diff --git a/common/shlibs b/common/shlibs
index 2d0e75a4b27..bf6858b6e52 100644
--- a/common/shlibs
+++ b/common/shlibs
@@ -976,7 +976,7 @@ libtirpc.so.1 libtirpc-0.2.2_1
 librpcsecgss.so.3 librpcsecgss-0.19_1
 libnfsidmap.so.0 libnfsidmap-0.24_1
 liblwres.so.141 bind-libs-9.10.2P3_2
-libdns.so.162 bind-libs-9.10.3P2_1
+libdns.so.164 bind-libs-9.10.4_1
 libbind9.so.140 bind-libs-9.10.2P3_2
 libisccfg.so.140 bind-libs-9.10.2P3_2
 libisc.so.160 bind-libs-9.10.3_1
diff --git a/srcpkgs/bind/patches/libressl.patch b/srcpkgs/bind/patches/libressl.patch
deleted file mode 100644
index 807a17f3ae6..00000000000
--- a/srcpkgs/bind/patches/libressl.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-$OpenBSD: patch-lib_dns_dst_openssl_h,v 1.1 2015/09/16 15:28:16 sthen Exp $
---- lib/dns/dst_openssl.h.orig	Wed Sep 16 14:00:47 2015
-+++ lib/dns/dst_openssl.h	Wed Sep 16 14:02:42 2015
-@@ -36,7 +36,7 @@
- #define USE_ENGINE 1
- #endif
- 
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- /*
-  * These are new in OpenSSL 1.1.0.  BN_GENCB _cb needs to be declared in
-  * the function like this before the BN_GENCB_new call:
-$OpenBSD: patch-lib_dns_openssl_link_c,v 1.1 2015/09/16 15:28:16 sthen Exp $
---- lib/dns/openssl_link.c.orig	Wed Sep 16 14:01:23 2015
-+++ lib/dns/openssl_link.c	Wed Sep 16 14:01:46 2015
-@@ -88,7 +88,7 @@ entropy_getpseudo(unsigned char *buf, int num) {
- 	return (result == ISC_R_SUCCESS ? 1 : -1);
- }
- 
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- static void
- entropy_add(const void *buf, int num, double entropy) {
- 	/*
-@@ -121,7 +121,7 @@ lock_callback(int mode, int type, const char *file, in
- 		UNLOCK(&locks[type]);
- }
- 
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- static unsigned long
- id_callback(void) {
- 	return ((unsigned long)isc_thread_self());
-@@ -187,7 +187,7 @@ dst__openssl_init(const char *engine) {
- 	if (result != ISC_R_SUCCESS)
- 		goto cleanup_mutexalloc;
- 	CRYPTO_set_locking_callback(lock_callback);
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	CRYPTO_set_id_callback(id_callback);
- #endif
- 
-@@ -287,7 +287,7 @@ dst__openssl_destroy(void) {
- 	CRYPTO_cleanup_all_ex_data();
- #endif
- 	ERR_clear_error();
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	ERR_remove_state(0);
- #endif
- 	ERR_free_strings();
-$OpenBSD: patch-lib_dns_openssldh_link_c,v 1.1 2015/09/16 15:28:16 sthen Exp $
---- lib/dns/openssldh_link.c.orig	Wed Sep 16 14:01:23 2015
-+++ lib/dns/openssldh_link.c	Wed Sep 16 14:02:06 2015
-@@ -173,7 +173,7 @@ openssldh_generate(dst_key_t *key, int generator, void
- 	DH *dh = NULL;
- #if OPENSSL_VERSION_NUMBER > 0x00908000L
- 	BN_GENCB *cb;
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	BN_GENCB _cb;
- #endif
- 	union {
-@@ -210,7 +210,7 @@ openssldh_generate(dst_key_t *key, int generator, void
- 		if (dh == NULL)
- 			return (dst__openssl_toresult(ISC_R_NOMEMORY));
- 		cb = BN_GENCB_new();
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- 		if (cb == NULL) {
- 			DH_free(dh);
- 			return (dst__openssl_toresult(ISC_R_NOMEMORY));
-$OpenBSD: patch-lib_dns_openssldsa_link_c,v 1.1 2015/09/16 15:28:16 sthen Exp $
