docs: clarify BIND9 9.20 branch strategy

Reviewed-on: #18

.gitea/workflows/test.yaml

@@ -54,8 +54,8 @@ jobs:
         run: |
           pip install --no-cache-dir \
             ansible \
-            molecule[podman] \
+            molecule \
-            podman-compose \
+            molecule-podman \
             pyyaml \
             jinja2
 

.github/skills/molecule-role-testing/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: molecule-role-testing
+description: Run Molecule scenarios to test the bind9 role using the repository's Molecule configuration.
+---
+
+Use this skill when asked to test or validate the role with Molecule.
+
+## Scope
+- Repository root: /home/alive/Code/ansible-bind9-role
+- Scenarios: molecule/default and molecule/bind9-20
+- Driver: podman
+
+## Prerequisites
+1. Ensure Podman is available and the current user can run it.
+2. Ensure Molecule and Ansible are installed in the active Python environment.
+
+## Default scenario (BIND 9.18 LTS)
+1. From the repository root, run:
+   - molecule test
+2. If a faster check is requested, run:
+   - molecule converge
+
+## BIND 9.20+ scenario
+1. From the repository root, run:
+   - molecule test -s bind9-20
+2. If a faster check is requested, run:
+   - molecule converge -s bind9-20
+
+## Notes
+- The scenarios use systemd-enabled containers and require privileged Podman.
+- If a scenario fails, capture the error summary and relevant logs before making changes.

AGENTS.md

@@ -4,3 +4,41 @@
 Ensure that all practices and instructions described by
 https://raw.githubusercontent.com/ansible/ansible-creator/refs/heads/main/docs/agents.md
 are followed.
+
+## Repository Actions
+
+**Use gitea-mcp tools for all repository interactions.** Do not use `curl`, `git`, or direct API calls.
+
+### When to Use gitea-mcp
+
+- Fetching issues, PRs, branches, tags, releases
+- Reading files, directories, or commits from repo
+- Creating issues, PRs, comments, tags, or releases
+- Editing issues or PRs
+
+### Wrong vs Right
+
+❌ `curl http://git.valid.dk/api/v1/repos/daniel/ansible-bind9-role/issues/6`
+
+✅ `mcp_gitea-mcp_list_repo_issues(owner, repo, page, pageSize)`
+
+### Local Workspace
+
+Terminal commands are fine for:
+- Compiling, testing, building
+- Git operations on local files (commit, push)
+- Using `read_file`, `grep_search`, `semantic_search`
+
+## General project workflow
+1. Check for open tickets
+2. Choose next logical ticket to work on
+3. Create branch for ticket
+4. Create plan for ticket
+5. Execute plan
+6. Create appropriate commits to repository
+7. Submit PR to repository
+8. Review the PR critically
+9. Check if further work is needed to resolve the issues found
+10. Loop 8-9 until complete
+11. Ask me to review the PR and merge it
+12. Close the ticket

CHANGELOG.md

@@ -14,10 +14,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Grammar fetcher for upstream BIND9 sources (`scripts/fetch_bind_grammar.py`)
 - Automated version difference tracking
 - Operating system support matrix
+- BIND9 Version Differences documentation (`docs/BIND_VERSION_DIFFERENCES.md`) covering:
+  - 44 breaking changes between BIND9 9.18.44 and 9.20.18
+  - 35 new options in BIND9 9.20
+  - 22 modified options requiring configuration updates
+  - 3 newly deprecated options
 
 ### Changed
 - Established formal release management process
 - Defined backporting policy for security, bugs, and features
+- Clarified version compatibility in CONFIGURATION_GRAMMAR.md
 
 ### Planned
 - BIND9 9.20+ support in separate `9.20` branch

CONFIGURATION_GRAMMAR.md

@@ -39,6 +39,17 @@ The BIND9 role uses YAML to replicate the official ISC BIND9 configuration forma
 - `max-cache-ttl` → `max_cache_ttl`
 - `dnssec-policy` → `dnssec_policy`
 
+### Version Compatibility
+
+This role and its configuration grammar are based on **BIND9 9.18.x (LTS)**. 
+
+For information about upgrading to BIND9 9.20 or later, see [BIND9 Version Differences](docs/BIND_VERSION_DIFFERENCES.md) which documents:
+- **Breaking changes** between versions
+- **New features** available in newer versions
+- **Migration guidance** for configuration updates
+
+⚠️ **Important:** BIND9 9.20 introduces significant breaking changes. Please review the version differences document before upgrading configurations.
+
 ## Configuration Structure
 
 All configuration is defined through four precedence-based variables that are merged:

