diff --git a/ChangeLog b/ChangeLog
index a8cd5fd6..1ac54fdb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+* 2015-09-??: Version 0.3.3
+  * Fix clearing upstream events on shutdown
+  * Fix dnssec validation of direct CNAME queries.
+    Thanks Simson L. Garfinkel.
+  * Fix get_api_information():version_string also for release candidates
+
 * 2015-09-04: Version 0.3.2
   * Fix returned upstreams list by getdns_context_get_api_information()
   * Fix some autoconf issues when srcdir != builddir
diff --git a/README.md b/README.md
index 5e3a53ff..27c6c151 100644
--- a/README.md
+++ b/README.md
@@ -97,8 +97,8 @@ package management system to install the compile time files.  If you checked
 out our git you need to copy the libtool helper scripts and rebuild configure
 with:
 
-    # libtoolize -fi
-    # autoreconf -ci
+    # libtoolize -ci
+    # autoreconf -fi
 
 ## Extensions / Event loop dependencies
 
diff --git a/configure.ac b/configure.ac
index b78c9927..342ff15e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -36,7 +36,7 @@ sinclude(./m4/ax_check_compile_flag.m4)
 sinclude(./m4/pkg.m4)
 
 AC_INIT([getdns], [0.3.2], [stub-resolver@verisignlabs.com], [], [https://getdnsapi.net])
-AC_SUBST(RELEASE_CANDIDATE, [])
+AC_SUBST(RELEASE_CANDIDATE, [rc1])
 
 # Set current date from system if not set
 AC_ARG_WITH([current-date],
@@ -46,7 +46,7 @@ AC_ARG_WITH([current-date],
   [CURRENT_DATE="`date -u +%Y-%m-%dT%H:%M:%SZ`"])
 
 AC_SUBST(GETDNS_VERSION, ["AC_PACKAGE_VERSION$RELEASE_CANDIDATE"])
-AC_SUBST(GETDNS_NUMERIC_VERSION, [0x00030200])
+AC_SUBST(GETDNS_NUMERIC_VERSION, [0x00030201])
 AC_SUBST(API_VERSION, ["July 2015"])
 AC_SUBST(API_NUMERIC_VERSION, [0x07df0700])
 GETDNS_COMPILATION_COMMENT="AC_PACKAGE_NAME $GETDNS_VERSION configured on $CURRENT_DATE for the $API_VERSION version of the API"
@@ -71,9 +71,10 @@ GETDNS_COMPILATION_COMMENT="AC_PACKAGE_NAME $GETDNS_VERSION configured on $CURRE
 # getdns-0.2.0 had libversion 2:2:1
 # getdns-0.3.0 had libversion 3:3:2
 # getdns-0.3.1 had libversion 3:4:2
-# getdns-0.3.2 has libversion 3:5:2
+# getdns-0.3.2 had libversion 3:5:2
+# getdns-0.3.3 will have libversion 3:6:2
 #
-GETDNS_LIBVERSION=3:5:2
+GETDNS_LIBVERSION=3:6:2
 
 AC_SUBST(GETDNS_COMPILATION_COMMENT)
 AC_SUBST(GETDNS_LIBVERSION)
diff --git a/src/context.c b/src/context.c
index 374aa5f4..0a7478c4 100644
--- a/src/context.c
+++ b/src/context.c
@@ -2536,7 +2536,7 @@ getdns_context_get_api_information(getdns_context* context) {
     if (!result) {
         return NULL;
     }
-    r = getdns_dict_util_set_string(result, "version_string", PACKAGE_VERSION);
+    r = getdns_dict_util_set_string(result, "version_string", GETDNS_VERSION);
     r |= getdns_dict_util_set_string(result, "implementation_string", PACKAGE_URL);
     r |= getdns_dict_set_int(result, "resolution_type", context->resolution_type);
     settings = _get_context_settings(context);
diff --git a/src/dnssec.c b/src/dnssec.c
index f72f3066..e5cc4a4a 100644
--- a/src/dnssec.c
+++ b/src/dnssec.c
@@ -1065,8 +1065,17 @@ static void add_question2val_chain(struct mem_funcs *mf,
 		q_rrset.name = _getdns_rdf_if_or_as_decompressed(
 				rdf, cname_spc, &cname_len);
 	}
+
+	/* If the qtype was a CNAME, and we got one, we'r done.
+	 * We asked for it directly, so no redirection applies.
+	 * Otherwise we have to check the referred to name/qtype.
+	 */
+	if (qtype == GETDNS_RRTYPE_CNAME && q_rrset.name != qname)
+		return;
+
 	q_rrset.rr_type  = qtype;
 	if (!(rr = rrtype_iter_init(&rr_spc, &q_rrset))) {
+
 		/* No answer for the question.  Add a head for this rrset
 		 * anyway, to validate proof of non-existance, or to find
 		 * proof that the packet is insecure.