diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
index dab4a1ef80..25c992b312 100644
--- a/lib/dns/include/dns/types.h
+++ b/lib/dns/include/dns/types.h
@@ -73,9 +73,9 @@ enum {
 
 #include <dns/enumclass.h>
 enum {
-	ns_c_none = 0,
 	CLASSENUM
-	ns_c_any = 255
+	ns_c_none = 0,
+	/* ns_c_any = 255  TSIG is class ANY specific */
 } ns_class_t;
 
 #endif /* DNS_TYPES_H */
diff --git a/lib/dns/rdata/any_255/tsig_250.c b/lib/dns/rdata/any_255/tsig_250.c
new file mode 100644
index 0000000000..7082edd8de
--- /dev/null
+++ b/lib/dns/rdata/any_255/tsig_250.c
@@ -0,0 +1,288 @@
+/*
+ * Copyright (C) 1999 Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+ /* $Id: tsig_250.c,v 1.1 1999/02/04 01:06:40 marka Exp $ */
+
+ /* draft-ietf-dnsind-tsig-07.txt */
+
+#ifndef RDATA_ANY_255_TSIG_250_H
+#define RDATA_ANY_255_TSIG_250_H
+
+static dns_result_t
+fromtext_any_tsig(dns_rdataclass_t class, dns_rdatatype_t type,
+		  isc_lex_t *lexer, dns_name_t *origin,
+		  isc_boolean_t downcase, isc_buffer_t *target)
+{
+	isc_token_t token;
+	dns_name_t name;
+	unsigned long long sigtime;
+	isc_buffer_t buffer;
+	char *e;
+
+	REQUIRE(type == 250);
+	REQUIRE(class == 255);
+
+	/* Algorithm Name */
+	RETERR(gettoken(lexer, &token, isc_tokentype_string, ISC_FALSE));
+	dns_name_init(&name, NULL);
+	buffer_fromregion(&buffer, &token.value.as_region,
+			  ISC_BUFFERTYPE_TEXT);
+	origin = (origin != NULL) ? origin : dns_rootname;
+	RETERR(dns_name_fromtext(&name, &buffer, origin, downcase, target));
+
+	/* Time Signed: 48 bits */
+	RETERR(gettoken(lexer, &token, isc_tokentype_string, ISC_FALSE));
+	sigtime = strtouq(token.value.as_pointer, &e, 10);
+	if (*e != 0)
+		return (DNS_R_SYNTAX);
+	if ((sigtime >> 48) != 0)
+		return(DNS_R_RANGE);
+	RETERR(uint16_tobuffer(sigtime >> 32, target));
+	RETERR(uint32_tobuffer(sigtime & 0xffffffff, target));
+
+	/* Fudge */
+	RETERR(gettoken(lexer, &token, isc_tokentype_number, ISC_FALSE));
+	if (token.value.as_ulong > 0xffff)
+		return (DNS_R_RANGE);
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/* Signature Size */
+	RETERR(gettoken(lexer, &token, isc_tokentype_number, ISC_FALSE));
+	if (token.value.as_ulong > 0xffff)
+		return (DNS_R_RANGE);
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/* Signature */
+	RETERR(base64_tobuffer(lexer, target, token.value.as_ulong));
+
+	/* Original ID */
+	RETERR(gettoken(lexer, &token, isc_tokentype_number, ISC_FALSE));
+	if (token.value.as_ulong > 0xffff)
+		return (DNS_R_RANGE);
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/* Error */
+	RETERR(gettoken(lexer, &token, isc_tokentype_number, ISC_FALSE));
+	if (token.value.as_ulong > 0xffff)
+		return (DNS_R_RANGE);
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/* Other Len */
+	RETERR(gettoken(lexer, &token, isc_tokentype_number, ISC_FALSE));
+	if (token.value.as_ulong > 0xffff)
+		return (DNS_R_RANGE);
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/* Other Data */
+	return (base64_tobuffer(lexer, target, token.value.as_ulong));
+}
+
+static dns_result_t
+totext_any_tsig(dns_rdata_t *rdata, dns_name_t *origin, isc_buffer_t *target) {
+	isc_region_t sr;
+	isc_region_t sigr;
