diff --git a/.gitignore b/.gitignore
index 7ff5f5f..20396a6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -115,3 +115,5 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.6.tar.xz.asc
 /bind-9.16.7.tar.xz
 /bind-9.16.7.tar.xz.asc
+/bind-9.16.8.tar.xz
+/bind-9.16.8.tar.xz.asc
diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index 0dfc74c..48ff40b 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -130,7 +130,7 @@ index ace0e5a..e0f6a00 100644
  	dnssec-importkey.@O@ ${OBJS} ${LIBS}
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index ed9add2..90bcec7 100644
+index 525f505..d517ec6 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
 @@ -37,13 +37,14 @@ DBDRIVER_LIBS =
@@ -153,7 +153,7 @@ index ed9add2..90bcec7 100644
  		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
  		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
  		${DBDRIVER_INCLUDES} \
-@@ -54,24 +55,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+@@ -55,24 +56,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
  		${LIBXML2_CFLAGS} \
  		${MAXMINDDB_CFLAGS}
  
@@ -183,7 +183,7 @@ index ed9add2..90bcec7 100644
  
  DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
  		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
-@@ -91,7 +92,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
+@@ -92,7 +93,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  
  SUBDIRS =	unix
  
@@ -192,7 +192,7 @@ index ed9add2..90bcec7 100644
  
  GEOIP2LINKOBJS = geoip.@O@
  
-@@ -149,7 +150,7 @@ server.@O@: server.c
+@@ -150,7 +151,7 @@ server.@O@: server.c
  		-DPRODUCT=\"${PRODUCT}\" \
  		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
  
@@ -201,7 +201,7 @@ index ed9add2..90bcec7 100644
  	export MAKE_SYMTABLE="yes"; \
  	export BASEOBJS="${OBJS} ${UOBJS}"; \
  	${FINALBUILDCMD}
-@@ -159,7 +160,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
+@@ -160,7 +161,7 @@ feature-test.@O@: ${top_srcdir}/bin/tests/system/feature-test.c
  	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
  		-c ${top_srcdir}/bin/tests/system/feature-test.c
  
@@ -210,7 +210,7 @@ index ed9add2..90bcec7 100644
  	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
  		-o $@ feature-test.@O@ ${ISCLIBS} ${LIBS}
  
-@@ -178,11 +179,11 @@ statschannel.@O@: bind9.xsl.h
+@@ -179,11 +180,11 @@ statschannel.@O@: bind9.xsl.h
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
  
@@ -226,10 +226,10 @@ index ed9add2..90bcec7 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/configure.ac b/configure.ac
-index 2ff68a5..2638ef2 100644
+index 1932000..cf15786 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1214,12 +1214,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1244,12 +1244,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
@@ -244,7 +244,7 @@ index 2ff68a5..2638ef2 100644
  
  #
  # was --with-lmdb specified?
-@@ -2281,6 +2283,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+@@ -2336,6 +2338,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
  AC_SUBST(BIND9_NS_BUILDINCLUDE)
  AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
  AC_SUBST(BIND9_IRS_BUILDINCLUDE)
@@ -253,7 +253,7 @@ index 2ff68a5..2638ef2 100644
  if test "X$srcdir" != "X"; then
  	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
  	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2289,6 +2293,8 @@ if test "X$srcdir" != "X"; then
+@@ -2344,6 +2348,8 @@ if test "X$srcdir" != "X"; then
  	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
  	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
  	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
@@ -262,7 +262,7 @@ index 2ff68a5..2638ef2 100644
  else
  	BIND9_ISC_BUILDINCLUDE=""
  	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2297,6 +2303,8 @@ else
+@@ -2352,6 +2358,8 @@ else
  	BIND9_NS_BUILDINCLUDE=""
  	BIND9_BIND9_BUILDINCLUDE=""
  	BIND9_IRS_BUILDINCLUDE=""
@@ -271,7 +271,7 @@ index 2ff68a5..2638ef2 100644
  fi
  
  AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -2757,8 +2765,11 @@ AC_CONFIG_FILES([
+@@ -2824,8 +2832,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -283,7 +283,7 @@ index 2ff68a5..2638ef2 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/plugins/Makefile
-@@ -2820,6 +2831,10 @@ AC_CONFIG_FILES([
+@@ -2887,6 +2898,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -294,7 +294,7 @@ index 2ff68a5..2638ef2 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -2852,6 +2867,10 @@ AC_CONFIG_FILES([
+@@ -2919,6 +2934,10 @@ AC_CONFIG_FILES([
  	lib/ns/include/Makefile
  	lib/ns/include/ns/Makefile
  	lib/ns/tests/Makefile
@@ -481,19 +481,19 @@ index d00ddaf..b867afe 100644
 -	rm -f libns.@A@ timestamp
 +	rm -f libns-pkcs11.@A@ timestamp
 diff --git a/lib/ns-pkcs11/tests/Makefile.in b/lib/ns-pkcs11/tests/Makefile.in
-index 7869c8e..789d6cb 100644
+index ef1c1a6..5bbf10d 100644
 --- a/lib/ns-pkcs11/tests/Makefile.in
 +++ b/lib/ns-pkcs11/tests/Makefile.in
-@@ -21,17 +21,17 @@ WRAP_NAME =	-Wl,-install_name,${top_builddir}/lib/ns/tests/$@
- WRAP_RPATH =	-Wl,-rpath,${top_builddir}/lib/ns/tests
- WRAP_LIB =	-L${top_builddir}/lib/ns/tests -lwrap
+@@ -17,17 +17,17 @@ VERSION=@BIND9_VERSION@
+ 
+ WRAP_OPTIONS =	-Wl,--wrap=isc_nmhandle_detach -Wl,--wrap=isc_nmhandle_attach
  
 -CINCLUDES =	-I. -Iinclude ${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
 +CINCLUDES =	-I. -Iinclude ${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
  		${OPENSSL_CFLAGS} \
  		@CMOCKA_CFLAGS@
 -CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
-+CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\" @USE_PKCS11@
++CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns-pkcs11/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\" @USE_PKCS11@
  
  ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
  ISCDEPLIBS =	../../isc/libisc.@A@
@@ -509,7 +509,7 @@ index 7869c8e..789d6cb 100644
  LIBS =		@LIBS@ @CMOCKA_LIBS@
  
 diff --git a/make/includes.in b/make/includes.in
-index 9ff1bd8..ebab049 100644
+index 5373a7e..f1901ee 100644
 --- a/make/includes.in
 +++ b/make/includes.in
 @@ -41,3 +41,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch
index 7ee915b..03d7ad1 100644
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@@ -1,4 +1,4 @@
-From 303aae42064a4f6245f9c519953a5e6dd67510c0 Mon Sep 17 00:00:00 2001
+From cb648b203af5bf9085ad78d021f47c3baeb9b6e0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -82,16 +82,16 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/setup.sh            |  6 +-
- bin/tests/system/nsupdate/tests.sh            | 11 ++-
+ bin/tests/system/nsupdate/tests.sh            | 11 +++-
  bin/tests/system/rndc/setup.sh                |  2 +-
  bin/tests/system/rndc/tests.sh                | 23 ++++---
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
  bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
  bin/tests/system/tsig/setup.sh                |  5 ++
- bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
+ bin/tests/system/tsig/tests.sh                | 65 ++++++++++++-------
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- 33 files changed, 161 insertions(+), 107 deletions(-)
+ 33 files changed, 160 insertions(+), 106 deletions(-)
  create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
@@ -177,10 +177,10 @@ index 7cdcb6e..606a345 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
-index 4b4e050..0e679a8 100644
+index 7e20bac..9753a9d 100644
 --- a/bin/tests/system/acl/ns2/named5.conf.in
 +++ b/bin/tests/system/acl/ns2/named5.conf.in
-@@ -34,12 +34,12 @@ options {
+@@ -35,12 +35,12 @@ options {
  };
  
  key one {
@@ -196,7 +196,7 @@ index 4b4e050..0e679a8 100644
  };
  
 diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
-index fe49a86..d7819f1 100644
+index b4d3045..ebbc798 100644
 --- a/bin/tests/system/acl/tests.sh
 +++ b/bin/tests/system/acl/tests.sh
 @@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
@@ -431,7 +431,7 @@ index f4bc399..e01f312 100644
  };
  
 diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
-index 479910c..53b9e5c 100644
+index 4cb2709..c0884cf 100644
 --- a/bin/tests/system/allow-query/tests.sh
 +++ b/bin/tests/system/allow-query/tests.sh
 @@ -182,7 +182,7 @@ rndc_reload ns2 10.53.0.2
@@ -551,10 +551,10 @@ index 21be03e..e57c308 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 2eb2850..9e6913d 100644
+index 0dabe54..d55c51b 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -197,6 +197,6 @@ dyndb "name" "library.so" {
+@@ -204,6 +204,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -563,7 +563,7 @@ index 2eb2850..9e6913d 100644
  	secret "qwertyuiopasdfgh";
  };
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 204d612..684fab6 100644
+index 4a90332..2f85b44 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -14,6 +14,7 @@
@@ -574,7 +574,7 @@ index 204d612..684fab6 100644
  #include <isc/net.h>
  #include <isc/print.h>
  #include <isc/util.h>
-@@ -158,6 +159,19 @@ main(int argc, char **argv) {
+@@ -177,6 +178,19 @@ main(int argc, char **argv) {
  #endif /* ifdef DLZ_FILESYSTEM */
  	}
  
@@ -591,8 +591,8 @@ index 204d612..684fab6 100644
 +		}
 +	}
 +
- 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
- #ifdef WIN32
+ 	if (strcmp(argv[1], "--with-idn") == 0) {
+ #ifdef HAVE_LIBIDN2
  		return (0);
 diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
 index 2976bfc..256d846 100644
@@ -620,7 +620,7 @@ index 2976bfc..256d846 100644
  };
  
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index d54ab0d..ba38177 100644
+index 3d7e0b7..ec4d9a7 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
 @@ -212,16 +212,16 @@ ret=0
@@ -644,7 +644,7 @@ index d54ab0d..ba38177 100644
  	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
  	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index e7b6adb..4ad5cc1 100644
+index 346b647..c018fb4 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
 @@ -33,7 +33,7 @@ controls {
@@ -670,7 +670,7 @@ index b703843..8bfe2b0 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 5d70114..6c4b55a 100644
+index c055da3..4e1242b 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
 @@ -56,7 +56,11 @@ EOF
@@ -687,10 +687,10 @@ index 5d70114..6c4b55a 100644
  $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 72a282a..5d42e04 100755
+index b15fa2d..cb7979b 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -715,7 +715,14 @@ fi
+@@ -797,7 +797,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms ($n)"
@@ -706,7 +706,7 @@ index 72a282a..5d42e04 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -723,7 +730,7 @@ send
+@@ -805,7 +812,7 @@ send
  END
  done
  sleep 2
@@ -716,7 +716,7 @@ index 72a282a..5d42e04 100755
  done
  if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index 6b539d1..4d7eaa2 100644
+index b59e7a7..04d5f5a 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
 @@ -33,7 +33,7 @@ make_key () {
@@ -729,7 +729,7 @@ index 6b539d1..4d7eaa2 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 2af855a..36cd1aa 100644
+index 78508f3..a2a201e 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
 @@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -763,7 +763,7 @@ index 2af855a..36cd1aa 100644
  n=`expr $n + 1`
  echo_i "testing rndc with hmac-sha1 ($n)"
 diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
-index fbf30c6..f61657d 100644
+index 4ee703f..635434e 100644
 --- a/bin/tests/system/tsig/ns1/named.conf.in
 +++ b/bin/tests/system/tsig/ns1/named.conf.in
 @@ -21,10 +21,7 @@ options {
@@ -807,7 +807,7 @@ index 0000000..0682194
 +	algorithm hmac-md5-80;
 +};
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
-index b3e0450..90a6ce4 100644
+index e3b4a45..ae21d04 100644
 --- a/bin/tests/system/tsig/setup.sh
 +++ b/bin/tests/system/tsig/setup.sh
 @@ -15,3 +15,8 @@ SYSTEMTESTTOP=..
@@ -820,7 +820,7 @@ index b3e0450..90a6ce4 100644
 +	cat ns1/rndc5.conf.in >> ns1/named.conf
 +fi
 diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
-index 3a720de..e20e7f9 100644
+index 38d842a..668aa6f 100644
 --- a/bin/tests/system/tsig/tests.sh
 +++ b/bin/tests/system/tsig/tests.sh
 @@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
@@ -834,13 +834,6 @@ index 3a720de..e20e7f9 100644
 -if [ $ret -eq 1 ] ; then
 -	echo_i "failed"; status=1
 -fi
--
--echo_i "fetching using hmac-md5 (new form)"
--ret=0
--$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
--grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
--if [ $ret -eq 1 ] ; then
--	echo_i "failed"; status=1
 +if $FEATURETEST --md5
 +then
 +	echo_i "fetching using hmac-md5 (old form)"
@@ -850,7 +843,13 @@ index 3a720de..e20e7f9 100644
 +	if [ $ret -eq 1 ] ; then
 +		echo_i "failed"; status=1
 +	fi
-+
+ 
+-echo_i "fetching using hmac-md5 (new form)"
+-ret=0
+-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
+-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
+-if [ $ret -eq 1 ] ; then
+-	echo_i "failed"; status=1
 +	echo_i "fetching using hmac-md5 (new form)"
 +	ret=0
 +	$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
@@ -925,7 +924,7 @@ index ea42b4d..08676da 100644
  };
  
