76 files changed, 4633 insertions, 2113 deletions

diff --git a/src/credential/gnunet-service-credential.c b/src/credential/gnunet-service-credential.c
index a2c339363..399371a2e 100644
--- a/src/credential/gnunet-service-credential.c
+++ b/src/credential/gnunet-service-credential.c
@@ -961,9 +961,11 @@ collect_next (void *cls)
   struct VerifyRequestHandle *vrh = cls;
   vrh->collect_next_task = NULL;
   GNUNET_assert (NULL != vrh->cred_collection_iter);
-  GNUNET_NAMESTORE_zone_iterator_next (vrh->cred_collection_iter);
+  GNUNET_NAMESTORE_zone_iterator_next (vrh->cred_collection_iter,
+                                       1);
 }
 
+
 static void
 handle_cred_collection_cb (void *cls,
                            const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
diff --git a/src/dht/dht.h b/src/dht/dht.h
index 4c994f93a..95ffa33ca 100644
--- a/src/dht/dht.h
+++ b/src/dht/dht.h
@@ -214,11 +214,6 @@ struct GNUNET_DHT_ClientPutMessage
   uint32_t desired_replication_level GNUNET_PACKED;
 
   /**
-   * Unique ID for the PUT message.
-   */
-  uint64_t unique_id GNUNET_PACKED;
-
-  /**
    * How long should this data persist?
    */
   struct GNUNET_TIME_AbsoluteNBO expiration;
@@ -234,30 +229,6 @@ struct GNUNET_DHT_ClientPutMessage
 
 
 /**
- * Message to confirming receipt of PUT, sent from DHT service to clients.
- */
-struct GNUNET_DHT_ClientPutConfirmationMessage
-{
-  /**
-   * Type: #GNUNET_MESSAGE_TYPE_DHT_CLIENT_PUT_OK
-   */
-  struct GNUNET_MessageHeader header;
-
-  /**
-   * Always zero.
-   */
-  uint32_t reserved GNUNET_PACKED;
-
-  /**
-   * Unique ID from the PUT message that is being confirmed.
-   */
-  uint64_t unique_id GNUNET_PACKED;
-
-};
-
-
-
-/**
  * Message to monitor put requests going through peer, DHT service -> clients.
  */
 struct GNUNET_DHT_MonitorPutMessage
diff --git a/src/dht/dht_api.c b/src/dht/dht_api.c
index 42ddc7b60..af0dafbf3 100644
--- a/src/dht/dht_api.c
+++ b/src/dht/dht_api.c
@@ -55,7 +55,7 @@ struct GNUNET_DHT_PutHandle
   /**
    * Continuation to call when done.
    */
-  GNUNET_DHT_PutContinuation cont;
+  GNUNET_SCHEDULER_TaskCallback cont;
 
   /**
    * Main handle to this DHT api
@@ -68,9 +68,9 @@ struct GNUNET_DHT_PutHandle
   void *cont_cls;
 
   /**
-   * Unique ID for the PUT operation.
+   * Envelope from the PUT operation.
    */
-  uint64_t unique_id;
+  struct GNUNET_MQ_Envelope *env;
 
 };
 
@@ -440,7 +440,7 @@ static void
 do_disconnect (struct GNUNET_DHT_Handle *h)
 {
   struct GNUNET_DHT_PutHandle *ph;
-  GNUNET_DHT_PutContinuation cont;
+  GNUNET_SCHEDULER_TaskCallback cont;
   void *cont_cls;
 
   if (NULL == h->mq)
@@ -456,10 +456,10 @@ do_disconnect (struct GNUNET_DHT_Handle *h)
   {
     cont = ph->cont;
     cont_cls = ph->cont_cls;
+    ph->env = NULL;
     GNUNET_DHT_put_cancel (ph);
     if (NULL != cont)
-      cont (cont_cls,
-            GNUNET_SYSERR);
+      cont (cont_cls);
   }
   GNUNET_assert (NULL == h->reconnect_task);
   h->reconnect_task
@@ -818,31 +818,23 @@ handle_client_result (void *cls,
 
 
 /**
- * Process a put confirmation message from the service.
+ * Process a MQ PUT transmission notification.
  *
  * @param cls The DHT handle.
- * @param msg confirmation message from the service.
  */
 static void
-handle_put_confirmation (void *cls,
-                         const struct GNUNET_DHT_ClientPutConfirmationMessage *msg)
+handle_put_cont (void *cls)
 {
-  struct GNUNET_DHT_Handle *handle = cls;
-  struct GNUNET_DHT_PutHandle *ph;
-  GNUNET_DHT_PutContinuation cont;
+  struct GNUNET_DHT_PutHandle *ph = cls;
+  GNUNET_SCHEDULER_TaskCallback cont;
   void *cont_cls;
 
-  for (ph = handle->put_head; NULL != ph; ph = ph->next)
-    if (ph->unique_id == msg->unique_id)
-      break;
-  if (NULL == ph)
-    return;
   cont = ph->cont;
   cont_cls = ph->cont_cls;
+  ph->env = NULL;
   GNUNET_DHT_put_cancel (ph);
   if (NULL != cont)
-    cont (cont_cls,
-          GNUNET_OK);
+    cont (cont_cls);
 }
 
 
@@ -872,10 +864,6 @@ try_connect (struct GNUNET_DHT_Handle *h)
                            GNUNET_MESSAGE_TYPE_DHT_CLIENT_RESULT,
                            struct GNUNET_DHT_ClientResultMessage,
                            h),
-    GNUNET_MQ_hd_fixed_size (put_confirmation,
-                             GNUNET_MESSAGE_TYPE_DHT_CLIENT_PUT_OK,
-                             struct GNUNET_DHT_ClientPutConfirmationMessage,
-                             h),
     GNUNET_MQ_handler_end ()
   };
   if (NULL != h->mq)
@@ -941,8 +929,7 @@ GNUNET_DHT_disconnect (struct GNUNET_DHT_Handle *handle)
   while (NULL != (ph = handle->put_head))
   {
     if (NULL != ph->cont)
-      ph->cont (ph->cont_cls,
-                GNUNET_SYSERR);
+      ph->cont (ph->cont_cls);
     GNUNET_DHT_put_cancel (ph);
   }
   if (NULL != handle->mq)
@@ -989,7 +976,7 @@ GNUNET_DHT_put (struct GNUNET_DHT_Handle *handle,
                 size_t size,
                 const void *data,
                 struct GNUNET_TIME_Absolute exp,
-                GNUNET_DHT_PutContinuation cont,
+                GNUNET_SCHEDULER_TaskCallback cont,
                 void *cont_cls)
 {
   struct GNUNET_MQ_Envelope *env;
@@ -1014,22 +1001,24 @@ GNUNET_DHT_put (struct GNUNET_DHT_Handle *handle,
   ph->dht_handle = handle;
   ph->cont = cont;
   ph->cont_cls = cont_cls;
-  ph->unique_id = ++handle->uid_gen;
   GNUNET_CONTAINER_DLL_insert_tail (handle->put_head,
                                     handle->put_tail,
                                     ph);
   env = GNUNET_MQ_msg_extra (put_msg,
                              size,
                              GNUNET_MESSAGE_TYPE_DHT_CLIENT_PUT);
+  GNUNET_MQ_notify_sent (env,
+                         &handle_put_cont,
+                         ph);
+  ph->env = env;
   put_msg->type = htonl ((uint32_t) type);
   put_msg->options = htonl ((uint32_t) options);
   put_msg->desired_replication_level = htonl (desired_replication_level);
-  put_msg->unique_id = ph->unique_id;
   put_msg->expiration = GNUNET_TIME_absolute_hton (exp);
   put_msg->key = *key;
   GNUNET_memcpy (&put_msg[1],
-          data,
-          size);
+                 data,
+                 size);
   GNUNET_MQ_send (handle->mq,
                   env);
   return ph;
@@ -1052,6 +1041,10 @@ GNUNET_DHT_put_cancel (struct GNUNET_DHT_PutHandle *ph)
 {
   struct GNUNET_DHT_Handle *handle = ph->dht_handle;
 
+  if (NULL != ph->env)
+    GNUNET_MQ_notify_sent (ph->env,
+                           NULL,
+                           NULL);
   GNUNET_CONTAINER_DLL_remove (handle->put_head,
                                handle->put_tail,
                                ph);
diff --git a/src/dht/dht_test_lib.c b/src/dht/dht_test_lib.c
index 4c1bd3057..52d5a3731 100644
--- a/src/dht/dht_test_lib.c
+++ b/src/dht/dht_test_lib.c
@@ -114,7 +114,6 @@ dht_connect_cb (void *cls,
                 const char *emsg)
 {
   struct GNUNET_DHT_TEST_Context *ctx = cls;
-  unsigned int i;
 
   if (NULL != emsg)
   {
@@ -124,10 +123,10 @@ dht_connect_cb (void *cls,
     GNUNET_SCHEDULER_shutdown ();
     return;
   }
-  for (i=0;i<ctx->num_peers;i++)
+  for (unsigned int i=0;i<ctx->num_peers;i++)
     if (op == ctx->ops[i])
       ctx->dhts[i] = ca_result;
-  for (i=0;i<ctx->num_peers;i++)
+  for (unsigned int i=0;i<ctx->num_peers;i++)
     if (NULL == ctx->dhts[i])
       return; /* still some DHT connections missing */
   /* all DHT connections ready! */
@@ -147,9 +146,7 @@ dht_connect_cb (void *cls,
 void
 GNUNET_DHT_TEST_cleanup (struct GNUNET_DHT_TEST_Context *ctx)
 {
-  unsigned int i;
-
-  for (i=0;i<ctx->num_peers;i++)
+  for (unsigned int i=0;i<ctx->num_peers;i++)
     GNUNET_TESTBED_operation_done (ctx->ops[i]);
   GNUNET_free (ctx->ops);
   GNUNET_free (ctx->dhts);
@@ -160,18 +157,17 @@ GNUNET_DHT_TEST_cleanup (struct GNUNET_DHT_TEST_Context *ctx)
 
 static void
 dht_test_run (void *cls,
-             struct GNUNET_TESTBED_RunHandle *h,
+              struct GNUNET_TESTBED_RunHandle *h,
               unsigned int num_peers,
               struct GNUNET_TESTBED_Peer **peers,
               unsigned int links_succeeded,
               unsigned int links_failed)
 {
   struct GNUNET_DHT_TEST_Context *ctx = cls;
-  unsigned int i;
 
   GNUNET_assert (num_peers == ctx->num_peers);
   ctx->peers = peers;
-  for (i=0;i<num_peers;i++)
+  for (unsigned int i=0;i<num_peers;i++)
     ctx->ops[i] = GNUNET_TESTBED_service_connect (ctx,
                                                   peers[i],
                                                   "dht",
diff --git a/src/dht/gnunet-dht-put.c b/src/dht/gnunet-dht-put.c
index f183fe588..db4d04681 100644
--- a/src/dht/gnunet-dht-put.c
+++ b/src/dht/gnunet-dht-put.c
@@ -103,34 +103,12 @@ shutdown_task (void *cls)
  * Signature of the main function of a task.
  *
  * @param cls closure
- * @param success #GNUNET_OK if the PUT was transmitted,
- *                #GNUNET_NO on timeout,
- *                #GNUNET_SYSERR on disconnect from service
- *                after the PUT message was transmitted
- *                (so we don't know if it was received or not)
  */
 static void
-message_sent_cont (void *cls, int success)
+message_sent_cont (void *cls)
 {
-  if (verbose)
-  {
-    switch (success)
-    {
-    case GNUNET_OK:
-      FPRINTF (stderr, "%s `%s'!\n",  _("PUT request sent with key"), GNUNET_h2s_full(&key));
-      break;
-    case GNUNET_NO:
-      FPRINTF (stderr, "%s",  _("Timeout sending PUT request!\n"));
-      break;
-    case GNUNET_SYSERR:
-      FPRINTF (stderr, "%s",  _("PUT request not confirmed!\n"));
-      break;
-    default:
-      GNUNET_break (0);
-      break;
-    }
-  }
-  GNUNET_SCHEDULER_add_now (&shutdown_task, NULL);
+  GNUNET_SCHEDULER_add_now (&shutdown_task,
+                            NULL);
 }
 
 
@@ -160,7 +138,8 @@ run (void *cls,
 
   if (NULL == (dht_handle = GNUNET_DHT_connect (cfg, 1)))
   {
-    FPRINTF (stderr, _("Could not connect to %s service!\n"), "DHT");
+    FPRINTF (stderr,
+             _("Could not connect to DHT service!\n"));
     ret = 1;
     return;
   }
@@ -203,55 +182,47 @@ main (int argc, char *const *argv)
 {
 
   struct GNUNET_GETOPT_CommandLineOption options[] = {
-  
     GNUNET_GETOPT_option_string ('d',
                                  "data",
                                  "DATA",
                                  gettext_noop ("the data to insert under the key"),
                                  &data),
-  
     GNUNET_GETOPT_option_relative_time ('e',
-                                            "expiration",
-                                            "EXPIRATION",
-                                            gettext_noop ("how long to store this entry in the dht (in seconds)"),
-                                            &expiration),
-  
+                                        "expiration",
+                                        "EXPIRATION",
+                                        gettext_noop ("how long to store this entry in the dht (in seconds)"),
+                                        &expiration),
     GNUNET_GETOPT_option_string ('k',
                                  "key",
                                  "KEY",
                                  gettext_noop ("the query key"),
                                  &query_key),
-  
     GNUNET_GETOPT_option_flag ('x',
-                                  "demultiplex",
-                                  gettext_noop ("use DHT's demultiplex everywhere option"),
-                                  &demultixplex_everywhere),
-  
+                               "demultiplex",
+                               gettext_noop ("use DHT's demultiplex everywhere option"),
+                               &demultixplex_everywhere),
     GNUNET_GETOPT_option_uint ('r',
-                                   "replication",
-                                   "LEVEL",
-                                   gettext_noop ("how many replicas to create"),
-                                   &replication),
-  
+                               "replication",
+                               "LEVEL",
+                               gettext_noop ("how many replicas to create"),
+                               &replication),
     GNUNET_GETOPT_option_flag ('R',
-                                  "record",
-                                  gettext_noop ("use DHT's record route option"),
-                                  &record_route),
-  
+                               "record",
+                               gettext_noop ("use DHT's record route option"),
+                               &record_route),
     GNUNET_GETOPT_option_uint ('t',
-                                   "type",
-                                   "TYPE",
-                                   gettext_noop ("the type to insert data as"),
-                                   &query_type),
-  
+                               "type",
+                               "TYPE",
+                               gettext_noop ("the type to insert data as"),
+                               &query_type),
     GNUNET_GETOPT_option_verbose (&verbose),
-  
     GNUNET_GETOPT_OPTION_END
   };
 
 
-  if (GNUNET_OK != GNUNET_STRINGS_get_utf8_args (argc, argv,
-                                                 &argc, &argv))
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_get_utf8_args (argc, argv,
+                                    &argc, &argv))
     return 2;
   expiration = GNUNET_TIME_UNIT_HOURS;
   return (GNUNET_OK ==
diff --git a/src/dht/gnunet-service-dht_clients.c b/src/dht/gnunet-service-dht_clients.c
index cb155c484..503d7867b 100644
--- a/src/dht/gnunet-service-dht_clients.c
+++ b/src/dht/gnunet-service-dht_clients.c
@@ -477,8 +477,6 @@ handle_dht_local_put (void *cls,
   struct ClientHandle *ch = cls;
   struct GNUNET_CONTAINER_BloomFilter *peer_bf;
   uint16_t size;
-  struct GNUNET_MQ_Envelope *env;
-  struct GNUNET_DHT_ClientPutConfirmationMessage *conf;
 
   size = ntohs (dht_msg->header.size);
   GNUNET_STATISTICS_update (GDS_stats,
@@ -537,12 +535,6 @@ handle_dht_local_put (void *cls,
                            &dht_msg[1],
                            size - sizeof (struct GNUNET_DHT_ClientPutMessage));
   GNUNET_CONTAINER_bloomfilter_free (peer_bf);
-  env = GNUNET_MQ_msg (conf,
-                       GNUNET_MESSAGE_TYPE_DHT_CLIENT_PUT_OK);
-  conf->reserved = htonl (0);
-  conf->unique_id = dht_msg->unique_id;
-  GNUNET_MQ_send (ch->mq,
-                  env);
   GNUNET_SERVICE_client_continue (ch->client);
 }
 
diff --git a/src/dht/test_dht_api.c b/src/dht/test_dht_api.c
index 8f4e0ed31..62d121306 100644
--- a/src/dht/test_dht_api.c
+++ b/src/dht/test_dht_api.c
@@ -105,11 +105,9 @@ test_get_iterator (void *cls,
  * Signature of the main function of a task.
  *
  * @param cls closure
- * @param success result of PUT
  */
 static void
-test_get (void *cls,
-          int success)
+test_get (void *cls)
 {
   struct GNUNET_HashCode hash;
 
diff --git a/src/dht/test_dht_topo.c b/src/dht/test_dht_topo.c
index 8be3064f7..79edb2b0c 100644
--- a/src/dht/test_dht_topo.c
+++ b/src/dht/test_dht_topo.c
@@ -332,19 +332,17 @@ dht_get_handler (void *cls,
               "Get successful\n");
 #if 0
   {
-    int i;
-
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "PATH: (get %u, put %u)\n",
                 get_path_length,
                 put_path_length);
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "  LOCAL\n");
-    for (i = get_path_length - 1; i >= 0; i--)
+    for (int i = get_path_length - 1; i >= 0; i--)
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                   "  %s\n",
                   GNUNET_i2s (&get_path[i]));
-    for (i = put_path_length - 1; i >= 0; i--)
+    for (int i = put_path_length - 1; i >= 0; i--)
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                   "  %s\n",
                   GNUNET_i2s (&put_path[i]));
@@ -384,12 +382,11 @@ do_puts (void *cls)
   struct GNUNET_DHT_Handle **hs = cls;
   struct GNUNET_HashCode key;
   struct GNUNET_HashCode value;
-  unsigned int i;
 
   put_task = NULL;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Putting values into DHT\n");
-  for (i = 0; i < NUM_PEERS; i++)
+  for (unsigned int i = 0; i < NUM_PEERS; i++)
   {
     GNUNET_CRYPTO_hash (&i,
                         sizeof (i),
diff --git a/src/dns/dnsstub.c b/src/dns/dnsstub.c
index 6aa2d7b8f..6eb3612c2 100644
--- a/src/dns/dnsstub.c
+++ b/src/dns/dnsstub.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2012 GNUnet e.V.
+     Copyright (C) 2012, 2018 GNUnet e.V.
 
      GNUnet is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
@@ -28,20 +28,15 @@
 #include "gnunet_dnsstub_lib.h"
 
 /**
- * Timeout for an external (Internet-DNS) DNS resolution
- */
-#define REQUEST_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 5)
-
-/**
  * Timeout for retrying DNS queries.
  */
 #define DNS_RETRANSMIT_DELAY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MILLISECONDS, 250)
 
+
 /**
- * How many DNS sockets do we open at most at the same time?
- * (technical socket maximum is this number x2 for IPv4+IPv6)
+ * DNS Server used for resolution.
  */
-#define DNS_SOCKET_MAX 128
+struct DnsServer;
 
 
 /**
@@ -81,19 +76,14 @@ struct GNUNET_DNSSTUB_RequestSocket
   struct GNUNET_SCHEDULER_Task *retry_task;
 
   /**
-   * When should this request time out?
-   */
-  struct GNUNET_TIME_Absolute timeout;
-
-  /**
-   * Address we sent the DNS request to.
+   * Next address we sent the DNS request to.
    */
-  struct sockaddr_storage addr;
+  struct DnsServer *ds_pos;
 
   /**
-   * Number of bytes in @e addr.
+   * Context this request executes in.
    */
-  socklen_t addrlen;
+  struct GNUNET_DNSSTUB_Context *ctx;
 
   /**
    * Query we sent to @e addr.
@@ -109,6 +99,29 @@ struct GNUNET_DNSSTUB_RequestSocket
 
 
 /**
+ * DNS Server used for resolution.
+ */
+struct DnsServer
+{
+
+  /**
+   * Kept in a DLL.
+   */
+  struct DnsServer *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct DnsServer *prev;
+
+  /**
+   * IP address of the DNS resolver.
+   */
+  struct sockaddr_storage ss;
+};
+
+
+/**
  * Handle to the stub resolver.
  */
 struct GNUNET_DNSSTUB_Context
@@ -117,13 +130,28 @@ struct GNUNET_DNSSTUB_Context
   /**
    * Array of all open sockets for DNS requests.
    */
-  struct GNUNET_DNSSTUB_RequestSocket sockets[DNS_SOCKET_MAX];
+  struct GNUNET_DNSSTUB_RequestSocket *sockets;
+
+  /**
+   * DLL of DNS resolvers we use.
+   */
+  struct DnsServer *dns_head;
+
+  /**
+   * DLL of DNS resolvers we use.
+   */
+  struct DnsServer *dns_tail;
+
+  /**
+   * How frequently do we retry requests?
+   */
+  struct GNUNET_TIME_Relative retry_freq;
 
   /**
-   * IP address to use for the DNS server if we are a DNS exit service
-   * (for VPN via cadet); otherwise NULL.
+   * Length of @e sockets array.
    */
-  char *dns_exit;
+  unsigned int num_sockets;
+
 };
 
 
@@ -212,33 +240,21 @@ open_socket (int af)
 
 
 /**
- * Read a DNS response from the (unhindered) UDP-Socket
- *
- * @param cls socket to read from
- */
-static void
-read_response (void *cls);
-
-
-/**
  * Get a socket of the specified address family to send out a
  * UDP DNS request to the Internet.
  *
  * @param ctx the DNSSTUB context
- * @param af desired address family
- * @return NULL on error (given AF not "supported")
+ * @return NULL on error
  */
 static struct GNUNET_DNSSTUB_RequestSocket *
-get_request_socket (struct GNUNET_DNSSTUB_Context *ctx,
-                    int af)
+get_request_socket (struct GNUNET_DNSSTUB_Context *ctx)
 {
   struct GNUNET_DNSSTUB_RequestSocket *rs;
-  struct GNUNET_NETWORK_FDSet *rset;
 
   for (unsigned int i=0;i<256;i++)
   {
     rs = &ctx->sockets[GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE,
-                                                 DNS_SOCKET_MAX)];
+                                                 ctx->num_sockets)];
     if (NULL == rs->rc)
       break;
   }
@@ -246,25 +262,10 @@ get_request_socket (struct GNUNET_DNSSTUB_Context *ctx,
   {
     /* signal "failure" */
     rs->rc (rs->rc_cls,
-            rs,
             NULL,
             0);
     rs->rc = NULL;
   }
-  rs->timeout = GNUNET_TIME_relative_to_absolute (REQUEST_TIMEOUT);
-  switch (af)
-  {
-  case AF_INET:
-    if (NULL == rs->dnsout4)
-      rs->dnsout4 = open_socket (AF_INET);
-    break;
-  case AF_INET6:
-    if (NULL == rs->dnsout6)
-      rs->dnsout6 = open_socket (AF_INET6);
-    break;
-  default:
-    return NULL;
-  }
   if (NULL != rs->read_task)
   {
     GNUNET_SCHEDULER_cancel (rs->read_task);
@@ -280,194 +281,7 @@ get_request_socket (struct GNUNET_DNSSTUB_Context *ctx,
     GNUNET_free (rs->request);
     rs->request = NULL;
   }
-  if ( (NULL == rs->dnsout4) &&
-       (NULL == rs->dnsout6) )
-    return NULL;
-  rset = GNUNET_NETWORK_fdset_create ();
-  if (NULL != rs->dnsout4)
-    GNUNET_NETWORK_fdset_set (rset,
-                              rs->dnsout4);
-  if (NULL != rs->dnsout6)
-    GNUNET_NETWORK_fdset_set (rset,
-                              rs->dnsout6);
-  rs->read_task = GNUNET_SCHEDULER_add_select (GNUNET_SCHEDULER_PRIORITY_DEFAULT,
-                                               REQUEST_TIMEOUT,
-                                               rset,
-                                               NULL,
-                                               &read_response,
-                                               rs);
-  GNUNET_NETWORK_fdset_destroy (rset);
-  return rs;
-}
-
-
-/**
- * Task to (re)transmit the DNS query, possibly repeatedly until
- * we succeed.
- *
- * @param cls our `struct GNUNET_DNSSTUB_RequestSocket *`
- */
-static void
-transmit_query (void *cls)
-{
-  struct GNUNET_DNSSTUB_RequestSocket *rs = cls;
-  struct GNUNET_NETWORK_Handle *ret;
-
-  rs->retry_task = NULL;
-  ret = (NULL != rs->dnsout4) ? rs->dnsout4 : rs->dnsout6;
-  GNUNET_assert (NULL != ret);
-  if (GNUNET_SYSERR ==
-      GNUNET_NETWORK_socket_sendto (ret,
-                                    rs->request,
-                                    rs->request_len,
-                                    (struct sockaddr *) &rs->addr,
-                                    rs->addrlen))
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                _("Failed to send DNS request to %s\n"),
-                GNUNET_a2s ((struct sockaddr *) &rs->addr,
-                            rs->addrlen));
-  else
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                _("Sent DNS request to %s\n"),
-                GNUNET_a2s ((struct sockaddr *) &rs->addr,
-                            rs->addrlen));
-  rs->retry_task = GNUNET_SCHEDULER_add_delayed (DNS_RETRANSMIT_DELAY,
-                                                 &transmit_query,
-                                                 rs);
-}
-
-
-/**
- * Perform DNS resolution.
- *
- * @param ctx stub resolver to use
- * @param sa the socket address
- * @param sa_len the length of @a sa
- * @param request DNS request to transmit
- * @param request_len number of bytes in @a request
- * @param rc function to call with result
- * @param rc_cls closure for @a rc
- * @return socket used for the request, NULL on error
- */
-struct GNUNET_DNSSTUB_RequestSocket *
-GNUNET_DNSSTUB_resolve (struct GNUNET_DNSSTUB_Context *ctx,
-                        const struct sockaddr *sa,
-                        socklen_t sa_len,
-                        const void *request,
-                        size_t request_len,
-                        GNUNET_DNSSTUB_ResultCallback rc,
-                        void *rc_cls)
-{
-  struct GNUNET_DNSSTUB_RequestSocket *rs;
-
-  if (NULL == (rs = get_request_socket (ctx,
-                                        sa->sa_family)))
-    return NULL;
-  GNUNET_assert (NULL == rs->rc);
-  GNUNET_memcpy (&rs->addr,
-                 sa,
-                 sa_len);
-  rs->addrlen = sa_len;
-  rs->rc = rc;
-  rs->rc_cls = rc_cls;
-  rs->request = GNUNET_memdup (request,
-                               request_len);
-  rs->request_len = request_len;
-  rs->retry_task = GNUNET_SCHEDULER_add_now (&transmit_query,
-                                             rs);
-  return rs;
-}
-
-
-/**
- * Perform DNS resolution using our default IP from init.
- *
- * @param ctx stub resolver to use
- * @param request DNS request to transmit
- * @param request_len number of bytes in msg
- * @param rc function to call with result
- * @param rc_cls closure for 'rc'
- * @return socket used for the request, NULL on error
- */
-struct GNUNET_DNSSTUB_RequestSocket *
-GNUNET_DNSSTUB_resolve2 (struct GNUNET_DNSSTUB_Context *ctx,
-                         const void *request,
-                         size_t request_len,
-                         GNUNET_DNSSTUB_ResultCallback rc,
-                         void *rc_cls)
-{
-  int af;
-  struct sockaddr_in v4;
-  struct sockaddr_in6 v6;
-  struct sockaddr *sa;
-  socklen_t salen;
-  struct GNUNET_NETWORK_Handle *dnsout;
-  struct GNUNET_DNSSTUB_RequestSocket *rs;
-
-  memset (&v4, 0, sizeof (v4));
-  memset (&v6, 0, sizeof (v6));
-  if (1 == inet_pton (AF_INET,
-                      ctx->dns_exit,
-                      &v4.sin_addr))
-  {
-    salen = sizeof (v4);
-    v4.sin_family = AF_INET;
-    v4.sin_port = htons (53);
-#if HAVE_SOCKADDR_IN_SIN_LEN
-    v4.sin_len = (u_char) salen;
-#endif
-    sa = (struct sockaddr *) &v4;
-    af = AF_INET;
-  }
-  else if (1 == inet_pton (AF_INET6,
-                           ctx->dns_exit,
-                           &v6.sin6_addr))
-  {
-    salen = sizeof (v6);
-    v6.sin6_family = AF_INET6;
-    v6.sin6_port = htons (53);
-#if HAVE_SOCKADDR_IN_SIN_LEN
-    v6.sin6_len = (u_char) salen;
-#endif
-    sa = (struct sockaddr *) &v6;
-    af = AF_INET6;
-  }
-  else
-  {
-    GNUNET_break (0);
-    return NULL;
-  }
-  if (NULL == (rs = get_request_socket (ctx,
-                                        af)))
-    return NULL;
-  GNUNET_assert (NULL == rs->rc);
-  if (NULL != rs->dnsout4)
-    dnsout = rs->dnsout4;
-  else
-    dnsout = rs->dnsout6;
-  if (NULL == dnsout)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                _("Configured DNS exit `%s' is not working / valid.\n"),
-                ctx->dns_exit);
-    return NULL;
-  }
-  GNUNET_memcpy (&rs->addr,
-                 sa,
-                 salen);
-  rs->addrlen = salen;
-  rs->rc = rc;
-  rs->rc_cls = rc_cls;
-  if (GNUNET_SYSERR ==
-      GNUNET_NETWORK_socket_sendto (dnsout,
-                                    request,
-                                    request_len,
-                                    sa,
-                                    salen))
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                _("Failed to send DNS request to %s\n"),
-                GNUNET_a2s (sa, salen));
-  rs->timeout = GNUNET_TIME_relative_to_absolute (REQUEST_TIMEOUT);
+  rs->ctx = ctx;
   return rs;
 }
 
@@ -484,9 +298,7 @@ static int
 do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
              struct GNUNET_NETWORK_Handle *dnsout)
 {
-  struct sockaddr_storage addr;
-  socklen_t addrlen;
-  struct GNUNET_TUN_DnsHeader *dns;
+  struct GNUNET_DNSSTUB_Context *ctx = rs->ctx;
   ssize_t r;
   int len;
 
@@ -507,9 +319,15 @@ do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
               len);
   {
     unsigned char buf[len] GNUNET_ALIGN;
+    int found;
+    struct sockaddr_storage addr;
+    socklen_t addrlen;
+    struct GNUNET_TUN_DnsHeader *dns;
 
     addrlen = sizeof (addr);
-    memset (&addr, 0, sizeof (addr));
+    memset (&addr,
+            0,
+            sizeof (addr));
     r = GNUNET_NETWORK_socket_recvfrom (dnsout,
                                         buf,
                                         sizeof (buf),
@@ -522,6 +340,24 @@ do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
       GNUNET_NETWORK_socket_close (dnsout);
       return GNUNET_SYSERR;
     }
+    found = GNUNET_NO;
+    for (struct DnsServer *ds = ctx->dns_head; NULL != ds; ds = ds->next)
+    {
+      if (0 == memcmp (&addr,
+                       &ds->ss,
+                       GNUNET_MIN (sizeof (struct sockaddr_storage),
+                                   addrlen)))
+      {
+        found = GNUNET_YES;
+        break;
+      }
+    }
+    if (GNUNET_NO == found)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Received DNS response from server we never asked (ignored)");
+      return GNUNET_NO;
+    }
     if (sizeof (struct GNUNET_TUN_DnsHeader) > r)
     {
       GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
@@ -530,22 +366,15 @@ do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
       return GNUNET_NO;
     }
     dns = (struct GNUNET_TUN_DnsHeader *) buf;
-    if ( (addrlen != rs->addrlen) ||
-         (GNUNET_YES !=
-          GNUNET_TUN_sockaddr_cmp ((struct sockaddr *) &rs->addr,
-                                   (struct sockaddr *) &addr,
-                                   GNUNET_YES)) ||
-       (0 == GNUNET_TIME_absolute_get_remaining (rs->timeout).rel_value_us) )
+    if (NULL == rs->rc)
     {
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Request timeout or invalid sender address; ignoring reply\n");
+                  "Request timeout or cancelled; ignoring reply\n");
       return GNUNET_NO;
     }
-    if (NULL != rs->rc)
-      rs->rc (rs->rc_cls,
-              rs,
-              dns,
-              r);
+    rs->rc (rs->rc_cls,
+            dns,
+            r);
   }
   return GNUNET_OK;
 }
@@ -557,44 +386,21 @@ do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
  * @param cls socket to read from
  */
 static void
-read_response (void *cls)
+read_response (void *cls);
+
+
+/**
+ * Schedule #read_response() task for @a rs.
+ *
+ * @param rs request to schedule read operation for
+ */
+static void
+schedule_read (struct GNUNET_DNSSTUB_RequestSocket *rs)
 {
-  struct GNUNET_DNSSTUB_RequestSocket *rs = cls;
   struct GNUNET_NETWORK_FDSet *rset;
-  const struct GNUNET_SCHEDULER_TaskContext *tc;
-
-  rs->read_task = NULL;
-  tc = GNUNET_SCHEDULER_get_task_context ();
-  if (0 == (tc->reason & GNUNET_SCHEDULER_REASON_READ_READY))
-  {
-    /* signal "failure" (from timeout) */
-    if (NULL != rs->rc)
-    {
-      rs->rc (rs->rc_cls,
-              rs,
-              NULL,
-              0);
-      rs->rc = NULL;
-    }
-    /* timeout */
-    cleanup_rs (rs);
-    return;
-  }
-  /* read and process ready sockets */
-  if ((NULL != rs->dnsout4) &&
-      (GNUNET_NETWORK_fdset_isset (tc->read_ready,
-                                   rs->dnsout4)) &&
-      (GNUNET_SYSERR == do_dns_read (rs,
-                                     rs->dnsout4)))
-    rs->dnsout4 = NULL;
-  if ((NULL != rs->dnsout6) &&
-      (GNUNET_NETWORK_fdset_isset (tc->read_ready,
-                                   rs->dnsout6)) &&
-      (GNUNET_SYSERR == do_dns_read (rs,
-                                     rs->dnsout6)))
-    rs->dnsout6 = NULL;
 
-  /* re-schedule read task */
+  if (NULL != rs->read_task)
+    GNUNET_SCHEDULER_cancel (rs->read_task);
   rset = GNUNET_NETWORK_fdset_create ();
   if (NULL != rs->dnsout4)
     GNUNET_NETWORK_fdset_set (rset,
@@ -603,7 +409,7 @@ read_response (void *cls)
     GNUNET_NETWORK_fdset_set (rset,
                               rs->dnsout6);
   rs->read_task = GNUNET_SCHEDULER_add_select (GNUNET_SCHEDULER_PRIORITY_DEFAULT,
-                                               GNUNET_TIME_absolute_get_remaining (rs->timeout),
+                                               GNUNET_TIME_UNIT_FOREVER_REL,
                                                rset,
                                                NULL,
                                                &read_response,
@@ -613,6 +419,151 @@ read_response (void *cls)
 
 
 /**
+ * Read a DNS response from the (unhindered) UDP-Socket
+ *
+ * @param cls `struct GNUNET_DNSSTUB_RequestSocket` to read from
+ */
+static void
+read_response (void *cls)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs = cls;
+  const struct GNUNET_SCHEDULER_TaskContext *tc;
+
+  rs->read_task = NULL;
+  tc = GNUNET_SCHEDULER_get_task_context ();
+  /* read and process ready sockets */
+  if ( (NULL != rs->dnsout4) &&
+       (GNUNET_NETWORK_fdset_isset (tc->read_ready,
+                                    rs->dnsout4)) &&
+       (GNUNET_SYSERR ==
+        do_dns_read (rs,
+                     rs->dnsout4)) )
+    rs->dnsout4 = NULL;
+  if ( (NULL != rs->dnsout6) &&
+       (GNUNET_NETWORK_fdset_isset (tc->read_ready,
+                                    rs->dnsout6)) &&
+       (GNUNET_SYSERR ==
+        do_dns_read (rs,
+                     rs->dnsout6)) )
+    rs->dnsout6 = NULL;
+  /* re-schedule read task */
+  schedule_read (rs);
+}
+
+
+/**
+ * Task to (re)transmit the DNS query, possibly repeatedly until
+ * we succeed.
+ *
+ * @param cls our `struct GNUNET_DNSSTUB_RequestSocket *`
+ */
+static void
+transmit_query (void *cls)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs = cls;
+  struct GNUNET_DNSSTUB_Context *ctx = rs->ctx;
+  const struct sockaddr *sa;
+  socklen_t salen;
+  struct DnsServer *ds;
+  struct GNUNET_NETWORK_Handle *dnsout;
+
+  rs->retry_task = GNUNET_SCHEDULER_add_delayed (ctx->retry_freq,
+                                                 &transmit_query,
+                                                 rs);
+  ds = rs->ds_pos;
+  rs->ds_pos = ds->next;
+  if (NULL == rs->ds_pos)
+    rs->ds_pos = ctx->dns_head;
+  GNUNET_assert (NULL != ds);
+  dnsout = NULL;
+  switch (ds->ss.ss_family)
+  {
+  case AF_INET:
+    if (NULL == rs->dnsout4)
+      rs->dnsout4 = open_socket (AF_INET);
+    dnsout = rs->dnsout4;
+    sa = (const struct sockaddr *) &ds->ss;
+    salen = sizeof (struct sockaddr_in);
+    break;
+  case AF_INET6:
+    if (NULL == rs->dnsout6)
+      rs->dnsout6 = open_socket (AF_INET6);
+    dnsout = rs->dnsout6;
+    sa = (const struct sockaddr *) &ds->ss;
+    salen = sizeof (struct sockaddr_in6);
+    break;
+  default:
+    return;
+  }
+  if (NULL == dnsout)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to use configure DNS server, skipping\n");
+    return;
+  }
+  if (GNUNET_SYSERR ==
+      GNUNET_NETWORK_socket_sendto (dnsout,
+                                    rs->request,
+                                    rs->request_len,
+                                    sa,
+                                    salen))
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _("Failed to send DNS request to %s\n"),
+                GNUNET_a2s (sa,
+                            salen));
+  else
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                _("Sent DNS request to %s\n"),
+                GNUNET_a2s (sa,
+                            salen));
+  schedule_read (rs);
+}
+
+
+/**
+ * Perform DNS resolution using our default IP from init.
+ *
+ * @param ctx stub resolver to use
+ * @param request DNS request to transmit
+ * @param request_len number of bytes in msg
+ * @param rc function to call with result
+ * @param rc_cls closure for 'rc'
+ * @return socket used for the request, NULL on error
+ */
+struct GNUNET_DNSSTUB_RequestSocket *
+GNUNET_DNSSTUB_resolve (struct GNUNET_DNSSTUB_Context *ctx,
+                         const void *request,
+                         size_t request_len,
+                         GNUNET_DNSSTUB_ResultCallback rc,
+                         void *rc_cls)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs;
+
+  if (NULL == ctx->dns_head)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No DNS server configured for resolution\n");
+    return NULL;
+  }
+  if (NULL == (rs = get_request_socket (ctx)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No request socket available for DNS resolution\n");
+    return NULL;
+  }
+  rs->ds_pos = ctx->dns_head;
+  rs->rc = rc;
+  rs->rc_cls = rc_cls;
+  rs->request = GNUNET_memdup (request,
+                               request_len);
+  rs->request_len = request_len;
+  rs->retry_task = GNUNET_SCHEDULER_add_now (&transmit_query,
+                                             rs);
+  return rs;
+}
+
+
+/**
  * Cancel DNS resolution.
  *
  * @param rs resolution to cancel
@@ -626,28 +577,153 @@ GNUNET_DNSSTUB_resolve_cancel (struct GNUNET_DNSSTUB_RequestSocket *rs)
     GNUNET_SCHEDULER_cancel (rs->retry_task);
     rs->retry_task = NULL;
   }
+  if (NULL != rs->read_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->read_task);
+    rs->read_task = NULL;
+  }
 }
 
 
 /**
  * Start a DNS stub resolver.
  *
- * @param dns_ip target IP address to use
+ * @param num_sockets how many sockets should we open
+ *        in parallel for DNS queries for this stub?
  * @return NULL on error
  */
 struct GNUNET_DNSSTUB_Context *
-GNUNET_DNSSTUB_start (const char *dns_ip)
+GNUNET_DNSSTUB_start (unsigned int num_sockets)
 {
   struct GNUNET_DNSSTUB_Context *ctx;
 
+  if (0 == num_sockets)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
   ctx = GNUNET_new (struct GNUNET_DNSSTUB_Context);
-  if (NULL != dns_ip)
-    ctx->dns_exit = GNUNET_strdup (dns_ip);
+  ctx->num_sockets = num_sockets;
+  ctx->sockets = GNUNET_new_array (num_sockets,
+                                   struct GNUNET_DNSSTUB_RequestSocket);
+  ctx->retry_freq = DNS_RETRANSMIT_DELAY;
   return ctx;
 }
 
 
 /**
+ * Add nameserver for use by the DNSSTUB.  We will use
+ * all provided nameservers for resolution (round-robin).
+ *
+ * @param ctx resolver context to modify
+ * @param dns_ip target IP address to use (as string)
+ * @return #GNUNET_OK on success
+ */
+int
+GNUNET_DNSSTUB_add_dns_ip (struct GNUNET_DNSSTUB_Context *ctx,
+                           const char *dns_ip)
+{
+  struct DnsServer *ds;
+  struct in_addr i4;
+  struct in6_addr i6;
+
+  ds = GNUNET_new (struct DnsServer);
+  if (1 == inet_pton (AF_INET,
+                      dns_ip,
+                      &i4))
+  {
+    struct sockaddr_in *s4 = (struct sockaddr_in *) &ds->ss;
+
+    s4->sin_family = AF_INET;
+    s4->sin_port = htons (53);
+    s4->sin_addr = i4;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    s4->sin_len = (u_char) sizeof (struct sockaddr_in);
+#endif
+  }
+  else if (1 == inet_pton (AF_INET6,
+                           dns_ip,
+                           &i6))
+  {
+    struct sockaddr_in6 *s6 = (struct sockaddr_in6 *) &ds->ss;
+
+    s6->sin6_family = AF_INET6;
+    s6->sin6_port = htons (53);
+    s6->sin6_addr = i6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    s6->sin6_len = (u_char) sizeof (struct sockaddr_in6);
+#endif
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Malformed IP address `%s' for DNS server\n",
+                dns_ip);
+    GNUNET_free (ds);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_CONTAINER_DLL_insert (ctx->dns_head,
+                               ctx->dns_tail,
+                               ds);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add nameserver for use by the DNSSTUB.  We will use
+ * all provided nameservers for resolution (round-robin).
+ *
+ * @param ctx resolver context to modify
+ * @param sa socket address of DNS resolver to use
+ * @return #GNUNET_OK on success
+ */
+int
+GNUNET_DNSSTUB_add_dns_sa (struct GNUNET_DNSSTUB_Context *ctx,
+                           const struct sockaddr *sa)
+{
+  struct DnsServer *ds;
+
+  ds = GNUNET_new (struct DnsServer);
+  switch (sa->sa_family)
+  {
+  case AF_INET:
+    memcpy (&ds->ss,
+            sa,
+            sizeof (struct sockaddr_in));
+    break;
+  case AF_INET6:
+    memcpy (&ds->ss,
+            sa,
+            sizeof (struct sockaddr_in6));
+    break;
+  default:
+    GNUNET_break (0);
+    GNUNET_free (ds);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_CONTAINER_DLL_insert (ctx->dns_head,
+                               ctx->dns_tail,
+                               ds);
+  return GNUNET_OK;
+}
+
+
+/**
+ * How long should we try requests before timing out?
+ * Only effective for requests issued after this call.
+ *
+ * @param ctx resolver context to modify
+ * @param retry_freq how long to wait between retries
+ */
+void
+GNUNET_DNSSTUB_set_retry (struct GNUNET_DNSSTUB_Context *ctx,
+                          struct GNUNET_TIME_Relative retry_freq)
+{
+  ctx->retry_freq = retry_freq;
+}
+
+
+/**
  * Cleanup DNSSTUB resolver.
  *
  * @param ctx stub resolver to clean up
@@ -655,15 +731,18 @@ GNUNET_DNSSTUB_start (const char *dns_ip)
 void
 GNUNET_DNSSTUB_stop (struct GNUNET_DNSSTUB_Context *ctx)
 {
-  unsigned int i;
+  struct DnsServer *ds;
 
-  for (i=0;i<DNS_SOCKET_MAX;i++)
-    cleanup_rs (&ctx->sockets[i]);
-  if (NULL != ctx->dns_exit)
+  while (NULL != (ds = ctx->dns_head))
   {
-    GNUNET_free (ctx->dns_exit);
-    ctx->dns_exit = NULL;
+    GNUNET_CONTAINER_DLL_remove (ctx->dns_head,
+                                 ctx->dns_tail,
+                                 ds);
+    GNUNET_free (ds);
   }
+  for (unsigned int i=0;i<ctx->num_sockets;i++)
+    cleanup_rs (&ctx->sockets[i]);
+  GNUNET_free (ctx->sockets);
   GNUNET_free (ctx);
 }
 
diff --git a/src/dns/gnunet-service-dns.c b/src/dns/gnunet-service-dns.c
index 9feaa8413..39ce7f6e5 100644
--- a/src/dns/gnunet-service-dns.c
+++ b/src/dns/gnunet-service-dns.c
@@ -508,13 +508,11 @@ send_request_to_client (struct RequestRecord *rr,
  * succeeded.
  *
  * @param cls NULL
- * @param rs the socket that received the response
  * @param dns the response itself
  * @param r number of bytes in dns
  */
 static void
 process_dns_result (void *cls,
-                    struct GNUNET_DNSSTUB_RequestSocket *rs,
                     const struct GNUNET_TUN_DnsHeader *dns,
                     size_t r);
 
