diff --git a/CHANGES b/CHANGES
index f3e4755916..89949d21e9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+ 525.	[func]		New arguement 'exact' for dns_db_subtractrdataset(),
+			and dns_rdataslab_subtract() requesting that the RR's
+			must exist prior to deletion.  DNS_R_NOTEXACT is
+			returned if the condition is not met.
 
  524.	[func]		The 'forward' and 'forwarders' statement in
 			non-forward zones should work now.
diff --git a/lib/dns/db.c b/lib/dns/db.c
index 93191231c6..c22243601b 100644
--- a/lib/dns/db.c
+++ b/lib/dns/db.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: db.c,v 1.57 2000/10/17 07:22:29 marka Exp $ */
+/* $Id: db.c,v 1.58 2000/10/18 23:53:21 marka Exp $ */
 
 /***
  *** Imports
@@ -589,7 +589,7 @@ dns_db_addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 isc_result_t
 dns_db_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
 			dns_dbversion_t *version, dns_rdataset_t *rdataset,
-			dns_rdataset_t *newrdataset)
+			isc_boolean_t exact, dns_rdataset_t *newrdataset)
 {
 	/*
 	 * Remove any rdata in 'rdataset' from 'node' in version 'version' of
@@ -607,7 +607,7 @@ dns_db_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
 		 ! dns_rdataset_isassociated(newrdataset)));
 
 	return ((db->methods->subtractrdataset)(db, node, version, rdataset,
-						newrdataset));
+						exact, newrdataset));
 }
 
 isc_result_t
diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
index 79dfd1da0a..b9d39e40c1 100644
--- a/lib/dns/include/dns/db.h
+++ b/lib/dns/include/dns/db.h
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: db.h,v 1.58 2000/08/31 13:00:57 marka Exp $ */
+/* $Id: db.h,v 1.59 2000/10/18 23:53:29 marka Exp $ */
 
 #ifndef DNS_DB_H
 #define DNS_DB_H 1
@@ -134,6 +134,7 @@ typedef struct dns_dbmethods {
 	isc_result_t	(*subtractrdataset)(dns_db_t *db, dns_dbnode_t *node,
 					    dns_dbversion_t *version,
 					    dns_rdataset_t *rdataset,
+					    isc_boolean_t exact,
 					    dns_rdataset_t *newrdataset);
 	isc_result_t	(*deleterdataset)(dns_db_t *db, dns_dbnode_t *node,
 					  dns_dbversion_t *version,
@@ -1047,7 +1048,7 @@ dns_db_addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 isc_result_t
 dns_db_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
 			dns_dbversion_t *version, dns_rdataset_t *rdataset,
-			dns_rdataset_t *newrdataset);
+			isc_boolean_t exact, dns_rdataset_t *newrdataset);
 /*
  * Remove any rdata in 'rdataset' from 'node' in version 'version' of
  * 'db'.
@@ -1067,6 +1068,9 @@ dns_db_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
  *	'rdataset' is a valid, associated rdataset with the same class
  *	as 'db'.
  *
+ *	'exact' if ISC_TRUE then all rdata in 'rdataset' must exist
+ *	at 'node'.
+ *
  *	'newrdataset' is NULL, or a valid, unassociated rdataset.
  *
  *	The database has zone semantics and 'version' is a valid
@@ -1078,6 +1082,8 @@ dns_db_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
  *	DNS_R_UNCHANGED			The operation did not change anything.
  *	DNS_R_NXRRSET			All rdata of the same type as those
  *					in 'rdataset' have been deleted.
+ *	DNS_R_NOTEXACT			Some part of 'rdataset' did not
+ *					exist and 'exact' was ISC_TRUE.
  *
  *	Other results are possible, depending upon the database
  *	implementation used.
diff --git a/lib/dns/include/dns/rdataslab.h b/lib/dns/include/dns/rdataslab.h
index c3a49a4fa5..2a5683d54e 100644
--- a/lib/dns/include/dns/rdataslab.h
+++ b/lib/dns/include/dns/rdataslab.h
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdataslab.h,v 1.15 2000/09/01 01:35:21 bwelling Exp $ */
+/* $Id: rdataslab.h,v 1.16 2000/10/18 23:53:30 marka Exp $ */
 