---- lib/dns/openssldsa_link.c.orig	Wed Sep 16 14:01:23 2015
-+++ lib/dns/openssldsa_link.c	Wed Sep 16 14:02:22 2015
-@@ -359,7 +359,7 @@ openssldsa_generate(dst_key_t *key, int unused, void (
- 	isc_result_t result;
- #if OPENSSL_VERSION_NUMBER > 0x00908000L
- 	BN_GENCB *cb;
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	BN_GENCB _cb;
- #endif
- 	union {
-@@ -383,7 +383,7 @@ openssldsa_generate(dst_key_t *key, int unused, void (
- 	if (dsa == NULL)
- 		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
- 	cb = BN_GENCB_new();
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- 	if (cb == NULL) {
- 		DSA_free(dsa);
- 		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-$OpenBSD: patch-lib_dns_opensslrsa_link_c,v 1.1 2015/09/16 15:28:16 sthen Exp $
---- lib/dns/opensslrsa_link.c.orig	Wed Sep 16 14:01:23 2015
-+++ lib/dns/opensslrsa_link.c	Wed Sep 16 14:02:31 2015
-@@ -771,7 +771,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*ca
- 	} u;
- 	RSA *rsa = RSA_new();
- 	BIGNUM *e = BN_new();
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	BN_GENCB _cb;
- #endif
- 	BN_GENCB *cb = BN_GENCB_new();
diff --git a/srcpkgs/bind/template b/srcpkgs/bind/template
index ddd59c5dc9e..ec3808c760a 100644
--- a/srcpkgs/bind/template
+++ b/srcpkgs/bind/template
@@ -1,24 +1,35 @@
 # Template file for 'bind'
 pkgname=bind
-_distver=9.10.3
-_patchver=P4
+_distver=9.10.4
+_patchver=
 version="${_distver}${_patchver}"
-revision=2
+revision=1
 wrksrc="${pkgname}-${_distver}${_patchver:+-${_patchver}}"
 short_desc="Berkeley Internet Name Domain server"
 maintainer="Juan RP <xtraeme@voidlinux.eu>"
 license="ISC"
 homepage="http://www.isc.org/software/bind/"
 distfiles="http://ftp.isc.org/isc/bind9/${_distver}${_patchver:+-${_patchver}}/bind-${_distver}${_patchver:+-${_patchver}}.tar.gz"
-checksum=2ac044b5fbdf45fb45107af0df961b3b7cb5262a3bf1948ed3fe7a170dd13e3e
+checksum=f8d412b38d5ac390275b943bde69f4608f67862a45487ec854b30e4448fcb056
+
+build_options="geoip seccomp"
+build_options_default="geoip"
+
+if [ -z "$CROSS_BUILD" ]; then
+	build_options_default+=" seccomp"
+fi
 
 build_style=gnu-configure
 configure_args="--disable-static --enable-threads --enable-largefile
  --with-libtool --enable-atomic --sysconfdir=/etc/named --enable-epoll
- --enable-ipv6 --with-randomdev=/dev/urandom --with-ecdsa=yes --with-libtool
- --with-openssl=${XBPS_CROSS_BASE}/usr --without-gssapi --without-gost"
+ --enable-ipv6 --with-randomdev=/dev/random --with-ecdsa=yes --with-libtool
+ --with-openssl=${XBPS_CROSS_BASE}/usr --without-gssapi --without-gost
+ --enable-openssl-hash --with-readline --with-tuning=default
+ --enable-fetchlimit --enable-sit $(vopt_enable seccomp)
+ $(vopt_if geoip "--with-geoip=${XBPS_CROSS_BASE}/usr" "--without-geoip")"
 hostmakedepends="automake libtool perl"
-makedepends="libressl-devel libxml2-devel libcap-devel readline-devel"
+makedepends="libressl-devel libxml2-devel libcap-devel readline-devel
+ $(vopt_if geoip geoip-devel) $(vopt_if seccomp libseccomp-devel)"
 conf_files="/etc/named/named.conf"
 system_accounts="named"
 named_descr="BIND DNS server"