diff --git a/unbound.spec b/unbound.spec
index eb6f2ab..82ef14f 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -16,12 +16,12 @@
 
 %global _hardened_build 1
 
-#global extra_version rc1
+%global extra_version rc2
 
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.6.3
-Release: 1%{?extra_version:.%{extra_version}}%{?dist}
+Version: 1.6.4
+Release: 0%{?extra_version:.%{extra_version}}%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
 Source: http://www.unbound.net/downloads/%{name}-%{version}%{?extra_version}.tar.gz
@@ -43,8 +43,6 @@ Source15: unbound-anchor.timer
 Source16: unbound-munin.README
 Source17: unbound-anchor.service
 
-Patch1: unbound-1.6.2-permissive.patch
-
 Group: System Environment/Daemons
 BuildRequires: flex, openssl-devel
 BuildRequires: libevent-devel expat-devel
@@ -137,9 +135,6 @@ Python 3 modules and extensions for unbound
 %prep
 %{?extra_version:%global pkgname %{name}-%{version}%{extra_version}}%{!?extra_version:%global pkgname %{name}-%{version}}
 %setup -qcn %{pkgname}
-pushd %{pkgname}
-%patch1 -p1
-popd
 
 %if 0%{with_python}
 mv %{pkgname} %{pkgname}_python2
@@ -170,6 +165,7 @@ export CXXFLAGS="$RPM_OPT_FLAGS -fPIE -pie"
 # ./configure script common arguments
 %global configure_args --with-libevent --with-pthreads --with-ssl \\\
             --disable-rpath --disable-static \\\
+            --enable-subnet --enable-ipsecmod \\\
             --with-conf-file=%{_sysconfdir}/%{name}/unbound.conf \\\
             --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid \\\
             --enable-sha2 --disable-gost --enable-ecdsa \\\
@@ -444,6 +440,9 @@ popd
 
 
 %changelog
+* Thu Jun 22 2017 Paul Wouters <pwouters@redhat.com> - 1.6.4-0.rc2
+- Update to 1.6.4 (esubnet, ipsecmod support, bugfixes)
+
 * Tue Jun 13 2017 Paul Wouters <pwouters@redhat.com> - 1.6.3-1
 - Updated to 1.6.3 (fixes assertion failure when receiving malformed packet with 0x20 enabled)