 #ifndef DNS_RDATASLAB_H
 #define DNS_RDATASLAB_H 1
@@ -107,9 +107,10 @@ isc_result_t
 dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 		       unsigned int reservelen, isc_mem_t *mctx,
 		       dns_rdataclass_t rdclass, dns_rdatatype_t type,
-		       unsigned char **tslabp);
+		       isc_boolean_t exact, unsigned char **tslabp);
 /*
- * Subtract 'sslab' from 'mslab'.
+ * Subtract 'sslab' from 'mslab'.  If 'exact' is true then all elements
+ * of 'sslab' must exist in 'mslab'.
  *
  * XXX
  */
diff --git a/lib/dns/include/dns/result.h b/lib/dns/include/dns/result.h
index 453179eb95..2165278a17 100644
--- a/lib/dns/include/dns/result.h
+++ b/lib/dns/include/dns/result.h
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: result.h,v 1.69 2000/10/17 07:22:38 marka Exp $ */
+/* $Id: result.h,v 1.70 2000/10/18 23:53:31 marka Exp $ */
 
 #ifndef DNS_RESULT_H
 #define DNS_RESULT_H 1
@@ -71,7 +71,7 @@
 #define DNS_R_CNAME			(ISC_RESULTCLASS_DNS + 32)
 #define DNS_R_BADDB			(ISC_RESULTCLASS_DNS + 33)
 #define DNS_R_ZONECUT			(ISC_RESULTCLASS_DNS + 34)
-#define DNS_R_BADZONE			(ISC_RESULTCLASS_DNS + 35) /* XXX MPA*/
+#define DNS_R_BADZONE			(ISC_RESULTCLASS_DNS + 35)
 #define DNS_R_MOREDATA			(ISC_RESULTCLASS_DNS + 36)
 #define DNS_R_UPTODATE			(ISC_RESULTCLASS_DNS + 37)
 #define DNS_R_TSIGVERIFYFAILURE		(ISC_RESULTCLASS_DNS + 38)
@@ -103,8 +103,9 @@
 #define DNS_R_UNKNOWNOPT		(ISC_RESULTCLASS_DNS + 64)
 #define DNS_R_UNEXPECTEDID		(ISC_RESULTCLASS_DNS + 65)
 #define DNS_R_SEENINCLUDE		(ISC_RESULTCLASS_DNS + 66)
+#define DNS_R_NOTEXACT			(ISC_RESULTCLASS_DNS + 67)
 
-#define DNS_R_NRESULTS			67	/* Number of results */
+#define DNS_R_NRESULTS			68	/* Number of results */
 
 /*
  * DNS wire format rcodes.
diff --git a/lib/dns/journal.c b/lib/dns/journal.c
index 58a92a6694..d4be8e8c21 100644
--- a/lib/dns/journal.c
+++ b/lib/dns/journal.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: journal.c,v 1.57 2000/08/01 01:22:25 tale Exp $ */
+/* $Id: journal.c,v 1.58 2000/10/18 23:53:22 marka Exp $ */
 
 #include <config.h>
 
@@ -402,6 +402,7 @@ dns_diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver)
 			} else if (op == DNS_DIFFOP_DEL) {
 				result = dns_db_subtractrdataset(db, node, ver,
 								 &rds,
+								 ISC_TRUE,
 								 NULL);
 			} else {
 				INSIST(0);
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index c85214c493..3e534b3857 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbtdb.c,v 1.127 2000/10/13 18:55:10 halley Exp $ */
+/* $Id: rbtdb.c,v 1.128 2000/10/18 23:53:23 marka Exp $ */
 
 /*
  * Principal Author: Bob Halley
@@ -3397,7 +3397,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 
 static isc_result_t
 subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		 dns_rdataset_t *rdataset, dns_rdataset_t *newrdataset)
+		 dns_rdataset_t *rdataset, isc_boolean_t exact,
+		 dns_rdataset_t *newrdataset)
 {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
 	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
@@ -3456,7 +3457,7 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 					rbtdb->common.mctx,
 					rbtdb->common.rdclass,
 					(dns_rdatatype_t)header->type,
-					&subresult);
+					exact, &subresult);
 		if (result == ISC_R_SUCCESS) {
 			free_rdataset(rbtdb->common.mctx, newheader);
 			newheader = (rdatasetheader_t *)subresult;
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
index 68e6359bac..903412a891 100644
--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdataslab.c,v 1.20 2000/09/23 01:05:03 bwelling Exp $ */
+/* $Id: rdataslab.c,v 1.21 2000/10/18 23:53:24 marka Exp $ */
 