docs/BIND9_9.20_SUPPORT.md

@@ -0,0 +1,233 @@
+# BIND9 9.20 Support Implementation Guide
+
+## Overview
+
+This document describes the ansible-bind9-role strategy for BIND9 9.20+ support through a dedicated version branch.
+
+The current implementation uses branch-level compatibility boundaries instead of runtime version detection. The main branch targets BIND9 9.18.x LTS, while the 9.20 branch targets BIND9 9.20+ feature releases.
+
+## Architecture
+
+### Branch-Based Support Strategy
+
+The role uses branch-only support boundaries:
+
+1. `main` branch: BIND9 9.18.x LTS support for production-stable deployments.
+2. `9.20` branch: BIND9 9.20+ feature-release support with version-specific templates, grammar data, tests, and documentation.
+
+The role does not currently detect BIND9 versions at runtime and does not use runtime version conditionals in templates. Each branch is expected to be tested against the BIND9 series it supports.
+
+This approach is preferred because:
+
+- compatibility boundaries are clear for users and maintainers;
+- templates avoid cross-version conditional complexity;
+- each branch can evolve with the grammar and package behavior of its target BIND9 series;
+- generated configuration does not silently change based on the installed package version.
+
+### Branch Structure
+
+```
+main                    # BIND9 9.18.x LTS support
+│
+└─ 9.20                 # BIND9 9.20+ feature-release support
+   └─ feature/*          # Short-lived feature branches targeting 9.20
+```
+
+## Implementation Details
+
+### 1. Task Flow
+
+1. Install the configured BIND9 packages from `bind9_packages`.
+2. Ensure backup and logging directories exist when enabled or configured.
+3. Render configured BIND9 files through `named.conf.generator.j2`.
+4. Validate the generated configuration with `named-checkconf -z`.
+5. Restore backed-up configuration files if validation fails.
+6. Start and enable the `named` service.
+
+There is no runtime `bind9_version` fact in this flow.
+
+### 2. Meta/Argument Specs Updates
+
+The `meta/argument_specs.yml` file documents the public role inputs for the current branch. It must not document runtime-only variables that the role does not set or consume.
+
+### 3. Molecule Testing
+
+Two molecule scenarios are now available:
+
+#### Default Scenario (BIND9 9.18.x)
+- **Location**: `molecule/default/`
+- **Platform**: Debian 13 (Trixie) with BIND9 9.18.x
+- **Purpose**: Validate production-stable configurations
+
+#### BIND9 9.20 Scenario
+- **Location**: `molecule/bind9-20/`
+- **Platform**: Ubuntu 24.04 LTS with BIND9 9.20+
+- **Purpose**: Validate newer configurations and breaking changes
+- **Tests**: Forward zones, TLS, DNSTAP, modern DNSSEC
+
+### 4. Template Version Compatibility
+
+Templates in each version branch should be audited for the BIND9 series targeted by that branch. The primary template files include:
+
+- `named.conf.options.j2` - Global options block
+- `named.conf.zone.j2` - Zone definitions
+- `named.conf.primaries.j2` - Primary/secondary definitions
+- `named.conf.tls.j2` - TLS configurations (9.20 focus)
+- `named.conf.dnssec-policy.j2` - DNSSEC policies
+
+### 5. Deprecated Options Handling
+
+BIND9 9.20 removes 44 options from 9.18. The 9.20 branch should handle this through:
+
+1. **Documentation**: Each deprecated option is documented in BIND9_MIGRATION_GUIDE.md
+2. **Branch-specific templates**: Templates on the 9.20 branch omit removed options
+3. **Migration Path**: BIND9_MIGRATION_GUIDE.md provides alternatives for each removed option
+
+## Critical BIND9 9.20 Changes
+
+### Automatically Enabled Options
+
+These cannot and should not be configured (always enabled in 9.20):
+
+- `glue-cache` - Glue records are always cached
+- `keep-response-order` - Response ordering is always enabled
+- `reuse` - TCP socket reuse is always enabled
+
+### Removed Global Options
+
+Key removed options requiring configuration changes:
+
+| 9.18 Option | 9.20 Replacement |
+|---|---|
+| `alt-transfer-source` | Use TLS in `primaries` statement |
+| `alt-transfer-source-v6` | Use TLS in `primaries` statement |
+| `auto-dnssec` | Automatic (DNSSEC always managed) |
+| `dsc` | Use TLS configuration instead |
+| `gssapi-credential` | Use TSIG + TLS instead |
+| `heartbeat-interval` | Zone transfer monitoring improved |
+| `lock-file` | OS-level locking used |
+| `max-zone-ttl` | Use per-zone option instead |
+| `parental-agents` | Use enhanced `primaries` statement |
+| `parental-registration-delay` | Zone monitoring improved |
+| `root-delegation-only` | Zone constraints |
+| `suppress-initial-notify` | NOTIFY behavior changed |
+| `tkeydhkey` | Use modern TLS/DNSSEC |
+| `tkeygsapi-credential` | Use TSIG + TLS |
+
+### New 9.20 Features
+
+- **Native TLS/DoT Support**: Zone transfers over TLS
+- **Automatic DNSSEC Management**: DNSSEC is handled automatically
+- **Enhanced HTTP/HTTPS Server**: Built-in HTTP API
+- **Better Resolver Behavior**: Improved retry and fallback logic
+- **Query Monitoring**: Advanced query tracking and statistics
+
+## Configuration Changes for 9.20
+
+### Before (BIND9 9.18.x)
+
+```yaml
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      alt_transfer_source: 10.0.1.1
+      glue_cache: yes
+      parental_agents: 
+        - 192.0.2.1
+        - 192.0.2.2
+```
+
+### After (BIND9 9.20+)
+
+```yaml
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      # Removed: alt_transfer_source, glue_cache, parental_agents
+      # Instead use TLS and enhanced primaries statement
+  - name: named.conf.zone
+    zones:
+      - name: example.com
+        type: secondary
+        primaries:
+          - address: 192.0.2.1
+            tls: zone-transfer-tls  # New 9.20 approach
+          - address: 192.0.2.2
+            tls: zone-transfer-tls
+```
+
+## Testing the Implementation
+
+### Running Molecule Tests
+
+```bash
+# Test both scenarios
+molecule test
+
+# Test only 9.18 scenario
+molecule test -s default
+
+# Test only 9.20 scenario
+molecule test -s bind9-20
+
+# Interactive testing
+molecule create -s bind9-20
+molecule converge -s bind9-20
+molecule verify -s bind9-20
+```
+
+### Manual Validation
+
+```bash
+# Check BIND9 version
+named -v
+
+# Validate configuration syntax
+named-checkconf /etc/bind/named.conf
+
+# Check logs for version-related messages
+journalctl -u named -n 50 -e
+tail -f /var/log/named/default.log
+```
+
+## Migration Path
+
+Users upgrading from 9.18 to 9.20 should:
+
+1. **Review Configuration**: Check `BIND9_MIGRATION_GUIDE.md` for breaking changes
+2. **Update Playbooks**: Remove deprecated variables/options
+3. **Test in Staging**: Use `molecule test -s bind9-20` to validate
+4. **Gradual Migration**: Test on non-critical servers first
+5. **Monitor Logs**: Watch for deprecation or error messages
+
+## Future Enhancements
+
+- [ ] Automated configuration migration tool
+- [ ] Deprecation warnings in role output
+- [ ] Runtime version detection if branch-per-version maintenance becomes insufficient
+- [ ] Template conditionals only if a future design intentionally supports multiple BIND9 series from one branch
+- [ ] 9.21+ preparation when available
+- [ ] Performance tuning for 9.20 features
+- [ ] DNS-over-HTTPS (DoH) support
+- [ ] Clustering/high-availability examples
+
+## References
+
+- [ISC BIND9 Website](https://www.isc.org/bind/)
+- [BIND9 9.20 Release Notes](https://www.isc.org/download/news/)
+- [BIND9 Documentation](https://bind9.readthedocs.io/)
+- [BIND9 Version Differences](BIND_VERSION_DIFFERENCES.md)
+- [BIND9 Migration Guide](BIND9_MIGRATION_GUIDE.md)
+- [VERSION_SUPPORT.md](VERSION_SUPPORT.md)
+
+## Support
+
+For issues or questions about BIND9 9.20 support:
+
+1. Check existing [Issues](https://git.valid.dk/daniel/ansible-bind9-role/issues)
+2. Review [Discussions](https://git.valid.dk/daniel/ansible-bind9-role/discussions)
+3. Create a new issue with:
+   - BIND9 version (`named -v`)
+   - Playbook configuration
+   - Error messages from logs
+   - Steps to reproduce

