          NULL != rec;
@@ -1180,8 +1586,10 @@ ns_lookup_result_cb (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                 "Hot-start with %u existing records for `%s'\n",
                 pos,
-                req->label);
+                req->hostname);
   }
+  free_records (req);
+
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Adding `%s' to worklist to start at %s\n",
               req->hostname,
@@ -1198,13 +1606,11 @@ ns_lookup_result_cb (void *cls,
 static void
 queue (const char *hostname)
 {
-  struct GNUNET_DNSPARSER_Packet p;
-  struct GNUNET_DNSPARSER_Query q;
   struct Request *req;
-  char *raw;
-  size_t raw_size;
   const char *dot;
   struct Zone *zone;
+  size_t hlen;
+  struct GNUNET_HashCode hc;
 
   if (GNUNET_OK !=
       GNUNET_DNSPARSER_check_name (hostname))
@@ -1237,46 +1643,131 @@ queue (const char *hostname)
                 dot + 1);
     return;
   }
-  q.name = (char *) hostname;
-  q.type = GNUNET_DNSPARSER_TYPE_NS;
-  q.dns_traffic_class = GNUNET_TUN_DNS_CLASS_INTERNET;
-
-  memset (&p,
-          0,
-          sizeof (p));
-  p.num_queries = 1;
-  p.queries = &q;
-  p.id = (uint16_t) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE,
-                                              UINT16_MAX);
 
+  hlen = strlen (hostname) + 1;
+  req = GNUNET_malloc (sizeof (struct Request) + hlen);
+  req->zone = zone;
+  req->hostname = (char *) &req[1];
+  memcpy (req->hostname,
+          hostname,
+          hlen);
+  req->id = (uint16_t) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE,
+                                                 UINT16_MAX);
+  GNUNET_CRYPTO_hash (req->hostname,
+                      hlen,
+                      &hc);
   if (GNUNET_OK !=
-      GNUNET_DNSPARSER_pack (&p,
-                             UINT16_MAX,
-                             &raw,
-                             &raw_size))
+      GNUNET_CONTAINER_multihashmap_put (ns_pending,
+                                         &hc,
+                                         req,
+                                         GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "Failed to pack query for hostname `%s'\n",
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Duplicate hostname `%s' ignored\n",
                 hostname);
-    rejects++;
+    GNUNET_free (req);
     return;
   }
+}
+
+
+/**
+ * We have completed the initial iteration over the namestore's database.
+ * This function is called on each of the remaining records in
+ * #move_to_queue to #queue() them, as we will simply not find existing
+ * records for them any longer.
+ *
+ * @param cls NULL
+ * @param key unused
+ * @param value a `struct Request`
+ * @return #GNUNET_OK (continue to iterate)
+ */
+static int
+move_to_queue (void *cls,
+               const struct GNUNET_HashCode *key,
+               void *value)
+{
+  struct Request *req = value;
+
+  (void) cls;
+  (void) key;
+  insert_sorted (req);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Iterate over all of the zones we care about and see which records
+ * we may need to re-fetch when.
+ *
+ * @param cls NULL
+ */
+static void
+iterate_zones (void *cls)
+{
+  static struct Zone *last;
+
+  (void) cls;
+  if (NULL != zone_it)
+  {
+    zone_it = NULL;
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Finished iteration over zone `%s'!\n",
+                last->domain);
+    /* subtract left-overs from previous iteration */
+    GNUNET_STATISTICS_update (stats,
+                              "# NAMESTORE records requested from cache",
+                              (long long) (- ns_iterator_trigger_next),
+                              GNUNET_NO);
+    ns_iterator_trigger_next = 0;
+  }
+  GNUNET_assert (NULL != zone_tail);
+  if (zone_tail == last)
+  {
+    /* Done iterating over relevant zones in NAMESTORE, move
+       rest of hash map to work queue as well. */
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Finished all NAMESTORE iterations!\n");
+    GNUNET_STATISTICS_set (stats,
+                           "# Domain names without cached reply",
+                           GNUNET_CONTAINER_multihashmap_size (ns_pending),
+                           GNUNET_NO);
+    GNUNET_CONTAINER_multihashmap_iterate (ns_pending,
+                                           &move_to_queue,
+                                           NULL);
+    GNUNET_CONTAINER_multihashmap_destroy (ns_pending);
+    ns_pending = NULL;
+    start_time_reg_proc = GNUNET_TIME_absolute_get ();
+    total_reg_proc_dns = 0;
+    total_reg_proc_dns_ns = 0;
+    return;
+  }
+  if (NULL == last)
+    last = zone_head;
+  else
+    last = last->next;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Starting iteration over zone `%s'!\n",
+              last->domain);
+  /* subtract left-overs from previous iteration */
+  GNUNET_STATISTICS_update (stats,
+                            "# NAMESTORE records requested from cache",
+                            1,
+                            GNUNET_NO);
+  ns_iterator_trigger_next = 1;
+  GNUNET_STATISTICS_update (stats,
+                            "# zones iterated",
+                            1,
+                            GNUNET_NO);
+  zone_it = GNUNET_NAMESTORE_zone_iteration_start (ns,
+                                                   &last->key,
+                                                   &ns_lookup_error_cb,
+                                                   NULL,
+                                                   &ns_lookup_result_cb,
+                                                   last,
+                                                   &iterate_zones,
+                                                   NULL);
 
-  req = GNUNET_new (struct Request);
-  req->zone = zone;
-  req->hostname = GNUNET_strdup (hostname);
-  req->raw = raw;
-  req->raw_len = raw_size;
-  req->id = p.id;
-  req->label = GNUNET_strndup (hostname,
-                               dot - hostname);
-  req->qe = GNUNET_NAMESTORE_records_lookup (ns,
-                                             &req->zone->key,
-                                             req->label,
-                                             &ns_lookup_error_cb,
-                                             req,
-                                             &ns_lookup_result_cb,
-                                             req);
 }
 
 
@@ -1288,12 +1779,17 @@ queue (const char *hostname)
 static void
 process_stdin (void *cls)
 {
+  static struct GNUNET_TIME_Absolute last;
+  static uint64_t idot;
   char hn[256];
 
   (void) cls;
   t = NULL;
-  GNUNET_IDENTITY_disconnect (id);
-  id = NULL;
+  if (NULL != id)
+  {
+    GNUNET_IDENTITY_disconnect (id);
+    id = NULL;
+  }
   while (NULL !=
          fgets (hn,
                 sizeof (hn),
@@ -1301,8 +1797,34 @@ process_stdin (void *cls)
   {
     if (strlen(hn) > 0)
       hn[strlen(hn)-1] = '\0'; /* eat newline */
+    if (0 == idot)
+      last = GNUNET_TIME_absolute_get ();
+    idot++;
+    if (0 == idot % 10000)
+    {
+      struct GNUNET_TIME_Relative delta;
+
+      delta = GNUNET_TIME_absolute_get_duration (last);
+      last = GNUNET_TIME_absolute_get ();
+      fprintf (stderr,
+               "Imported 10000 records in %s\n",
+               GNUNET_STRINGS_relative_time_to_string (delta,
+                                                       GNUNET_YES));
+      GNUNET_STATISTICS_set (stats,
+                             "# domain names provided",
+                             idot,
+                             GNUNET_NO);
+    }
     queue (hn);
   }
+  fprintf (stderr,
+           "Done reading %llu domain names\n",
+           (unsigned long long) idot);
+  GNUNET_STATISTICS_set (stats,
+                         "# domain names provided",
+                         idot,
+                         GNUNET_NO);
+  iterate_zones (NULL);
 }
 
 
@@ -1358,7 +1880,7 @@ identity_cb (void *cls,
     else
     {
       GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "Specified zone not found\n");
+                  "No zone found\n");
       GNUNET_SCHEDULER_shutdown ();
       return;
     }
@@ -1395,14 +1917,44 @@ run (void *cls,
   (void) cls;
   (void) args;
   (void) cfgfile;
+  stats = GNUNET_STATISTICS_create ("zoneimport",
+                                    cfg);
   req_heap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
-  ctx = GNUNET_DNSSTUB_start (dns_server);
+  ns_pending = GNUNET_CONTAINER_multihashmap_create (map_size,
+                                                     GNUNET_NO);
+  if (NULL == ns_pending)
+  {
+    fprintf (stderr,
+             "Failed to allocate memory for main hash map\n");
+    return;
+  }
+  ctx = GNUNET_DNSSTUB_start (256);
   if (NULL == ctx)
   {
     fprintf (stderr,
              "Failed to initialize GNUnet DNS STUB\n");
     return;
   }
+  if (NULL == args[0])
+  {
+    fprintf (stderr,
+             "You must provide a list of DNS resolvers on the command line\n");
+    return;
+  }
+  for (unsigned int i=0;NULL != args[i];i++)
+  {
+    if (GNUNET_OK !=
+        GNUNET_DNSSTUB_add_dns_ip (ctx,
+                                   args[i]))
+    {
+      fprintf (stderr,
+               "Failed to use `%s' for DNS resolver\n",
+               args[i]);
+      return;
+    }
+  }
+
+
   GNUNET_SCHEDULER_add_shutdown (&do_shutdown,
                                  NULL);
   ns = GNUNET_NAMESTORE_connect (cfg);
@@ -1429,12 +1981,11 @@ main (int argc,
       char *const*argv)
 {
   struct GNUNET_GETOPT_CommandLineOption options[] = {
-    GNUNET_GETOPT_option_mandatory
-    (GNUNET_GETOPT_option_string ('s',
-                                  "server",
-                                  "IP",
-                                  "which DNS server should be used",
-                                  &dns_server)),
+    GNUNET_GETOPT_option_uint ('s',
+                               "size",
+                               "MAPSIZE",
+                               gettext_noop ("size to use for the main hash map"),
+                               &map_size),
     GNUNET_GETOPT_OPTION_END
   };
 
@@ -1451,12 +2002,16 @@ main (int argc,
                       NULL);
   GNUNET_free ((void*) argv);
   fprintf (stderr,
-           "Rejected %u names, did %u lookups, found %u records, %u lookups failed, %u pending on shutdown\n",
+           "Rejected %u names, had %u cached, did %u lookups, stored %u record sets\n"
+           "Found %u records, %u lookups failed, %u/%u pending on shutdown\n",
            rejects,
+           cached,
            lookups,
+           record_sets,
            records,
            failures,
-           pending);
+           pending,
+           pending_rs);
   return 0;
 }
 
diff --git a/src/namestore/namestore.conf.in b/src/namestore/namestore.conf.in
index f19ac5643..8b5e440b8 100644
--- a/src/namestore/namestore.conf.in
+++ b/src/namestore/namestore.conf.in
@@ -9,8 +9,17 @@ HOSTNAME = localhost
 BINARY = gnunet-service-namestore
 ACCEPT_FROM = 127.0.0.1;
 ACCEPT_FROM6 = ::1;
+
+# Which database should we use?
 DATABASE = sqlite
 
+# Should we optimize publishing record by caching the mapping
+# from zone private keys to zone public keys in memory?
+# (Set to NO if totally paranoid about keeping private keys
+# in RAM longer than necessary.)
+CACHE_KEYS = YES
+
+
 [namestore-sqlite]
 FILENAME = $GNUNET_DATA_HOME/namestore/sqlite.db
 
@@ -38,5 +47,3 @@ UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-fcfsd.sock
 
 # On what port does the FCFS daemon listen for HTTP clients?
 HTTPPORT = 18080
-
-
diff --git a/src/namestore/namestore.h b/src/namestore/namestore.h
index ec7f28704..207b35662 100644
--- a/src/namestore/namestore.h
+++ b/src/namestore/namestore.h
@@ -161,7 +161,7 @@ struct LabelLookupResponseMessage
    * Length of serialized record data
    */
   uint16_t rd_len GNUNET_PACKED;
-
+  
   /**
    * Number of records contained
    */
@@ -169,7 +169,7 @@ struct LabelLookupResponseMessage
 
   /**
    * Was the label found in the database??
-   * GNUNET_YES or GNUNET_NO
+   * #GNUNET_YES or #GNUNET_NO
    */
   uint16_t found GNUNET_PACKED;
 
@@ -345,6 +345,14 @@ struct ZoneIterationNextMessage
    * Type will be #GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_NEXT
    */
   struct GNUNET_NAMESTORE_Header gns_header;
+
+  /**
+   * Number of records to return to the iterator in one shot
+   * (before #GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_NEXT
+   * should be send again). In NBO.
+   */
+  uint64_t limit;
+
 };
 
 
diff --git a/src/namestore/namestore_api.c b/src/namestore/namestore_api.c
index a187bd250..ab356838b 100644
--- a/src/namestore/namestore_api.c
+++ b/src/namestore/namestore_api.c
@@ -1087,7 +1087,7 @@ GNUNET_NAMESTORE_set_nick (struct GNUNET_NAMESTORE_Handle *h,
   rd.flags |= GNUNET_GNSRECORD_RF_PRIVATE;
   return GNUNET_NAMESTORE_records_store (h,
                                          pkey,
-                                         GNUNET_GNS_MASTERZONE_STR,
+                                         GNUNET_GNS_EMPTY_LABEL_AT,
                                          1,
                                          &rd,
                                          cont,
@@ -1281,19 +1281,24 @@ GNUNET_NAMESTORE_zone_iteration_start (struct GNUNET_NAMESTORE_Handle *h,
  * for the next record.
  *
  * @param it the iterator
+ * @param limit number of records to return to the iterator in one shot
+ *         (before #GNUNET_NAMESTORE_zone_iterator_next is to be called again)
  */
 void
-GNUNET_NAMESTORE_zone_iterator_next (struct GNUNET_NAMESTORE_ZoneIterator *it)
+GNUNET_NAMESTORE_zone_iterator_next (struct GNUNET_NAMESTORE_ZoneIterator *it,
+                                     uint64_t limit)
 {
   struct GNUNET_NAMESTORE_Handle *h = it->h;
   struct ZoneIterationNextMessage *msg;
   struct GNUNET_MQ_Envelope *env;
 
   LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Sending ZONE_ITERATION_NEXT message\n");
+       "Sending ZONE_ITERATION_NEXT message with limit %llu\n",
+       (unsigned long long) limit);
   env = GNUNET_MQ_msg (msg,
                        GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_NEXT);
   msg->gns_header.r_id = htonl (it->op_id);
+  msg->limit = GNUNET_htonll (limit);
   GNUNET_MQ_send (h->mq,
                   env);
 }
diff --git a/src/namestore/perf_namestore_api_flat.conf b/src/namestore/perf_namestore_api_flat.conf
new file mode 100644
index 000000000..26e2f2c51
--- /dev/null
+++ b/src/namestore/perf_namestore_api_flat.conf
@@ -0,0 +1,7 @@
+@INLINE@ test_namestore_api.conf
+
+[namestore]
+DATABASE = flat
+
+[namecache]
+DISABLE = YES
diff --git a/src/namestore/perf_namestore_api_postgres.conf b/src/namestore/perf_namestore_api_postgres.conf
new file mode 100644
index 000000000..259ce35e7
--- /dev/null
+++ b/src/namestore/perf_namestore_api_postgres.conf
@@ -0,0 +1,7 @@
+@INLINE@ test_namestore_api.conf
+
+[namestore]
+DATABASE = postgres
+
+[namecache]
+DISABLE = YES
diff --git a/src/namestore/perf_namestore_api_sqlite.conf b/src/namestore/perf_namestore_api_sqlite.conf
new file mode 100644
index 000000000..72b609226
--- /dev/null
+++ b/src/namestore/perf_namestore_api_sqlite.conf
@@ -0,0 +1,4 @@
+@INLINE@ test_namestore_api.conf
+
+[namecache]
+DISABLE = YES
diff --git a/src/namestore/perf_namestore_api_zone_iteration.c b/src/namestore/perf_namestore_api_zone_iteration.c
new file mode 100644
index 000000000..4ef8d3407
--- /dev/null
+++ b/src/namestore/perf_namestore_api_zone_iteration.c
@@ -0,0 +1,388 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013, 2018 GNUnet e.V.
+
+     GNUnet is free software; you can redistribute it and/or modify
+     it under the terms of the GNU General Public License as published
+     by the Free Software Foundation; either version 3, or (at your
+     option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     General Public License for more details.
+
+     You should have received a copy of the GNU General Public License
+     along with GNUnet; see the file COPYING.  If not, write to the
+     Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+     Boston, MA 02110-1301, USA.
+*/
+/**
+ * @file namestore/perf_namestore_api_zone_iteration.c
+ * @brief testcase for zone iteration functionality: iterate all zones
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_namestore_service.h"
+#include "gnunet_testing_lib.h"
+#include "namestore.h"
+
+/**
+ * A #BENCHMARK_SIZE of 1000 takes less than a minute on a reasonably
+ * modern system, so 30 minutes should be OK even for very, very
+ * slow systems.
+ */
+#define TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 30)
+
+/**
+ * The runtime of the benchmark is expected to be linear
+ * for the iteration phase with a *good* database.  The FLAT
+ * database uses a quadratic retrieval algorithm,
+ * hence it should be quadratic in the size.
+ */
+#define BENCHMARK_SIZE 1000
+
+/**
+ * Maximum record size
+ */
+#define MAX_REC_SIZE 500
+
+/**
+ * How big are the blocks we fetch? Note that the first block is
+ * always just 1 record set per current API.  Smaller block
+ * sizes will make quadratic iteration-by-offset penalties
+ * more pronounced.
+ */
+#define BLOCK_SIZE 100
+
+static struct GNUNET_NAMESTORE_Handle *nsh;
+
+static struct GNUNET_SCHEDULER_Task *timeout_task;
+
+static struct GNUNET_SCHEDULER_Task *t;
+
+static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+
+static struct GNUNET_NAMESTORE_ZoneIterator *zi;
+
+static struct GNUNET_NAMESTORE_QueueEntry *qe;
+
+static int res;
+
+static char *directory;
+
+static unsigned int off;
+
+static unsigned int left_until_next;
+
+static uint8_t seen[1 + BENCHMARK_SIZE / 8];
+
+static struct GNUNET_TIME_Absolute start;
+
+
+/**
+ * Terminate everything
+ *
+ * @param cls NULL
+ */
+static void
+end (void *cls)
+{
+  (void) cls;
+  if (NULL != qe)
+  {
+    GNUNET_NAMESTORE_cancel (qe);
+    qe = NULL;
+  }
+  if (NULL != zi)
+  {
+    GNUNET_NAMESTORE_zone_iteration_stop (zi);
+    zi = NULL;
+  }
+  if (NULL != nsh)
+  {
+    GNUNET_NAMESTORE_disconnect (nsh);
+    nsh = NULL;
+  }
+  if (NULL != t)
+  {
+    GNUNET_SCHEDULER_cancel (t);
+    t = NULL;
+  }
+  if (NULL != timeout_task)
+  {
+    GNUNET_SCHEDULER_cancel (timeout_task);
+    timeout_task = NULL;
+  }
+  if (NULL != privkey)
+  {
+    GNUNET_free (privkey);
+    privkey = NULL;
+  }
+}
+
+
+/**
+ * End with timeout. As this is a benchmark, we do not
+ * fail hard but return "skipped".
+ */
+static void
+timeout (void *cls)
+{
+  (void) cls;
+  timeout_task = NULL;
+  GNUNET_SCHEDULER_shutdown ();
+  res = 77;
+}
+
+
+static struct GNUNET_GNSRECORD_Data *
+create_record (unsigned int count)
+{
+  struct GNUNET_GNSRECORD_Data *rd;
+
+  rd = GNUNET_malloc (count + sizeof (struct GNUNET_GNSRECORD_Data));
+  rd->expiration_time = GNUNET_TIME_relative_to_absolute (GNUNET_TIME_UNIT_HOURS).abs_value_us;
+  rd->record_type = count;
+  rd->data_size = count;
+  rd->data = (void *) &rd[1];
+  rd->flags = 0;
+  memset (&rd[1],
+          'a',
+          count);
+  return rd;
+}
+
+
+static void
+zone_end (void *cls)
+{
+  struct GNUNET_TIME_Relative delay;
+
+  zi = NULL;
+  delay = GNUNET_TIME_absolute_get_duration (start);
+  fprintf (stdout,
+           "Iterating over %u records took %s\n",
+           off,
+           GNUNET_STRINGS_relative_time_to_string (delay,
+                                                   GNUNET_YES));
+  if (BENCHMARK_SIZE == off)
+  {
+    res = 0;
+  }
+  else
+  {
+    GNUNET_break (0);
+    res = 1;
+  }
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+fail_cb (void *cls)
+{
+  zi = NULL;
+  res = 2;
+  GNUNET_break (0);
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+zone_proc (void *cls,
+           const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+           const char *label,
+           unsigned int rd_count,
+           const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct GNUNET_GNSRECORD_Data *wrd;
+  unsigned int xoff;
+
+  GNUNET_assert (NULL != zone);
+  if (1 != sscanf (label,
+                   "l%u",
+                   &xoff))
+  {
+    res = 3;
+    GNUNET_break (0);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  if ( (xoff > BENCHMARK_SIZE) ||
+       (0 != (seen[xoff / 8] & (1U << (xoff % 8)))) )
+  {
+    res = 3;
+    GNUNET_break (0);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  seen[xoff / 8] |= (1U << (xoff % 8));
+  wrd = create_record (xoff % MAX_REC_SIZE);
+  if ( (rd->record_type != wrd->record_type) ||
+       (rd->data_size != wrd->data_size) ||
+       (rd->flags != wrd->flags) )
+  {
+    res = 4;
+    GNUNET_break (0);
+    GNUNET_SCHEDULER_shutdown ();
+    GNUNET_free (wrd);
+    return;
+  }
+  if (0 != memcmp (rd->data,
+                   wrd->data,
+                   wrd->data_size))
+  {
+    res = 4;
+    GNUNET_break (0);
+    GNUNET_SCHEDULER_shutdown ();
+    GNUNET_free (wrd);
+    return;
+  }
+  GNUNET_free (wrd);
+  if (0 != memcmp (zone,
+                   privkey,
+                   sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey)))
+  {
+    res = 5;
+    GNUNET_break (0);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  off++;
+  left_until_next--;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Obtained record %u, expecting %u more until asking for mor explicitly\n",
+              off,
+              left_until_next);
+  if (0 == left_until_next)
+  {
+    left_until_next = BLOCK_SIZE;
+    GNUNET_NAMESTORE_zone_iterator_next (zi,
+                                         left_until_next);
+  }
+}
+
+
+static void
+publish_record (void *cls);
+
+
+static void
+put_cont (void *cls,
+          int32_t success,
+          const char *emsg)
+{
+  (void) cls;
+  qe = NULL;
+  GNUNET_assert (GNUNET_OK == success);
+  t = GNUNET_SCHEDULER_add_now (&publish_record,
+                                NULL);
+}
+
+
+static void
+publish_record (void *cls)
+{
+  struct GNUNET_GNSRECORD_Data *rd;
+  char *label;
+
+  (void) cls;
+  t = NULL;
+  if (BENCHMARK_SIZE == off)
+  {
+    struct GNUNET_TIME_Relative delay;
+
+    delay = GNUNET_TIME_absolute_get_duration (start);
+    fprintf (stdout,
+             "Inserting %u records took %s\n",
+             off,
+             GNUNET_STRINGS_relative_time_to_string (delay,
+                                                     GNUNET_YES));
+    start = GNUNET_TIME_absolute_get ();
+    off = 0;
+    left_until_next = 1;
+    zi = GNUNET_NAMESTORE_zone_iteration_start (nsh,
+                                                NULL,
+                                                &fail_cb,
+                                                NULL,
+                                                &zone_proc,
+                                                NULL,
+                                                &zone_end,
+                                                NULL);
+    GNUNET_assert (NULL != zi);
+    return;
+  }
+  rd = create_record ((++off) % MAX_REC_SIZE);
+  GNUNET_asprintf (&label,
+                   "l%u",
+                   off);
+  qe = GNUNET_NAMESTORE_records_store (nsh,
+                                       privkey,
+                                       label,
+                                       1, rd,
+                                       &put_cont,
+                                       NULL);
+  GNUNET_free (label);
+  GNUNET_free (rd);
+}
+
+
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_TESTING_Peer *peer)
+{
+  directory = NULL;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONFIGURATION_get_value_string(cfg,
+                                                       "PATHS",
+                                                       "GNUNET_TEST_HOME",
+                                                       &directory));
+  GNUNET_DISK_directory_remove (directory);
+  GNUNET_SCHEDULER_add_shutdown (&end,
+                                 NULL);
+  timeout_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
+                                               &timeout,
+                                               NULL);
+  nsh = GNUNET_NAMESTORE_connect (cfg);
+  GNUNET_assert (NULL != nsh);
+  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
+  GNUNET_assert (NULL != privkey);
+  start = GNUNET_TIME_absolute_get ();
+  t = GNUNET_SCHEDULER_add_now (&publish_record,
+                                NULL);
+}
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "perf_namestore_api_%s.conf",
+                   plugin_name);
+  res = 1;
+  if (0 !=
+      GNUNET_TESTING_peer_run ("perf-namestore-api-zone-iteration",
+                               cfg_name,
+                               &run,
+                               NULL))
+  {
+    res = 1;
+  }
+  GNUNET_free (cfg_name);
+  if (NULL != directory)
+  {
+    GNUNET_DISK_directory_remove (directory);
+    GNUNET_free (directory);
+  }
+  return res;
+}
+
+
+/* end of perf_namestore_api_zone_iteration.c */
diff --git a/src/namestore/plugin_namestore_flat.c b/src/namestore/plugin_namestore_flat.c
index 305fe7ba1..88b3ce9b4 100644
--- a/src/namestore/plugin_namestore_flat.c
+++ b/src/namestore/plugin_namestore_flat.c
@@ -86,6 +86,7 @@ struct Plugin
 
 };
 
+
 struct FlatFileEntry
 {
   /**
@@ -435,45 +436,51 @@ namestore_flat_store_records (void *cls,
                                      UINT64_MAX);
   key_len = strlen (label) + sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey);
   key = GNUNET_malloc (key_len);
-  GNUNET_memcpy (key, label, strlen (label));
-  GNUNET_memcpy (key+strlen(label),
-          zone_key,
-          sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey));
+  GNUNET_memcpy (key,
+                 label,
+                 strlen (label));
+  GNUNET_memcpy (key + strlen(label),
+                 zone_key,
+                 sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey));
   GNUNET_CRYPTO_hash (key,
                       key_len,
                       &hkey);
-
-  GNUNET_CONTAINER_multihashmap_remove_all (plugin->hm, &hkey);
-
-  if (0 < rd_count)
+  GNUNET_CONTAINER_multihashmap_remove_all (plugin->hm,
+                                            &hkey);
+  if (0 == rd_count)
   {
-    entry = GNUNET_new (struct FlatFileEntry);
-    entry->private_key = GNUNET_new (struct GNUNET_CRYPTO_EcdsaPrivateKey);
-    GNUNET_asprintf (&entry->label,
-                     label,
-                     strlen (label));
-    GNUNET_memcpy (entry->private_key,
-                   zone_key,
-                   sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey));
-    entry->rvalue = rvalue;
-    entry->record_count = rd_count;
-    entry->record_data = GNUNET_new_array (rd_count,
-                                           struct GNUNET_GNSRECORD_Data);
-    for (unsigned int i = 0; i < rd_count; i++)
-    {
-      entry->record_data[i].expiration_time = rd[i].expiration_time;
-      entry->record_data[i].record_type = rd[i].record_type;
-      entry->record_data[i].flags = rd[i].flags;
-      entry->record_data[i].data_size = rd[i].data_size;
-      entry->record_data[i].data = GNUNET_malloc (rd[i].data_size);
-      GNUNET_memcpy ((char*)entry->record_data[i].data, rd[i].data, rd[i].data_size);
-    }
-    return GNUNET_CONTAINER_multihashmap_put (plugin->hm,
-                                              &hkey,
-                                              entry,
-                                              GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY);
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "sqlite",
+                     "Record deleted\n");
+    return GNUNET_OK;
   }
-  return GNUNET_NO;
+  entry = GNUNET_new (struct FlatFileEntry);
+  entry->private_key = GNUNET_new (struct GNUNET_CRYPTO_EcdsaPrivateKey);
+  GNUNET_asprintf (&entry->label,
+                   label,
+                   strlen (label));
+  GNUNET_memcpy (entry->private_key,
+                 zone_key,
+                 sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey));
+  entry->rvalue = rvalue;
+  entry->record_count = rd_count;
+  entry->record_data = GNUNET_new_array (rd_count,
+                                         struct GNUNET_GNSRECORD_Data);
+  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    entry->record_data[i].expiration_time = rd[i].expiration_time;
+    entry->record_data[i].record_type = rd[i].record_type;
+    entry->record_data[i].flags = rd[i].flags;
+    entry->record_data[i].data_size = rd[i].data_size;
+    entry->record_data[i].data = GNUNET_malloc (rd[i].data_size);
+    GNUNET_memcpy ((char*)entry->record_data[i].data,
+                   rd[i].data,
+                   rd[i].data_size);
+  }
+  return GNUNET_CONTAINER_multihashmap_put (plugin->hm,
+                                            &hkey,
+                                            entry,
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY);
 }
 
 
@@ -485,7 +492,7 @@ namestore_flat_store_records (void *cls,
  * @param label name of the record in the zone
  * @param iter function to call with the result
  * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
  */
 static int
 namestore_flat_lookup_records (void *cls,
@@ -502,6 +509,7 @@ namestore_flat_lookup_records (void *cls,
 
   if (NULL == zone)
   {
+    GNUNET_break (0);
     return GNUNET_SYSERR;
   }
   key_len = strlen (label) + sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey);
@@ -524,6 +532,7 @@ namestore_flat_lookup_records (void *cls,
     return GNUNET_NO;
   if (NULL != iter)
     iter (iter_cls,
+          0,
           entry->private_key,
           entry->label,
           entry->record_count,
@@ -532,30 +541,85 @@ namestore_flat_lookup_records (void *cls,
 }
 
 
+/**
+ * Closure for #iterate_zones.
+ */
+struct IterateContext
+{
+  /**
+   * How many more records should we skip before returning results?
+   */
+  uint64_t offset;
+
+  /**
+   * How many more records should we return?
+   */
+  uint64_t limit;
+
+  /**
+   * What is the position of the current entry, counting
+   * starts from 1.
+   */
+  uint64_t pos;
+
+  /**
+   * Target zone.
+   */
+  const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone;
+
+  /**
+   * Function to call on each record.
+   */
+  GNUNET_NAMESTORE_RecordIterator iter;
+
+  /**
+   * Closure for @e iter.
+   */
+  void *iter_cls;
+
+};
+
+
+/**
+ * Helper function for #namestore_flat_iterate_records().
+ *
+ * @param cls a `struct IterateContext`
+ * @param key unused
+ * @param value a `struct FlatFileEntry`
+ * @return #GNUNET_YES to continue the iteration
+ */
 static int
 iterate_zones (void *cls,
                const struct GNUNET_HashCode *key,
                void *value)
 {
-  struct Plugin *plugin = cls;
+  struct IterateContext *ic = cls;
   struct FlatFileEntry *entry = value;
 
   (void) key;
-  if ((plugin->target_offset > plugin->offset) ||
-      ( (NULL != plugin->iter_zone) &&
-        (0 != memcmp (entry->private_key,
-                      plugin->iter_zone,
-                      sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey))))) {
-    plugin->offset++;
+  ic->pos++;
+  if (0 == ic->limit)
+    return GNUNET_NO;
+  if ( (NULL != ic->zone) &&
+       (0 != memcmp (entry->private_key,
+                     ic->zone,
+                     sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey))) )
+    return GNUNET_YES;
+  if (ic->offset > 0)
+  {
+    ic->offset--;
     return GNUNET_YES;
   }
-  plugin->iter (plugin->iter_cls,
-                entry->private_key,
-                entry->label,
-                entry->record_count,
-                entry->record_data);
-  plugin->iter_result_found = GNUNET_YES;
-  return GNUNET_NO;
+  ic->iter (ic->iter_cls,
+            ic->pos,
+            entry->private_key,
+            entry->label,
+            entry->record_count,
+            entry->record_data);
+  ic->limit--;
+  if (0 == ic->limit)
+    return GNUNET_NO;
+  return GNUNET_YES;
 }
 
