Stuart Cardall authored Jul 19, 2015 and Francesco Colista committed Jul 20, 2015

New feature: public-key based client authentication (-K), for private and
commercial DNS services to securely authenticate the sender of a query no
matter what the source IP address is, without altering the DNS query.