@@ -530,7 +528,6 @@ next_phase (struct RequestRecord *rr)
 {
   struct ClientRecord *cr;
   int nz;
-  socklen_t salen;
 
   if (rr->phase == RP_DROP)
   {
@@ -582,22 +579,27 @@ next_phase (struct RequestRecord *rr)
     next_phase (rr);
     return;
   case RP_QUERY:
+#if 0
+    /* TODO: optionally, use this to forward DNS requests to the
+       *original* DNS server instead of the one we have configured...
+       (but then we need to create a fresh dnsstub for each request
+       *and* manage the timeout) */
     switch (rr->dst_addr.ss_family)
     {
     case AF_INET:
       salen = sizeof (struct sockaddr_in);
+      sa = (const struct sockaddr *) &rr->dst_addr;
       break;
     case AF_INET6:
       salen = sizeof (struct sockaddr_in6);
+      sa = (const struct sockaddr *) &rr->dst_addr;
       break;
     default:
       GNUNET_assert (0);
     }
-
+#endif
     rr->phase = RP_INTERNET_DNS;
     rr->rs = GNUNET_DNSSTUB_resolve (dnsstub,
-                                     (struct sockaddr*) &rr->dst_addr,
-                                     salen,
                                      rr->payload,
                                      rr->payload_length,
                                      &process_dns_result,
@@ -714,13 +716,11 @@ client_disconnect_cb (void *cls,
  * succeeded.
  *
  * @param cls NULL
- * @param rs the socket that received the response
  * @param dns the response itself
  * @param r number of bytes in dns
  */
 static void
 process_dns_result (void *cls,
-                    struct GNUNET_DNSSTUB_RequestSocket *rs,
                     const struct GNUNET_TUN_DnsHeader *dns,
                     size_t r)
 {
@@ -733,8 +733,7 @@ process_dns_result (void *cls,
     return; /* ignore */
 
   rr = &requests[dns->id];
-  if ( (rr->phase != RP_INTERNET_DNS) ||
-       (rr->rs != rs) )
+  if (rr->phase != RP_INTERNET_DNS)
   {
     /* unexpected / bogus reply */
     GNUNET_STATISTICS_update (stats,
@@ -1055,8 +1054,6 @@ run (void *cls,
   char *ipv4mask;
   char *ipv6addr;
   char *ipv6prefix;
-  struct in_addr dns_exit4;
-  struct in6_addr dns_exit6;
   char *dns_exit;
   char *binary;
   int nortsetup;
@@ -1065,24 +1062,26 @@ run (void *cls,
   stats = GNUNET_STATISTICS_create ("dns", cfg);
   GNUNET_SCHEDULER_add_shutdown (&cleanup_task,
                                  cls);
+  dnsstub = GNUNET_DNSSTUB_start (128);
+  /* TODO: support multiple DNS_EXIT servers being configured */
+  /* TODO: see above TODO on using DNS server from original packet.
+     Not sure which is best... */
   dns_exit = NULL;
-  if ( ( (GNUNET_OK !=
-          GNUNET_CONFIGURATION_get_value_string (cfg,
-                                                 "dns",
-                                                 "DNS_EXIT",
-                                                 &dns_exit)) ||
-         ( (1 != inet_pton (AF_INET, dns_exit, &dns_exit4)) &&
-           (1 != inet_pton (AF_INET6, dns_exit, &dns_exit6)) ) ) )
+  if ( (GNUNET_OK !=
+        GNUNET_CONFIGURATION_get_value_string (cfg,
+                                               "dns",
+                                               "DNS_EXIT",
+                                               &dns_exit)) ||
+       (GNUNET_OK !=
+        GNUNET_DNSSTUB_add_dns_ip (dnsstub,
+                                   dns_exit)) )
   {
     GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR,
                                "dns",
                                "DNS_EXIT",
                                _("need a valid IPv4 or IPv6 address\n"));
     GNUNET_free_non_null (dns_exit);
-    dns_exit = NULL;
   }
-  dnsstub = GNUNET_DNSSTUB_start (dns_exit);
-  GNUNET_free_non_null (dns_exit);
   binary = GNUNET_OS_get_libexec_binary_path ("gnunet-helper-dns");
   if (GNUNET_YES !=
       GNUNET_OS_check_helper_binary (binary,
diff --git a/src/dns/gnunet-zoneimport.c b/src/dns/gnunet-zoneimport.c
index 914868af4..860672e7a 100644
--- a/src/dns/gnunet-zoneimport.c
+++ b/src/dns/gnunet-zoneimport.c
@@ -290,13 +290,11 @@ process_record (struct Request *req,
  * Function called with the result of a DNS resolution.
  *
  * @param cls closure with the `struct Request`
- * @param rs socket that received the response
  * @param dns dns response, never NULL
  * @param dns_len number of bytes in @a dns
  */
 static void
 process_result (void *cls,
-                struct GNUNET_DNSSTUB_RequestSocket *rs,
                 const struct GNUNET_TUN_DnsHeader *dns,
                 size_t dns_len)
 {
@@ -407,11 +405,11 @@ submit_req (struct Request *req)
        (pending >= THRESH) )
     return GNUNET_SYSERR;
   GNUNET_assert (NULL == req->rs);
-  req->rs = GNUNET_DNSSTUB_resolve2 (ctx,
-                                     req->raw,
-                                     req->raw_len,
-                                     &process_result,
-                                     req);
+  req->rs = GNUNET_DNSSTUB_resolve (ctx,
+                                    req->raw,
+                                    req->raw_len,
+                                    &process_result,
+                                    req);
   GNUNET_assert (NULL != req->rs);
   req->issue_num++;
   last_request = now;
@@ -561,13 +559,23 @@ main (int argc,
              "Missing required configuration argument\n");
     return -1;
   }
-  ctx = GNUNET_DNSSTUB_start (argv[1]);
+  ctx = GNUNET_DNSSTUB_start (256);
   if (NULL == ctx)
   {
     fprintf (stderr,
              "Failed to initialize GNUnet DNS STUB\n");
     return 1;
   }
+  if (GNUNET_OK !=
+      GNUNET_DNSSTUB_add_dns_ip (ctx,
+                                 argv[1]))
+  {
+    fprintf (stderr,
+             "Failed to use `%s' for DNS resolver\n",
+             argv[1]);
+    return 1;
+  }
+
   while (NULL !=
          fgets (hn,
                 sizeof (hn),
diff --git a/src/exit/gnunet-daemon-exit.c b/src/exit/gnunet-daemon-exit.c
index 0b3cc505a..ae40feea0 100644
--- a/src/exit/gnunet-daemon-exit.c
+++ b/src/exit/gnunet-daemon-exit.c
@@ -458,13 +458,11 @@ GNUNET_NETWORK_STRUCT_END
  * succeeded.
  *
  * @param cls NULL
- * @param rs the socket that received the response
  * @param dns the response itself
  * @param r number of bytes in @a dns
  */
 static void
 process_dns_result (void *cls,
-                    struct GNUNET_DNSSTUB_RequestSocket *rs,
                     const struct GNUNET_TUN_DnsHeader *dns,
                     size_t r)
 {
@@ -479,8 +477,7 @@ process_dns_result (void *cls,
     return;
   /* Handle case that this is a reply to a request from a CADET DNS channel */
   ts = channels[dns->id];
-  if ( (NULL == ts) ||
-       (ts->specifics.dns.rs != rs) )
+  if (NULL == ts)
     return;
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Got a response from the stub resolver for DNS request received via CADET!\n");
@@ -557,11 +554,11 @@ handle_dns_request (void *cls,
                  dlen);
   dout = (struct GNUNET_TUN_DnsHeader *) buf;
   dout->id = ts->specifics.dns.my_id;
-  ts->specifics.dns.rs = GNUNET_DNSSTUB_resolve2 (dnsstub,
-                                                  buf,
-                                                  dlen,
-                                                  &process_dns_result,
-                                                  NULL);
+  ts->specifics.dns.rs = GNUNET_DNSSTUB_resolve (dnsstub,
+                                                 buf,
+                                                 dlen,
+                                                 &process_dns_result,
+                                                 NULL);
   if (NULL == ts->specifics.dns.rs)
   {
     GNUNET_break_op (0);
@@ -3429,16 +3426,11 @@ do_dht_put (void *cls);
  * Schedules the next PUT.
  *
  * @param cls closure, NULL
- * @param success #GNUNET_OK if the operation worked (unused)
  */
 static void
-dht_put_cont (void *cls,
-              int success)
+dht_put_cont (void *cls)
 {
   dht_put = NULL;
-  dht_task = GNUNET_SCHEDULER_add_delayed (DHT_PUT_FREQUENCY,
-                                           &do_dht_put,
-                                           NULL);
 }
 
 
@@ -3453,7 +3445,9 @@ do_dht_put (void *cls)
 {
   struct GNUNET_TIME_Absolute expiration;
 
-  dht_task = NULL;
+  dht_task = GNUNET_SCHEDULER_add_delayed (DHT_PUT_FREQUENCY,
+                                           &do_dht_put,
+                                           NULL);
   expiration = GNUNET_TIME_absolute_ntoh (dns_advertisement.expiration_time);
   if (GNUNET_TIME_absolute_get_remaining (expiration).rel_value_us <
       GNUNET_TIME_UNIT_HOURS.rel_value_us)
@@ -3466,6 +3460,8 @@ do_dht_put (void *cls)
                                            &dns_advertisement.purpose,
                                            &dns_advertisement.signature));
   }
+  if (NULL != dht_put)
+    GNUNET_DHT_put_cancel (dht_put);
   dht_put = GNUNET_DHT_put (dht,
                             &dht_put_key,
                             1 /* replication */,
@@ -3545,25 +3541,23 @@ advertise_dns_exit ()
   };
   char *dns_exit;
   struct GNUNET_HashCode port;
-  struct in_addr dns_exit4;
-  struct in6_addr dns_exit6;
 
   if (GNUNET_YES !=
       GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                             "exit",
                                             "EXIT_DNS"))
     return;
+  GNUNET_assert (NULL != (dnsstub = GNUNET_DNSSTUB_start (128)));
+  dns_exit = NULL;
+  /* TODO: support using multiple DNS resolvers */
   if ( (GNUNET_OK !=
         GNUNET_CONFIGURATION_get_value_string (cfg,
                                                "exit",
                                                "DNS_RESOLVER",
                                                &dns_exit)) ||
-       ( (1 != inet_pton (AF_INET,
-                          dns_exit,
-                          &dns_exit4)) &&
-         (1 != inet_pton (AF_INET6,
-                          dns_exit,
-                          &dns_exit6)) ) )
+       (GNUNET_OK !=
+        GNUNET_DNSSTUB_add_dns_ip (dnsstub,
+                                   dns_exit)) )
   {
     GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR,
                                "dns",
diff --git a/src/fs/gnunet-service-fs_put.c b/src/fs/gnunet-service-fs_put.c
index e8c7f586d..bb8560fff 100644
--- a/src/fs/gnunet-service-fs_put.c
+++ b/src/fs/gnunet-service-fs_put.c
@@ -135,14 +135,9 @@ schedule_next_put (struct PutOperator *po)
  * Continuation called after DHT PUT operation has finished.
  *
  * @param cls type of blocks to gather
- * @param success GNUNET_OK if the PUT was transmitted,
- *                GNUNET_NO on timeout,
- *                GNUNET_SYSERR on disconnect from service
- *                after the PUT message was transmitted
- *                (so we don't know if it was received or not)
  */
 static void
-delay_dht_put_blocks (void *cls, int success)
+delay_dht_put_blocks (void *cls)
 {
   struct PutOperator *po = cls;
 
diff --git a/src/gns/gns.conf.in b/src/gns/gns.conf.in
index d48a213e9..2e49a4c60 100644
--- a/src/gns/gns.conf.in
+++ b/src/gns/gns.conf.in
@@ -22,9 +22,6 @@ MAX_PARALLEL_BACKGROUND_QUERIES = 1000
 # called via NSS or other mechanisms).
 INTERCEPT_DNS = YES
 
-# Using caching (start with namestore), or always ask DHT?
-USE_CACHE = YES
-
 # PREFIX = valgrind --leak-check=full --track-origins=yes
 
 # Zones
diff --git a/src/gns/gns_tld_api.c b/src/gns/gns_tld_api.c
index 293e37140..8a4d03b11 100644
--- a/src/gns/gns_tld_api.c
+++ b/src/gns/gns_tld_api.c
@@ -94,7 +94,7 @@ struct GNUNET_GNS_LookupWithTldRequest
  * @return the part of @a name after the last ".",
  *         or @a name if @a name does not contain a "."
  */
-static const char *
+static char *
 get_tld (const char *name)
 {
   const char *tld;
@@ -105,14 +105,14 @@ get_tld (const char *name)
     tld = name;
   else
     tld++; /* skip the '.' */
-  return tld;
+  return GNUNET_strdup (tld);
 }
 
 
 /**
  * Eat the TLD of the given @a name.
  *
- * @param name a name
+ * @param[in,out] name a name
  */
 static void
 eat_tld (char *name)
@@ -124,7 +124,7 @@ eat_tld (char *name)
                  (unsigned char) '.');
   if (NULL == tld)
     strcpy (name,
-            GNUNET_GNS_MASTERZONE_STR);
+            GNUNET_GNS_EMPTY_LABEL_AT);
   else
     *tld = '\0';
 }
@@ -229,7 +229,7 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle *handle,
                             void *proc_cls)
 {
   struct GNUNET_GNS_LookupWithTldRequest *ltr;
-  const char *tld;
+  char *tld;
   char *dot_tld;
   char *zonestr;
   struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
@@ -251,6 +251,7 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle *handle,
     eat_tld (ltr->name);
     lookup_with_public_key (ltr,
                             &pkey);
+    GNUNET_free (tld);
     return ltr;
   }
 
@@ -277,6 +278,7 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle *handle,
       GNUNET_free (dot_tld);
       GNUNET_free (ltr->name);
       GNUNET_free (ltr);
+      GNUNET_free (tld);
       return NULL;
     }
     GNUNET_free (dot_tld);
@@ -284,6 +286,7 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle *handle,
     eat_tld (ltr->name);
     lookup_with_public_key (ltr,
                             &pkey);
+    GNUNET_free (tld);
     return ltr;
   }
   GNUNET_free (dot_tld);
@@ -301,6 +304,7 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle *handle,
                                            tld,
                                            &identity_zone_cb,
                                            ltr);
+  GNUNET_free (tld);
   if (NULL == ltr->id_op)
   {
     GNUNET_free (ltr->name);
diff --git a/src/gns/gnunet-dns2gns.c b/src/gns/gnunet-dns2gns.c
index 47cc6dde0..bc66f1325 100644
--- a/src/gns/gnunet-dns2gns.c
+++ b/src/gns/gnunet-dns2gns.c
@@ -247,19 +247,16 @@ do_timeout (void *cls)
  * Iterator called on obtained result for a DNS lookup
  *
  * @param cls closure
- * @param rs the request socket
  * @param dns the DNS udp payload
  * @param r size of the DNS payload
  */
 static void
 dns_result_processor (void *cls,
-                      struct GNUNET_DNSSTUB_RequestSocket *rs,
                       const struct GNUNET_TUN_DnsHeader *dns,
                       size_t r)
 {
   struct Request *request = cls;
 
-  (void) rs;
   if (NULL == dns)
   {
     /* DNSSTUB gave up, so we trigger timeout early */
@@ -307,11 +304,11 @@ result_processor (void *cls,
     request->original_request_id = request->packet->id;
     GNUNET_DNSPARSER_free_packet (request->packet);
     request->packet = NULL;
-    request->dns_lookup = GNUNET_DNSSTUB_resolve2 (dns_stub,
-                                                   request->udp_msg,
-                                                   request->udp_msg_size,
-                                                   &dns_result_processor,
-                                                   request);
+    request->dns_lookup = GNUNET_DNSSTUB_resolve (dns_stub,
+                                                  request->udp_msg,
+                                                  request->udp_msg_size,
+                                                  &dns_result_processor,
+                                                  request);
     return;
   }
   packet = request->packet;
@@ -594,8 +591,12 @@ run (void *cls,
                                  NULL);
   if (NULL == (gns = GNUNET_GNS_connect (cfg)))
     return;
-  if (NULL == (dns_stub = GNUNET_DNSSTUB_start (dns_ip)))
+  GNUNET_assert (NULL != (dns_stub = GNUNET_DNSSTUB_start (128)));
+  if (GNUNET_OK !=
+      GNUNET_DNSSTUB_add_dns_ip (dns_stub,
+                                 dns_ip))
   {
+    GNUNET_DNSSTUB_stop (dns_stub);
     GNUNET_GNS_disconnect (gns);
     gns = NULL;
     return;
diff --git a/src/gns/gnunet-gns-proxy.c b/src/gns/gnunet-gns-proxy.c
index 8b9aa599e..08663a57e 100644
--- a/src/gns/gnunet-gns-proxy.c
+++ b/src/gns/gnunet-gns-proxy.c
@@ -855,9 +855,9 @@ mhd_content_cb (void *cls,
     return MHD_CONTENT_READER_END_OF_STREAM;
   }
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Writing %lu/%lu bytes\n",
-              bytes_to_copy,
-              s5r->io_len);
+              "Writing %llu/%llu bytes\n",
+              (unsigned long long) bytes_to_copy,
+              (unsigned long long) s5r->io_len);
   GNUNET_memcpy (buf,
                  s5r->io_buf,
                  bytes_to_copy);
@@ -1307,12 +1307,12 @@ curl_download_cb (void *ptr,
   if (sizeof (s5r->io_buf) - s5r->io_len < total)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Pausing CURL `%s%s' download, not enough space %lu %lu %lu\n",
+                "Pausing CURL `%s%s' download, not enough space %llu %llu %llu\n",
                 s5r->domain,
                 s5r->url,
-                sizeof (s5r->io_buf),
-                s5r->io_len,
-                total);
+                (unsigned long long) sizeof (s5r->io_buf),
+                (unsigned long long) s5r->io_len,
+                (unsigned long long) total);
     return CURL_WRITEFUNC_PAUSE; /* not enough space */
   }
   GNUNET_memcpy (&s5r->io_buf[s5r->io_len],
diff --git a/src/gns/gnunet-service-gns.c b/src/gns/gnunet-service-gns.c
index 90cd47e1d..c376ddfcc 100644
--- a/src/gns/gnunet-service-gns.c
+++ b/src/gns/gnunet-service-gns.c
@@ -229,14 +229,14 @@ GNS_get_tld (const char *name)
 /**
  * Task run during shutdown.
  *
- * @param cls unused
- * @param tc unused
+ * @param cls unused, NULL
  */
 static void
 shutdown_task (void *cls)
 {
   struct GNS_TopLevelDomain *tld;
 
+  (void) cls;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Shutting down!\n");
   GNS_interceptor_done ();
@@ -283,6 +283,7 @@ client_disconnect_cb (void *cls,
   struct ClientLookupHandle *clh;
   struct GnsClient *gc = app_ctx;
 
+  (void) cls;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Client %p disconnected\n",
               client);
@@ -314,6 +315,8 @@ client_connect_cb (void *cls,
                    struct GNUNET_MQ_Handle *mq)
 {
   struct GnsClient *gc;
+
+  (void) cls;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Client %p connected\n",
               client);
@@ -383,6 +386,7 @@ check_lookup (void *cls,
   size_t msg_size;
   const char* name;
 
+  (void) cls;
   msg_size = ntohs (l_msg->header.size);
   if (msg_size < sizeof (struct LookupMessage))
   {
@@ -479,6 +483,8 @@ read_service_conf (void *cls,
   struct GNUNET_CRYPTO_EcdsaPublicKey pk;
   struct GNS_TopLevelDomain *tld;
 
+  (void) cls;
+  (void) section;
   if (option[0] != '.')
     return;
   if (GNUNET_OK !=
diff --git a/src/gns/gnunet-service-gns_resolver.c b/src/gns/gnunet-service-gns_resolver.c
index 94819b040..92e03bc69 100644
--- a/src/gns/gnunet-service-gns_resolver.c
+++ b/src/gns/gnunet-service-gns_resolver.c
@@ -72,6 +72,57 @@
  * DLL to hold the authority chain we had to pass in the resolution
  * process.
  */
+struct AuthorityChain;
+
+
+/**
+ * Element of a resolution process for looking up the
+ * responsible DNS server hostname in a GNS2DNS recursive
+ * resolution.
+ */
+struct Gns2DnsPending
+{
+
+  /**
+   * Kept in a DLL.
+   */
+  struct Gns2DnsPending *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct Gns2DnsPending *prev;
+
+  /**
+   * Context this activity belongs with.
+   */
+  struct AuthorityChain *ac;
+
+  /**
+   * Handle for the resolution of the IP part of the
+   * GNS2DNS record.  Will return to us the addresses
+   * of the DNS resolver to use.
+   */
+  struct GNS_ResolverHandle *rh;
+
+  /**
+   * Handle for DNS resolution of the DNS nameserver.
+   */
+  struct GNUNET_RESOLVER_RequestHandle *dns_rh;
+};
+
+
+/**
+ * Handle to a currenty pending resolution.  On result (positive or
+ * negative) the #GNS_ResultProcessor is called.
+ */
+struct GNS_ResolverHandle;
+
+
+/**
+ * DLL to hold the authority chain we had to pass in the resolution
+ * process.
+ */
 struct AuthorityChain
 {
   /**
@@ -131,11 +182,32 @@ struct AuthorityChain
       char name[GNUNET_DNSPARSER_MAX_NAME_LENGTH + 1];
 
       /**
-       * IP address of the DNS resolver that is authoritative.
-       * (this implementation currently only supports one
-       * IP at a time).
+       * List of resolutions of the 'ip' of the name server that
+       * are still pending.
+       */
+      struct Gns2DnsPending *gp_head;
+
+      /**
+       * Tail of list of resolutions of the 'ip' of the name server that
+       * are still pending.
+       */
+      struct Gns2DnsPending *gp_tail;
+
+      /**
+       * Handle to perform DNS lookups with this authority (in GNS2DNS handling).
+       */
+      struct GNUNET_DNSSTUB_Context *dns_handle;
+
+      /**
+       * Did we succeed in getting an IP address for *any* of the DNS servers listed?
+       * Once we do, we can start with DNS queries.
+       */
+      int found;
+
+      /**
+       * Did we start the recursive resolution via DNS?
        */
-      struct sockaddr_storage dns_ip;
+      int launched;
 
     } dns_authority;
 
@@ -218,34 +290,6 @@ struct VpnContext
 
 
 /**
- * Information we keep during the resolution of an
- * IP address for a DNS server while handling a
- * GNS2DNS record.
- */
-struct Gns2DnsContext
-{
-
-  /**
-   * DNS domain in which the resolution will continue
-   * (first part of the GNS2DNS record).
-   */
-  char *ns;
-
-  /**
-   * Handle for the resolution of the IP part of the
-   * GNS2DNS record.  Will return to us the addresses
-   * of the DNS resolver to use.
-   */
-  struct GNS_ResolverHandle *rh;
-
-  /**
-   * Handle for DNS resolution of the DNS nameserver.
-   */
-  struct GNUNET_RESOLVER_RequestHandle *dns_rh;
-};
-
-
-/**
  * Handle to a currenty pending resolution.  On result (positive or
  * negative) the #GNS_ResultProcessor is called.
  */
@@ -278,12 +322,6 @@ struct GNS_ResolverHandle
   void* proc_cls;
 
   /**
-   * Handle used during GNS2DNS resolution for looking up the
-   * IP address of the DNS server.
-   */
-  struct Gns2DnsContext *g2dc;
-
-  /**
    * Handle for DHT lookups. should be NULL if no lookups are in progress
    */
   struct GNUNET_DHT_GetHandle *get_handle;
@@ -431,11 +469,6 @@ static struct GNUNET_VPN_Handle *vpn_handle;
 static struct GNUNET_DHT_Handle *dht_handle;
 
 /**
- * Handle to perform DNS lookups.
- */
-static struct GNUNET_DNSSTUB_Context *dns_handle;
-
-/**
  * Heap for limiting parallel DHT lookups
  */
 static struct GNUNET_CONTAINER_Heap *dht_lookup_heap;
@@ -468,7 +501,7 @@ static struct CacheOps *co_tail;
 /**
  * Use namecache
  */
-static int use_cache;
+static int disable_cache;
 
 /**
  * Global configuration.
@@ -543,21 +576,53 @@ translate_dot_plus (struct GNS_ResolverHandle *rh,
 
 
 /**
- * Task scheduled to asynchronously fail a resolution.
+ * Wrapper around #GNS_resolver_lookup_cancel() as a task.
+ * Used for delayed cleanup so we can unwind the stack first.
  *
- * @param cls the 'struct GNS_ResolverHandle' of the resolution to fail
+ * @param cls the `struct GNS_ResolverHandle`
  */
 static void
-fail_resolution (void *cls)
+GNS_resolver_lookup_cancel_ (void *cls)
 {
   struct GNS_ResolverHandle *rh = cls;
 
   rh->task_id = NULL;
-  rh->proc (rh->proc_cls, 0, NULL);
   GNS_resolver_lookup_cancel (rh);
 }
 
 
+/**
+ * Function called to asynchronously fail a resolution.
+ *
+ * @param rh the resolution to fail
+ */
+static void
+fail_resolution (struct GNS_ResolverHandle *rh)
+{
+  rh->proc (rh->proc_cls,
+            0,
+            NULL);
+  GNUNET_assert (NULL == rh->task_id);
+  rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                          rh);
+}
+
+
+/**
+ * Function called when a resolution times out.
+ *
+ * @param cls the `struct GNS_ResolverHandle`
+ */
+static void
+timeout_resolution (void *cls)
+{
+  struct GNS_ResolverHandle *rh = cls;
+
+  rh->task_id = NULL;
+  fail_resolution (rh);
+}
+
+
 #if (defined WINDOWS) || (defined DARWIN)
 /* Don't have this on W32, here's a naive implementation
  * Was somehow removed on OS X ...  */
@@ -831,13 +896,11 @@ start_resolver_lookup (void *cls);
  *
  * @param cls the request handle of the resolution that
  *        we were attempting to make
- * @param rs socket that received the response
  * @param dns dns response, never NULL
  * @param dns_len number of bytes in @a dns
  */
 static void
 dns_result_parser (void *cls,
-                   struct GNUNET_DNSSTUB_RequestSocket *rs,
                    const struct GNUNET_TUN_DnsHeader *dns,
                    size_t dns_len)
 {
@@ -845,18 +908,13 @@ dns_result_parser (void *cls,
   struct GNUNET_DNSPARSER_Packet *p;
   const struct GNUNET_DNSPARSER_Record *rec;
   unsigned int rd_count;
-  unsigned int i;
 
-  (void) rs;
   if (NULL == dns)
   {
     rh->dns_request = NULL;
     GNUNET_SCHEDULER_cancel (rh->task_id);
     rh->task_id = NULL;
-    rh->proc (rh->proc_cls,
-              0,
-              NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   if (rh->original_dns_id != dns->id)
@@ -872,6 +930,8 @@ dns_result_parser (void *cls,
                 _("Failed to parse DNS response\n"));
     return;
   }
+
+  /* We got a result from DNS */
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received DNS response for `%s' with %u answers\n",
               rh->ac_tail->label,
@@ -920,8 +980,10 @@ dns_result_parser (void *cls,
 
     buf_off = 0;
     skip = 0;
-    memset (rd, 0, sizeof (rd));
-    for (i=0;i<rd_count;i++)
+    memset (rd,
+            0,
+            sizeof (rd));
+    for (unsigned int i=0;i<rd_count;i++)
     {
       if (i < p->num_answers)
         rec = &p->answers[i];
@@ -1043,9 +1105,12 @@ dns_result_parser (void *cls,
     rh->proc (rh->proc_cls,
               rd_count - skip,
               rd);
-    GNS_resolver_lookup_cancel (rh);
   }
   GNUNET_DNSPARSER_free_packet (p);
+  if (NULL != rh->task_id)
+    GNUNET_SCHEDULER_cancel (rh->task_id); /* should be timeout task */
+  rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                          rh);
 }
 
 
@@ -1061,7 +1126,6 @@ static void
 recursive_dns_resolution (struct GNS_ResolverHandle *rh)
 {
   struct AuthorityChain *ac;
-  socklen_t sa_len;
   struct GNUNET_DNSPARSER_Query *query;
   struct GNUNET_DNSPARSER_Packet *p;
   char *dns_request;
@@ -1074,20 +1138,6 @@ recursive_dns_resolution (struct GNS_ResolverHandle *rh)
               "Starting DNS lookup for `%s'\n",
               ac->label);
   GNUNET_assert (GNUNET_NO == ac->gns_authority);
-  switch (((const struct sockaddr *) &ac->authority_info.dns_authority.dns_ip)->sa_family)
-  {
-  case AF_INET:
-    sa_len = sizeof (struct sockaddr_in);
-    break;
-  case AF_INET6:
-    sa_len = sizeof (struct sockaddr_in6);
-    break;
-  default:
-    GNUNET_break (0);
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
-    return;
-  }
   query = GNUNET_new (struct GNUNET_DNSPARSER_Query);
   query->name = GNUNET_strdup (ac->label);
   query->type = rh->record_type;
@@ -1109,20 +1159,22 @@ recursive_dns_resolution (struct GNS_ResolverHandle *rh)
     rh->proc (rh->proc_cls,
               0,
               NULL);
-    GNS_resolver_lookup_cancel (rh);
+    GNUNET_assert (NULL == rh->task_id);
+    rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                            rh);
   }
   else
   {
     rh->original_dns_id = p->id;
-    rh->dns_request = GNUNET_DNSSTUB_resolve (dns_handle,
-                                              (const struct sockaddr *) &ac->authority_info.dns_authority.dns_ip,
-                                              sa_len,
+    GNUNET_assert (NULL != ac->authority_info.dns_authority.dns_handle);
+    GNUNET_assert (NULL == rh->dns_request);
+    rh->dns_request = GNUNET_DNSSTUB_resolve (ac->authority_info.dns_authority.dns_handle,
                                               dns_request,
                                               dns_request_length,
                                               &dns_result_parser,
                                               rh);
     rh->task_id = GNUNET_SCHEDULER_add_delayed (DNS_LOOKUP_TIMEOUT,
-                                                &fail_resolution,
+                                                &timeout_resolution,
                                                 rh);
   }
   if (GNUNET_SYSERR != ret)
@@ -1293,15 +1345,47 @@ vpn_allocation_cb (void *cls,
 
 
 /**
+ * We have resolved one or more of the nameservers for a
+ * GNS2DNS lookup.  Once we have some of them, begin using
+ * the DNSSTUB resolver.
+ *
+ * @param ac context for GNS2DNS resolution
+ */
+static void
+continue_with_gns2dns (struct AuthorityChain *ac)
+{
+  struct GNS_ResolverHandle *rh = ac->rh;
+
+  if ( (NULL != ac->authority_info.dns_authority.gp_head) &&
+       (GNUNET_NO == ac->authority_info.dns_authority.found) )
+    return; /* more pending and none found yet */
+  if (GNUNET_NO == ac->authority_info.dns_authority.found)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Failed to resolve DNS server for `%s' in GNS2DNS resolution\n",
+                ac->authority_info.dns_authority.name);
+    fail_resolution (rh);
+    return;
+  }
+  if (GNUNET_NO != ac->authority_info.dns_authority.launched)
+    return; /* already running, do not launch again! */
+  /* recurse */
+  ac->authority_info.dns_authority.launched = GNUNET_YES;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Will continue resolution using DNS to resolve `%s'\n",
+              ac->label);
+  GNUNET_assert (NULL == rh->task_id);
+  rh->task_id = GNUNET_SCHEDULER_add_now (&recursive_resolution,
+                                          rh);
+
+}
+
+
+/**
  * We've resolved the IP address for the DNS resolver to use
  * after encountering a GNS2DNS record.
  *
- * TODO: Right now we only foward the request to ONE DNS resolver,
- * even if we get multiple IP addresses back; a correct implementation
- * should try all DNS resolvers.
- *
- * @param cls the `struct GNS_ResolverHandle` where we encountered
- *            the GNS2DNS record
+ * @param cls the `struct Gns2DnsPending` used for this request
  * @param rd_count number of records in @a rd
  * @param rd addresses for the DNS resolver  (presumably)
  */
@@ -1310,136 +1394,96 @@ handle_gns2dns_result (void *cls,
                        unsigned int rd_count,
                        const struct GNUNET_GNSRECORD_Data *rd)
 {
-  struct GNS_ResolverHandle *rh = cls;
-  struct AuthorityChain *ac;
-  struct sockaddr *sa;
-  struct sockaddr_in v4;
-  struct sockaddr_in6 v6;
-  size_t sa_len;
-
-  /* find suitable A/AAAA record */
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Received %u results for IP address of DNS server for GNS2DNS transition\n",
-              rd_count);
-  /* enable cleanup of 'rh' handle that comes next... */
-  if (NULL != rh->g2dc->rh)
+  struct Gns2DnsPending *gp = cls;
+  struct AuthorityChain *ac = gp->ac;
+
+  GNUNET_CONTAINER_DLL_remove (ac->authority_info.dns_authority.gp_head,
+                               ac->authority_info.dns_authority.gp_tail,
+                               gp);
+  /* enable cleanup of 'rh' handle that automatically comes after we return,
+     and which expects 'rh' to be in the #rlh_head DLL. */
+  if (NULL != gp->rh)
   {
     GNUNET_CONTAINER_DLL_insert (rlh_head,
                                  rlh_tail,
-                                 rh->g2dc->rh);
-    rh->g2dc->rh = NULL;
+                                 gp->rh);
+    gp->rh = NULL;
   }
-  sa = NULL;
-  sa_len = 0;
+  GNUNET_free (gp);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received %u results for IP address of DNS server for GNS2DNS transition\n",
+              rd_count);
+  /* find suitable A/AAAA record */
   for (unsigned int j=0;j<rd_count;j++)
   {
     switch (rd[j].record_type)
     {
     case GNUNET_DNSPARSER_TYPE_A:
-      if (sizeof (struct in_addr) != rd[j].data_size)
       {
-        GNUNET_break_op (0);
-        rh->proc (rh->proc_cls, 0, NULL);
-        GNS_resolver_lookup_cancel (rh);
-        return;
-      }
-      /* FIXME: might want to check if we support IPv4 here,
-         and otherwise skip this one and hope we find another */
-      memset (&v4, 0, sizeof (v4));
-      sa_len = sizeof (v4);
-      v4.sin_family = AF_INET;
-      v4.sin_port = htons (53);
+        struct sockaddr_in v4;
+
+        if (sizeof (struct in_addr) != rd[j].data_size)
+        {
+          GNUNET_break_op (0);
+          continue;
+        }
+        memset (&v4,
+                0,
+                sizeof (v4));
+        v4.sin_family = AF_INET;
+        v4.sin_port = htons (53);
 #if HAVE_SOCKADDR_IN_SIN_LEN
-      v4.sin_len = (u_char) sa_len;
+        v4.sin_len = (u_char) sizeof (v4);
 #endif
-      GNUNET_memcpy (&v4.sin_addr,
-              rd[j].data,
-              sizeof (struct in_addr));
-      sa = (struct sockaddr *) &v4;
-      break;
+        GNUNET_memcpy (&v4.sin_addr,
+                       rd[j].data,
+                       sizeof (struct in_addr));
+        if (GNUNET_OK ==
+            GNUNET_DNSSTUB_add_dns_sa (ac->authority_info.dns_authority.dns_handle,
+                                       (const struct sockaddr *) &v4))
+          ac->authority_info.dns_authority.found = GNUNET_YES;
+        break;
+      }
     case GNUNET_DNSPARSER_TYPE_AAAA:
-      if (sizeof (struct in6_addr) != rd[j].data_size)
       {
-        GNUNET_break_op (0);
-        rh->proc (rh->proc_cls, 0, NULL);
-        GNS_resolver_lookup_cancel (rh);
-        return;
-      }
-      /* FIXME: might want to check if we support IPv6 here,
-         and otherwise skip this one and hope we find another */
-      memset (&v6, 0, sizeof (v6));
-      sa_len = sizeof (v6);
-      v6.sin6_family = AF_INET6;
-      v6.sin6_port = htons (53);
+        struct sockaddr_in6 v6;
+
+        if (sizeof (struct in6_addr) != rd[j].data_size)
+        {
+          GNUNET_break_op (0);
+          continue;
+        }
+        /* FIXME: might want to check if we support IPv6 here,
+           and otherwise skip this one and hope we find another */
+        memset (&v6,
+                0,
+                sizeof (v6));
+        v6.sin6_family = AF_INET6;
+        v6.sin6_port = htons (53);
 #if HAVE_SOCKADDR_IN_SIN_LEN
-      v6.sin6_len = (u_char) sa_len;
+        v6.sin6_len = (u_char) sizeof (v6);
 #endif
-      GNUNET_memcpy (&v6.sin6_addr,
-              rd[j].data,
-              sizeof (struct in6_addr));
-      sa = (struct sockaddr *) &v6;
-      break;
+        GNUNET_memcpy (&v6.sin6_addr,
+                       rd[j].data,
+                       sizeof (struct in6_addr));
+        if (GNUNET_OK ==
+            GNUNET_DNSSTUB_add_dns_sa (ac->authority_info.dns_authority.dns_handle,
+                                       (const struct sockaddr *) &v6))
+          ac->authority_info.dns_authority.found = GNUNET_YES;
+        break;
+      }
     default:
       break;
     }
-    if (NULL != sa)
-      break;
-  }
-  if (NULL == sa)
-  {
-    /* we cannot continue; NS without A/AAAA */
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
-    return;
   }
-  /* expand authority chain */
-  ac = GNUNET_new (struct AuthorityChain);
-  ac->rh = rh;
-  GNUNET_assert (strlen (rh->g2dc->ns) <= GNUNET_DNSPARSER_MAX_NAME_LENGTH);
-  strcpy (ac->authority_info.dns_authority.name,
-          rh->g2dc->ns);
-  GNUNET_memcpy (&ac->authority_info.dns_authority.dns_ip,
-          sa,
-          sa_len);
-  /* for DNS recursion, the label is the full DNS name,
-     created from the remainder of the GNS name and the
-     name in the NS record */
-  GNUNET_asprintf (&ac->label,
-                   "%.*s%s%s",
-                   (int) rh->name_resolution_pos,
-                   rh->name,
-                   (0 != rh->name_resolution_pos) ? "." : "",
-                   rh->g2dc->ns);
-  GNUNET_free (rh->g2dc->ns);
-  GNUNET_free (rh->g2dc);
-  rh->g2dc = NULL;
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Will continue resolution using DNS server `%s' to resolve `%s'\n",
-              GNUNET_a2s (sa,
-                          sa_len),
-              ac->label);
-  GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
-                                    rh->ac_tail,
-                                    ac);
-  if (strlen (ac->label) > GNUNET_DNSPARSER_MAX_NAME_LENGTH)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                _("GNS lookup resulted in DNS name that is too long (`%s')\n"),
-                ac->label);
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
-    return;
-  }
-  /* recurse */
-  rh->task_id = GNUNET_SCHEDULER_add_now (&recursive_resolution,
-                                          rh);
+  continue_with_gns2dns (ac);
 }
 
 
 /**
  * Function called by the resolver for each address obtained from DNS.
  *
- * @param cls closure, a `struct Gns2DnsContext *`
+ * @param cls closure, a `struct Gns2DnsPending *`
  * @param addr one of the addresses of the host, NULL for the last address
  * @param addrlen length of @a addr
  */
@@ -1448,57 +1492,270 @@ handle_gns2dns_ip (void *cls,
                    const struct sockaddr *addr,
                    socklen_t addrlen)
 {
-  struct Gns2DnsContext *g2dc = cls;
-  struct GNUNET_GNSRECORD_Data rd;
-
+  struct Gns2DnsPending *gp = cls;
+  struct AuthorityChain *ac = gp->ac;
+
+  GNUNET_RESOLVER_request_cancel (gp->dns_rh);
+  GNUNET_CONTAINER_DLL_remove (ac->authority_info.dns_authority.gp_head,
+                               ac->authority_info.dns_authority.gp_tail,
+                               gp);
+  GNUNET_free (gp);
   if (NULL == addr)
   {
     /* DNS resolution failed */
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "Failed to use DNS to resolve name of DNS resolver\n");
-    g2dc->rh->g2dc = NULL;
-    fail_resolution (g2dc->rh);
-    GNUNET_free (g2dc);
   }
-  switch (addr->sa_family)
+  else
   {
-  case AF_INET:
+    if (GNUNET_OK ==
+        GNUNET_DNSSTUB_add_dns_sa (ac->authority_info.dns_authority.dns_handle,
+                                   addr))
+      ac->authority_info.dns_authority.found = GNUNET_YES;
+  }
+  continue_with_gns2dns (ac);
+}
+
+
+/**
+ * We found a CNAME record, perform recursive resolution on it.
+ *
+ * @param rh resolution handle
+ * @param rd record with CNAME to resolve recursively
+ */
+static void
+recursive_cname_resolution (struct GNS_ResolverHandle *rh,
+                            const struct GNUNET_GNSRECORD_Data *rd)
+{
+  char *cname;
+  size_t off;
+
+  off = 0;
+  cname = GNUNET_DNSPARSER_parse_name (rd->data,
+                                       rd->data_size,
+                                       &off);
+  if ( (NULL == cname) ||
+       (off != rd->data_size) )
+  {
+    GNUNET_break_op (0); /* record not well-formed */
+    GNUNET_free_non_null (cname);
+    fail_resolution (rh);
+    return;
+  }
+  handle_gns_cname_result (rh,
+                           cname);
+  GNUNET_free (cname);
+}
+
+
+/**
+ * We found a PKEY record, perform recursive resolution on it.
+ *
+ * @param rh resolution handle
+ * @param rd record with PKEY to resolve recursively
+ */
+static void
+recursive_pkey_resolution (struct GNS_ResolverHandle *rh,
+                           const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct AuthorityChain *ac;
+
+  /* delegation to another zone */
+  if (sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey) !=
+      rd->data_size)
+  {
+    GNUNET_break_op (0);
+    fail_resolution (rh);
+    return;
+  }
+  /* expand authority chain */
+  ac = GNUNET_new (struct AuthorityChain);
+  ac->rh = rh;
+  ac->gns_authority = GNUNET_YES;
+  ac->suggested_shortening_label = NULL;
+  ac->shortening_started = GNUNET_NO;
+  GNUNET_memcpy (&ac->authority_info.gns_authority,
+                 rd->data,
+                 sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey));
+  ac->label = resolver_lookup_get_next_label (rh);
+  /* add AC to tail */
+  GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
+                                    rh->ac_tail,
+                                    ac);
+  /* recurse */
+  rh->task_id = GNUNET_SCHEDULER_add_now (&recursive_resolution,
+                                          rh);
+}
+
+
+/**
+ * We found one or more GNS2DNS records, perform recursive resolution on it.
+ * (to be precise, one or more records in @a rd is GNS2DNS, there may be others,
+ * so this function still needs to check which ones are GNS2DNS).
+ *
+ * @param rh resolution handle
+ * @param rd_count length of the @a rd array
+ * @param rd record with PKEY to resolve recursively
+ * @return #GNUNET_OK if this worked, #GNUNET_SYSERR if no GNS2DNS records were in @a rd
+ */
+static int
+recursive_gns2dns_resolution (struct GNS_ResolverHandle *rh,
+                              unsigned int rd_count,
+                              const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct AuthorityChain *ac;
+  const char *tld;
+  char *ns;
+
+  ns = NULL;
+  /* expand authority chain */
+  ac = GNUNET_new (struct AuthorityChain);
+  ac->rh = rh;
+  ac->authority_info.dns_authority.dns_handle = GNUNET_DNSSTUB_start (4);
+
+  for (unsigned int i=0;i<rd_count;i++)
+  {
+    char *ip;
+    char *n;
+    size_t off;
+    struct Gns2DnsPending *gp;
+    struct GNUNET_CRYPTO_EcdsaPublicKey zone;
+
+    if (GNUNET_GNSRECORD_TYPE_GNS2DNS != rd[i].record_type)
+      continue;
+    off = 0;
+    n = GNUNET_DNSPARSER_parse_name (rd[i].data,
+                                     rd[i].data_size,
+                                     &off);
+    ip = GNUNET_DNSPARSER_parse_name (rd[i].data,
+                                      rd[i].data_size,
+                                      &off);
+    if ( (NULL == n) ||
+         (NULL == ip) ||
+         (off != rd[i].data_size) )
     {
-      const struct sockaddr_in *v4 = (const struct sockaddr_in *) addr;
-
-      GNUNET_assert (sizeof (*v4) == addrlen);
-      rd.data = v4;
-      rd.data_size = sizeof (*v4);
-      rd.expiration_time = UINT64_MAX;
-      rd.record_type = GNUNET_DNSPARSER_TYPE_A;
-      rd.flags = 0;
-      break;
+      GNUNET_break_op (0);
+      GNUNET_free_non_null (n);
+      GNUNET_free_non_null (ip);
+      continue;
     }
-  case AF_INET6:
+    /* resolve 'ip' to determine the IP(s) of the DNS
+       resolver to use for lookup of 'ns' */
+    if (NULL != ns)
     {
-      const struct sockaddr_in6 *v6 = (const struct sockaddr_in6 *) addr;
-
-      GNUNET_assert (sizeof (*v6) == addrlen);
-      rd.data = v6;
-      rd.data_size = sizeof (v6);
-      rd.expiration_time = UINT64_MAX;
-      rd.record_type = GNUNET_DNSPARSER_TYPE_AAAA;
-      rd.flags = 0;
-      break;
+      if (0 != strcasecmp (ns,
+                           n))
+      {
+        /* NS values must all be the same for all GNS2DNS records,
+           anything else leads to insanity */
+        GNUNET_break_op (0);
+        GNUNET_free (n);
+        GNUNET_free (ip);
+        continue;
+      }
+      GNUNET_free (n);
+    }
+    else
+    {
+      ns = n;
     }
-  default:
-    return;
-  }
-  GNUNET_RESOLVER_request_cancel (g2dc->dns_rh);
-  g2dc->dns_rh = NULL;
-  handle_gns2dns_result (g2dc->rh,
-                         1,
-                         &rd);
 