 
@@ -565,32 +629,33 @@ iterate_zones (void *cls,
  *
  * @param cls closure (internal context for the plugin)
  * @param zone hash of public key of the zone, NULL to iterate over all zones
- * @param offset offset in the list of all matching records
+ * @param serial serial number to exclude in the list of all matching records
+ * @param limit maximum number of results to return to @a iter
  * @param iter function to call with the result
  * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no more results, #GNUNET_SYSERR on error
  */
 static int
 namestore_flat_iterate_records (void *cls,
                                 const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
-                                uint64_t offset,
+                                uint64_t serial,
+                                uint64_t limit,
                                 GNUNET_NAMESTORE_RecordIterator iter,
                                 void *iter_cls)
 {
   struct Plugin *plugin = cls;
-
-  /* FIXME: maybe use separate closure to better handle
-     recursive calls? */
-  plugin->target_offset = offset;
-  plugin->offset = 0;
-  plugin->iter = iter;
-  plugin->iter_cls = iter_cls;
-  plugin->iter_zone = zone;
-  plugin->iter_result_found = GNUNET_NO;
+  struct IterateContext ic;
+
+  ic.offset = serial;
+  ic.pos = 0;
+  ic.limit = limit;
+  ic.iter = iter;
+  ic.iter_cls = iter_cls;
+  ic.zone = zone;
   GNUNET_CONTAINER_multihashmap_iterate (plugin->hm,
                                          &iterate_zones,
-                                         plugin);
-  return plugin->iter_result_found;
+                                         &ic);
+  return (0 == ic.limit) ? GNUNET_OK : GNUNET_NO;
 }
 
 
@@ -617,6 +682,7 @@ zone_to_name (void *cls,
                      sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey)))
     {
       plugin->iter (plugin->iter_cls,
+                    0,
                     entry->private_key,
                     entry->label,
                     entry->record_count,
diff --git a/src/namestore/plugin_namestore_postgres.c b/src/namestore/plugin_namestore_postgres.c
index a9c19d517..d7907b1a6 100644
--- a/src/namestore/plugin_namestore_postgres.c
+++ b/src/namestore/plugin_namestore_postgres.c
@@ -65,23 +65,27 @@ static int
 database_setup (struct Plugin *plugin)
 {
   struct GNUNET_PQ_ExecuteStatement es_temporary =
-    GNUNET_PQ_make_execute ("CREATE TEMPORARY TABLE IF NOT EXISTS ns097records ("
+    GNUNET_PQ_make_execute ("CREATE TEMPORARY TABLE IF NOT EXISTS ns098records ("
+                            " seq BIGSERIAL PRIMARY KEY,"
                             " zone_private_key BYTEA NOT NULL DEFAULT '',"
                             " pkey BYTEA DEFAULT '',"
                             " rvalue BYTEA NOT NULL DEFAULT '',"
                             " record_count INTEGER NOT NULL DEFAULT 0,"
                             " record_data BYTEA NOT NULL DEFAULT '',"
-                            " label TEXT NOT NULL DEFAULT ''"
+                            " label TEXT NOT NULL DEFAULT '',"
+                            " CONSTRAINT zl UNIQUE (zone_private_key,label)"
                             ")"
                             "WITH OIDS");
   struct GNUNET_PQ_ExecuteStatement es_default =
-    GNUNET_PQ_make_execute ("CREATE TABLE IF NOT EXISTS ns097records ("
+    GNUNET_PQ_make_execute ("CREATE TABLE IF NOT EXISTS ns098records ("
+                            " seq BIGSERIAL PRIMARY KEY,"
                             " zone_private_key BYTEA NOT NULL DEFAULT '',"
                             " pkey BYTEA DEFAULT '',"
                             " rvalue BYTEA NOT NULL DEFAULT '',"
                             " record_count INTEGER NOT NULL DEFAULT 0,"
                             " record_data BYTEA NOT NULL DEFAULT '',"
-                            " label TEXT NOT NULL DEFAULT ''"
+                            " label TEXT NOT NULL DEFAULT '',"
+                            " CONSTRAINT zl UNIQUE (zone_private_key,label)"
                             ")"
                             "WITH OIDS");
   const struct GNUNET_PQ_ExecuteStatement *cr;
@@ -125,13 +129,13 @@ database_setup (struct Plugin *plugin)
     struct GNUNET_PQ_ExecuteStatement es[] = {
       *cr,
       GNUNET_PQ_make_try_execute ("CREATE INDEX IF NOT EXISTS ir_pkey_reverse "
-                                  "ON ns097records (zone_private_key,pkey)"),
+                                  "ON ns098records (zone_private_key,pkey)"),
       GNUNET_PQ_make_try_execute ("CREATE INDEX IF NOT EXISTS ir_pkey_iter "
-                                  "ON ns097records (zone_private_key,rvalue)"),
-      GNUNET_PQ_make_try_execute ("CREATE INDEX IF NOT EXISTS it_iter "
-                                  "ON ns097records (rvalue)"),
+                                  "ON ns098records (zone_private_key,seq)"),
       GNUNET_PQ_make_try_execute ("CREATE INDEX IF NOT EXISTS ir_label "
-                                  "ON ns097records (label)"),
+                                  "ON ns098records (label)"),
+      GNUNET_PQ_make_try_execute ("CREATE INDEX IF NOT EXISTS zone_label "
+                                  "ON ns098records (zone_private_key,label)"),
       GNUNET_PQ_EXECUTE_STATEMENT_END
     };
 
@@ -148,23 +152,35 @@ database_setup (struct Plugin *plugin)
   {
     struct GNUNET_PQ_PreparedStatement ps[] = {
       GNUNET_PQ_make_prepare ("store_records",
-                              "INSERT INTO ns097records (zone_private_key, pkey, rvalue, record_count, record_data, label) VALUES "
-                              "($1, $2, $3, $4, $5, $6)", 6),
+                              "INSERT INTO ns098records"
+                              " (zone_private_key, pkey, rvalue, record_count, record_data, label)"
+                              " VALUES ($1, $2, $3, $4, $5, $6)"
+                              " ON CONFLICT ON CONSTRAINT zl"
+                              " DO UPDATE"
+                              "    SET pkey=$2,rvalue=$3,record_count=$4,record_data=$5"
+                              "    WHERE ns098records.zone_private_key = $1"
+                              "          AND ns098records.label = $6",
+                              6),
       GNUNET_PQ_make_prepare ("delete_records",
-                              "DELETE FROM ns097records "
-                              "WHERE zone_private_key=$1 AND label=$2", 2),
+                              "DELETE FROM ns098records "
+                              "WHERE zone_private_key=$1 AND label=$2",
+                              2),
       GNUNET_PQ_make_prepare ("zone_to_name",
-                              "SELECT record_count,record_data,label FROM ns097records"
-                              " WHERE zone_private_key=$1 AND pkey=$2", 2),
+                              "SELECT seq,record_count,record_data,label FROM ns098records"
+                              " WHERE zone_private_key=$1 AND pkey=$2",
+                              2),
       GNUNET_PQ_make_prepare ("iterate_zone",
-                              "SELECT record_count,record_data,label FROM ns097records "
-                              "WHERE zone_private_key=$1 ORDER BY rvalue LIMIT 1 OFFSET $2", 2),
+                              "SELECT seq,record_count,record_data,label FROM ns098records "
+                              "WHERE zone_private_key=$1 AND seq > $2 ORDER BY seq ASC LIMIT $3",
+                              3),
       GNUNET_PQ_make_prepare ("iterate_all_zones",
-                              "SELECT record_count,record_data,label,zone_private_key"
-                              " FROM ns097records ORDER BY rvalue LIMIT 1 OFFSET $1", 1),
+                              "SELECT seq,record_count,record_data,label,zone_private_key"
+                              " FROM ns098records WHERE seq > $1 ORDER BY seq ASC LIMIT $2",
+                              2),
       GNUNET_PQ_make_prepare ("lookup_label",
-                              "SELECT record_count,record_data,label "
-                              "FROM ns097records WHERE zone_private_key=$1 AND label=$2", 2),
+                              "SELECT seq,record_count,record_data,label "
+                              "FROM ns098records WHERE zone_private_key=$1 AND label=$2",
+                              2),
       GNUNET_PQ_PREPARED_STATEMENT_END
     };
 
@@ -206,7 +222,9 @@ namestore_postgres_store_records (void *cls,
   uint32_t rd_count32 = (uint32_t) rd_count;
   size_t data_size;
 
-  memset (&pkey, 0, sizeof (pkey));
+  memset (&pkey,
+          0,
+          sizeof (pkey));
   for (unsigned int i=0;i<rd_count;i++)
     if (GNUNET_GNSRECORD_TYPE_PKEY == rd[i].record_type)
     {
@@ -218,12 +236,38 @@ namestore_postgres_store_records (void *cls,
     }
   rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
                                      UINT64_MAX);
-  data_size = GNUNET_GNSRECORD_records_get_size (rd_count, rd);
+  data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                 rd);
   if (data_size > 64 * 65536)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
+  /* if record set is empty, delete existing records */
+  if (0 == rd_count)
+  {
+    struct GNUNET_PQ_QueryParam params[] = {
+      GNUNET_PQ_query_param_auto_from_type (zone_key),
+      GNUNET_PQ_query_param_string (label),
+      GNUNET_PQ_query_param_end
+    };
+    enum GNUNET_DB_QueryStatus res;
+
+    res = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                              "delete_records",
+                                              params);
+    if ( (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != res) &&
+         (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS != res) )
+    {
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
+    }
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "postgres",
+                     "Record deleted\n");
+    return GNUNET_OK;
+  }
+  /* otherwise, UPSERT (i.e. UPDATE if exists, otherwise INSERT) */
   {
     char data[data_size];
     struct GNUNET_PQ_QueryParam params[] = {
@@ -278,6 +322,12 @@ struct ParserContext
    * Zone key, NULL if part of record.
    */
   const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key;
+
+  /**
+   * Number of results still to return (counted down by
+   * number of results given to iterator).
+   */
+  uint64_t limit;
 };
 
 
@@ -296,14 +346,18 @@ parse_result_call_iterator (void *cls,
 {
   struct ParserContext *pc = cls;
 
+  if (NULL == pc->iter)
+    return; /* no need to do more work */
   for (unsigned int i=0;i<num_results;i++)
   {
+    uint64_t serial;
     void *data;
     size_t data_size;
     uint32_t record_count;
     char *label;
     struct GNUNET_CRYPTO_EcdsaPrivateKey zk;
     struct GNUNET_PQ_ResultSpec rs_with_zone[] = {
+      GNUNET_PQ_result_spec_uint64 ("seq", &serial),
       GNUNET_PQ_result_spec_uint32 ("record_count", &record_count),
       GNUNET_PQ_result_spec_variable_size ("record_data", &data, &data_size),
       GNUNET_PQ_result_spec_string ("label", &label),
@@ -311,6 +365,7 @@ parse_result_call_iterator (void *cls,
       GNUNET_PQ_result_spec_end
     };
     struct GNUNET_PQ_ResultSpec rs_without_zone[] = {
+      GNUNET_PQ_result_spec_uint64 ("seq", &serial),
       GNUNET_PQ_result_spec_uint32 ("record_count", &record_count),
       GNUNET_PQ_result_spec_variable_size ("record_data", &data, &data_size),
       GNUNET_PQ_result_spec_string ("label", &label),
@@ -351,6 +406,7 @@ parse_result_call_iterator (void *cls,
         return;
       }
       pc->iter (pc->iter_cls,
+                serial,
                 (NULL == pc->zone_key) ? &zk : pc->zone_key,
                 label,
                 record_count,
@@ -358,6 +414,7 @@ parse_result_call_iterator (void *cls,
     }
     GNUNET_PQ_cleanup_result (rs);
   }
+  pc->limit -= num_results;
 }
 
 
@@ -369,7 +426,7 @@ parse_result_call_iterator (void *cls,
  * @param label name of the record in the zone
  * @param iter function to call with the result
  * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
  */
 static int
 namestore_postgres_lookup_records (void *cls,
@@ -387,6 +444,11 @@ namestore_postgres_lookup_records (void *cls,
   struct ParserContext pc;
   enum GNUNET_DB_QueryStatus res;
 
+  if (NULL == zone)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
   pc.iter = iter;
   pc.iter_cls = iter_cls;
   pc.zone_key = zone;
@@ -395,8 +457,10 @@ namestore_postgres_lookup_records (void *cls,
                                               params,
                                               &parse_result_call_iterator,
                                               &pc);
-  if (res <= 0)
+  if (res < 0)
     return GNUNET_SYSERR;
+  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res)
+    return GNUNET_NO;
   return GNUNET_OK;
 }
 
@@ -407,15 +471,17 @@ namestore_postgres_lookup_records (void *cls,
  *
  * @param cls closure (internal context for the plugin)
  * @param zone hash of public key of the zone, NULL to iterate over all zones
- * @param offset offset in the list of all matching records
+ * @param serial serial number to exclude in the list of all matching records
+ * @param limit maximum number of results to fetch
  * @param iter function to call with the result
  * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no more results, #GNUNET_SYSERR on error
  */
 static int
 namestore_postgres_iterate_records (void *cls,
                                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
-                                    uint64_t offset,
+                                    uint64_t serial,
+                                    uint64_t limit,
                                     GNUNET_NAMESTORE_RecordIterator iter,
                                     void *iter_cls)
 {
@@ -426,10 +492,12 @@ namestore_postgres_iterate_records (void *cls,
   pc.iter = iter;
   pc.iter_cls = iter_cls;
   pc.zone_key = zone;
+  pc.limit = limit;
   if (NULL == zone)
   {
     struct GNUNET_PQ_QueryParam params_without_zone[] = {
-      GNUNET_PQ_query_param_uint64 (&offset),
+      GNUNET_PQ_query_param_uint64 (&serial),
+      GNUNET_PQ_query_param_uint64 (&limit),
       GNUNET_PQ_query_param_end
     };
 
@@ -443,7 +511,8 @@ namestore_postgres_iterate_records (void *cls,
   {
     struct GNUNET_PQ_QueryParam params_with_zone[] = {
       GNUNET_PQ_query_param_auto_from_type (zone),
-      GNUNET_PQ_query_param_uint64 (&offset),
+      GNUNET_PQ_query_param_uint64 (&serial),
+      GNUNET_PQ_query_param_uint64 (&limit),
       GNUNET_PQ_query_param_end
     };
 
@@ -456,9 +525,9 @@ namestore_postgres_iterate_records (void *cls,
   if (res < 0)
     return GNUNET_SYSERR;
 