+	char buf[sizeof "281474976710655 "];	
+	dns_name_t name;
+	dns_name_t prefix;
+	isc_boolean_t sub;
+	unsigned long long sigtime;
+	unsigned short n;
+
+	REQUIRE(rdata->type == 250);
+	REQUIRE(rdata->class == 255);
+
+	dns_rdata_toregion(rdata, &sr);
+	/* Algorithm Name */
+	dns_name_init(&name, NULL);
+	dns_name_init(&prefix, NULL);
+	dns_name_fromregion(&name, &sr);
+	sub = name_prefix(&name, origin, &prefix);
+	RETERR(dns_name_totext(&prefix, sub, target));
+	RETERR(str_totext(" ", target));
+	isc_region_consume(&sr, name_length(&name));
+
+	/* Time Signed */
+	sigtime = ((unsigned long long)sr.base[0] << 40) |
+		  ((unsigned long long)sr.base[1] << 32) |
+		  (sr.base[2] << 24) | (sr.base[3] << 16) |
+		  (sr.base[4] << 8) | sr.base[5];
+	isc_region_consume(&sr, 6);
+	sprintf(buf, "%qu ", sigtime);
+	RETERR(str_totext(buf, target));
+
+	/* Fudge */
+	n = uint16_fromregion(&sr);
+	isc_region_consume(&sr, 2);
+	sprintf(buf, "%u ", n);
+	RETERR(str_totext(buf, target));
+
+	/* Signature Size */
+	n = uint16_fromregion(&sr);
+	isc_region_consume(&sr, 2);
+	sprintf(buf, "%u ", n);
+	RETERR(str_totext(buf, target));
+
+	/* Signature */
+	REQUIRE(n <= sr.length);
+	sigr = sr;
+	sigr.length = n;
+	RETERR(base64_totext(&sigr, target));
+	RETERR(str_totext(" ", target));
+	isc_region_consume(&sr, n);
+
+	/* Original ID */
+	n = uint16_fromregion(&sr);
+	isc_region_consume(&sr, 2);
+	sprintf(buf, "%u ", n);
+	RETERR(str_totext(buf, target));
+
+	/* Error */
+	n = uint16_fromregion(&sr);
+	isc_region_consume(&sr, 2);
+	sprintf(buf, "%u ", n);
+	RETERR(str_totext(buf, target));
+
+	/* Other Size */
+	n = uint16_fromregion(&sr);
+	isc_region_consume(&sr, 2);
+	sprintf(buf, "%u ", n);
+	RETERR(str_totext(buf, target));
+
+	/* Other */
+	return (base64_totext(&sr, target));
+}
+
+static dns_result_t
+fromwire_any_tsig(dns_rdataclass_t class, dns_rdatatype_t type,
+		  isc_buffer_t *source, dns_decompress_t *dctx,
+		  isc_boolean_t downcase, isc_buffer_t *target)
+{
+	isc_region_t sr;
+	dns_name_t name;
+	unsigned long n;
+
+	REQUIRE(type == 250);
+	REQUIRE(class == 255);
+	
+	/* Algorithm Name */
+	dns_name_init(&name, NULL);
+	RETERR(dns_name_fromwire(&name, source, dctx, downcase, target));
+
+	isc_buffer_active(source, &sr);
+	/* Time Signed + Fudge */
+	if (sr.length < 8)
+		return (DNS_R_UNEXPECTEDEND);
+	RETERR(mem_tobuffer(target, sr.base, 8));
+	isc_region_consume(&sr, 8);
+	isc_buffer_forward(source, 8);
+
+	/* Signature Length + Signature */
+	if (sr.length < 2)
+		return (DNS_R_UNEXPECTEDEND);
+	n = uint16_fromregion(&sr);
+	if (sr.length < n + 2)
+		return (DNS_R_UNEXPECTEDEND);
+	RETERR(mem_tobuffer(target, sr.base, n + 2));
+	isc_region_consume(&sr, n + 2);
+	isc_buffer_forward(source, n + 2);
+
+	/* Original ID + Error */
+	if (sr.length < 4)
+		return (DNS_R_UNEXPECTEDEND);
+	RETERR(mem_tobuffer(target, sr.base,  4));
+	isc_region_consume(&sr, 4);
+	isc_buffer_forward(source, 4);
+
+	/* Other Length + Other */
+	if (sr.length < 2)
+		return (DNS_R_UNEXPECTEDEND);
+	n = uint16_fromregion(&sr);
+	if (sr.length < n + 2)
+		return (DNS_R_UNEXPECTEDEND);
+	isc_buffer_forward(source, n + 2);