+    /* check if 'ip' is already an IPv4/IPv6 address */
+    if (GNUNET_OK ==
+        GNUNET_DNSSTUB_add_dns_ip (ac->authority_info.dns_authority.dns_handle,
+                                   ip))
+    {
+      ac->authority_info.dns_authority.found = GNUNET_YES;
+      GNUNET_free (ip);
+      continue;
+    }
+    tld = GNS_get_tld (ip);
+    if (0 != strcmp (tld,
+                     "+"))
+    {
+      /* 'ip' is a DNS name */
+      gp = GNUNET_new (struct Gns2DnsPending);
+      gp->ac = ac;
+      GNUNET_CONTAINER_DLL_insert (ac->authority_info.dns_authority.gp_head,
+                                   ac->authority_info.dns_authority.gp_tail,
+                                   gp);
+      gp->dns_rh = GNUNET_RESOLVER_ip_get (ip,
+                                           AF_UNSPEC,
+                                           GNUNET_TIME_UNIT_FOREVER_REL,
+                                           &handle_gns2dns_ip,
+                                           gp);
+      GNUNET_free (ip);
+      continue;
+    }
+    /* 'ip' should be a GNS name */
+    gp = GNUNET_new (struct Gns2DnsPending);
+    gp->ac = ac;
+    GNUNET_CONTAINER_DLL_insert (ac->authority_info.dns_authority.gp_head,
+                                 ac->authority_info.dns_authority.gp_tail,
+                                 gp);
+    gp->rh = GNUNET_new (struct GNS_ResolverHandle);
+    ip = translate_dot_plus (rh,
+                             ip);
+    tld = GNS_get_tld (ip);
+    if (GNUNET_OK !=
+        GNUNET_GNSRECORD_zkey_to_pkey (tld,
+                                       &zone))
+    {
+      GNUNET_break_op (0);
+      GNUNET_free (ip);
+      continue;
+    }
+    gp->rh->authority_zone = zone;
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Resolving `%s' to determine IP address of DNS server for GNS2DNS transition for `%s'\n",
+                ip,
+                ns);
+    gp->rh->name = ip;
+    gp->rh->name_resolution_pos = strlen (ip) - strlen (tld) - 1;
+    gp->rh->proc = &handle_gns2dns_result;
+    gp->rh->proc_cls = gp;
+    gp->rh->record_type = GNUNET_GNSRECORD_TYPE_ANY;
+    gp->rh->options = GNUNET_GNS_LO_DEFAULT;
+    gp->rh->loop_limiter = rh->loop_limiter + 1;
+    gp->rh->task_id
+      = GNUNET_SCHEDULER_add_now (&start_resolver_lookup,
+                                  gp->rh);
+  } /* end 'for all records' */
+
+  if (NULL == ns)
+  {
+    /* not a single GNS2DNS record found */
+    GNUNET_free (ac);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_assert (strlen (ns) <= GNUNET_DNSPARSER_MAX_NAME_LENGTH);
+  strcpy (ac->authority_info.dns_authority.name,
+          ns);
+  /* for DNS recursion, the label is the full DNS name,
+     created from the remainder of the GNS name and the
+     name in the NS record */
+  GNUNET_asprintf (&ac->label,
+                   "%.*s%s%s",
+                   (int) rh->name_resolution_pos,
+                   rh->name,
+                   (0 != rh->name_resolution_pos) ? "." : "",
+                   ns);
+  GNUNET_free (ns);
+  GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
+                                    rh->ac_tail,
+                                    ac);
+  if (strlen (ac->label) > GNUNET_DNSPARSER_MAX_NAME_LENGTH)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _("GNS lookup resulted in DNS name that is too long (`%s')\n"),
+                ac->label);
+    return GNUNET_SYSERR;
+  }
+  continue_with_gns2dns (ac);
+  return GNUNET_OK;
 }
 
 
-
 /**
  * Process a records that were decrypted from a block.
  *
@@ -1512,7 +1769,6 @@ handle_gns_resolution_result (void *cls,
                               const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct GNS_ResolverHandle *rh = cls;
-  struct AuthorityChain *ac;
   struct AuthorityChain *shorten_ac;
   char *cname;
   struct VpnContext *vpn_ctx;
@@ -1532,6 +1788,14 @@ handle_gns_resolution_result (void *cls,
               rh->ac_tail->label,
               GNUNET_GNSRECORD_z2s (&rh->ac_tail->authority_info.gns_authority),
               rd_count);
+  if (0 == rd_count)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _("GNS lookup failed (zero records found)\n"));
+    fail_resolution (rh);
+    return;
+  }
+
   if (0 == rh->name_resolution_pos)
   {
     /* top-level match, are we done yet? */
@@ -1547,9 +1811,8 @@ handle_gns_resolution_result (void *cls,
            (off != rd[0].data_size) )
       {
         GNUNET_break_op (0);
-        rh->proc (rh->proc_cls, 0, NULL);
-        GNS_resolver_lookup_cancel (rh);
         GNUNET_free_non_null (cname);
+        fail_resolution (rh);
         return;
       }
       handle_gns_cname_result (rh,
@@ -1573,8 +1836,7 @@ handle_gns_resolution_result (void *cls,
                 rd[i].data_size)
             {
               GNUNET_break_op (0);
-              rh->proc (rh->proc_cls, 0, NULL);
-              GNS_resolver_lookup_cancel (rh);
+              fail_resolution (rh);
               return;
             }
             vpn = (const struct GNUNET_TUN_GnsVpnRecord *) rd[i].data;
@@ -1582,8 +1844,7 @@ handle_gns_resolution_result (void *cls,
             if ('\0' != vname[rd[i].data_size - 1 - sizeof (struct GNUNET_TUN_GnsVpnRecord)])
             {
               GNUNET_break_op (0);
-              rh->proc (rh->proc_cls, 0, NULL);
-              GNS_resolver_lookup_cancel (rh);
+              fail_resolution (rh);
               return;
             }
             GNUNET_TUN_service_name_to_hash (vname,
@@ -1621,7 +1882,13 @@ handle_gns_resolution_result (void *cls,
             /* delegation to DNS */
             GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                         "Found GNS2DNS record, delegating to DNS!\n");
-            goto do_recurse;
+            if (GNUNET_OK ==
+                recursive_gns2dns_resolution (rh,
+                                              rd_count,
+                                              rd))
+              return;
+            else
+              goto fail;
           }
         default:
           break;
@@ -1823,18 +2090,20 @@ handle_gns_resolution_result (void *cls,
             GNUNET_break_op (0);
             break;
           }
-          GNUNET_memcpy (&pub, rd[i].data, rd[i].data_size);
+          GNUNET_memcpy (&pub,
+                         rd[i].data,
+                         rd[i].data_size);
           rd_off++;
           if (GNUNET_GNSRECORD_TYPE_PKEY != rh->record_type)
           {
-            /* try to resolve "+" */
+            /* try to resolve "@" */
             struct AuthorityChain *ac;
 
             ac = GNUNET_new (struct AuthorityChain);
             ac->rh = rh;
             ac->gns_authority = GNUNET_YES;
             ac->authority_info.gns_authority = pub;
-            ac->label = GNUNET_strdup (GNUNET_GNS_MASTERZONE_STR);
+            ac->label = GNUNET_strdup (GNUNET_GNS_EMPTY_LABEL_AT);
             ac->suggested_shortening_label = NULL;
             ac->shortening_started = GNUNET_NO;
             GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
@@ -1856,7 +2125,13 @@ handle_gns_resolution_result (void *cls,
           }
           GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                       "Found GNS2DNS record, delegating to DNS!\n");
-          goto do_recurse;
+          if (GNUNET_OK ==
+              recursive_gns2dns_resolution (rh,
+                                            rd_count,
+                                            rd))
+            return;
+          else
+            goto fail;
         }
       case GNUNET_GNSRECORD_TYPE_BOX:
         {
@@ -1901,200 +2176,35 @@ handle_gns_resolution_result (void *cls,
     rh->proc (rh->proc_cls,
               rd_off,
               rd_new);
-    GNS_resolver_lookup_cancel (rh);
+    rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                            rh);
     return;
   }
- do_recurse:
-  /* need to recurse, check if we can */
-  for (unsigned int i=0;i<rd_count;i++)
+
+  switch (rd[0].record_type)
   {
-    switch (rd[i].record_type)
-    {
-    case GNUNET_GNSRECORD_TYPE_PKEY:
-      /* delegation to another zone */
-      if (sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey) !=
-          rd[i].data_size)
-      {
-        GNUNET_break_op (0);
-        rh->proc (rh->proc_cls, 0, NULL);
-        GNS_resolver_lookup_cancel (rh);
-        return;
-      }
-      /* expand authority chain */
-      ac = GNUNET_new (struct AuthorityChain);
-      ac->rh = rh;
-      ac->gns_authority = GNUNET_YES;
-      ac->suggested_shortening_label = NULL;
-      ac->shortening_started = GNUNET_NO;
-      GNUNET_memcpy (&ac->authority_info.gns_authority,
-              rd[i].data,
-              sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey));
-      ac->label = resolver_lookup_get_next_label (rh);
-      /* add AC to tail */
-      GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
-                                        rh->ac_tail,
-                                        ac);
-      /* recurse */
-      rh->task_id = GNUNET_SCHEDULER_add_now (&recursive_resolution,
-                                              rh);
+  case GNUNET_DNSPARSER_TYPE_CNAME:
+    GNUNET_break_op (1 == rd_count); /* CNAME should be unique */
+    recursive_cname_resolution (rh,
+                                &rd[0]);
+    return;
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    GNUNET_break_op (1 == rd_count); /* PKEY should be unique */
+    recursive_pkey_resolution (rh,
+                               &rd[0]);
+    return;
+  default:
+    if (GNUNET_OK ==
+        recursive_gns2dns_resolution (rh,
+                                      rd_count,
+                                      rd))
       return;
-    case GNUNET_GNSRECORD_TYPE_GNS2DNS:
-      {
-        /* TODO: Right now we only foward the request to ONE DNS resolver,
-           even if we get multiple IP addresses back; a correct implementation
-           should try all DNS resolvers. */
-        /* resolution continues within DNS */
-        struct Gns2DnsContext *g2dc;
-        char *ip;
-        char *ns;
-        const char *tld;
-        struct GNUNET_CRYPTO_EcdsaPublicKey zone;
-        struct in_addr v4;
-        struct in6_addr v6;
-
-        off = 0;
-        ns = GNUNET_DNSPARSER_parse_name (rd[i].data,
-                                          rd[i].data_size,
-                                          &off);
-        ip = GNUNET_DNSPARSER_parse_name (rd[i].data,
-                                          rd[i].data_size,
-                                          &off);
-        if ( (NULL == ns) ||
-             (NULL == ip) ||
-             (off != rd[i].data_size) )
-        {
-          GNUNET_break_op (0);
-          GNUNET_free_non_null (ns);
-          GNUNET_free_non_null (ip);
-          fail_resolution (rh);
-          return;
-        }
-        /* resolve 'ip' to determine the IP(s) of the DNS
-           resolver to use for lookup of 'ns' */
-        g2dc = GNUNET_new (struct Gns2DnsContext);
-        g2dc->ns = ns;
-        rh->g2dc = g2dc;
-
-        /* check if 'ip' is already an IPv4/IPv6 address */
-        if (1 == inet_pton (AF_INET,
-                            ip,
-                            &v4))
-        {
-          /* name is IPv4 address, pretend it's an A record */
-          struct GNUNET_GNSRECORD_Data rd;
-
-          GNUNET_free (ip);
-          rd.data = &v4;
-          rd.data_size = sizeof (v4);
-          rd.expiration_time = UINT64_MAX;
-          rd.record_type = GNUNET_DNSPARSER_TYPE_A;
-          rd.flags = 0;
-          handle_gns2dns_result (rh,
-                                 1,
-                                 &rd);
-          return;
-        }
-        if (1 == inet_pton (AF_INET6,
-                            ip,
-                            &v6))
-        {
-          /* name is IPv6 address, pretend it's an AAAA record */
-          struct GNUNET_GNSRECORD_Data rd;
-
-          GNUNET_free (ip);
-          rd.data = &v6;
-          rd.data_size = sizeof (v6);
-          rd.expiration_time = UINT64_MAX;
-          rd.record_type = GNUNET_DNSPARSER_TYPE_AAAA;
-          rd.flags = 0;
-          handle_gns2dns_result (rh,
-                                 1,
-                                 &rd);
-          return;
-        }
-
-        tld = GNS_get_tld (ip);
-        if (0 != strcmp (tld,
-                         "+"))
-        {
-          /* 'ip' is a DNS name */
-          g2dc->dns_rh = GNUNET_RESOLVER_ip_get (ip,
-                                                 AF_UNSPEC,
-                                                 GNUNET_TIME_UNIT_FOREVER_REL,
-                                                 &handle_gns2dns_ip,
-                                                 g2dc);
-          GNUNET_free (ip);
-          return;
-        }
-
-        /* 'ip' should be a GNS name */
-        g2dc->rh = GNUNET_new (struct GNS_ResolverHandle);
-
-        ip = translate_dot_plus (rh,
-                                 ip);
-        tld = GNS_get_tld (ip);
-        if (GNUNET_OK !=
-            GNUNET_GNSRECORD_zkey_to_pkey (tld,
-                                           &zone))
-        {
-          GNUNET_break_op (0);
-          GNUNET_free_non_null (ns);
-          GNUNET_free_non_null (ip);
-          GNUNET_free (g2dc);
-          fail_resolution (rh);
-          return;
-        }
-        g2dc->rh->authority_zone = zone;
-        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                    "Resolving `%s' to determine IP address of DNS server for GNS2DNS transition for `%s'\n",
-                    ip,
-                    ns);
-        g2dc->rh->name = ip;
-        g2dc->rh->name_resolution_pos = strlen (ip) - strlen (tld) - 1;
-        g2dc->rh->proc = &handle_gns2dns_result;
-        g2dc->rh->proc_cls = rh;
-        g2dc->rh->record_type = GNUNET_GNSRECORD_TYPE_ANY;
-        g2dc->rh->options = GNUNET_GNS_LO_DEFAULT;
-        g2dc->rh->loop_limiter = rh->loop_limiter + 1;
-        g2dc->rh->task_id
-          = GNUNET_SCHEDULER_add_now (&start_resolver_lookup,
-                                      g2dc->rh);
-        return;
-      }
-    case GNUNET_DNSPARSER_TYPE_CNAME:
-      {
-        char *cname;
-
-        off = 0;
-        cname = GNUNET_DNSPARSER_parse_name (rd[i].data,
-                                             rd[i].data_size,
-                                             &off);
-        if ( (NULL == cname) ||
-             (off != rd[i].data_size) )
-        {
-          GNUNET_break_op (0); /* record not well-formed */
-          rh->proc (rh->proc_cls, 0, NULL);
-          GNS_resolver_lookup_cancel (rh);
-          GNUNET_free_non_null (cname);
-          return;
-        }
-        handle_gns_cname_result (rh,
-                                 cname);
-        GNUNET_free (cname);
-        return;
-      }
-      /* FIXME: handle DNAME */
-    default:
-      /* skip */
-      break;
-    }
+    break;
   }
+ fail:
   GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
               _("GNS lookup recursion failed (no delegation record found)\n"));
-  rh->proc (rh->proc_cls,
-            0,
-            NULL);
-  GNS_resolver_lookup_cancel (rh);
+  fail_resolution (rh);
 }
 
 
@@ -2176,8 +2286,7 @@ handle_dht_response (void *cls,
   {
     /* how did this pass DHT block validation!? */
     GNUNET_break (0);
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   block = data;
@@ -2188,8 +2297,7 @@ handle_dht_response (void *cls,
   {
     /* how did this pass DHT block validation!? */
     GNUNET_break (0);
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   if (GNUNET_OK !=
@@ -2200,8 +2308,7 @@ handle_dht_response (void *cls,
                                       rh))
   {
     GNUNET_break_op (0); /* block was ill-formed */
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   if (0 == GNUNET_TIME_absolute_get_remaining (GNUNET_TIME_absolute_ntoh (block->expiration_time)).rel_value_us)
@@ -2252,8 +2359,7 @@ start_dht_request (struct GNS_ResolverHandle *rh,
     /* fail longest-standing DHT request */
     rx = GNUNET_CONTAINER_heap_peek (dht_lookup_heap);
     GNUNET_assert (NULL != rx);
-    rx->proc (rx->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rx);
+    fail_resolution (rx);
   }
 }
 
@@ -2324,8 +2430,7 @@ handle_namecache_block_response (void *cls,
                 "Resolution failed for `%s' in zone %s (DHT lookup not permitted by configuration)\n",
                 ac->label,
                 GNUNET_GNSRECORD_z2s (&ac->authority_info.gns_authority));
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -2373,7 +2478,7 @@ recursive_gns_resolution_namecache (struct GNS_ResolverHandle *rh)
   GNUNET_GNSRECORD_query_from_public_key (&ac->authority_info.gns_authority,
                                           ac->label,
                                           &query);
-  if (GNUNET_YES == use_cache)
+  if (GNUNET_YES != disable_cache)
   {
     rh->namecache_qe
       = GNUNET_NAMECACHE_lookup_block (namecache_handle,
@@ -2384,7 +2489,8 @@ recursive_gns_resolution_namecache (struct GNS_ResolverHandle *rh)
   }
   else
   {
-    start_dht_request (rh, &query);
+    start_dht_request (rh,
+                       &query);
   }
 }
 
@@ -2408,8 +2514,7 @@ handle_revocation_result (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 _("Zone %s was revoked, resolution fails\n"),
                 GNUNET_GNSRECORD_z2s (&ac->authority_info.gns_authority));
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   recursive_gns_resolution_namecache (rh);
@@ -2453,8 +2558,7 @@ recursive_resolution (void *cls)
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "Encountered unbounded recursion resolving `%s'\n",
                 rh->name);
-    rh->proc (rh->proc_cls, 0, NULL);
-    GNS_resolver_lookup_cancel (rh);
+    fail_resolution (rh);
     return;
   }
   if (GNUNET_YES == rh->ac_tail->gns_authority)
@@ -2491,8 +2595,12 @@ start_resolver_lookup (void *cls)
     rd.expiration_time = UINT64_MAX;
     rd.record_type = GNUNET_DNSPARSER_TYPE_A;
     rd.flags = 0;
-    rh->proc (rh->proc_cls, 1, &rd);
-    GNS_resolver_lookup_cancel (rh);
+    rh->proc (rh->proc_cls,
+              1,
+              &rd);
+    GNUNET_assert (NULL == rh->task_id);
+    rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                            rh);
     return;
   }
   if (1 == inet_pton (AF_INET6,
@@ -2507,8 +2615,12 @@ start_resolver_lookup (void *cls)
     rd.expiration_time = UINT64_MAX;
     rd.record_type = GNUNET_DNSPARSER_TYPE_AAAA;
     rd.flags = 0;
-    rh->proc (rh->proc_cls, 1, &rd);
-    GNS_resolver_lookup_cancel (rh);
+    rh->proc (rh->proc_cls,
+              1,
+              &rd);
+    GNUNET_assert (NULL == rh->task_id);
+    rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                            rh);
     return;
   }
 
@@ -2518,8 +2630,8 @@ start_resolver_lookup (void *cls)
   ac->suggested_shortening_label = NULL;
   if (NULL == ac->label)
     /* name was just the "TLD", so we default to label
-       #GNUNET_GNS_MASTERZONE_STR */
-    ac->label = GNUNET_strdup (GNUNET_GNS_MASTERZONE_STR);
+       #GNUNET_GNS_EMPTY_LABEL_AT */
+    ac->label = GNUNET_strdup (GNUNET_GNS_EMPTY_LABEL_AT);
   ac->gns_authority = GNUNET_YES;
   ac->authority_info.gns_authority = rh->authority_zone;
   GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
@@ -2587,37 +2699,51 @@ GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
   GNUNET_CONTAINER_DLL_remove (rlh_head,
                                rlh_tail,
                                rh);
+  if (NULL != rh->dns_request)
+  {
+    GNUNET_DNSSTUB_resolve_cancel (rh->dns_request);
+    rh->dns_request = NULL;
+  }
   while (NULL != (ac = rh->ac_head))
   {
     GNUNET_CONTAINER_DLL_remove (rh->ac_head,
                                  rh->ac_tail,
                                  ac);
+    if (GNUNET_NO == ac->gns_authority)
+    {
+      struct Gns2DnsPending *gp;
+
+      while (NULL != (gp = ac->authority_info.dns_authority.gp_head))
+      {
+        GNUNET_CONTAINER_DLL_remove (ac->authority_info.dns_authority.gp_head,
+                                     ac->authority_info.dns_authority.gp_tail,
+                                     gp);
+        if (NULL != gp->rh)
+        {
+          /* rh->g2dc->rh is NOT in the DLL yet, so to enable us
+             using GNS_resolver_lookup_cancel here, we need to
+             add it first... */
+          GNUNET_CONTAINER_DLL_insert (rlh_head,
+                                       rlh_tail,
+                                       gp->rh);
+          GNUNET_assert (NULL == gp->rh->task_id);
+          gp->rh->task_id = GNUNET_SCHEDULER_add_now (&GNS_resolver_lookup_cancel_,
+                                                      gp->rh);
+          gp->rh = NULL;
+        }
+        if (NULL != gp->dns_rh)
+        {
+          GNUNET_RESOLVER_request_cancel (gp->dns_rh);
+          gp->dns_rh = NULL;
+        }
+        GNUNET_free (gp);
+      }
+      GNUNET_DNSSTUB_stop (ac->authority_info.dns_authority.dns_handle);
+    }
     GNUNET_free (ac->label);
     GNUNET_free_non_null (ac->suggested_shortening_label);
     GNUNET_free (ac);
   }
-  if (NULL != rh->g2dc)
-  {
-    /* rh->g2dc->rh is NOT in the DLL yet, so to enable us
-       using GNS_resolver_lookup_cancel here, we need to
-       add it first... */
-    if (NULL != rh->g2dc->rh)
-    {
-      GNUNET_CONTAINER_DLL_insert (rlh_head,
-                                   rlh_tail,
-                                   rh->g2dc->rh);
-      GNS_resolver_lookup_cancel (rh->g2dc->rh);
-      rh->g2dc->rh = NULL;
-    }
-    if (NULL != rh->g2dc->dns_rh)
-    {
-      GNUNET_RESOLVER_request_cancel (rh->g2dc->dns_rh);
-      rh->g2dc->rh = NULL;
-    }
-    GNUNET_free (rh->g2dc->ns);
-    GNUNET_free (rh->g2dc);
-    rh->g2dc = NULL;
-  }
   if (NULL != rh->task_id)
   {
     GNUNET_SCHEDULER_cancel (rh->task_id);
@@ -2639,11 +2765,6 @@ GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
     GNUNET_free (vpn_ctx->rd_data);
     GNUNET_free (vpn_ctx);
   }
-  if (NULL != rh->dns_request)
-  {
-    GNUNET_DNSSTUB_resolve_cancel (rh->dns_request);
-    rh->dns_request = NULL;
-  }
   if (NULL != rh->namecache_qe)
   {
     GNUNET_NAMECACHE_cancel (rh->namecache_qe);
@@ -2690,34 +2811,18 @@ GNS_resolver_init (struct GNUNET_NAMECACHE_Handle *nc,
                    const struct GNUNET_CONFIGURATION_Handle *c,
                    unsigned long long max_bg_queries)
 {
-  char *dns_ip;
-
   cfg = c;
   namecache_handle = nc;
   dht_handle = dht;
   dht_lookup_heap =
     GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
   max_allowed_background_queries = max_bg_queries;
-  if (GNUNET_SYSERR == (use_cache =
-                        GNUNET_CONFIGURATION_get_value_yesno (c,
-                                                              "gns",
-                                                              "USE_CACHE")))
-    use_cache = GNUNET_YES;
-  if (GNUNET_NO == use_cache)
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+  disable_cache = GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                                        "namecache",
+                                                        "DISABLE");
+  if (GNUNET_YES == disable_cache)
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "Namecache disabled\n");
-
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_string (c,
-                                             "gns",
-                                             "DNS_RESOLVER",
-                                             &dns_ip))
-  {
-    /* user did not specify DNS resolver, use 8.8.8.8 */
-    dns_ip = GNUNET_strdup ("8.8.8.8");
-  }
-  dns_handle = GNUNET_DNSSTUB_start (dns_ip);
-  GNUNET_free (dns_ip);
   vpn_handle = GNUNET_VPN_connect (cfg);
 }
 
@@ -2734,7 +2839,9 @@ GNS_resolver_done ()
   /* abort active resolutions */
   while (NULL != (rh = rlh_head))
   {
-    rh->proc (rh->proc_cls, 0, NULL);
+    rh->proc (rh->proc_cls,
+              0,
+              NULL);
     GNS_resolver_lookup_cancel (rh);
   }
   while (NULL != (co = co_head))
@@ -2747,8 +2854,6 @@ GNS_resolver_done ()
   }
   GNUNET_CONTAINER_heap_destroy (dht_lookup_heap);
   dht_lookup_heap = NULL;
-  GNUNET_DNSSTUB_stop (dns_handle);
-  dns_handle = NULL;
   GNUNET_VPN_disconnect (vpn_handle);
   vpn_handle = NULL;
   dht_handle = NULL;
diff --git a/src/gns/test_gns_lookup.conf b/src/gns/test_gns_lookup.conf
index ea8c7c3fc..a9a2345c7 100644
--- a/src/gns/test_gns_lookup.conf
+++ b/src/gns/test_gns_lookup.conf
@@ -10,7 +10,7 @@ AUTOSTART = YES
 PLUGINS =
 
 [gns]
-#PREFIX = valgrind --leak-check=full --track-origins=yes
+# PREFIX = valgrind --leak-check=full --track-origins=yes
 AUTOSTART = YES
 AUTO_IMPORT_PKEY = YES
 MAX_PARALLEL_BACKGROUND_QUERIES = 10
diff --git a/src/gnsrecord/gnsrecord_crypto.c b/src/gnsrecord/gnsrecord_crypto.c
index 0fab97f06..cebc842f3 100644
--- a/src/gnsrecord/gnsrecord_crypto.c
+++ b/src/gnsrecord/gnsrecord_crypto.c
@@ -72,6 +72,7 @@ derive_block_aes_key (struct GNUNET_CRYPTO_SymmetricInitializationVector *iv,
  * Sign name and records
  *
  * @param key the private key
+ * @param pkey associated public key
  * @param expire block expiration
  * @param label the name for the records
  * @param rd record data
@@ -79,29 +80,29 @@ derive_block_aes_key (struct GNUNET_CRYPTO_SymmetricInitializationVector *iv,
  * @return NULL on error (block too large)
  */
 struct GNUNET_GNSRECORD_Block *
-GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
-                               struct GNUNET_TIME_Absolute expire,
-                               const char *label,
-                               const struct GNUNET_GNSRECORD_Data *rd,
-                               unsigned int rd_count)
+block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+              const struct GNUNET_CRYPTO_EcdsaPublicKey *pkey,
+              struct GNUNET_TIME_Absolute expire,
+              const char *label,
+              const struct GNUNET_GNSRECORD_Data *rd,
+              unsigned int rd_count)
 {
-  size_t payload_len = GNUNET_GNSRECORD_records_get_size (rd_count, rd);
+  size_t payload_len = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                          rd);
   char payload[sizeof (uint32_t) + payload_len];
   struct GNUNET_GNSRECORD_Block *block;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
   struct GNUNET_CRYPTO_EcdsaPrivateKey *dkey;
   struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
   struct GNUNET_CRYPTO_SymmetricSessionKey skey;
   struct GNUNET_GNSRECORD_Data rdc[rd_count];
   uint32_t rd_count_nbo;
-  unsigned int i;
   struct GNUNET_TIME_Absolute now;
 
   if (payload_len > GNUNET_GNSRECORD_MAX_BLOCK_SIZE)
     return NULL;
   /* convert relative to absolute times */
   now = GNUNET_TIME_absolute_get ();
-  for (i=0;i<rd_count;i++)
+  for (unsigned int i=0;i<rd_count;i++)
   {
     rdc[i] = rd[i];
     if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
@@ -116,13 +117,19 @@ GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
   }
   /* serialize */
   rd_count_nbo = htonl (rd_count);
-  GNUNET_memcpy (payload, &rd_count_nbo, sizeof (uint32_t));
+  GNUNET_memcpy (payload,
+                 &rd_count_nbo,
+                 sizeof (uint32_t));
   GNUNET_assert (payload_len ==
-                 GNUNET_GNSRECORD_records_serialize (rd_count, rdc,
-                                                     payload_len, &payload[sizeof (uint32_t)]));
+                 GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                     rdc,
+                                                     payload_len,
+                                                     &payload[sizeof (uint32_t)]));
   block = GNUNET_malloc (sizeof (struct GNUNET_GNSRECORD_Block) +
-                         sizeof (uint32_t) + payload_len);
-  block->purpose.size = htonl (sizeof (uint32_t) + payload_len +
+                         sizeof (uint32_t) +
+                         payload_len);
+  block->purpose.size = htonl (sizeof (uint32_t) +
+                               payload_len +
                                sizeof (struct GNUNET_CRYPTO_EccSignaturePurpose) +
                                sizeof (struct GNUNET_TIME_AbsoluteNBO));
   block->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
@@ -132,18 +139,21 @@ GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
                                                  label,
                                                  "gns");
   GNUNET_CRYPTO_ecdsa_key_get_public (dkey,
-                                    &block->derived_key);
-  GNUNET_CRYPTO_ecdsa_key_get_public (key,
-                                    &pkey);
-  derive_block_aes_key (&iv, &skey, label, &pkey);
+                                      &block->derived_key);
+  derive_block_aes_key (&iv,
+                        &skey,
+                        label,
+                        pkey);
   GNUNET_break (payload_len + sizeof (uint32_t) ==
-                GNUNET_CRYPTO_symmetric_encrypt (payload, payload_len + sizeof (uint32_t),
-                                                 &skey, &iv,
+                GNUNET_CRYPTO_symmetric_encrypt (payload,
+                                                 payload_len + sizeof (uint32_t),
+                                                 &skey,
+                                                 &iv,
                                                  &block[1]));
   if (GNUNET_OK !=
       GNUNET_CRYPTO_ecdsa_sign (dkey,
-                              &block->purpose,
-                              &block->signature))
+                                &block->purpose,
+                                &block->signature))
   {
     GNUNET_break (0);
     GNUNET_free (dkey);
@@ -156,6 +166,97 @@ GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
 
 
 /**
+ * Sign name and records
+ *
+ * @param key the private key
+ * @param expire block expiration
+ * @param label the name for the records
+ * @param rd record data
+ * @param rd_count number of records
+ * @return NULL on error (block too large)
+ */
+struct GNUNET_GNSRECORD_Block *
+GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+                               struct GNUNET_TIME_Absolute expire,
+                               const char *label,
+                               const struct GNUNET_GNSRECORD_Data *rd,
+                               unsigned int rd_count)
+{
+  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+
+  GNUNET_CRYPTO_ecdsa_key_get_public (key,
+                                      &pkey);
+  return block_create (key,
+                       &pkey,
+                       expire,
+                       label,
+                       rd,
+                       rd_count);
+}
+
+
+/**
+ * Line in cache mapping private keys to public keys.
+ */
+struct KeyCacheLine
+{
+  /**
+   * A private key.
+   */
+  struct GNUNET_CRYPTO_EcdsaPrivateKey key;
+
+  /**
+   * Associated public key.
+   */
+  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+
+};
+
+
+/**
+ * Sign name and records, cache derived public key (also keeps the
+ * private key in static memory, so do not use this function if
+ * keeping the private key in the process'es RAM is a major issue).
+ *
+ * @param key the private key
+ * @param expire block expiration
+ * @param label the name for the records
+ * @param rd record data
+ * @param rd_count number of records
+ * @return NULL on error (block too large)
+ */
+struct GNUNET_GNSRECORD_Block *
+GNUNET_GNSRECORD_block_create2 (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+                                struct GNUNET_TIME_Absolute expire,
+                                const char *label,
+                                const struct GNUNET_GNSRECORD_Data *rd,
+                                unsigned int rd_count)
+{
+#define CSIZE 64
+  static struct KeyCacheLine cache[CSIZE];
+  struct KeyCacheLine *line;
+
+  line = &cache[(*(unsigned int *) key) % CSIZE];
+  if (0 != memcmp (&line->key,
+                   key,
+                   sizeof (*key)))
+  {
+    /* cache miss, recompute */
+    line->key = *key;
+    GNUNET_CRYPTO_ecdsa_key_get_public (key,
+                                        &line->pkey);
+  }
+  return block_create (key,
+                       &line->pkey,
+                       expire,
+                       label,
+                       rd,
+                       rd_count);
+}
+
+
+
+/**
  * Check if a signature is valid.  This API is used by the GNS Block
  * to validate signatures received from the network.
  *
@@ -166,9 +267,9 @@ int
 GNUNET_GNSRECORD_block_verify (const struct GNUNET_GNSRECORD_Block *block)
 {
   return GNUNET_CRYPTO_ecdsa_verify (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN,
-                                   &block->purpose,
-                                   &block->signature,
-                                   &block->derived_key);
+                                     &block->purpose,
+                                     &block->signature,
+                                     &block->derived_key);
 }
 
 
@@ -224,9 +325,7 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
     }
     {
       struct GNUNET_GNSRECORD_Data rd[rd_count];
-      unsigned int i;
       unsigned int j;
-      unsigned int k;
       struct GNUNET_TIME_Absolute now;
 
       if (GNUNET_OK !=
@@ -241,7 +340,7 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
       /* hide expired records */
       now = GNUNET_TIME_absolute_get ();
       j = 0;
-      for (i=0;i<rd_count;i++)
+      for (unsigned int i=0;i<rd_count;i++)
       {
         if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
         {
@@ -254,7 +353,7 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
         {
           int include_record = GNUNET_YES;
           /* Shadow record, figure out if we have a not expired active record */
-          for (k=0;k<rd_count;k++)
+          for (unsigned int k=0;k<rd_count;k++)
           {
             if (k == i)
               continue;
@@ -283,7 +382,9 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
       }
       rd_count = j;
       if (NULL != proc)
-        proc (proc_cls, rd_count, (0 != rd_count) ? rd : NULL);
+        proc (proc_cls,
+              rd_count,
+              (0 != rd_count) ? rd : NULL);
     }
   }
   return GNUNET_OK;
@@ -304,8 +405,11 @@ GNUNET_GNSRECORD_query_from_private_key (const struct GNUNET_CRYPTO_EcdsaPrivate
 {
   struct GNUNET_CRYPTO_EcdsaPublicKey pub;
 
-  GNUNET_CRYPTO_ecdsa_key_get_public (zone, &pub);
-  GNUNET_GNSRECORD_query_from_public_key (&pub, label, query);
+  GNUNET_CRYPTO_ecdsa_key_get_public (zone,
+                                      &pub);
+  GNUNET_GNSRECORD_query_from_public_key (&pub,
+                                          label,
+                                          query);
 }
 
 
@@ -323,8 +427,13 @@ GNUNET_GNSRECORD_query_from_public_key (const struct GNUNET_CRYPTO_EcdsaPublicKe
 {
   struct GNUNET_CRYPTO_EcdsaPublicKey pd;
 
-  GNUNET_CRYPTO_ecdsa_public_key_derive (pub, label, "gns", &pd);
-  GNUNET_CRYPTO_hash (&pd, sizeof (pd), query);
+  GNUNET_CRYPTO_ecdsa_public_key_derive (pub,
+                                         label,
+                                         "gns",
+                                         &pd);
+  GNUNET_CRYPTO_hash (&pd,
+                      sizeof (pd),
+                      query);
 }
 
 
diff --git a/src/gnsrecord/gnsrecord_misc.c b/src/gnsrecord/gnsrecord_misc.c
index 3c1ead437..05f56cf70 100644
--- a/src/gnsrecord/gnsrecord_misc.c
+++ b/src/gnsrecord/gnsrecord_misc.c
@@ -152,8 +152,6 @@ struct GNUNET_TIME_Absolute
 GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
                                              const struct GNUNET_GNSRECORD_Data *rd)
 {
-  unsigned int c;
-  unsigned int c2;
   struct GNUNET_TIME_Absolute expire;
   struct GNUNET_TIME_Absolute at;
   struct GNUNET_TIME_Relative rt;
@@ -163,7 +161,7 @@ GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
   if (NULL == rd)
     return GNUNET_TIME_UNIT_ZERO_ABS;
   expire = GNUNET_TIME_UNIT_FOREVER_ABS;
-  for (c = 0; c < rd_count; c++)
+  for (unsigned int c = 0; c < rd_count; c++)
   {
     if (0 != (rd[c].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
     {
@@ -175,12 +173,12 @@ GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
       at.abs_value_us = rd[c].expiration_time;
     }
 
-    for (c2 = 0; c2 < rd_count; c2++)
+    for (unsigned int c2 = 0; c2 < rd_count; c2++)
     {
       /* Check for shadow record */
-      if ((c == c2) ||
-          (rd[c].record_type != rd[c2].record_type) ||
-          (0 == (rd[c2].flags & GNUNET_GNSRECORD_RF_SHADOW_RECORD)))
+      if ( (c == c2) ||
+           (rd[c].record_type != rd[c2].record_type) ||
+           (0 == (rd[c2].flags & GNUNET_GNSRECORD_RF_SHADOW_RECORD)) )
           continue;
       /* We have a shadow record */
       if (0 != (rd[c2].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
@@ -192,9 +190,11 @@ GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
       {
         at_shadow.abs_value_us = rd[c2].expiration_time;
       }
-      at = GNUNET_TIME_absolute_max (at, at_shadow);
+      at = GNUNET_TIME_absolute_max (at,
+                                     at_shadow);
     }
-    expire = GNUNET_TIME_absolute_min (at, expire);
+    expire = GNUNET_TIME_absolute_min (at, 
+                                       expire);
   }
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Determined expiration time for block with %u records to be %s\n",
diff --git a/src/gnsrecord/test_gnsrecord_crypto.c b/src/gnsrecord/test_gnsrecord_crypto.c
index 24fe2ad36..1df3f3730 100644
--- a/src/gnsrecord/test_gnsrecord_crypto.c
+++ b/src/gnsrecord/test_gnsrecord_crypto.c
@@ -52,11 +52,10 @@ static int res;
 static struct GNUNET_GNSRECORD_Data *
 create_record (int count)
 {
-  unsigned int c;
   struct GNUNET_GNSRECORD_Data *rd;
 
   rd = GNUNET_malloc (count * sizeof (struct GNUNET_GNSRECORD_Data));
-  for (c = 0; c < count; c++)
+  for (unsigned int c = 0; c < count; c++)
   {
     rd[c].expiration_time = GNUNET_TIME_absolute_get().abs_value_us + 1000000000;
     rd[c].record_type = TEST_RECORD_TYPE;
@@ -74,17 +73,19 @@ rd_decrypt_cb (void *cls,
                const struct GNUNET_GNSRECORD_Data *rd)
 {
   char rd_cmp_data[TEST_RECORD_DATALEN];
-  int c;
 
   GNUNET_assert (RECORDS == rd_count);
   GNUNET_assert (NULL != rd);
-
-  memset (rd_cmp_data, 'a', TEST_RECORD_DATALEN);
-  for (c = 0; c < rd_count; c++)
+  memset (rd_cmp_data,
+          'a',
+          TEST_RECORD_DATALEN);
+  for (unsigned int c = 0; c < rd_count; c++)
   {
     GNUNET_assert (TEST_RECORD_TYPE == rd[c].record_type);
     GNUNET_assert (TEST_RECORD_DATALEN == rd[c].data_size);
-    GNUNET_assert (0 == memcmp (&rd_cmp_data, rd[c].data, TEST_RECORD_DATALEN));
+    GNUNET_assert (0 == memcmp (&rd_cmp_data,
+                                rd[c].data,
+                                TEST_RECORD_DATALEN));
   }
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Block was decrypted successfully \n");
@@ -93,37 +94,53 @@ rd_decrypt_cb (void *cls,
 }
 
 static void
-run (void *cls, char *const *args, const char *cfgfile,
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
      const struct GNUNET_CONFIGURATION_Handle *cfg)
 {
   struct GNUNET_GNSRECORD_Block *block;
   struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+  struct GNUNET_HashCode query_pub;
+  struct GNUNET_HashCode query_priv;
 
-  /* load privat key */
-  char *hostkey_file;
-  GNUNET_asprintf(&hostkey_file,
-                  "zonefiles%s%s",
-                  DIR_SEPARATOR_STR,
-                  "N0UJMP015AFUNR2BTNM3FKPBLG38913BL8IDMCO2H0A1LIB81960.zkey");
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Using zonekey file `%s'\n",
-              hostkey_file);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create_from_file(hostkey_file);
-  GNUNET_free (hostkey_file);
-  GNUNET_assert (privkey != NULL);
+  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
+  GNUNET_assert (NULL != privkey);
   struct GNUNET_TIME_Absolute expire = GNUNET_TIME_absolute_get();
-  /* get public key */
-  GNUNET_CRYPTO_ecdsa_key_get_public(privkey, &pubkey);
 
+  /* get public key */
+  GNUNET_CRYPTO_ecdsa_key_get_public (privkey,
+                                      &pubkey);
+
+  /* test query derivation */
+  GNUNET_GNSRECORD_query_from_private_key (privkey,
+                                           "testlabel",
+                                           &query_priv);
+  GNUNET_GNSRECORD_query_from_public_key (&pubkey,
+                                          "testlabel",
+                                          &query_pub);
+  GNUNET_assert (0 == memcmp (&query_priv,
+                              &query_pub,
+                              sizeof (struct GNUNET_HashCode)));
   /* create record */
   s_name = "DUMMY.dummy.gnunet";
   s_rd = create_record (RECORDS);
 
   /* Create block */
-  GNUNET_assert (NULL != (block = GNUNET_GNSRECORD_block_create (privkey, expire,s_name, s_rd, RECORDS)));
-  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_verify (block));
-  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_decrypt (block, &pubkey, s_name, &rd_decrypt_cb, s_name));
-
+  GNUNET_assert (NULL != (block =
+                          GNUNET_GNSRECORD_block_create (privkey,
+                                                         expire,
+                                                         s_name,
+                                                         s_rd,
+                                                         RECORDS)));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_GNSRECORD_block_verify (block));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_GNSRECORD_block_decrypt (block,
+                                                 &pubkey,
+                                                 s_name,
+                                                 &rd_decrypt_cb,
+                                                 s_name));
   GNUNET_free (block);
 }
 
@@ -131,7 +148,8 @@ run (void *cls, char *const *args, const char *cfgfile,
 int
 main (int argc, char *argv[])
 {
-  static char *const argvx[] = { "test-gnsrecord-crypto",
+  static char *const argvx[] = {
+    "test-gnsrecord-crypto",
     NULL
   };
   static struct GNUNET_GETOPT_CommandLineOption options[] = {
@@ -139,8 +157,11 @@ main (int argc, char *argv[])
   };
 
   res = 1;
-  GNUNET_PROGRAM_run ((sizeof (argvx) / sizeof (char *)) - 1, argvx, "test-namestore-api",
-                      "nohelp", options, &run, &res);
+  GNUNET_PROGRAM_run ((sizeof (argvx) / sizeof (char *)) - 1,
+                      argvx,
+                      "test-gnsrecord-crypto",
+                      "nohelp", options,
+                      &run, &res);
   return res;
 }
 
diff --git a/src/identity-provider/gnunet-service-identity-provider.c b/src/identity-provider/gnunet-service-identity-provider.c
index 572202c3f..6afb7bb05 100644
--- a/src/identity-provider/gnunet-service-identity-provider.c
+++ b/src/identity-provider/gnunet-service-identity-provider.c
@@ -2190,12 +2190,15 @@ attr_iter_cb (void *cls,
 
   if (rd_count != 1)
   {
-    GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it);
+    GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it,
+                                         1);
     return;
   }
 
-  if (GNUNET_GNSRECORD_TYPE_ID_ATTR != rd->record_type) {
-    GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it);
+  if (GNUNET_GNSRECORD_TYPE_ID_ATTR != rd->record_type)
+  {
+    GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it,
+                                         1);
     return;
   }
   attr_ver = ntohl(*((uint32_t*)rd->data));
@@ -2209,8 +2212,10 @@ attr_iter_cb (void *cls,
                                             rd->data_size-sizeof (uint32_t),
                                             key,
                                             (void**)&attr_ser);
-  if (GNUNET_SYSERR == msg_extra_len) {
-    GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it);
+  if (GNUNET_SYSERR == msg_extra_len)
+  {
+    GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it,
+                                         1);
     return;
   }
 
@@ -2253,13 +2258,15 @@ iterate_after_abe_bootstrap (void *cls,
                                                      ai);
 }
 
-void
+
+static void
 iterate_next_after_abe_bootstrap (void *cls,
                                   struct GNUNET_ABE_AbeMasterKey *abe_key)
 {
   struct AttributeIterator *ai = cls;
   ai->abe_key = abe_key;
-  GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it);
+  GNUNET_NAMESTORE_zone_iterator_next (ai->ns_it,
+                                       1);
 }
 
 
diff --git a/src/identity-provider/plugin_rest_openid_connect.c b/src/identity-provider/plugin_rest_openid_connect.c
index 7e8054e60..125bb98f6 100644
--- a/src/identity-provider/plugin_rest_openid_connect.c
+++ b/src/identity-provider/plugin_rest_openid_connect.c
@@ -1076,16 +1076,19 @@ namestore_iteration_callback (
     }
   }
 
-  GNUNET_NAMESTORE_zone_iterator_next (handle->namestore_handle_it);
+  GNUNET_NAMESTORE_zone_iterator_next (handle->namestore_handle_it,
+                                       1);
 }
 
+
 /**
  * Iteration over all results finished, build final
  * response.
  *
  * @param cls the `struct RequestHandle`
  */
-static void namestore_iteration_finished (void *cls)
+static void
+namestore_iteration_finished (void *cls)
 {
   struct RequestHandle *handle = cls;
   struct GNUNET_HashCode cache_key;
diff --git a/src/include/gnunet_dht_service.h b/src/include/gnunet_dht_service.h
index d798482e3..a4c63889e 100644
--- a/src/include/gnunet_dht_service.h
+++ b/src/include/gnunet_dht_service.h
@@ -142,22 +142,6 @@ struct GNUNET_DHT_PutHandle;
 
 
 /**
- * Type of a PUT continuation.  You must not call
- * #GNUNET_DHT_disconnect in this continuation.
- *
- * @param cls closure
- * @param success #GNUNET_OK if the PUT was transmitted,
- *                #GNUNET_NO on timeout,
- *                #GNUNET_SYSERR on disconnect from service
- *                after the PUT message was transmitted
- *                (so we don't know if it was received or not)
- */
-typedef void
-(*GNUNET_DHT_PutContinuation)(void *cls,
-                              int success);
-
-
-/**
  * Perform a PUT operation storing data in the DHT.
  *
  * @param handle handle to DHT service
@@ -184,7 +168,7 @@ GNUNET_DHT_put (struct GNUNET_DHT_Handle *handle,
                 size_t size,
                 const void *data,
                 struct GNUNET_TIME_Absolute exp,
-                GNUNET_DHT_PutContinuation cont,
+                GNUNET_SCHEDULER_TaskCallback cont,
                 void *cont_cls);
 
 
diff --git a/src/include/gnunet_dnsstub_lib.h b/src/include/gnunet_dnsstub_lib.h
index 1c3305f7b..41e30d044 100644
--- a/src/include/gnunet_dnsstub_lib.h
+++ b/src/include/gnunet_dnsstub_lib.h
@@ -1,6 +1,6 @@
 /*
       This file is part of GNUnet
-      Copyright (C) 2012 GNUnet e.V.
+      Copyright (C) 2012, 2018 GNUnet e.V.
 
