diff --git a/go.mod b/go.mod
index b4c8ea97f7..e7cef0957f 100644
--- a/go.mod
+++ b/go.mod
@@ -5,7 +5,7 @@ go 1.25.0
 exclude google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1
 
 require (
-	codeberg.org/miekg/dns v0.6.49
+	codeberg.org/miekg/dns v0.6.52
 	github.com/BurntSushi/toml v1.6.0
 	github.com/VividCortex/ewma v1.2.0
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
diff --git a/go.sum b/go.sum
index 95dd0d45f7..69ca76361b 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-codeberg.org/miekg/dns v0.6.49 h1:2rS0XXCFU4TdJLjyOHHRLNbPt+SRy6ItxXTIQUfIJ2o=
-codeberg.org/miekg/dns v0.6.49/go.mod h1:fIxAzBMDPnXWSw0fp8+pfZMRiAqYY4+HHYLzUo/S6Dg=
+codeberg.org/miekg/dns v0.6.52 h1:eOYbzjeTAfS2X6ucnVEhKdORr9WyO93wazFo7cfj+OY=
+codeberg.org/miekg/dns v0.6.52/go.mod h1:fIxAzBMDPnXWSw0fp8+pfZMRiAqYY4+HHYLzUo/S6Dg=
 github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
diff --git a/vendor/codeberg.org/miekg/dns/README.md b/vendor/codeberg.org/miekg/dns/README.md
index 77d9d46d75..9cf4ab0411 100644
--- a/vendor/codeberg.org/miekg/dns/README.md
+++ b/vendor/codeberg.org/miekg/dns/README.md
@@ -1,5 +1,5 @@
-[![Go Report Card](https://goreportcard.com/badge/codeberg.org/miekg/dns)](https://goreportcard.com/report/codeberg.org/miekg/dns)
 [![Go Doc](https://godoc.org/coreberg.org/miekg/dns?status.svg)](https://godoc.org/codeberg.org/miekg/dns)
+[![Build Status](https://codeberg.org/miekg/dns/badges/workflows/build.yaml/badge.svg)](https://codeberg.org/miekg/dns)
 
 # Even more alternative approach to a DNS library (version 2)
 
@@ -25,7 +25,7 @@ production ready name server. Because of these we are depending on a lot more ex
 point these servers will be split off.
 
 This new version will not soon see a v1.0.0 release because I want to be able to still make changes. In a
-year or two (2028?) when things have stablized it will be blessed with a v1.0.0.
+year or two (2028?) when things have stabilized it will be blessed with a v1.0.0.
 
 # Porting From v1
 
@@ -33,6 +33,14 @@ Everything from <https://github.com/miekg/dns> works. See
 [README-v1-to-v2.md](https://codeberg.org/miekg/dns/src/branch/main/_doc/README-v1-to-v2.md)
 for the differences, if you are porting your application.
 
+## Performance
+
+dnsv2's performance should be roughly 2x across the board compared to v1 (also see below).
+
+- Serving DNS queries per second is \~2x (maybe more).
+- Parsing zones files in RRs per second is \~1.5x.
+- Memory usage can be \~0.5x due to rdata split off.
+
 For developers please read the
 [developer README](https://codeberg.org/miekg/dns/src/branch/main/_doc/README-dev.md).
 
@@ -42,7 +50,7 @@ For developers please read the
 - Everything is a resource record, EDNS0 pseudo RRs included.
   - Easy way to access RR's header and resource data (rdata).
 - Small API.
-  - Package _dnsutil_ contains functions that help programmers, but are not nessecarily in scope the the
+  - Package _dnsutil_ contains functions that help programmers, but are not necessarily in scope the the
     _dns_ package.
   - Package _dnstest_ contains functions and types that help you test, similar to the _httptest_ package.
   - Package _svcb_ holds all details of the SVCB/HTTPS record.
@@ -55,7 +63,7 @@ For developers please read the
     - On my Dell XPS 17 (Intel) it is similar-ish (~300K/240K qps UDP/TCP).
     - On other Intel/AMD hardware it is lower (~200K (UDP) qps) - yet to understand why.
   - See `cmd/reflect` and do a `go build; make new.txt` to redo the performance test. Requires `dnsperf` to be installed.
-  - The SE zone (8M RRs) is parsed in \~18s (\~440K RR/s), the CH zones (15M RRs) is parsed in \~21s (\~ 650K
+  - The SE zone (8M RRs) is parsed in \~18s (\~440K RR/s), the CH zones (15M RRs) is parsed in \~21s (\~650K
     RRs). The main difference being that SE use algorithm 8, and CH algorithm 13 (shorter RRSIGs).
     See `cmd/parse`, tested with M2/Asahi Linux.
 
