diff --git a/net-dns/bind-tools/Manifest b/net-dns/bind-tools/Manifest
index 7a2ed3e5e1..8d4277ff32 100644
--- a/net-dns/bind-tools/Manifest
+++ b/net-dns/bind-tools/Manifest
@@ -1,6 +1,8 @@
 DIST bind-9.20.20.tar.xz 5802548 BLAKE2B 416593b641ec7de486f474bb4edbe843a2abd18d9a5c12dcd74fd55c4f1d2d89bdacfa32458dd6ecc09e7e601692f9c134459f5c183dabc3f98fa7b5506736e0 SHA512 46cd2983bdf45f65e3f134c5ae13b04b574836839dc6efac701146cf6a216a42ffa84b6f7267596b6b92b391e7845aa055031417053a3ebaa718cfc51db1ada7
 DIST bind-9.20.21.tar.xz 5808576 BLAKE2B 20c2acac40242516da10cc8e45074de3d5d8906e4c4e216f6d69cba0585816aba4ec77adda8142294623eef5b045ec64cc8a18c721ece6af939741903558454b SHA512 f0f566a243268a579a7c97409409699aa66a08e82982d48046c83d9dfd01f8a9c337af7bb80018773667fcc98a5e6fb9f244ac28e72688ab04a494337605c616
 DIST bind-9.20.22.tar.xz 5817248 BLAKE2B 74537646d8c08c4874548b064ab62bab3721d22e2654feed54ea0b61c087018b24f725d0cfaf8298bc71a1be280c753c86449b13e5d9ec26f84ba7e9f61b7a5a SHA512 a23b630fc755977534e3fb8605810495ab8e4817ade93448f93167a38c643b0da6e93b3c2d9e191e99989af446a8aabfa43636120cc6c2a0c653dcd36cb89d07
+DIST bind-9.20.23.tar.xz 5837532 BLAKE2B f4f5526fac2832685204ccc93087df3ce2dd3fbb267a5b68d0cf8074365a8f1d6e7b9ff130b41a023ea8dd96499a361a0396188f0a71a08630c54ec13e63c39a SHA512 fce8a69620c15223e54dd197c09c7b00c165e5e3a5b2f62b241f589be5675c581029cf750caa8ed1f1fcb0faf293df04e77c494c205bab89d6d01153395bf4cb
 DIST bind-9.21.19.tar.xz 5320236 BLAKE2B 1cad37334c7e1b9d879483d7002d3932d5eedb2894a1b4ee4abb6cc7c4d634bd208907e6d0a526cf23fb1e064601d3e0b2b8113a8bde0c19eefb64e1c503e0f4 SHA512 c5d2d9184d56ba8612873d37299febe7196be8cd6aca1de0a93b8bcac3fc774cc2e2feac1ea91c79a3ccb27a735c692e83abd0670d8c2d0880714d37c6a05562
 DIST bind-9.21.20.tar.xz 5328196 BLAKE2B acf1193aa7499bbcb0c883b201aa7eb85a52f7c9b274a5f18a95d7a9ac54ab21b5311a88e6b1cedbf6af15e46832679b90660e2b91a8512d74c85296b1dff7f3 SHA512 4bd65612ff851720eba7f88495d51eb8a41b6a946c377b9dcd62f58f8c5a3e9338af44abc9df76b2ead9461eca4eb81f088619e3cc481f35fa0fc5d0926a93e3
 DIST bind-9.21.21.tar.xz 5346552 BLAKE2B e0639f94ac5e82c2975bda2e85cb8275fb0e9d3e069f944cfa3e72238772fcfdb3f2238bc21baee674709430b7436f0a32911d16ac925e534849e6b1fb7436b6 SHA512 ebb05d1141d38bd1897bb0de1475194ca6e9335e1a295ab388376d880de1a0569279b734433f469565eccdea91cc8e6e3603b2879be700bf27082ff075bdbe49
+DIST bind-9.21.22.tar.xz 5383844 BLAKE2B 17112e87af111ad4c6d8836585cd01c34b43bc581cf8e6f2c5da631d58ae110aaa92d7666480b8c7d9a99609f580e9f56ad4cea9f7aaa73201d11acb0521ca7e SHA512 f9e11d150162661c755dabdd7862c0565e6a10077e2a6aee04f8cefce94c262d8928ff9e42f8c8750242aee3b0992afe2f49f72f0f8cab8b7e4ae1c9fc06e0fa