docs/BIND9_MIGRATION_GUIDE.md

@@ -0,0 +1,478 @@
+# BIND9 9.18 to 9.20 Migration Guide
+
+## Overview
+
+This guide provides step-by-step instructions for migrating BIND9 configurations from version 9.18.x (LTS) to version 9.20.x. 
+
+**Important:** BIND9 9.20 introduces 44 breaking changes. Before upgrading, carefully review this guide and test in a development environment.
+
+For detailed technical differences between versions, see [BIND9 Version Differences](BIND_VERSION_DIFFERENCES.md).
+
+## Table of Contents
+
+1. [Pre-Migration Planning](#pre-migration-planning)
+2. [Breaking Changes Summary](#breaking-changes-summary)
+3. [Migration Steps](#migration-steps)
+4. [Configuration Examples](#configuration-examples)
+5. [Role-Specific Changes](#role-specific-changes)
+6. [Testing Recommendations](#testing-recommendations)
+7. [Rollback Procedure](#rollback-procedure)
+
+## Pre-Migration Planning
+
+### Check Your Configuration
+
+Before upgrading, identify which BIND9 options your configuration uses:
+
+```bash
+# Check for options that will be removed
+named-checkconf -p /etc/bind/named.conf | \
+  grep -E "alt-transfer-source|auto-dnssec|coresize|datasize|glue-cache"
+```
+
+### Create Backups
+
+```bash
+# Backup all BIND configuration
+cp -r /etc/bind /data/backup/bind.9.18.backup
+
+# Backup BIND data
+cp -r /var/lib/bind /data/backup/bind.9.18.data
+cp -r /var/cache/bind /data/backup/bind.9.18.cache
+```
+
+### Review Version Support
+
+This Ansible role is designed for BIND9 9.18.x. When upgrading to 9.20:
+
+- The main branch will continue supporting 9.18.x
+- A separate `9.20` branch will provide 9.20-specific templates and configurations
+- Use the appropriate branch for your target BIND9 version
+
+## Breaking Changes Summary
+
+The following options are **removed** in BIND9 9.20 and will cause `named` to fail if present:
+
+### Global Options (9.20 Breaking Changes)
+
+- `alt-transfer-source` - Use TLS-based transfers instead
+- `alt-transfer-source-v6` - Use TLS-based transfers instead
+- `auto-dnssec` - DNSSEC management is automatic in 9.20
+- `coresize` - System resource limits; use OS-level controls
+- `datasize` - System resource limits; use OS-level controls
+- `dscp` - Use TLS configuration instead
+- `files` - System resource limits; use OS-level controls
+- `glue-cache` - Always enabled in 9.20
+- `heartbeat-interval` - Zone transfer changes
+- `keep-response-order` - Always enabled in 9.20
+- `lock-file` - Use system lock controls
+- `maxz-zone-ttl` - Use `max-zone-ttl` instead (per-zone option)
+- `parent-registration-delay` - Zone-delegation monitoring removed
+- `parental-agents` - Use `primaries` statement with DNSSEC
+- `primaries` - Replaced with enhanced syntax (see below)
+- `random-device` - System entropy handling improved
+- `recurse-ing-file` - Renamed to `recursing-file`
+- `reserved-sockets` - Automatic in 9.20
+- `resolver-nonbackoff-tries` - Resolver behavior changed
+- `resolver-retry-interval` - Resolver behavior changed
+- `reuse` - Always enabled in 9.20
+- `root-delegation-only` - Removed; not needed in 9.20
+- `stacksize` - System resource limits; use OS-level controls
+- `suppress-initial-notify` - NOTIFY behavior changed
+- `tkey-dhkey` - Use modern TLS/DNSSEC instead
+- `tkey-gssapi-credential` - Use TSIG + TLS instead
+
+### Zone-Type Specific Breaking Changes
+
+#### All Zone Types
+- `delegation-only` - Removed; use zone type constraints instead
+- `alt-transfer-source[v6]` - Use TLS configuration
+- `auto-dnssec` - DNSSEC management changes
+- `use-alt-transfer-source` - Use TLS configuration
+
+## Migration Steps
+
+### Step 1: Identify Configuration Changes
+
+Review your current `bind9_*_config` variables for any deprecated options:
+
+```yaml
+# Search your inventory and host_vars for these patterns
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      # These options must be removed or replaced:
+      # - alt_transfer_source
+      # - auto_dnssec  
+      # - glue_cache
+      # ... etc
+```
+
+### Step 2: Update Ansible Variables
+
+Replace deprecated options in your Ansible configuration:
+
+```yaml
+# BEFORE (BIND9 9.18)
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      alt_transfer_source: 10.0.1.1
+      glue_cache: yes
+      keep_response_order: yes
+
+# AFTER (BIND9 9.20)
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      # alt_transfer_source removed - use TLS
+      # glue_cache removed - always enabled
+      # keep_response_order removed - always enabled
+      # Instead configure TLS for transfers
+      http:
+        preference: https
+```
+
+### Step 3: Update Primaries Configuration
+
+The `primaries` statement syntax has changed:
+
+```yaml
+# BEFORE (BIND9 9.18)
+bind9_host_config:
+  - name: named.conf.view
+    view:
+      - name: internal
+        zone:
+          - name: example.com
+            type: secondary
+            primaries:
+              - 192.0.2.1
+              - 192.0.2.2
+
+# AFTER (BIND9 9.20)
+bind9_host_config:
+  - name: named.conf.view
+    view:
+      - name: internal
+        zone:
+          - name: example.com
+            type: secondary
+            primaries:
+              - address: 192.0.2.1
+              - address: 192.0.2.2
+              # Optional: TLS configuration
+              # tls: cert-name
+              # source: 10.0.1.1
+              # source_v6: "2001:db8::1"
+```
+
+### Step 4: Validate Configuration
+
+Before deploying to production:
+
+```bash
+# Validate syntax
+named-checkconf /etc/bind/named.conf
+
+# Check for deprecated options
+grep -r "alt-transfer-source\|auto-dnssec\|glue-cache" /etc/bind/
+```
+
+### Step 5: Test Zone Operations
+
+```bash
+# Test zone transfers
+dig @ns1.example.com example.com AXFR
+
+# Test DNSSEC validation
+dig @ns1.example.com example.com +dnssec
+
+# Check BIND logs
+journalctl -u bind9 -f
+```
+
+## Configuration Examples
+
+### Example 1: Simple Secondary Zone Migration
+
+**BIND9 9.18 Configuration:**
+
+```yaml
+bind9_default_config:
+  - name: named.conf.view
+    view:
+      - name: "default"
+        recursion: yes
+        zone:
+          - name: "example.com"
+            type: "secondary"
+            file: "/var/lib/bind/example.com.zone"
+            primaries:
+              - 192.0.2.1
+              - 192.0.2.2
+            alt_transfer_source: 10.0.1.1
+            alt_transfer_source_v6: "2001:db8::1"
+            allow_transfer:
+              - 10.0.2.0/24
+```
+
+**BIND9 9.20 Configuration:**
+
+```yaml