       GNUnet is free software; you can redistribute it and/or modify
       it under the terms of the GNU General Public License as published
@@ -48,14 +48,52 @@ struct GNUNET_DNSSTUB_RequestSocket;
 /**
  * Start a DNS stub resolver.
  *
- * @param dns_ip target IP address to use
+ * @param num_sockets how many sockets should we open
+ *        in parallel for DNS queries for this stub?
  * @return NULL on error
  */
 struct GNUNET_DNSSTUB_Context *
-GNUNET_DNSSTUB_start (const char *dns_ip);
+GNUNET_DNSSTUB_start (unsigned int num_sockets);
 
 
 /**
+ * Add nameserver for use by the DNSSTUB.  We will use
+ * all provided nameservers for resolution (round-robin).
+ *
+ * @param ctx resolver context to modify
+ * @param dns_ip target IP address to use (as string)
+ * @return #GNUNET_OK on success
+ */
+int
+GNUNET_DNSSTUB_add_dns_ip (struct GNUNET_DNSSTUB_Context *ctx,
+                           const char *dns_ip);
+
+
+/**
+ * Add nameserver for use by the DNSSTUB.  We will use
+ * all provided nameservers for resolution (round-robin).
+ *
+ * @param ctx resolver context to modify
+ * @param sa socket address of DNS resolver to use
+ * @return #GNUNET_OK on success
+ */
+int
+GNUNET_DNSSTUB_add_dns_sa (struct GNUNET_DNSSTUB_Context *ctx,
+                           const struct sockaddr *sa);
+
+
+/**
+ * How long should we try requests before timing out?
+ * Only effective for requests issued after this call.
+ *
+ * @param ctx resolver context to modify
+ * @param retry_frequ how long to wait between retries
+ */
+void
+GNUNET_DNSSTUB_set_retry (struct GNUNET_DNSSTUB_Context *ctx,
+                          struct GNUNET_TIME_Relative retry_freq);
+
+/**
  * Cleanup DNSSTUB resolver.
  *
  * @param ctx stub resolver to clean up
@@ -66,57 +104,36 @@ GNUNET_DNSSTUB_stop (struct GNUNET_DNSSTUB_Context *ctx);
 
 /**
  * Function called with the result of a DNS resolution.
+ * Once this function is called, the resolution request
+ * is automatically cancelled / cleaned up.  In particular,
+ * the function will only be called once.
  *
  * @param cls closure
- * @param rs socket that received the response
- * @param dns dns response, never NULL
+ * @param dns dns response, NULL on hard error (i.e. timeout)
  * @param dns_len number of bytes in @a dns
  */
 typedef void
 (*GNUNET_DNSSTUB_ResultCallback)(void *cls,
-                                 struct GNUNET_DNSSTUB_RequestSocket *rs,
                                  const struct GNUNET_TUN_DnsHeader *dns,
                                  size_t dns_len);
 
 
 /**
- * Perform DNS resolution using given address.
- *
- * @param ctx stub resolver to use
- * @param sa the socket address
- * @param sa_len the socket length
- * @param request DNS request to transmit
- * @param request_len number of bytes in msg
- * @param rc function to call with result
- * @param rc_cls closure for @a rc
- * @return socket used for the request, NULL on error
- */
-struct GNUNET_DNSSTUB_RequestSocket *
-GNUNET_DNSSTUB_resolve (struct GNUNET_DNSSTUB_Context *ctx,
-                        const struct sockaddr *sa,
-                        socklen_t sa_len,
-                        const void *request,
-                        size_t request_len,
-                        GNUNET_DNSSTUB_ResultCallback rc,
-                        void *rc_cls);
-
-
-/**
  * Perform DNS resolution using our default IP from init.
  *
  * @param ctx stub resolver to use
  * @param request DNS request to transmit
  * @param request_len number of bytes in msg
- * @param rc function to call with result
+ * @param rc function to call with result (once)
  * @param rc_cls closure for @a rc
  * @return socket used for the request, NULL on error
  */
 struct GNUNET_DNSSTUB_RequestSocket *
-GNUNET_DNSSTUB_resolve2 (struct GNUNET_DNSSTUB_Context *ctx,
-                         const void *request,
-                         size_t request_len,
-                         GNUNET_DNSSTUB_ResultCallback rc,
-                         void *rc_cls);
+GNUNET_DNSSTUB_resolve (struct GNUNET_DNSSTUB_Context *ctx,
+                        const void *request,
+                        size_t request_len,
+                        GNUNET_DNSSTUB_ResultCallback rc,
+                        void *rc_cls);
 
 
 /**
diff --git a/src/include/gnunet_gns_service.h b/src/include/gnunet_gns_service.h
index 8c1f64783..ff3110406 100644
--- a/src/include/gnunet_gns_service.h
+++ b/src/include/gnunet_gns_service.h
@@ -48,13 +48,10 @@ extern "C"
 
 
 /**
- * String we use to indicate the local master zone or a
- * root entry in the current zone.
- *
- * FIXME: probably should be changed to "@" and renamed
- * (this name is confusing!)
+ * String we use to indicate an empty label (top-level
+ * entry in the zone).  DNS uses "@", so do we.
  */
-#define GNUNET_GNS_MASTERZONE_STR "+"
+#define GNUNET_GNS_EMPTY_LABEL_AT "@"
 
 /**
  * Connection to the GNS service.
diff --git a/src/include/gnunet_gnsrecord_lib.h b/src/include/gnunet_gnsrecord_lib.h
index d03b4db3b..38346ada3 100644
--- a/src/include/gnunet_gnsrecord_lib.h
+++ b/src/include/gnunet_gnsrecord_lib.h
@@ -342,9 +342,10 @@ GNUNET_NETWORK_STRUCT_END
  * @param rd_count number of entries in @a rd array
  * @param rd array of records with data to store
  */
-typedef void (*GNUNET_GNSRECORD_RecordCallback) (void *cls,
-                                                 unsigned int rd_count,
-                                                 const struct GNUNET_GNSRECORD_Data *rd);
+typedef void
+(*GNUNET_GNSRECORD_RecordCallback) (void *cls,
+                                    unsigned int rd_count,
+                                    const struct GNUNET_GNSRECORD_Data *rd);
 
 
 
@@ -557,6 +558,25 @@ GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
 
 
 /**
+ * Sign name and records, cache derived public key (also keeps the
+ * private key in static memory, so do not use this function if
+ * keeping the private key in the process'es RAM is a major issue).
+ *
+ * @param key the private key
+ * @param expire block expiration
+ * @param label the name for the records
+ * @param rd record data
+ * @param rd_count number of records in @a rd
+ */
+struct GNUNET_GNSRECORD_Block *
+GNUNET_GNSRECORD_block_create2 (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+                                struct GNUNET_TIME_Absolute expire,
+                                const char *label,
+                                const struct GNUNET_GNSRECORD_Data *rd,
+                                unsigned int rd_count);
+
+
+/**
  * Check if a signature is valid.  This API is used by the GNS Block
  * to validate signatures received from the network.
  *
diff --git a/src/include/gnunet_namestore_plugin.h b/src/include/gnunet_namestore_plugin.h
index 3ebf48987..e15068222 100644
--- a/src/include/gnunet_namestore_plugin.h
+++ b/src/include/gnunet_namestore_plugin.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2012, 2013 GNUnet e.V.
+     Copyright (C) 2012, 2013, 2018 GNUnet e.V.
 
      GNUnet is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
@@ -47,6 +47,7 @@ extern "C"
  * Function called for each matching record.
  *
  * @param cls closure
+ * @param serial unique serial number of the record
  * @param zone_key private key of the zone
  * @param label name that is being mapped (at most 255 characters long)
  * @param rd_count number of entries in @a rd array
@@ -54,6 +55,7 @@ extern "C"
  */
 typedef void
 (*GNUNET_NAMESTORE_RecordIterator) (void *cls,
+                                    uint64_t serial,
                                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *private_key,
                                     const char *label,
                                     unsigned int rd_count,
@@ -97,7 +99,7 @@ struct GNUNET_NAMESTORE_PluginFunctions
    * @param label name of the record in the zone
    * @param iter function to call with the result
    * @param iter_cls closure for @a iter
-   * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+   * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
    */
   int
   (*lookup_records) (void *cls,
@@ -109,19 +111,21 @@ struct GNUNET_NAMESTORE_PluginFunctions
 
   /**
    * Iterate over the results for a particular zone in the
-   * datastore.  Will return at most one result to the iterator.
+   * datastore.  Will return at most @a limit results to the iterator.
    *
    * @param cls closure (internal context for the plugin)
    * @param zone private key of the zone, NULL for all zones
-   * @param offset offset in the list of all matching records
+   * @param serial serial (to exclude) in the list of matching records
+   * @param limit maximum number of results to return to @a iter
    * @param iter function to call with the result
    * @param iter_cls closure for @a iter
-   * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+   * @return #GNUNET_OK on success, #GNUNET_NO if there were no more results, #GNUNET_SYSERR on error
    */
   int
   (*iterate_records) (void *cls,
                       const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
-                      uint64_t offset,
+                      uint64_t serial,
+                      uint64_t limit,
                       GNUNET_NAMESTORE_RecordIterator iter,
                       void *iter_cls);
 
diff --git a/src/include/gnunet_namestore_service.h b/src/include/gnunet_namestore_service.h
index f8c2eaf3b..4828f72ad 100644
--- a/src/include/gnunet_namestore_service.h
+++ b/src/include/gnunet_namestore_service.h
@@ -267,9 +267,12 @@ GNUNET_NAMESTORE_zone_iteration_start (struct GNUNET_NAMESTORE_Handle *h,
  * for the next record.
  *
  * @param it the iterator
+ * @param limit number of records to return to the iterator in one shot
+ *         (before #GNUNET_NAMESTORE_zone_iterator_next is to be called again)
  */
 void
-GNUNET_NAMESTORE_zone_iterator_next (struct GNUNET_NAMESTORE_ZoneIterator *it);
+GNUNET_NAMESTORE_zone_iterator_next (struct GNUNET_NAMESTORE_ZoneIterator *it,
+                                     uint64_t limit);
 
 
 /**
diff --git a/src/include/gnunet_protocols.h b/src/include/gnunet_protocols.h
index d692b28ff..bf1b48679 100644
--- a/src/include/gnunet_protocols.h
+++ b/src/include/gnunet_protocols.h
@@ -624,11 +624,6 @@ extern "C"
 #define GNUNET_MESSAGE_TYPE_DHT_MONITOR_STOP             154
 
 /**
- * Acknowledge receiving PUT request
- */
-#define GNUNET_MESSAGE_TYPE_DHT_CLIENT_PUT_OK             155
-
-/**
  * Certain results are already known to the client, filter those.
  */
 #define GNUNET_MESSAGE_TYPE_DHT_CLIENT_GET_RESULTS_KNOWN             156
diff --git a/src/namecache/namecache.conf.in b/src/namecache/namecache.conf.in
index 236cafecd..becd34187 100644
--- a/src/namecache/namecache.conf.in
+++ b/src/namecache/namecache.conf.in
@@ -11,6 +11,11 @@ ACCEPT_FROM = 127.0.0.1;
 ACCEPT_FROM6 = ::1;
 DATABASE = sqlite
 
+# Disables use of caching by GNS. Useful for systems that
+# publish very large zones and are CPU bound, if they do not
+# also do a large number of lookups.
+DISABLE = NO
+
 [namecache-sqlite]
 FILENAME = $GNUNET_DATA_HOME/namecache/sqlite.db
 
diff --git a/src/namecache/plugin_namecache_sqlite.c b/src/namecache/plugin_namecache_sqlite.c
index 37d6d3b62..e0f64a6b0 100644
--- a/src/namecache/plugin_namecache_sqlite.c
+++ b/src/namecache/plugin_namecache_sqlite.c
@@ -136,13 +136,16 @@ create_indices (sqlite3 * dbh)
 {
   /* create indices */
   if ( (SQLITE_OK !=
-        sqlite3_exec (dbh, "CREATE INDEX IF NOT EXISTS ir_query_hash ON ns096blocks (query,expiration_time)",
+        sqlite3_exec (dbh,
+                      "CREATE INDEX IF NOT EXISTS ir_query_hash ON ns096blocks (query,expiration_time)",
                       NULL, NULL, NULL)) ||
        (SQLITE_OK !=
-        sqlite3_exec (dbh, "CREATE INDEX IF NOT EXISTS ir_block_expiration ON ns096blocks (expiration_time)",
+        sqlite3_exec (dbh,
+                      "CREATE INDEX IF NOT EXISTS ir_block_expiration ON ns096blocks (expiration_time)",
                       NULL, NULL, NULL)) )
     LOG (GNUNET_ERROR_TYPE_ERROR,
-         "Failed to create indices: %s\n", sqlite3_errmsg (dbh));
+         "Failed to create indices: %s\n",
+         sqlite3_errmsg (dbh));
 }
 
 
@@ -208,28 +211,44 @@ database_setup (struct Plugin *plugin)
     return GNUNET_SYSERR;
   }
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA temp_store=MEMORY", NULL, NULL,
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA temp_store=MEMORY",
+                       NULL, NULL,
                        ENULL));
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA synchronous=NORMAL", NULL, NULL,
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA synchronous=NORMAL",
+                       NULL, NULL,
                        ENULL));
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA legacy_file_format=OFF", NULL, NULL,
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA legacy_file_format=OFF",
+                       NULL, NULL,
                        ENULL));
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA auto_vacuum=INCREMENTAL", NULL,
-                       NULL, ENULL));
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA auto_vacuum=INCREMENTAL",
+                       NULL, NULL,
+                       ENULL));
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA encoding=\"UTF-8\"", NULL,
-                       NULL, ENULL));
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA encoding=\"UTF-8\"",
+                       NULL, NULL,
+                       ENULL));
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA locking_mode=EXCLUSIVE", NULL, NULL,
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA locking_mode=EXCLUSIVE",
+                       NULL, NULL,
                        ENULL));
   CHECK (SQLITE_OK ==
-         sqlite3_exec (plugin->dbh, "PRAGMA page_size=4092", NULL, NULL,
+         sqlite3_exec (plugin->dbh,
+                       "PRAGMA page_size=4092",
+                       NULL, NULL,
                        ENULL));
 
-  CHECK (SQLITE_OK == sqlite3_busy_timeout (plugin->dbh, BUSY_TIMEOUT_MS));
+  CHECK (SQLITE_OK ==
+         sqlite3_busy_timeout (plugin->dbh,
+                               BUSY_TIMEOUT_MS));
 
 
   /* Create tables */
@@ -237,17 +256,19 @@ database_setup (struct Plugin *plugin)
          sq_prepare (plugin->dbh,
                      "SELECT 1 FROM sqlite_master WHERE tbl_name = 'ns096blocks'",
                      &stmt));
-  if ((sqlite3_step (stmt) == SQLITE_DONE) &&
-      (sqlite3_exec
-       (plugin->dbh,
-        "CREATE TABLE ns096blocks ("
-        " query BLOB NOT NULL,"
-        " block BLOB NOT NULL,"
-        " expiration_time INT8 NOT NULL"
-        ")",
-        NULL, NULL, NULL) != SQLITE_OK))
+  if ( (sqlite3_step (stmt) == SQLITE_DONE) &&
+       (SQLITE_OK !=
+        sqlite3_exec (plugin->dbh,
+                      "CREATE TABLE ns096blocks ("
+                      " query BLOB NOT NULL,"
+                      " block BLOB NOT NULL,"
+                      " expiration_time INT8 NOT NULL"
+                      ")",
+                      NULL, NULL, NULL)) )
   {
-    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR, "sqlite3_exec");
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR,
+                "sqlite3_exec");
     sqlite3_finalize (stmt);
     return GNUNET_SYSERR;
   }
@@ -411,11 +432,11 @@ namecache_sqlite_cache_block (void *cls,
   GNUNET_CRYPTO_hash (&block->derived_key,
                       sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey),
                       &query);
-  fprintf (stderr,
-           "Caching new version of block %s (expires %llu)\n",
-           GNUNET_h2s (&query),
-           (unsigned long long) expiration.abs_value_us);
   expiration = GNUNET_TIME_absolute_ntoh (block->expiration_time);
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Caching new version of block %s (expires %s)\n",
+              GNUNET_h2s (&query),
+              GNUNET_STRINGS_absolute_time_to_string (expiration));
   if (block_size > 64 * 65536)
   {
     GNUNET_break (0);
diff --git a/src/namestore/.gitignore b/src/namestore/.gitignore
index 9a4c615ba..e56271eac 100644
--- a/src/namestore/.gitignore
+++ b/src/namestore/.gitignore
@@ -20,3 +20,51 @@ test_plugin_namestore_postgres
 test_plugin_namestore_sqlite
 test_plugin_namestore_flat
 gnunet-zoneimport
+test_namestore_api_lookup_nick_flat
+test_namestore_api_lookup_nick_postgres
+test_namestore_api_lookup_nick_sqlite
+test_namestore_api_lookup_private_flat
+test_namestore_api_lookup_private_postgres
+test_namestore_api_lookup_private_sqlite
+test_namestore_api_lookup_public_flat
+test_namestore_api_lookup_public_postgres
+test_namestore_api_lookup_public_sqlite
+test_namestore_api_lookup_shadow_filter_flat
+test_namestore_api_lookup_shadow_filter_postgres
+test_namestore_api_lookup_shadow_filter_sqlite
+test_namestore_api_lookup_shadow_flat
+test_namestore_api_lookup_shadow_postgres
+test_namestore_api_lookup_shadow_sqlite
+test_namestore_api_monitoring_existing_flat
+test_namestore_api_monitoring_existing_postgres
+test_namestore_api_monitoring_existing_sqlite
+test_namestore_api_monitoring_flat
+test_namestore_api_monitoring_postgres
+test_namestore_api_monitoring_sqlite
+test_namestore_api_remove_flat
+test_namestore_api_remove_not_existing_record_flat
+test_namestore_api_remove_not_existing_record_postgres
+test_namestore_api_remove_not_existing_record_sqlite
+test_namestore_api_remove_postgres
+test_namestore_api_remove_sqlite
+test_namestore_api_store_flat
+test_namestore_api_store_postgres
+test_namestore_api_store_sqlite
+test_namestore_api_store_update_flat
+test_namestore_api_store_update_postgres
+test_namestore_api_store_update_sqlite
+test_namestore_api_zone_iteration_flat
+test_namestore_api_zone_iteration_nick_flat
+test_namestore_api_zone_iteration_nick_postgres
+test_namestore_api_zone_iteration_nick_sqlite
+test_namestore_api_zone_iteration_postgres
+test_namestore_api_zone_iteration_specific_zone_flat
+test_namestore_api_zone_iteration_specific_zone_postgres
+test_namestore_api_zone_iteration_specific_zone_sqlite
+test_namestore_api_zone_iteration_sqlite
+test_namestore_api_zone_iteration_stop_flat
+test_namestore_api_zone_iteration_stop_postgres
+test_namestore_api_zone_iteration_stop_sqlite
+test_namestore_api_zone_to_name_flat
+test_namestore_api_zone_to_name_postgres
+test_namestore_api_zone_to_name_sqlite
diff --git a/src/namestore/Makefile.am b/src/namestore/Makefile.am
index fd8f8054f..fa85cc060 100644
--- a/src/namestore/Makefile.am
+++ b/src/namestore/Makefile.am
@@ -20,74 +20,81 @@ if USE_COVERAGE
   XLIBS = -lgcov
 endif
 
-if HAVE_EXPERIMENTAL
 FLAT_PLUGIN = libgnunet_plugin_namestore_flat.la
 if HAVE_TESTING
-FLAT_TESTS = test_plugin_namestore_flat
-endif
+FLAT_TESTS = test_plugin_namestore_flat \
+ test_namestore_api_store_flat \
+ test_namestore_api_store_update_flat \
+ test_namestore_api_remove_flat \
+ test_namestore_api_zone_iteration_flat \
+ test_namestore_api_lookup_nick_flat \
+ test_namestore_api_monitoring_flat \
+ test_namestore_api_lookup_public_flat \
+ test_namestore_api_lookup_private_flat \
+ test_namestore_api_lookup_shadow_flat \
+ test_namestore_api_lookup_shadow_filter_flat \
+ test_namestore_api_remove_not_existing_record_flat \
+ test_namestore_api_zone_iteration_nick_flat \
+ test_namestore_api_zone_iteration_specific_zone_flat \
+ test_namestore_api_zone_iteration_stop_flat \
+ test_namestore_api_monitoring_existing_flat \
+ test_namestore_api_zone_to_name_flat \
+ perf_namestore_api_zone_iteration_flat
 endif
 
 if HAVE_SQLITE
 SQLITE_PLUGIN = libgnunet_plugin_namestore_sqlite.la
 if HAVE_TESTING
-SQLITE_TESTS = test_plugin_namestore_sqlite
+SQLITE_TESTS = test_plugin_namestore_sqlite \
+ test_namestore_api_store_sqlite \
+ test_namestore_api_store_update_sqlite \
+ test_namestore_api_zone_iteration_sqlite \
+ test_namestore_api_remove_sqlite \
+ test_namestore_api_lookup_nick_sqlite \
+ test_namestore_api_monitoring_sqlite \
+ test_namestore_api_lookup_public_sqlite \
+ test_namestore_api_lookup_private_sqlite \
+ test_namestore_api_lookup_shadow_sqlite \
+ test_namestore_api_lookup_shadow_filter_sqlite \
+ test_namestore_api_remove_not_existing_record_sqlite \
+ test_namestore_api_zone_iteration_nick_sqlite \
+ test_namestore_api_zone_iteration_specific_zone_sqlite \
+ test_namestore_api_zone_iteration_stop_sqlite \
+ test_namestore_api_monitoring_existing_sqlite \
+ test_namestore_api_zone_to_name_sqlite \
+ perf_namestore_api_zone_iteration_sqlite
 endif
 endif
 
 if HAVE_POSTGRESQL
-# postgres doesn't even build yet; thus: experimental!
 POSTGRES_PLUGIN = libgnunet_plugin_namestore_postgres.la
 if HAVE_TESTING
-POSTGRES_TESTS = test_plugin_namestore_postgres
-endif
+POSTGRES_TESTS = test_plugin_namestore_postgres \
+ test_namestore_api_store_postgres \
+ test_namestore_api_store_update_postgres \
+ test_namestore_api_remove_postgres \
+ test_namestore_api_zone_iteration_postgres \
+ test_namestore_api_lookup_nick_postgres \
+ test_namestore_api_monitoring_postgres \
+ test_namestore_api_lookup_public_postgres \
+ test_namestore_api_lookup_private_postgres \
+ test_namestore_api_lookup_shadow_postgres \
+ test_namestore_api_lookup_shadow_filter_postgres \
+ test_namestore_api_remove_not_existing_record_postgres \
+ test_namestore_api_zone_iteration_nick_postgres \
+ test_namestore_api_zone_iteration_specific_zone_postgres \
+ test_namestore_api_zone_iteration_stop_postgres \
+ test_namestore_api_monitoring_existing_postgres \
+ test_namestore_api_zone_to_name_postgres \
+ perf_namestore_api_zone_iteration_postgres
 endif
-
-# testcases do not even build yet; thus: experimental!
-if HAVE_TESTING
-TESTING_TESTS = \
- test_namestore_api_store.nc \
- test_namestore_api_store_update.nc \
- test_namestore_api_lookup_public.nc \
- test_namestore_api_lookup_private.nc \
- test_namestore_api_lookup_nick.nc \
- test_namestore_api_lookup_shadow.nc \
- test_namestore_api_lookup_shadow_filter.nc \
- test_namestore_api_remove.nc \
- test_namestore_api_remove_not_existing_record.nc \
- test_namestore_api_zone_iteration.nc \
- test_namestore_api_zone_iteration_nick.nc \
- test_namestore_api_zone_iteration_specific_zone.nc \
- test_namestore_api_zone_iteration_stop.nc \
- test_namestore_api_monitoring.nc \
- test_namestore_api_monitoring_existing.nc \
- test_namestore_api_zone_to_name
 endif
 
-# Declare .nc (NO-CONCURRENCY) as a test extension so that we can impart
-# sequential execution order for them
-TEST_EXTENSIONS = .nc
-test_namestore_api_store.log: test_namestore_api_store_update.log
-test_namestore_api_store_update.log: test_namestore_api_lookup_public.log
-test_namestore_api_lookup_public.log: test_namestore_api_lookup_private.log
-test_namestore_api_lookup_private.log: test_namestore_api_lookup_nick.log
-test_namestore_api_lookup_nick.log: test_namestore_api_lookup_shadow.log
-test_namestore_api_lookup_shadow.log: test_namestore_api_lookup_shadow_filter.log
-test_namestore_api_lookup_shadow_filter.log: test_namestore_api_remove.log
-test_namestore_api_remove.log: test_namestore_api_remove_not_existing_record.log
-test_namestore_api_remove_not_existing_record.log: test_namestore_api_zone_iteration.log
-test_namestore_api_zone_iteration.log: test_namestore_api_zone_iteration_nick.log
-test_namestore_api_zone_iteration_nick.log: test_namestore_api_zone_iteration_specific_zone.log
-test_namestore_api_zone_iteration_specific_zone.log: test_namestore_api_zone_iteration_stop.log
-test_namestore_api_zone_iteration_stop.log: test_namestore_api_monitoring.log
-test_namestore_api_monitoring.log: test_namestore_api_monitoring_existing.log
-
-
 if HAVE_SQLITE
 check_PROGRAMS = \
  $(SQLITE_TESTS) \
  $(POSTGRES_TESTS) \
- $(FLAT_TESTS) \
- $(TESTING_TESTS)
+ $(FLAT_TESTS)
 endif
 
 if HAVE_MHD
@@ -124,9 +131,7 @@ libexec_PROGRAMS = \
  gnunet-service-namestore
 
 bin_PROGRAMS = \
- gnunet-namestore
-
-noinst_PROGRAMS = \
+ gnunet-namestore \
  gnunet-zoneimport
 
 if HAVE_MHD
@@ -139,6 +144,7 @@ gnunet_zoneimport_SOURCES = \
  gnunet-zoneimport.c
 gnunet_zoneimport_LDADD = \
   libgnunetnamestore.la \
+  $(top_builddir)/src/statistics/libgnunetstatistics.la \
   $(top_builddir)/src/identity/libgnunetidentity.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/dns/libgnunetdnsparser.la \
@@ -234,135 +240,423 @@ libgnunet_plugin_rest_namestore_la_LDFLAGS = \
  $(GN_PLUGIN_LDFLAGS)
 
 
-test_namestore_api_store_nc_SOURCES = \
+test_namestore_api_store_flat_SOURCES = \
+ test_namestore_api_store.c
+test_namestore_api_store_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_store_sqlite_SOURCES = \
+ test_namestore_api_store.c
+test_namestore_api_store_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_store_postgres_SOURCES = \
  test_namestore_api_store.c
-test_namestore_api_store_nc_LDADD = \
+test_namestore_api_store_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_store_update_flat_SOURCES = \
+ test_namestore_api_store_update.c
+test_namestore_api_store_update_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_store_update_sqlite_SOURCES = \
+ test_namestore_api_store_update.c
+test_namestore_api_store_update_sqlite_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_store_update_nc_SOURCES = \
+test_namestore_api_store_update_postgres_SOURCES = \
  test_namestore_api_store_update.c
-test_namestore_api_store_update_nc_LDADD = \
+test_namestore_api_store_update_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_public_flat_SOURCES = \
+ test_namestore_api_lookup_public.c
+test_namestore_api_lookup_public_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_public_sqlite_SOURCES = \
+ test_namestore_api_lookup_public.c
+test_namestore_api_lookup_public_sqlite_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_lookup_public_nc_SOURCES = \
+test_namestore_api_lookup_public_postgres_SOURCES = \
  test_namestore_api_lookup_public.c
-test_namestore_api_lookup_public_nc_LDADD = \
+test_namestore_api_lookup_public_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_nick_sqlite_SOURCES = \
+ test_namestore_api_lookup_nick.c
+test_namestore_api_lookup_nick_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_nick_postgres_SOURCES = \
+ test_namestore_api_lookup_nick.c
+test_namestore_api_lookup_nick_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_lookup_nick_nc_SOURCES = \
+test_namestore_api_lookup_nick_flat_SOURCES = \
  test_namestore_api_lookup_nick.c
-test_namestore_api_lookup_nick_nc_LDADD = \
+test_namestore_api_lookup_nick_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_private_flat_SOURCES = \
+ test_namestore_api_lookup_private.c
+test_namestore_api_lookup_private_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_private_sqlite_SOURCES = \
+ test_namestore_api_lookup_private.c
+test_namestore_api_lookup_private_sqlite_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_lookup_private_nc_SOURCES = \
+test_namestore_api_lookup_private_postgres_SOURCES = \
  test_namestore_api_lookup_private.c
-test_namestore_api_lookup_private_nc_LDADD = \
+test_namestore_api_lookup_private_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_shadow_flat_SOURCES = \
+ test_namestore_api_lookup_shadow.c
+test_namestore_api_lookup_shadow_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_shadow_sqlite_SOURCES = \
+ test_namestore_api_lookup_shadow.c
+test_namestore_api_lookup_shadow_sqlite_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_lookup_shadow_nc_SOURCES = \
+test_namestore_api_lookup_shadow_postgres_SOURCES = \
  test_namestore_api_lookup_shadow.c
-test_namestore_api_lookup_shadow_nc_LDADD = \
+test_namestore_api_lookup_shadow_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+
+test_namestore_api_lookup_shadow_filter_flat_SOURCES = \
+ test_namestore_api_lookup_shadow_filter.c
+test_namestore_api_lookup_shadow_filter_flat_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_lookup_shadow_filter_nc_SOURCES = \
+test_namestore_api_lookup_shadow_filter_sqlite_SOURCES = \
+ test_namestore_api_lookup_shadow_filter.c
+test_namestore_api_lookup_shadow_filter_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/namecache/libgnunetnamecache.la \
+  libgnunetnamestore.la
+test_namestore_api_lookup_shadow_filter_postgres_SOURCES = \
  test_namestore_api_lookup_shadow_filter.c
-test_namestore_api_lookup_shadow_filter_nc_LDADD = \
+test_namestore_api_lookup_shadow_filter_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   libgnunetnamestore.la
 
-test_namestore_api_remove_nc_SOURCES = \
+test_namestore_api_remove_sqlite_SOURCES = \
+ test_namestore_api_remove.c
+test_namestore_api_remove_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_remove_postgres_SOURCES = \
  test_namestore_api_remove.c
-test_namestore_api_remove_nc_LDADD = \
+test_namestore_api_remove_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   libgnunetnamestore.la
 
-test_namestore_api_remove_not_existing_record_nc_SOURCES = \
+test_namestore_api_remove_flat_SOURCES = \
+ test_namestore_api_remove.c
+test_namestore_api_remove_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_remove_not_existing_record_flat_SOURCES = \
+ test_namestore_api_remove_not_existing_record.c
+test_namestore_api_remove_not_existing_record_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_remove_not_existing_record_sqlite_SOURCES = \
+ test_namestore_api_remove_not_existing_record.c
+test_namestore_api_remove_not_existing_record_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_remove_not_existing_record_postgres_SOURCES = \
  test_namestore_api_remove_not_existing_record.c
-test_namestore_api_remove_not_existing_record_nc_LDADD = \
+test_namestore_api_remove_not_existing_record_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   libgnunetnamestore.la
 
-test_namestore_api_zone_to_name_SOURCES = \
+test_namestore_api_zone_to_name_flat_SOURCES = \
+ test_namestore_api_zone_to_name.c
+test_namestore_api_zone_to_name_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_to_name_sqlite_SOURCES = \
+ test_namestore_api_zone_to_name.c
+test_namestore_api_zone_to_name_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_to_name_postgres_SOURCES = \
  test_namestore_api_zone_to_name.c
-test_namestore_api_zone_to_name_LDADD = \
+test_namestore_api_zone_to_name_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   libgnunetnamestore.la
 
-test_namestore_api_monitoring_nc_SOURCES = \
+test_namestore_api_monitoring_flat_SOURCES = \
+ test_namestore_api_monitoring.c
+test_namestore_api_monitoring_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  libgnunetnamestore.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/util/libgnunetutil.la
+
+test_namestore_api_monitoring_sqlite_SOURCES = \
+ test_namestore_api_monitoring.c
+test_namestore_api_monitoring_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  libgnunetnamestore.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/util/libgnunetutil.la
+
+test_namestore_api_monitoring_postgres_SOURCES = \
  test_namestore_api_monitoring.c
-test_namestore_api_monitoring_nc_LDADD = \
+test_namestore_api_monitoring_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  libgnunetnamestore.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/util/libgnunetutil.la
+
+test_namestore_api_monitoring_existing_flat_SOURCES = \
+ test_namestore_api_monitoring_existing.c
+test_namestore_api_monitoring_existing_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  libgnunetnamestore.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/util/libgnunetutil.la
+
+test_namestore_api_monitoring_existing_sqlite_SOURCES = \
+ test_namestore_api_monitoring_existing.c
+test_namestore_api_monitoring_existing_sqlite_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   libgnunetnamestore.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/util/libgnunetutil.la
 
-test_namestore_api_monitoring_existing_nc_SOURCES = \
+test_namestore_api_monitoring_existing_postgres_SOURCES = \
  test_namestore_api_monitoring_existing.c
-test_namestore_api_monitoring_existing_nc_LDADD = \
+test_namestore_api_monitoring_existing_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   libgnunetnamestore.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   $(top_builddir)/src/util/libgnunetutil.la
 
-test_namestore_api_zone_iteration_nc_SOURCES = \
+test_namestore_api_zone_iteration_flat_SOURCES = \
  test_namestore_api_zone_iteration.c
-test_namestore_api_zone_iteration_nc_LDADD = \
+test_namestore_api_zone_iteration_flat_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   libgnunetnamestore.la
 
-test_namestore_api_zone_iteration_nick_nc_SOURCES = \
+test_namestore_api_zone_iteration_sqlite_SOURCES = \
+ test_namestore_api_zone_iteration.c
+test_namestore_api_zone_iteration_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_postgres_SOURCES = \
+ test_namestore_api_zone_iteration.c
+test_namestore_api_zone_iteration_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+perf_namestore_api_zone_iteration_postgres_SOURCES = \
+ perf_namestore_api_zone_iteration.c
+perf_namestore_api_zone_iteration_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+perf_namestore_api_zone_iteration_sqlite_SOURCES = \
+ perf_namestore_api_zone_iteration.c
+perf_namestore_api_zone_iteration_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+perf_namestore_api_zone_iteration_flat_SOURCES = \
+ perf_namestore_api_zone_iteration.c
+perf_namestore_api_zone_iteration_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_nick_flat_SOURCES = \
  test_namestore_api_zone_iteration_nick.c
-test_namestore_api_zone_iteration_nick_nc_LDADD = \
+test_namestore_api_zone_iteration_nick_flat_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   libgnunetnamestore.la
 
+test_namestore_api_zone_iteration_nick_sqlite_SOURCES = \
+ test_namestore_api_zone_iteration_nick.c
+test_namestore_api_zone_iteration_nick_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
 
-test_namestore_api_zone_iteration_specific_zone_nc_SOURCES = \
+test_namestore_api_zone_iteration_nick_postgres_SOURCES = \
+ test_namestore_api_zone_iteration_nick.c
+test_namestore_api_zone_iteration_nick_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_specific_zone_flat_SOURCES = \
+ test_namestore_api_zone_iteration_specific_zone.c
+test_namestore_api_zone_iteration_specific_zone_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_specific_zone_sqlite_SOURCES = \
  test_namestore_api_zone_iteration_specific_zone.c
-test_namestore_api_zone_iteration_specific_zone_nc_LDADD = \
+test_namestore_api_zone_iteration_specific_zone_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_specific_zone_postgres_SOURCES = \
+ test_namestore_api_zone_iteration_specific_zone.c
+test_namestore_api_zone_iteration_specific_zone_postgres_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_stop_flat_SOURCES = \
+ test_namestore_api_zone_iteration_stop.c
+test_namestore_api_zone_iteration_stop_flat_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  libgnunetnamestore.la
+
+test_namestore_api_zone_iteration_stop_sqlite_SOURCES = \
+ test_namestore_api_zone_iteration_stop.c
+test_namestore_api_zone_iteration_stop_sqlite_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   libgnunetnamestore.la
 
-test_namestore_api_zone_iteration_stop_nc_SOURCES = \
+test_namestore_api_zone_iteration_stop_postgres_SOURCES = \
  test_namestore_api_zone_iteration_stop.c
-test_namestore_api_zone_iteration_stop_nc_LDADD = \
+test_namestore_api_zone_iteration_stop_postgres_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
@@ -393,6 +687,12 @@ check_SCRIPTS = \
 
 EXTRA_DIST = \
   test_namestore_api.conf \
+  test_namestore_api_postgres.conf \
+  test_namestore_api_sqlite.conf \
+  test_namestore_api_flat.conf \
+  perf_namestore_api_postgres.conf \
+  perf_namestore_api_sqlite.conf \
+  perf_namestore_api_flat.conf \
   test_plugin_namestore_sqlite.conf \
   test_plugin_namestore_postgres.conf \
   test_plugin_namestore_flat.conf \
diff --git a/src/namestore/gnunet-namestore-fcfsd.c b/src/namestore/gnunet-namestore-fcfsd.c
index ddd609918..903253b1a 100644
--- a/src/namestore/gnunet-namestore-fcfsd.c
+++ b/src/namestore/gnunet-namestore-fcfsd.c
@@ -324,15 +324,18 @@ iterate_cb (void *cls,
   char* pkey;
   char* new_buf;
 
+  (void) zone_key;
   if (1 != rd_len)
   {
-    GNUNET_NAMESTORE_zone_iterator_next (zr->list_it);
+    GNUNET_NAMESTORE_zone_iterator_next (zr->list_it,
+                                         1);
     return;
   }
 
   if (GNUNET_GNSRECORD_TYPE_PKEY != rd->record_type)
   {
-    GNUNET_NAMESTORE_zone_iterator_next (zr->list_it);
+    GNUNET_NAMESTORE_zone_iterator_next (zr->list_it,
+                                         1);
     return;
   }
 
@@ -343,7 +346,8 @@ iterate_cb (void *cls,
   if (NULL == pkey)
   {
     GNUNET_break (0);
-    GNUNET_NAMESTORE_zone_iterator_next (zr->list_it);
+    GNUNET_NAMESTORE_zone_iterator_next (zr->list_it,
+                                         1);
     return;
   }
   if (bytes_free < (strlen (name) + strlen (pkey) + 40))
@@ -359,7 +363,8 @@ iterate_cb (void *cls,
            name,
            pkey);
   zr->write_offset = strlen (zr->zoneinfo);
-  GNUNET_NAMESTORE_zone_iterator_next (zr->list_it);
+  GNUNET_NAMESTORE_zone_iterator_next (zr->list_it,
+                                       1);
   GNUNET_free (pkey);
 }
 
@@ -435,6 +440,7 @@ fill_s_reply (const char *info,
   char *reply;
   struct MHD_Response *response;
 
+  (void) request;
   GNUNET_asprintf (&reply,
                    SUBMIT_PAGE,
                    info,
@@ -583,6 +589,8 @@ zone_to_name_cb (void *cls,
   struct Request *request = cls;
   struct GNUNET_GNSRECORD_Data r;
 
+  (void) rd;
+  (void) zone_key;
   request->qe = NULL;
   if (0 != rd_count)
   {
@@ -640,6 +648,9 @@ lookup_block_processor (void *cls,
 {
   struct Request *request = cls;
 
+  (void) label;
+  (void) rd;
+  (void) zone;
   request->qe = NULL;
   if (0 == rd_count)
   {
@@ -711,6 +722,8 @@ create_response (void *cls,
   struct GNUNET_CRYPTO_EcdsaPublicKey pub;
   int ret;
 
+  (void) cls;
+  (void) version;
   if ( (0 == strcmp (method, MHD_HTTP_METHOD_GET)) ||
        (0 == strcmp (method, MHD_HTTP_METHOD_HEAD)) )
     {
diff --git a/src/namestore/gnunet-namestore.c b/src/namestore/gnunet-namestore.c
index 9a1805af4..d329dcb3b 100644
--- a/src/namestore/gnunet-namestore.c
+++ b/src/namestore/gnunet-namestore.c
@@ -398,7 +398,8 @@ display_record (void *cls,
   if ( (NULL != name) &&
        (0 != strcmp (name, rname)) )
   {
-    GNUNET_NAMESTORE_zone_iterator_next (list_it);
+    GNUNET_NAMESTORE_zone_iterator_next (list_it,
+                                         1);
     return;
   }
   FPRINTF (stdout,
@@ -408,7 +409,7 @@ display_record (void *cls,
   {
     if ( (GNUNET_GNSRECORD_TYPE_NICK == rd[i].record_type) &&
          (0 != strcmp (rname,
-                       GNUNET_GNS_MASTERZONE_STR)) )
+                       GNUNET_GNS_EMPTY_LABEL_AT)) )
       continue;
     typestring = GNUNET_GNSRECORD_number_to_typename (rd[i].record_type);
     s = GNUNET_GNSRECORD_value_to_string (rd[i].record_type,
@@ -441,7 +442,8 @@ display_record (void *cls,
     GNUNET_free (s);
   }
   FPRINTF (stdout, "%s", "\n");
-  GNUNET_NAMESTORE_zone_iterator_next (list_it);
+  GNUNET_NAMESTORE_zone_iterator_next (list_it,
+                                       1);
 }
 
 
@@ -659,6 +661,8 @@ handle_reverse_lookup (void *cls,
 {
   (void) cls;
   (void) zone;
+  (void) rd_count;
+  (void) rd;
   reverse_qe = NULL;
   if (NULL == label)
     FPRINTF (stdout,
@@ -710,6 +714,7 @@ del_monitor (void *cls,
   char *vs;
 
   (void) cls;
+  (void) zone;
   del_qe = NULL;
   if (0 == rd_count)
   {
@@ -1090,6 +1095,9 @@ id_connect_cb (void *cls,
 {
   const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
 
+  (void) cls;
+  (void) ctx;
+  (void) name;
   if (NULL == ego)
   {
     get_default = GNUNET_IDENTITY_get (idh,
diff --git a/src/namestore/gnunet-service-namestore.c b/src/namestore/gnunet-service-namestore.c
index 3a3291c07..fa189dbc3 100644
--- a/src/namestore/gnunet-service-namestore.c
+++ b/src/namestore/gnunet-service-namestore.c
@@ -31,6 +31,7 @@
 #include "gnunet_namecache_service.h"
 #include "gnunet_namestore_service.h"
 #include "gnunet_namestore_plugin.h"
+#include "gnunet_statistics_service.h"
 #include "gnunet_signatures.h"
 #include "namestore.h"
 
@@ -74,6 +75,15 @@ struct ZoneIteration
   struct GNUNET_CRYPTO_EcdsaPrivateKey zone;
 
   /**
+   * Last sequence number in the zone iteration used to address next
+   * result of the zone iteration in the store
+   *
+   * Initialy set to 0.
+   * Updated in #zone_iterate_proc()
+   */
+  uint64_t seq;
+
+  /**
    * The operation id fot the zone iteration in the response for the client
    */
   uint32_t request_id;
@@ -82,8 +92,8 @@ struct ZoneIteration
    * Offset of the zone iteration used to address next result of the zone
    * iteration in the store
    *
-   * Initialy set to 0 in handle_iteration_start
-   * Incremented with by every call to handle_iteration_next
+   * Initialy set to 0 in #handle_iteration_start
+   * Incremented with by every call to #handle_iteration_next
    */
   uint32_t offset;
 
@@ -151,13 +161,13 @@ struct ZoneMonitor
   struct GNUNET_SCHEDULER_Task *task;
 
   /**
-   * Offset of the zone iteration used to address next result of the zone
-   * iteration in the store
+   * Last sequence number in the zone iteration used to address next
+   * result of the zone iteration in the store
    *
    * Initialy set to 0.
-   * Incremented with by every call to #handle_iteration_next
+   * Updated in #monitor_iterate_cb()
    */
-  uint32_t offset;
+  uint64_t seq;
 
 };
 
@@ -206,6 +216,11 @@ static const struct GNUNET_CRYPTO_EcdsaPrivateKey zero;
 static const struct GNUNET_CONFIGURATION_Handle *GSN_cfg;
 
 /**
+ * Handle to the statistics service
+ */
+static struct GNUNET_STATISTICS_Handle *statistics;
+
+/**
  * Namecache handle.
  */
 static struct GNUNET_NAMECACHE_Handle *namecache;
@@ -245,6 +260,18 @@ static struct ZoneMonitor *monitor_tail;
  */
 static struct GNUNET_NotificationContext *monitor_nc;
 
+/**
+ * Optimize block insertion by caching map of private keys to
+ * public keys in memory?
+ */
+static int cache_keys;
+
+/**
+ * Use the namecache? Doing so creates additional cryptographic
+ * operations whenever we touch a record.
+ */
+static int disable_namecache;
+
 
 /**
  * Task run during shutdown.
@@ -269,8 +296,11 @@ cleanup_task (void *cls)
                                  cop);
     GNUNET_free (cop);
   }
-  GNUNET_NAMECACHE_disconnect (namecache);
-  namecache = NULL;
+  if (NULL != namecache)
+  {
+    GNUNET_NAMECACHE_disconnect (namecache);
+    namecache = NULL;
+  }
   GNUNET_break (NULL == GNUNET_PLUGIN_unload (db_lib_name,
                                               GSN_database));
   GNUNET_free (db_lib_name);
@@ -280,6 +310,12 @@ cleanup_task (void *cls)
     GNUNET_notification_context_destroy (monitor_nc);
     monitor_nc = NULL;
   }
+  if (NULL != statistics)
+  {
+    GNUNET_STATISTICS_destroy (statistics,
+                               GNUNET_NO);
+    statistics = NULL;
+  }
 }
 