 #include <config.h>
 
@@ -363,12 +363,11 @@ isc_result_t
 dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 		       unsigned int reservelen, isc_mem_t *mctx,
 		       dns_rdataclass_t rdclass, dns_rdatatype_t type,
-		       unsigned char **tslabp)
+		       isc_boolean_t exact, unsigned char **tslabp)
 {
 	unsigned char *mcurrent, *sstart, *scurrent, *tstart, *tcurrent;
-	unsigned int mcount, scount, count, tlength, tcount;
+	unsigned int mcount, scount, rcount ,count, tlength, tcount;
 	dns_rdata_t srdata, mrdata;
-	isc_boolean_t removed_something = ISC_FALSE;
 
 	REQUIRE(tslabp != NULL && *tslabp == NULL);
 	REQUIRE(mslab != NULL && sslab != NULL);
@@ -391,6 +390,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 	 */
 	tlength = reservelen + 2;
 	tcount = 0;
+	rcount = 0;
 
 	/*
 	 * Add in the length of rdata in the mslab that aren't in
@@ -413,10 +413,17 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 			tlength += mcurrent - mrdatabegin;
 			tcount++;
 		} else
-			removed_something = ISC_TRUE;
+			rcount++;
 		mcount--;
 	} while (mcount > 0);
 
+	/*
+	 * Check that all the records originally existed.  The numeric
+ 	 * check only works as rdataslabs do not contain duplicates.
+	 */
+	if (exact && (rcount != scount))
+		return (DNS_R_NOTEXACT);
+
 	/*
 	 * Don't continue if the new rdataslab would be empty.
 	 */
@@ -426,7 +433,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 	/*
 	 * If nothing is going to change, we can stop.
 	 */
-	if (!removed_something)
+	if (rcount == 0)
 		return (DNS_R_UNCHANGED);
 
 	/*
diff --git a/lib/dns/result.c b/lib/dns/result.c
index 94a3c14e4c..46d974070d 100644
--- a/lib/dns/result.c
+++ b/lib/dns/result.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: result.c,v 1.75 2000/10/17 07:22:31 marka Exp $ */
+/* $Id: result.c,v 1.76 2000/10/18 23:53:26 marka Exp $ */
 
 #include <config.h>
 
@@ -105,7 +105,8 @@ static const char *text[DNS_R_NRESULTS] = {
 	"unknown opt attribute record",	       /* 64 DNS_R_UNKNOWNOPT        */
 
 	"unexpected message id",	       /* 65 DNS_R_UNEXPECTEDID      */
-	"seen include file"		       /* 66 DNS_R_SEENINCLUDE       */
+	"seen include file",		       /* 66 DNS_R_SEENINCLUDE       */
+	"not exact"		       	       /* 67 DNS_R_NOTEXACT	     */
 };
 
 static const char *rcode_text[DNS_R_NRCODERESULTS] = {
diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
index 390f17fafd..b11b097d8e 100644
--- a/lib/dns/sdb.c
+++ b/lib/dns/sdb.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sdb.c,v 1.11 2000/10/06 21:20:59 bwelling Exp $ */
+/* $Id: sdb.c,v 1.12 2000/10/18 23:53:27 marka Exp $ */
 
 /* NOMINUM_PUBLIC_DELETE */
 
@@ -1031,12 +1031,14 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 
 static isc_result_t
 subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		 dns_rdataset_t *rdataset, dns_rdataset_t *newrdataset)
+		 dns_rdataset_t *rdataset, isc_boolean_t exact,
+		 dns_rdataset_t *newrdataset)
 {
 	UNUSED(db);
 	UNUSED(node);
 	UNUSED(version);
 	UNUSED(rdataset);
+	UNUSED(exact);
 	UNUSED(newrdataset);
 
 	return (ISC_R_NOTIMPLEMENTED);