diff --git a/vendor/codeberg.org/miekg/dns/deleg/zdnsutil.go b/vendor/codeberg.org/miekg/dns/deleg/zdnsutil.go
index 5f169c5ea0..e79011a5e2 100644
--- a/vendor/codeberg.org/miekg/dns/deleg/zdnsutil.go
+++ b/vendor/codeberg.org/miekg/dns/deleg/zdnsutil.go
@@ -186,8 +186,8 @@ func dnsutilStringToTime(s string) (uint32, error) {
 	if err != nil {
 		return 0, err
 	}
-	mod := max(t.Unix()/maxSerialIncrement-1, 0)
-	return uint32(t.Unix() - mod*maxSerialIncrement), nil
+	mod := max(t/maxSerialIncrement-1, 0)
+	return uint32(t - mod*maxSerialIncrement), nil
 }
 
 // Absolute takes the name and origin and appends the origin to the name. This takes the 1035 presentation
diff --git a/vendor/codeberg.org/miekg/dns/edns_types.go b/vendor/codeberg.org/miekg/dns/edns_types.go
index 1771c04859..8abe053df9 100644
--- a/vendor/codeberg.org/miekg/dns/edns_types.go
+++ b/vendor/codeberg.org/miekg/dns/edns_types.go
@@ -61,7 +61,7 @@ func (o *LLQ) String() string {
 //
 // This record must be put in the pseudo section.
 type REPORTING struct {
-	AgentDomain string
+	AgentDomain string `dns:"domain-name"`
 }
 
 func (o *REPORTING) Len() int    { return tlv + len(o.AgentDomain) }
@@ -246,13 +246,8 @@ func (o *N3U) String() string {
 //
 // This record must be put in the pseudo section.
 type TCPKEEPALIVE struct {
-	// Timeout is an idle timeout value for the TCP connection, specified in
-	// units of 100 milliseconds, encoded in network byte order. If set to 0,
-	// pack will return a nil slico.
+	// Timeout is an idle timeout value for the TCP connection, specified in units of 100 milliseconds
 	Timeout uint16
-	// Length is the option's length.
-	// Deprecated: this field is deprecated and is always equal to 0.
-	Length uint16
 }
 
 func (o *TCPKEEPALIVE) Len() int {
@@ -397,6 +392,30 @@ func (o *ZONEVERSION) String() string {
 	return s
 }
 
+// ERFC3597 is used to represent unknown EDNS0 options.
+type ERFC3597 struct {
+	EDNS0Code uint16 `dns:"-"`
+	Code      string `dns:"hex"`
+}
+
+func (o *ERFC3597) Len() int    { return tlv + len(o.Code)/2 }
+func (o *ERFC3597) Data() RDATA { return o }
+func (o *ERFC3597) String() string {
+	sb := builderPool.Get()
+	sb.WriteByte('.')
+	sb.WriteByte('\t')
+	sb.WriteByte('\t') // skip TTL
+	sb.WriteString(classToString(o.Header().Class))
+	sb.WriteByte('\t')
+	sb.WriteString(codeToString(o.EDNS0Code))
+	sb.WriteByte('\t')
+
+	sprintData(&sb, `\#`, strconv.Itoa(len(o.Code)/2), o.Code)
+	s := sb.String()
+	builderPool.Put(sb)
+	return s
+}
+
 // Extended DNS Error Codes (RFC 8914). These are used in the [EDE] pseudo RR.
 const (
 	ExtendedErrorOther uint16 = iota
@@ -501,6 +520,8 @@ func unpackOptionCode(option EDNS0, s *cryptobyte.String) error {
 		return x.unpack(s)
 	case *ZONEVERSION:
 		return x.unpack(s)
+	case *ERFC3597:
+		return x.unpack(s)
 	}
 	if x, ok := option.(Packer); ok {
 		msg := []byte(*s)
@@ -539,6 +560,8 @@ func packOptionCode(option EDNS0, msg []byte, off int) (int, error) {
 		return x.pack(msg, off)
 	case *ZONEVERSION:
 		return x.pack(msg, off)
+	case *ERFC3597:
+		return x.pack(msg, off)
 	}
 	if x, ok := option.(Packer); ok {
 		return x.Pack(msg, off)
diff --git a/vendor/codeberg.org/miekg/dns/internal/dnsstring/strconv.go b/vendor/codeberg.org/miekg/dns/internal/dnsstring/strconv.go
index 20a07de391..b39d81f041 100644
--- a/vendor/codeberg.org/miekg/dns/internal/dnsstring/strconv.go
+++ b/vendor/codeberg.org/miekg/dns/internal/dnsstring/strconv.go
@@ -30,9 +30,9 @@ func AtoiUint32(s string) (uint32, error) {
 	return uint32(i), err
 }
 