 
@@ -362,18 +398,20 @@ client_connect_cb (void *cls,
 
 
 /**
- * Function called with the records for the #GNUNET_GNS_MASTERZONE_STR
+ * Function called with the records for the #GNUNET_GNS_EMPTY_LABEL_AT
  * label in the zone.  Used to locate the #GNUNET_GNSRECORD_TYPE_NICK
  * record, which (if found) is then copied to @a cls for future use.
  *
  * @param cls a `struct GNUNET_GNSRECORD_Data **` for storing the nick (if found)
+ * @param seq sequence number of the record
  * @param private_key the private key of the zone (unused)
- * @param label should be #GNUNET_GNS_MASTERZONE_STR
+ * @param label should be #GNUNET_GNS_EMPTY_LABEL_AT
  * @param rd_count number of records in @a rd
  * @param rd records stored under @a label in the zone
  */
 static void
 lookup_nick_it (void *cls,
+                uint64_t seq,
                 const struct GNUNET_CRYPTO_EcdsaPrivateKey *private_key,
                 const char *label,
                 unsigned int rd_count,
@@ -382,7 +420,8 @@ lookup_nick_it (void *cls,
   struct GNUNET_GNSRECORD_Data **res = cls;
 
   (void) private_key;
-  if (0 != strcmp (label, GNUNET_GNS_MASTERZONE_STR))
+  (void) seq;
+  if (0 != strcmp (label, GNUNET_GNS_EMPTY_LABEL_AT))
   {
     GNUNET_break (0);
     return;
@@ -423,14 +462,14 @@ get_nick_record (const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone)
   nick = NULL;
   res = GSN_database->lookup_records (GSN_database->cls,
                                       zone,
-                                      GNUNET_GNS_MASTERZONE_STR,
+                                      GNUNET_GNS_EMPTY_LABEL_AT,
                                       &lookup_nick_it,
                                       &nick);
   if ( (GNUNET_OK != res) ||
        (NULL == nick) )
   {
     GNUNET_CRYPTO_ecdsa_key_get_public (zone, &pub);
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO | GNUNET_ERROR_TYPE_BULK,
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG | GNUNET_ERROR_TYPE_BULK,
                 "No nick name set for zone `%s'\n",
                 GNUNET_GNSRECORD_z2s (&pub));
     return NULL;
@@ -439,9 +478,24 @@ get_nick_record (const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone)
 }
 
 
+/**
+ * Merge the nick record @a nick_rd with the rest of the
+ * record set given in @a rd2.  Store the result in @a rdc_res
+ * and @a rd_res.  The @a nick_rd's expiration time is set to
+ * the maximum expiration time of all of the records in @a rd2.
+ *
+ * @param nick_rd the nick record to integrate
+ * @param rd2_length length of the @a rd2 array
+ * @param rd2 array of records
+ * @param rdc_res[out] length of the resulting @a rd_res array
+ * @param rd_res[out] set to an array of records,
+ *                    including @a nick_rd and @a rd2;
+ *           all of the variable-size 'data' fields in @a rd2 are
+ *           allocated in the same chunk of memory!
+ */
 static void
 merge_with_nick_records (const struct GNUNET_GNSRECORD_Data *nick_rd,
-                         unsigned int rdc2,
+                         unsigned int rd2_length,
                          const struct GNUNET_GNSRECORD_Data *rd2,
                          unsigned int *rdc_res,
                          struct GNUNET_GNSRECORD_Data **rd_res)
@@ -452,24 +506,22 @@ merge_with_nick_records (const struct GNUNET_GNSRECORD_Data *nick_rd,
   int record_offset;
   size_t data_offset;
 
-  (*rdc_res) = 1 + rdc2;
-  if (0 == 1 + rdc2)
+  (*rdc_res) = 1 + rd2_length;
+  if (0 == 1 + rd2_length)
   {
     (*rd_res) = NULL;
     return;
   }
-
   req = 0;
   for (unsigned int c=0; c< 1; c++)
     req += sizeof (struct GNUNET_GNSRECORD_Data) + nick_rd[c].data_size;
-  for (unsigned int c=0; c< rdc2; c++)
+  for (unsigned int c=0; c< rd2_length; c++)
     req += sizeof (struct GNUNET_GNSRECORD_Data) + rd2[c].data_size;
   (*rd_res) = GNUNET_malloc (req);
-  data = (char *) &(*rd_res)[1 + rdc2];
+  data = (char *) &(*rd_res)[1 + rd2_length];
   data_offset = 0;
   latest_expiration = 0;
-
-  for (unsigned int c=0; c< rdc2; c++)
+  for (unsigned int c=0; c< rd2_length; c++)
   {
     if (0 != (rd2[c].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
     {
@@ -486,17 +538,15 @@ merge_with_nick_records (const struct GNUNET_GNSRECORD_Data *nick_rd,
                    rd2[c].data_size);
     data_offset += (*rd_res)[c].data_size;
   }
-  record_offset = rdc2;
-  for (unsigned int c=0; c< 1; c++)
-  {
-    (*rd_res)[c+record_offset] = nick_rd[c];
-    (*rd_res)[c+record_offset].expiration_time = latest_expiration;
-    (*rd_res)[c+record_offset].data = (void *) &data[data_offset];
-    GNUNET_memcpy ((void *) (*rd_res)[c+record_offset].data,
-                   nick_rd[c].data,
-                   nick_rd[c].data_size);
-    data_offset += (*rd_res)[c+record_offset].data_size;
-  }
+  /* append nick */
+  record_offset = rd2_length;
+  (*rd_res)[record_offset] = *nick_rd;
+  (*rd_res)[record_offset].expiration_time = latest_expiration;
+  (*rd_res)[record_offset].data = (void *) &data[data_offset];
+  GNUNET_memcpy ((void *) (*rd_res)[record_offset].data,
+                 nick_rd->data,
+                 nick_rd->data_size);
+  data_offset += (*rd_res)[record_offset].data_size;
   GNUNET_assert (req == (sizeof (struct GNUNET_GNSRECORD_Data)) * (*rdc_res) + data_offset);
 }
 
@@ -531,7 +581,9 @@ send_lookup_response (struct NamestoreClient *nc,
   char *rd_ser;
 
   nick = get_nick_record (zone_key);
-  if ((NULL != nick) && (0 != strcmp(name, GNUNET_GNS_MASTERZONE_STR)))
+  if ( (NULL != nick) &&
+       (0 != strcmp (name,
+                     GNUNET_GNS_EMPTY_LABEL_AT)))
   {
     nick->flags = (nick->flags | GNUNET_GNSRECORD_RF_PRIVATE) ^ GNUNET_GNSRECORD_RF_PRIVATE;
     merge_with_nick_records (nick,
@@ -569,6 +621,10 @@ send_lookup_response (struct NamestoreClient *nc,
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Sending RECORD_RESULT message with %u records\n",
               res_count);
+  GNUNET_STATISTICS_update (statistics,
+                            "Record sets sent to clients",
+                            1,
+                            GNUNET_NO);
   GNUNET_MQ_send (nc->mq,
                   env);
   if (rd != res)
@@ -659,6 +715,7 @@ refresh_block (struct NamestoreClient *nc,
   struct GNUNET_GNSRECORD_Data *nick;
   struct GNUNET_GNSRECORD_Data *res;
   unsigned int res_count;
+  struct GNUNET_TIME_Absolute exp_time;
 
   nick = get_nick_record (zone_key);
   res_count = rd_count;
@@ -672,26 +729,51 @@ refresh_block (struct NamestoreClient *nc,
                              &res);
     GNUNET_free (nick);
   }
-
   if (0 == res_count)
-    block = GNUNET_GNSRECORD_block_create (zone_key,
-                                           GNUNET_TIME_UNIT_ZERO_ABS,
-                                           name,
-                                           res, rd_count);
+  {
+    send_store_response (nc,
+                         GNUNET_OK,
+                         rid);
+    return; /* no data, no need to update cache */
+  }
+  if (GNUNET_YES == disable_namecache)
+  {
+    GNUNET_STATISTICS_update (statistics,
+                              "Namecache updates skipped (NC disabled)",
+                              1,
+                              GNUNET_NO);
+    send_store_response (nc,
+                         GNUNET_OK,
+                         rid);
+    return;
+  }
+  exp_time = GNUNET_GNSRECORD_record_get_expiration_time (res_count,
+                                                          res);
+  if (cache_keys)
+    block = GNUNET_GNSRECORD_block_create2 (zone_key,
+                                            exp_time,
+                                            name,
+                                            res,
+                                            res_count);
   else
     block = GNUNET_GNSRECORD_block_create (zone_key,
-                                           GNUNET_GNSRECORD_record_get_expiration_time (res_count,
-                                               res),
+                                           exp_time,
                                            name,
-                                           res, res_count);
+                                           res,
+                                           res_count);
   GNUNET_assert (NULL != block);
   GNUNET_CRYPTO_ecdsa_key_get_public (zone_key,
                                       &pkey);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Caching block for label `%s' with %u records in zone `%s' in namecache\n",
+              "Caching block for label `%s' with %u records and expiration %s in zone `%s' in namecache\n",
               name,
               res_count,
+              GNUNET_STRINGS_absolute_time_to_string (exp_time),
               GNUNET_GNSRECORD_z2s (&pkey));
+  GNUNET_STATISTICS_update (statistics,
+                            "Namecache updates pushed",
+                            1,
+                            GNUNET_NO);
   cop = GNUNET_new (struct CacheOperation);
   cop->nc = nc;
   cop->rid = rid;
@@ -746,9 +828,11 @@ struct RecordLookupContext
 
 /**
  * FIXME.
+ * @param seq sequence number of the record
  */
 static void
 lookup_it (void *cls,
+           uint64_t seq,
            const struct GNUNET_CRYPTO_EcdsaPrivateKey *private_key,
            const char *label,
            unsigned int rd_count,
@@ -759,23 +843,26 @@ lookup_it (void *cls,
   unsigned int rdc_res;
 
   (void) private_key;
-  if (0 == strcmp (label, rlc->label))
+  (void) seq;
+  if (0 == strcmp (label,
+                   rlc->label))
   {
     rlc->found = GNUNET_YES;
     if (0 != rd_count)
     {
       if ( (NULL != rlc->nick) &&
            (0 != strcmp (label,
-                         GNUNET_GNS_MASTERZONE_STR)) )
+                         GNUNET_GNS_EMPTY_LABEL_AT)) )
       {
         /* Merge */
         rd_res = NULL;
         rdc_res = 0;
         rlc->nick->flags = (rlc->nick->flags | GNUNET_GNSRECORD_RF_PRIVATE) ^ GNUNET_GNSRECORD_RF_PRIVATE;
         merge_with_nick_records (rlc->nick,
-                                 rd_count, rd,
-                                 &rdc_res, &rd_res);
-
+                                 rd_count,
+                                 rd,
+                                 &rdc_res,
+                                 &rd_res);
         rlc->rd_ser_len = GNUNET_GNSRECORD_records_get_size (rdc_res,
                                                              rd_res);
         rlc->res_rd_count = rdc_res;
@@ -945,7 +1032,8 @@ check_record_store (void *cls,
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  if ((0 == name_len) || (name_len > MAX_NAME_LEN))
+  if ( (0 == name_len) ||
+       (name_len > MAX_NAME_LEN) )
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -979,7 +1067,6 @@ handle_record_store (void *cls,
   const char *rd_ser;
   unsigned int rd_count;
   int res;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
   struct ZoneMonitor *zm;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -1006,8 +1093,6 @@ handle_record_store (void *cls,
     }
 
     /* Extracting and converting private key */
-    GNUNET_CRYPTO_ecdsa_key_get_public (&rp_msg->private_key,
-                                        &pubkey);
     conv_name = GNUNET_GNSRECORD_string_to_lowercase (name_tmp);
     if (NULL == conv_name)
     {
@@ -1018,18 +1103,16 @@ handle_record_store (void *cls,
       return;
     }
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Creating %u records for name `%s' in zone `%s'\n",
+                "Creating %u records for name `%s'\n",
                 (unsigned int) rd_count,
-                conv_name,
-                GNUNET_GNSRECORD_z2s (&pubkey));
-
+                conv_name);
     if ( (0 == rd_count) &&
          (GNUNET_NO ==
-          GSN_database->iterate_records (GSN_database->cls,
-                                         &rp_msg->private_key,
-                                         0,
-                                         NULL,
-                                         0)) )
+          GSN_database->lookup_records (GSN_database->cls,
+                                        &rp_msg->private_key,
+                                        conv_name,
+                                        NULL,
+                                        0)) )
     {
       /* This name does not exist, so cannot be removed */
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -1043,12 +1126,12 @@ handle_record_store (void *cls,
       unsigned int rd_clean_off;
 
       /* remove "NICK" records, unless this is for the
-         #GNUNET_GNS_MASTERZONE_STR label */
+         #GNUNET_GNS_EMPTY_LABEL_AT label */
       rd_clean_off = 0;
       for (unsigned int i=0;i<rd_count;i++)
       {
         rd_clean[rd_clean_off] = rd[i];
-        if ( (0 == strcmp (GNUNET_GNS_MASTERZONE_STR,
+        if ( (0 == strcmp (GNUNET_GNS_EMPTY_LABEL_AT,
                            conv_name)) ||
              (GNUNET_GNSRECORD_TYPE_NICK != rd[i].record_type) )
           rd_clean_off++;
@@ -1062,7 +1145,8 @@ handle_record_store (void *cls,
       {
         for (zm = monitor_head; NULL != zm; zm = zm->next)
         {
-          if ( (0 == memcmp (&rp_msg->private_key, &zm->zone,
+          if ( (0 == memcmp (&rp_msg->private_key,
+                             &zm->zone,
                              sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey))) ||
                (0 == memcmp (&zm->zone,
                              &zero,
@@ -1142,6 +1226,7 @@ struct ZoneToNameCtx
  * Zone to name iterator
  *
  * @param cls struct ZoneToNameCtx *
+ * @param seq sequence number of the record
  * @param zone_key the zone key
  * @param name name
  * @param rd_count number of records in @a rd
@@ -1149,6 +1234,7 @@ struct ZoneToNameCtx
  */
 static void
 handle_zone_to_name_it (void *cls,
+                        uint64_t seq,
                         const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
                         const char *name,
                         unsigned int rd_count,
@@ -1164,6 +1250,7 @@ handle_zone_to_name_it (void *cls,
   char *name_tmp;
   char *rd_tmp;
 
+  (void) seq;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Found result for zone-to-name lookup: `%s'\n",
               name);
@@ -1252,29 +1339,6 @@ handle_zone_to_name (void *cls,
 
 
 /**
- * Zone iteration processor result
- */
-enum ZoneIterationResult
-{
-  /**
-   * Iteration start.
-   */
-  IT_START = 0,
-
-  /**
-   * Found records,
-   * Continue to iterate with next iteration_next call
-   */
-  IT_SUCCESS_MORE_AVAILABLE = 1,
-
-  /**
-   * Iteration complete
-   */
-  IT_SUCCESS_NOT_MORE_RESULTS_AVAILABLE = 2
-};
-
-
-/**
  * Context for record remove operations passed from
  * #run_zone_iteration_round to #zone_iterate_proc as closure
  */
@@ -1286,13 +1350,9 @@ struct ZoneIterationProcResult
   struct ZoneIteration *zi;
 
   /**
-   * Iteration result: iteration done?
-   * #IT_SUCCESS_MORE_AVAILABLE:  if there may be more results overall but
-   * we got one for now and have sent it to the client
-   * #IT_SUCCESS_NOT_MORE_RESULTS_AVAILABLE: if there are no further results,
-   * #IT_START: if we are still trying to find a result.
+   * Number of results left to be returned in this iteration.
    */
-  int res_iteration_finished;
+  uint64_t limit;
 
 };
 
@@ -1300,7 +1360,8 @@ struct ZoneIterationProcResult
 /**
  * Process results for zone iteration from database
  *
- * @param cls struct ZoneIterationProcResult *proc
+ * @param cls struct ZoneIterationProcResult
+ * @param seq sequence number of the record
  * @param zone_key the zone key
  * @param name name
  * @param rd_count number of records for this name
@@ -1308,6 +1369,7 @@ struct ZoneIterationProcResult
  */
 static void
 zone_iterate_proc (void *cls,
+                   uint64_t seq,
                    const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
                    const char *name,
                    unsigned int rd_count,
@@ -1316,21 +1378,28 @@ zone_iterate_proc (void *cls,
   struct ZoneIterationProcResult *proc = cls;
   int do_refresh_block;
 
-  if ((NULL == zone_key) && (NULL == name))
+  if ( (NULL == zone_key) &&
+       (NULL == name) )
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Iteration done\n");
-    proc->res_iteration_finished = IT_SUCCESS_NOT_MORE_RESULTS_AVAILABLE;
     return;
   }
-  if ((NULL == zone_key) || (NULL == name))
+  if ( (NULL == zone_key) ||
+       (NULL == name) )
   {
     /* what is this!? should never happen */
-    proc->res_iteration_finished = IT_START;
     GNUNET_break (0);
     return;
   }
-  proc->res_iteration_finished = IT_SUCCESS_MORE_AVAILABLE;
+  if (0 == proc->limit)
+  {
+    /* what is this!? should never happen */
+    GNUNET_break (0);
+    return;
+  }
+  proc->limit--;
+  proc->zi->seq = seq;
   send_lookup_response (proc->zi->nc,
                         proc->zi->request_id,
                         zone_key,
@@ -1351,7 +1420,6 @@ zone_iterate_proc (void *cls,
                    name,
                    rd_count,
                    rd);
-
 }
 
 
@@ -1359,41 +1427,58 @@ zone_iterate_proc (void *cls,
  * Perform the next round of the zone iteration.
  *
  * @param zi zone iterator to process
+ * @param limit number of results to return in one pass
  */
 static void
-run_zone_iteration_round (struct ZoneIteration *zi)
+run_zone_iteration_round (struct ZoneIteration *zi,
+                          uint64_t limit)
 {
   struct ZoneIterationProcResult proc;
   struct GNUNET_MQ_Envelope *env;
   struct RecordResultMessage *rrm;
-  int ret;
+  struct GNUNET_TIME_Absolute start;
+  struct GNUNET_TIME_Relative duration;
 
-  memset (&proc, 0, sizeof (proc));
+  memset (&proc,
+          0,
+          sizeof (proc));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Asked to return up to %llu records at position %llu\n",
+              (unsigned long long) limit,
+              (unsigned long long) zi->seq);
   proc.zi = zi;
-  proc.res_iteration_finished = IT_START;
-  while (IT_START == proc.res_iteration_finished)
-  {
-    if (GNUNET_SYSERR ==
-        (ret = GSN_database->iterate_records (GSN_database->cls,
-                                              (0 == memcmp (&zi->zone, &zero, sizeof (zero)))
-                                              ? NULL
-                                              : &zi->zone,
-                                              zi->offset,
-                                              &zone_iterate_proc, &proc)))
-    {
-      GNUNET_break (0);
-      break;
-    }
-    if (GNUNET_NO == ret)
-      proc.res_iteration_finished = IT_SUCCESS_NOT_MORE_RESULTS_AVAILABLE;
-    zi->offset++;
-  }
-  if (IT_SUCCESS_MORE_AVAILABLE == proc.res_iteration_finished)
+  proc.limit = limit;
+  start = GNUNET_TIME_absolute_get ();
+  GNUNET_break (GNUNET_SYSERR !=
+                GSN_database->iterate_records (GSN_database->cls,
+                                               (0 == memcmp (&zi->zone,
+                                                             &zero,
+                                                             sizeof (zero)))
+                                               ? NULL
+                                               : &zi->zone,
+                                               zi->seq,
+                                               limit,
+                                               &zone_iterate_proc,
+                                               &proc));
+  duration = GNUNET_TIME_absolute_get_duration (start);
+  duration = GNUNET_TIME_relative_divide (duration,
+                                          limit - proc.limit);
+  GNUNET_STATISTICS_set (statistics,
+                         "NAMESTORE iteration delay (μs/record)",
+                         duration.rel_value_us,
+                         GNUNET_NO);
+  if (0 == proc.limit)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "More results available\n");
-    return; /* more results later */
+                "Returned %llu results, more results available\n",
+                (unsigned long long) limit);
+    return; /* more results later after we get the
+               #GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_NEXT message */
   }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Completed iteration after %llu/%llu results\n",
+              (unsigned long long) (limit - proc.limit),
+              (unsigned long long) limit);
   /* send empty response to indicate end of list */
   env = GNUNET_MQ_msg (rrm,
                        GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_RESULT);
@@ -1431,7 +1516,8 @@ handle_iteration_start (void *cls,
   GNUNET_CONTAINER_DLL_insert (nc->op_head,
                                nc->op_tail,
                                zi);
-  run_zone_iteration_round (zi);
+  run_zone_iteration_round (zi,
+                            1);
   GNUNET_SERVICE_client_continue (nc->client);
 }
 
@@ -1451,8 +1537,7 @@ handle_iteration_stop (void *cls,
   uint32_t rid;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Received `%s' message\n",
-              "ZONE_ITERATION_STOP");
+              "Received ZONE_ITERATION_STOP message\n");
   rid = ntohl (zis_msg->gns_header.r_id);
   for (zi = nc->op_head; NULL != zi; zi = zi->next)
     if (zi->request_id == rid)
@@ -1484,10 +1569,16 @@ handle_iteration_next (void *cls,
   struct NamestoreClient *nc = cls;
   struct ZoneIteration *zi;
   uint32_t rid;
+  uint64_t limit;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received ZONE_ITERATION_NEXT message\n");
+  GNUNET_STATISTICS_update (statistics,
+                            "Iteration NEXT messages received",
+                            1,
+                            GNUNET_NO);
   rid = ntohl (zis_msg->gns_header.r_id);
+  limit = GNUNET_ntohll (zis_msg->limit);
   for (zi = nc->op_head; NULL != zi; zi = zi->next)
     if (zi->request_id == rid)
       break;
@@ -1497,7 +1588,8 @@ handle_iteration_next (void *cls,
     GNUNET_SERVICE_client_drop (nc->client);
     return;
   }
-  run_zone_iteration_round (zi);
+  run_zone_iteration_round (zi,
+                            limit);
   GNUNET_SERVICE_client_continue (nc->client);
 }
 
@@ -1533,6 +1625,7 @@ monitor_next (void *cls);
  * A #GNUNET_NAMESTORE_RecordIterator for monitors.
  *
  * @param cls a 'struct ZoneMonitor *' with information about the monitor
+ * @param seq sequence number of the record
  * @param zone_key zone key of the zone
  * @param name name
  * @param rd_count number of records in @a rd
@@ -1540,6 +1633,7 @@ monitor_next (void *cls);
  */
 static void
 monitor_iterate_cb (void *cls,
+                    uint64_t seq,
                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
                     const char *name,
                     unsigned int rd_count,
@@ -1547,12 +1641,17 @@ monitor_iterate_cb (void *cls,
 {
   struct ZoneMonitor *zm = cls;
 
+  zm->seq = seq;
   if (NULL == name)
   {
     /* finished with iteration */
     monitor_sync (zm);
     return;
   }
+  GNUNET_STATISTICS_update (statistics,
+                            "Monitor notifications sent",
+                            1,
+                            GNUNET_NO);
   send_lookup_response (zm->nc,
                         0,
                         zone_key,
@@ -1598,7 +1697,7 @@ handle_monitor_start (void *cls,
 
 
 /**
- * Obtain the next datum during the zone monitor's zone intiial iteration.
+ * Obtain the next datum during the zone monitor's zone initial iteration.
  *
  * @param cls zone monitor that does its initial iteration
  */
@@ -1615,7 +1714,8 @@ monitor_next (void *cls)
                                                      sizeof (zero)))
                                        ? NULL
                                        : &zm->zone,
-                                       zm->offset++,
+                                       zm->seq,
+                                       1,
                                        &monitor_iterate_cb,
                                        zm);
   if (GNUNET_SYSERR == ret)
@@ -1650,9 +1750,19 @@ run (void *cls,
   (void) service;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Starting namestore service\n");
+  cache_keys = GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                                     "namestore",
+                                                     "CACHE_KEYS");
+  disable_namecache = GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                                            "namecache",
+                                                            "DISABLE");
   GSN_cfg = cfg;
   monitor_nc = GNUNET_notification_context_create (1);
-  namecache = GNUNET_NAMECACHE_connect (cfg);
+  if (GNUNET_YES != disable_namecache)
+  {
+    namecache = GNUNET_NAMECACHE_connect (cfg);
+    GNUNET_assert (NULL != namecache);
+  }
   /* Loading database plugin */
   if (GNUNET_OK !=
       GNUNET_CONFIGURATION_get_value_string (cfg,
@@ -1668,6 +1778,8 @@ run (void *cls,
   GSN_database = GNUNET_PLUGIN_load (db_lib_name,
                                      (void *) GSN_cfg);
   GNUNET_free (database);
+  statistics = GNUNET_STATISTICS_create ("namestore",
+                                         cfg);
   GNUNET_SCHEDULER_add_shutdown (&cleanup_task,
                                  NULL);
   if (NULL == GSN_database)
diff --git a/src/namestore/gnunet-zoneimport.c b/src/namestore/gnunet-zoneimport.c
index 4f4151c94..0fd0a4ab8 100644
--- a/src/namestore/gnunet-zoneimport.c
+++ b/src/namestore/gnunet-zoneimport.c
@@ -21,9 +21,6 @@
  * @file src/namestore/gnunet-zoneimport.c
  * @brief import a DNS zone for publication in GNS, incremental
  * @author Christian Grothoff
- *
- * TODO:
- * - set NICKname for zone's records
  */
 #include "platform.h"
 #include <gnunet_util_lib.h>
@@ -31,13 +28,14 @@
 #include <gnunet_dnsparser_lib.h>
 #include <gnunet_gnsrecord_lib.h>
 #include <gnunet_namestore_service.h>
+#include <gnunet_statistics_service.h>
 #include <gnunet_identity_service.h>
 
 
 /**
  * Maximum number of queries pending at the same time.
  */
-#define THRESH 20
+#define THRESH 100
 
 /**
  * TIME_THRESH is in usecs.  How quickly do we submit fresh queries.
@@ -51,10 +49,20 @@
 #define MAX_RETRIES 5
 
 /**
- * After how many lookups should we always sync to disk?
+ * How many DNS requests do we at most issue in rapid series?
+ */
+#define MAX_SERIES 10
+
+/**
+ * How long do we wait at least between series of requests?
  */
-#define TRANSACTION_SYNC_FREQ 100
+#define SERIES_DELAY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MICROSECONDS, 10)
 
+/**
+ * How many requests do we request from NAMESTORE in one batch
+ * during our initial iteration?
+ */
+#define NS_BATCH_SIZE 1024
 
 /**
  * Some zones may include authoritative records for other
@@ -112,7 +120,9 @@ struct Record
 
 
 /**
- * Request we should make.
+ * Request we should make.  We keep this struct in memory per request,
+ * thus optimizing it is crucial for the overall memory consumption of
+ * the zone importer.
  */
 struct Request
 {
@@ -149,21 +159,13 @@ struct Request
   struct GNUNET_DNSSTUB_RequestSocket *rs;
 
   /**
-   * Raw DNS query.
-   */
-  void *raw;
-
-  /**
-   * Hostname we are resolving.
+   * Hostname we are resolving, allocated at the end of
+   * this struct (optimizing memory consumption by reducing
+   * total number of allocations).
    */
   char *hostname;
 
   /**
-   * Label (without TLD) which we are resolving.
-   */
-  char *label;
-
-  /**
    * Namestore operation pending for this record.
    */
   struct GNUNET_NAMESTORE_QueueEntry *qe;
@@ -174,12 +176,6 @@ struct Request
   const struct Zone *zone;
 
   /**
-   * Answer we got back and are currently parsing, or NULL
-   * if not active.
-   */
-  struct GNUNET_DNSPARSER_Packet *p;
-
-  /**
    * At what time does the (earliest) of the returned records
    * for this name expire? At this point, we need to re-fetch
    * the record.
@@ -187,20 +183,18 @@ struct Request
   struct GNUNET_TIME_Absolute expires;
 
   /**
-   * Number of bytes in @e raw.
+   * While we are fetching the record, the value is set to the
+   * starting time of the DNS operation.  While doing a
+   * NAMESTORE store, again set to the start time of the
+   * NAMESTORE operation.
    */
-  size_t raw_len;
-
-  /**
-   * When did we last issue this request?
-   */
-  time_t time;
+  struct GNUNET_TIME_Absolute op_start_time;
 
   /**
    * How often did we issue this query? (And failed, reset
    * to zero once we were successful.)
    */
-  int issue_num;
+  unsigned int issue_num;
 
   /**
    * random 16-bit DNS query identifier.
@@ -210,6 +204,14 @@ struct Request
 
 
 /**
+ * Command-line argument specifying desired size of the hash map with
+ * all of our pending names.  Usually, we use an automatically growing
+ * map, but this is only OK up to about a million entries.  Above that
+ * number, the user must explicitly specify the size at startup.
+ */
+static unsigned int map_size = 1024;
+
+/**
  * Handle to the identity service.
  */
 static struct GNUNET_IDENTITY_Handle *id;
@@ -220,21 +222,36 @@ static struct GNUNET_IDENTITY_Handle *id;
 static struct GNUNET_NAMESTORE_Handle *ns;
 
 /**
+ * Handle to the statistics service.
+ */
+static struct GNUNET_STATISTICS_Handle *stats;
+
+/**
  * Context for DNS resolution.
  */
 static struct GNUNET_DNSSTUB_Context *ctx;
 
 /**
- * The number of queries that are outstanding
+ * The number of DNS queries that are outstanding
  */
 static unsigned int pending;
 
 /**
+ * The number of NAMESTORE record store operations that are outstanding
+ */
+static unsigned int pending_rs;
+
+/**
  * Number of lookups we performed overall.
  */
 static unsigned int lookups;
 
 /**
+ * Number of records we had cached.
+ */
+static unsigned int cached;
+
+/**
  * How many hostnames did we reject (malformed).
  */
 static unsigned int rejects;
@@ -250,6 +267,11 @@ static unsigned int failures;
 static unsigned int records;
 
 /**
+ * Number of record sets given to namestore.
+ */
+static unsigned int record_sets;
+
+/**
  * Heap of all requests to perform, sorted by
  * the time we should next do the request (i.e. by expires).
  */
@@ -271,9 +293,16 @@ static struct Request *req_tail;
 static struct GNUNET_SCHEDULER_Task *t;
 
 /**
- * Which DNS server do we use for queries?
+ * Hash map of requests for which we may still get a response from
+ * the namestore.  Set to NULL once the initial namestore iteration
+ * is done.
+ */
+static struct GNUNET_CONTAINER_MultiHashMap *ns_pending;
+
+/**
+ * Current zone iteration handle.
  */
-static char *dns_server;
+static struct GNUNET_NAMESTORE_ZoneIterator *zone_it;
 
 /**
  * Head of list of zones we are managing.
@@ -285,6 +314,47 @@ static struct Zone *zone_head;
  */
 static struct Zone *zone_tail;
 
+/**
+ * After how many more results must #ns_lookup_result_cb() ask
+ * the namestore for more?
+ */
+static uint64_t ns_iterator_trigger_next;
+
+/**
+ * Number of DNS requests counted in latency total.
+ */
+static uint64_t total_dns_latency_cnt;
+
+/**
+ * Sum of DNS latencies observed.
+ */
+static struct GNUNET_TIME_Relative total_dns_latency;
+
+/**
+ * Number of records processed (DNS lookup, no NAMESTORE) in total.
+ */
+static uint64_t total_reg_proc_dns;
+
+/**
+ * Number of records processed (DNS lookup, with NAMESTORE) in total.
+ */
+static uint64_t total_reg_proc_dns_ns;
+
+/**
+ * Start time of the regular processing.
+ */
+static struct GNUNET_TIME_Absolute start_time_reg_proc;
+
+/**
+ * Last time we worked before going idle.
+ */
+static struct GNUNET_TIME_Absolute sleep_time_reg_proc;
+
+/**
+ * Time we slept just waiting for work.
+ */
+static struct GNUNET_TIME_Relative idle_time;
+
 
 /**
  * Callback for #for_all_records
@@ -335,15 +405,107 @@ for_all_records (const struct GNUNET_DNSPARSER_Packet *p,
 
 
 /**
- * Free @a req and data structures reachable from it.
+ * Return just the label of the hostname in @a req.
  *
- * @param req request to free
+ * @param req request to process hostname of
+ * @return statically allocated pointer to the label,
+ *         overwritten upon the next request!
+ */
+static const char *
+get_label (struct Request *req)
+{
+  static char label[64];
+  const char *dot;
+
+  dot = strchr (req->hostname,
+                (unsigned char) '.');
+  if (NULL == dot)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (((size_t) (dot - req->hostname)) >= sizeof (label))
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  memcpy (label,
+          req->hostname,
+          dot - req->hostname);
+  label[dot - req->hostname] = '\0';
+  return label;
+}
+
+
+/**
+ * Build DNS query for @a hostname.
+ *
+ * @param hostname host to build query for
+ * @param raw_size[out] number of bytes in the query
+ * @return NULL on error, otherwise pointer to statically (!)
+ *         allocated query buffer
+ */
+static void *
+build_dns_query (struct Request *req,
+                 size_t *raw_size)
+{
+  static char raw[512];
+  char *rawp;
+  struct GNUNET_DNSPARSER_Packet p;
+  struct GNUNET_DNSPARSER_Query q;
+
+  q.name = (char *) req->hostname;
+  q.type = GNUNET_DNSPARSER_TYPE_NS;
+  q.dns_traffic_class = GNUNET_TUN_DNS_CLASS_INTERNET;
+
+  memset (&p,
+          0,
+          sizeof (p));
+  p.num_queries = 1;
+  p.queries = &q;
+  p.id = req->id;
+  if (GNUNET_OK !=
+      GNUNET_DNSPARSER_pack (&p,
+                             UINT16_MAX,
+                             &rawp,
+                             raw_size))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to pack query for hostname `%s'\n",
+                req->hostname);
+    rejects++;
+    return NULL;
+  }
+  if (*raw_size > sizeof (raw))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to pack query for hostname `%s'\n",
+                req->hostname);
+    rejects++;
+    GNUNET_break (0);
+    GNUNET_free (rawp);
+    return NULL;
+  }
+  memcpy (raw,
+          rawp,
+          *raw_size);
+  GNUNET_free (rawp);
+  return raw;
+}
+
+
+
+/**
+ * Free records associated with @a req.
+ *
+ * @param req request to free records of
  */
 static void
-free_request (struct Request *req)
+free_records (struct Request *req)
 {
   struct Record *rec;
 
+  /* Free records */
   while (NULL != (rec = req->rec_head))
   {
     GNUNET_CONTAINER_DLL_remove (req->rec_head,
@@ -351,9 +513,18 @@ free_request (struct Request *req)
                                  rec);
     GNUNET_free (rec);
   }
-  GNUNET_free (req->hostname);
-  GNUNET_free (req->label);
-  GNUNET_free (req->raw);
+}
+
+
+/**
+ * Free @a req and data structures reachable from it.
+ *
+ * @param req request to free
+ */
+static void
+free_request (struct Request *req)
+{
+  free_records (req);
   GNUNET_free (req);
 }
 
@@ -382,6 +553,7 @@ insert_sorted (struct Request *req)
   {
     if (NULL != t)
       GNUNET_SCHEDULER_cancel (t);
+    sleep_time_reg_proc = GNUNET_TIME_absolute_get ();
     t = GNUNET_SCHEDULER_add_at (req->expires,
                                  &process_queue,
                                  NULL);
@@ -564,16 +736,35 @@ check_for_glue (void *cls,
 
 
 /**
+ * Closure for #process_record().
+ */
+struct ProcessRecordContext
+{
+  /**
+   * Answer we got back and are currently parsing, or NULL
+   * if not active.
+   */
+  struct GNUNET_DNSPARSER_Packet *p;
+
+  /**
+   * Request we are processing.
+   */
+  struct Request *req;
+};
+
+
+/**
  * We received @a rec for @a req. Remember the answer.
  *
- * @param cls a `struct Request`
+ * @param cls a `struct ProcessRecordContext`
  * @param rec response
  */
 static void
 process_record (void *cls,
                 const struct GNUNET_DNSPARSER_Record *rec)
 {
-  struct Request *req = cls;
+  struct ProcessRecordContext *prc = cls;
+  struct Request *req = prc->req;
   char dst[65536];
   size_t dst_len;
   size_t off;
@@ -585,7 +776,7 @@ process_record (void *cls,
                        req->hostname))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "DNS returned record for `%s' of type %u while resolving `%s'\n",
+                "DNS returned record from zone `%s' of type %u while resolving `%s'\n",
                 rec->name,
                 (unsigned int) rec->type,
                 req->hostname);
@@ -600,6 +791,10 @@ process_record (void *cls,
                 req->hostname);
     return; /* record expired */
   }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "DNS returned record that expires at %s for `%s'\n",
+              GNUNET_STRINGS_absolute_time_to_string (rec->expiration_time),
+              req->hostname);
   switch (rec->type)
   {
   case GNUNET_DNSPARSER_TYPE_NS:
@@ -610,7 +805,7 @@ process_record (void *cls,
       gc.req = req;
       gc.ns = rec->data.hostname;
       gc.found = GNUNET_NO;
-      for_all_records (req->p,
+      for_all_records (prc->p,
                        &check_for_glue,
                        &gc);
       if ( (GNUNET_NO == gc.found) &&
@@ -665,10 +860,10 @@ process_record (void *cls,
     break;
   case GNUNET_DNSPARSER_TYPE_DNAME:
     /* No support for DNAME in GNS yet! FIXME: support later! */
-    fprintf (stdout,
-             "FIXME: not supported: %s DNAME %s\n",
-             rec->name,
-             rec->data.hostname);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "FIXME: not supported: %s DNAME %s\n",
+                rec->name,
+                rec->data.hostname);
     break;
   case GNUNET_DNSPARSER_TYPE_MX:
     if (GNUNET_OK ==
@@ -794,10 +989,10 @@ store_completed_cb (void *cls,
                     int32_t success,
                     const char *emsg)
 {
+  static struct GNUNET_TIME_Absolute last;
   struct Request *req = cls;
 
   req->qe = NULL;
-  pending--;
   if (GNUNET_SYSERR == success)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
@@ -807,9 +1002,75 @@ store_completed_cb (void *cls,
   }
   else
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                "Stored records under `%s'\n",
-                req->label);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Stored records under `%s' (%d)\n",
+                req->hostname,
+                success);
+  }
+  total_reg_proc_dns_ns++; /* finished regular processing */
+  pending_rs--;
+  free_records (req);
+  /* compute NAMESTORE statistics */
+  {
+    static uint64_t total_ns_latency_cnt;
+    static struct GNUNET_TIME_Relative total_ns_latency;
+    struct GNUNET_TIME_Relative ns_latency;
+
+    ns_latency = GNUNET_TIME_absolute_get_duration (req->op_start_time);
+    total_ns_latency = GNUNET_TIME_relative_add (total_ns_latency,
+                                                 ns_latency);
+    if (0 == total_ns_latency_cnt)
+      last = GNUNET_TIME_absolute_get ();
+    total_ns_latency_cnt++;
+    if (0 == (total_ns_latency_cnt % 1000))
+    {
+      struct GNUNET_TIME_Relative delta;
+
+      delta = GNUNET_TIME_absolute_get_duration (last);
+      last = GNUNET_TIME_absolute_get ();
+      fprintf (stderr,
+               "Processed 1000 records in %s\n",
+               GNUNET_STRINGS_relative_time_to_string (delta,
+                                                       GNUNET_YES));
+      GNUNET_STATISTICS_set (stats,
+                             "# average NAMESTORE PUT latency (μs)",
+                             total_ns_latency.rel_value_us / total_ns_latency_cnt,
+                             GNUNET_NO);
+    }
+  }
+  /* compute and publish overall velocity */
+  if (0 == (total_reg_proc_dns_ns % 100) )
+  {
+    struct GNUNET_TIME_Relative runtime;
+
+    runtime = GNUNET_TIME_absolute_get_duration (start_time_reg_proc);
+    runtime = GNUNET_TIME_relative_subtract (runtime,
+                                             idle_time);
+    runtime = GNUNET_TIME_relative_divide (runtime,
+                                           total_reg_proc_dns + total_reg_proc_dns_ns);
+    GNUNET_STATISTICS_set (stats,
+                           "# Regular processing completed without NAMESTORE",
+                           total_reg_proc_dns,
+                           GNUNET_NO);
+    GNUNET_STATISTICS_set (stats,
+                           "# Regular processing completed with NAMESTORE PUT",
+                           total_reg_proc_dns_ns,
+                           GNUNET_NO);
+    GNUNET_STATISTICS_set (stats,
+                           "# average request processing latency (μs)",
+                           runtime.rel_value_us,
+                           GNUNET_NO);
+    GNUNET_STATISTICS_set (stats,
+                           "# total time spent idle (μs)",
+                           idle_time.rel_value_us,
+                           GNUNET_NO);
+  }
+
+  if (NULL == t)
+  {
+    sleep_time_reg_proc = GNUNET_TIME_absolute_get ();
+    t = GNUNET_SCHEDULER_add_now (&process_queue,
+                                  NULL);
   }
 }
 
@@ -818,13 +1079,11 @@ store_completed_cb (void *cls,
  * Function called with the result of a DNS resolution.
  *
  * @param cls closure with the `struct Request`
- * @param rs socket that received the response
  * @param dns dns response, never NULL
  * @param dns_len number of bytes in @a dns
  */
 static void
 process_result (void *cls,
-                struct GNUNET_DNSSTUB_RequestSocket *rs,
                 const struct GNUNET_TUN_DnsHeader *dns,
                 size_t dns_len)
 {
@@ -833,7 +1092,6 @@ process_result (void *cls,
   struct GNUNET_DNSPARSER_Packet *p;
   unsigned int rd_count;
 
-  (void) rs;
   GNUNET_assert (NULL == req->hn);
   if (NULL == dns)
   {
@@ -842,26 +1100,50 @@ process_result (void *cls,
                                  req_tail,
                                  req);
     pending--;
+    if (NULL == t)
+    {
+      sleep_time_reg_proc = GNUNET_TIME_absolute_get ();
+      t = GNUNET_SCHEDULER_add_now (&process_queue,
+                                    NULL);
+    }
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 "Stub gave up on DNS reply for `%s'\n",
                 req->hostname);
+    GNUNET_STATISTICS_update (stats,
+                              "# DNS lookups timed out",
+                              1,
+                              GNUNET_NO);
     if (req->issue_num > MAX_RETRIES)
     {
       failures++;
       free_request (req);
+      GNUNET_STATISTICS_update (stats,
+                                "# requests given up on",
+                                1,
+                                GNUNET_NO);
       return;
     }
+    total_reg_proc_dns++;
     req->rs = NULL;
     insert_sorted (req);
     return;
   }
   if (req->id != dns->id)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "DNS ID did not match request, ignoring reply\n");
+    GNUNET_STATISTICS_update (stats,
+                              "# DNS ID missmatches",
+                              1,
+                              GNUNET_NO);
     return;
+  }
   GNUNET_CONTAINER_DLL_remove (req_head,
                                req_tail,
                                req);
   GNUNET_DNSSTUB_resolve_cancel (req->rs);
   req->rs = NULL;
+  pending--;
   p = GNUNET_DNSPARSER_parse ((const char *) dns,
                               dns_len);
   if (NULL == p)
@@ -869,35 +1151,59 @@ process_result (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 "Failed to parse DNS reply for `%s'\n",
                 req->hostname);
+    GNUNET_STATISTICS_update (stats,
+                              "# DNS parser errors",
+                              1,
+                              GNUNET_NO);
+    if (NULL == t)
+    {
+      sleep_time_reg_proc = GNUNET_TIME_absolute_get ();
+      t = GNUNET_SCHEDULER_add_now (&process_queue,
+                                    NULL);
+    }
     if (req->issue_num > MAX_RETRIES)
     {
       failures++;
-      insert_sorted (req);
-      pending--;
+      free_request (req);
+      GNUNET_STATISTICS_update (stats,
+                                "# requests given up on",
+                                1,
+                                GNUNET_NO);
       return;
     }
     insert_sorted (req);
-    pending--;
     return;
   }
-  /* Free old/legacy records */
-  while (NULL != (rec = req->rec_head))
-  {
-    GNUNET_CONTAINER_DLL_remove (req->rec_head,
-                                 req->rec_tail,
-                                 rec);
-    GNUNET_free (rec);
-  }
   /* import new records */
   req->issue_num = 0; /* success, reset counter! */
-  req->p = p;
-  for_all_records (p,
-                   &process_record,
-                   req);
-  req->p = NULL;
+  {
+    struct ProcessRecordContext prc = {
+      .req = req,
+      .p = p
+    };
+
+    for_all_records (p,
+                     &process_record,
+                     &prc);
+  }
   GNUNET_DNSPARSER_free_packet (p);
   /* count records found, determine minimum expiration time */
   req->expires = GNUNET_TIME_UNIT_FOREVER_ABS;
+  {
+    struct GNUNET_TIME_Relative dns_latency;
+
+    dns_latency = GNUNET_TIME_absolute_get_duration (req->op_start_time);
+    total_dns_latency = GNUNET_TIME_relative_add (total_dns_latency,
+                                                  dns_latency);
+    total_dns_latency_cnt++;
+    if (0 == (total_dns_latency_cnt % 1000))
+    {
+      GNUNET_STATISTICS_set (stats,
+                             "# average DNS lookup latency (μs)",
+                             total_dns_latency.rel_value_us / total_dns_latency_cnt,
+                             GNUNET_NO);
+    }
+  }
   rd_count = 0;
   for (rec = req->rec_head; NULL != rec; rec = rec->next)
   {
@@ -915,8 +1221,18 @@ process_result (void *cls,
   /* Instead of going for SOA, simplified for now to look each
      day in case we got an empty response */
   if (0 == rd_count)
+  {
     req->expires
       = GNUNET_TIME_relative_to_absolute (GNUNET_TIME_UNIT_DAYS);
+    GNUNET_STATISTICS_update (stats,
+                              "# empty DNS replies (usually NXDOMAIN)",
+                              1,
+                              GNUNET_NO);
+  }
+  else
+  {
+    record_sets++;
+  }
   /* convert records to namestore import format */
   {
     struct GNUNET_GNSRECORD_Data rd[GNUNET_NZL(rd_count)];
@@ -925,67 +1241,22 @@ process_result (void *cls,
     /* convert linked list into array */
     for (rec = req->rec_head; NULL != rec; rec =rec->next)
       rd[off++] = rec->grd;
+    pending_rs++;
+    req->op_start_time = GNUNET_TIME_absolute_get ();
     req->qe = GNUNET_NAMESTORE_records_store (ns,
                                               &req->zone->key,
-                                              req->label,
+                                              get_label (req),
                                               rd_count,
                                               rd,
                                               &store_completed_cb,
                                               req);
+    GNUNET_assert (NULL != req->qe);
   }
   insert_sorted (req);
 }
 