+bind9_default_config:
+  - name: named.conf.view
+    view:
+      - name: "default"
+        recursion: yes
+        zone:
+          - name: "example.com"
+            type: "secondary"
+            file: "/var/lib/bind/example.com.zone"
+            primaries:
+              - address: 192.0.2.1
+              - address: 192.0.2.2
+            # alt_transfer_source removed - use TLS
+            # Configuration now uses single source per address:
+            allow_transfer:
+              - 10.0.2.0/24
+```
+
+### Example 2: DNSSEC Configuration Migration
+
+**BIND9 9.18 Configuration:**
+
+```yaml
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      dnssec_policy: default
+  - name: named.conf.zone
+    zone:
+      - name: "example.com"
+        type: "primary"
+        file: "/var/lib/bind/example.com.zone"
+        auto_dnssec: maintain
+        inline_signing: yes
+```
+
+**BIND9 9.20 Configuration:**
+
+```yaml
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      dnssec_policy: default
+  - name: named.conf.zone
+    zone:
+      - name: "example.com"
+        type: "primary"
+        file: "/var/lib/bind/example.com.zone"
+        # auto_dnssec removed - DNSSEC management is automatic
+        dnssec_policy: default  # Explicitly set policy
+        inline_signing: yes     # Still supported
+```
+
+## Role-Specific Changes
+
+### Branch Selection
+
+When using this Ansible role with BIND9 9.20, you have two options:
+
+#### Option 1: Use Main Branch (Recommended for 9.18)
+
+```bash
+# Use main branch for BIND9 9.18
+ansible-galaxy install daniel.ansible-bind9-role
+```
+
+#### Option 2: Use 9.20 Branch (When Available)
+
+```bash
+# Clone the 9.20 branch for BIND9 9.20 support
+git clone --branch 9.20 https://git.valid.dk/daniel/ansible-bind9-role.git
+```
+
+### Template Variables
+
+No Ansible variable names change between versions. However, the **values** for some variables may need adjustment:
+
+```yaml
+# Variable names stay the same (kebab-case → snake_case)
+# Example: "alt-transfer-source" → "alt_transfer_source"
+# Simply remove deprecated variables - they will be ignored
+
+bind9_default_config:
+  - name: named.conf.options
+    options:
+      # Remove these:
+      # alt_transfer_source: ...
+      # auto_dnssec: ...
+      # glue_cache: ...
+      
+      # These still work:
+      dnssec_validation: yes
+      recursion: yes
+      allow_query:
+        - any
+```
+
+### DNSSEC Policy Changes
+
+BIND9 9.20 improves DNSSEC handling:
+
+```yaml
+# Both versions support dnssec_policy
+bind9_default_config:
+  - name: named.conf.dnssec-policy
+    dnssec_policy:
+      - name: default
+        keys:
+          - lifetime: 3600
+            algorithm: ecdsap256sha256
+            role:
+              - ksk
+              - zsk
+        nsec3param:
+          iterations: 0
+          optout: no
+          salt_length: 32
+```
+
+## Testing Recommendations
+
+### Test Environment Setup
+
+Create a test playbook to validate migration:
+
+```yaml
+---
+# Test playbook for BIND9 9.20 migration
+- hosts: test_servers
+  
+  tasks:
+    - name: Apply BIND9 9.20 configuration
+      include_role:
+        name: ansible-bind9-role
+      
+    - name: Validate configuration
+      command: named-checkconf /etc/bind/named.conf
+      register: config_check
+      failed_when: config_check.rc != 0
+    
+    - name: Test zone transfers
+      command: >
+        dig @localhost example.com AXFR
+      register: zone_transfer
+      
+    - name: Test DNSSEC validation
+      command: >
+        dig @localhost example.com +dnssec
+      register: dnssec_test
+      
+    - name: Check BIND status
+      systemd:
+        name: bind9
+        state: started
+      register: bind_status
+```
+
+### Validation Checklist
+
+- [ ] Configuration syntax valid (`named-checkconf`)
+- [ ] BIND9 service starts without errors
+- [ ] All zones load successfully
+- [ ] Zone transfers complete successfully
+- [ ] Queries resolve correctly
+- [ ] DNSSEC validation works
+- [ ] Secondary zones receive updates
+- [ ] No errors in BIND logs
+- [ ] Performance is acceptable
+
+## Rollback Procedure
+
+If issues occur after migration:
+
+### Immediate Rollback
+
+```bash
+# Stop BIND9
+systemctl stop bind9
+
+# Restore configuration backup
+rm -rf /etc/bind
+cp -r /data/backup/bind.9.18.backup /etc/bind
+
+# Restore zone files
+rm -rf /var/lib/bind
+cp -r /data/backup/bind.9.18.data /var/lib/bind
+cp -r /data/backup/bind.9.18.cache /var/cache/bind
+
+# Restore BIND9 package
+apt-get install --reinstall bind9=1:9.18.44-1+0~20240101.3+debian~bullseye+1+sury+1
+
+# Start BIND9
+systemctl start bind9
+
+# Verify
+systemctl status bind9
+dig @localhost example.com
+```
+
+### Using Ansible Rollback
+
+```yaml
+---
+- hosts: bind_servers
+  tasks:
+    - name: Restore BIND9 9.18 package
+      apt:
+        name: bind9=1:9.18.44-1+0~20240101.3+debian~bullseye+1+sury+1
+        state: present
+    
+    - name: Restore configuration from backup
+      synchronize:
+        src: /data/backup/bind.9.18.backup/
+        dest: /etc/bind/
+        delete: yes
+        mode: push
+    
+    - name: Restart BIND9
+      systemd:
+        name: bind9
+        state: restarted
+        daemon_reload: yes
+```
+
+## Additional Resources
+
+- [BIND9 Version Differences](BIND_VERSION_DIFFERENCES.md) - Technical comparison
+- [ISC BIND9 Release Notes](https://www.isc.org/bind/) - Official documentation
+- [BIND9 9.20 Features](https://bind.readthedocs.io/en/latest/) - Feature details
+- [Role Configuration Reference](CONFIGURATION_GRAMMAR.md) - Ansible role documentation
+
+## Getting Help
+
+For issues during migration:
+
+1. Check [BIND9 Version Differences](BIND_VERSION_DIFFERENCES.md) for specific option changes
+2. Review BIND9 logs: `journalctl -u bind9 -n 100`
+3. Validate configuration: `named-checkconf /etc/bind/named.conf`
+4. Test in development environment first
+5. Document any custom options that need special handling
+
+## Version Support Timeline
+
+- **BIND9 9.18.x (LTS)**: Supported until September 2026
+  - This Ansible role's current focus
+  - Main branch targets 9.18.x configurations
+  
+- **BIND9 9.20.x**: Available now
+  - Future branch (`9.20`) being prepared
+  - Plan migration during non-critical periods
+
+- **BIND9 9.22.x**: Coming in 2026
+  - Further breaking changes expected
+  - Will require additional migration steps
+
+Plan upgrades within your maintenance windows and test thoroughly before production deployment.