-func ToTime(s string) (time.Time, error) {
+func ToTime(s string) (int64, error) {
 	if len(s) != 14 {
-		return time.Time{}, errors.New("timestamp must be exactly 14 characters")
+		return 0, errors.New("timestamp must be exactly 14 characters")
 	}
 	digit := func(b byte) int { return int(b - '0') }
 
@@ -47,8 +47,8 @@ func ToTime(s string) (time.Time, error) {
 		month < 1 || month > 12 ||
 		day < 1 || day > 31 ||
 		hour > 23 || minute > 59 || second > 59 {
-		return time.Time{}, errors.New("timestamp contains out-of-range values")
+		return 0, errors.New("timestamp contains out-of-range values")
 	}
 
-	return time.Date(year, time.Month(month), day, hour, minute, second, 0, time.UTC), nil
+	return time.Date(year, time.Month(month), day, hour, minute, second, 0, time.UTC).Unix(), nil
 }
diff --git a/vendor/codeberg.org/miekg/dns/optpack.go b/vendor/codeberg.org/miekg/dns/optpack.go
index dcb3805aa7..32caee13dc 100644
--- a/vendor/codeberg.org/miekg/dns/optpack.go
+++ b/vendor/codeberg.org/miekg/dns/optpack.go
@@ -22,7 +22,7 @@ func unpackOPT(s *cryptobyte.String) ([]EDNS0, error) {
 		if newFn, ok := CodeToRR[code]; ok {
 			option = newFn()
 		} else {
-			return nil, unpack.Errorf("unknown OPT code %d", code)
+			option = &ERFC3597{EDNS0Code: code}
 		}
 		if err := unpackOptionCode(option, &data); err != nil {
 			return nil, err
@@ -38,9 +38,14 @@ func packOPT(options []EDNS0, msg []byte, off int) (int, error) {
 		if off+l >= len(msg) {
 			return len(msg), pack.ErrBuf
 		}
-		code := RRToCode(options[i]) // TODO(miek): Use Coder for externally supplied option code
+		code := RRToCode(options[i])
 		if code == CodeNone {
-			return len(msg), fmt.Errorf("unknown option code seen")
+			if erfc3597, ok := options[i].(*ERFC3597); ok {
+				code = erfc3597.EDNS0Code
+			} else {
+				// really the last option
+				return len(msg), fmt.Errorf("unknown option code")
+			}
 		}
 
 		pack.Uint16(code, msg, off)
diff --git a/vendor/codeberg.org/miekg/dns/rdata/string.go b/vendor/codeberg.org/miekg/dns/rdata/string.go
index c46137619e..335f5ece49 100644
--- a/vendor/codeberg.org/miekg/dns/rdata/string.go
+++ b/vendor/codeberg.org/miekg/dns/rdata/string.go
@@ -399,7 +399,7 @@ func (rd TKEY) String() string {
 
 func (rd RFC3597) String() string {
 	sb := builderPool.Get()
-	sprintData(&sb, strconv.Itoa(len(rd.Data)/2), rd.Data)
+	sprintData(&sb, `\#`, strconv.Itoa(len(rd.Data)/2), rd.Data)
 	s := sb.String()
 	builderPool.Put(sb)
 	return s
diff --git a/vendor/codeberg.org/miekg/dns/rdata/zdnsutil.go b/vendor/codeberg.org/miekg/dns/rdata/zdnsutil.go
index d489908b5b..5db7df4570 100644
--- a/vendor/codeberg.org/miekg/dns/rdata/zdnsutil.go
+++ b/vendor/codeberg.org/miekg/dns/rdata/zdnsutil.go
@@ -186,8 +186,8 @@ func dnsutilStringToTime(s string) (uint32, error) {
 	if err != nil {
 		return 0, err
 	}
-	mod := max(t.Unix()/maxSerialIncrement-1, 0)
-	return uint32(t.Unix() - mod*maxSerialIncrement), nil
+	mod := max(t/maxSerialIncrement-1, 0)
+	return uint32(t - mod*maxSerialIncrement), nil
 }
 