-  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res)
+  if ( (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res) ||
+       (pc.limit > 0) )
     return GNUNET_NO;
-
   return GNUNET_OK;
 }
 
diff --git a/src/namestore/plugin_namestore_sqlite.c b/src/namestore/plugin_namestore_sqlite.c
index 5ad84688c..f62be1e18 100644
--- a/src/namestore/plugin_namestore_sqlite.c
+++ b/src/namestore/plugin_namestore_sqlite.c
@@ -147,15 +147,13 @@ create_indices (sqlite3 * dbh)
   /* create indices */
   if ( (SQLITE_OK !=
         sqlite3_exec (dbh,
-                      "CREATE INDEX IF NOT EXISTS ir_pkey_reverse ON ns097records (zone_private_key,pkey)",
+                      "CREATE INDEX IF NOT EXISTS ir_pkey_reverse "
+                      "ON ns098records (zone_private_key,pkey)",
                       NULL, NULL, NULL)) ||
        (SQLITE_OK !=
         sqlite3_exec (dbh,
-                      "CREATE INDEX IF NOT EXISTS ir_pkey_iter ON ns097records (zone_private_key,rvalue)",
-                      NULL, NULL, NULL)) ||
-       (SQLITE_OK !=
-        sqlite3_exec (dbh,
-                      "CREATE INDEX IF NOT EXISTS it_iter ON ns097records (rvalue)",
+                      "CREATE INDEX IF NOT EXISTS ir_pkey_iter "
+                      "ON ns098records (zone_private_key,uid)",
                       NULL, NULL, NULL)) )
     LOG (GNUNET_ERROR_TYPE_ERROR,
          "Failed to create indices: %s\n",
@@ -260,22 +258,24 @@ database_setup (struct Plugin *plugin)
   /* Create table */
   CHECK (SQLITE_OK ==
          sq_prepare (plugin->dbh,
-                     "SELECT 1 FROM sqlite_master WHERE tbl_name = 'ns097records'",
+                     "SELECT 1 FROM sqlite_master WHERE tbl_name = 'ns098records'",
                      &stmt));
-  if ((sqlite3_step (stmt) == SQLITE_DONE) &&
-      (sqlite3_exec
-       (plugin->dbh,
-        "CREATE TABLE ns097records ("
-        " zone_private_key BLOB NOT NULL,"
-        " pkey BLOB,"
-        " rvalue INT8 NOT NULL,"
-        " record_count INT NOT NULL,"
-        " record_data BLOB NOT NULL,"
-        " label TEXT NOT NULL"
-        ")",
-        NULL, NULL, NULL) != SQLITE_OK))
+  if ( (sqlite3_step (stmt) == SQLITE_DONE) &&
+       (SQLITE_OK !=
+        sqlite3_exec (plugin->dbh,
+                      "CREATE TABLE ns098records ("
+                      " uid INTEGER PRIMARY KEY,"
+                      " zone_private_key BLOB NOT NULL,"
+                      " pkey BLOB,"
+                      " rvalue INT8 NOT NULL,"
+                      " record_count INT NOT NULL,"
+                      " record_data BLOB NOT NULL,"
+                      " label TEXT NOT NULL"
+                      ")",
+                      NULL, NULL, NULL)) )
   {
-    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR,
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR,
                 "sqlite3_exec");
     sqlite3_finalize (stmt);
     return GNUNET_SYSERR;
@@ -286,33 +286,40 @@ database_setup (struct Plugin *plugin)
 
   if ( (SQLITE_OK !=
         sq_prepare (plugin->dbh,
-                    "INSERT INTO ns097records (zone_private_key, pkey, rvalue, record_count, record_data, label)"
+                    "INSERT INTO ns098records (zone_private_key, pkey, rvalue, record_count, record_data, label)"
                     " VALUES (?, ?, ?, ?, ?, ?)",
                     &plugin->store_records)) ||
        (SQLITE_OK !=
         sq_prepare (plugin->dbh,
-                    "DELETE FROM ns097records WHERE zone_private_key=? AND label=?",
+                    "DELETE FROM ns098records WHERE zone_private_key=? AND label=?",
                     &plugin->delete_records)) ||
        (SQLITE_OK !=
         sq_prepare (plugin->dbh,
-                    "SELECT record_count,record_data,label"
-                    " FROM ns097records WHERE zone_private_key=? AND pkey=?",
+                    "SELECT uid,record_count,record_data,label"
+                    " FROM ns098records"
+                    " WHERE zone_private_key=? AND pkey=?",
                     &plugin->zone_to_name)) ||
        (SQLITE_OK !=
         sq_prepare (plugin->dbh,
-                    "SELECT record_count,record_data,label"
-                    " FROM ns097records WHERE zone_private_key=?"
-                    " ORDER BY rvalue LIMIT 1 OFFSET ?",
+                    "SELECT uid,record_count,record_data,label"
+                    " FROM ns098records"
+                    " WHERE zone_private_key=? AND _rowid_ >= ?"
+                    " ORDER BY _rowid_ ASC"
+                    " LIMIT ?",
                     &plugin->iterate_zone)) ||
        (SQLITE_OK !=
         sq_prepare (plugin->dbh,
-                    "SELECT record_count,record_data,label,zone_private_key"
-                    " FROM ns097records ORDER BY rvalue LIMIT 1 OFFSET ?",
+                    "SELECT uid,record_count,record_data,label,zone_private_key"
+                    " FROM ns098records"
+                    " WHERE _rowid_ >= ?"
+                    " ORDER BY _rowid_ ASC"
+                    " LIMIT ?",
                     &plugin->iterate_all_zones))  ||
        (SQLITE_OK !=
         sq_prepare (plugin->dbh,
-                    "SELECT record_count,record_data,label,zone_private_key"
-                    " FROM ns097records WHERE zone_private_key=? AND label=?",
+                    "SELECT uid,record_count,record_data,label,zone_private_key"
+                    " FROM ns098records"
+                    " WHERE zone_private_key=? AND label=?",
                     &plugin->lookup_label))
        )
   {
@@ -405,10 +412,11 @@ namestore_sqlite_store_records (void *cls,
   struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
   uint64_t rvalue;
   size_t data_size;
-  unsigned int i;
 
-  memset (&pkey, 0, sizeof (pkey));
-  for (i=0;i<rd_count;i++)
+  memset (&pkey,
+          0,
+          sizeof (pkey));
+  for (unsigned int i=0;i<rd_count;i++)
     if (GNUNET_GNSRECORD_TYPE_PKEY == rd[i].record_type)
     {
       GNUNET_break (sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey) ==
@@ -526,93 +534,115 @@ namestore_sqlite_store_records (void *cls,
  * @param plugin plugin context
  * @param stmt to run (and then clean up)
  * @param zone_key private key of the zone
+ * @param limit maximum number of results to fetch
  * @param iter iterator to call with the result
  * @param iter_cls closure for @a iter
  * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
  */
 static int
-get_record_and_call_iterator (struct Plugin *plugin,
-                              sqlite3_stmt *stmt,
-                              const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
-                              GNUNET_NAMESTORE_RecordIterator iter,
-                              void *iter_cls)
+get_records_and_call_iterator (struct Plugin *plugin,
+                               sqlite3_stmt *stmt,
+                               const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                               uint64_t limit,
+                               GNUNET_NAMESTORE_RecordIterator iter,
+                               void *iter_cls)
 {
-  uint32_t record_count;
-  size_t data_size;
-  void *data;
-  char *label;
-  struct GNUNET_CRYPTO_EcdsaPrivateKey zk;
   int ret;
   int sret;
 
-  ret = GNUNET_NO;
-  if (SQLITE_ROW == (sret = sqlite3_step (stmt)))
+  ret = GNUNET_OK;
+  for (uint64_t i = 0;i<limit;i++)
   {
-    struct GNUNET_SQ_ResultSpec rs[] = {
-      GNUNET_SQ_result_spec_uint32 (&record_count),
-      GNUNET_SQ_result_spec_variable_size (&data, &data_size),
-      GNUNET_SQ_result_spec_string (&label),
-      GNUNET_SQ_result_spec_end
-    };
-    struct GNUNET_SQ_ResultSpec rsx[] = {
-      GNUNET_SQ_result_spec_uint32 (&record_count),
-      GNUNET_SQ_result_spec_variable_size (&data, &data_size),
-      GNUNET_SQ_result_spec_string (&label),
-      GNUNET_SQ_result_spec_auto_from_type (&zk),
-      GNUNET_SQ_result_spec_end
-    };
+    sret = sqlite3_step (stmt);
 
-    if (NULL == zone_key)
+    if (SQLITE_DONE == sret)
     {
-      zone_key = &zk;
-      ret = GNUNET_SQ_extract_result (stmt,
-                                      rsx);
-    }
-    else
-    {
-      ret = GNUNET_SQ_extract_result (stmt,
-                                      rs);
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Iteration done (no results)\n");
+      ret = GNUNET_NO;
+      break;
     }
-    if ( (GNUNET_OK != ret) ||
-         (record_count > 64 * 1024) )
+    if (SQLITE_ROW != sret)
     {
-      /* sanity check, don't stack allocate far too much just
-         because database might contain a large value here */
-      GNUNET_break (0);
+      LOG_SQLITE (plugin,
+                  GNUNET_ERROR_TYPE_ERROR,
+                  "sqlite_step");
       ret = GNUNET_SYSERR;
+      break;
     }
-    else
+
     {
-      struct GNUNET_GNSRECORD_Data rd[record_count];
+      uint64_t seq;
+      uint32_t record_count;
+      size_t data_size;
+      void *data;
+      char *label;
+      struct GNUNET_CRYPTO_EcdsaPrivateKey zk;
+      struct GNUNET_SQ_ResultSpec rs[] = {
+        GNUNET_SQ_result_spec_uint64 (&seq),
+        GNUNET_SQ_result_spec_uint32 (&record_count),
+        GNUNET_SQ_result_spec_variable_size (&data,
+                                             &data_size),
+        GNUNET_SQ_result_spec_string (&label),
+        GNUNET_SQ_result_spec_end
+      };
+      struct GNUNET_SQ_ResultSpec rsx[] = {
+        GNUNET_SQ_result_spec_uint64 (&seq),
+        GNUNET_SQ_result_spec_uint32 (&record_count),
+        GNUNET_SQ_result_spec_variable_size (&data,
+                                             &data_size),
+        GNUNET_SQ_result_spec_string (&label),
+        GNUNET_SQ_result_spec_auto_from_type (&zk),
+        GNUNET_SQ_result_spec_end
+      };
 
-      if (GNUNET_OK !=
-          GNUNET_GNSRECORD_records_deserialize (data_size,
-                                                data,
-                                                record_count,
-                                                rd))
+      if (NULL == zone_key)
       {
-        GNUNET_break (0);
-        ret = GNUNET_SYSERR;
+        zone_key = &zk;
+        ret = GNUNET_SQ_extract_result (stmt,
+                                        rsx);
       }
       else
       {
-        if (NULL != iter)
-          iter (iter_cls,
-                zone_key,
-                label,
-                record_count,
-                rd);
-        ret = GNUNET_YES;
+        ret = GNUNET_SQ_extract_result (stmt,
+                                        rs);
+      }
+      if ( (GNUNET_OK != ret) ||
+           (record_count > 64 * 1024) )
+      {
+        /* sanity check, don't stack allocate far too much just
+           because database might contain a large value here */
+        GNUNET_break (0);
+        ret = GNUNET_SYSERR;
+        break;
       }
+      else
+      {
+        struct GNUNET_GNSRECORD_Data rd[record_count];
+
+        if (GNUNET_OK !=
+            GNUNET_GNSRECORD_records_deserialize (data_size,
+                                                  data,
+                                                  record_count,
+                                                  rd))
+        {
+          GNUNET_break (0);
+          ret = GNUNET_SYSERR;
+          break;
+        }
+        else
+        {
+          if (NULL != iter)
+            iter (iter_cls,
+                  seq + 1,
+                  zone_key,
+                  label,
+                  record_count,
+                  rd);
+        }
+      }
+      GNUNET_SQ_cleanup_result (rs);
     }
-    GNUNET_SQ_cleanup_result (rs);
-  }
-  else
-  {
-    if (SQLITE_DONE != sret)
-      LOG_SQLITE (plugin,
-                  GNUNET_ERROR_TYPE_ERROR,
-                  "sqlite_step");
   }
   GNUNET_SQ_reset (plugin->dbh,
                    stmt);
@@ -628,7 +658,7 @@ get_record_and_call_iterator (struct Plugin *plugin,
  * @param label name of the record in the zone
  * @param iter function to call with the result
  * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
  */
 static int
 namestore_sqlite_lookup_records (void *cls,
@@ -645,7 +675,10 @@ namestore_sqlite_lookup_records (void *cls,
   };
 
   if (NULL == zone)
+  {
+    GNUNET_break (0);
     return GNUNET_SYSERR;
+  }
   if (GNUNET_OK !=
       GNUNET_SQ_bind (plugin->lookup_label,
                       params))
@@ -656,11 +689,12 @@ namestore_sqlite_lookup_records (void *cls,
                      plugin->lookup_label);
     return GNUNET_SYSERR;
   }
-  return get_record_and_call_iterator (plugin,
-                                       plugin->lookup_label,
-                                       zone,
-                                       iter,
-                                       iter_cls);
+  return get_records_and_call_iterator (plugin,
+                                        plugin->lookup_label,
+                                        zone,
+                                        1,
+                                        iter,
+                                        iter_cls);
 }
 
 
@@ -670,15 +704,17 @@ namestore_sqlite_lookup_records (void *cls,
  *
  * @param cls closure (internal context for the plugin)
  * @param zone hash of public key of the zone, NULL to iterate over all zones
- * @param offset offset in the list of all matching records
+ * @param serial serial number to exclude in the list of all matching records
+ * @param limit maximum number of results to return
  * @param iter function to call with the result
  * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no more results, #GNUNET_SYSERR on error
  */
 static int
 namestore_sqlite_iterate_records (void *cls,
                                   const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
-                                  uint64_t offset,
+                                  uint64_t serial,
+                                  uint64_t limit,
                                   GNUNET_NAMESTORE_RecordIterator iter,
                                   void *iter_cls)
 {
@@ -689,7 +725,8 @@ namestore_sqlite_iterate_records (void *cls,
   if (NULL == zone)
   {
     struct GNUNET_SQ_QueryParam params[] = {
-      GNUNET_SQ_query_param_uint64 (&offset),
+      GNUNET_SQ_query_param_uint64 (&serial),
+      GNUNET_SQ_query_param_uint64 (&limit),
       GNUNET_SQ_query_param_end
     };
 
@@ -701,7 +738,8 @@ namestore_sqlite_iterate_records (void *cls,
   {
     struct GNUNET_SQ_QueryParam params[] = {
       GNUNET_SQ_query_param_auto_from_type (zone),
-      GNUNET_SQ_query_param_uint64 (&offset),
+      GNUNET_SQ_query_param_uint64 (&serial),
+      GNUNET_SQ_query_param_uint64 (&limit),
       GNUNET_SQ_query_param_end
     };
 
@@ -718,11 +756,12 @@ namestore_sqlite_iterate_records (void *cls,
                      stmt);
     return GNUNET_SYSERR;
   }
-  return get_record_and_call_iterator (plugin,
-                                       stmt,
-                                       zone,
-                                       iter,
-                                       iter_cls);
+  return get_records_and_call_iterator (plugin,
+                                        stmt,
+                                        zone,
+                                        limit,
+                                        iter,
+                                        iter_cls);
 }
 
 
@@ -741,7 +780,8 @@ static int
 namestore_sqlite_zone_to_name (void *cls,
                                const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
                                const struct GNUNET_CRYPTO_EcdsaPublicKey *value_zone,
-                               GNUNET_NAMESTORE_RecordIterator iter, void *iter_cls)
+                               GNUNET_NAMESTORE_RecordIterator iter,
+                               void *iter_cls)
 {
   struct Plugin *plugin = cls;
   struct GNUNET_SQ_QueryParam params[] = {
@@ -764,11 +804,12 @@ namestore_sqlite_zone_to_name (void *cls,
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Performing reverse lookup for `%s'\n",
        GNUNET_GNSRECORD_z2s (value_zone));
-  return get_record_and_call_iterator (plugin,
-                                       plugin->zone_to_name,
-                                       zone,
-                                       iter,
-                                       iter_cls);
+  return get_records_and_call_iterator (plugin,
+                                        plugin->zone_to_name,
+                                        zone,
+                                        1,
+                                        iter,
+                                        iter_cls);
 }
 
 
@@ -787,7 +828,9 @@ libgnunet_plugin_namestore_sqlite_init (void *cls)
 
   if (NULL != plugin.cfg)
     return NULL;                /* can only initialize once! */
-  memset (&plugin, 0, sizeof (struct Plugin));
+  memset (&plugin,
+          0,
+          sizeof (struct Plugin));
   plugin.cfg = cfg;
   if (GNUNET_OK != database_setup (&plugin))
   {
diff --git a/src/namestore/plugin_rest_namestore.c b/src/namestore/plugin_rest_namestore.c
index 4602106da..fd1528a1d 100644
--- a/src/namestore/plugin_rest_namestore.c
+++ b/src/namestore/plugin_rest_namestore.c
@@ -452,7 +452,8 @@ namestore_list_response (void *cls,
                 "%s does not match %s\n",
                 rname,
                 handle->name);
-    GNUNET_NAMESTORE_zone_iterator_next (handle->list_it);
+    GNUNET_NAMESTORE_zone_iterator_next (handle->list_it,
+                                         1);
     return;
   }
 