 
 /**
- * Submit a request to DNS unless we need to slow down because
- * we are at the rate limit.
- *
- * @param req request to submit
- * @return #GNUNET_OK if request was submitted
- *         #GNUNET_NO if request was already submitted
- *         #GNUNET_SYSERR if we are at the rate limit
- */
-static int
-submit_req (struct Request *req)
-{
-  static struct GNUNET_TIME_Absolute last_request;
-  struct GNUNET_TIME_Absolute now;
-
-  if (NULL != req->qe)
-    return GNUNET_NO; /* namestore op still pending */
-  if (NULL != req->rs)
-  {
-    GNUNET_break (0);
-    return GNUNET_NO; /* already submitted */
-  }
-  now = GNUNET_TIME_absolute_get ();
-  if ( (now.abs_value_us - last_request.abs_value_us < TIME_THRESH) ||
-       (pending >= THRESH) )
-    return GNUNET_SYSERR;
-  GNUNET_CONTAINER_DLL_insert (req_head,
-                               req_tail,
-                               req);
-  GNUNET_assert (NULL == req->rs);
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-              "Requesting resolution for `%s'\n",
-              req->hostname);
-  req->rs = GNUNET_DNSSTUB_resolve2 (ctx,
-                                     req->raw,
-                                     req->raw_len,
-                                     &process_result,
-                                     req);
-  GNUNET_assert (NULL != req->rs);
-  req->issue_num++;
-  last_request = now;
-  lookups++;
-  pending++;
-  req->time = time (NULL);
-  return GNUNET_OK;
-}
-
-
-/**
  * Process as many requests as possible from the queue.
  *
  * @param cls NULL
@@ -994,26 +1265,79 @@ static void
 process_queue (void *cls)
 {
   struct Request *req;
+  unsigned int series;
+  void *raw;
+  size_t raw_size;
+  struct GNUNET_TIME_Relative delay;
 
   (void) cls;
+  delay = GNUNET_TIME_absolute_get_duration (sleep_time_reg_proc);
+  idle_time = GNUNET_TIME_relative_add (idle_time,
+                                        delay);
+  series = 0;
   t = NULL;
-  while (1)
+  while (pending + pending_rs < THRESH)
   {
     req = GNUNET_CONTAINER_heap_peek (req_heap);
     if (NULL == req)
       break;
+    if (NULL != req->qe)
+      return; /* namestore op still pending */
+    if (NULL != req->rs)
+    {
+      GNUNET_break (0);
+      return; /* already submitted */
+    }
     if (GNUNET_TIME_absolute_get_remaining (req->expires).rel_value_us > 0)
       break;
-    if (GNUNET_OK != submit_req (req))
-      break;
     GNUNET_assert (req ==
                    GNUNET_CONTAINER_heap_remove_root (req_heap));
     req->hn = NULL;
+    GNUNET_CONTAINER_DLL_insert (req_head,
+                                 req_tail,
+                                 req);
+    GNUNET_assert (NULL == req->rs);
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Requesting resolution for `%s'\n",
+                req->hostname);
+    raw = build_dns_query (req,
+                           &raw_size);
+    if (NULL == raw)
+    {
+      GNUNET_break (0);
+      free_request (req);
+      continue;
+    }
+    req->op_start_time = GNUNET_TIME_absolute_get ();
+    req->rs = GNUNET_DNSSTUB_resolve (ctx,
+                                      raw,
+                                      raw_size,
+                                      &process_result,
+                                      req);
+    GNUNET_assert (NULL != req->rs);
+    req->issue_num++;
+    lookups++;
+    pending++;
+    series++;
+    if (series > MAX_SERIES)
+      break;
+  }
+  if (pending + pending_rs >= THRESH)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Stopped processing queue (%u+%u/%u)]\n",
+                pending,
+                pending_rs,
+                THRESH);
+    return; /* wait for replies */
   }
-
   req = GNUNET_CONTAINER_heap_peek (req_heap);
   if (NULL == req)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Stopped processing queue: empty queue\n");
     return;
+  }
   if (GNUNET_TIME_absolute_get_remaining (req->expires).rel_value_us > 0)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_INFO,
@@ -1022,20 +1346,43 @@ process_queue (void *cls)
                 req->hostname);
     if (NULL != t)
       GNUNET_SCHEDULER_cancel (t);
+    sleep_time_reg_proc = GNUNET_TIME_absolute_get ();
     t = GNUNET_SCHEDULER_add_at (req->expires,
                                  &process_queue,
                                  NULL);
+    return;
   }
-  else
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Throttling for 1ms\n");
-    if (NULL != t)
-      GNUNET_SCHEDULER_cancel (t);
-    t = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_MILLISECONDS,
-                                      &process_queue,
-                                      NULL);
-  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Throttling\n");
+  if (NULL != t)
+    GNUNET_SCHEDULER_cancel (t);
+  sleep_time_reg_proc = GNUNET_TIME_absolute_get ();
+  t = GNUNET_SCHEDULER_add_delayed (SERIES_DELAY,
+                                    &process_queue,
+                                    NULL);
+}
+
+
+/**
+ * Iterator called during #do_shutdown() to free requests in
+ * the #ns_pending map.
+ *
+ * @param cls NULL
+ * @param key unused
+ * @param value the `struct Request` to free
+ * @return #GNUNET_OK
+ */
+static int
+free_request_it (void *cls,
+                 const struct GNUNET_HashCode *key,
+                 void *value)
+{
+  struct Request *req = value;
+
+  (void) cls;
+  (void) key;
+  free_request (req);
+  return GNUNET_OK;
 }
 
 
@@ -1061,33 +1408,50 @@ do_shutdown (void *cls)
     GNUNET_SCHEDULER_cancel (t);
     t = NULL;
   }
-  if (NULL != ns)
-  {
-    GNUNET_NAMESTORE_disconnect (ns);
-    ns = NULL;
-  }
-  if (NULL != ctx)
-  {
-    GNUNET_DNSSTUB_stop (ctx);
-    ctx = NULL;
-  }
   while (NULL != (req = req_head))
   {
     GNUNET_CONTAINER_DLL_remove (req_head,
                                  req_tail,
                                  req);
+    if (NULL != req->qe)
+      GNUNET_NAMESTORE_cancel (req->qe);
     free_request (req);
   }
   while (NULL != (req = GNUNET_CONTAINER_heap_remove_root (req_heap)))
   {
     req->hn = NULL;
+    if (NULL != req->qe)
+      GNUNET_NAMESTORE_cancel (req->qe);
     free_request (req);
   }
+  if (NULL != zone_it)
+  {
+    GNUNET_NAMESTORE_zone_iteration_stop (zone_it);
+    zone_it = NULL;
+  }
+  if (NULL != ns)
+  {
+    GNUNET_NAMESTORE_disconnect (ns);
+    ns = NULL;
+  }
+  if (NULL != ctx)
+  {
+    GNUNET_DNSSTUB_stop (ctx);
+    ctx = NULL;
+  }
   if (NULL != req_heap)
   {
     GNUNET_CONTAINER_heap_destroy (req_heap);
     req_heap = NULL;
   }
+  if (NULL != ns_pending)
+  {
+    GNUNET_CONTAINER_multihashmap_iterate (ns_pending,
+                                           &free_request_it,
+                                           NULL);
+    GNUNET_CONTAINER_multihashmap_destroy (ns_pending);
+    ns_pending = NULL;
+  }
   while (NULL != (zone = zone_head))
   {
     GNUNET_CONTAINER_DLL_remove (zone_head,
@@ -1096,52 +1460,93 @@ do_shutdown (void *cls)
     GNUNET_free (zone->domain);
     GNUNET_free (zone);
   }
+  if (NULL != stats)
+  {
+    GNUNET_STATISTICS_destroy (stats, GNUNET_NO);
+    stats = NULL;
+  }
 }
 
 
 /**
  * Function called if #GNUNET_NAMESTORE_records_lookup() failed.
- * Continues resolution based on assumption namestore has no data.
+ * Just logs an error.
  *
- * @param cls a `struct Request`
+ * @param cls a `struct Zone`
  */
 static void
 ns_lookup_error_cb (void *cls)
 {
-  struct Request *req = cls;
+  struct Zone *zone = cls;
 
-  req->qe = NULL;
   GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-              "Failed to load data from namestore for `%s'\n",
-              req->label);
-  insert_sorted (req);
+              "Failed to load data from namestore for zone `%s'\n",
+              zone->domain);
 }
 
 
 /**
  * Process a record that was stored in the namestore.
  *
- * @param cls a `struct Request *`
- * @param zone private key of the zone
+ * @param cls a `struct Zone *`
+ * @param key private key of the zone
  * @param label label of the records
  * @param rd_count number of entries in @a rd array, 0 if label was deleted
  * @param rd array of records with data to store
  */
 static void
 ns_lookup_result_cb (void *cls,
-                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
                      const char *label,
                      unsigned int rd_count,
                      const struct GNUNET_GNSRECORD_Data *rd)
 {
-  struct Request *req = cls;
+  struct Zone *zone = cls;
+  struct Request *req;
+  struct GNUNET_HashCode hc;
+  char *fqdn;
 
-  req->qe = NULL;
-  GNUNET_break (0 == memcmp (zone,
+  ns_iterator_trigger_next--;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Obtained NAMESTORE reply, %llu left in round\n",
+              (unsigned long long) ns_iterator_trigger_next);
+  if (0 == ns_iterator_trigger_next)
+  {
+    ns_iterator_trigger_next = NS_BATCH_SIZE;
+    GNUNET_STATISTICS_update (stats,
+                              "# NAMESTORE records requested from cache",
+                              ns_iterator_trigger_next,
+                              GNUNET_NO);
+    GNUNET_NAMESTORE_zone_iterator_next (zone_it,
+                                         ns_iterator_trigger_next);
+  }
+  GNUNET_asprintf (&fqdn,
+                   "%s.%s",
+                   label,
+                   zone->domain);
+  GNUNET_CRYPTO_hash (fqdn,
+                      strlen (fqdn) + 1,
+                      &hc);
+  GNUNET_free (fqdn);
+  req = GNUNET_CONTAINER_multihashmap_get (ns_pending,
+                                           &hc);
+  if (NULL == req)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Ignoring record `%s' in zone `%s': not on my list!\n",
+                label,
+                zone->domain);
+    return;
+  }
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONTAINER_multihashmap_remove (ns_pending,
+                                                       &hc,
+                                                       req));
+  GNUNET_break (0 == memcmp (key,
                              &req->zone->key,
-                             sizeof (*zone)));
+                             sizeof (*key)));
   GNUNET_break (0 == strcasecmp (label,
-                                 req->label));
+                                 get_label (req)));
   for (unsigned int i=0;i<rd_count;i++)
   {
     struct GNUNET_TIME_Absolute at;
@@ -1157,12 +1562,13 @@ ns_lookup_result_cb (void *cls,
   {
     GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                 "Empty record set in namestore for `%s'\n",
-                req->label);
+                req->hostname);
   }
   else
   {
     unsigned int pos = 0;
 
+    cached++;
     req->expires = GNUNET_TIME_UNIT_FOREVER_ABS;
     for (struct Record *rec = req->rec_head;
          NULL != rec;
@@ -1180,8 +1586,10 @@ ns_lookup_result_cb (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                 "Hot-start with %u existing records for `%s'\n",
                 pos,
-                req->label);
+                req->hostname);
   }
+  free_records (req);
+
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Adding `%s' to worklist to start at %s\n",
               req->hostname,
@@ -1198,13 +1606,11 @@ ns_lookup_result_cb (void *cls,
 static void
 queue (const char *hostname)
 {
-  struct GNUNET_DNSPARSER_Packet p;
-  struct GNUNET_DNSPARSER_Query q;
   struct Request *req;
-  char *raw;
-  size_t raw_size;
   const char *dot;
   struct Zone *zone;
+  size_t hlen;
+  struct GNUNET_HashCode hc;
 
   if (GNUNET_OK !=
       GNUNET_DNSPARSER_check_name (hostname))
@@ -1237,46 +1643,131 @@ queue (const char *hostname)
                 dot + 1);
     return;
   }
-  q.name = (char *) hostname;
-  q.type = GNUNET_DNSPARSER_TYPE_NS;
-  q.dns_traffic_class = GNUNET_TUN_DNS_CLASS_INTERNET;
-
-  memset (&p,
-          0,
-          sizeof (p));
-  p.num_queries = 1;
-  p.queries = &q;
-  p.id = (uint16_t) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE,
-                                              UINT16_MAX);
 
+  hlen = strlen (hostname) + 1;
+  req = GNUNET_malloc (sizeof (struct Request) + hlen);
+  req->zone = zone;
+  req->hostname = (char *) &req[1];
+  memcpy (req->hostname,
+          hostname,
+          hlen);
+  req->id = (uint16_t) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE,
+                                                 UINT16_MAX);
+  GNUNET_CRYPTO_hash (req->hostname,
+                      hlen,
+                      &hc);
   if (GNUNET_OK !=
-      GNUNET_DNSPARSER_pack (&p,
-                             UINT16_MAX,
-                             &raw,
-                             &raw_size))
+      GNUNET_CONTAINER_multihashmap_put (ns_pending,
+                                         &hc,
+                                         req,
+                                         GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "Failed to pack query for hostname `%s'\n",
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Duplicate hostname `%s' ignored\n",
                 hostname);
-    rejects++;
+    GNUNET_free (req);
     return;
   }
+}
+
+
+/**
+ * We have completed the initial iteration over the namestore's database.
+ * This function is called on each of the remaining records in
+ * #move_to_queue to #queue() them, as we will simply not find existing
+ * records for them any longer.
+ *
+ * @param cls NULL
+ * @param key unused
+ * @param value a `struct Request`
+ * @return #GNUNET_OK (continue to iterate)
+ */
+static int
+move_to_queue (void *cls,
+               const struct GNUNET_HashCode *key,
+               void *value)
+{
+  struct Request *req = value;
+
+  (void) cls;
+  (void) key;
+  insert_sorted (req);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Iterate over all of the zones we care about and see which records
+ * we may need to re-fetch when.
+ *
+ * @param cls NULL
+ */
+static void
+iterate_zones (void *cls)
+{
+  static struct Zone *last;
+
+  (void) cls;
+  if (NULL != zone_it)
+  {
+    zone_it = NULL;
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Finished iteration over zone `%s'!\n",
+                last->domain);
+    /* subtract left-overs from previous iteration */
+    GNUNET_STATISTICS_update (stats,
+                              "# NAMESTORE records requested from cache",
+                              (long long) (- ns_iterator_trigger_next),
+                              GNUNET_NO);
+    ns_iterator_trigger_next = 0;
+  }
+  GNUNET_assert (NULL != zone_tail);
+  if (zone_tail == last)
+  {
+    /* Done iterating over relevant zones in NAMESTORE, move
+       rest of hash map to work queue as well. */
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Finished all NAMESTORE iterations!\n");
+    GNUNET_STATISTICS_set (stats,
+                           "# Domain names without cached reply",
+                           GNUNET_CONTAINER_multihashmap_size (ns_pending),
+                           GNUNET_NO);
+    GNUNET_CONTAINER_multihashmap_iterate (ns_pending,
+                                           &move_to_queue,
+                                           NULL);
+    GNUNET_CONTAINER_multihashmap_destroy (ns_pending);
+    ns_pending = NULL;
+    start_time_reg_proc = GNUNET_TIME_absolute_get ();
+    total_reg_proc_dns = 0;
+    total_reg_proc_dns_ns = 0;
+    return;
+  }
+  if (NULL == last)
+    last = zone_head;
+  else
+    last = last->next;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Starting iteration over zone `%s'!\n",
+              last->domain);
+  /* subtract left-overs from previous iteration */
+  GNUNET_STATISTICS_update (stats,
+                            "# NAMESTORE records requested from cache",
+                            1,
+                            GNUNET_NO);
+  ns_iterator_trigger_next = 1;
+  GNUNET_STATISTICS_update (stats,
+                            "# zones iterated",
+                            1,
+                            GNUNET_NO);
+  zone_it = GNUNET_NAMESTORE_zone_iteration_start (ns,
+                                                   &last->key,
+                                                   &ns_lookup_error_cb,
+                                                   NULL,
+                                                   &ns_lookup_result_cb,
+                                                   last,
+                                                   &iterate_zones,
+                                                   NULL);
 
-  req = GNUNET_new (struct Request);
-  req->zone = zone;
-  req->hostname = GNUNET_strdup (hostname);
-  req->raw = raw;
-  req->raw_len = raw_size;
-  req->id = p.id;
-  req->label = GNUNET_strndup (hostname,
-                               dot - hostname);
-  req->qe = GNUNET_NAMESTORE_records_lookup (ns,
-                                             &req->zone->key,
-                                             req->label,
-                                             &ns_lookup_error_cb,
-                                             req,
-                                             &ns_lookup_result_cb,
-                                             req);
 }
 
 
@@ -1288,12 +1779,17 @@ queue (const char *hostname)
 static void
 process_stdin (void *cls)
 {
+  static struct GNUNET_TIME_Absolute last;
+  static uint64_t idot;
   char hn[256];
 
   (void) cls;
   t = NULL;
-  GNUNET_IDENTITY_disconnect (id);
-  id = NULL;
+  if (NULL != id)
+  {
+    GNUNET_IDENTITY_disconnect (id);
+    id = NULL;
+  }
   while (NULL !=
          fgets (hn,
                 sizeof (hn),
@@ -1301,8 +1797,34 @@ process_stdin (void *cls)
   {
     if (strlen(hn) > 0)
       hn[strlen(hn)-1] = '\0'; /* eat newline */
+    if (0 == idot)
+      last = GNUNET_TIME_absolute_get ();
+    idot++;
+    if (0 == idot % 10000)
+    {
+      struct GNUNET_TIME_Relative delta;
+
+      delta = GNUNET_TIME_absolute_get_duration (last);
+      last = GNUNET_TIME_absolute_get ();
+      fprintf (stderr,
+               "Imported 10000 records in %s\n",
+               GNUNET_STRINGS_relative_time_to_string (delta,
+                                                       GNUNET_YES));
+      GNUNET_STATISTICS_set (stats,
+                             "# domain names provided",
+                             idot,
+                             GNUNET_NO);
+    }
     queue (hn);
   }
+  fprintf (stderr,
+           "Done reading %llu domain names\n",
+           (unsigned long long) idot);
+  GNUNET_STATISTICS_set (stats,
+                         "# domain names provided",
+                         idot,
+                         GNUNET_NO);
+  iterate_zones (NULL);
 }
 
 
@@ -1358,7 +1880,7 @@ identity_cb (void *cls,
     else
     {
       GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "Specified zone not found\n");
+                  "No zone found\n");
       GNUNET_SCHEDULER_shutdown ();
       return;
     }
@@ -1395,14 +1917,44 @@ run (void *cls,
   (void) cls;
   (void) args;
   (void) cfgfile;
+  stats = GNUNET_STATISTICS_create ("zoneimport",
+                                    cfg);
   req_heap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
-  ctx = GNUNET_DNSSTUB_start (dns_server);
+  ns_pending = GNUNET_CONTAINER_multihashmap_create (map_size,
+                                                     GNUNET_NO);
+  if (NULL == ns_pending)
+  {
+    fprintf (stderr,
+             "Failed to allocate memory for main hash map\n");
+    return;
+  }
+  ctx = GNUNET_DNSSTUB_start (256);
   if (NULL == ctx)
   {
     fprintf (stderr,
              "Failed to initialize GNUnet DNS STUB\n");
     return;
   }
+  if (NULL == args[0])
+  {
+    fprintf (stderr,
+             "You must provide a list of DNS resolvers on the command line\n");
+    return;
+  }
+  for (unsigned int i=0;NULL != args[i];i++)
+  {
+    if (GNUNET_OK !=
+        GNUNET_DNSSTUB_add_dns_ip (ctx,
+                                   args[i]))
+    {
+      fprintf (stderr,
+               "Failed to use `%s' for DNS resolver\n",
+               args[i]);
+      return;
+    }
+  }
+
+
   GNUNET_SCHEDULER_add_shutdown (&do_shutdown,
                                  NULL);
   ns = GNUNET_NAMESTORE_connect (cfg);
@@ -1429,12 +1981,11 @@ main (int argc,
       char *const*argv)
 {
   struct GNUNET_GETOPT_CommandLineOption options[] = {
-    GNUNET_GETOPT_option_mandatory
-    (GNUNET_GETOPT_option_string ('s',
-                                  "server",
-                                  "IP",
-                                  "which DNS server should be used",
-                                  &dns_server)),
+    GNUNET_GETOPT_option_uint ('s',
+                               "size",
+                               "MAPSIZE",
+                               gettext_noop ("size to use for the main hash map"),
+                               &map_size),
     GNUNET_GETOPT_OPTION_END
   };
 
@@ -1451,12 +2002,16 @@ main (int argc,
                       NULL);
   GNUNET_free ((void*) argv);
   fprintf (stderr,
-           "Rejected %u names, did %u lookups, found %u records, %u lookups failed, %u pending on shutdown\n",
+           "Rejected %u names, had %u cached, did %u lookups, stored %u record sets\n"
+           "Found %u records, %u lookups failed, %u/%u pending on shutdown\n",
            rejects,
+           cached,
            lookups,
+           record_sets,
            records,
            failures,
-           pending);
+           pending,
+           pending_rs);
   return 0;
 }
 
diff --git a/src/namestore/namestore.conf.in b/src/namestore/namestore.conf.in
index f19ac5643..8b5e440b8 100644
--- a/src/namestore/namestore.conf.in
+++ b/src/namestore/namestore.conf.in
@@ -9,8 +9,17 @@ HOSTNAME = localhost
 BINARY = gnunet-service-namestore
 ACCEPT_FROM = 127.0.0.1;
 ACCEPT_FROM6 = ::1;
+
+# Which database should we use?
 DATABASE = sqlite
 
+# Should we optimize publishing record by caching the mapping
+# from zone private keys to zone public keys in memory?
+# (Set to NO if totally paranoid about keeping private keys
+# in RAM longer than necessary.)
+CACHE_KEYS = YES
+
+
 [namestore-sqlite]
 FILENAME = $GNUNET_DATA_HOME/namestore/sqlite.db
 
@@ -38,5 +47,3 @@ UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-fcfsd.sock
 
 # On what port does the FCFS daemon listen for HTTP clients?
 HTTPPORT = 18080
-
-
diff --git a/src/namestore/namestore.h b/src/namestore/namestore.h
index ec7f28704..207b35662 100644
--- a/src/namestore/namestore.h
+++ b/src/namestore/namestore.h
@@ -161,7 +161,7 @@ struct LabelLookupResponseMessage
    * Length of serialized record data
    */
   uint16_t rd_len GNUNET_PACKED;
-
+  
   /**
    * Number of records contained
    */
@@ -169,7 +169,7 @@ struct LabelLookupResponseMessage
 
   /**
    * Was the label found in the database??
-   * GNUNET_YES or GNUNET_NO
+   * #GNUNET_YES or #GNUNET_NO
    */
   uint16_t found GNUNET_PACKED;
 
@@ -345,6 +345,14 @@ struct ZoneIterationNextMessage
    * Type will be #GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_NEXT
    */
   struct GNUNET_NAMESTORE_Header gns_header;
+
+  /**
+   * Number of records to return to the iterator in one shot
+   * (before #GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_NEXT
+   * should be send again). In NBO.
+   */
+  uint64_t limit;
+
 };
 
 
diff --git a/src/namestore/namestore_api.c b/src/namestore/namestore_api.c
index a187bd250..ab356838b 100644
--- a/src/namestore/namestore_api.c
+++ b/src/namestore/namestore_api.c
@@ -1087,7 +1087,7 @@ GNUNET_NAMESTORE_set_nick (struct GNUNET_NAMESTORE_Handle *h,
   rd.flags |= GNUNET_GNSRECORD_RF_PRIVATE;
   return GNUNET_NAMESTORE_records_store (h,
                                          pkey,
-                                         GNUNET_GNS_MASTERZONE_STR,
+                                         GNUNET_GNS_EMPTY_LABEL_AT,
                                          1,
                                          &rd,
                                          cont,
@@ -1281,19 +1281,24 @@ GNUNET_NAMESTORE_zone_iteration_start (struct GNUNET_NAMESTORE_Handle *h,
  * for the next record.
  *
  * @param it the iterator
+ * @param limit number of records to return to the iterator in one shot
+ *         (before #GNUNET_NAMESTORE_zone_iterator_next is to be called again)
  */
 void
-GNUNET_NAMESTORE_zone_iterator_next (struct GNUNET_NAMESTORE_ZoneIterator *it)
+GNUNET_NAMESTORE_zone_iterator_next (struct GNUNET_NAMESTORE_ZoneIterator *it,
+                                     uint64_t limit)
 {
   struct GNUNET_NAMESTORE_Handle *h = it->h;
   struct ZoneIterationNextMessage *msg;
   struct GNUNET_MQ_Envelope *env;
 
   LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Sending ZONE_ITERATION_NEXT message\n");
+       "Sending ZONE_ITERATION_NEXT message with limit %llu\n",
+       (unsigned long long) limit);
   env = GNUNET_MQ_msg (msg,
                        GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_NEXT);
   msg->gns_header.r_id = htonl (it->op_id);
+  msg->limit = GNUNET_htonll (limit);
   GNUNET_MQ_send (h->mq,
                   env);
 }
diff --git a/src/namestore/perf_namestore_api_flat.conf b/src/namestore/perf_namestore_api_flat.conf
new file mode 100644
index 000000000..26e2f2c51
--- /dev/null
+++ b/src/namestore/perf_namestore_api_flat.conf
@@ -0,0 +1,7 @@
+@INLINE@ test_namestore_api.conf
+
+[namestore]
+DATABASE = flat
+
+[namecache]
+DISABLE = YES
diff --git a/src/namestore/perf_namestore_api_postgres.conf b/src/namestore/perf_namestore_api_postgres.conf
new file mode 100644
index 000000000..259ce35e7
--- /dev/null
+++ b/src/namestore/perf_namestore_api_postgres.conf
@@ -0,0 +1,7 @@
+@INLINE@ test_namestore_api.conf
+
+[namestore]
+DATABASE = postgres
+
+[namecache]
+DISABLE = YES
diff --git a/src/namestore/perf_namestore_api_sqlite.conf b/src/namestore/perf_namestore_api_sqlite.conf
new file mode 100644
index 000000000..72b609226
--- /dev/null
+++ b/src/namestore/perf_namestore_api_sqlite.conf
@@ -0,0 +1,4 @@
+@INLINE@ test_namestore_api.conf
+
+[namecache]
+DISABLE = YES
diff --git a/src/namestore/perf_namestore_api_zone_iteration.c b/src/namestore/perf_namestore_api_zone_iteration.c
new file mode 100644
index 000000000..4ef8d3407
--- /dev/null
+++ b/src/namestore/perf_namestore_api_zone_iteration.c
@@ -0,0 +1,388 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013, 2018 GNUnet e.V.
+
+     GNUnet is free software; you can redistribute it and/or modify
+     it under the terms of the GNU General Public License as published
+     by the Free Software Foundation; either version 3, or (at your
+     option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     General Public License for more details.
+
+     You should have received a copy of the GNU General Public License
+     along with GNUnet; see the file COPYING.  If not, write to the
+     Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+     Boston, MA 02110-1301, USA.
+*/
+/**
+ * @file namestore/perf_namestore_api_zone_iteration.c
+ * @brief testcase for zone iteration functionality: iterate all zones
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_namestore_service.h"
+#include "gnunet_testing_lib.h"
+#include "namestore.h"
+
+/**
+ * A #BENCHMARK_SIZE of 1000 takes less than a minute on a reasonably
+ * modern system, so 30 minutes should be OK even for very, very
+ * slow systems.
+ */
+#define TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 30)
+
+/**
+ * The runtime of the benchmark is expected to be linear
+ * for the iteration phase with a *good* database.  The FLAT
+ * database uses a quadratic retrieval algorithm,
+ * hence it should be quadratic in the size.
+ */
+#define BENCHMARK_SIZE 1000
+
+/**
+ * Maximum record size
+ */
+#define MAX_REC_SIZE 500
+
+/**
+ * How big are the blocks we fetch? Note that the first block is
+ * always just 1 record set per current API.  Smaller block
+ * sizes will make quadratic iteration-by-offset penalties
+ * more pronounced.
+ */
+#define BLOCK_SIZE 100
+
+static struct GNUNET_NAMESTORE_Handle *nsh;
+
+static struct GNUNET_SCHEDULER_Task *timeout_task;
+
+static struct GNUNET_SCHEDULER_Task *t;
+
+static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+
+static struct GNUNET_NAMESTORE_ZoneIterator *zi;
+
+static struct GNUNET_NAMESTORE_QueueEntry *qe;
+
+static int res;
+
+static char *directory;
+
+static unsigned int off;
+
+static unsigned int left_until_next;
+
+static uint8_t seen[1 + BENCHMARK_SIZE / 8];
+
+static struct GNUNET_TIME_Absolute start;
+
+
+/**
+ * Terminate everything
+ *
+ * @param cls NULL
+ */
+static void
+end (void *cls)
+{
+  (void) cls;
+  if (NULL != qe)
+  {
+    GNUNET_NAMESTORE_cancel (qe);
+    qe = NULL;
+  }
+  if (NULL != zi)
+  {
+    GNUNET_NAMESTORE_zone_iteration_stop (zi);
+    zi = NULL;
+  }
+  if (NULL != nsh)
+  {
+    GNUNET_NAMESTORE_disconnect (nsh);
+    nsh = NULL;
+  }
+  if (NULL != t)
+  {
+    GNUNET_SCHEDULER_cancel (t);
+    t = NULL;
+  }
+  if (NULL != timeout_task)
+  {
+    GNUNET_SCHEDULER_cancel (timeout_task);
+    timeout_task = NULL;
+  }
+  if (NULL != privkey)
+  {
+    GNUNET_free (privkey);
+    privkey = NULL;
+  }
+}
+
+
+/**
+ * End with timeout. As this is a benchmark, we do not
+ * fail hard but return "skipped".
+ */
+static void
+timeout (void *cls)
+{
+  (void) cls;
+  timeout_task = NULL;
+  GNUNET_SCHEDULER_shutdown ();
+  res = 77;
+}
+
+
+static struct GNUNET_GNSRECORD_Data *
+create_record (unsigned int count)
+{
+  struct GNUNET_GNSRECORD_Data *rd;
+
+  rd = GNUNET_malloc (count + sizeof (struct GNUNET_GNSRECORD_Data));
+  rd->expiration_time = GNUNET_TIME_relative_to_absolute (GNUNET_TIME_UNIT_HOURS).abs_value_us;
+  rd->record_type = count;
+  rd->data_size = count;
+  rd->data = (void *) &rd[1];
+  rd->flags = 0;
+  memset (&rd[1],
+          'a',
+          count);
+  return rd;
+}
+
+
+static void
+zone_end (void *cls)
+{
+  struct GNUNET_TIME_Relative delay;
+
+  zi = NULL;
+  delay = GNUNET_TIME_absolute_get_duration (start);
+  fprintf (stdout,
+           "Iterating over %u records took %s\n",
+           off,
+           GNUNET_STRINGS_relative_time_to_string (delay,
+                                                   GNUNET_YES));
+  if (BENCHMARK_SIZE == off)
+  {
+    res = 0;
+  }
+  else
+  {
+    GNUNET_break (0);
+    res = 1;
+  }
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+fail_cb (void *cls)
+{
+  zi = NULL;
+  res = 2;
+  GNUNET_break (0);
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+zone_proc (void *cls,
+           const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+           const char *label,
+           unsigned int rd_count,
+           const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct GNUNET_GNSRECORD_Data *wrd;
+  unsigned int xoff;
+
+  GNUNET_assert (NULL != zone);
+  if (1 != sscanf (label,
+                   "l%u",
+                   &xoff))
+  {
+    res = 3;
+    GNUNET_break (0);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  if ( (xoff > BENCHMARK_SIZE) ||
+       (0 != (seen[xoff / 8] & (1U << (xoff % 8)))) )
+  {
+    res = 3;
+    GNUNET_break (0);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  seen[xoff / 8] |= (1U << (xoff % 8));
+  wrd = create_record (xoff % MAX_REC_SIZE);
+  if ( (rd->record_type != wrd->record_type) ||
+       (rd->data_size != wrd->data_size) ||
+       (rd->flags != wrd->flags) )
+  {
+    res = 4;
+    GNUNET_break (0);
+    GNUNET_SCHEDULER_shutdown ();
+    GNUNET_free (wrd);
+    return;
+  }
+  if (0 != memcmp (rd->data,
+                   wrd->data,
+                   wrd->data_size))
+  {
+    res = 4;
+    GNUNET_break (0);
+    GNUNET_SCHEDULER_shutdown ();
+    GNUNET_free (wrd);
+    return;
+  }
+  GNUNET_free (wrd);
+  if (0 != memcmp (zone,
+                   privkey,
+                   sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey)))
+  {
+    res = 5;
+    GNUNET_break (0);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  off++;
+  left_until_next--;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Obtained record %u, expecting %u more until asking for mor explicitly\n",
+              off,
+              left_until_next);
+  if (0 == left_until_next)
+  {
+    left_until_next = BLOCK_SIZE;
+    GNUNET_NAMESTORE_zone_iterator_next (zi,
+                                         left_until_next);
+  }
+}
+
+
+static void
+publish_record (void *cls);
+
+
+static void
+put_cont (void *cls,
+          int32_t success,
+          const char *emsg)
+{
+  (void) cls;
+  qe = NULL;
+  GNUNET_assert (GNUNET_OK == success);
+  t = GNUNET_SCHEDULER_add_now (&publish_record,
+                                NULL);
+}
+
+
+static void
+publish_record (void *cls)
+{
+  struct GNUNET_GNSRECORD_Data *rd;
+  char *label;
+
+  (void) cls;
+  t = NULL;
+  if (BENCHMARK_SIZE == off)
+  {
+    struct GNUNET_TIME_Relative delay;
+
+    delay = GNUNET_TIME_absolute_get_duration (start);
+    fprintf (stdout,
+             "Inserting %u records took %s\n",
+             off,
+             GNUNET_STRINGS_relative_time_to_string (delay,
+                                                     GNUNET_YES));
+    start = GNUNET_TIME_absolute_get ();
+    off = 0;
+    left_until_next = 1;
+    zi = GNUNET_NAMESTORE_zone_iteration_start (nsh,
+                                                NULL,
+                                                &fail_cb,
+                                                NULL,
+                                                &zone_proc,
+                                                NULL,
+                                                &zone_end,
+                                                NULL);
+    GNUNET_assert (NULL != zi);
+    return;
+  }
+  rd = create_record ((++off) % MAX_REC_SIZE);
+  GNUNET_asprintf (&label,
+                   "l%u",
+                   off);
+  qe = GNUNET_NAMESTORE_records_store (nsh,
+                                       privkey,
+                                       label,
+                                       1, rd,
+                                       &put_cont,
+                                       NULL);
+  GNUNET_free (label);
+  GNUNET_free (rd);
+}
+
+
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_TESTING_Peer *peer)
+{
+  directory = NULL;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONFIGURATION_get_value_string(cfg,
+                                                       "PATHS",
+                                                       "GNUNET_TEST_HOME",
+                                                       &directory));
+  GNUNET_DISK_directory_remove (directory);
+  GNUNET_SCHEDULER_add_shutdown (&end,
+                                 NULL);
+  timeout_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
+                                               &timeout,
+                                               NULL);
+  nsh = GNUNET_NAMESTORE_connect (cfg);
+  GNUNET_assert (NULL != nsh);
+  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
+  GNUNET_assert (NULL != privkey);
+  start = GNUNET_TIME_absolute_get ();
+  t = GNUNET_SCHEDULER_add_now (&publish_record,
+                                NULL);
+}
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "perf_namestore_api_%s.conf",
+                   plugin_name);
+  res = 1;
+  if (0 !=
+      GNUNET_TESTING_peer_run ("perf-namestore-api-zone-iteration",
+                               cfg_name,
+                               &run,
+                               NULL))
+  {
+    res = 1;
+  }
+  GNUNET_free (cfg_name);
+  if (NULL != directory)
+  {
+    GNUNET_DISK_directory_remove (directory);
+    GNUNET_free (directory);
+  }
+  return res;
+}
+
+
+/* end of perf_namestore_api_zone_iteration.c */
diff --git a/src/namestore/plugin_namestore_flat.c b/src/namestore/plugin_namestore_flat.c
index 305fe7ba1..88b3ce9b4 100644
--- a/src/namestore/plugin_namestore_flat.c
+++ b/src/namestore/plugin_namestore_flat.c
@@ -86,6 +86,7 @@ struct Plugin
 
 };
 
+
 struct FlatFileEntry
 {
   /**
@@ -435,45 +436,51 @@ namestore_flat_store_records (void *cls,
                                      UINT64_MAX);
   key_len = strlen (label) + sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey);
   key = GNUNET_malloc (key_len);
-  GNUNET_memcpy (key, label, strlen (label));
-  GNUNET_memcpy (key+strlen(label),
-          zone_key,
-          sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey));
+  GNUNET_memcpy (key,
+                 label,
+                 strlen (label));
+  GNUNET_memcpy (key + strlen(label),
+                 zone_key,
+                 sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey));
   GNUNET_CRYPTO_hash (key,
                       key_len,
                       &hkey);
-
-  GNUNET_CONTAINER_multihashmap_remove_all (plugin->hm, &hkey);
-
-  if (0 < rd_count)
+  GNUNET_CONTAINER_multihashmap_remove_all (plugin->hm,
+                                            &hkey);
+  if (0 == rd_count)
   {
-    entry = GNUNET_new (struct FlatFileEntry);
-    entry->private_key = GNUNET_new (struct GNUNET_CRYPTO_EcdsaPrivateKey);
-    GNUNET_asprintf (&entry->label,
-                     label,
-                     strlen (label));
-    GNUNET_memcpy (entry->private_key,
-                   zone_key,
-                   sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey));
-    entry->rvalue = rvalue;
-    entry->record_count = rd_count;
-    entry->record_data = GNUNET_new_array (rd_count,
-                                           struct GNUNET_GNSRECORD_Data);
-    for (unsigned int i = 0; i < rd_count; i++)
-    {
-      entry->record_data[i].expiration_time = rd[i].expiration_time;
-      entry->record_data[i].record_type = rd[i].record_type;
-      entry->record_data[i].flags = rd[i].flags;
-      entry->record_data[i].data_size = rd[i].data_size;
-      entry->record_data[i].data = GNUNET_malloc (rd[i].data_size);
-      GNUNET_memcpy ((char*)entry->record_data[i].data, rd[i].data, rd[i].data_size);
-    }
-    return GNUNET_CONTAINER_multihashmap_put (plugin->hm,
-                                              &hkey,
-                                              entry,
-                                              GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY);
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "sqlite",
+                     "Record deleted\n");
+    return GNUNET_OK;
   }
-  return GNUNET_NO;
+  entry = GNUNET_new (struct FlatFileEntry);
+  entry->private_key = GNUNET_new (struct GNUNET_CRYPTO_EcdsaPrivateKey);
+  GNUNET_asprintf (&entry->label,
+                   label,
+                   strlen (label));
+  GNUNET_memcpy (entry->private_key,
+                 zone_key,
+                 sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey));
+  entry->rvalue = rvalue;
+  entry->record_count = rd_count;
+  entry->record_data = GNUNET_new_array (rd_count,
+                                         struct GNUNET_GNSRECORD_Data);
+  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    entry->record_data[i].expiration_time = rd[i].expiration_time;
+    entry->record_data[i].record_type = rd[i].record_type;
+    entry->record_data[i].flags = rd[i].flags;
+    entry->record_data[i].data_size = rd[i].data_size;
+    entry->record_data[i].data = GNUNET_malloc (rd[i].data_size);
+    GNUNET_memcpy ((char*)entry->record_data[i].data,
+                   rd[i].data,
+                   rd[i].data_size);
+  }
+  return GNUNET_CONTAINER_multihashmap_put (plugin->hm,
+                                            &hkey,
+                                            entry,
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY);
 }
 
 
@@ -485,7 +492,7 @@ namestore_flat_store_records (void *cls,
  * @param label name of the record in the zone
  * @param iter function to call with the result
  * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
  */
 static int
 namestore_flat_lookup_records (void *cls,
@@ -502,6 +509,7 @@ namestore_flat_lookup_records (void *cls,
 
   if (NULL == zone)
   {
+    GNUNET_break (0);
     return GNUNET_SYSERR;
   }
   key_len = strlen (label) + sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey);
@@ -524,6 +532,7 @@ namestore_flat_lookup_records (void *cls,
     return GNUNET_NO;
   if (NULL != iter)
     iter (iter_cls,
+          0,
           entry->private_key,
           entry->label,
           entry->record_count,
@@ -532,30 +541,85 @@ namestore_flat_lookup_records (void *cls,
 }
 
 
+/**
+ * Closure for #iterate_zones.
+ */
+struct IterateContext
+{
+  /**
+   * How many more records should we skip before returning results?
+   */
+  uint64_t offset;
+
+  /**
+   * How many more records should we return?
+   */
+  uint64_t limit;
+
+  /**
+   * What is the position of the current entry, counting
+   * starts from 1.
+   */
+  uint64_t pos;
+
+  /**
+   * Target zone.
+   */
+  const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone;
+
+  /**
+   * Function to call on each record.
+   */
+  GNUNET_NAMESTORE_RecordIterator iter;
+
+  /**
+   * Closure for @e iter.
+   */
+  void *iter_cls;
+
+};
+
+
+/**
+ * Helper function for #namestore_flat_iterate_records().
+ *
+ * @param cls a `struct IterateContext`
+ * @param key unused
+ * @param value a `struct FlatFileEntry`
+ * @return #GNUNET_YES to continue the iteration
+ */
 static int
 iterate_zones (void *cls,
                const struct GNUNET_HashCode *key,
                void *value)
 {
-  struct Plugin *plugin = cls;
+  struct IterateContext *ic = cls;
   struct FlatFileEntry *entry = value;
 
   (void) key;
-  if ((plugin->target_offset > plugin->offset) ||
-      ( (NULL != plugin->iter_zone) &&
-        (0 != memcmp (entry->private_key,
-                      plugin->iter_zone,
-                      sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey))))) {
-    plugin->offset++;
+  ic->pos++;
+  if (0 == ic->limit)
+    return GNUNET_NO;
+  if ( (NULL != ic->zone) &&
+       (0 != memcmp (entry->private_key,
+                     ic->zone,
+                     sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey))) )
+    return GNUNET_YES;
+  if (ic->offset > 0)
+  {
+    ic->offset--;
     return GNUNET_YES;
   }
-  plugin->iter (plugin->iter_cls,
-                entry->private_key,
-                entry->label,
-                entry->record_count,
-                entry->record_data);
-  plugin->iter_result_found = GNUNET_YES;
-  return GNUNET_NO;
+  ic->iter (ic->iter_cls,
+            ic->pos,
+            entry->private_key,
+            entry->label,
+            entry->record_count,
+            entry->record_data);
+  ic->limit--;
+  if (0 == ic->limit)
+    return GNUNET_NO;
+  return GNUNET_YES;
 }
 
 
@@ -565,32 +629,33 @@ iterate_zones (void *cls,
  *
  * @param cls closure (internal context for the plugin)
  * @param zone hash of public key of the zone, NULL to iterate over all zones
- * @param offset offset in the list of all matching records
+ * @param serial serial number to exclude in the list of all matching records
+ * @param limit maximum number of results to return to @a iter
  * @param iter function to call with the result
  * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no more results, #GNUNET_SYSERR on error
  */
 static int
 namestore_flat_iterate_records (void *cls,
                                 const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
-                                uint64_t offset,
+                                uint64_t serial,
+                                uint64_t limit,
                                 GNUNET_NAMESTORE_RecordIterator iter,
                                 void *iter_cls)
 {
   struct Plugin *plugin = cls;
-
-  /* FIXME: maybe use separate closure to better handle
-     recursive calls? */
-  plugin->target_offset = offset;
-  plugin->offset = 0;
-  plugin->iter = iter;
-  plugin->iter_cls = iter_cls;
-  plugin->iter_zone = zone;
-  plugin->iter_result_found = GNUNET_NO;
+  struct IterateContext ic;
+
+  ic.offset = serial;
+  ic.pos = 0;
+  ic.limit = limit;
+  ic.iter = iter;
+  ic.iter_cls = iter_cls;
+  ic.zone = zone;
   GNUNET_CONTAINER_multihashmap_iterate (plugin->hm,
                                          &iterate_zones,
-                                         plugin);
-  return plugin->iter_result_found;
+                                         &ic);
+  return (0 == ic.limit) ? GNUNET_OK : GNUNET_NO;
 }
 
