diff --git a/src/cache.c b/src/cache.c
index 6daaf3e..39f6dbe 100644
--- a/src/cache.c
+++ b/src/cache.c
@@ -26,6 +26,8 @@
 static int bignames_left, hash_size;
 
 static void make_non_terminals(struct crec *source);
+static struct crec *really_insert(char *name, struct all_addr *addr, 
+				  time_t now,  unsigned long ttl, unsigned short flags);
 
 /* type->string mapping: this is also used by the name-hash function as a mixing table. */
 static const struct {
@@ -464,16 +466,10 @@
   new_chain = NULL;
   insert_error = 0;
 }
- 
+
 struct crec *cache_insert(char *name, struct all_addr *addr, 
 			  time_t now,  unsigned long ttl, unsigned short flags)
 {
-  struct crec *new, *target_crec = NULL;
-  union bigname *big_name = NULL;
-  int freed_all = flags & F_REVERSE;
-  int free_avail = 0;
-  unsigned int target_uid;
-  
   /* Don't log DNSSEC records here, done elsewhere */
   if (flags & (F_IPV4 | F_IPV6 | F_CNAME))
     {
@@ -484,7 +480,20 @@
       if (daemon->min_cache_ttl != 0 && daemon->min_cache_ttl > ttl)
 	ttl = daemon->min_cache_ttl;
     }
+  
+  return really_insert(name, addr, now, ttl, flags);
+}
 
+
+static struct crec *really_insert(char *name, struct all_addr *addr, 
+				  time_t now,  unsigned long ttl, unsigned short flags)
+{
+  struct crec *new, *target_crec = NULL;
+  union bigname *big_name = NULL;
+  int freed_all = flags & F_REVERSE;
+  int free_avail = 0;
+  unsigned int target_uid;
+  
   /* if previous insertion failed give up now. */
   if (insert_error)
     return NULL;
@@ -645,12 +654,185 @@
 	  cache_hash(new_chain);
 	  cache_link(new_chain);
 	  daemon->metrics[METRIC_DNS_CACHE_INSERTED]++;
+
+	  /* If we're a child process, send this cache entry up the pipe to the master.
+	     The marshalling process is rather nasty. */
+	  if (daemon->pipe_to_parent != -1)
+	    {
+	      char *name = cache_get_name(new_chain);
+	      ssize_t m = strlen(name);
+	      unsigned short flags = new_chain->flags;
+#ifdef HAVE_DNSSEC
+	      u16 class = new_chain->uid;
+#endif
+	      
+	      read_write(daemon->pipe_to_parent, (unsigned char *)&m, sizeof(m), 0);
+	      read_write(daemon->pipe_to_parent, (unsigned char *)name, m, 0);
+	      read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->ttd, sizeof(new_chain->ttd), 0);
+	      read_write(daemon->pipe_to_parent, (unsigned  char *)&flags, sizeof(flags), 0);
+
+	      if (flags & (F_IPV4 | F_IPV6))
+		read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr, sizeof(new_chain->addr), 0);
+#ifdef HAVE_DNSSEC
+	      else if (flags & F_DNSKEY)
+		{
+		  read_write(daemon->pipe_to_parent, (unsigned char *)&class, sizeof(class), 0);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.algo, sizeof(new_chain->addr.key.algo), 0);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.keytag, sizeof(new_chain->addr.key.keytag), 0);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.flags, sizeof(new_chain->addr.key.flags), 0);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.keylen, sizeof(new_chain->addr.key.keylen), 0);
+		  blockdata_write(new_chain->addr.key.keydata, new_chain->addr.key.keylen, daemon->pipe_to_parent);
+		}
+	      else if (flags & F_DS)
+		{
+		  read_write(daemon->pipe_to_parent, (unsigned char *)&class, sizeof(class), 0);
+		  /* A negative DS entry is possible and has no data, obviously. */
+		  if (!(flags & F_NEG))
+		    {
+		      read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.algo, sizeof(new_chain->addr.ds.algo), 0);
+		      read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.keytag, sizeof(new_chain->addr.ds.keytag), 0);
+		      read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.digest, sizeof(new_chain->addr.ds.digest), 0);
+		      read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.keylen, sizeof(new_chain->addr.ds.keylen), 0);
+		      blockdata_write(new_chain->addr.ds.keydata, new_chain->addr.ds.keylen, daemon->pipe_to_parent);
+		    }
+		}
+#endif
+	      
+	    }
 	}
+      
       new_chain = tmp;
     }
+
+  /* signal end of cache insert in master process */
+  if (daemon->pipe_to_parent != -1)
+    {
+      ssize_t m = -1;
+      read_write(daemon->pipe_to_parent, (unsigned char *)&m, sizeof(m), 0);
+    }
+      
   new_chain = NULL;
 }
 