docs/BIND_VERSION_DIFFERENCES.md

@@ -0,0 +1,552 @@
+# BIND9 Version Differences: v9.18.44 vs v9.20.18
+
+This document compares BIND9 configuration grammar between v9.18.44 and v9.20.18.
+
+Generated automatically by `scripts/compare_bind_versions.py`.
+
+## Summary
+
+- **New Options**: 35
+- **Removed Options**: 44 ⚠️
+- **Modified Options**: 22
+- **Newly Deprecated**: 3
+
+## ⚠️ Breaking Changes
+
+The following options were removed in v9.20.18 and will cause configuration errors:
+
+### options
+
+- `alt-transfer-source`
+- `alt-transfer-source-v6`
+- `auto-dnssec`
+- `coresize`
+- `datasize`
+- `dscp`
+- `files`
+- `glue-cache`
+- `heartbeat-interval`
+- `keep-response-order`
+- `lock-file`
+- `maxz-zone-ttl`
+- `parent-registration-delay`
+- `parental-agents`
+- `primaries`
+- `random-device`
+- `recurse-ing-file`
+- `reserved-sockets`
+- `resolver-nonbackoff-tries`
+- `resolver-retry-interval`
+- `reuse`
+- `root-delegation-only`
+- `stacksize`
+- `suppress-initial-notify`
+- `tkey-dhkey`
+- `tkey-gssapi-credential`
+- `use-alt-transfer-source`
+
+### forward.zoneopt
+
+- `delegation-only`
+
+### hint.zoneopt
+
+- `delegation-only`
+
+### mirror.zoneopt
+
+- `alt-transfer-source`
+- `alt-transfer-source-v6`
+- `use-alt-transfer-source`
+
+### primary.zoneopt
+
+- `alt-transfer-source`
+- `alt-transfer-source-v6`
+- `auto-dnssec`
+- `update-check-ksk`
+
+### secondary.zoneopt
+
+- `alt-transfer-source`
+- `alt-transfer-source-v6`
+- `auto-dnssec`
+- `use-alt-transfer-source`
+
+### stub.zoneopt
+
+- `delegation-only`
+- `use-alt-transfer-source`
+
+### delegation-only.zoneopt
+
+- `type`
+- `zone`
+
+## ✨ New Features
+
+The following options were added in v9.20.18:
+
+### options
+
+- `allow-proxy`
+- `allow-proxy-on`
+- `cdnskey`
+- `cds-digest-types`
+- `check-svcb`
+- `cipher-suites`
+- `dnsrps-library`
+- `inline-signing`
+- `key-store`
+- `manual-mode`
+- `max-validation-failures-per-fetch`
+- `max-validations-per-fetch`
+- `min-transfer-rate-in`
+- `notify-defer`
+- `offline-ksk`
+- `pkcs11-uri`
+- `recursing-file`
+- `remote-servers`
+- `require-cookie`
+- `resolver-use-dns64`
+- `responselog`
+- `reuseport`
+- `sig0-checks-quota`
+- `sig0-checks-quota-exempt`
+- `sig0-key-checks-limit`
+- `sig0-message-checks-limit`
+
+### mirror.zoneopt
+
+- `min-transfer-rate-in`
+- `notify-defer`
+
+### primary.zoneopt
+
+- `check-svcb`
+- `checkds`
+- `notify-defer`
+
+### secondary.zoneopt
+
+- `checkds`
+- `min-transfer-rate-in`
+- `notify-defer`
+
+### stub.zoneopt
+
+- `min-transfer-rate-in`
+
+## 🔧 Modified Options
+
+The following options have syntax changes in v9.20.18:
+
+### options
+
+#### `listen-on`
+
+**v9.18.44**:
+```
+[ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ proxy <string> ] [ tls <string> ] [ http <string> ] { <address_match_element>
+```
+
+#### `response-policy`
+
+**v9.18.44**:
+```
+{ zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ]
+```
+
+**v9.20.18**:
+```
+{ zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ ede <string> ]
+```
+
+#### `cookie-algorithm`
+
+**v9.18.44**:
+```
+( aes | siphash24 )
+```
+
+**v9.20.18**:
+```
+( siphash24 )
+```
+
+#### `forwarders`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]
+```
+
+#### `listen-on-v6`
+
+**v9.18.44**:
+```
+[ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ proxy <string> ] [ tls <string> ] [ http <string> ] { <address_match_element>
+```
+
+#### `also-notify`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+#### `catalog-zones`
+
+**v9.18.44**:
+```
+{ zone <string> [ default-primaries [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+{ zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+### forward.zoneopt
+
+#### `forwarders`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]
+```
+
+### mirror.zoneopt
+
+#### `also-notify`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+#### `primaries`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+### primary.zoneopt
+
+#### `update-policy`
+
+**v9.18.44**:
+```
+( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesubject ) [ <string> ] <rrtype list>
+```
+
+**v9.20.18**:
+```
+( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtype list>
+```
+
+#### `also-notify`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+#### `parental-agents`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+#### `forwarders`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]
+```
+
+### redirect.zoneopt
+
+#### `primaries`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+### secondary.zoneopt
+
+#### `also-notify`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+#### `parental-agents`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+#### `forwarders`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]
+```
+
+#### `primaries`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+### static-stub.zoneopt
+
+#### `forwarders`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]
+```
+
+### stub.zoneopt
+
+#### `forwarders`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]
+```
+
+#### `primaries`
+
+**v9.18.44**:
+```
+[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+**v9.20.18**:
+```
+[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]
+```
+
+## 📋 Newly Deprecated Options
+
+The following options were marked as deprecated in v9.20.18:
+
+### options
+
+- `sortlist`
+
+### primary.zoneopt
+
+- `max-zone-ttl`
+
+### redirect.zoneopt
+
+- `max-zone-ttl`
+
+## Detailed File-by-File Comparison
+
+### options
+
+- v9.18.44: 334 options
+- v9.20.18: 333 options
+- Added: 26
+- Removed: 27
+- Modified: 7
+
+### forward.zoneopt
+
+- v9.18.44: 5 options
+- v9.20.18: 4 options
+- Added: 0
+- Removed: 1
+- Modified: 1
+
+### hint.zoneopt
+
+- v9.18.44: 5 options
+- v9.20.18: 4 options
+- Added: 0
+- Removed: 1
+- Modified: 0
+
+### in-view.zoneopt
+
+- v9.18.44: 2 options
+- v9.20.18: 2 options
+- Added: 0
+- Removed: 0
+- Modified: 0
+
+### mirror.zoneopt
+
+- v9.18.44: 44 options
+- v9.20.18: 43 options
+- Added: 2
+- Removed: 3
+- Modified: 2
+
+### primary.zoneopt
+
+- v9.18.44: 63 options
+- v9.20.18: 62 options
+- Added: 3
+- Removed: 4
+- Modified: 4
+
+### redirect.zoneopt
+
+- v9.18.44: 14 options
+- v9.20.18: 14 options
+- Added: 0
+- Removed: 0
+- Modified: 1
+
+### secondary.zoneopt
+
+- v9.18.44: 66 options
+- v9.20.18: 65 options
+- Added: 3
+- Removed: 4
+- Modified: 4
+
+### static-stub.zoneopt
+
+- v9.18.44: 12 options
+- v9.20.18: 12 options
+- Added: 0
+- Removed: 0
+- Modified: 1
+
+### stub.zoneopt
+
+- v9.18.44: 28 options
+- v9.20.18: 27 options
+- Added: 1
+- Removed: 2
+- Modified: 2
+
+### delegation-only.zoneopt
+
+- v9.18.44: 2 options
+- v9.20.18: 0 options
+- Added: 0
+- Removed: 2
+- Modified: 0
+
+### rndc.grammar
+
+- v9.18.44: 14 options
+- v9.20.18: 14 options
+- Added: 0
+- Removed: 0
+- Modified: 0
+
+## Migration Guide
+
+### Migrating from v9.18.44 to v9.20.18
+
+1. **Remove unsupported options** from your configuration
+   - Review the Breaking Changes section above
+   - Check if there are replacement options
+
+2. **Plan for deprecated options**
+   - These options still work but may be removed in future versions
+   - Start planning migration to recommended alternatives
+
+3. **Test your configuration**
+   - Use `named-checkconf` to validate syntax
+   - Test in a development environment before production

docs/VERSION_SUPPORT.md

@@ -270,36 +270,20 @@ bind9-grammar/
 
 ## Version-Specific Features
 
-### Version Detection
+### Branch-Level Version Targeting
 
-The role will detect BIND9 version at runtime:
+The role currently uses branch-level version targeting instead of runtime version detection:
 
-```yaml
+- `main` targets BIND9 9.18.x LTS.
-# tasks/main.yml (planned implementation)
+- `9.20` targets BIND9 9.20+ feature releases.
-- name: Detect BIND9 version
-  ansible.builtin.command: named -V
-  register: _bind9_version_output
-  changed_when: false
 
-- name: Set BIND9 version facts
+Each branch carries the templates, grammar data, documentation, and tests appropriate for its supported BIND9 series. This keeps generated configuration predictable and avoids mixing incompatible BIND9 grammar rules in one template path.
-  ansible.builtin.set_fact:
-    bind9_version_full: "{{ _bind9_version_output.stdout | regex_search('BIND (\\S+)', '\\1') | first }}"
-    bind9_version_major: "{{ _bind9_version_output.stdout | regex_search('BIND (\\d+)\\.(\\d+)', '\\1') | first }}"
-    bind9_version_minor: "{{ _bind9_version_output.stdout | regex_search('BIND (\\d+)\\.(\\d+)', '\\2') | first }}"
-```
 
-### Conditional Configuration
+### Runtime Detection
 
-Templates will use version-aware conditionals:
+Runtime version detection is not part of the current implementation. The role does not set `bind9_version_full`, `bind9_version_major`, `bind9_version_minor`, or `bind9_version`, and templates do not branch on those values.
 