 
@@ -617,6 +682,7 @@ zone_to_name (void *cls,
                      sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey)))
     {
       plugin->iter (plugin->iter_cls,
+                    0,
                     entry->private_key,
                     entry->label,
                     entry->record_count,
diff --git a/src/namestore/plugin_namestore_postgres.c b/src/namestore/plugin_namestore_postgres.c
index a9c19d517..d7907b1a6 100644
--- a/src/namestore/plugin_namestore_postgres.c
+++ b/src/namestore/plugin_namestore_postgres.c
@@ -65,23 +65,27 @@ static int
 database_setup (struct Plugin *plugin)
 {
   struct GNUNET_PQ_ExecuteStatement es_temporary =
-    GNUNET_PQ_make_execute ("CREATE TEMPORARY TABLE IF NOT EXISTS ns097records ("
+    GNUNET_PQ_make_execute ("CREATE TEMPORARY TABLE IF NOT EXISTS ns098records ("
+                            " seq BIGSERIAL PRIMARY KEY,"
                             " zone_private_key BYTEA NOT NULL DEFAULT '',"
                             " pkey BYTEA DEFAULT '',"
                             " rvalue BYTEA NOT NULL DEFAULT '',"
                             " record_count INTEGER NOT NULL DEFAULT 0,"
                             " record_data BYTEA NOT NULL DEFAULT '',"
-                            " label TEXT NOT NULL DEFAULT ''"
+                            " label TEXT NOT NULL DEFAULT '',"
+                            " CONSTRAINT zl UNIQUE (zone_private_key,label)"
                             ")"
                             "WITH OIDS");
   struct GNUNET_PQ_ExecuteStatement es_default =
-    GNUNET_PQ_make_execute ("CREATE TABLE IF NOT EXISTS ns097records ("
+    GNUNET_PQ_make_execute ("CREATE TABLE IF NOT EXISTS ns098records ("
+                            " seq BIGSERIAL PRIMARY KEY,"
                             " zone_private_key BYTEA NOT NULL DEFAULT '',"
                             " pkey BYTEA DEFAULT '',"
                             " rvalue BYTEA NOT NULL DEFAULT '',"
                             " record_count INTEGER NOT NULL DEFAULT 0,"
                             " record_data BYTEA NOT NULL DEFAULT '',"
-                            " label TEXT NOT NULL DEFAULT ''"
+                            " label TEXT NOT NULL DEFAULT '',"
+                            " CONSTRAINT zl UNIQUE (zone_private_key,label)"
                             ")"
                             "WITH OIDS");
   const struct GNUNET_PQ_ExecuteStatement *cr;
@@ -125,13 +129,13 @@ database_setup (struct Plugin *plugin)
     struct GNUNET_PQ_ExecuteStatement es[] = {
       *cr,
       GNUNET_PQ_make_try_execute ("CREATE INDEX IF NOT EXISTS ir_pkey_reverse "
-                                  "ON ns097records (zone_private_key,pkey)"),
+                                  "ON ns098records (zone_private_key,pkey)"),
       GNUNET_PQ_make_try_execute ("CREATE INDEX IF NOT EXISTS ir_pkey_iter "
-                                  "ON ns097records (zone_private_key,rvalue)"),
-      GNUNET_PQ_make_try_execute ("CREATE INDEX IF NOT EXISTS it_iter "
-                                  "ON ns097records (rvalue)"),
+                                  "ON ns098records (zone_private_key,seq)"),
       GNUNET_PQ_make_try_execute ("CREATE INDEX IF NOT EXISTS ir_label "
-                                  "ON ns097records (label)"),
+                                  "ON ns098records (label)"),
+      GNUNET_PQ_make_try_execute ("CREATE INDEX IF NOT EXISTS zone_label "
+                                  "ON ns098records (zone_private_key,label)"),
       GNUNET_PQ_EXECUTE_STATEMENT_END
     };
 
@@ -148,23 +152,35 @@ database_setup (struct Plugin *plugin)
   {
     struct GNUNET_PQ_PreparedStatement ps[] = {
       GNUNET_PQ_make_prepare ("store_records",
-                              "INSERT INTO ns097records (zone_private_key, pkey, rvalue, record_count, record_data, label) VALUES "
-                              "($1, $2, $3, $4, $5, $6)", 6),
+                              "INSERT INTO ns098records"
+                              " (zone_private_key, pkey, rvalue, record_count, record_data, label)"
+                              " VALUES ($1, $2, $3, $4, $5, $6)"
+                              " ON CONFLICT ON CONSTRAINT zl"
+                              " DO UPDATE"
+                              "    SET pkey=$2,rvalue=$3,record_count=$4,record_data=$5"
+                              "    WHERE ns098records.zone_private_key = $1"
+                              "          AND ns098records.label = $6",
+                              6),
       GNUNET_PQ_make_prepare ("delete_records",
-                              "DELETE FROM ns097records "
-                              "WHERE zone_private_key=$1 AND label=$2", 2),
+                              "DELETE FROM ns098records "
+                              "WHERE zone_private_key=$1 AND label=$2",
+                              2),
       GNUNET_PQ_make_prepare ("zone_to_name",
-                              "SELECT record_count,record_data,label FROM ns097records"
-                              " WHERE zone_private_key=$1 AND pkey=$2", 2),
+                              "SELECT seq,record_count,record_data,label FROM ns098records"
+                              " WHERE zone_private_key=$1 AND pkey=$2",
+                              2),
       GNUNET_PQ_make_prepare ("iterate_zone",
-                              "SELECT record_count,record_data,label FROM ns097records "
-                              "WHERE zone_private_key=$1 ORDER BY rvalue LIMIT 1 OFFSET $2", 2),
+                              "SELECT seq,record_count,record_data,label FROM ns098records "
+                              "WHERE zone_private_key=$1 AND seq > $2 ORDER BY seq ASC LIMIT $3",
+                              3),
       GNUNET_PQ_make_prepare ("iterate_all_zones",
-                              "SELECT record_count,record_data,label,zone_private_key"
-                              " FROM ns097records ORDER BY rvalue LIMIT 1 OFFSET $1", 1),
+                              "SELECT seq,record_count,record_data,label,zone_private_key"
+                              " FROM ns098records WHERE seq > $1 ORDER BY seq ASC LIMIT $2",
+                              2),
       GNUNET_PQ_make_prepare ("lookup_label",
-                              "SELECT record_count,record_data,label "
-                              "FROM ns097records WHERE zone_private_key=$1 AND label=$2", 2),
+                              "SELECT seq,record_count,record_data,label "
+                              "FROM ns098records WHERE zone_private_key=$1 AND label=$2",
+                              2),
       GNUNET_PQ_PREPARED_STATEMENT_END
     };
 
@@ -206,7 +222,9 @@ namestore_postgres_store_records (void *cls,
   uint32_t rd_count32 = (uint32_t) rd_count;
   size_t data_size;
 
-  memset (&pkey, 0, sizeof (pkey));
+  memset (&pkey,
+          0,
+          sizeof (pkey));
   for (unsigned int i=0;i<rd_count;i++)
     if (GNUNET_GNSRECORD_TYPE_PKEY == rd[i].record_type)
     {
@@ -218,12 +236,38 @@ namestore_postgres_store_records (void *cls,
     }
   rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
                                      UINT64_MAX);
-  data_size = GNUNET_GNSRECORD_records_get_size (rd_count, rd);
+  data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                 rd);
   if (data_size > 64 * 65536)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
+  /* if record set is empty, delete existing records */
+  if (0 == rd_count)
+  {
+    struct GNUNET_PQ_QueryParam params[] = {
+      GNUNET_PQ_query_param_auto_from_type (zone_key),
+      GNUNET_PQ_query_param_string (label),
+      GNUNET_PQ_query_param_end
+    };
+    enum GNUNET_DB_QueryStatus res;
+
+    res = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                              "delete_records",
+                                              params);
+    if ( (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != res) &&
+         (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS != res) )
+    {
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
+    }
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "postgres",
+                     "Record deleted\n");
+    return GNUNET_OK;
+  }
+  /* otherwise, UPSERT (i.e. UPDATE if exists, otherwise INSERT) */
   {
     char data[data_size];
     struct GNUNET_PQ_QueryParam params[] = {
@@ -278,6 +322,12 @@ struct ParserContext
    * Zone key, NULL if part of record.
    */
   const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key;
+
+  /**
+   * Number of results still to return (counted down by
+   * number of results given to iterator).
+   */
+  uint64_t limit;
 };
 
 
@@ -296,14 +346,18 @@ parse_result_call_iterator (void *cls,
 {
   struct ParserContext *pc = cls;
 
+  if (NULL == pc->iter)
+    return; /* no need to do more work */
   for (unsigned int i=0;i<num_results;i++)
   {
+    uint64_t serial;
     void *data;
     size_t data_size;
     uint32_t record_count;
     char *label;
     struct GNUNET_CRYPTO_EcdsaPrivateKey zk;
     struct GNUNET_PQ_ResultSpec rs_with_zone[] = {
+      GNUNET_PQ_result_spec_uint64 ("seq", &serial),
       GNUNET_PQ_result_spec_uint32 ("record_count", &record_count),
       GNUNET_PQ_result_spec_variable_size ("record_data", &data, &data_size),
       GNUNET_PQ_result_spec_string ("label", &label),
@@ -311,6 +365,7 @@ parse_result_call_iterator (void *cls,
       GNUNET_PQ_result_spec_end
     };
     struct GNUNET_PQ_ResultSpec rs_without_zone[] = {
+      GNUNET_PQ_result_spec_uint64 ("seq", &serial),
       GNUNET_PQ_result_spec_uint32 ("record_count", &record_count),
       GNUNET_PQ_result_spec_variable_size ("record_data", &data, &data_size),
       GNUNET_PQ_result_spec_string ("label", &label),
@@ -351,6 +406,7 @@ parse_result_call_iterator (void *cls,
         return;
       }
       pc->iter (pc->iter_cls,
+                serial,
                 (NULL == pc->zone_key) ? &zk : pc->zone_key,
                 label,
                 record_count,
@@ -358,6 +414,7 @@ parse_result_call_iterator (void *cls,
     }
     GNUNET_PQ_cleanup_result (rs);
   }
+  pc->limit -= num_results;
 }
 
 
@@ -369,7 +426,7 @@ parse_result_call_iterator (void *cls,
  * @param label name of the record in the zone
  * @param iter function to call with the result
  * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
  */
 static int
 namestore_postgres_lookup_records (void *cls,
@@ -387,6 +444,11 @@ namestore_postgres_lookup_records (void *cls,
   struct ParserContext pc;
   enum GNUNET_DB_QueryStatus res;
 
+  if (NULL == zone)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
   pc.iter = iter;
   pc.iter_cls = iter_cls;
   pc.zone_key = zone;
@@ -395,8 +457,10 @@ namestore_postgres_lookup_records (void *cls,
                                               params,
                                               &parse_result_call_iterator,
                                               &pc);
-  if (res <= 0)
+  if (res < 0)
     return GNUNET_SYSERR;
+  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res)
+    return GNUNET_NO;
   return GNUNET_OK;
 }
 
@@ -407,15 +471,17 @@ namestore_postgres_lookup_records (void *cls,
  *
  * @param cls closure (internal context for the plugin)
  * @param zone hash of public key of the zone, NULL to iterate over all zones
- * @param offset offset in the list of all matching records
+ * @param serial serial number to exclude in the list of all matching records
+ * @param limit maximum number of results to fetch
  * @param iter function to call with the result
  * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no more results, #GNUNET_SYSERR on error
  */
 static int
 namestore_postgres_iterate_records (void *cls,
                                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
-                                    uint64_t offset,
+                                    uint64_t serial,
+                                    uint64_t limit,
                                     GNUNET_NAMESTORE_RecordIterator iter,
                                     void *iter_cls)
 {
@@ -426,10 +492,12 @@ namestore_postgres_iterate_records (void *cls,
   pc.iter = iter;
   pc.iter_cls = iter_cls;
   pc.zone_key = zone;
+  pc.limit = limit;
   if (NULL == zone)
   {
     struct GNUNET_PQ_QueryParam params_without_zone[] = {
-      GNUNET_PQ_query_param_uint64 (&offset),
+      GNUNET_PQ_query_param_uint64 (&serial),
+      GNUNET_PQ_query_param_uint64 (&limit),
       GNUNET_PQ_query_param_end
     };
 
@@ -443,7 +511,8 @@ namestore_postgres_iterate_records (void *cls,
   {
     struct GNUNET_PQ_QueryParam params_with_zone[] = {
       GNUNET_PQ_query_param_auto_from_type (zone),
-      GNUNET_PQ_query_param_uint64 (&offset),
+      GNUNET_PQ_query_param_uint64 (&serial),
+      GNUNET_PQ_query_param_uint64 (&limit),
       GNUNET_PQ_query_param_end
     };
 
@@ -456,9 +525,9 @@ namestore_postgres_iterate_records (void *cls,
   if (res < 0)
     return GNUNET_SYSERR;
 
-  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res)
+  if ( (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res) ||
+       (pc.limit > 0) )
     return GNUNET_NO;
-
   return GNUNET_OK;
 }
 
diff --git a/src/namestore/plugin_namestore_sqlite.c b/src/namestore/plugin_namestore_sqlite.c
index 5ad84688c..f62be1e18 100644
--- a/src/namestore/plugin_namestore_sqlite.c
+++ b/src/namestore/plugin_namestore_sqlite.c
@@ -147,15 +147,13 @@ create_indices (sqlite3 * dbh)
   /* create indices */
   if ( (SQLITE_OK !=
         sqlite3_exec (dbh,
-                      "CREATE INDEX IF NOT EXISTS ir_pkey_reverse ON ns097records (zone_private_key,pkey)",
+                      "CREATE INDEX IF NOT EXISTS ir_pkey_reverse "
+                      "ON ns098records (zone_private_key,pkey)",
                       NULL, NULL, NULL)) ||
        (SQLITE_OK !=
         sqlite3_exec (dbh,
-                      "CREATE INDEX IF NOT EXISTS ir_pkey_iter ON ns097records (zone_private_key,rvalue)",
-                      NULL, NULL, NULL)) ||
-       (SQLITE_OK !=
-        sqlite3_exec (dbh,
-                      "CREATE INDEX IF NOT EXISTS it_iter ON ns097records (rvalue)",
+                      "CREATE INDEX IF NOT EXISTS ir_pkey_iter "
+                      "ON ns098records (zone_private_key,uid)",
                       NULL, NULL, NULL)) )
     LOG (GNUNET_ERROR_TYPE_ERROR,
          "Failed to create indices: %s\n",
@@ -260,22 +258,24 @@ database_setup (struct Plugin *plugin)
   /* Create table */
   CHECK (SQLITE_OK ==
          sq_prepare (plugin->dbh,
-                     "SELECT 1 FROM sqlite_master WHERE tbl_name = 'ns097records'",
+                     "SELECT 1 FROM sqlite_master WHERE tbl_name = 'ns098records'",
                      &stmt));
-  if ((sqlite3_step (stmt) == SQLITE_DONE) &&
-      (sqlite3_exec
-       (plugin->dbh,
-        "CREATE TABLE ns097records ("
-        " zone_private_key BLOB NOT NULL,"
-        " pkey BLOB,"
-        " rvalue INT8 NOT NULL,"
-        " record_count INT NOT NULL,"
-        " record_data BLOB NOT NULL,"
-        " label TEXT NOT NULL"
-        ")",
-        NULL, NULL, NULL) != SQLITE_OK))
+  if ( (sqlite3_step (stmt) == SQLITE_DONE) &&
+       (SQLITE_OK !=
+        sqlite3_exec (plugin->dbh,
+                      "CREATE TABLE ns098records ("
+                      " uid INTEGER PRIMARY KEY,"
+                      " zone_private_key BLOB NOT NULL,"
+                      " pkey BLOB,"
+                      " rvalue INT8 NOT NULL,"
+                      " record_count INT NOT NULL,"
+                      " record_data BLOB NOT NULL,"
+                      " label TEXT NOT NULL"
+                      ")",
+                      NULL, NULL, NULL)) )
   {
-    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR,
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR,
                 "sqlite3_exec");
     sqlite3_finalize (stmt);
     return GNUNET_SYSERR;
@@ -286,33 +286,40 @@ database_setup (struct Plugin *plugin)
 
   if ( (SQLITE_OK !=
         sq_prepare (plugin->dbh,
-                    "INSERT INTO ns097records (zone_private_key, pkey, rvalue, record_count, record_data, label)"
+                    "INSERT INTO ns098records (zone_private_key, pkey, rvalue, record_count, record_data, label)"
                     " VALUES (?, ?, ?, ?, ?, ?)",
                     &plugin->store_records)) ||
        (SQLITE_OK !=
         sq_prepare (plugin->dbh,
-                    "DELETE FROM ns097records WHERE zone_private_key=? AND label=?",
+                    "DELETE FROM ns098records WHERE zone_private_key=? AND label=?",
                     &plugin->delete_records)) ||
        (SQLITE_OK !=
         sq_prepare (plugin->dbh,
-                    "SELECT record_count,record_data,label"
-                    " FROM ns097records WHERE zone_private_key=? AND pkey=?",
+                    "SELECT uid,record_count,record_data,label"
+                    " FROM ns098records"
+                    " WHERE zone_private_key=? AND pkey=?",
                     &plugin->zone_to_name)) ||
        (SQLITE_OK !=
         sq_prepare (plugin->dbh,
-                    "SELECT record_count,record_data,label"
-                    " FROM ns097records WHERE zone_private_key=?"
-                    " ORDER BY rvalue LIMIT 1 OFFSET ?",
+                    "SELECT uid,record_count,record_data,label"
+                    " FROM ns098records"
+                    " WHERE zone_private_key=? AND _rowid_ >= ?"
+                    " ORDER BY _rowid_ ASC"
+                    " LIMIT ?",
                     &plugin->iterate_zone)) ||
        (SQLITE_OK !=
         sq_prepare (plugin->dbh,
-                    "SELECT record_count,record_data,label,zone_private_key"
-                    " FROM ns097records ORDER BY rvalue LIMIT 1 OFFSET ?",
+                    "SELECT uid,record_count,record_data,label,zone_private_key"
+                    " FROM ns098records"
+                    " WHERE _rowid_ >= ?"
+                    " ORDER BY _rowid_ ASC"
+                    " LIMIT ?",
                     &plugin->iterate_all_zones))  ||
        (SQLITE_OK !=
         sq_prepare (plugin->dbh,
-                    "SELECT record_count,record_data,label,zone_private_key"
-                    " FROM ns097records WHERE zone_private_key=? AND label=?",
+                    "SELECT uid,record_count,record_data,label,zone_private_key"
+                    " FROM ns098records"
+                    " WHERE zone_private_key=? AND label=?",
                     &plugin->lookup_label))
        )
   {
@@ -405,10 +412,11 @@ namestore_sqlite_store_records (void *cls,
   struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
   uint64_t rvalue;
   size_t data_size;
-  unsigned int i;
 
-  memset (&pkey, 0, sizeof (pkey));
-  for (i=0;i<rd_count;i++)
+  memset (&pkey,
+          0,
+          sizeof (pkey));
+  for (unsigned int i=0;i<rd_count;i++)
     if (GNUNET_GNSRECORD_TYPE_PKEY == rd[i].record_type)
     {
       GNUNET_break (sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey) ==
@@ -526,93 +534,115 @@ namestore_sqlite_store_records (void *cls,
  * @param plugin plugin context
  * @param stmt to run (and then clean up)
  * @param zone_key private key of the zone
+ * @param limit maximum number of results to fetch
  * @param iter iterator to call with the result
  * @param iter_cls closure for @a iter
  * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
  */
 static int
-get_record_and_call_iterator (struct Plugin *plugin,
-                              sqlite3_stmt *stmt,
-                              const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
-                              GNUNET_NAMESTORE_RecordIterator iter,
-                              void *iter_cls)
+get_records_and_call_iterator (struct Plugin *plugin,
+                               sqlite3_stmt *stmt,
+                               const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                               uint64_t limit,
+                               GNUNET_NAMESTORE_RecordIterator iter,
+                               void *iter_cls)
 {
-  uint32_t record_count;
-  size_t data_size;
-  void *data;
-  char *label;
-  struct GNUNET_CRYPTO_EcdsaPrivateKey zk;
   int ret;
   int sret;
 
-  ret = GNUNET_NO;
-  if (SQLITE_ROW == (sret = sqlite3_step (stmt)))
+  ret = GNUNET_OK;
+  for (uint64_t i = 0;i<limit;i++)
   {
-    struct GNUNET_SQ_ResultSpec rs[] = {
-      GNUNET_SQ_result_spec_uint32 (&record_count),
-      GNUNET_SQ_result_spec_variable_size (&data, &data_size),
-      GNUNET_SQ_result_spec_string (&label),
-      GNUNET_SQ_result_spec_end
-    };
-    struct GNUNET_SQ_ResultSpec rsx[] = {
-      GNUNET_SQ_result_spec_uint32 (&record_count),
-      GNUNET_SQ_result_spec_variable_size (&data, &data_size),
-      GNUNET_SQ_result_spec_string (&label),
-      GNUNET_SQ_result_spec_auto_from_type (&zk),
-      GNUNET_SQ_result_spec_end
-    };
+    sret = sqlite3_step (stmt);
 
-    if (NULL == zone_key)
+    if (SQLITE_DONE == sret)
     {
-      zone_key = &zk;
-      ret = GNUNET_SQ_extract_result (stmt,
-                                      rsx);
-    }
-    else
-    {
-      ret = GNUNET_SQ_extract_result (stmt,
-                                      rs);
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Iteration done (no results)\n");
+      ret = GNUNET_NO;
+      break;
     }
-    if ( (GNUNET_OK != ret) ||
-         (record_count > 64 * 1024) )
+    if (SQLITE_ROW != sret)
     {
-      /* sanity check, don't stack allocate far too much just
-         because database might contain a large value here */
-      GNUNET_break (0);
+      LOG_SQLITE (plugin,
+                  GNUNET_ERROR_TYPE_ERROR,
+                  "sqlite_step");
       ret = GNUNET_SYSERR;
+      break;
     }
-    else
+
     {
-      struct GNUNET_GNSRECORD_Data rd[record_count];
+      uint64_t seq;
+      uint32_t record_count;
+      size_t data_size;
+      void *data;
+      char *label;
+      struct GNUNET_CRYPTO_EcdsaPrivateKey zk;
+      struct GNUNET_SQ_ResultSpec rs[] = {
+        GNUNET_SQ_result_spec_uint64 (&seq),
+        GNUNET_SQ_result_spec_uint32 (&record_count),
+        GNUNET_SQ_result_spec_variable_size (&data,
+                                             &data_size),
+        GNUNET_SQ_result_spec_string (&label),
+        GNUNET_SQ_result_spec_end
+      };
+      struct GNUNET_SQ_ResultSpec rsx[] = {
+        GNUNET_SQ_result_spec_uint64 (&seq),
+        GNUNET_SQ_result_spec_uint32 (&record_count),
+        GNUNET_SQ_result_spec_variable_size (&data,
+                                             &data_size),
+        GNUNET_SQ_result_spec_string (&label),
+        GNUNET_SQ_result_spec_auto_from_type (&zk),
+        GNUNET_SQ_result_spec_end
+      };
 
-      if (GNUNET_OK !=
-          GNUNET_GNSRECORD_records_deserialize (data_size,
-                                                data,
-                                                record_count,
-                                                rd))
+      if (NULL == zone_key)
       {
-        GNUNET_break (0);
-        ret = GNUNET_SYSERR;
+        zone_key = &zk;
+        ret = GNUNET_SQ_extract_result (stmt,
+                                        rsx);
       }
       else
       {
-        if (NULL != iter)
-          iter (iter_cls,
-                zone_key,
-                label,
-                record_count,
-                rd);
-        ret = GNUNET_YES;
+        ret = GNUNET_SQ_extract_result (stmt,
+                                        rs);
+      }
+      if ( (GNUNET_OK != ret) ||
+           (record_count > 64 * 1024) )
+      {
+        /* sanity check, don't stack allocate far too much just
+           because database might contain a large value here */
+        GNUNET_break (0);
+        ret = GNUNET_SYSERR;
+        break;
       }
+      else
+      {
+        struct GNUNET_GNSRECORD_Data rd[record_count];
+
+        if (GNUNET_OK !=
+            GNUNET_GNSRECORD_records_deserialize (data_size,
+                                                  data,
+                                                  record_count,
+                                                  rd))
+        {
+          GNUNET_break (0);
+          ret = GNUNET_SYSERR;
+          break;
+        }
+        else
+        {
+          if (NULL != iter)
+            iter (iter_cls,
+                  seq + 1,
+                  zone_key,
+                  label,
+                  record_count,
+                  rd);
+        }
+      }
+      GNUNET_SQ_cleanup_result (rs);
     }
-    GNUNET_SQ_cleanup_result (rs);
-  }
-  else
-  {
-    if (SQLITE_DONE != sret)
-      LOG_SQLITE (plugin,
-                  GNUNET_ERROR_TYPE_ERROR,
-                  "sqlite_step");
   }
   GNUNET_SQ_reset (plugin->dbh,
                    stmt);
@@ -628,7 +658,7 @@ get_record_and_call_iterator (struct Plugin *plugin,
  * @param label name of the record in the zone
  * @param iter function to call with the result
  * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
  */
 static int
 namestore_sqlite_lookup_records (void *cls,
@@ -645,7 +675,10 @@ namestore_sqlite_lookup_records (void *cls,
   };
 
   if (NULL == zone)
+  {
+    GNUNET_break (0);
     return GNUNET_SYSERR;
+  }
   if (GNUNET_OK !=
       GNUNET_SQ_bind (plugin->lookup_label,
                       params))
@@ -656,11 +689,12 @@ namestore_sqlite_lookup_records (void *cls,
                      plugin->lookup_label);
     return GNUNET_SYSERR;
   }
-  return get_record_and_call_iterator (plugin,
-                                       plugin->lookup_label,
-                                       zone,
-                                       iter,
-                                       iter_cls);
+  return get_records_and_call_iterator (plugin,
+                                        plugin->lookup_label,
+                                        zone,
+                                        1,
+                                        iter,
+                                        iter_cls);
 }
 
 
@@ -670,15 +704,17 @@ namestore_sqlite_lookup_records (void *cls,
  *
  * @param cls closure (internal context for the plugin)
  * @param zone hash of public key of the zone, NULL to iterate over all zones
- * @param offset offset in the list of all matching records
+ * @param serial serial number to exclude in the list of all matching records
+ * @param limit maximum number of results to return
  * @param iter function to call with the result
  * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no more results, #GNUNET_SYSERR on error
  */
 static int
 namestore_sqlite_iterate_records (void *cls,
                                   const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
-                                  uint64_t offset,
+                                  uint64_t serial,
+                                  uint64_t limit,
                                   GNUNET_NAMESTORE_RecordIterator iter,
                                   void *iter_cls)
 {
@@ -689,7 +725,8 @@ namestore_sqlite_iterate_records (void *cls,
   if (NULL == zone)
   {
     struct GNUNET_SQ_QueryParam params[] = {
-      GNUNET_SQ_query_param_uint64 (&offset),
+      GNUNET_SQ_query_param_uint64 (&serial),
+      GNUNET_SQ_query_param_uint64 (&limit),
       GNUNET_SQ_query_param_end
     };
 
@@ -701,7 +738,8 @@ namestore_sqlite_iterate_records (void *cls,
   {
     struct GNUNET_SQ_QueryParam params[] = {
       GNUNET_SQ_query_param_auto_from_type (zone),
-      GNUNET_SQ_query_param_uint64 (&offset),
+      GNUNET_SQ_query_param_uint64 (&serial),
+      GNUNET_SQ_query_param_uint64 (&limit),
       GNUNET_SQ_query_param_end
     };
 
@@ -718,11 +756,12 @@ namestore_sqlite_iterate_records (void *cls,
                      stmt);
     return GNUNET_SYSERR;
   }
-  return get_record_and_call_iterator (plugin,
-                                       stmt,
-                                       zone,
-                                       iter,
-                                       iter_cls);
+  return get_records_and_call_iterator (plugin,
+                                        stmt,
+                                        zone,
+                                        limit,
+                                        iter,
+                                        iter_cls);
 }
 
 
@@ -741,7 +780,8 @@ static int
 namestore_sqlite_zone_to_name (void *cls,
                                const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
                                const struct GNUNET_CRYPTO_EcdsaPublicKey *value_zone,
-                               GNUNET_NAMESTORE_RecordIterator iter, void *iter_cls)
+                               GNUNET_NAMESTORE_RecordIterator iter,
+                               void *iter_cls)
 {
   struct Plugin *plugin = cls;
   struct GNUNET_SQ_QueryParam params[] = {
@@ -764,11 +804,12 @@ namestore_sqlite_zone_to_name (void *cls,
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Performing reverse lookup for `%s'\n",
        GNUNET_GNSRECORD_z2s (value_zone));
-  return get_record_and_call_iterator (plugin,
-                                       plugin->zone_to_name,
-                                       zone,
-                                       iter,
-                                       iter_cls);
+  return get_records_and_call_iterator (plugin,
+                                        plugin->zone_to_name,
+                                        zone,
+                                        1,
+                                        iter,
+                                        iter_cls);
 }
 
 
@@ -787,7 +828,9 @@ libgnunet_plugin_namestore_sqlite_init (void *cls)
 
   if (NULL != plugin.cfg)
     return NULL;                /* can only initialize once! */
-  memset (&plugin, 0, sizeof (struct Plugin));
+  memset (&plugin,
+          0,
+          sizeof (struct Plugin));
   plugin.cfg = cfg;
   if (GNUNET_OK != database_setup (&plugin))
   {
diff --git a/src/namestore/plugin_rest_namestore.c b/src/namestore/plugin_rest_namestore.c
index 4602106da..fd1528a1d 100644
--- a/src/namestore/plugin_rest_namestore.c
+++ b/src/namestore/plugin_rest_namestore.c
@@ -452,7 +452,8 @@ namestore_list_response (void *cls,
                 "%s does not match %s\n",
                 rname,
                 handle->name);
-    GNUNET_NAMESTORE_zone_iterator_next (handle->list_it);
+    GNUNET_NAMESTORE_zone_iterator_next (handle->list_it,
+                                         1);
     return;
   }
 
@@ -460,7 +461,7 @@ namestore_list_response (void *cls,
   for (unsigned int i=0; i<rd_len; i++)
   {
     if ( (GNUNET_GNSRECORD_TYPE_NICK == rd[i].record_type) &&
-         (0 != strcmp (rname, GNUNET_GNS_MASTERZONE_STR)) )
+         (0 != strcmp (rname, GNUNET_GNS_EMPTY_LABEL_AT)) )
       continue;
 
     if ( (rd[i].record_type != handle->type) &&
@@ -483,7 +484,8 @@ namestore_list_response (void *cls,
   }
 
   json_decref (result_array);
-  GNUNET_NAMESTORE_zone_iterator_next (handle->list_it);
+  GNUNET_NAMESTORE_zone_iterator_next (handle->list_it,
+                                       1);
 }
 
 
diff --git a/src/namestore/test_namestore_api.conf b/src/namestore/test_namestore_api.conf
index a1a674d89..29ff90b5d 100644
--- a/src/namestore/test_namestore_api.conf
+++ b/src/namestore/test_namestore_api.conf
@@ -1,8 +1,19 @@
+@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/no_autostart_above_core.conf
+
 [PATHS]
 GNUNET_TEST_HOME = /tmp/test-gnunet-namestore/
 
 [namestore]
 DATABASE = sqlite
+AUTOSTART = YES
+
+[namecache]
+DATABASE = sqlite
+AUTOSTART = YES
+
+[identity]
+AUTOSTART = YES
 
 [namestore-sqlite]
 FILENAME = $GNUNET_TEST_HOME/namestore/sqlite_test.db
diff --git a/src/namestore/test_namestore_api_flat.conf b/src/namestore/test_namestore_api_flat.conf
new file mode 100644
index 000000000..49fe25468
--- /dev/null
+++ b/src/namestore/test_namestore_api_flat.conf
@@ -0,0 +1,4 @@
+@INLINE@ test_namestore_api.conf
+
+[namestore]
+DATABASE = flat
diff --git a/src/namestore/test_namestore_api_lookup_nick.c b/src/namestore/test_namestore_api_lookup_nick.c
index de958cee2..50d1fd9a9 100644
--- a/src/namestore/test_namestore_api_lookup_nick.c
+++ b/src/namestore/test_namestore_api_lookup_nick.c
@@ -18,8 +18,8 @@
      Boston, MA 02110-1301, USA.
 */
 /**
- * @file namestore/test_namestore_api_store.c
- * @brief testcase for namestore_api.c: store a record
+ * @file namestore/test_namestore_api_lookup_nick.c
+ * @brief testcase for namestore_api.c: NICK records
  */
 #include "platform.h"
 #include "gnunet_namestore_service.h"
@@ -317,15 +317,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-lookup-nick",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_lookup_private.c b/src/namestore/test_namestore_api_lookup_private.c
index 57505c48b..7866749f1 100644
--- a/src/namestore/test_namestore_api_lookup_private.c
+++ b/src/namestore/test_namestore_api_lookup_private.c
@@ -230,15 +230,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-lookup-private",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
@@ -248,4 +256,4 @@ main (int argc, char *argv[])
 }
 
 
-/* end of test_namestore_api_store.c */
+/* end of test_namestore_api_lookup_private.c */
diff --git a/src/namestore/test_namestore_api_lookup_public.c b/src/namestore/test_namestore_api_lookup_public.c
index 09d6b302d..02ca16042 100644
--- a/src/namestore/test_namestore_api_lookup_public.c
+++ b/src/namestore/test_namestore_api_lookup_public.c
@@ -237,15 +237,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_lookup_shadow.c b/src/namestore/test_namestore_api_lookup_shadow.c
index 7f9a90704..e80335796 100644
--- a/src/namestore/test_namestore_api_lookup_shadow.c
+++ b/src/namestore/test_namestore_api_lookup_shadow.c
@@ -18,7 +18,7 @@
      Boston, MA 02110-1301, USA.
 */
 /**
- * @file namestore/test_namestore_api_lookup_shadow_filter.c
+ * @file namestore/test_namestore_api_lookup_shadow.c
  * @brief testcase for namestore_api.c: store a shadow record and perform a lookup
  * test passes if test returns the record but without the shadow flag since no
  * other valid record is available
@@ -267,15 +267,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-lookup-shadow",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
@@ -285,4 +293,4 @@ main (int argc, char *argv[])
 }
 
 
-/* end of test_namestore_api_lookup_shadow_filter.c */
+/* end of test_namestore_api_lookup_shadow.c */
diff --git a/src/namestore/test_namestore_api_lookup_shadow_filter.c b/src/namestore/test_namestore_api_lookup_shadow_filter.c
index a22baa17b..5b8811a23 100644
--- a/src/namestore/test_namestore_api_lookup_shadow_filter.c
+++ b/src/namestore/test_namestore_api_lookup_shadow_filter.c
@@ -345,15 +345,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-lookup-shadow-filter",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_monitoring.c b/src/namestore/test_namestore_api_monitoring.c
index efbd6badf..f6d4fe226 100644
--- a/src/namestore/test_namestore_api_monitoring.c
+++ b/src/namestore/test_namestore_api_monitoring.c
@@ -209,7 +209,9 @@ zone_proc (void *cls,
 
 
 static void
-put_cont (void *cls, int32_t success, const char *emsg)
+put_cont (void *cls,
+          int32_t success,
+          const char *emsg)
 {
   static int c = 0;
   char *label = cls;
@@ -232,10 +234,12 @@ put_cont (void *cls, int32_t success, const char *emsg)
   else
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "Failed to created records\n");
+                "Failed to create record `%s'\n",
+                label);
     GNUNET_break (0);
     GNUNET_SCHEDULER_cancel (endbadly_task);
-    endbadly_task = GNUNET_SCHEDULER_add_now (&endbadly, NULL);
+    endbadly_task = GNUNET_SCHEDULER_add_now (&endbadly,
+                                              NULL);
   }
 }
 
@@ -341,10 +345,16 @@ run (void *cls,
   /* name in different zone */
   GNUNET_asprintf(&s_name_3, "dummy3");
   s_rd_3 = create_record(1);
-  GNUNET_assert (NULL != (ns_ops[2] = GNUNET_NAMESTORE_records_store (nsh, privkey2, s_name_3,
-                1, s_rd_3, &put_cont, s_name_3)));
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Created record 1\n");
+  GNUNET_assert (NULL != (ns_ops[2] =
+                          GNUNET_NAMESTORE_records_store (nsh,
+                                                          privkey2,
+                                                          s_name_3,
+                                                          1,
+                                                          s_rd_3,
+                                                          &put_cont,
+                                                          s_name_3)));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Created record 1\n");
   GNUNET_asprintf(&s_name_1, "dummy1");
   s_rd_1 = create_record(1);
   GNUNET_assert (NULL != (ns_ops[0] = GNUNET_NAMESTORE_records_store(nsh, privkey, s_name_1,
@@ -364,15 +374,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api-monitoring",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_monitoring_existing.c b/src/namestore/test_namestore_api_monitoring_existing.c
index cd1838b5c..17f726eb1 100644
--- a/src/namestore/test_namestore_api_monitoring_existing.c
+++ b/src/namestore/test_namestore_api_monitoring_existing.c
@@ -71,18 +71,18 @@ do_shutdown ()
 
   if (NULL != ns_ops[0])
   {
-        GNUNET_NAMESTORE_cancel(ns_ops[0]);
-        ns_ops[0] = NULL;
+    GNUNET_NAMESTORE_cancel(ns_ops[0]);
+    ns_ops[0] = NULL;
   }
   if (NULL != ns_ops[1])
   {
-        GNUNET_NAMESTORE_cancel(ns_ops[1]);
-        ns_ops[1] = NULL;
+    GNUNET_NAMESTORE_cancel(ns_ops[1]);
+    ns_ops[1] = NULL;
   }
   if (NULL != ns_ops[2])
   {
-        GNUNET_NAMESTORE_cancel(ns_ops[2]);
-        ns_ops[2] = NULL;
+    GNUNET_NAMESTORE_cancel(ns_ops[2]);
+    ns_ops[2] = NULL;
   }
 
   if (NULL != nsh)
@@ -274,18 +274,20 @@ put_cont (void *cls, int32_t success, const char *emsg)
 static struct GNUNET_GNSRECORD_Data *
 create_record (unsigned int count)
 {
-  unsigned int c;
   struct GNUNET_GNSRECORD_Data * rd;
 
-  rd = GNUNET_malloc (count * sizeof (struct GNUNET_GNSRECORD_Data));
-  for (c = 0; c < count; c++)
+  rd = GNUNET_new_array (count,
+                         struct GNUNET_GNSRECORD_Data);
+  for (unsigned int c = 0; c < count; c++)
   {
     rd[c].expiration_time = GNUNET_TIME_relative_to_absolute (GNUNET_TIME_UNIT_HOURS).abs_value_us;
     rd[c].record_type = 1111;
     rd[c].data_size = 50;
     rd[c].data = GNUNET_malloc(50);
     rd[c].flags = 0;
-    memset ((char *) rd[c].data, 'a', 50);
+    memset ((char *) rd[c].data,
+            'a',
+            50);
   }
   return rd;
 }
@@ -300,7 +302,10 @@ run (void *cls,
 
   directory = NULL;
   GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CONFIGURATION_get_value_string(mycfg, "PATHS", "GNUNET_TEST_HOME", &directory));
+                 GNUNET_CONFIGURATION_get_value_string (mycfg,
+                                                        "PATHS",
+                                                        "GNUNET_TEST_HOME",
+                                                        &directory));
   GNUNET_DISK_directory_remove (directory);
 
   res = 1;
@@ -363,15 +368,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api-monitoring",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-monitoring-existing",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
@@ -381,4 +394,4 @@ main (int argc, char *argv[])
 }
 
 
-/* end of test_namestore_api_monitoring.c */
+/* end of test_namestore_api_monitoring_existing.c */
diff --git a/src/namestore/test_namestore_api_postgres.conf b/src/namestore/test_namestore_api_postgres.conf
new file mode 100644
index 000000000..397cb4b2f
--- /dev/null
+++ b/src/namestore/test_namestore_api_postgres.conf
@@ -0,0 +1,4 @@
+@INLINE@ test_namestore_api.conf
+
+[namestore]
+DATABASE = postgres
diff --git a/src/namestore/test_namestore_api_remove.c b/src/namestore/test_namestore_api_remove.c
index 2d670c1ee..532a751da 100644
--- a/src/namestore/test_namestore_api_remove.c
+++ b/src/namestore/test_namestore_api_remove.c
@@ -120,7 +120,8 @@ remove_cont (void *cls,
 
 
 static void
-put_cont (void *cls, int32_t success,
+put_cont (void *cls,
+          int32_t success,
           const char *emsg)
 {
   const char *name = cls;
@@ -161,20 +162,27 @@ run (void *cls,
 
   directory = NULL;
   GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CONFIGURATION_get_value_string(cfg, "PATHS", "GNUNET_TEST_HOME", &directory));
+                 GNUNET_CONFIGURATION_get_value_string(cfg,
+                                                       "PATHS",
+                                                       "GNUNET_TEST_HOME",
+                                                       &directory));
   GNUNET_DISK_directory_remove (directory);
 
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
-                                                &endbadly, NULL);
+                                                &endbadly,
+                                                NULL);
   GNUNET_asprintf (&hostkey_file,
                    "zonefiles%s%s",
                    DIR_SEPARATOR_STR,
                    "N0UJMP015AFUNR2BTNM3FKPBLG38913BL8IDMCO2H0A1LIB81960.zkey");
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Using zonekey file `%s' \n", hostkey_file);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Using zonekey file `%s' \n",
+              hostkey_file);
   privkey = GNUNET_CRYPTO_ecdsa_key_create_from_file (hostkey_file);
   GNUNET_free (hostkey_file);
   GNUNET_assert (privkey != NULL);
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey, &pubkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (privkey,
+                                      &pubkey);
 
   removed = GNUNET_NO;
 
@@ -201,15 +209,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-remove",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_remove_not_existing_record.c b/src/namestore/test_namestore_api_remove_not_existing_record.c
index ef199cdf6..2f20c3636 100644
--- a/src/namestore/test_namestore_api_remove_not_existing_record.c
+++ b/src/namestore/test_namestore_api_remove_not_existing_record.c
@@ -167,15 +167,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-remove-non-existing-record",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_sqlite.conf b/src/namestore/test_namestore_api_sqlite.conf
new file mode 100644
index 000000000..5416daec3
--- /dev/null
+++ b/src/namestore/test_namestore_api_sqlite.conf
@@ -0,0 +1,4 @@
+@INLINE@ test_namestore_api.conf
+
+[namestore]
+DATABASE = sqlite
diff --git a/src/namestore/test_namestore_api_store.c b/src/namestore/test_namestore_api_store.c
index d80676770..4e51678a1 100644
--- a/src/namestore/test_namestore_api_store.c
+++ b/src/namestore/test_namestore_api_store.c
@@ -159,15 +159,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
     GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_store_update.c b/src/namestore/test_namestore_api_store_update.c
index ed5a399bd..0a4551f21 100644
--- a/src/namestore/test_namestore_api_store_update.c
+++ b/src/namestore/test_namestore_api_store_update.c
@@ -274,15 +274,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api-store-update",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_zone_iteration.c b/src/namestore/test_namestore_api_zone_iteration.c
index 8960be55d..806605d94 100644
--- a/src/namestore/test_namestore_api_zone_iteration.c
+++ b/src/namestore/test_namestore_api_zone_iteration.c
@@ -276,7 +276,8 @@ zone_proc (void *cls,
     returned_records ++;
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Telling namestore to send the next result\n");
-    GNUNET_NAMESTORE_zone_iterator_next (zi);
+    GNUNET_NAMESTORE_zone_iterator_next (zi,
+                                         1);
   }
   else
   {
@@ -486,15 +487,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api-zone-iteration",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_zone_iteration_nick.c b/src/namestore/test_namestore_api_zone_iteration_nick.c
index 791702f97..a88646864 100644
--- a/src/namestore/test_namestore_api_zone_iteration_nick.c
+++ b/src/namestore/test_namestore_api_zone_iteration_nick.c
@@ -245,7 +245,8 @@ zone_proc (void *cls,
     returned_records ++;
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Telling namestore to send the next result\n");
-    GNUNET_NAMESTORE_zone_iterator_next (zi);
+    GNUNET_NAMESTORE_zone_iterator_next (zi,
+                                         1);
   }
   else
   {
@@ -489,15 +490,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api-zone-iteration",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-zone-iteration-nick",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_zone_iteration_specific_zone.c b/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
index c5ae927b0..a4fb320e9 100644
--- a/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
+++ b/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
@@ -238,7 +238,8 @@ zone_proc (void *cls,
     returned_records ++;
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Telling namestore to send the next result\n");
-    GNUNET_NAMESTORE_zone_iterator_next (zi);
+    GNUNET_NAMESTORE_zone_iterator_next (zi,
+                                         1);
   }
   else
   {
@@ -484,15 +485,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api-zone-iteration",
-                               "test_namestore_api.conf",
+      GNUNET_TESTING_peer_run ("test-namestore-api-zone-iteration-specific-zone",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_zone_iteration_stop.c b/src/namestore/test_namestore_api_zone_iteration_stop.c
index a5f040150..c7be5fead 100644
--- a/src/namestore/test_namestore_api_zone_iteration_stop.c
+++ b/src/namestore/test_namestore_api_zone_iteration_stop.c
@@ -271,7 +271,8 @@ zone_proc (void *cls,
     returned_records ++;
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Telling namestore to send the next result\n");
-    GNUNET_NAMESTORE_zone_iterator_next (zi);
+    GNUNET_NAMESTORE_zone_iterator_next (zi,
+                                         1);
   }
   else
   {
@@ -507,15 +508,23 @@ run (void *cls,
 int
 main (int argc, char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api-zone-iteration-stop",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
       GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_namestore_api_zone_to_name.c b/src/namestore/test_namestore_api_zone_to_name.c
index 2bc7d34a3..5b088d90b 100644
--- a/src/namestore/test_namestore_api_zone_to_name.c
+++ b/src/namestore/test_namestore_api_zone_to_name.c
@@ -221,7 +221,7 @@ run (void *cls,
   /* load privat key */
   {
     char *zonekey_file;
-  
+
     GNUNET_asprintf (&zonekey_file,
                      "zonefiles%s%s",
                      DIR_SEPARATOR_STR,
@@ -242,13 +242,13 @@ run (void *cls,
                               sizeof (s_zone_value));
   {
     struct GNUNET_GNSRECORD_Data rd;
-    
+
     rd.expiration_time = GNUNET_TIME_absolute_get().abs_value_us;
     rd.record_type = GNUNET_GNSRECORD_TYPE_PKEY;
     rd.data_size = sizeof (s_zone_value);
     rd.data = &s_zone_value;
     rd.flags = 0;
-    
+
     nsh = GNUNET_NAMESTORE_connect (cfg);
     GNUNET_break (NULL != nsh);
     GNUNET_NAMESTORE_records_store (nsh,
@@ -266,17 +266,24 @@ int
 main (int argc,
       char *argv[])
 {
+  const char *plugin_name;
+  char *cfg_name;
+
   (void) argc;
-  (void) argv;
+  plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
+  GNUNET_asprintf (&cfg_name,
+                   "test_namestore_api_%s.conf",
+                   plugin_name);
   res = 1;
   if (0 !=
       GNUNET_TESTING_peer_run ("test-namestore-api-zone-to-name",
-                               "test_namestore_api.conf",
+                               cfg_name,
                                &run,
                                NULL))
   {
     res = 1;
   }
+  GNUNET_free (cfg_name);
   if (NULL != directory)
   {
     GNUNET_DISK_directory_remove (directory);
diff --git a/src/namestore/test_plugin_namestore.c b/src/namestore/test_plugin_namestore.c
index aa5d10809..6bccd1706 100644
--- a/src/namestore/test_plugin_namestore.c
+++ b/src/namestore/test_plugin_namestore.c
@@ -47,8 +47,12 @@ unload_plugin (struct GNUNET_NAMESTORE_PluginFunctions *api)
 {
   char *libname;
 
