diff --git a/src/etc/inc/globals.inc b/src/etc/inc/globals.inc
index 304bfee7f3..53b876ed85 100644
--- a/src/etc/inc/globals.inc
+++ b/src/etc/inc/globals.inc
@@ -74,7 +74,7 @@ $g = array(
 	"disablecrashreporter" => false,
 	"crashreporterurl" => "https://crashreporter.pfsense.org/crash_reporter.php",
 	"debug" => false,
-	"latest_config" => "17.3",
+	"latest_config" => "17.4",
 	"minimum_ram_warning" => "101",
 	"minimum_ram_warning_text" => "128 MB",
 	"wan_interface_name" => "wan",
diff --git a/src/etc/inc/services.inc b/src/etc/inc/services.inc
index f0a204fa45..e5e5805cc4 100644
--- a/src/etc/inc/services.inc
+++ b/src/etc/inc/services.inc
@@ -2531,39 +2531,16 @@ function services_dnsupdate_process($int = "", $updatehost = "", $forced = false
 			$hostname .= ".";
 		}
 
-		/*
-		 * write private key file
-		 * this is dumb - public and private keys are the same for
-		 * HMAC-MD5, but nsupdate insists on having both
-		 */
-		$fd = fopen($g['varetc_path'] .
-		    "/K{$i}{$keyname}+157+00000.private", "w");
-		$privkey = <<<EOD
-Private-key-format: v1.2
-Algorithm: 157 (HMAC)
-Key: {$dnsupdate['keydata']}
+		/* write key file */
+		$algorithm = empty($dnsupdate['keyalgorithm']) ? 'hmac-md5' : $dnsupdate['keyalgorithm'];
+		$upkey = <<<EOD
+key "{$keyname}" {
+	algorithm {$algorithm};
+	secret "{$dnsupdate['keydata']}";
+};
 
 EOD;
-		fwrite($fd, $privkey);
-		fclose($fd);
-
-		/* write public key file */
-		if ($dnsupdate['keytype'] == "zone") {
-			$flags = 257;
-			$proto = 3;
-		} else if ($dnsupdate['keytype'] == "host") {
-			$flags = 513;
-			$proto = 3;
-		} else if ($dnsupdate['keytype'] == "user") {
-			$flags = 0;
-			$proto = 2;
-		}
-
-		$fd = fopen($g['varetc_path'] .
-		    "/K{$i}{$keyname}+157+00000.key", "w");
-		fwrite($fd, "{$keyname} IN KEY {$flags} {$proto} 157 " .
-		    "{$dnsupdate['keydata']}\n");
-		fclose($fd);
+		@file_put_contents("{$g['varetc_path']}/nsupdatekey{$i}", $upkey);
 
 		/* generate update instructions */
 		$upinst = "";
@@ -2633,12 +2610,10 @@ EOD;
 			continue;
 		}
 
-		@file_put_contents("{$g['varetc_path']}/nsupdatecmds{$i}",
-		    $upinst);
+		@file_put_contents("{$g['varetc_path']}/nsupdatecmds{$i}", $upinst);
 		unset($upinst);
 		/* invoke nsupdate */
-		$cmd = "/usr/local/bin/nsupdate -k " .
-		    "{$g['varetc_path']}/K{$i}{$keyname}+157+00000.key";
+		$cmd = "/usr/local/bin/nsupdate -k {$g['varetc_path']}/nsupdatekey{$i}";
 
 		if (isset($dnsupdate['usetcp'])) {
 			$cmd .= " -v";
diff --git a/src/etc/inc/upgrade_config.inc b/src/etc/inc/upgrade_config.inc
index 6b7ac30397..dc5543893a 100644
--- a/src/etc/inc/upgrade_config.inc
+++ b/src/etc/inc/upgrade_config.inc
@@ -5493,6 +5493,18 @@ function upgrade_172_to_173() {
 	}
 }
 
+/*
+ * Dynamic DNS nsupdate keyfiles have been replaced with a simpler ddns-confgen style file.
+ */
+function upgrade_173_to_174() {
+	global $config;
+
+	/* Remove unused keytype field. */
+	foreach ($config['dnsupdates']['dnsupdate'] as $i => &$dnsupdate) {
+		unset($dnsupdate['keytype']);
+	}
+}
+
 /*
  * Special function that is called independent of current config version. It's
  * a workaround to have config_upgrade running on older versions after next
diff --git a/src/usr/local/www/services_rfc2136_edit.php b/src/usr/local/www/services_rfc2136_edit.php
index 848afede3a..ba8f803de9 100644
--- a/src/usr/local/www/services_rfc2136_edit.php
+++ b/src/usr/local/www/services_rfc2136_edit.php
@@ -28,6 +28,15 @@
 
 require_once("guiconfig.inc");
 