@@ -460,7 +461,7 @@ namestore_list_response (void *cls,
   for (unsigned int i=0; i<rd_len; i++)
   {
     if ( (GNUNET_GNSRECORD_TYPE_NICK == rd[i].record_type) &&
-         (0 != strcmp (rname, GNUNET_GNS_MASTERZONE_STR)) )
+         (0 != strcmp (rname, GNUNET_GNS_EMPTY_LABEL_AT)) )
       continue;
 
     if ( (rd[i].record_type != handle->type) &&
@@ -483,7 +484,8 @@ namestore_list_response (void *cls,
   }
 
   json_decref (result_array);
-  GNUNET_NAMESTORE_zone_iterator_next (handle->list_it);
+  GNUNET_NAMESTORE_zone_iterator_next (handle->list_it,
+                                       1);
 }
 
 
diff --git a/src/namestore/test_namestore_api.conf b/src/namestore/test_namestore_api.conf
index a1a674d89..29ff90b5d 100644
--- a/src/namestore/test_namestore_api.conf
+++ b/src/namestore/test_namestore_api.conf
@@ -1,8 +1,19 @@
+@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/no_autostart_above_core.conf
+
 [PATHS]
 GNUNET_TEST_HOME = /tmp/test-gnunet-namestore/
 
 [namestore]
 DATABASE = sqlite
+AUTOSTART = YES
+
+[namecache]
+DATABASE = sqlite
+AUTOSTART = YES
+
+[identity]
+AUTOSTART = YES
 
 [namestore-sqlite]
 FILENAME = $GNUNET_TEST_HOME/namestore/sqlite_test.db
diff --git a/src/namestore/test_namestore_api_flat.conf b/src/namestore/test_namestore_api_flat.conf
new file mode 100644
index 000000000..49fe25468
--- /dev/null
+++ b/src/namestore/test_namestore_api_flat.conf
@@ -0,0 +1,4 @@
+@INLINE@ test_namestore_api.conf
+
+[namestore]
+DATABASE = flat
diff --git a/src/namestore/test_namestore_api_lookup_nick.c b/src/namestore/test_namestore_api_lookup_nick.c
index de958cee2..50d1fd9a9 100644
--- a/src/namestore/test_namestore_api_lookup_nick.c
+++ b/src/namestore/test_namestore_api_lookup_nick.c
@@ -18,8 +18,8 @@
      Boston, MA 02110-1301, USA.
 */
 /**
- * @file namestore/test_namestore_api_store.c
- * @brief testcase for namestore_api.c: store a record
+ * @file namestore/test_namestore_api_lookup_nick.c
+ * @brief testcase for namestore_api.c: NICK records
  */
 #include "platform.h"
 #include "gnunet_namestore_service.h"
@@ -317,15 +317,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-lookup-nick",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_lookup_private.c b/src/namestore/test_namestore_api_lookup_private.c
index 57505c48b..7866749f1 100644
--- a/src/namestore/test_namestore_api_lookup_private.c
+++ b/src/namestore/test_namestore_api_lookup_private.c
@@ -230,15 +230,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-lookup-private",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
@@ -248,4 +256,4 @@ main (int argc, char *argv[])
 }
 
 
-/* end of test_namestore_api_store.c */
+/* end of test_namestore_api_lookup_private.c */
diff --git a/src/namestore/test_namestore_api_lookup_public.c b/src/namestore/test_namestore_api_lookup_public.c
index 09d6b302d..02ca16042 100644
--- a/src/namestore/test_namestore_api_lookup_public.c
+++ b/src/namestore/test_namestore_api_lookup_public.c
@@ -237,15 +237,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_lookup_shadow.c b/src/namestore/test_namestore_api_lookup_shadow.c
index 7f9a90704..e80335796 100644
--- a/src/namestore/test_namestore_api_lookup_shadow.c
+++ b/src/namestore/test_namestore_api_lookup_shadow.c
@@ -18,7 +18,7 @@
      Boston, MA 02110-1301, USA.
 */
 /**
- * @file namestore/test_namestore_api_lookup_shadow_filter.c
+ * @file namestore/test_namestore_api_lookup_shadow.c
  * @brief testcase for namestore_api.c: store a shadow record and perform a lookup
  * test passes if test returns the record but without the shadow flag since no
  * other valid record is available
@@ -267,15 +267,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-lookup-shadow",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
@@ -285,4 +293,4 @@ main (int argc, char *argv[])
 }
 
 
-/* end of test_namestore_api_lookup_shadow_filter.c */
+/* end of test_namestore_api_lookup_shadow.c */
diff --git a/src/namestore/test_namestore_api_lookup_shadow_filter.c b/src/namestore/test_namestore_api_lookup_shadow_filter.c
index a22baa17b..5b8811a23 100644
--- a/src/namestore/test_namestore_api_lookup_shadow_filter.c
+++ b/src/namestore/test_namestore_api_lookup_shadow_filter.c
@@ -345,15 +345,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-lookup-shadow-filter",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_monitoring.c b/src/namestore/test_namestore_api_monitoring.c
index efbd6badf..f6d4fe226 100644
--- a/src/namestore/test_namestore_api_monitoring.c
+++ b/src/namestore/test_namestore_api_monitoring.c
@@ -209,7 +209,9 @@ zone_proc (void *cls,
 
 
 static void
-put_cont (void *cls, int32_t success, const char *emsg)
+put_cont (void *cls,
+          int32_t success,
+          const char *emsg)
 {
   static int c = 0;
   char *label = cls;
@@ -232,10 +234,12 @@ put_cont (void *cls, int32_t success, const char *emsg)
   else
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "Failed to created records\n");
+                "Failed to create record `%s'\n",
+                label);
     GNUNET_break (0);
     GNUNET_SCHEDULER_cancel (endbadly_task);
-    endbadly_task = GNUNET_SCHEDULER_add_now (&endbadly, NULL);
+    endbadly_task = GNUNET_SCHEDULER_add_now (&endbadly,
+                                              NULL);
   }
 }
 
@@ -341,10 +345,16 @@ run (void *cls,
   /* name in different zone */
   GNUNET_asprintf(&s_name_3, "dummy3");
   s_rd_3 = create_record(1);
-  GNUNET_assert (NULL != (ns_ops[2] = GNUNET_NAMESTORE_records_store (nsh, privkey2, s_name_3,
-                1, s_rd_3, &put_cont, s_name_3)));
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Created record 1\n");
+  GNUNET_assert (NULL != (ns_ops[2] =
+                          GNUNET_NAMESTORE_records_store (nsh,
+                                                          privkey2,
+                                                          s_name_3,
+                                                          1,
+                                                          s_rd_3,
+                                                          &put_cont,
+                                                          s_name_3)));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Created record 1\n");
   GNUNET_asprintf(&s_name_1, "dummy1");
   s_rd_1 = create_record(1);
   GNUNET_assert (NULL != (ns_ops[0] = GNUNET_NAMESTORE_records_store(nsh, privkey, s_name_1,
@@ -364,15 +374,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api-monitoring",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_monitoring_existing.c b/src/namestore/test_namestore_api_monitoring_existing.c
index cd1838b5c..17f726eb1 100644
--- a/src/namestore/test_namestore_api_monitoring_existing.c
+++ b/src/namestore/test_namestore_api_monitoring_existing.c
@@ -71,18 +71,18 @@ do_shutdown ()
 
   if (NULL != ns_ops[0])
   {
-        GNUNET_NAMESTORE_cancel(ns_ops[0]);
-        ns_ops[0] = NULL;
+    GNUNET_NAMESTORE_cancel(ns_ops[0]);
+    ns_ops[0] = NULL;
   }
   if (NULL != ns_ops[1])
   {
-        GNUNET_NAMESTORE_cancel(ns_ops[1]);
-        ns_ops[1] = NULL;
+    GNUNET_NAMESTORE_cancel(ns_ops[1]);
+    ns_ops[1] = NULL;
   }
   if (NULL != ns_ops[2])
   {
-        GNUNET_NAMESTORE_cancel(ns_ops[2]);
-        ns_ops[2] = NULL;
+    GNUNET_NAMESTORE_cancel(ns_ops[2]);
+    ns_ops[2] = NULL;
   }
 
   if (NULL != nsh)
@@ -274,18 +274,20 @@ put_cont (void *cls, int32_t success, const char *emsg)
 static struct GNUNET_GNSRECORD_Data *
 create_record (unsigned int count)
 {
-  unsigned int c;
   struct GNUNET_GNSRECORD_Data * rd;
 
-  rd = GNUNET_malloc (count * sizeof (struct GNUNET_GNSRECORD_Data));
-  for (c = 0; c < count; c++)
+  rd = GNUNET_new_array (count,
+                         struct GNUNET_GNSRECORD_Data);
+  for (unsigned int c = 0; c < count; c++)
   {
     rd[c].expiration_time = GNUNET_TIME_relative_to_absolute (GNUNET_TIME_UNIT_HOURS).abs_value_us;
     rd[c].record_type = 1111;
     rd[c].data_size = 50;
     rd[c].data = GNUNET_malloc(50);
     rd[c].flags = 0;
-    memset ((char *) rd[c].data, 'a', 50);
+    memset ((char *) rd[c].data,
+            'a',
+            50);
   }
   return rd;
 }
@@ -300,7 +302,10 @@ run (void *cls,
 
   directory = NULL;
   GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CONFIGURATION_get_value_string(mycfg, "PATHS", "GNUNET_TEST_HOME", &directory));
+                 GNUNET_CONFIGURATION_get_value_string (mycfg,
+                                                        "PATHS",
+                                                        "GNUNET_TEST_HOME",
+                                                        &directory));
   GNUNET_DISK_directory_remove (directory);
 
   res = 1;
@@ -363,15 +368,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api-monitoring",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-monitoring-existing",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
@@ -381,4 +394,4 @@ main (int argc, char *argv[])
 }
 
 
-/* end of test_namestore_api_monitoring.c */
+/* end of test_namestore_api_monitoring_existing.c */
diff --git a/src/namestore/test_namestore_api_postgres.conf b/src/namestore/test_namestore_api_postgres.conf
new file mode 100644
index 000000000..397cb4b2f
--- /dev/null
+++ b/src/namestore/test_namestore_api_postgres.conf
@@ -0,0 +1,4 @@
+@INLINE@ test_namestore_api.conf
+
+[namestore]
+DATABASE = postgres
diff --git a/src/namestore/test_namestore_api_remove.c b/src/namestore/test_namestore_api_remove.c
index 2d670c1ee..532a751da 100644
--- a/src/namestore/test_namestore_api_remove.c
+++ b/src/namestore/test_namestore_api_remove.c
@@ -120,7 +120,8 @@ remove_cont (void *cls,
 
 
 static void
-put_cont (void *cls, int32_t success,
+put_cont (void *cls,
+          int32_t success,
           const char *emsg)
 {
   const char *name = cls;
@@ -161,20 +162,27 @@ run (void *cls,
 
   directory = NULL;
   GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CONFIGURATION_get_value_string(cfg, "PATHS", "GNUNET_TEST_HOME", &directory));
+                 GNUNET_CONFIGURATION_get_value_string(cfg,
+                                                       "PATHS",
+                                                       "GNUNET_TEST_HOME",
+                                                       &directory));
   GNUNET_DISK_directory_remove (directory);
 
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
-                                                &endbadly, NULL);
+                                                &endbadly,
+                                                NULL);
   GNUNET_asprintf (&hostkey_file,
                    "zonefiles%s%s",
                    DIR_SEPARATOR_STR,
                    "N0UJMP015AFUNR2BTNM3FKPBLG38913BL8IDMCO2H0A1LIB81960.zkey");
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Using zonekey file `%s' \n", hostkey_file);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Using zonekey file `%s' \n",
+              hostkey_file);
   privkey = GNUNET_CRYPTO_ecdsa_key_create_from_file (hostkey_file);
   GNUNET_free (hostkey_file);
   GNUNET_assert (privkey != NULL);
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey, &pubkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (privkey,
+                                      &pubkey);
 
   removed = GNUNET_NO;
 
@@ -201,15 +209,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-remove",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_remove_not_existing_record.c b/src/namestore/test_namestore_api_remove_not_existing_record.c
index ef199cdf6..2f20c3636 100644
--- a/src/namestore/test_namestore_api_remove_not_existing_record.c
+++ b/src/namestore/test_namestore_api_remove_not_existing_record.c
@@ -167,15 +167,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-remove-non-existing-record",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_sqlite.conf b/src/namestore/test_namestore_api_sqlite.conf
new file mode 100644
index 000000000..5416daec3
--- /dev/null
+++ b/src/namestore/test_namestore_api_sqlite.conf
@@ -0,0 +1,4 @@
+@INLINE@ test_namestore_api.conf
+
+[namestore]
+DATABASE = sqlite
diff --git a/src/namestore/test_namestore_api_store.c b/src/namestore/test_namestore_api_store.c
index d80676770..4e51678a1 100644
--- a/src/namestore/test_namestore_api_store.c
+++ b/src/namestore/test_namestore_api_store.c
@@ -159,15 +159,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
     GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_store_update.c b/src/namestore/test_namestore_api_store_update.c
index ed5a399bd..0a4551f21 100644
--- a/src/namestore/test_namestore_api_store_update.c
+++ b/src/namestore/test_namestore_api_store_update.c
@@ -274,15 +274,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api-store-update",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_zone_iteration.c b/src/namestore/test_namestore_api_zone_iteration.c
index 8960be55d..806605d94 100644
--- a/src/namestore/test_namestore_api_zone_iteration.c
+++ b/src/namestore/test_namestore_api_zone_iteration.c
@@ -276,7 +276,8 @@ zone_proc (void *cls,
     returned_records ++;
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Telling namestore to send the next result\n");
-    GNUNET_NAMESTORE_zone_iterator_next (zi);
+    GNUNET_NAMESTORE_zone_iterator_next (zi,
+                                         1);
   }
   else
   {
@@ -486,15 +487,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api-zone-iteration",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_zone_iteration_nick.c b/src/namestore/test_namestore_api_zone_iteration_nick.c
index 791702f97..a88646864 100644
--- a/src/namestore/test_namestore_api_zone_iteration_nick.c
+++ b/src/namestore/test_namestore_api_zone_iteration_nick.c
@@ -245,7 +245,8 @@ zone_proc (void *cls,
     returned_records ++;
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Telling namestore to send the next result\n");
-    GNUNET_NAMESTORE_zone_iterator_next (zi);
+    GNUNET_NAMESTORE_zone_iterator_next (zi,
+                                         1);
   }
   else
   {
@@ -489,15 +490,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api-zone-iteration",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-zone-iteration-nick",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_zone_iteration_specific_zone.c b/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
index c5ae927b0..a4fb320e9 100644
--- a/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
+++ b/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
@@ -238,7 +238,8 @@ zone_proc (void *cls,
     returned_records ++;
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Telling namestore to send the next result\n");
-    GNUNET_NAMESTORE_zone_iterator_next (zi);
+    GNUNET_NAMESTORE_zone_iterator_next (zi,
+                                         1);
   }
   else
   {
@@ -484,15 +485,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api-zone-iteration",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-zone-iteration-specific-zone",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_zone_iteration_stop.c b/src/namestore/test_namestore_api_zone_iteration_stop.c
index a5f040150..c7be5fead 100644
--- a/src/namestore/test_namestore_api_zone_iteration_stop.c
+++ b/src/namestore/test_namestore_api_zone_iteration_stop.c
@@ -271,7 +271,8 @@ zone_proc (void *cls,
     returned_records ++;
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Telling namestore to send the next result\n");
-    GNUNET_NAMESTORE_zone_iterator_next (zi);
+    GNUNET_NAMESTORE_zone_iterator_next (zi,
+                                         1);
   }
   else
   {
@@ -507,15 +508,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api-zone-iteration-stop",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_zone_to_name.c b/src/namestore/test_namestore_api_zone_to_name.c
index 2bc7d34a3..5b088d90b 100644
--- a/src/namestore/test_namestore_api_zone_to_name.c
+++ b/src/namestore/test_namestore_api_zone_to_name.c
@@ -221,7 +221,7 @@ run (void *cls,
   /* load privat key */
   {
     char *zonekey_file;
-  
+
     GNUNET_asprintf (&zonekey_file,
                      "zonefiles%s%s",
                      DIR_SEPARATOR_STR,
@@ -242,13 +242,13 @@ run (void *cls,
                               sizeof (s_zone_value));
   {
     struct GNUNET_GNSRECORD_Data rd;
-    
+
     rd.expiration_time = GNUNET_TIME_absolute_get().abs_value_us;
     rd.record_type = GNUNET_GNSRECORD_TYPE_PKEY;
     rd.data_size = sizeof (s_zone_value);
     rd.data = &s_zone_value;
     rd.flags = 0;
-    
+
     nsh = GNUNET_NAMESTORE_connect (cfg);
     GNUNET_break (NULL != nsh);
     GNUNET_NAMESTORE_records_store (nsh,
@@ -266,17 +266,24 @@ int
 main (int argc,
       char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
   (void) argc;
-  (void) argv;
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api-zone-to-name",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
     GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_plugin_namestore.c b/src/namestore/test_plugin_namestore.c
index aa5d10809..6bccd1706 100644
--- a/src/namestore/test_plugin_namestore.c
+++ b/src/namestore/test_plugin_namestore.c
@@ -47,8 +47,12 @@ unload_plugin (struct GNUNET_NAMESTORE_PluginFunctions *api)
 {
   char *libname;
 
