Prereq: "3.3.8"
diff -ur --new-file /var/tmp/postfix-3.3.8/src/global/mail_version.h ./src/global/mail_version.h
--- /var/tmp/postfix-3.3.8/src/global/mail_version.h	2020-03-12 11:01:19.000000000 -0400
+++ ./src/global/mail_version.h	2020-04-18 11:39:21.000000000 -0400
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20200312"
-#define MAIL_VERSION_NUMBER	"3.3.8"
+#define MAIL_RELEASE_DATE	"20200418"
+#define MAIL_VERSION_NUMBER	"3.3.9"
 
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
diff -ur --new-file /var/tmp/postfix-3.3.8/HISTORY ./HISTORY
--- /var/tmp/postfix-3.3.8/HISTORY	2020-03-12 10:56:46.000000000 -0400
+++ ./HISTORY	2020-04-18 13:45:19.000000000 -0400
@@ -23555,3 +23555,17 @@
 	multi-Milter configuration during MAIL FROM. Milter client
 	state was not properly reset after one of the Milters failed.
 	Reported by WeiYu Wu.
+
+20200416
+
+	Workaround for broken builds after an incompatible change
+	in GCC 10. Files: makedefs, Makefile.in.
+
+	Workaround for broken DANE support after an incompatible
+	change in GLIBC 2.31. This avoids the need for new options
+	in /etc/resolv.conf. Files: dns/dns.h, dns/dns_lookup.c.
+
+20200418
+
+	Bitrot: LINUX5, GLIBC resolver flags. Files: makedefs,
+	util/sys_defs.h, dns/dns_str_resflags.c.
diff -ur --new-file /var/tmp/postfix-3.3.8/Makefile.in ./Makefile.in
--- /var/tmp/postfix-3.3.8/Makefile.in	2016-12-04 12:25:40.000000000 -0500
+++ ./Makefile.in	2020-04-18 11:39:21.000000000 -0400
@@ -1,5 +1,5 @@
 SHELL	= /bin/sh
-WARN    = -Wmissing-prototypes -Wformat -Wno-comment
+WARN    = -Wmissing-prototypes -Wformat -Wno-comment -fcommon
 OPTS	= 'WARN=$(WARN)'
 DIRS	= src/util src/global src/dns src/tls src/xsasl src/master src/milter \
 	src/postfix src/fsstone src/smtpstone \
diff -ur --new-file /var/tmp/postfix-3.3.8/makedefs ./makedefs
--- /var/tmp/postfix-3.3.8/makedefs	2018-02-03 12:20:46.000000000 -0500
+++ ./makedefs	2020-04-18 13:13:16.000000000 -0400
@@ -546,7 +546,7 @@
 		: ${SHLIB_ENV="LD_LIBRARY_PATH=`pwd`/lib"}
 		: ${PLUGIN_LD="${CC-gcc} -shared"}
 		;;
-  Linux.[34].*)	SYSTYPE=LINUX$RELEASE_MAJOR
+ Linux.[345].*)	SYSTYPE=LINUX$RELEASE_MAJOR
 		case "$CCARGS" in
 		 *-DNO_DB*) ;;
 		 *-DHAS_DB*) ;;
@@ -1123,7 +1123,7 @@
 : ${CC=gcc} ${OPT='-O'} ${DEBUG='-g'} ${AWK=awk} \
 ${WARN='-Wall -Wno-comment -Wformat -Wimplicit -Wmissing-prototypes \
 	-Wparentheses -Wstrict-prototypes -Wswitch -Wuninitialized \
-	-Wunused -Wno-missing-braces'}
+	-Wunused -Wno-missing-braces -fcommon'}
 