diff --git a/net-dns/bind-tools/bind-tools-9.20.23.ebuild b/net-dns/bind-tools/bind-tools-9.20.23.ebuild
new file mode 100644
index 0000000000..abcaddf30c
--- /dev/null
+++ b/net-dns/bind-tools/bind-tools-9.20.23.ebuild
@@ -0,0 +1,107 @@
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic toolchain-funcs
+
+DESCRIPTION="bind tools: dig, nslookup, host, nsupdate, dnssec-keygen"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/9.20.23/bind-9.20.23.tar.xz -> bind-9.20.23.tar.xz"
+
+LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
+SLOT="0"
+KEYWORDS="*"
+IUSE="doc gssapi idn ipv6 libedit readline xml"
+# no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
+
+COMMON_DEPEND="
+	dev-libs/libuv:=
+	dev-libs/openssl
+	dev-libs/userspace-rcu
+	sys-libs/libcap
+	xml? ( dev-libs/libxml2 )
+	idn? ( net-dns/libidn2:= )
+	gssapi? ( virtual/krb5 )
+	libedit? ( dev-libs/libedit )
+	!libedit? (
+		readline? ( sys-libs/readline:= )
+	)
+"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	!<=net-dns/bind-9.18.1-r2
+"
+S="${WORKDIR}/bind-9.20.23"
+
+# sphinx required for man-page and html creation
+BDEPEND="
+	doc? ( dev-python/sphinx )
+	virtual/pkgconfig
+"
+
+# bug 479092, requires networking
+RESTRICT="test"
+
+src_prepare() {
+	default
+
+	export LDFLAGS="${LDFLAGS} -L${EPREFIX}/usr/$(get_libdir)"
+
+	# Disable tests for now, bug 406399
+	sed -i '/^SUBDIRS/s:tests::' bin/Makefile.in lib/Makefile.in || die
+
+	# bug #220361
+	rm aclocal.m4 || die
+	rm -rf libtool.m4/ || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--localstatedir="${EPREFIX}"/var
+		--without-json-c
+		--without-zlib
+		--without-lmdb
+		--without-maxminddb
+		--disable-geoip
+		--with-openssl="${ESYSROOT}"/usr
+		$(use_with idn libidn2 "${ESYSROOT}"/usr)
+		$(use_with xml libxml2)
+		$(use_with gssapi)
+		AR="$(type -P $(tc-getAR))"
+	)
+
+	# bug 607400
+	if use libedit ; then
+		myeconfargs+=( --with-readline=libedit )
+	elif use readline ; then
+		myeconfargs+=( --with-readline=readline )
+	else
+		myeconfargs+=( --without-readline )
+	fi
+
+	# bug 344029
+	append-cflags "-DDIG_SIGCHASE"
+
+	# to expose CMSG_* macros from sys/sockets.h
+	[[ ${CHOST} == *-solaris* ]] && append-cflags "-D_XOPEN_SOURCE=600"
+
+	# localstatedir for nsupdate -l, bug 395785
+	tc-export BUILD_CC
+	econf "${myeconfargs[@]}"
+
+	# bug #151839
+	echo '#undef SO_BSDCOMPAT' >> config.h
+}
+
+src_install() {
+	default
+
+	rm -r "${D}"/usr/bin/{arpaname,named*,nsec3hash} || die
+	rm -r "${D}"/usr/{include,sbin} || die
+	rm -r "${D}"/usr/share/man/man*/{arpaname,named,nsec3hash}* || die
+	rm -r "${D}"/usr/share/man/man{5,8} || die
+}
+
+# vim: filetype=ebuild