-  GNUNET_asprintf (&libname, "libgnunet_plugin_namestore_%s", plugin_name);
-  GNUNET_break (NULL == GNUNET_PLUGIN_unload (libname, api));
+  GNUNET_asprintf (&libname,
+                   "libgnunet_plugin_namestore_%s",
+                   plugin_name);
+  GNUNET_break (NULL ==
+                GNUNET_PLUGIN_unload (libname,
+                                      api));
   GNUNET_free (libname);
 }
 
@@ -65,12 +69,17 @@ load_plugin (const struct GNUNET_CONFIGURATION_Handle *cfg)
   struct GNUNET_NAMESTORE_PluginFunctions *ret;
   char *libname;
 
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO, _("Loading `%s' namestore plugin\n"),
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              _("Loading `%s' namestore plugin\n"),
               plugin_name);
-  GNUNET_asprintf (&libname, "libgnunet_plugin_namestore_%s", plugin_name);
+  GNUNET_asprintf (&libname,
+                   "libgnunet_plugin_namestore_%s",
+                   plugin_name);
   if (NULL == (ret = GNUNET_PLUGIN_load (libname, (void*) cfg)))
   {
-    FPRINTF (stderr, "Failed to load plugin `%s'!\n", plugin_name);
+    FPRINTF (stderr,
+             "Failed to load plugin `%s'!\n",
+             plugin_name);
     GNUNET_free (libname);
     return NULL;
   }
@@ -81,54 +90,66 @@ load_plugin (const struct GNUNET_CONFIGURATION_Handle *cfg)
 
 static void
 test_record (void *cls,
-                                                 const struct GNUNET_CRYPTO_EcdsaPrivateKey *private_key,
-                                                 const char *label,
-                                                 unsigned int rd_count,
-                                                 const struct GNUNET_GNSRECORD_Data *rd)
+             uint64_t seq,
+             const struct GNUNET_CRYPTO_EcdsaPrivateKey *private_key,
+             const char *label,
+             unsigned int rd_count,
+             const struct GNUNET_GNSRECORD_Data *rd)
 {
   int *idp = cls;
   int id = *idp;
   struct GNUNET_CRYPTO_EcdsaPrivateKey tzone_private_key;
   char tname[64];
   unsigned int trd_count = 1 + (id % 1024);
-  unsigned int i;
 
-  GNUNET_snprintf (tname, sizeof (tname),
-                   "a%u", (unsigned int ) id);
-  for (i=0;i<trd_count;i++)
+  GNUNET_snprintf (tname,
+                   sizeof (tname),
+                   "a%u",
+                   (unsigned int ) id);
+  for (unsigned int i=0;i<trd_count;i++)
   {
     GNUNET_assert (rd[i].data_size == id % 10);
     GNUNET_assert (0 == memcmp ("Hello World", rd[i].data, id % 10));
     GNUNET_assert (rd[i].record_type == 1 + (id % 13));
     GNUNET_assert (rd[i].flags == 0);
   }
-  memset (&tzone_private_key, (id % 241), sizeof (tzone_private_key));
+  memset (&tzone_private_key,
+          (id % 241),
+          sizeof (tzone_private_key));
   GNUNET_assert (0 == strcmp (label, tname));
-  GNUNET_assert (0 == memcmp (&tzone_private_key, private_key, sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey)));
+  GNUNET_assert (0 == memcmp (&tzone_private_key,
+                              private_key,
+                              sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey)));
 }
 
 
 static void
-get_record (struct GNUNET_NAMESTORE_PluginFunctions *nsp, int id)
+get_record (struct GNUNET_NAMESTORE_PluginFunctions *nsp,
+            int id)
 {
-  GNUNET_assert (GNUNET_OK == nsp->iterate_records (nsp->cls,
-                                            NULL, 0, &test_record, &id));
+  GNUNET_assert (GNUNET_OK ==
+                 nsp->iterate_records (nsp->cls,
+                                       NULL,
+                                       0,
+                                       1,
+                                       &test_record,
+                                       &id));
 }
 
 
 static void
-put_record (struct GNUNET_NAMESTORE_PluginFunctions *nsp, int id)
+put_record (struct GNUNET_NAMESTORE_PluginFunctions *nsp,
+            int id)
 {
   struct GNUNET_CRYPTO_EcdsaPrivateKey zone_private_key;
   char label[64];
   unsigned int rd_count = 1 + (id % 1024);
   struct GNUNET_GNSRECORD_Data rd[rd_count];
   struct GNUNET_CRYPTO_EcdsaSignature signature;
-  unsigned int i;
 
   GNUNET_snprintf (label, sizeof (label),
                    "a%u", (unsigned int ) id);
-  for (i=0;i<rd_count;i++)
+  for (unsigned int i=0;i<rd_count;i++)
   {
     rd[i].data = "Hello World";
     rd[i].data_size = id % 10;
@@ -138,16 +159,19 @@ put_record (struct GNUNET_NAMESTORE_PluginFunctions *nsp, int id)
   }
   memset (&zone_private_key, (id % 241), sizeof (zone_private_key));
   memset (&signature, (id % 243), sizeof (signature));
-  GNUNET_assert (GNUNET_OK == nsp->store_records (nsp->cls,
-                                                &zone_private_key,
-                                                label,
-                                                rd_count,
-                                                rd));
+  GNUNET_assert (GNUNET_OK ==
+                 nsp->store_records (nsp->cls,
+                                     &zone_private_key,
+                                     label,
+                                     rd_count,
+                                     rd));
 }
 
 
 static void
-run (void *cls, char *const *args, const char *cfgfile,
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
      const struct GNUNET_CONFIGURATION_Handle *cfg)
 {
   struct GNUNET_NAMESTORE_PluginFunctions *nsp;
@@ -169,7 +193,8 @@ run (void *cls, char *const *args, const char *cfgfile,
 
 
 int
-main (int argc, char *argv[])
+main (int argc,
+      char *argv[])
 {
   char cfg_name[128];
   char *const xargv[] = {
@@ -182,18 +207,25 @@ main (int argc, char *argv[])
     GNUNET_GETOPT_OPTION_END
   };
 
-  //GNUNET_DISK_directory_remove ("/tmp/gnunet-test-plugin-namestore-sqlite");
   GNUNET_log_setup ("test-plugin-namestore",
                     "WARNING",
                     NULL);
   plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
-  GNUNET_snprintf (cfg_name, sizeof (cfg_name), "test_plugin_namestore_%s.conf",
+  GNUNET_snprintf (cfg_name,
+                   sizeof (cfg_name),
+                   "test_plugin_namestore_%s.conf",
                    plugin_name);
-  GNUNET_PROGRAM_run ((sizeof (xargv) / sizeof (char *)) - 1, xargv,
-                      "test-plugin-namestore", "nohelp", options, &run, NULL);
+  GNUNET_PROGRAM_run ((sizeof (xargv) / sizeof (char *)) - 1,
+                      xargv,
+                      "test-plugin-namestore",
+                      "nohelp",
+                      options,
+                      &run,
+                      NULL);
   if (ok != 0)
-    FPRINTF (stderr, "Missed some testcases: %d\n", ok);
-  //GNUNET_DISK_directory_remove ("/tmp/gnunet-test-plugin-namestore-sqlite");
+    FPRINTF (stderr,
+             "Missed some testcases: %d\n",
+             ok);
   return ok;
 }
 
diff --git a/src/util/container_multihashmap.c b/src/util/container_multihashmap.c
index ffeb4a71f..6001fc1df 100644
--- a/src/util/container_multihashmap.c
+++ b/src/util/container_multihashmap.c
@@ -175,14 +175,36 @@ struct GNUNET_CONTAINER_MultiHashMap *
 GNUNET_CONTAINER_multihashmap_create (unsigned int len,
                                       int do_not_copy_keys)
 {
-  struct GNUNET_CONTAINER_MultiHashMap *map;
+  struct GNUNET_CONTAINER_MultiHashMap *hm;
 
   GNUNET_assert (len > 0);
-  map = GNUNET_new (struct GNUNET_CONTAINER_MultiHashMap);
-  map->map = GNUNET_malloc (len * sizeof (union MapEntry));
-  map->map_length = len;
-  map->use_small_entries = do_not_copy_keys;
-  return map;
+  hm = GNUNET_new (struct GNUNET_CONTAINER_MultiHashMap);
+  if (len * sizeof (union MapEntry) > GNUNET_MAX_MALLOC_CHECKED)
+  {
+    size_t s;
+    /* application *explicitly* requested very large map, hopefully
+       it checks the return value... */
+    s = len * sizeof (union MapEntry);
+    if ( (s / sizeof (union MapEntry)) != len)
+      return NULL; /* integer overflow on multiplication */
+    if (NULL == (hm->map = GNUNET_malloc_large (s)))
+    {
+      /* out of memory */
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Out of memory allocating large hash map (%u entries)\n",
+                  len);
+      GNUNET_free (hm);
+      return NULL;
+    }
+  }
+  else
+  {
+    hm->map = GNUNET_new_array (len,
+                                union MapEntry);
+  }
+  hm->map_length = len;
+  hm->use_small_entries = do_not_copy_keys;
+  return hm;
 }
 
 
@@ -196,11 +218,10 @@ void
 GNUNET_CONTAINER_multihashmap_destroy (struct GNUNET_CONTAINER_MultiHashMap
                                        *map)
 {
-  unsigned int i;
-  union MapEntry me;
-
-  for (i = 0; i < map->map_length; i++)
+  for (unsigned int i = 0; i < map->map_length; i++)
   {
+    union MapEntry me;
+
     me = map->map[i];
     if (map->use_small_entries)
     {
@@ -257,8 +278,7 @@ idx_of (const struct GNUNET_CONTAINER_MultiHashMap *map,
  * @return the number of key value pairs
  */
 unsigned int
-GNUNET_CONTAINER_multihashmap_size (const struct GNUNET_CONTAINER_MultiHashMap
-                                    *map)
+GNUNET_CONTAINER_multihashmap_size (const struct GNUNET_CONTAINER_MultiHashMap *map)
 {
   return map->size;
 }
@@ -656,17 +676,22 @@ grow (struct GNUNET_CONTAINER_MultiHashMap *map)
   unsigned int old_len;
   unsigned int new_len;
   unsigned int idx;
-  unsigned int i;
 
   map->modification_counter++;
 
   old_map = map->map;
   old_len = map->map_length;
   new_len = old_len * 2;
-  new_map = GNUNET_malloc (sizeof (union MapEntry) * new_len);
+  /* if we would exceed heap size limit for the _first_ time,
+     try staying just below the limit */
+  if ( (new_len * sizeof (union MapEntry) > GNUNET_MAX_MALLOC_CHECKED) &&
+       ((old_len+1) * sizeof (union MapEntry) < GNUNET_MAX_MALLOC_CHECKED) )
+    new_len = GNUNET_MAX_MALLOC_CHECKED / sizeof (union MapEntry);
+  new_map = GNUNET_new_array (new_len,
+                              union MapEntry);
   map->map_length = new_len;
   map->map = new_map;
-  for (i = 0; i < old_len; i++)
+  for (unsigned int i = 0; i < old_len; i++)
   {
     if (map->use_small_entries)
     {
diff --git a/src/util/mq.c b/src/util/mq.c
index af700836c..dbcce704d 100644
--- a/src/util/mq.c
+++ b/src/util/mq.c
@@ -578,11 +578,9 @@ void
 GNUNET_MQ_set_handlers_closure (struct GNUNET_MQ_Handle *mq,
                                 void *handlers_cls)
 {
-  unsigned int i;
-
   if (NULL == mq->handlers)
     return;
-  for (i=0;NULL != mq->handlers[i].cb; i++)
+  for (unsigned int i=0;NULL != mq->handlers[i].cb; i++)
     mq->handlers[i].cls = handlers_cls;
 }
 
@@ -782,7 +780,9 @@ GNUNET_MQ_notify_sent (struct GNUNET_MQ_Envelope *ev,
                        GNUNET_SCHEDULER_TaskCallback cb,
                        void *cb_cls)
 {
-  GNUNET_assert (NULL == ev->sent_cb);
+  /* allow setting *OR* clearing callback */
+  GNUNET_assert ( (NULL == ev->sent_cb) ||
+                  (NULL == cb) );
   ev->sent_cb = cb;
   ev->sent_cls = cb_cls;
 }
diff --git a/src/util/resolver_api.c b/src/util/resolver_api.c
index b92fd6a02..68f02587a 100644
--- a/src/util/resolver_api.c
+++ b/src/util/resolver_api.c
@@ -478,7 +478,15 @@ handle_response (void *cls,
   char *nret;
 
   (void) cls;
-  GNUNET_assert (NULL != rh);
+  if (NULL == rh)
+  {
+    /* Resolver service sent extra replies to query (after terminator)? Bad! */
+    GNUNET_break (0);
+    GNUNET_MQ_destroy (mq);
+    mq = NULL;
+    reconnect ();
+    return;
+  }
   size = ntohs (msg->size);
   if (size == sizeof (struct GNUNET_MessageHeader))
   {
diff --git a/src/zonemaster/gnunet-service-zonemaster.c b/src/zonemaster/gnunet-service-zonemaster.c
index b3a2cb8b3..7129cf44f 100644
--- a/src/zonemaster/gnunet-service-zonemaster.c
+++ b/src/zonemaster/gnunet-service-zonemaster.c
@@ -36,20 +36,38 @@
 #define LOG_STRERROR_FILE(kind,syscall,filename) GNUNET_log_from_strerror_file (kind, "util", syscall, filename)
 
 
+/**
+ * How often should we (re)publish each record before
+ * it expires?
+ */
+#define PUBLISH_OPS_PER_EXPIRATION 4
 
 /**
- * The initial interval in milliseconds btween puts in
- * a zone iteration
+ * How often do we measure the delta between desired zone
+ * iteration speed and actual speed, and tell statistics
+ * service about it?
  */
-#define INITIAL_PUT_INTERVAL GNUNET_TIME_UNIT_MILLISECONDS
+#define DELTA_INTERVAL 100
 