+	return (mem_tobuffer(target, sr.base, n + 2));
+}
+
+static dns_result_t
+towire_any_tsig(dns_rdata_t *rdata, dns_compress_t *cctx, isc_buffer_t *target) {
+	isc_region_t sr;
+	dns_name_t name;
+
+	REQUIRE(rdata->type == 250);
+	REQUIRE(rdata->class == 255);
+
+	cctx = cctx;	/*unused*/
+
+	dns_rdata_toregion(rdata, &sr);
+	dns_name_init(&name, NULL);
+	dns_name_fromregion(&name, &sr);
+	RETERR(dns_name_towire(&name, cctx, target));
+	isc_region_consume(&sr, name_length(&name));
+	return (mem_tobuffer(target, sr.base, sr.length));
+}
+
+static int
+compare_any_tsig(dns_rdata_t *rdata1, dns_rdata_t *rdata2) {
+	isc_region_t r1;
+	isc_region_t r2;
+	dns_name_t name1;
+	dns_name_t name2;
+	int result;
+
+	REQUIRE(rdata1->type == rdata2->type);
+	REQUIRE(rdata1->class == rdata2->class);
+	REQUIRE(rdata1->type == 250);
+	REQUIRE(rdata1->class == 255);
+	
+	dns_rdata_toregion(rdata1, &r1);
+	dns_rdata_toregion(rdata2, &r2);
+	dns_name_init(&name1, NULL);
+	dns_name_init(&name2, NULL);
+	dns_name_fromregion(&name1, &r1);
+	dns_name_fromregion(&name2, &r2);
+	result = dns_name_compare(&name1, &name2);
+	if (result != 0)
+		return (result);
+	isc_region_consume(&r1, name_length(&name1));
+	isc_region_consume(&r2, name_length(&name2));
+	return (compare_region(&r1, &r2));
+}
+
+static dns_result_t
+fromstruct_any_tsig(dns_rdataclass_t class, dns_rdatatype_t type,
+		    void *source, isc_buffer_t *target) {
+
+	REQUIRE(type == 250);
+	REQUIRE(class == 255);
+	
+	source = source;
+	target = target;
+
+	return (DNS_R_NOTIMPLEMENTED);
+}
+
+static dns_result_t
+tostruct_any_tsig(dns_rdata_t *rdata, void *target) {
+
+	REQUIRE(rdata->type == 250);
+	REQUIRE(rdata->class == 255);
+	
+	target = target;
+
+	return (DNS_R_NOTIMPLEMENTED);
+}
+#endif	/* RDATA_ANY_255_TSIG_250_H */
diff --git a/lib/dns/rdata/any_255/tsig_250.h b/lib/dns/rdata/any_255/tsig_250.h
new file mode 100644
index 0000000000..2e5e3484ad
--- /dev/null
+++ b/lib/dns/rdata/any_255/tsig_250.h
@@ -0,0 +1,288 @@
+/*
+ * Copyright (C) 1999 Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+ /* $Id: tsig_250.h,v 1.1 1999/02/04 01:06:40 marka Exp $ */
+
+ /* draft-ietf-dnsind-tsig-07.txt */
+
+#ifndef RDATA_ANY_255_TSIG_250_H
+#define RDATA_ANY_255_TSIG_250_H
+
+static dns_result_t
+fromtext_any_tsig(dns_rdataclass_t class, dns_rdatatype_t type,
+		  isc_lex_t *lexer, dns_name_t *origin,
+		  isc_boolean_t downcase, isc_buffer_t *target)
+{
+	isc_token_t token;
+	dns_name_t name;
+	unsigned long long sigtime;
+	isc_buffer_t buffer;
+	char *e;
+
+	REQUIRE(type == 250);
+	REQUIRE(class == 255);
+
+	/* Algorithm Name */
+	RETERR(gettoken(lexer, &token, isc_tokentype_string, ISC_FALSE));
+	dns_name_init(&name, NULL);
+	buffer_fromregion(&buffer, &token.value.as_region,
+			  ISC_BUFFERTYPE_TEXT);
+	origin = (origin != NULL) ? origin : dns_rootname;
+	RETERR(dns_name_fromtext(&name, &buffer, origin, downcase, target));
+
+	/* Time Signed: 48 bits */
+	RETERR(gettoken(lexer, &token, isc_tokentype_string, ISC_FALSE));
+	sigtime = strtouq(token.value.as_pointer, &e, 10);
+	if (*e != 0)
+		return (DNS_R_SYNTAX);
+	if ((sigtime >> 48) != 0)
+		return(DNS_R_RANGE);
+	RETERR(uint16_tobuffer(sigtime >> 32, target));