 // Absolute takes the name and origin and appends the origin to the name. This takes the 1035 presentation
diff --git a/vendor/codeberg.org/miekg/dns/response.go b/vendor/codeberg.org/miekg/dns/response.go
index 1485f0b9ae..5c2b46c609 100644
--- a/vendor/codeberg.org/miekg/dns/response.go
+++ b/vendor/codeberg.org/miekg/dns/response.go
@@ -65,6 +65,8 @@ func (w *response) LocalAddr() net.Addr {
 		return sock.LocalAddr()
 	case *tls.Conn:
 		return sock.LocalAddr()
+	case *net.UnixConn:
+		return sock.LocalAddr()
 	default:
 		panic("dns: internal error: no sock 🧦 in response")
 	}
@@ -82,6 +84,8 @@ func (w *response) RemoteAddr() net.Addr {
 		return sock.RemoteAddr()
 	case *tls.Conn:
 		return sock.RemoteAddr()
+	case *net.UnixConn:
+		return sock.RemoteAddr()
 	default:
 		panic("dns: internal error: no sock 🧦 in response")
 	}
diff --git a/vendor/codeberg.org/miekg/dns/scan.go b/vendor/codeberg.org/miekg/dns/scan.go
index 28a70273ff..9674895e74 100644
--- a/vendor/codeberg.org/miekg/dns/scan.go
+++ b/vendor/codeberg.org/miekg/dns/scan.go
@@ -713,8 +713,8 @@ func stringToTTL(token string) (uint32, bool) {
 	}
 
 	var s, i uint
-	for _, c := range token {
-		switch c {
+	for j := range token {
+		switch token[j] {
 		case 's', 'S':
 			s += i
 			i = 0
@@ -732,7 +732,7 @@ func stringToTTL(token string) (uint32, bool) {
 			i = 0
 		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
 			i *= 10
-			i += uint(c) - '0'
+			i += uint(token[j]) - '0'
 		default:
 			return 0, false
 		}
diff --git a/vendor/codeberg.org/miekg/dns/svcb/zdnsutil.go b/vendor/codeberg.org/miekg/dns/svcb/zdnsutil.go
index 6896129123..c904034f39 100644
--- a/vendor/codeberg.org/miekg/dns/svcb/zdnsutil.go
+++ b/vendor/codeberg.org/miekg/dns/svcb/zdnsutil.go
@@ -186,8 +186,8 @@ func dnsutilStringToTime(s string) (uint32, error) {
 	if err != nil {
 		return 0, err
 	}
-	mod := max(t.Unix()/maxSerialIncrement-1, 0)
-	return uint32(t.Unix() - mod*maxSerialIncrement), nil
+	mod := max(t/maxSerialIncrement-1, 0)
+	return uint32(t - mod*maxSerialIncrement), nil
 }
 
 // Absolute takes the name and origin and appends the origin to the name. This takes the 1035 presentation
diff --git a/vendor/codeberg.org/miekg/dns/types.go b/vendor/codeberg.org/miekg/dns/types.go
index e8808198d5..ac46923032 100644
--- a/vendor/codeberg.org/miekg/dns/types.go
+++ b/vendor/codeberg.org/miekg/dns/types.go
@@ -987,9 +987,9 @@ func (rr *RFC3597) String() string {
 	sb.WriteByte('\t')
 	sb.WriteString(strconv.FormatInt(int64(rr.Hdr.TTL), 10))
 	sb.WriteByte('\t')
-	sb.WriteString("CLASS" + strconv.Itoa(int(rr.Hdr.Class)))
+	sb.WriteString(classToString(rr.Header().Class))
 	sb.WriteByte('\t')
-	sb.WriteString("TYPE" + strconv.Itoa(int(rr.RRType)))
+	sb.WriteString(typeToString(rr.RRType))
 	sb.WriteByte('\t')
 
 	sb.WriteString(rr.RFC3597.String())
diff --git a/vendor/codeberg.org/miekg/dns/version.go b/vendor/codeberg.org/miekg/dns/version.go
index 465096f1e2..a8bd2ff562 100644
--- a/vendor/codeberg.org/miekg/dns/version.go
+++ b/vendor/codeberg.org/miekg/dns/version.go
@@ -3,7 +3,7 @@ package dns
 import "fmt"
 