 /**
- * The lower bound for the zone iteration interval
+ * How many records do we fetch in one shot from the namestore?
  */
-#define MINIMUM_ZONE_ITERATION_INTERVAL GNUNET_TIME_UNIT_SECONDS
+#define NS_BLOCK_SIZE 1000
+
+/**
+ * How many pending DHT operations do we allow at most?
+ */
+#define DHT_QUEUE_LIMIT 2000
+
+/**
+ * The initial interval in milliseconds btween puts in
+ * a zone iteration
+ */
+#define INITIAL_ZONE_ITERATION_INTERVAL GNUNET_TIME_UNIT_MILLISECONDS
 
 /**
  * The upper bound for the zone iteration interval
+ * (per record).
  */
 #define MAXIMUM_ZONE_ITERATION_INTERVAL GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 15)
 
@@ -79,22 +97,27 @@
 /**
  * Handle for DHT PUT activity triggered from the namestore monitor.
  */
-struct MonitorActivity
+struct DhtPutActivity
 {
   /**
    * Kept in a DLL.
    */
-  struct MonitorActivity *next;
+  struct DhtPutActivity *next;
 
   /**
    * Kept in a DLL.
    */
-  struct MonitorActivity *prev;
+  struct DhtPutActivity *prev;
 
   /**
    * Handle for the DHT PUT operation.
    */
   struct GNUNET_DHT_PutHandle *ph;
+
+  /**
+   * When was this PUT initiated?
+   */
+  struct GNUNET_TIME_Absolute start_date;
 };
 
 
@@ -131,12 +154,32 @@ static struct GNUNET_NAMESTORE_ZoneMonitor *zmon;
 /**
  * Head of monitor activities; kept in a DLL.
  */
-static struct MonitorActivity *ma_head;
+static struct DhtPutActivity *ma_head;
 
 /**
  * Tail of monitor activities; kept in a DLL.
  */
-static struct MonitorActivity *ma_tail;
+static struct DhtPutActivity *ma_tail;
+
+/**
+ * Head of iteration put activities; kept in a DLL.
+ */
+static struct DhtPutActivity *it_head;
+
+/**
+ * Tail of iteration put activities; kept in a DLL.
+ */
+static struct DhtPutActivity *it_tail;
+
+/**
+ * Number of entries in the DHT queue #it_head.
+ */
+static unsigned int dht_queue_length;
+
+/**
+ * Number of entries in the DHT queue #ma_head.
+ */
+static unsigned int ma_queue_length;
 
 /**
  * Useful for zone update for DHT put
@@ -149,15 +192,31 @@ static unsigned long long num_public_records;
 static unsigned long long last_num_public_records;
 
 /**
+ * Number of successful put operations performed in the current
+ * measurement cycle (as measured in #check_zone_namestore_next()).
+ */
+static unsigned long long put_cnt;
+
+/**
+ * What is the frequency at which we currently would like
+ * to perform DHT puts (per record)?  Calculated in
+ * update_velocity() from the #zone_publish_time_window()
+ * and the total number of record sets we have (so far)
+ * observed in the zone.
+ */
+static struct GNUNET_TIME_Relative target_iteration_velocity_per_record;
+
+/**
  * Minimum relative expiration time of records seem during the current
  * zone iteration.
  */
 static struct GNUNET_TIME_Relative min_relative_record_time;
 
 /**
- * Zone iteration PUT interval.
+ * Minimum relative expiration time of records seem during the last
+ * zone iteration.
  */
-static struct GNUNET_TIME_Relative put_interval;
+static struct GNUNET_TIME_Relative last_min_relative_record_time;
 
 /**
  * Default time window for zone iteration
@@ -171,16 +230,43 @@ static struct GNUNET_TIME_Relative zone_publish_time_window_default;
 static struct GNUNET_TIME_Relative zone_publish_time_window;
 
 /**
+ * When did we last start measuring the #DELTA_INTERVAL successful
+ * DHT puts? Used for velocity calculations.
+ */
+static struct GNUNET_TIME_Absolute last_put_100;
+
+/**
+ * By how much should we try to increase our per-record iteration speed
+ * (over the desired speed calculated directly from the #put_interval)?
+ * Basically this value corresponds to the per-record CPU time overhead
+ * we have.
+ */
+static struct GNUNET_TIME_Relative sub_delta;
+
+/**
  * zone publish task
  */
 static struct GNUNET_SCHEDULER_Task *zone_publish_task;
 
 /**
+ * How many more values are left for the current query before we need
+ * to explicitly ask the namestore for more?
+ */
+static unsigned int ns_iteration_left;
+
+/**
  * #GNUNET_YES if zone has never been published before
  */
 static int first_zone_iteration;
 
 /**
+ * Optimize block insertion by caching map of private keys to
+ * public keys in memory?
+ */
+static int cache_keys;
+
+
+/**
  * Task run during shutdown.
  *
  * @param cls unused
@@ -189,8 +275,9 @@ static int first_zone_iteration;
 static void
 shutdown_task (void *cls)
 {
-  struct MonitorActivity *ma;
+  struct DhtPutActivity *ma;
 
+  (void) cls;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Shutting down!\n");
   while (NULL != (ma = ma_head))
@@ -201,6 +288,15 @@ shutdown_task (void *cls)
                                  ma);
     GNUNET_free (ma);
   }
+  while (NULL != (ma = it_head))
+  {
+    GNUNET_DHT_put_cancel (ma->ph);
+    GNUNET_CONTAINER_DLL_remove (it_head,
+                                 it_tail,
+                                 ma);
+    dht_queue_length--;
+    GNUNET_free (ma);
+  }
   if (NULL != statistics)
   {
     GNUNET_STATISTICS_destroy (statistics,
@@ -243,14 +339,18 @@ shutdown_task (void *cls)
 /**
  * Method called periodically that triggers iteration over authoritative records
  *
- * @param cls closure
+ * @param cls NULL
  */
 static void
-publish_zone_dht_next (void *cls)
+publish_zone_namestore_next (void *cls)
 {
+  (void) cls;
   zone_publish_task = NULL;
   GNUNET_assert (NULL != namestore_iter);
-  GNUNET_NAMESTORE_zone_iterator_next (namestore_iter);
+  GNUNET_assert (0 == ns_iteration_left);
+  ns_iteration_left = NS_BLOCK_SIZE;
+  GNUNET_NAMESTORE_zone_iterator_next (namestore_iter,
+                                       NS_BLOCK_SIZE);
 }
 
 
@@ -264,58 +364,224 @@ publish_zone_dht_start (void *cls);
 
 
 /**
- * Continuation called from DHT once the PUT operation is done.
+ * Continuation called from DHT once the PUT operation triggered
+ * by a monitor is done.
  *
- * @param cls closure, NULL if called from regular iteration,
- *        `struct MonitorActivity` if called from #handle_monitor_event.
- * @param success #GNUNET_OK on success
+ * @param cls a `struct DhtPutActivity`
  */
 static void
-dht_put_continuation (void *cls,
-                      int success)
+dht_put_monitor_continuation (void *cls)
 {
-  struct MonitorActivity *ma = cls;
-  struct GNUNET_TIME_Relative next_put_interval;
+  struct DhtPutActivity *ma = cls;
 
-  num_public_records++;
-  if (NULL == ma)
+  ma_queue_length--;
+  GNUNET_CONTAINER_DLL_remove (ma_head,
+                               ma_tail,
+                               ma);
+  GNUNET_free (ma);
+}
+
+
+/**
+ * Calculate #target_iteration_velocity_per_record.
+ */
+static void
+calculate_put_interval ()
+{
+  if (0 == num_public_records)
   {
-    active_put = NULL;
-    if ( (num_public_records > last_num_public_records) &&
-         (GNUNET_NO == first_zone_iteration) )
+    /**
+     * If no records are known (startup) or none present
+     * we can safely set the interval to the value for a single
+     * record
+     */
+    target_iteration_velocity_per_record = zone_publish_time_window;
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG | GNUNET_ERROR_TYPE_BULK,
+                "No records in namestore database.\n");
+  }
+  else
+  {
+    last_min_relative_record_time
+      = GNUNET_TIME_relative_min (last_min_relative_record_time,
+                                  min_relative_record_time);
+    zone_publish_time_window
+      = GNUNET_TIME_relative_min (GNUNET_TIME_relative_divide (last_min_relative_record_time,
+                                                               PUBLISH_OPS_PER_EXPIRATION),
+                                  zone_publish_time_window_default);
+    target_iteration_velocity_per_record
+      = GNUNET_TIME_relative_divide (zone_publish_time_window,
+                                     last_num_public_records);
+  }
+  target_iteration_velocity_per_record
+    = GNUNET_TIME_relative_min (target_iteration_velocity_per_record,
+                                MAXIMUM_ZONE_ITERATION_INTERVAL);
+  GNUNET_STATISTICS_set (statistics,
+                         "Minimum relative record expiration (in μs)",
+                         last_min_relative_record_time.rel_value_us,
+                         GNUNET_NO);
+  GNUNET_STATISTICS_set (statistics,
+                         "Zone publication time window (in μs)",
+                         zone_publish_time_window.rel_value_us,
+                         GNUNET_NO);
+  GNUNET_STATISTICS_set (statistics,
+                         "Target zone iteration velocity (μs)",
+                         target_iteration_velocity_per_record.rel_value_us,
+                         GNUNET_NO);
+}
+
+
+/**
+ * Re-calculate our velocity and the desired velocity.
+ * We have succeeded in making #DELTA_INTERVAL puts, so
+ * now calculate the new desired delay between puts.
+ *
+ * @param cnt how many records were processed since the last call?
+ */
+static void
+update_velocity (unsigned int cnt)
+{
+  struct GNUNET_TIME_Relative delta;
+  unsigned long long pct = 0;
+
+  if (0 == cnt)
+    return;
+  /* How fast were we really? */
+  delta = GNUNET_TIME_absolute_get_duration (last_put_100);
+  delta.rel_value_us /= cnt;
+  last_put_100 = GNUNET_TIME_absolute_get ();
+
+  /* calculate expected frequency */
+  if ( (num_public_records > last_num_public_records) &&
+       (GNUNET_NO == first_zone_iteration) )
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Last record count was lower than current record count.  Reducing interval.\n");
+    last_num_public_records = num_public_records * LATE_ITERATION_SPEEDUP_FACTOR;
+    calculate_put_interval ();
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Desired global zone iteration interval is %s/record!\n",
+              GNUNET_STRINGS_relative_time_to_string (target_iteration_velocity_per_record,
+                                                      GNUNET_YES));
+
+  /* Tell statistics actual vs. desired speed */
+  GNUNET_STATISTICS_set (statistics,
+                         "Current zone iteration velocity (μs/record)",
+                         delta.rel_value_us,
+                         GNUNET_NO);
+  /* update "sub_delta" based on difference, taking
+     previous sub_delta into account! */
+  if (target_iteration_velocity_per_record.rel_value_us > delta.rel_value_us)
+  {
+    /* We were too fast, reduce sub_delta! */
+    struct GNUNET_TIME_Relative corr;
+
+    corr = GNUNET_TIME_relative_subtract (target_iteration_velocity_per_record,
+                                          delta);
+    if (sub_delta.rel_value_us > delta.rel_value_us)
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Last record count was lower than current record count.  Reducing interval.\n");
-      put_interval = GNUNET_TIME_relative_divide (zone_publish_time_window,
-                                                  num_public_records);
-      next_put_interval = GNUNET_TIME_relative_divide (put_interval,
-                                                       LATE_ITERATION_SPEEDUP_FACTOR);
+      /* Reduce sub_delta by corr */
+      sub_delta = GNUNET_TIME_relative_subtract (sub_delta,
+                                                 corr);
     }
     else
-      next_put_interval = put_interval;
-    next_put_interval = GNUNET_TIME_relative_min (next_put_interval,
-                                                  MAXIMUM_ZONE_ITERATION_INTERVAL);
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "PUT complete, next PUT in %s!\n",
-                GNUNET_STRINGS_relative_time_to_string (next_put_interval,
-                                                        GNUNET_YES));
-
-    GNUNET_STATISTICS_set (statistics,
-                           "Current zone iteration interval (ms)",
-                           next_put_interval.rel_value_us / 1000LL,
-                           GNUNET_NO);
-    GNUNET_assert (NULL == zone_publish_task);
-    zone_publish_task = GNUNET_SCHEDULER_add_delayed (next_put_interval,
-                                                      &publish_zone_dht_next,
-                                                      NULL);
+    {
+      /* We're doing fine with waiting the full time, this
+         should theoretically only happen if we run at
+         infinite speed. */
+      sub_delta = GNUNET_TIME_UNIT_ZERO;
+    }
   }
-  else
+  else if (target_iteration_velocity_per_record.rel_value_us < delta.rel_value_us)
   {
-    GNUNET_CONTAINER_DLL_remove (ma_head,
-                                 ma_tail,
-                                 ma);
-    GNUNET_free (ma);
+    /* We were too slow, increase sub_delta! */
+    struct GNUNET_TIME_Relative corr;
+
+    corr = GNUNET_TIME_relative_subtract (delta,
+                                          target_iteration_velocity_per_record);
+    sub_delta = GNUNET_TIME_relative_add (sub_delta,
+                                          corr);
+    if (sub_delta.rel_value_us > target_iteration_velocity_per_record.rel_value_us)
+    {
+      /* CPU overload detected, we cannot go at desired speed,
+         as this would mean using a negative delay. */
+      /* compute how much faster we would want to be for
+         the desired velocity */
+      if (0 == target_iteration_velocity_per_record.rel_value_us)
+        pct = UINT64_MAX; /* desired speed is infinity ... */
+      else
+        pct = (sub_delta.rel_value_us -
+               target_iteration_velocity_per_record.rel_value_us) * 100LLU
+          / target_iteration_velocity_per_record.rel_value_us;
+      sub_delta = target_iteration_velocity_per_record;
+    }
   }
+  GNUNET_STATISTICS_set (statistics,
+                         "# size of the DHT queue (it)",
+                         dht_queue_length,
+                         GNUNET_NO);
+  GNUNET_STATISTICS_set (statistics,
+                         "# size of the DHT queue (mon)",
+                         ma_queue_length,
+                         GNUNET_NO);
+  GNUNET_STATISTICS_set (statistics,
+                         "% speed increase needed for target velocity",
+                         pct,
+                         GNUNET_NO);
+  GNUNET_STATISTICS_set (statistics,
+                         "# records processed in current iteration",
+                         num_public_records,
+                         GNUNET_NO);
+}
+
+
+/**
+ * Check if the current zone iteration needs to be continued
+ * by calling #publish_zone_namestore_next(), and if so with what delay.
+ */
+static void
+check_zone_namestore_next ()
+{
+  struct GNUNET_TIME_Relative delay;
+
+  if (0 != ns_iteration_left)
+    return; /* current NAMESTORE iteration not yet done */
+  update_velocity (put_cnt);
+  put_cnt = 0;
+  delay = GNUNET_TIME_relative_subtract (target_iteration_velocity_per_record,
+                                         sub_delta);
+  /* We delay *once* per #NS_BLOCK_SIZE, so we need to multiply the
+     per-record delay calculated so far with the #NS_BLOCK_SIZE */
+  GNUNET_STATISTICS_set (statistics,
+                         "Current artificial NAMESTORE delay (μs/record)",
+                         delay.rel_value_us,
+                         GNUNET_NO);
+  delay = GNUNET_TIME_relative_multiply (delay,
+                                         NS_BLOCK_SIZE);
+  GNUNET_assert (NULL == zone_publish_task);
+  zone_publish_task = GNUNET_SCHEDULER_add_delayed (delay,
+                                                    &publish_zone_namestore_next,
+                                                    NULL);
+}
+
+
+/**
+ * Continuation called from DHT once the PUT operation is done.
+ *
+ * @param cls a `struct DhtPutActivity`
+ */
+static void
+dht_put_continuation (void *cls)
+{
+  struct DhtPutActivity *ma = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "PUT complete\n");
+  dht_queue_length--;
+  GNUNET_CONTAINER_DLL_remove (it_head,
+                               it_tail,
+                               ma);
+  GNUNET_free (ma);
 }
 