-  GNUNET_asprintf (&libname, "libgnunet_plugin_namestore_%s", plugin_name);
-  GNUNET_break (NULL == GNUNET_PLUGIN_unload (libname, api));
+  GNUNET_asprintf (&libname,
+                   "libgnunet_plugin_namestore_%s",
+                   plugin_name);
+  GNUNET_break (NULL ==
+                GNUNET_PLUGIN_unload (libname,
+                                      api));
   GNUNET_free (libname);
 }
 
@@ -65,12 +69,17 @@ load_plugin (const struct GNUNET_CONFIGURATION_Handle *cfg)
   struct GNUNET_NAMESTORE_PluginFunctions *ret;
   char *libname;
 
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO, _("Loading `%s' namestore plugin\n"),
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              _("Loading `%s' namestore plugin\n"),
               plugin_name);
-  GNUNET_asprintf (&libname, "libgnunet_plugin_namestore_%s", plugin_name);
+  GNUNET_asprintf (&libname,
+                   "libgnunet_plugin_namestore_%s",
+                   plugin_name);
   if (NULL == (ret = GNUNET_PLUGIN_load (libname, (void*) cfg)))
   {
-    FPRINTF (stderr, "Failed to load plugin `%s'!\n", plugin_name);
+    FPRINTF (stderr,
+             "Failed to load plugin `%s'!\n",
+             plugin_name);
     GNUNET_free (libname);
     return NULL;
   }
@@ -81,54 +90,66 @@ load_plugin (const struct GNUNET_CONFIGURATION_Handle *cfg)
 
 static void
 test_record (void *cls,
-                                                 const struct GNUNET_CRYPTO_EcdsaPrivateKey *private_key,
-                                                 const char *label,
-                                                 unsigned int rd_count,
-                                                 const struct GNUNET_GNSRECORD_Data *rd)
+             uint64_t seq,
+             const struct GNUNET_CRYPTO_EcdsaPrivateKey *private_key,
+             const char *label,
+             unsigned int rd_count,
+             const struct GNUNET_GNSRECORD_Data *rd)
 {
   int *idp = cls;
   int id = *idp;
   struct GNUNET_CRYPTO_EcdsaPrivateKey tzone_private_key;
   char tname[64];
   unsigned int trd_count = 1 + (id % 1024);
-  unsigned int i;
 
-  GNUNET_snprintf (tname, sizeof (tname),
-                   "a%u", (unsigned int ) id);
-  for (i=0;i<trd_count;i++)
+  GNUNET_snprintf (tname,
+                   sizeof (tname),
+                   "a%u",
+                   (unsigned int ) id);
+  for (unsigned int i=0;i<trd_count;i++)
   {
     GNUNET_assert (rd[i].data_size == id % 10);
     GNUNET_assert (0 == memcmp ("Hello World", rd[i].data, id % 10));
     GNUNET_assert (rd[i].record_type == 1 + (id % 13));
     GNUNET_assert (rd[i].flags == 0);
   }
-  memset (&tzone_private_key, (id % 241), sizeof (tzone_private_key));
+  memset (&tzone_private_key,
+          (id % 241),
+          sizeof (tzone_private_key));
   GNUNET_assert (0 == strcmp (label, tname));
-  GNUNET_assert (0 == memcmp (&tzone_private_key, private_key, sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey)));
+  GNUNET_assert (0 == memcmp (&tzone_private_key,
+                              private_key,
+                              sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey)));
 }
 
 
 static void
-get_record (struct GNUNET_NAMESTORE_PluginFunctions *nsp, int id)
+get_record (struct GNUNET_NAMESTORE_PluginFunctions *nsp,
+            int id)
 {
-  GNUNET_assert (GNUNET_OK == nsp->iterate_records (nsp->cls,
-                                            NULL, 0, &test_record, &id));
+  GNUNET_assert (GNUNET_OK ==
+                 nsp->iterate_records (nsp->cls,
+                                       NULL,
+                                       0,
+                                       1,
+                                       &test_record,
+                                       &id));
 }
 
 
 static void
-put_record (struct GNUNET_NAMESTORE_PluginFunctions *nsp, int id)
+put_record (struct GNUNET_NAMESTORE_PluginFunctions *nsp,
+            int id)
 {
   struct GNUNET_CRYPTO_EcdsaPrivateKey zone_private_key;
   char label[64];
   unsigned int rd_count = 1 + (id % 1024);
   struct GNUNET_GNSRECORD_Data rd[rd_count];
   struct GNUNET_CRYPTO_EcdsaSignature signature;
-  unsigned int i;
 
   GNUNET_snprintf (label, sizeof (label),
                    "a%u", (unsigned int ) id);
-  for (i=0;i<rd_count;i++)
+  for (unsigned int i=0;i<rd_count;i++)
   {
     rd[i].data = "Hello World";
     rd[i].data_size = id % 10;
@@ -138,16 +159,19 @@ put_record (struct GNUNET_NAMESTORE_PluginFunctions *nsp, int id)
   }
   memset (&zone_private_key, (id % 241), sizeof (zone_private_key));
   memset (&signature, (id % 243), sizeof (signature));
-  GNUNET_assert (GNUNET_OK == nsp->store_records (nsp->cls,
-                                                &zone_private_key,
-                                                label,
-                                                rd_count,
-                                                rd));
+  GNUNET_assert (GNUNET_OK ==
+                 nsp->store_records (nsp->cls,
+                                     &zone_private_key,
+                                     label,
+                                     rd_count,
+                                     rd));
 }
 
 
 static void
-run (void *cls, char *const *args, const char *cfgfile,
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
      const struct GNUNET_CONFIGURATION_Handle *cfg)
 {
   struct GNUNET_NAMESTORE_PluginFunctions *nsp;
@@ -169,7 +193,8 @@ run (void *cls, char *const *args, const char *cfgfile,
 
 
 int
-main (int argc, char *argv[])
+main (int argc,
+      char *argv[])
 {
   char cfg_name[128];
   char *const xargv[] = {
@@ -182,18 +207,25 @@ main (int argc, char *argv[])
     GNUNET_GETOPT_OPTION_END
   };
 
-  //GNUNET_DISK_directory_remove ("/tmp/gnunet-test-plugin-namestore-sqlite");
   GNUNET_log_setup ("test-plugin-namestore",
                     "WARNING",
                     NULL);
   plugin_name = GNUNET_TESTING_get_testname_from_underscore (argv[0]);
-  GNUNET_snprintf (cfg_name, sizeof (cfg_name), "test_plugin_namestore_%s.conf",
+  GNUNET_snprintf (cfg_name,
+                   sizeof (cfg_name),
+                   "test_plugin_namestore_%s.conf",
                    plugin_name);
-  GNUNET_PROGRAM_run ((sizeof (xargv) / sizeof (char *)) - 1, xargv,
-                      "test-plugin-namestore", "nohelp", options, &run, NULL);
+  GNUNET_PROGRAM_run ((sizeof (xargv) / sizeof (char *)) - 1,
+                      xargv,
+                      "test-plugin-namestore",
+                      "nohelp",
+                      options,
+                      &run,
+                      NULL);
   if (ok != 0)
-    FPRINTF (stderr, "Missed some testcases: %d\n", ok);
-  //GNUNET_DISK_directory_remove ("/tmp/gnunet-test-plugin-namestore-sqlite");
+    FPRINTF (stderr,
+             "Missed some testcases: %d\n",
+             ok);
   return ok;
 }
 
diff --git a/src/util/container_multihashmap.c b/src/util/container_multihashmap.c
index ffeb4a71f..6001fc1df 100644
--- a/src/util/container_multihashmap.c
+++ b/src/util/container_multihashmap.c
@@ -175,14 +175,36 @@ struct GNUNET_CONTAINER_MultiHashMap *
 GNUNET_CONTAINER_multihashmap_create (unsigned int len,
                                       int do_not_copy_keys)
 {
-  struct GNUNET_CONTAINER_MultiHashMap *map;
+  struct GNUNET_CONTAINER_MultiHashMap *hm;
 
   GNUNET_assert (len > 0);
-  map = GNUNET_new (struct GNUNET_CONTAINER_MultiHashMap);
-  map->map = GNUNET_malloc (len * sizeof (union MapEntry));
-  map->map_length = len;
-  map->use_small_entries = do_not_copy_keys;
-  return map;
+  hm = GNUNET_new (struct GNUNET_CONTAINER_MultiHashMap);
+  if (len * sizeof (union MapEntry) > GNUNET_MAX_MALLOC_CHECKED)
+  {
+    size_t s;
+    /* application *explicitly* requested very large map, hopefully
+       it checks the return value... */
+    s = len * sizeof (union MapEntry);
+    if ( (s / sizeof (union MapEntry)) != len)
+      return NULL; /* integer overflow on multiplication */
+    if (NULL == (hm->map = GNUNET_malloc_large (s)))
+    {
+      /* out of memory */
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Out of memory allocating large hash map (%u entries)\n",
+                  len);
+      GNUNET_free (hm);
+      return NULL;
+    }
+  }
+  else
+  {
+    hm->map = GNUNET_new_array (len,
+                                union MapEntry);
+  }
+  hm->map_length = len;
+  hm->use_small_entries = do_not_copy_keys;
+  return hm;
 }
 
 
@@ -196,11 +218,10 @@ void
 GNUNET_CONTAINER_multihashmap_destroy (struct GNUNET_CONTAINER_MultiHashMap
                                        *map)
 {
-  unsigned int i;
-  union MapEntry me;
-
-  for (i = 0; i < map->map_length; i++)
+  for (unsigned int i = 0; i < map->map_length; i++)
   {
+    union MapEntry me;
+
     me = map->map[i];
     if (map->use_small_entries)
     {
@@ -257,8 +278,7 @@ idx_of (const struct GNUNET_CONTAINER_MultiHashMap *map,
  * @return the number of key value pairs
  */
 unsigned int
-GNUNET_CONTAINER_multihashmap_size (const struct GNUNET_CONTAINER_MultiHashMap
-                                    *map)
+GNUNET_CONTAINER_multihashmap_size (const struct GNUNET_CONTAINER_MultiHashMap *map)
 {
   return map->size;
 }
@@ -656,17 +676,22 @@ grow (struct GNUNET_CONTAINER_MultiHashMap *map)
   unsigned int old_len;
   unsigned int new_len;
   unsigned int idx;
-  unsigned int i;
 
   map->modification_counter++;
 
   old_map = map->map;
   old_len = map->map_length;
   new_len = old_len * 2;
-  new_map = GNUNET_malloc (sizeof (union MapEntry) * new_len);
+  /* if we would exceed heap size limit for the _first_ time,
+     try staying just below the limit */
+  if ( (new_len * sizeof (union MapEntry) > GNUNET_MAX_MALLOC_CHECKED) &&
+       ((old_len+1) * sizeof (union MapEntry) < GNUNET_MAX_MALLOC_CHECKED) )
+    new_len = GNUNET_MAX_MALLOC_CHECKED / sizeof (union MapEntry);
+  new_map = GNUNET_new_array (new_len,
+                              union MapEntry);
   map->map_length = new_len;
   map->map = new_map;
-  for (i = 0; i < old_len; i++)
+  for (unsigned int i = 0; i < old_len; i++)
   {
     if (map->use_small_entries)
     {
diff --git a/src/util/mq.c b/src/util/mq.c
index af700836c..dbcce704d 100644
--- a/src/util/mq.c
+++ b/src/util/mq.c
@@ -578,11 +578,9 @@ void
 GNUNET_MQ_set_handlers_closure (struct GNUNET_MQ_Handle *mq,
                                 void *handlers_cls)
 {
-  unsigned int i;
-
   if (NULL == mq->handlers)
     return;
-  for (i=0;NULL != mq->handlers[i].cb; i++)
+  for (unsigned int i=0;NULL != mq->handlers[i].cb; i++)
     mq->handlers[i].cls = handlers_cls;
 }
 
@@ -782,7 +780,9 @@ GNUNET_MQ_notify_sent (struct GNUNET_MQ_Envelope *ev,
                        GNUNET_SCHEDULER_TaskCallback cb,
                        void *cb_cls)
 {
-  GNUNET_assert (NULL == ev->sent_cb);
+  /* allow setting *OR* clearing callback */
+  GNUNET_assert ( (NULL == ev->sent_cb) ||
+                  (NULL == cb) );
   ev->sent_cb = cb;
   ev->sent_cls = cb_cls;
 }
diff --git a/src/util/resolver_api.c b/src/util/resolver_api.c
index b92fd6a02..68f02587a 100644
--- a/src/util/resolver_api.c
+++ b/src/util/resolver_api.c
@@ -478,7 +478,15 @@ handle_response (void *cls,
   char *nret;
 
   (void) cls;
-  GNUNET_assert (NULL != rh);
+  if (NULL == rh)
+  {
+    /* Resolver service sent extra replies to query (after terminator)? Bad! */
+    GNUNET_break (0);
+    GNUNET_MQ_destroy (mq);
+    mq = NULL;
+    reconnect ();
+    return;
+  }
   size = ntohs (msg->size);
   if (size == sizeof (struct GNUNET_MessageHeader))
   {
diff --git a/src/zonemaster/gnunet-service-zonemaster.c b/src/zonemaster/gnunet-service-zonemaster.c
index b3a2cb8b3..7129cf44f 100644
--- a/src/zonemaster/gnunet-service-zonemaster.c
+++ b/src/zonemaster/gnunet-service-zonemaster.c
@@ -36,20 +36,38 @@
 #define LOG_STRERROR_FILE(kind,syscall,filename) GNUNET_log_from_strerror_file (kind, "util", syscall, filename)
 
 
+/**
+ * How often should we (re)publish each record before
+ * it expires?
+ */
+#define PUBLISH_OPS_PER_EXPIRATION 4
 
 /**
- * The initial interval in milliseconds btween puts in
- * a zone iteration
+ * How often do we measure the delta between desired zone
+ * iteration speed and actual speed, and tell statistics
+ * service about it?
  */
-#define INITIAL_PUT_INTERVAL GNUNET_TIME_UNIT_MILLISECONDS
+#define DELTA_INTERVAL 100
 
 /**
- * The lower bound for the zone iteration interval
+ * How many records do we fetch in one shot from the namestore?
  */
-#define MINIMUM_ZONE_ITERATION_INTERVAL GNUNET_TIME_UNIT_SECONDS
+#define NS_BLOCK_SIZE 1000
+
+/**
+ * How many pending DHT operations do we allow at most?
+ */
+#define DHT_QUEUE_LIMIT 2000
+
+/**
+ * The initial interval in milliseconds btween puts in
+ * a zone iteration
+ */
+#define INITIAL_ZONE_ITERATION_INTERVAL GNUNET_TIME_UNIT_MILLISECONDS
 
 /**
  * The upper bound for the zone iteration interval
+ * (per record).
  */
 #define MAXIMUM_ZONE_ITERATION_INTERVAL GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 15)
 
@@ -79,22 +97,27 @@
 /**
  * Handle for DHT PUT activity triggered from the namestore monitor.
  */
-struct MonitorActivity
+struct DhtPutActivity
 {
   /**
    * Kept in a DLL.
    */
-  struct MonitorActivity *next;
+  struct DhtPutActivity *next;
 
   /**
    * Kept in a DLL.
    */
-  struct MonitorActivity *prev;
+  struct DhtPutActivity *prev;
 
   /**
    * Handle for the DHT PUT operation.
    */
   struct GNUNET_DHT_PutHandle *ph;
+
+  /**
+   * When was this PUT initiated?
+   */
+  struct GNUNET_TIME_Absolute start_date;
 };
 
 
@@ -131,12 +154,32 @@ static struct GNUNET_NAMESTORE_ZoneMonitor *zmon;
 /**
  * Head of monitor activities; kept in a DLL.
  */
-static struct MonitorActivity *ma_head;
+static struct DhtPutActivity *ma_head;
 
 /**
  * Tail of monitor activities; kept in a DLL.
  */
-static struct MonitorActivity *ma_tail;
+static struct DhtPutActivity *ma_tail;
+
+/**
+ * Head of iteration put activities; kept in a DLL.
+ */
+static struct DhtPutActivity *it_head;
+
+/**
+ * Tail of iteration put activities; kept in a DLL.
+ */
+static struct DhtPutActivity *it_tail;
+
+/**
+ * Number of entries in the DHT queue #it_head.
+ */
+static unsigned int dht_queue_length;
+
+/**
+ * Number of entries in the DHT queue #ma_head.
+ */
+static unsigned int ma_queue_length;
 
 /**
  * Useful for zone update for DHT put
@@ -149,15 +192,31 @@ static unsigned long long num_public_records;
 static unsigned long long last_num_public_records;
 
 /**
+ * Number of successful put operations performed in the current
+ * measurement cycle (as measured in #check_zone_namestore_next()).
+ */
+static unsigned long long put_cnt;
+
+/**
+ * What is the frequency at which we currently would like
+ * to perform DHT puts (per record)?  Calculated in
+ * update_velocity() from the #zone_publish_time_window()
+ * and the total number of record sets we have (so far)
+ * observed in the zone.
+ */
+static struct GNUNET_TIME_Relative target_iteration_velocity_per_record;
+
+/**
  * Minimum relative expiration time of records seem during the current
  * zone iteration.
  */
 static struct GNUNET_TIME_Relative min_relative_record_time;
 
 /**
- * Zone iteration PUT interval.
+ * Minimum relative expiration time of records seem during the last
+ * zone iteration.
  */
-static struct GNUNET_TIME_Relative put_interval;
+static struct GNUNET_TIME_Relative last_min_relative_record_time;
 
 /**
  * Default time window for zone iteration
@@ -171,16 +230,43 @@ static struct GNUNET_TIME_Relative zone_publish_time_window_default;
 static struct GNUNET_TIME_Relative zone_publish_time_window;
 
 /**
+ * When did we last start measuring the #DELTA_INTERVAL successful
+ * DHT puts? Used for velocity calculations.
+ */
+static struct GNUNET_TIME_Absolute last_put_100;
+
+/**
+ * By how much should we try to increase our per-record iteration speed
+ * (over the desired speed calculated directly from the #put_interval)?
+ * Basically this value corresponds to the per-record CPU time overhead
+ * we have.
+ */
+static struct GNUNET_TIME_Relative sub_delta;
+
+/**
  * zone publish task
  */
 static struct GNUNET_SCHEDULER_Task *zone_publish_task;
 
 /**
+ * How many more values are left for the current query before we need
+ * to explicitly ask the namestore for more?
+ */
+static unsigned int ns_iteration_left;
+
+/**
  * #GNUNET_YES if zone has never been published before
  */
 static int first_zone_iteration;
 
 /**
+ * Optimize block insertion by caching map of private keys to
+ * public keys in memory?
+ */
+static int cache_keys;
+
+
+/**
  * Task run during shutdown.
  *
  * @param cls unused
@@ -189,8 +275,9 @@ static int first_zone_iteration;
 static void
 shutdown_task (void *cls)
 {
-  struct MonitorActivity *ma;
+  struct DhtPutActivity *ma;
 
+  (void) cls;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Shutting down!\n");
   while (NULL != (ma = ma_head))
@@ -201,6 +288,15 @@ shutdown_task (void *cls)
                                  ma);
     GNUNET_free (ma);
   }
+  while (NULL != (ma = it_head))
+  {
+    GNUNET_DHT_put_cancel (ma->ph);
+    GNUNET_CONTAINER_DLL_remove (it_head,
+                                 it_tail,
+                                 ma);
+    dht_queue_length--;
+    GNUNET_free (ma);
+  }
   if (NULL != statistics)
   {
     GNUNET_STATISTICS_destroy (statistics,
@@ -243,14 +339,18 @@ shutdown_task (void *cls)
 /**
  * Method called periodically that triggers iteration over authoritative records
  *
- * @param cls closure
+ * @param cls NULL
  */
 static void
-publish_zone_dht_next (void *cls)
+publish_zone_namestore_next (void *cls)
 {
+  (void) cls;
   zone_publish_task = NULL;
   GNUNET_assert (NULL != namestore_iter);
-  GNUNET_NAMESTORE_zone_iterator_next (namestore_iter);
+  GNUNET_assert (0 == ns_iteration_left);
+  ns_iteration_left = NS_BLOCK_SIZE;
+  GNUNET_NAMESTORE_zone_iterator_next (namestore_iter,
+                                       NS_BLOCK_SIZE);
 }
 
 
@@ -264,58 +364,224 @@ publish_zone_dht_start (void *cls);
 
 
 /**
- * Continuation called from DHT once the PUT operation is done.
+ * Continuation called from DHT once the PUT operation triggered
+ * by a monitor is done.
  *
- * @param cls closure, NULL if called from regular iteration,
- *        `struct MonitorActivity` if called from #handle_monitor_event.
- * @param success #GNUNET_OK on success
+ * @param cls a `struct DhtPutActivity`
  */
 static void
-dht_put_continuation (void *cls,
-                      int success)
+dht_put_monitor_continuation (void *cls)
 {
-  struct MonitorActivity *ma = cls;
-  struct GNUNET_TIME_Relative next_put_interval;
+  struct DhtPutActivity *ma = cls;
 
-  num_public_records++;
-  if (NULL == ma)
+  ma_queue_length--;
+  GNUNET_CONTAINER_DLL_remove (ma_head,
+                               ma_tail,
+                               ma);
+  GNUNET_free (ma);
+}
+
+
+/**
+ * Calculate #target_iteration_velocity_per_record.
+ */
+static void
+calculate_put_interval ()
+{
+  if (0 == num_public_records)
   {
-    active_put = NULL;
-    if ( (num_public_records > last_num_public_records) &&
-         (GNUNET_NO == first_zone_iteration) )
+    /**
+     * If no records are known (startup) or none present
+     * we can safely set the interval to the value for a single
+     * record
+     */
+    target_iteration_velocity_per_record = zone_publish_time_window;
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG | GNUNET_ERROR_TYPE_BULK,
+                "No records in namestore database.\n");
+  }
+  else
+  {
+    last_min_relative_record_time
+      = GNUNET_TIME_relative_min (last_min_relative_record_time,
+                                  min_relative_record_time);
+    zone_publish_time_window
+      = GNUNET_TIME_relative_min (GNUNET_TIME_relative_divide (last_min_relative_record_time,
+                                                               PUBLISH_OPS_PER_EXPIRATION),
+                                  zone_publish_time_window_default);
+    target_iteration_velocity_per_record
+      = GNUNET_TIME_relative_divide (zone_publish_time_window,
+                                     last_num_public_records);
+  }
+  target_iteration_velocity_per_record
+    = GNUNET_TIME_relative_min (target_iteration_velocity_per_record,
+                                MAXIMUM_ZONE_ITERATION_INTERVAL);
+  GNUNET_STATISTICS_set (statistics,
+                         "Minimum relative record expiration (in μs)",
+                         last_min_relative_record_time.rel_value_us,
+                         GNUNET_NO);
+  GNUNET_STATISTICS_set (statistics,
+                         "Zone publication time window (in μs)",
+                         zone_publish_time_window.rel_value_us,
+                         GNUNET_NO);
+  GNUNET_STATISTICS_set (statistics,
+                         "Target zone iteration velocity (μs)",
+                         target_iteration_velocity_per_record.rel_value_us,
+                         GNUNET_NO);
+}
+
+
+/**
+ * Re-calculate our velocity and the desired velocity.
+ * We have succeeded in making #DELTA_INTERVAL puts, so
+ * now calculate the new desired delay between puts.
+ *
+ * @param cnt how many records were processed since the last call?
+ */
+static void
+update_velocity (unsigned int cnt)
+{
+  struct GNUNET_TIME_Relative delta;
+  unsigned long long pct = 0;
+
+  if (0 == cnt)
+    return;
+  /* How fast were we really? */
+  delta = GNUNET_TIME_absolute_get_duration (last_put_100);
+  delta.rel_value_us /= cnt;
+  last_put_100 = GNUNET_TIME_absolute_get ();
+
+  /* calculate expected frequency */
+  if ( (num_public_records > last_num_public_records) &&
+       (GNUNET_NO == first_zone_iteration) )
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Last record count was lower than current record count.  Reducing interval.\n");
+    last_num_public_records = num_public_records * LATE_ITERATION_SPEEDUP_FACTOR;
+    calculate_put_interval ();
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Desired global zone iteration interval is %s/record!\n",
+              GNUNET_STRINGS_relative_time_to_string (target_iteration_velocity_per_record,
+                                                      GNUNET_YES));
+
+  /* Tell statistics actual vs. desired speed */
+  GNUNET_STATISTICS_set (statistics,
+                         "Current zone iteration velocity (μs/record)",
+                         delta.rel_value_us,
+                         GNUNET_NO);
+  /* update "sub_delta" based on difference, taking
+     previous sub_delta into account! */
+  if (target_iteration_velocity_per_record.rel_value_us > delta.rel_value_us)
+  {
+    /* We were too fast, reduce sub_delta! */
+    struct GNUNET_TIME_Relative corr;
+
+    corr = GNUNET_TIME_relative_subtract (target_iteration_velocity_per_record,
+                                          delta);
+    if (sub_delta.rel_value_us > delta.rel_value_us)
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Last record count was lower than current record count.  Reducing interval.\n");
-      put_interval = GNUNET_TIME_relative_divide (zone_publish_time_window,
-                                                  num_public_records);
-      next_put_interval = GNUNET_TIME_relative_divide (put_interval,
-                                                       LATE_ITERATION_SPEEDUP_FACTOR);
+      /* Reduce sub_delta by corr */
+      sub_delta = GNUNET_TIME_relative_subtract (sub_delta,
+                                                 corr);
     }
     else
-      next_put_interval = put_interval;
-    next_put_interval = GNUNET_TIME_relative_min (next_put_interval,
-                                                  MAXIMUM_ZONE_ITERATION_INTERVAL);
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "PUT complete, next PUT in %s!\n",
-                GNUNET_STRINGS_relative_time_to_string (next_put_interval,
-                                                        GNUNET_YES));
-
-    GNUNET_STATISTICS_set (statistics,
-                           "Current zone iteration interval (ms)",
-                           next_put_interval.rel_value_us / 1000LL,
-                           GNUNET_NO);
-    GNUNET_assert (NULL == zone_publish_task);
-    zone_publish_task = GNUNET_SCHEDULER_add_delayed (next_put_interval,
-                                                      &publish_zone_dht_next,
-                                                      NULL);
+    {
+      /* We're doing fine with waiting the full time, this
+         should theoretically only happen if we run at
+         infinite speed. */
+      sub_delta = GNUNET_TIME_UNIT_ZERO;
+    }
   }
-  else
+  else if (target_iteration_velocity_per_record.rel_value_us < delta.rel_value_us)
   {
-    GNUNET_CONTAINER_DLL_remove (ma_head,
-                                 ma_tail,
-                                 ma);
-    GNUNET_free (ma);
+    /* We were too slow, increase sub_delta! */
+    struct GNUNET_TIME_Relative corr;
+
+    corr = GNUNET_TIME_relative_subtract (delta,
+                                          target_iteration_velocity_per_record);
+    sub_delta = GNUNET_TIME_relative_add (sub_delta,
+                                          corr);
+    if (sub_delta.rel_value_us > target_iteration_velocity_per_record.rel_value_us)
+    {
+      /* CPU overload detected, we cannot go at desired speed,
+         as this would mean using a negative delay. */
+      /* compute how much faster we would want to be for
+         the desired velocity */
+      if (0 == target_iteration_velocity_per_record.rel_value_us)
+        pct = UINT64_MAX; /* desired speed is infinity ... */
+      else
+        pct = (sub_delta.rel_value_us -
+               target_iteration_velocity_per_record.rel_value_us) * 100LLU
+          / target_iteration_velocity_per_record.rel_value_us;
+      sub_delta = target_iteration_velocity_per_record;
+    }
   }
+  GNUNET_STATISTICS_set (statistics,
+                         "# size of the DHT queue (it)",
+                         dht_queue_length,
+                         GNUNET_NO);
+  GNUNET_STATISTICS_set (statistics,
+                         "# size of the DHT queue (mon)",
+                         ma_queue_length,
+                         GNUNET_NO);
+  GNUNET_STATISTICS_set (statistics,
+                         "% speed increase needed for target velocity",
+                         pct,
+                         GNUNET_NO);
+  GNUNET_STATISTICS_set (statistics,
+                         "# records processed in current iteration",
+                         num_public_records,
+                         GNUNET_NO);
+}
+
+
+/**
+ * Check if the current zone iteration needs to be continued
+ * by calling #publish_zone_namestore_next(), and if so with what delay.
+ */
+static void
+check_zone_namestore_next ()
+{
+  struct GNUNET_TIME_Relative delay;
+
+  if (0 != ns_iteration_left)
+    return; /* current NAMESTORE iteration not yet done */
+  update_velocity (put_cnt);
+  put_cnt = 0;
+  delay = GNUNET_TIME_relative_subtract (target_iteration_velocity_per_record,
+                                         sub_delta);
+  /* We delay *once* per #NS_BLOCK_SIZE, so we need to multiply the
+     per-record delay calculated so far with the #NS_BLOCK_SIZE */
+  GNUNET_STATISTICS_set (statistics,
+                         "Current artificial NAMESTORE delay (μs/record)",
+                         delay.rel_value_us,
+                         GNUNET_NO);
+  delay = GNUNET_TIME_relative_multiply (delay,
+                                         NS_BLOCK_SIZE);
+  GNUNET_assert (NULL == zone_publish_task);
+  zone_publish_task = GNUNET_SCHEDULER_add_delayed (delay,
+                                                    &publish_zone_namestore_next,
+                                                    NULL);
+}
+
+
+/**
+ * Continuation called from DHT once the PUT operation is done.
+ *
+ * @param cls a `struct DhtPutActivity`
+ */
+static void
+dht_put_continuation (void *cls)
+{
+  struct DhtPutActivity *ma = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "PUT complete\n");
+  dht_queue_length--;
+  GNUNET_CONTAINER_DLL_remove (it_head,
+                               it_tail,
+                               ma);
+  GNUNET_free (ma);
 }
 
 
@@ -336,11 +602,10 @@ convert_records_for_export (const struct GNUNET_GNSRECORD_Data *rd,
 {
   struct GNUNET_TIME_Absolute now;
   unsigned int rd_public_count;
-  unsigned int i;
 
   rd_public_count = 0;
   now = GNUNET_TIME_absolute_get ();
-  for (i=0;i<rd_count;i++)
+  for (unsigned int i=0;i<rd_count;i++)
     if (0 == (rd[i].flags & GNUNET_GNSRECORD_RF_PRIVATE))
     {
       rd_public[rd_public_count] = rd[i];
@@ -370,7 +635,8 @@ convert_records_for_export (const struct GNUNET_GNSRECORD_Data *rd,
  * @param label label to store under
  * @param rd_public public record data
  * @param rd_public_count number of records in @a rd_public
- * @param pc_arg closure argument to pass to the #dht_put_continuation
+ * @param cont function to call with PUT result
+ * @param cont_cls closure for @a cont
  * @return DHT PUT handle, NULL on error
  */
 static struct GNUNET_DHT_PutHandle *
@@ -378,7 +644,8 @@ perform_dht_put (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
                  const char *label,
                  const struct GNUNET_GNSRECORD_Data *rd_public,
                  unsigned int rd_public_count,
-                 void *pc_arg)
+                 GNUNET_SCHEDULER_TaskCallback cont,
+                 void *cont_cls)
 {
   struct GNUNET_GNSRECORD_Block *block;
   struct GNUNET_HashCode query;
@@ -388,25 +655,40 @@ perform_dht_put (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
 
   expire = GNUNET_GNSRECORD_record_get_expiration_time (rd_public_count,
                                                         rd_public);
-  block = GNUNET_GNSRECORD_block_create (key,
-                                         expire,
-                                         label,
-                                         rd_public,
-                                         rd_public_count);
+  if (cache_keys)
+    block = GNUNET_GNSRECORD_block_create2 (key,
+                                            expire,
+                                            label,
+                                            rd_public,
+                                            rd_public_count);
+  else
+    block = GNUNET_GNSRECORD_block_create (key,
+                                           expire,
+                                           label,
+                                           rd_public,
+                                           rd_public_count);
   if (NULL == block)
+  {
+    GNUNET_break (0);
     return NULL; /* whoops */
+  }
   block_size = ntohl (block->purpose.size)
     + sizeof (struct GNUNET_CRYPTO_EcdsaSignature)
     + sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey);
   GNUNET_GNSRECORD_query_from_private_key (key,
                                            label,
                                            &query);
+  GNUNET_STATISTICS_update (statistics,
+                            "DHT put operations initiated",
+                            1,
+                            GNUNET_NO);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Storing %u record(s) for label `%s' in DHT with expiration `%s' under key %s\n",
               rd_public_count,
               label,
               GNUNET_STRINGS_absolute_time_to_string (expire),
               GNUNET_h2s (&query));
+  num_public_records++;
   ret = GNUNET_DHT_put (dht_handle,
                         &query,
                         DHT_GNS_REPLICATION_LEVEL,
@@ -415,8 +697,8 @@ perform_dht_put (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
                         block_size,
                         block,
                         expire,
-                        &dht_put_continuation,
-                        pc_arg);
+                        cont,
+                        cont_cls);
   GNUNET_free (block);
   return ret;
 }
@@ -424,10 +706,13 @@ perform_dht_put (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
 
 /**
  * We encountered an error in our zone iteration.
+ *
+ * @param cls NULL
  */
 static void
 zone_iteration_error (void *cls)
 {
+  (void) cls;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Got disconnected from namestore database, retrying.\n");
   namestore_iter = NULL;
@@ -451,66 +736,47 @@ zone_iteration_error (void *cls)
 
 /**
  * Zone iteration is completed.
+ *
+ * @param cls NULL
  */
 static void
 zone_iteration_finished (void *cls)
 {
+  (void) cls;
   /* we're done with one iteration, calculate when to do the next one */
   namestore_iter = NULL;
   last_num_public_records = num_public_records;
   first_zone_iteration = GNUNET_NO;
-  if (0 == num_public_records)
-  {
-    /**
-     * If no records are known (startup) or none present
-     * we can safely set the interval to the value for a single
-     * record
-     */
-    put_interval = zone_publish_time_window;
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG | GNUNET_ERROR_TYPE_BULK,
-                "No records in namestore database.\n");
-  }
-  else
-  {
-    /* If records are present, next publication is based on the minimum
-     * relative expiration time of the records published divided by 4
-     */
-    zone_publish_time_window
-      = GNUNET_TIME_relative_min (GNUNET_TIME_relative_divide (min_relative_record_time, 4),
-                                  zone_publish_time_window_default);
-    put_interval = GNUNET_TIME_relative_divide (zone_publish_time_window,
-                                                num_public_records);
-  }
+  last_min_relative_record_time = min_relative_record_time;
+  calculate_put_interval ();
   /* reset for next iteration */
-  min_relative_record_time = GNUNET_TIME_UNIT_FOREVER_REL;
-  put_interval = GNUNET_TIME_relative_max (MINIMUM_ZONE_ITERATION_INTERVAL,
-                                           put_interval);
-  put_interval = GNUNET_TIME_relative_min (put_interval,
-                                           MAXIMUM_ZONE_ITERATION_INTERVAL);
+  min_relative_record_time
+    = GNUNET_TIME_relative_multiply (GNUNET_DHT_DEFAULT_REPUBLISH_FREQUENCY,
+                                     PUBLISH_OPS_PER_EXPIRATION);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Zone iteration finished. Adjusted zone iteration interval to %s\n",
-              GNUNET_STRINGS_relative_time_to_string (put_interval,
+              GNUNET_STRINGS_relative_time_to_string (target_iteration_velocity_per_record,
                                                       GNUNET_YES));
   GNUNET_STATISTICS_set (statistics,
-                         "Current zone iteration interval (in ms)",
-                         put_interval.rel_value_us / 1000LL,
+                         "Target zone iteration velocity (μs)",
+                         target_iteration_velocity_per_record.rel_value_us,
                          GNUNET_NO);
-  GNUNET_STATISTICS_update (statistics,
-                            "Number of zone iterations",
-                            1,
-                            GNUNET_NO);
   GNUNET_STATISTICS_set (statistics,
                          "Number of public records in DHT",
                          last_num_public_records,
                          GNUNET_NO);
   GNUNET_assert (NULL == zone_publish_task);
-  if (0 == num_public_records)
-    zone_publish_task = GNUNET_SCHEDULER_add_delayed (put_interval,
+  if (0 == last_num_public_records)
+  {
+    zone_publish_task = GNUNET_SCHEDULER_add_delayed (target_iteration_velocity_per_record,
                                                       &publish_zone_dht_start,
                                                       NULL);
+  }
   else
+  {
     zone_publish_task = GNUNET_SCHEDULER_add_now (&publish_zone_dht_start,
                                                   NULL);
+  }
 }
 
 
@@ -532,32 +798,59 @@ put_gns_record (void *cls,
 {
   struct GNUNET_GNSRECORD_Data rd_public[rd_count];
   unsigned int rd_public_count;
+  struct DhtPutActivity *ma;
 
+  (void) cls;
+  ns_iteration_left--;
   rd_public_count = convert_records_for_export (rd,
                                                 rd_count,
                                                 rd_public);
-
   if (0 == rd_public_count)
   {
-    GNUNET_assert (NULL == zone_publish_task);
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Record set empty, moving to next record set\n");
-    zone_publish_task = GNUNET_SCHEDULER_add_now (&publish_zone_dht_next,
-                                                  NULL);
+    check_zone_namestore_next ();
     return;
   }
   /* We got a set of records to publish */
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Starting DHT PUT\n");
-  active_put = perform_dht_put (key,
-                                label,
-                                rd_public,
-                                rd_public_count,
-                                NULL);
-  if (NULL == active_put)
+  ma = GNUNET_new (struct DhtPutActivity);
+  ma->start_date = GNUNET_TIME_absolute_get ();
+  ma->ph = perform_dht_put (key,
+                            label,
+                            rd_public,
+                            rd_public_count,
+                            &dht_put_continuation,
+                            ma);
+  put_cnt++;
+  if (0 == put_cnt % DELTA_INTERVAL)
+    update_velocity (DELTA_INTERVAL);
+  check_zone_namestore_next ();
+  if (NULL == ma->ph)
   {
-    GNUNET_break (0);
-    dht_put_continuation (NULL, GNUNET_NO);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Could not perform DHT PUT, is the DHT running?\n");
+    GNUNET_free (ma);
+    return;
+  }
+  dht_queue_length++;
+  GNUNET_CONTAINER_DLL_insert_tail (it_head,
+                                    it_tail,
+                                    ma);
+  if (dht_queue_length > DHT_QUEUE_LIMIT)
+  {
+    ma = it_head;
+    GNUNET_CONTAINER_DLL_remove (it_head,
+                                 it_tail,
+                                 ma);
+    GNUNET_DHT_put_cancel (ma->ph);
+    dht_queue_length--;
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "DHT PUT unconfirmed after %s, aborting PUT\n",
+                GNUNET_STRINGS_relative_time_to_string (GNUNET_TIME_absolute_get_duration (ma->start_date),
+                                                        GNUNET_YES));
+    GNUNET_free (ma);
   }
 }
 
@@ -570,13 +863,18 @@ put_gns_record (void *cls,
 static void
 publish_zone_dht_start (void *cls)
 {
+  (void) cls;
   zone_publish_task = NULL;
-
+  GNUNET_STATISTICS_update (statistics,
+                            "Full zone iterations launched",
+                            1,
+                            GNUNET_NO);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Starting DHT zone update!\n");
   /* start counting again */
   num_public_records = 0;
   GNUNET_assert (NULL == namestore_iter);
+  ns_iteration_left = 1;
   namestore_iter
     = GNUNET_NAMESTORE_zone_iteration_start (namestore_handle,
                                              NULL, /* All zones */
@@ -586,6 +884,7 @@ publish_zone_dht_start (void *cls)
                                              NULL,
                                              &zone_iteration_finished,
                                              NULL);
+  GNUNET_assert (NULL != namestore_iter);
 }
 
 
@@ -608,8 +907,13 @@ handle_monitor_event (void *cls,
 {
   struct GNUNET_GNSRECORD_Data rd_public[rd_count];
   unsigned int rd_public_count;
-  struct MonitorActivity *ma;
+  struct DhtPutActivity *ma;
 
+  (void) cls;
+  GNUNET_STATISTICS_update (statistics,
+                            "Namestore monitor events received",
+                            1,
+                            GNUNET_NO);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received %u records for label `%s' via namestore monitor\n",
               rd_count,
@@ -621,11 +925,14 @@ handle_monitor_event (void *cls,
                                                 rd_public);
   if (0 == rd_public_count)
     return; /* nothing to do */
-  ma = GNUNET_new (struct MonitorActivity);
+  num_public_records++;
+  ma = GNUNET_new (struct DhtPutActivity);
+  ma->start_date = GNUNET_TIME_absolute_get ();
   ma->ph = perform_dht_put (zone,
                             label,
                             rd,
                             rd_count,
+                            &dht_put_monitor_continuation,
                             ma);
   if (NULL == ma->ph)
   {
@@ -633,9 +940,24 @@ handle_monitor_event (void *cls,
     GNUNET_free (ma);
     return;
   }
-  GNUNET_CONTAINER_DLL_insert (ma_head,
-                               ma_tail,
-                               ma);
+  GNUNET_CONTAINER_DLL_insert_tail (ma_head,
+                                    ma_tail,
+                                    ma);
+  ma_queue_length++;
+  if (ma_queue_length > DHT_QUEUE_LIMIT)
+  {
+    ma = ma_head;
+    GNUNET_CONTAINER_DLL_remove (ma_head,
+                                 ma_tail,
+                                 ma);
+    GNUNET_DHT_put_cancel (ma->ph);
+    ma_queue_length--;
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "DHT PUT unconfirmed after %s, aborting PUT\n",
+                GNUNET_STRINGS_relative_time_to_string (GNUNET_TIME_absolute_get_duration (ma->start_date),
+                                                        GNUNET_YES));
+    GNUNET_free (ma);
+  }
 }
 
 
@@ -648,22 +970,28 @@ handle_monitor_event (void *cls,
 static void
 monitor_sync_event (void *cls)
 {
+  (void) cls;
   if ( (NULL == zone_publish_task) &&
        (NULL == namestore_iter) )
-  zone_publish_task = GNUNET_SCHEDULER_add_now (&publish_zone_dht_start,
-                                                NULL);
+    zone_publish_task = GNUNET_SCHEDULER_add_now (&publish_zone_dht_start,
+                                                  NULL);
 }
 
 
 /**
- * The zone monitor is now in SYNC with the current state of the
- * name store.  Start to perform periodic iterations.
+ * The zone monitor encountered an IPC error trying to to get in
+ * sync. Restart from the beginning.
  *
  * @param cls NULL
  */
 static void
 handle_monitor_error (void *cls)
 {
+  (void) cls;
+  GNUNET_STATISTICS_update (statistics,
+                            "Namestore monitor errors encountered",
+                            1,
+                            GNUNET_NO);
   if (NULL != zone_publish_task)
   {
     GNUNET_SCHEDULER_cancel (zone_publish_task);
@@ -698,7 +1026,13 @@ run (void *cls,
 {
   unsigned long long max_parallel_bg_queries = 128;
 
-  min_relative_record_time = GNUNET_TIME_UNIT_FOREVER_REL;
+  (void) cls;
+  (void) service;
+  last_put_100 = GNUNET_TIME_absolute_get (); /* first time! */
+  min_relative_record_time
+    = GNUNET_TIME_relative_multiply (GNUNET_DHT_DEFAULT_REPUBLISH_FREQUENCY,
+                                     PUBLISH_OPS_PER_EXPIRATION);
+  target_iteration_velocity_per_record = INITIAL_ZONE_ITERATION_INTERVAL;
   namestore_handle = GNUNET_NAMESTORE_connect (c);
   if (NULL == namestore_handle)
   {
@@ -707,8 +1041,9 @@ run (void *cls,
     GNUNET_SCHEDULER_shutdown ();
     return;
   }
-
-  put_interval = INITIAL_PUT_INTERVAL;
+  cache_keys = GNUNET_CONFIGURATION_get_value_yesno (c,
+                                                     "namestore",
+                                                     "CACHE_KEYS");
   zone_publish_time_window_default = DEFAULT_ZONE_PUBLISH_TIME_WINDOW;
   if (GNUNET_OK ==
       GNUNET_CONFIGURATION_get_value_time (c,
@@ -733,20 +1068,26 @@ run (void *cls,
                 max_parallel_bg_queries);
   }
   if (0 == max_parallel_bg_queries)
-    max_parallel_bg_queries = 1;          
+    max_parallel_bg_queries = 1;
   dht_handle = GNUNET_DHT_connect (c,
                                    (unsigned int) max_parallel_bg_queries);
   if (NULL == dht_handle)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 _("Could not connect to DHT!\n"));
-    GNUNET_SCHEDULER_add_now (&shutdown_task, NULL);
+    GNUNET_SCHEDULER_add_now (&shutdown_task,
+                              NULL);
     return;
   }
 
   /* Schedule periodic put for our records. */
-  first_zone_iteration = GNUNET_YES;\
-  statistics = GNUNET_STATISTICS_create ("zonemaster", c);
+  first_zone_iteration = GNUNET_YES;
+  statistics = GNUNET_STATISTICS_create ("zonemaster",
+                                         c);
+  GNUNET_STATISTICS_set (statistics,
+                         "Target zone iteration velocity (μs)",
+                         target_iteration_velocity_per_record.rel_value_us,
+                         GNUNET_NO);
   zmon = GNUNET_NAMESTORE_zone_monitor_start (c,
                                               NULL,
                                               GNUNET_NO,
@@ -757,7 +1098,8 @@ run (void *cls,
                                               &monitor_sync_event,
                                               NULL);
   GNUNET_break (NULL != zmon);
-  GNUNET_SCHEDULER_add_shutdown (&shutdown_task, NULL);
+  GNUNET_SCHEDULER_add_shutdown (&shutdown_task,
+                                 NULL);
 }