+	RETERR(uint32_tobuffer(sigtime & 0xffffffff, target));
+
+	/* Fudge */
+	RETERR(gettoken(lexer, &token, isc_tokentype_number, ISC_FALSE));
+	if (token.value.as_ulong > 0xffff)
+		return (DNS_R_RANGE);
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/* Signature Size */
+	RETERR(gettoken(lexer, &token, isc_tokentype_number, ISC_FALSE));
+	if (token.value.as_ulong > 0xffff)
+		return (DNS_R_RANGE);
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/* Signature */
+	RETERR(base64_tobuffer(lexer, target, token.value.as_ulong));
+
+	/* Original ID */
+	RETERR(gettoken(lexer, &token, isc_tokentype_number, ISC_FALSE));
+	if (token.value.as_ulong > 0xffff)
+		return (DNS_R_RANGE);
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/* Error */
+	RETERR(gettoken(lexer, &token, isc_tokentype_number, ISC_FALSE));
+	if (token.value.as_ulong > 0xffff)
+		return (DNS_R_RANGE);
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/* Other Len */
+	RETERR(gettoken(lexer, &token, isc_tokentype_number, ISC_FALSE));
+	if (token.value.as_ulong > 0xffff)
+		return (DNS_R_RANGE);
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/* Other Data */
+	return (base64_tobuffer(lexer, target, token.value.as_ulong));
+}
+
+static dns_result_t
+totext_any_tsig(dns_rdata_t *rdata, dns_name_t *origin, isc_buffer_t *target) {
+	isc_region_t sr;
+	isc_region_t sigr;
+	char buf[sizeof "281474976710655 "];	
+	dns_name_t name;
+	dns_name_t prefix;
+	isc_boolean_t sub;
+	unsigned long long sigtime;
+	unsigned short n;
+
+	REQUIRE(rdata->type == 250);
+	REQUIRE(rdata->class == 255);
+
+	dns_rdata_toregion(rdata, &sr);
+	/* Algorithm Name */
+	dns_name_init(&name, NULL);
+	dns_name_init(&prefix, NULL);
+	dns_name_fromregion(&name, &sr);
+	sub = name_prefix(&name, origin, &prefix);
+	RETERR(dns_name_totext(&prefix, sub, target));
+	RETERR(str_totext(" ", target));
+	isc_region_consume(&sr, name_length(&name));
+
+	/* Time Signed */
+	sigtime = ((unsigned long long)sr.base[0] << 40) |
+		  ((unsigned long long)sr.base[1] << 32) |
+		  (sr.base[2] << 24) | (sr.base[3] << 16) |
+		  (sr.base[4] << 8) | sr.base[5];
+	isc_region_consume(&sr, 6);
+	sprintf(buf, "%qu ", sigtime);
+	RETERR(str_totext(buf, target));
+
+	/* Fudge */
+	n = uint16_fromregion(&sr);
+	isc_region_consume(&sr, 2);
+	sprintf(buf, "%u ", n);
+	RETERR(str_totext(buf, target));
+
+	/* Signature Size */
+	n = uint16_fromregion(&sr);
+	isc_region_consume(&sr, 2);
+	sprintf(buf, "%u ", n);
+	RETERR(str_totext(buf, target));
+
+	/* Signature */
+	REQUIRE(n <= sr.length);
+	sigr = sr;
+	sigr.length = n;
+	RETERR(base64_totext(&sigr, target));
+	RETERR(str_totext(" ", target));
+	isc_region_consume(&sr, n);
+
+	/* Original ID */
+	n = uint16_fromregion(&sr);
+	isc_region_consume(&sr, 2);
+	sprintf(buf, "%u ", n);
+	RETERR(str_totext(buf, target));
+
+	/* Error */
+	n = uint16_fromregion(&sr);
+	isc_region_consume(&sr, 2);
+	sprintf(buf, "%u ", n);
+	RETERR(str_totext(buf, target));
+
+	/* Other Size */
+	n = uint16_fromregion(&sr);
+	isc_region_consume(&sr, 2);
+	sprintf(buf, "%u ", n);
+	RETERR(str_totext(buf, target));
+
+	/* Other */
+	return (base64_totext(&sr, target));