 
@@ -336,11 +602,10 @@ convert_records_for_export (const struct GNUNET_GNSRECORD_Data *rd,
 {
   struct GNUNET_TIME_Absolute now;
   unsigned int rd_public_count;
-  unsigned int i;
 
   rd_public_count = 0;
   now = GNUNET_TIME_absolute_get ();
-  for (i=0;i<rd_count;i++)
+  for (unsigned int i=0;i<rd_count;i++)
     if (0 == (rd[i].flags & GNUNET_GNSRECORD_RF_PRIVATE))
     {
       rd_public[rd_public_count] = rd[i];
@@ -370,7 +635,8 @@ convert_records_for_export (const struct GNUNET_GNSRECORD_Data *rd,
  * @param label label to store under
  * @param rd_public public record data
  * @param rd_public_count number of records in @a rd_public
- * @param pc_arg closure argument to pass to the #dht_put_continuation
+ * @param cont function to call with PUT result
+ * @param cont_cls closure for @a cont
  * @return DHT PUT handle, NULL on error
  */
 static struct GNUNET_DHT_PutHandle *
@@ -378,7 +644,8 @@ perform_dht_put (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
                  const char *label,
                  const struct GNUNET_GNSRECORD_Data *rd_public,
                  unsigned int rd_public_count,
-                 void *pc_arg)
+                 GNUNET_SCHEDULER_TaskCallback cont,
+                 void *cont_cls)
 {
   struct GNUNET_GNSRECORD_Block *block;
   struct GNUNET_HashCode query;
@@ -388,25 +655,40 @@ perform_dht_put (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
 
   expire = GNUNET_GNSRECORD_record_get_expiration_time (rd_public_count,
                                                         rd_public);
-  block = GNUNET_GNSRECORD_block_create (key,
-                                         expire,
-                                         label,
-                                         rd_public,
-                                         rd_public_count);
+  if (cache_keys)
+    block = GNUNET_GNSRECORD_block_create2 (key,
+                                            expire,
+                                            label,
+                                            rd_public,
+                                            rd_public_count);
+  else
+    block = GNUNET_GNSRECORD_block_create (key,
+                                           expire,
+                                           label,
+                                           rd_public,
+                                           rd_public_count);
   if (NULL == block)
+  {
+    GNUNET_break (0);
     return NULL; /* whoops */
+  }
   block_size = ntohl (block->purpose.size)
     + sizeof (struct GNUNET_CRYPTO_EcdsaSignature)
     + sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey);
   GNUNET_GNSRECORD_query_from_private_key (key,
                                            label,
                                            &query);
+  GNUNET_STATISTICS_update (statistics,
+                            "DHT put operations initiated",
+                            1,
+                            GNUNET_NO);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Storing %u record(s) for label `%s' in DHT with expiration `%s' under key %s\n",
               rd_public_count,
               label,
               GNUNET_STRINGS_absolute_time_to_string (expire),
               GNUNET_h2s (&query));
+  num_public_records++;
   ret = GNUNET_DHT_put (dht_handle,
                         &query,
                         DHT_GNS_REPLICATION_LEVEL,
@@ -415,8 +697,8 @@ perform_dht_put (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
                         block_size,
                         block,
                         expire,
-                        &dht_put_continuation,
-                        pc_arg);
+                        cont,
+                        cont_cls);
   GNUNET_free (block);
   return ret;
 }
@@ -424,10 +706,13 @@ perform_dht_put (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
 
 /**
  * We encountered an error in our zone iteration.
+ *
+ * @param cls NULL
  */
 static void
 zone_iteration_error (void *cls)
 {
+  (void) cls;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Got disconnected from namestore database, retrying.\n");
   namestore_iter = NULL;
@@ -451,66 +736,47 @@ zone_iteration_error (void *cls)
 
 /**
  * Zone iteration is completed.
+ *
+ * @param cls NULL
  */
 static void
 zone_iteration_finished (void *cls)
 {
+  (void) cls;
   /* we're done with one iteration, calculate when to do the next one */
   namestore_iter = NULL;
   last_num_public_records = num_public_records;
   first_zone_iteration = GNUNET_NO;
-  if (0 == num_public_records)
-  {
-    /**
-     * If no records are known (startup) or none present
-     * we can safely set the interval to the value for a single
-     * record
-     */
-    put_interval = zone_publish_time_window;
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG | GNUNET_ERROR_TYPE_BULK,
-                "No records in namestore database.\n");
-  }
-  else
-  {
-    /* If records are present, next publication is based on the minimum
-     * relative expiration time of the records published divided by 4
-     */
-    zone_publish_time_window
-      = GNUNET_TIME_relative_min (GNUNET_TIME_relative_divide (min_relative_record_time, 4),
-                                  zone_publish_time_window_default);
-    put_interval = GNUNET_TIME_relative_divide (zone_publish_time_window,
-                                                num_public_records);
-  }
+  last_min_relative_record_time = min_relative_record_time;
+  calculate_put_interval ();
   /* reset for next iteration */
-  min_relative_record_time = GNUNET_TIME_UNIT_FOREVER_REL;
-  put_interval = GNUNET_TIME_relative_max (MINIMUM_ZONE_ITERATION_INTERVAL,
-                                           put_interval);
-  put_interval = GNUNET_TIME_relative_min (put_interval,
-                                           MAXIMUM_ZONE_ITERATION_INTERVAL);
+  min_relative_record_time
+    = GNUNET_TIME_relative_multiply (GNUNET_DHT_DEFAULT_REPUBLISH_FREQUENCY,
+                                     PUBLISH_OPS_PER_EXPIRATION);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Zone iteration finished. Adjusted zone iteration interval to %s\n",
-              GNUNET_STRINGS_relative_time_to_string (put_interval,
+              GNUNET_STRINGS_relative_time_to_string (target_iteration_velocity_per_record,
                                                       GNUNET_YES));
   GNUNET_STATISTICS_set (statistics,
-                         "Current zone iteration interval (in ms)",
-                         put_interval.rel_value_us / 1000LL,
+                         "Target zone iteration velocity (μs)",
+                         target_iteration_velocity_per_record.rel_value_us,
                          GNUNET_NO);
-  GNUNET_STATISTICS_update (statistics,
-                            "Number of zone iterations",
-                            1,
-                            GNUNET_NO);
   GNUNET_STATISTICS_set (statistics,
                          "Number of public records in DHT",
                          last_num_public_records,
                          GNUNET_NO);
   GNUNET_assert (NULL == zone_publish_task);
-  if (0 == num_public_records)
-    zone_publish_task = GNUNET_SCHEDULER_add_delayed (put_interval,
+  if (0 == last_num_public_records)
+  {
+    zone_publish_task = GNUNET_SCHEDULER_add_delayed (target_iteration_velocity_per_record,
                                                       &publish_zone_dht_start,
                                                       NULL);
+  }
   else
+  {
     zone_publish_task = GNUNET_SCHEDULER_add_now (&publish_zone_dht_start,
                                                   NULL);
+  }
 }
 
 
@@ -532,32 +798,59 @@ put_gns_record (void *cls,
 {
   struct GNUNET_GNSRECORD_Data rd_public[rd_count];
   unsigned int rd_public_count;
+  struct DhtPutActivity *ma;
 
+  (void) cls;
+  ns_iteration_left--;
   rd_public_count = convert_records_for_export (rd,
                                                 rd_count,
                                                 rd_public);
-
   if (0 == rd_public_count)
   {
-    GNUNET_assert (NULL == zone_publish_task);
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Record set empty, moving to next record set\n");
-    zone_publish_task = GNUNET_SCHEDULER_add_now (&publish_zone_dht_next,
-                                                  NULL);
+    check_zone_namestore_next ();
     return;
   }
   /* We got a set of records to publish */
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Starting DHT PUT\n");
-  active_put = perform_dht_put (key,
-                                label,
-                                rd_public,
-                                rd_public_count,
-                                NULL);
-  if (NULL == active_put)
+  ma = GNUNET_new (struct DhtPutActivity);
+  ma->start_date = GNUNET_TIME_absolute_get ();
+  ma->ph = perform_dht_put (key,
+                            label,
+                            rd_public,
+                            rd_public_count,
+                            &dht_put_continuation,
+                            ma);
+  put_cnt++;
+  if (0 == put_cnt % DELTA_INTERVAL)
+    update_velocity (DELTA_INTERVAL);
+  check_zone_namestore_next ();
+  if (NULL == ma->ph)
   {
-    GNUNET_break (0);
-    dht_put_continuation (NULL, GNUNET_NO);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Could not perform DHT PUT, is the DHT running?\n");
+    GNUNET_free (ma);
+    return;
+  }
+  dht_queue_length++;
+  GNUNET_CONTAINER_DLL_insert_tail (it_head,
+                                    it_tail,
+                                    ma);
+  if (dht_queue_length > DHT_QUEUE_LIMIT)
+  {
+    ma = it_head;
+    GNUNET_CONTAINER_DLL_remove (it_head,
+                                 it_tail,
+                                 ma);
+    GNUNET_DHT_put_cancel (ma->ph);
+    dht_queue_length--;
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "DHT PUT unconfirmed after %s, aborting PUT\n",
+                GNUNET_STRINGS_relative_time_to_string (GNUNET_TIME_absolute_get_duration (ma->start_date),
+                                                        GNUNET_YES));
+    GNUNET_free (ma);
   }
 }
 
@@ -570,13 +863,18 @@ put_gns_record (void *cls,
 static void
 publish_zone_dht_start (void *cls)
 {
+  (void) cls;
   zone_publish_task = NULL;
-
+  GNUNET_STATISTICS_update (statistics,
+                            "Full zone iterations launched",
+                            1,
+                            GNUNET_NO);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Starting DHT zone update!\n");
   /* start counting again */
   num_public_records = 0;
   GNUNET_assert (NULL == namestore_iter);
+  ns_iteration_left = 1;
   namestore_iter
     = GNUNET_NAMESTORE_zone_iteration_start (namestore_handle,
                                              NULL, /* All zones */
@@ -586,6 +884,7 @@ publish_zone_dht_start (void *cls)
                                              NULL,
                                              &zone_iteration_finished,
                                              NULL);
+  GNUNET_assert (NULL != namestore_iter);
 }
 
 
@@ -608,8 +907,13 @@ handle_monitor_event (void *cls,
 {
   struct GNUNET_GNSRECORD_Data rd_public[rd_count];
   unsigned int rd_public_count;
-  struct MonitorActivity *ma;
+  struct DhtPutActivity *ma;
 
+  (void) cls;
+  GNUNET_STATISTICS_update (statistics,
+                            "Namestore monitor events received",
+                            1,
+                            GNUNET_NO);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received %u records for label `%s' via namestore monitor\n",
               rd_count,
@@ -621,11 +925,14 @@ handle_monitor_event (void *cls,
                                                 rd_public);
   if (0 == rd_public_count)
     return; /* nothing to do */
-  ma = GNUNET_new (struct MonitorActivity);
+  num_public_records++;
+  ma = GNUNET_new (struct DhtPutActivity);
+  ma->start_date = GNUNET_TIME_absolute_get ();
   ma->ph = perform_dht_put (zone,
                             label,
                             rd,
                             rd_count,
+                            &dht_put_monitor_continuation,
                             ma);
   if (NULL == ma->ph)
   {
@@ -633,9 +940,24 @@ handle_monitor_event (void *cls,
     GNUNET_free (ma);
     return;
   }
-  GNUNET_CONTAINER_DLL_insert (ma_head,
-                               ma_tail,
-                               ma);
+  GNUNET_CONTAINER_DLL_insert_tail (ma_head,
+                                    ma_tail,
+                                    ma);
+  ma_queue_length++;
+  if (ma_queue_length > DHT_QUEUE_LIMIT)
+  {
+    ma = ma_head;
+    GNUNET_CONTAINER_DLL_remove (ma_head,
+                                 ma_tail,
+                                 ma);
+    GNUNET_DHT_put_cancel (ma->ph);
+    ma_queue_length--;
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "DHT PUT unconfirmed after %s, aborting PUT\n",
+                GNUNET_STRINGS_relative_time_to_string (GNUNET_TIME_absolute_get_duration (ma->start_date),
+                                                        GNUNET_YES));
+    GNUNET_free (ma);
+  }
 }
 
 
@@ -648,22 +970,28 @@ handle_monitor_event (void *cls,
 static void
 monitor_sync_event (void *cls)
 {
+  (void) cls;
   if ( (NULL == zone_publish_task) &&
        (NULL == namestore_iter) )
-  zone_publish_task = GNUNET_SCHEDULER_add_now (&publish_zone_dht_start,
-                                                NULL);
+    zone_publish_task = GNUNET_SCHEDULER_add_now (&publish_zone_dht_start,
+                                                  NULL);
 }
 
 
 /**
- * The zone monitor is now in SYNC with the current state of the
- * name store.  Start to perform periodic iterations.
+ * The zone monitor encountered an IPC error trying to to get in
+ * sync. Restart from the beginning.
  *
  * @param cls NULL
  */
 static void
 handle_monitor_error (void *cls)
 {
+  (void) cls;
+  GNUNET_STATISTICS_update (statistics,
+                            "Namestore monitor errors encountered",
+                            1,
+                            GNUNET_NO);
   if (NULL != zone_publish_task)
   {
     GNUNET_SCHEDULER_cancel (zone_publish_task);
@@ -698,7 +1026,13 @@ run (void *cls,
 {
   unsigned long long max_parallel_bg_queries = 128;
 
-  min_relative_record_time = GNUNET_TIME_UNIT_FOREVER_REL;
+  (void) cls;
+  (void) service;
+  last_put_100 = GNUNET_TIME_absolute_get (); /* first time! */
+  min_relative_record_time
+    = GNUNET_TIME_relative_multiply (GNUNET_DHT_DEFAULT_REPUBLISH_FREQUENCY,
+                                     PUBLISH_OPS_PER_EXPIRATION);
+  target_iteration_velocity_per_record = INITIAL_ZONE_ITERATION_INTERVAL;
   namestore_handle = GNUNET_NAMESTORE_connect (c);
   if (NULL == namestore_handle)
   {
@@ -707,8 +1041,9 @@ run (void *cls,
     GNUNET_SCHEDULER_shutdown ();
     return;
   }
-
-  put_interval = INITIAL_PUT_INTERVAL;
+  cache_keys = GNUNET_CONFIGURATION_get_value_yesno (c,
+                                                     "namestore",
+                                                     "CACHE_KEYS");
   zone_publish_time_window_default = DEFAULT_ZONE_PUBLISH_TIME_WINDOW;
   if (GNUNET_OK ==
       GNUNET_CONFIGURATION_get_value_time (c,
@@ -733,20 +1068,26 @@ run (void *cls,
                 max_parallel_bg_queries);
   }
   if (0 == max_parallel_bg_queries)
-    max_parallel_bg_queries = 1;          
+    max_parallel_bg_queries = 1;
   dht_handle = GNUNET_DHT_connect (c,
                                    (unsigned int) max_parallel_bg_queries);
   if (NULL == dht_handle)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 _("Could not connect to DHT!\n"));
-    GNUNET_SCHEDULER_add_now (&shutdown_task, NULL);
+    GNUNET_SCHEDULER_add_now (&shutdown_task,
+                              NULL);
     return;
   }
 
   /* Schedule periodic put for our records. */
-  first_zone_iteration = GNUNET_YES;\
-  statistics = GNUNET_STATISTICS_create ("zonemaster", c);
+  first_zone_iteration = GNUNET_YES;
+  statistics = GNUNET_STATISTICS_create ("zonemaster",
+                                         c);
+  GNUNET_STATISTICS_set (statistics,
+                         "Target zone iteration velocity (μs)",
+                         target_iteration_velocity_per_record.rel_value_us,
+                         GNUNET_NO);
   zmon = GNUNET_NAMESTORE_zone_monitor_start (c,
                                               NULL,
                                               GNUNET_NO,
@@ -757,7 +1098,8 @@ run (void *cls,
                                               &monitor_sync_event,
                                               NULL);
   GNUNET_break (NULL != zmon);
-  GNUNET_SCHEDULER_add_shutdown (&shutdown_task, NULL);
+  GNUNET_SCHEDULER_add_shutdown (&shutdown_task,
+                                 NULL);
 }