+
+/* A marshalled cache entry arrives on fd, read, unmarshall and insert into cache of master process. */
+int cache_recv_insert(time_t now, int fd)
+{
+  ssize_t m;
+  struct all_addr addr;
+  unsigned long ttl;
+  time_t ttd;
+  unsigned short flags;
+  struct crec *crecp = NULL;
+  
+  cache_start_insert();
+  
+  while(1)
+    {
+ 
+      if (!read_write(fd, (unsigned char *)&m, sizeof(m), 1))
+	return 0;
+      
+      if (m == -1)
+	{
+	  cache_end_insert();
+	  return 1;
+	}
+
+      if (!read_write(fd, (unsigned char *)daemon->namebuff, m, 1) ||
+	  !read_write(fd, (unsigned char *)&ttd, sizeof(ttd), 1) ||
+	  !read_write(fd, (unsigned char *)&flags, sizeof(flags), 1))
+	return 0;
+
+      daemon->namebuff[m] = 0;
+
+      ttl = difftime(ttd, now);
+      
+      if (flags & (F_IPV4 | F_IPV6))
+	{
+	  if (!read_write(fd, (unsigned char *)&addr, sizeof(addr), 1))
+	    return 0;
+	  crecp = really_insert(daemon->namebuff, &addr, now, ttl, flags);
+	}
+      else if (flags & F_CNAME)
+	{
+	  struct crec *newc = really_insert(daemon->namebuff, NULL, now, ttl, flags);
+	  /* This relies on the fact the the target of a CNAME immediately preceeds
+	     it because of the order of extraction in extract_addresses, and
+	     the order reversal on the new_chain. */
+	  if (newc)
+	    {
+	      if (!crecp)
+		{
+		  newc->addr.cname.target.cache = NULL;
+		  /* anything other than zero, to avoid being mistaken for CNAME to interface-name */ 
+		  newc->addr.cname.uid = 1; 
+		}
+	      else
+		{
+		  next_uid(crecp);
+		  newc->addr.cname.target.cache = crecp;
+		  newc->addr.cname.uid = crecp->uid;
+		}
+	    }
+	}
+#ifdef HAVE_DNSSEC
+      else if (flags & (F_DNSKEY | F_DS))
+	{
+	  unsigned short class, keylen, keyflags, keytag;
+	  unsigned char algo, digest;
+	  struct blockdata *keydata;
+	  
+	  if (!read_write(fd, (unsigned char *)&class, sizeof(class), 1))
+	    return 0;
+	  /* Cache needs to known class for DNSSEC stuff */
+	  addr.addr.dnssec.class = class;
+
+	  crecp = really_insert(daemon->namebuff, &addr, now, ttl, flags);
+	    
+	  if (flags & F_DNSKEY)
+	    {
+	      if (!read_write(fd, (unsigned char *)&algo, sizeof(algo), 1) ||
+		  !read_write(fd, (unsigned char *)&keytag, sizeof(keytag), 1) ||
+		  !read_write(fd, (unsigned char *)&keyflags, sizeof(keyflags), 1) ||
+		  !read_write(fd, (unsigned char *)&keylen, sizeof(keylen), 1) ||
+		  !(keydata = blockdata_read(fd, keylen)))
+		return 0;
+	    }
+	  else if (!(flags & F_NEG))
+	    {
+	      if (!read_write(fd, (unsigned char *)&algo, sizeof(algo), 1) ||
+		  !read_write(fd, (unsigned char *)&keytag, sizeof(keytag), 1) ||
+		  !read_write(fd, (unsigned char *)&digest, sizeof(digest), 1) ||
+		  !read_write(fd, (unsigned char *)&keylen, sizeof(keylen), 1) ||
+		  !(keydata = blockdata_read(fd, keylen)))
+		return 0;
+	    }
+
+	  if (crecp)
+	    {
+	       if (flags & F_DNSKEY)
+		 {
+		   crecp->addr.key.algo = algo;
+		   crecp->addr.key.keytag = keytag;
+		   crecp->addr.key.flags = flags;
+		   crecp->addr.key.keylen = keylen;
+		   crecp->addr.key.keydata = keydata;
+		 }
+	       else if (!(flags & F_NEG))
+		 {
+		   crecp->addr.ds.algo = algo;
+		   crecp->addr.ds.keytag = keytag;
+		   crecp->addr.ds.digest = digest;
+		   crecp->addr.ds.keylen = keylen;
+		   crecp->addr.ds.keydata = keydata;
+		 }
+	    }
+	}
+#endif
+    }
+}
+	
 int cache_find_non_terminal(char *name, time_t now)
 {
   struct crec *crecp;