+}
+
+static dns_result_t
+fromwire_any_tsig(dns_rdataclass_t class, dns_rdatatype_t type,
+		  isc_buffer_t *source, dns_decompress_t *dctx,
+		  isc_boolean_t downcase, isc_buffer_t *target)
+{
+	isc_region_t sr;
+	dns_name_t name;
+	unsigned long n;
+
+	REQUIRE(type == 250);
+	REQUIRE(class == 255);
+	
+	/* Algorithm Name */
+	dns_name_init(&name, NULL);
+	RETERR(dns_name_fromwire(&name, source, dctx, downcase, target));
+
+	isc_buffer_active(source, &sr);
+	/* Time Signed + Fudge */
+	if (sr.length < 8)
+		return (DNS_R_UNEXPECTEDEND);
+	RETERR(mem_tobuffer(target, sr.base, 8));
+	isc_region_consume(&sr, 8);
+	isc_buffer_forward(source, 8);
+
+	/* Signature Length + Signature */
+	if (sr.length < 2)
+		return (DNS_R_UNEXPECTEDEND);
+	n = uint16_fromregion(&sr);
+	if (sr.length < n + 2)
+		return (DNS_R_UNEXPECTEDEND);
+	RETERR(mem_tobuffer(target, sr.base, n + 2));
+	isc_region_consume(&sr, n + 2);
+	isc_buffer_forward(source, n + 2);
+
+	/* Original ID + Error */
+	if (sr.length < 4)
+		return (DNS_R_UNEXPECTEDEND);
+	RETERR(mem_tobuffer(target, sr.base,  4));
+	isc_region_consume(&sr, 4);
+	isc_buffer_forward(source, 4);
+
+	/* Other Length + Other */
+	if (sr.length < 2)
+		return (DNS_R_UNEXPECTEDEND);
+	n = uint16_fromregion(&sr);
+	if (sr.length < n + 2)
+		return (DNS_R_UNEXPECTEDEND);
+	isc_buffer_forward(source, n + 2);
+	return (mem_tobuffer(target, sr.base, n + 2));
+}
+
+static dns_result_t
+towire_any_tsig(dns_rdata_t *rdata, dns_compress_t *cctx, isc_buffer_t *target) {
+	isc_region_t sr;
+	dns_name_t name;
+
+	REQUIRE(rdata->type == 250);
+	REQUIRE(rdata->class == 255);
+
+	cctx = cctx;	/*unused*/
+
+	dns_rdata_toregion(rdata, &sr);
+	dns_name_init(&name, NULL);
+	dns_name_fromregion(&name, &sr);
+	RETERR(dns_name_towire(&name, cctx, target));
+	isc_region_consume(&sr, name_length(&name));
+	return (mem_tobuffer(target, sr.base, sr.length));
+}
+
+static int
+compare_any_tsig(dns_rdata_t *rdata1, dns_rdata_t *rdata2) {
+	isc_region_t r1;
+	isc_region_t r2;
+	dns_name_t name1;
+	dns_name_t name2;
+	int result;
+
+	REQUIRE(rdata1->type == rdata2->type);
+	REQUIRE(rdata1->class == rdata2->class);
+	REQUIRE(rdata1->type == 250);
+	REQUIRE(rdata1->class == 255);
+	
+	dns_rdata_toregion(rdata1, &r1);
+	dns_rdata_toregion(rdata2, &r2);
+	dns_name_init(&name1, NULL);
+	dns_name_init(&name2, NULL);
+	dns_name_fromregion(&name1, &r1);
+	dns_name_fromregion(&name2, &r2);
+	result = dns_name_compare(&name1, &name2);
+	if (result != 0)
+		return (result);
+	isc_region_consume(&r1, name_length(&name1));
+	isc_region_consume(&r2, name_length(&name2));
+	return (compare_region(&r1, &r2));
+}
+
+static dns_result_t
+fromstruct_any_tsig(dns_rdataclass_t class, dns_rdatatype_t type,
+		    void *source, isc_buffer_t *target) {
+
+	REQUIRE(type == 250);
+	REQUIRE(class == 255);
+	
+	source = source;
+	target = target;
+
+	return (DNS_R_NOTIMPLEMENTED);
+}
+
+static dns_result_t
+tostruct_any_tsig(dns_rdata_t *rdata, void *target) {
+
+	REQUIRE(rdata->type == 250);
+	REQUIRE(rdata->class == 255);
+	
+	target = target;
+
+	return (DNS_R_NOTIMPLEMENTED);
+}
+#endif	/* RDATA_ANY_255_TSIG_250_H */