-```jinja2
+Runtime detection may be reconsidered in the future if maintaining separate version branches becomes more expensive than supporting multiple BIND9 series from one branch. That future design would require dedicated tasks, public metadata, template changes, and Molecule coverage before being documented as supported behavior.
-{# templates/named.conf.options.j2 (planned) #}
-{% if bind9_version_major | int >= 20 %}
-    {# BIND9 9.20+ specific options #}
-{% else %}
-    {# BIND9 9.18 options #}
-{% endif %}
-```
 
 ## Migration Guidance
 
@@ -367,4 +351,3 @@ See `CHANGELOG.md` for version-specific migration notes.
 | Date | Version | Changes |
 |------|---------|---------|
 | 2026-02-07 | 1.0 | Initial version support policy |
-

docs/bind_version_comparison.json

@@ -0,0 +1,326 @@
+{
+  "options": {
+    "file": "options",
+    "added": [
+      "allow-proxy",
+      "allow-proxy-on",
+      "cdnskey",
+      "cds-digest-types",
+      "check-svcb",
+      "cipher-suites",
+      "dnsrps-library",
+      "inline-signing",
+      "key-store",
+      "manual-mode",
+      "max-validation-failures-per-fetch",
+      "max-validations-per-fetch",
+      "min-transfer-rate-in",
+      "notify-defer",
+      "offline-ksk",
+      "pkcs11-uri",
+      "recursing-file",
+      "remote-servers",
+      "require-cookie",
+      "resolver-use-dns64",
+      "responselog",
+      "reuseport",
+      "sig0-checks-quota",
+      "sig0-checks-quota-exempt",
+      "sig0-key-checks-limit",
+      "sig0-message-checks-limit"
+    ],
+    "removed": [
+      "alt-transfer-source",
+      "alt-transfer-source-v6",
+      "auto-dnssec",
+      "coresize",
+      "datasize",
+      "dscp",
+      "files",
+      "glue-cache",
+      "heartbeat-interval",
+      "keep-response-order",
+      "lock-file",
+      "maxz-zone-ttl",
+      "parent-registration-delay",
+      "parental-agents",
+      "primaries",
+      "random-device",
+      "recurse-ing-file",
+      "reserved-sockets",
+      "resolver-nonbackoff-tries",
+      "resolver-retry-interval",
+      "reuse",
+      "root-delegation-only",
+      "stacksize",
+      "suppress-initial-notify",
+      "tkey-dhkey",
+      "tkey-gssapi-credential",
+      "use-alt-transfer-source"
+    ],
+    "modified": [
+      {
+        "option": "listen-on",
+        "old_definition": "[ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>",
+        "new_definition": "[ port <integer> ] [ proxy <string> ] [ tls <string> ] [ http <string> ] { <address_match_element>"
+      },
+      {
+        "option": "response-policy",
+        "old_definition": "{ zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ]",
+        "new_definition": "{ zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ ede <string> ]"
+      },
+      {
+        "option": "cookie-algorithm",
+        "old_definition": "( aes | siphash24 )",
+        "new_definition": "( siphash24 )"
+      },
+      {
+        "option": "forwarders",
+        "old_definition": "[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]",
+        "new_definition": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]"
+      },
+      {
+        "option": "listen-on-v6",
+        "old_definition": "[ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>",
+        "new_definition": "[ port <integer> ] [ proxy <string> ] [ tls <string> ] [ http <string> ] { <address_match_element>"
+      },
+      {
+        "option": "also-notify",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      },
+      {
+        "option": "catalog-zones",
+        "old_definition": "{ zone <string> [ default-primaries [ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "{ zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [
+      "sortlist"
+    ],
+    "options1_count": 334,
+    "options2_count": 333
+  },
+  "forward.zoneopt": {
+    "file": "forward.zoneopt",
+    "added": [],
+    "removed": [
+      "delegation-only"
+    ],
+    "modified": [
+      {
+        "option": "forwarders",
+        "old_definition": "[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]",
+        "new_definition": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [],
+    "options1_count": 5,
+    "options2_count": 4
+  },
+  "hint.zoneopt": {
+    "file": "hint.zoneopt",
+    "added": [],
+    "removed": [
+      "delegation-only"
+    ],
+    "modified": [],
+    "deprecated_new": [],
+    "options1_count": 5,
+    "options2_count": 4
+  },
+  "in-view.zoneopt": {
+    "file": "in-view.zoneopt",
+    "added": [],
+    "removed": [],
+    "modified": [],
+    "deprecated_new": [],
+    "options1_count": 2,
+    "options2_count": 2
+  },
+  "mirror.zoneopt": {
+    "file": "mirror.zoneopt",
+    "added": [
+      "min-transfer-rate-in",
+      "notify-defer"
+    ],
+    "removed": [
+      "alt-transfer-source",
+      "alt-transfer-source-v6",
+      "use-alt-transfer-source"
+    ],
+    "modified": [
+      {
+        "option": "also-notify",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      },
+      {
+        "option": "primaries",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [],
+    "options1_count": 44,
+    "options2_count": 43
+  },
+  "primary.zoneopt": {
+    "file": "primary.zoneopt",
+    "added": [
+      "check-svcb",
+      "checkds",
+      "notify-defer"
+    ],
+    "removed": [
+      "alt-transfer-source",
+      "alt-transfer-source-v6",
+      "auto-dnssec",
+      "update-check-ksk"
+    ],
+    "modified": [
+      {
+        "option": "update-policy",
+        "old_definition": "( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesubject ) [ <string> ] <rrtype list>",
+        "new_definition": "( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtype list>"
+      },
+      {
+        "option": "also-notify",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      },
+      {
+        "option": "parental-agents",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      },
+      {
+        "option": "forwarders",
+        "old_definition": "[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]",
+        "new_definition": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [
+      "max-zone-ttl"
+    ],
+    "options1_count": 63,
+    "options2_count": 62
+  },
+  "redirect.zoneopt": {
+    "file": "redirect.zoneopt",
+    "added": [],
+    "removed": [],
+    "modified": [
+      {
+        "option": "primaries",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [
+      "max-zone-ttl"
+    ],
+    "options1_count": 14,
+    "options2_count": 14
+  },
+  "secondary.zoneopt": {
+    "file": "secondary.zoneopt",
+    "added": [
+      "checkds",
+      "min-transfer-rate-in",
+      "notify-defer"
+    ],
+    "removed": [
+      "alt-transfer-source",
+      "alt-transfer-source-v6",
+      "auto-dnssec",
+      "use-alt-transfer-source"
+    ],
+    "modified": [
+      {
+        "option": "also-notify",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      },
+      {
+        "option": "parental-agents",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      },
+      {
+        "option": "forwarders",
+        "old_definition": "[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]",
+        "new_definition": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]"
+      },
+      {
+        "option": "primaries",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [],
+    "options1_count": 66,
+    "options2_count": 65
+  },
+  "static-stub.zoneopt": {
+    "file": "static-stub.zoneopt",
+    "added": [],
+    "removed": [],
+    "modified": [
+      {
+        "option": "forwarders",
+        "old_definition": "[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]",
+        "new_definition": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [],
+    "options1_count": 12,
+    "options2_count": 12
+  },
+  "stub.zoneopt": {
+    "file": "stub.zoneopt",
+    "added": [
+      "min-transfer-rate-in"
+    ],
+    "removed": [
+      "delegation-only",
+      "use-alt-transfer-source"
+    ],
+    "modified": [
+      {
+        "option": "forwarders",
+        "old_definition": "[ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]",
+        "new_definition": "[ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]"
+      },
+      {
+        "option": "primaries",
+        "old_definition": "[ port <integer> ]  { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]",
+        "new_definition": "[ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]"
+      }
+    ],
+    "deprecated_new": [],
+    "options1_count": 28,
+    "options2_count": 27
+  },
+  "delegation-only.zoneopt": {
+    "file": "delegation-only.zoneopt",
+    "added": [],
+    "removed": [
+      "type",
+      "zone"
+    ],
+    "modified": [],
+    "deprecated_new": [],
+    "options1_count": 2,
+    "options2_count": 0
+  },
+  "rndc.grammar": {
+    "file": "rndc.grammar",
+    "added": [],
+    "removed": [],
+    "modified": [],
+    "deprecated_new": [],
+    "options1_count": 14,
+    "options2_count": 14
+  }
+}