 // Version is current version of this library.
-var Version = v{0, 6, 49}
+var Version = v{0, 6, 52}
 
 type v struct {
 	Major, Minor, Patch int
diff --git a/vendor/codeberg.org/miekg/dns/zclone.go b/vendor/codeberg.org/miekg/dns/zclone.go
index 5e4b469586..ef93ae5e80 100644
--- a/vendor/codeberg.org/miekg/dns/zclone.go
+++ b/vendor/codeberg.org/miekg/dns/zclone.go
@@ -881,7 +881,6 @@ func (rr *N3U) Clone() RR {
 func (rr *TCPKEEPALIVE) Clone() RR {
 	return &TCPKEEPALIVE{
 		rr.Timeout,
-		rr.Length,
 	}
 }
 
@@ -915,6 +914,13 @@ func (rr *ZONEVERSION) Clone() RR {
 	}
 }
 
+func (rr *ERFC3597) Clone() RR {
+	return &ERFC3597{
+		rr.EDNS0Code,
+		rr.Code,
+	}
+}
+
 func (rr *KEEPALIVE) Clone() RR {
 	return &KEEPALIVE{
 		rr.Timeout,
diff --git a/vendor/codeberg.org/miekg/dns/zdnsutil.go b/vendor/codeberg.org/miekg/dns/zdnsutil.go
index c95b00ed88..3effe17743 100644
--- a/vendor/codeberg.org/miekg/dns/zdnsutil.go
+++ b/vendor/codeberg.org/miekg/dns/zdnsutil.go
@@ -186,8 +186,8 @@ func dnsutilStringToTime(s string) (uint32, error) {
 	if err != nil {
 		return 0, err
 	}
-	mod := max(t.Unix()/maxSerialIncrement-1, 0)
-	return uint32(t.Unix() - mod*maxSerialIncrement), nil
+	mod := max(t/maxSerialIncrement-1, 0)
+	return uint32(t - mod*maxSerialIncrement), nil
 }
 
 // Absolute takes the name and origin and appends the origin to the name. This takes the 1035 presentation
diff --git a/vendor/codeberg.org/miekg/dns/zednspack.go b/vendor/codeberg.org/miekg/dns/zednspack.go
index cc6796aba6..d0c2ccbc28 100644
--- a/vendor/codeberg.org/miekg/dns/zednspack.go
+++ b/vendor/codeberg.org/miekg/dns/zednspack.go
@@ -158,7 +158,7 @@ func (o *EDE) pack(msg []byte, off int) (int, error) {
 func (e *REPORTING) unpack(s *cryptobyte.String) (err error) {
 	e.AgentDomain, err = unpack.Name(s, nil) // TODO: unpackNAme with nil buffer, no compression pointers..
 	if err != nil {
-		return unpack.Errorf("overflow REPORTING agent domain")
+		return unpack.Errorf("overflow REPORTING AgentDomain")
 	}
 	return nil
 }
@@ -332,3 +332,12 @@ func (o *ZONEVERSION) unpack(s *cryptobyte.String) (err error) {
 	o.Version = []byte(v)
 	return err
 }
+
+func (o *ERFC3597) pack(msg []byte, off int) (int, error) {
+	return hex.Decode(msg[off:], []byte(o.Code))
+}
+
+func (o *ERFC3597) unpack(s *cryptobyte.String) error {
+	o.Code = hex.EncodeToString(*s)
+	return nil
+}
diff --git a/vendor/codeberg.org/miekg/dns/zednsrr.go b/vendor/codeberg.org/miekg/dns/zednsrr.go
index 982279bb84..056ba36bd8 100644
--- a/vendor/codeberg.org/miekg/dns/zednsrr.go
+++ b/vendor/codeberg.org/miekg/dns/zednsrr.go
@@ -30,6 +30,8 @@ func (o *ESU) Header() *Header          { return &Header{Name: "."} }
 func (o *ESU) Pseudo() bool             { return true }
 func (o *ZONEVERSION) Header() *Header  { return &Header{Name: "."} }
 func (o *ZONEVERSION) Pseudo() bool     { return true }
+func (o *ERFC3597) Header() *Header     { return &Header{Name: "."} }
+func (o *ERFC3597) Pseudo() bool        { return true }
 
 // CodeToRR is a map of constructors for each EDNS0 RR type.
 var CodeToRR = map[uint16]func() EDNS0{
diff --git a/vendor/modules.txt b/vendor/modules.txt
index cb79262d89..440026aea6 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1,4 +1,4 @@
-# codeberg.org/miekg/dns v0.6.49
+# codeberg.org/miekg/dns v0.6.52
 ## explicit; go 1.25.0
 codeberg.org/miekg/dns
 codeberg.org/miekg/dns/deleg