 # Extract map type names from -DHAS_XXX compiler options.  We avoid
 # problems with tr(1) range syntax by using enumerations instead,
diff -ur --new-file /var/tmp/postfix-3.3.8/src/dns/dns.h ./src/dns/dns.h
--- /var/tmp/postfix-3.3.8/src/dns/dns.h	2017-12-27 17:29:44.000000000 -0500
+++ ./src/dns/dns.h	2020-04-18 11:39:21.000000000 -0400
@@ -59,6 +59,7 @@
  */
 #ifdef NO_DNSSEC
 #undef RES_USE_DNSSEC
+#undef RES_TRUSTAD
 #endif
 
  /*
@@ -70,6 +71,9 @@
 #ifndef RES_USE_EDNS0
 #define RES_USE_EDNS0	0
 #endif
+#ifndef RES_TRUSTAD
+#define RES_TRUSTAD	0
+#endif
 
  /*-
   * TLSA: https://tools.ietf.org/html/rfc6698#section-7.1
diff -ur --new-file /var/tmp/postfix-3.3.8/src/dns/dns_lookup.c ./src/dns/dns_lookup.c
--- /var/tmp/postfix-3.3.8/src/dns/dns_lookup.c	2019-12-15 11:09:52.000000000 -0500
+++ ./src/dns/dns_lookup.c	2020-04-18 11:39:21.000000000 -0400
@@ -116,6 +116,9 @@
 /*	Request DNSSEC validation. This flag is silently ignored
 /*	when the system stub resolver API, resolver(3), does not
 /*	implement DNSSEC.
+/*	Automatically turns on the RES_TRUSTAD flag on systems that
+/*	support this flag (this behavior will be more configurable
+/*	in a later release).
 /* .RE
 /* .IP lflags
 /*	Flags that control the operation of the dns_lookup*()
@@ -453,10 +456,10 @@
     /*
      * Set extra options that aren't exposed to the application.
      */
-#define XTRA_FLAGS (RES_USE_EDNS0)
+#define XTRA_FLAGS (RES_USE_EDNS0 | RES_TRUSTAD)
 
     if (flags & RES_USE_DNSSEC)
-	flags |= RES_USE_EDNS0;
+	flags |= (RES_USE_EDNS0 | RES_TRUSTAD);
 
     /*
      * Save and restore resolver options that we overwrite, to avoid
diff -ur --new-file /var/tmp/postfix-3.3.8/src/dns/dns_str_resflags.c ./src/dns/dns_str_resflags.c
--- /var/tmp/postfix-3.3.8/src/dns/dns_str_resflags.c	2016-05-15 11:20:14.000000000 -0400
+++ ./src/dns/dns_str_resflags.c	2020-04-18 13:19:16.000000000 -0400
@@ -60,10 +60,16 @@
     "RES_DEFNAMES", RES_DEFNAMES,
     "RES_STAYOPEN", RES_STAYOPEN,
     "RES_DNSRCH", RES_DNSRCH,
+#ifdef RES_INSECURE1
     "RES_INSECURE1", RES_INSECURE1,
+#endif
+#ifdef RES_INSECURE2
     "RES_INSECURE2", RES_INSECURE2,
+#endif
     "RES_NOALIASES", RES_NOALIASES,
+#ifdef RES_USE_INET6
     "RES_USE_INET6", RES_USE_INET6,
+#endif
 #ifdef RES_ROTATE
     "RES_ROTATE", RES_ROTATE,
 #endif
diff -ur --new-file /var/tmp/postfix-3.3.8/src/util/sys_defs.h ./src/util/sys_defs.h
--- /var/tmp/postfix-3.3.8/src/util/sys_defs.h	2017-06-18 15:30:20.000000000 -0400
+++ ./src/util/sys_defs.h	2020-04-18 13:16:03.000000000 -0400
@@ -748,7 +748,7 @@
  /*
   * LINUX.
   */
-#if defined(LINUX2) || defined(LINUX3) || defined(LINUX4)
+#if defined(LINUX2) || defined(LINUX3) || defined(LINUX4) || defined(LINUX5)
 #define SUPPORTED
 #define UINT32_TYPE	unsigned int
 #define UINT16_TYPE	unsigned short