meta/argument_specs.yml

@@ -2,6 +2,9 @@
 argument_specs:
   main:
     short_description: The main entry point for the bind9 role.
+    description:
+      - Configures BIND9 DNS server on Debian-based systems.
+      - "Supported BIND9 versions are branch-specific: main targets 9.18.x (LTS), and the 9.20 branch targets 9.20+ feature releases."
     options:
       bind9_config:
         type: list

molecule/bind9-20/README.md

@@ -0,0 +1,108 @@
+# BIND9 9.20 Molecule Scenario
+
+This Molecule scenario validates the ansible-bind9-role with BIND9 9.20 and later feature releases.
+
+## Purpose
+
+- Tests role compatibility with BIND9 9.20+ which includes 44 breaking changes from 9.18.x
+- Validates version-specific templates and configurations
+- Ensures configuration syntax is correct for newer BIND9 versions
+- Documents 9.20-specific configuration patterns
+
+## Platform
+
+- **Base Image**: Ubuntu 24.04 LTS (docker.io/library/ubuntu:24.04)
+- **BIND9 Version**: 9.20.x or later (as available in Ubuntu 24.04 repositories)
+
+## Notable BIND9 9.20 Changes
+
+Key breaking changes in this scenario:
+
+1. **Automatic Options**: The following options are automatically enabled in 9.20 and should not be configured:
+   - `glue-cache` - Always enabled
+   - `keep-response-order` - Always enabled
+   - `reuse` - Always enabled
+   - `recursion-enabled` - Always enabled
+
+2. **Removed Options**: These options are no longer supported in 9.20:
+   - `alt-transfer-source` - Use TLS instead
+   - `alt-transfer-source-v6` - Use TLS instead
+   - `auto-dnssec` - DNSSEC management is automatic
+   - `dsc` - Use TLS configuration instead
+   - `gssapi-credential` - Use TSIG + TLS instead
+   - `heartbeat-interval` - Zone transfer monitoring changed
+   - `lock-file` - OS-level locking is used
+   - `root-delegation-only` - Use zone constraints instead
+
+3. **Enhanced Features**:
+   - Improved TLS/DoT support for zone transfers
+   - Native DNSSEC management
+   - Better resolver behavior and retry logic
+   - Native HTTP/HTTPS server capabilities
+
+## Configuration Features Tested
+
+- **DNS Forwarding**: Forward zones with TLS-based forwarders (DoT)
+- **Query Logging**: Detailed query and response logging
+- **DNSTAP**: DNS packet capture for forensics
+- **TLS Configuration**: Modern TLS configurations for zone transfers
+- **Recursion**: Proper recursion configuration with ACLs
+- **DNSSEC Validation**: Modern DNSSEC validation approach
+
+## Testing
+
+To run this scenario:
+
+```bash
+# Test with this specific scenario
+cd /path/to/ansible-bind9-role
+molecule test -s bind9-20
+
+# Or specific steps
+molecule create -s bind9-20
+molecule converge -s bind9-20
+molecule verify -s bind9-20
+molecule destroy -s bind9-20
+```
+
+## Expected Results
+
+- BIND9 service starts successfully
+- Configuration files are generated without errors
+- DNS forwarding works correctly
+- Named-checkconf validates the configuration
+- All log channels are operational
+- TLS connections are established for forwarders
+
+## Troubleshooting
+
+### BIND9 Package Not Available
+
+If BIND9 9.20 is not available in Ubuntu 24.04 repositories, you may need to:
+
+1. Build from source using the upstream ISC BIND9 repository
+2. Use a different base image with more recent BIND9 packages
+3. Add a custom APT repository with backported packages
+
+### Configuration Syntax Errors
+
+Review `/etc/bind/named.conf` using:
+
+```bash
+named-checkconf /etc/bind/named.conf
+```
+
+Check logs at `/var/log/named/default.log` for specific error messages.
+
+## Future Updates
+
+- [ ] Add support for BIND9 9.20 DNS-over-HTTPS (DoH)
+- [ ] Test with BIND9 9.22+ when released
+- [ ] Validate performance improvements
+- [ ] Test clustering/replication features
+
+## References
+
+- [BIND9 Documentation](https://bind9.readthedocs.io/)
+- [BIND9 9.20 Release Notes](https://www.isc.org/bind/)
+- [DNS-over-TLS (DoT) RFC 7858](https://tools.ietf.org/html/rfc7858)

molecule/bind9-20/collections.yml

@@ -0,0 +1,4 @@
+---
+collections:
+  - ansible.posix
+  - community.general

molecule/bind9-20/converge.yml

@@ -0,0 +1,122 @@
+---
+- name: Converge
+  hosts: all
+  tasks:
+    - name: Create log directory for BIND
+      ansible.builtin.file:
+        path: /var/log/named
+        state: directory
+        mode: '0755'
+        owner: bind
+        group: bind
+
+    - name: Include bind9 role
+      ansible.builtin.include_role:
+        name: ../../../ansible-bind9-role  # noqa: role-name[path]
+  vars:
+    bind9_backup_config: false
+    # BIND9 9.20+ configuration with version-specific options
+    bind9_host_config:
+      - name: named.conf.options
+        options:
+          directory: "{{ bind9_working_directory }}"
+          recursion: true
+          allow_query:
+            - any
+          allow_recursion:
+            - 10.0.0.0/8
+            - 192.168.0.0/16
+            - 172.16.0.0/12
+            - localhost
+            - localnets
+          forwarders:
+            - address: 91.239.100.100
+              tls: censurfridns-anycast
+            - address: 89.233.43.71
+              tls: censurfridns-unicast
+          forward: first
+          dnssec_validation: auto
+          dnstap:
+            - type: auth
+            - type: resolver
+              log: query
+            - type: client
+              log: response
+          dnstap_output:
+            output_type: file
+            output_file: /var/log/named/dnstap.log
+            size: 20m
+            versions: 3
+            suffix: increment
+          dnstap_identity: dns-server-01
+          dnstap_version: 9.20
+          # Note: BIND9 9.20 automatically enables glue-cache, keep-response-order, reuse
+          # These options are removed in 9.20 and should not be configured
+          # Removed options (9.18 compatibility note):
+          # - alt_transfer_source (use TLS instead)
+          # - auto_dnssec (automatic in 9.20)
+          # - glue_cache (always enabled in 9.20)
+        logging:
+          channels:
+            - name: default_log
+              file:
+                name: /var/log/named/default.log
+              severity: info
+              print_time: true
+              print_severity: true
+              print_category: true
+            - name: security_log
+              file:
+                name: /var/log/named/security.log
+              severity: dynamic
+              print_time: true
+              print_severity: true
+              print_category: true
+            - name: query_log
+              file:
+                name: /var/log/named/queries.log
+                versions: 5
+                size: 10m
+              severity: info
+              print_time: true
+            - name: dnssec_log
+              file:
+                name: /var/log/named/dnssec.log
+              severity: debug
+              print_time: true
+              print_severity: true
+            - name: rate_limit_log
+              syslog: daemon
+              severity: warning
+          categories:
+            - name: default
+              channels:
+                - default_log
+            - name: general
+              channels:
+                - default_log
+            - name: security
+              channels:
+                - security_log
+            - name: queries
+              channels:
+                - query_log
+            - name: dnssec
+              channels:
+                - dnssec_log
+            - name: rate-limit
+              channels:
+                - rate_limit_log
+      - name: named.conf.local
+        tls:
+          - name: censurfridns-anycast
+            remote_hostname: anycast.uncensoreddns.org
+          - name: censurfridns-unicast
+            remote_hostname: unicast.uncensoreddns.org
+        zones:
+          - name: example.internal
+            type: forward
+            forward: only
+            forwarders:
+              - 10.0.0.53
+              - 10.0.0.54