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index 3b0d7b3..cc1ae3e 100644
+index ecd91a6..be9993a 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
 @@ -66,7 +66,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
@@ -938,5 +937,5 @@ index 3b0d7b3..cc1ae3e 100644
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
 -- 
-2.21.1
+2.26.2
 
diff --git a/bind.spec b/bind.spec
index 4f649a0..7eb101a 100644
--- a/bind.spec
+++ b/bind.spec
@@ -55,24 +55,24 @@
 # no more isc-config.sh and bind9-config
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1607
-%global sover_isc 1606
+%global sover_dns 1608
+%global sover_isc 1607
 %global sover_irs 1601
 %global sover_isccfg 1601
-%global sover_ns 1604
+%global sover_ns 1605
 
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.16.7
+Version:  9.16.8
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
-Source:   https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz
+Source0:  https://downloads.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz
 Source1:  named.sysconfig
-Source2:  https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz.asc
+Source2:  https://downloads.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.xz.asc
 Source3:  named.logrotate
 Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2019.txt
 Source16: named.conf
@@ -1161,6 +1161,9 @@ fi;
 %endif
 
 %changelog
+* Fri Oct 23 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.8-1
+- Update to 9.16.8
+
 * Thu Sep 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.16.7-1
 - Update to 9.16.7
 
diff --git a/sources b/sources
index 0dab457..0b7efe9 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.16.7.tar.xz) = 176c84657e8a7b10a7ca93c939ca6a7fcdefb22f9200c3f01be59bcd8990dee27b8dc0970299225bcbe0f1aa8f49a67c80c4a9853895ffbcd685adb9674e7768
-SHA512 (bind-9.16.7.tar.xz.asc) = a94721692a3c400aa9df9499874ac833e605a647ec8e4e42065bf4822581eb6e3cfb8b5f61e127fb069e821364de9aef2030fa7bb456616993321897e06c7ec4
+SHA512 (bind-9.16.8.tar.xz) = 803af842b4f83c16556036f3a2a52b4aeab4781bafb35385b786a3331cf17ef6148c23928f6903fd371337ba92870d7a8548f5d178b805d160d0af34af45fee7
+SHA512 (bind-9.16.8.tar.xz.asc) = e33fdd6dc8b1fffc7ffaf4b23a5b1c2b7e75296cff745b3e6bc35f362e42097b52202600f9b1762e7c6193e295254335cf992ffa3d34ee85cda8fad7b74bcb07