+$tsig_key_algos = array(
+	'hmac-md5'    => 'HMAC-MD5 (legacy default)',
+	'hmac-sha1'   => 'HMAC-SHA1',
+	'hmac-sha224' => 'HMAC-SHA224',
+	'hmac-sha256' => 'HMAC-SHA256 (current bind9 default)',
+	'hmac-sha384' => 'HMAC-SHA384',
+	'hmac-sha512' => 'HMAC-SHA512 (most secure)',
+);
+
 if (!is_array($config['dnsupdates']['dnsupdate'])) {
 	$config['dnsupdates']['dnsupdate'] = array();
 }
@@ -45,12 +54,9 @@ if (isset($id) && isset($a_rfc2136[$id])) {
 	if (!$pconfig['ttl']) {
 		$pconfig['ttl'] = 60;
 	}
-	$pconfig['keydata'] = $a_rfc2136[$id]['keydata'];
 	$pconfig['keyname'] = $a_rfc2136[$id]['keyname'];
-	$pconfig['keytype'] = $a_rfc2136[$id]['keytype'];
-	if (!$pconfig['keytype']) {
-		$pconfig['keytype'] = "zone";
-	}
+	$pconfig['keyalgorithm'] = $a_rfc2136[$id]['keyalgorithm'];
+	$pconfig['keydata'] = $a_rfc2136[$id]['keydata'];
 	$pconfig['server'] = $a_rfc2136[$id]['server'];
 	$pconfig['interface'] = $a_rfc2136[$id]['interface'];
 	$pconfig['usetcp'] = isset($a_rfc2136[$id]['usetcp']);
@@ -69,22 +75,23 @@ if ($_POST['save'] || $_POST['force']) {
 	$pconfig = $_POST;
 
 	/* input validation */
-	$reqdfields = array();
-	$reqdfieldsn = array();
-	$reqdfields = array_merge($reqdfields, explode(" ", "host ttl keyname keydata"));
-	$reqdfieldsn = array_merge($reqdfieldsn, array(gettext("Hostname"), gettext("TTL"), gettext("Key name"), gettext("Key")));
+	$reqdfields = array('host', 'ttl', 'keyname', 'keydata');
+	$reqdfieldsn = array(gettext("Hostname"), gettext("TTL"), gettext("Key name"), gettext("Key"));
 
 	do_input_validation($_POST, $reqdfields, $reqdfieldsn, $input_errors);
 
-	if (($_POST['host'] && !is_domain($_POST['host']))) {
+	if ($_POST['host'] && !is_domain($_POST['host'])) {
 		$input_errors[] = gettext("The DNS update host name contains invalid characters.");
 	}
-	if (($_POST['ttl'] && !is_numericint($_POST['ttl']))) {
+	if ($_POST['ttl'] && !is_numericint($_POST['ttl'])) {
 		$input_errors[] = gettext("The DNS update TTL must be an integer.");
 	}
-	if (($_POST['keyname'] && !is_domain($_POST['keyname']))) {
+	if ($_POST['keyname'] && !is_domain($_POST['keyname'])) {
 		$input_errors[] = gettext("The DNS update key name contains invalid characters.");
 	}
+	if ($_POST['keyalgorithm'] && !array_key_exists($_POST['keyalgorithm'], $tsig_key_algos)) {
+		$input_errors[] = gettext("The DNS update key algorithm is invalid.");
+	}
 
 	if (!$input_errors) {
 		$rfc2136 = array();
@@ -92,7 +99,7 @@ if ($_POST['save'] || $_POST['force']) {
 		$rfc2136['host'] = $_POST['host'];
 		$rfc2136['ttl'] = $_POST['ttl'];
 		$rfc2136['keyname'] = $_POST['keyname'];
-		$rfc2136['keytype'] = $_POST['keytype'];
+		$rfc2136['keyalgorithm'] = $_POST['keyalgorithm'];
 		$rfc2136['keydata'] = $_POST['keydata'];
 		$rfc2136['server'] = $_POST['server'];
 		$rfc2136['usetcp'] = $_POST['usetcp'] ? true : false;
@@ -161,8 +168,6 @@ $section->addInput(new Form_Checkbox(
 	$pconfig['enable']
 ));
 
-$optionlist = array();
-
 $iflist = build_if_list();
 
 $section->addInput(new Form_Select(
@@ -193,40 +198,19 @@ $section->addInput(new Form_Input(
 	$pconfig['keyname']
 ))->setHelp('This must match the setting on the DNS server.');
 
-$group = new Form_Group('*Key Type');
-
-$group->add(new Form_Checkbox(
-	'keytype',
-	'Key Type',
-	'Zone',
-	($pconfig['keytype'] == 'zone'),
-	'zone'
-))->displayAsRadio();
-
-$group->add(new Form_Checkbox(
-	'keytype',
-	'Key Type',
-	'Host',
-	($pconfig['keytype'] == 'host'),
-	'host'
-))->displayAsRadio();
-
-$group->add(new Form_Checkbox(
-	'keytype',
-	'Key Type',
-	'User',
-	($pconfig['keytype'] == 'user'),
-	'user'
-))->displayAsRadio();
-
-$section->add($group);
+$section->addInput(new Form_Select(
+	'keyalgorithm',
+	'*Key algorithm',
+	$pconfig['keyalgorithm'],
+	$tsig_key_algos
+));
 
 $section->addInput(new Form_Input(
 	'keydata',
 	'*Key',
 	'text',
 	$pconfig['keydata']
-))->setHelp('Paste an HMAC-MD5 key here.');
+))->setHelp('Secret TSIG domain key.');
 
 $section->addInput(new Form_Input(
 	'server',