molecule/bind9-20/molecule.yml

@@ -0,0 +1,22 @@
+---
+# Molecule scenario for BIND9 9.20+ support validation
+# This scenario tests the role with BIND9 9.20 and later feature releases
+# Note: May require ubuntu:24.04 or Debian 13 (Trixie) for 9.20 package availability
+
+driver:
+  name: podman
+platforms:
+  - name: ubuntu-2404-bind920
+    image: docker.io/library/ubuntu:24.04
+    command: /lib/systemd/systemd
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      ALLOW_BROKEN_CONDITIONALS: true
+verifier:
+  name: ansible

molecule/bind9-20/prepare.yml

@@ -0,0 +1,14 @@
+---
+- name: Prepare
+  hosts: all
+  tasks:
+    - name: Update package cache
+      ansible.builtin.apt:
+        update_cache: true
+
+    - name: Install DNS query tools (dnsutils)
+      ansible.builtin.apt:
+        name:
+          - dnsutils
+          - bind9-doc
+        state: present

molecule/bind9-20/verify.yml

@@ -0,0 +1,120 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: true
+  tasks:
+    - name: Check that BIND9 is installed
+      ansible.builtin.package:
+        name: bind9
+        state: present
+      check_mode: true
+      register: __bind9_package_check
+      failed_when: __bind9_package_check is changed
+
+    - name: Check that BIND9 service is running
+      ansible.builtin.service:
+        name: named
+        state: started
+        enabled: true
+      check_mode: true
+      register: __bind9_service_check
+      failed_when: __bind9_service_check is changed
+
+    - name: Check that BIND9 version is 9.20 or later
+      ansible.builtin.command:
+        cmd: named -v
+      register: __bind9_version_check
+      changed_when: false
+      failed_when: false
+
+    - name: Display BIND9 version
+      ansible.builtin.debug:
+        msg: "BIND9 version: {{ __bind9_version_check.stdout }}"
+
+    - name: Check that named.conf.options exists
+      ansible.builtin.stat:
+        path: /etc/bind/named.conf.options
+      register: __options_file
+      failed_when: not __options_file.stat.exists
+
+    - name: Check that named.conf.local exists
+      ansible.builtin.stat:
+        path: /etc/bind/named.conf.local
+      register: __local_file
+      failed_when: not __local_file.stat.exists
+
+    - name: Read named.conf.options content
+      ansible.builtin.slurp:
+        path: /etc/bind/named.conf.options
+      register: __options_content
+
+    - name: Verify forwarders are configured in options
+      ansible.builtin.assert:
+        that:
+          - "'forwarders' in __options_decoded"
+          - "'91.239.100.100' in __options_decoded"
+          - "'forward first' in __options_decoded"
+        fail_msg: Forwarders not properly configured in named.conf.options
+      vars:
+        __options_decoded: "{{ __options_content.content | b64decode }}"
+
+    - name: Read named.conf.local content
+      ansible.builtin.slurp:
+        path: /etc/bind/named.conf.local
+      register: __local_content
+
+    - name: Verify forward zone is configured
+      ansible.builtin.assert:
+        that:
+          - "'zone \"example.internal\"' in __local_decoded"
+          - "'type forward' in __local_decoded"
+          - "'forward only' in __local_decoded"
+        fail_msg: Forward zone not properly configured in named.conf.local
+      vars:
+        __local_decoded: "{{ __local_content.content | b64decode }}"
+
+    - name: Test DNS resolution using localhost
+      ansible.builtin.command:
+        cmd: dig @localhost google.com +short
+      register: __dns_query
+      changed_when: false
+      failed_when: __dns_query.rc != 0
+
+    - name: Verify DNS query returned results
+      ansible.builtin.assert:
+        that:
+          - __dns_query.stdout_lines | length > 0
+        fail_msg: DNS forwarding is not working
+
+    - name: Validate configuration syntax with named-checkconf
+      ansible.builtin.command:
+        cmd: named-checkconf /etc/bind/named.conf
+      register: __named_checkconf
+      changed_when: false
+      failed_when: __named_checkconf.rc != 0
+
+    - name: Check BIND logs for errors
+      ansible.builtin.command:
+        cmd: tail -30 /var/log/named/default.log
+      register: __bind_logs
+      changed_when: false
+
+    - name: Display BIND logs
+      ansible.builtin.debug:
+        msg: "BIND logs:\n{{ __bind_logs.stdout }}"
+
+    - name: Verify no critical errors in logs
+      ansible.builtin.shell: |
+        set -o pipefail
+        if grep -i "error" /var/log/named/default.log | grep -v "error reporting" > /dev/null; then
+          exit 1
+        fi
+      changed_when: false
+      failed_when: false
+      register: __error_check
+
+    - name: Assert no critical errors found
+      ansible.builtin.assert:
+        that:
+          - __error_check.rc == 0
+        fail_msg: Found critical errors in BIND logs

molecule/default/converge.yml

@@ -1,19 +1,10 @@
 ---
 - name: Converge
   hosts: all
-  tasks:
+  roles:
-    - name: Create log directory for BIND
+    - ansible-bind9-role
-      ansible.builtin.file:
-        path: /var/log/named
-        state: directory
-        mode: '0755'
-        owner: bind
-        group: bind
-
-    - name: Include bind9 role
-      ansible.builtin.include_role:
-        name: ../../../ansible-bind9-role  # noqa: role-name[path]
   vars:
+    bind9_log_dir: /var/log/named
     bind9_backup_config: false
     bind9_host_config:
       - name: named.conf.options
@@ -113,3 +104,14 @@
             forwarders:
               - 10.0.0.53
               - 10.0.0.54
+
+- name: Post-converge
+  hosts: all
+  tasks:
+    - name: Create log directory for BIND
+      ansible.builtin.file:
+        path: /var/log/named
+        state: directory
+        mode: '0750'
+        owner: bind
+        group: bind

molecule/default/molecule.yml

@@ -11,6 +11,8 @@ platforms:
     cgroupns_mode: host
 provisioner:
   name: ansible
+  env:
+    ANSIBLE_ROLES_PATH: ${MOLECULE_PROJECT_DIRECTORY}/..
   config_options:
     defaults:
       ALLOW_BROKEN_CONDITIONALS: true

molecule/default/verify.yml

@@ -41,7 +41,8 @@
       ansible.builtin.assert:
         that:
           - "'forwarders' in __options_decoded"
-          - "'8.8.8.8' in __options_decoded"
+          - "'91.239.100.100' in __options_decoded"
+          - "'89.233.43.71' in __options_decoded"
           - "'forward first' in __options_decoded"
         fail_msg: Forwarders not properly configured in named.conf.options
       vars:

tasks/main.yml

@@ -18,6 +18,17 @@
     mode: "0750"
   when: bind9_backup_config is defined and bind9_backup_config | bool
 
+- name: Ensure logging directory exists if defined
+  ansible.builtin.file:
+    path: "{{ bind9_log_dir }}"
+    state: directory
+    owner: bind
+    group: bind
+    mode: "0750"
+  when:
+    - bind9_log_dir is defined
+    - bind9_log_dir is not none
+
 - name: Deploy and Validate Configuration
   tags:
     - bind9
@@ -34,6 +45,7 @@
         owner: root
         group: bind
         mode: "0640"
+      when: bind9_backup_config | bool
       changed_when: false
       failed_when: false # It's okay if the file doesn't exist yet
       loop: "{{ bind9_config }}"
@@ -85,6 +97,7 @@
       loop: "{{ bind9_config }}"
       loop_control:
         label: "{{ item.name }}"
+      changed_when: false
       when: bind9_backup_config | bool is false
 
 - name: Ensure the named service is started