do-ip6: no

; config options
        stub-addr: 193.0.14.129
        trust-anchor: ".			IN DS 49060 8 2 E7B1EB56D7D5791B3D45630FEAA9C823DB84B385ACEEAC5F44DD08885C36700F"
        val-override-date: "20170807130000"
        query-minimization: off
        harden-glue: off
CONFIG_END

SCENARIO_BEGIN Test not setting AD bit for answer which contains proof of nonexistence of NS record using NSEC3 with opt-out 

RANGE_BEGIN 1 2
	ADDRESS 193.0.14.129 ;k.root-servers.net
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR RD AA AD NOERROR
SECTION QUESTION
.	IN	SOA
SECTION ANSWER
.                       86400   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2017030902 1800 900 604800 86400
.                       86400   IN      RRSIG   SOA 8 0 86400 20170901125744 20170802125744 20661 . uhdJY+sNwlQSb8TtF3WffXadfjNp3/XguyeJ7FKF1Rxr7WPG2asG70U+ Ltj1GFZkpcS+75ifMTJ7Ykc082KSRyh1pmMKQSiY9lPdiOX6muq+kBdX h6jkwI+FrCcrBDzhrH6A4XMcTlNj3lBxrUI7lsQyw2I/nwzsTEiTI+1/ mK5zQKA/pnMepKr4CUSS78f/tT955wm3slms5laQSfxqrakPCSwkRtlM xrXPJnjc34MLVpiItgzuQqCrCb+Rak2QNAVkNKfkvBMxJDmRXoz5BTTQ 4huaJWeOFyvIomZwBseFBDSyS5QYCEfMLo0+R/xc/KjzfVuYG8J0dClM kjnMEw==
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR RD AA AD NOERROR
SECTION QUESTION
.	IN	NS
SECTION ANSWER
.                       518400  IN      NS      k.root-servers.net.
.                       518400  IN      RRSIG   NS 8 0 518400 20170901125744 20170802125744 20661 . VDSzCYw6B8u9cLz5BJuzDtRfmc/iGmD3Vei9TPthggi2lwE4HJ6uxYPt HRuczjHOYJcBzJSL1vh/myUHZXysGiGtEASbKZyWnk0uGf//68sPyQLX +QbhvrjHHP17HOsH8ZaCQUvGD2q7yhTtiGlLPRRxUUA7TQ4e7HRMfzo7 R2g/U3mbzfvJctGrng08r2VPdFndE7H7deef9YJjQ32vJSaDzp0qVtwA q0RO6xfMcUHvAzxFVWkWqUkhbXoBv08xz9O182g2a7lCJlxKD1NbbJ9Y Ob4PFtvK9bL8PUlS3DK4GMsZ8XpTLX2lEUedulX4Jn0fHz5pYk2TEMF6 YuJAWA==

ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR RD AA AD NOERROR
SECTION QUESTION
.	IN	DNSKEY
SECTION ANSWER
.                       3600000 IN      DNSKEY  256 3 8 AwEAAe1oA46eOLNris1CtS0qM5TdMESK6i4hpalqa6JDv57eOUkaOeje ZW1tIFUokmaK7kuKEFEosddA89CYM8rt2RbC+sfKalbHAWOus0tXZyAL efb2sW95QRzyG6LNul0jQFn9eYWBUHrVe5Wqd0zrFCbTQLUhELSfrlkI UBpO/xKaGinRHX2JjyOnle4aPZY3bEVa/+KyY2ZU6UC4SBo3aHXanP26 ok91rOTmpTWp64ybsMdCXOU8deyuQFQf6q8DhIDmJrkymhX1MXWQQlE0 fAYIYf8/t9OCwucg8oEg4FPU8Gb4Zm/l6PgO4HFkFjBT6iGFCQt3qXe2 Qe3alUWoATc=
.                       3600000 IN      DNSKEY  257 3 8 AwEAAb8sZgVVa02muJ+/+SVhJAvz2EWKGEGquhPbQXuF6ALBYoF4KWTO bZVF8sIVTGoaX5+UWkwwHthg7RwS1DALT/AJymYeHhUwA04gLsfCZ/cv BjmRy5RozeSJ1uxAhoCYHCT2hQBZ0cH0n8roXFXI2Y+6708pO1IBkTPT 9MpAGfezTtGYOortbSn+vqT/Zu8jOpNwkleXON4rlZRBZPd4JUMGL9Y5 N/j6+ClYeM+eFQTKXrLi1oC+0yK1sG5OlqrBDhAhBnz+IhfZz4TOkqJ9 Li2BVMatHBeB9GQHtu0FZuC3J0EQgiZxvq1RgkefFJAiB+5uVRN8U7up 5mLDxSgmT0M=
.                       2592000 IN      RRSIG   DNSKEY 8 0 3600000 20170901125744 20170802125744 20661 . Oq/hUNG3VoToA2eT4gd32ALxOCXcR8TQwr+vSXEe6/hReGQdANdbyhFU stwNldw61ZD61MBUORY4YEmlpOsOAEpFB9pw2Me41GHdbtLCwcr5RTD4 6e/qBAdthoglLG53jObrp0nBJclLgoWfm4Rmn3DPIKcMoch/W5MmdWGj 7bC4xChMBWDYLPaqYm5PWgpMdHl60Sq9H/dkkWBvRuqPrN2ATBCoHjUE 6UGZM60AZPRuhqHogqvSiNEEEweqN7KK60dQy65dIMFh0iUCaw2/HDB5 NS30lMqxdJY6xAX1uNMIf6UhdFYFBqHClRUqJcOA7IqskkKel6ZC8Rpg 3qruFg==
.                       2592000 IN      RRSIG   DNSKEY 8 0 3600000 20170901125744 20170802125744 49060 . eYrzIaVlmMtByHu35+Fu1yUlRkfwZLEPQXspIq7dZzL06H8gBz11/FBE YAvpgYrACeLmEuj3NrWp+2odPrWo23usyvbDiUC1U242trYa4F5qUBKt JtXiHVwMhu+Xg4D5JAXU27itt0XHIKyOAZx6ifuZUvYTvfEtgPm+2Bal uenCi7/ZsBLpOOvB+Wjr+xpxMJILIABvfdgPWCCRh5JiYdhhldJCTA6J MQ5yUlf57OvFOQdnUP6xz+FjTAJWPO2rlc47sRaucKr1i/cQzLaqT2ui +zlunVo7lFq2zNZPRz7zRktO1iDp2Bz7rX+o4DTFVk2gxbcF2x3VAckM +dIgWw==
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype
ADJUST copy_id copy_query
REPLY QR RD AA REFUSED
SECTION QUESTION
.	IN	RRSIG
SECTION ANSWER
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR RD AA AD NXDOMAIN
SECTION QUESTION
li.   IN      NS
SECTION AUTHORITY
.                       86400   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2017030902 1800 900 604800 86400
.                       86400   IN      RRSIG   SOA 8 0 86400 20170901125744 20170802125744 20661 . uhdJY+sNwlQSb8TtF3WffXadfjNp3/XguyeJ7FKF1Rxr7WPG2asG70U+ Ltj1GFZkpcS+75ifMTJ7Ykc082KSRyh1pmMKQSiY9lPdiOX6muq+kBdX h6jkwI+FrCcrBDzhrH6A4XMcTlNj3lBxrUI7lsQyw2I/nwzsTEiTI+1/ mK5zQKA/pnMepKr4CUSS78f/tT955wm3slms5laQSfxqrakPCSwkRtlM xrXPJnjc34MLVpiItgzuQqCrCb+Rak2QNAVkNKfkvBMxJDmRXoz5BTTQ 4huaJWeOFyvIomZwBseFBDSyS5QYCEfMLo0+R/xc/KjzfVuYG8J0dClM kjnMEw==
ca5qlot3gsobijfasusg7dvc5kdtgp4e. 86400 IN NSEC3 1 1 10 AE83CC9CD22A4A92 QVMFNLQ9AOEGUQEMOCFD5HGN8L8VAPHO NS SOA RRSIG DNSKEY NSEC3PARAM
ca5qlot3gsobijfasusg7dvc5kdtgp4e. 86400 IN RRSIG NSEC3 8 1 86400 20170901125744 20170802125744 20661 . TLye07FnnjtPSZ0pUMJ4OToH9evHpuj7Yb6ktj1W1bDLqxYcmbTc1jZu IWe4wn/pLz5/78sigR+KKkP6L/Ki0ZVG8fcmR546Jp4o0+fGVkAqbRyc /kckl4QsHqR4UiMrIDhc/MQHnaje/bNrGka+7pQOnvmRyUo0jSHuVfFI LdKMZpk5seTZKI0k/WgmrDYuFii4HqT8+RB9/uoFVPlSSI/rYJ2G4Wgt t81732pO5Kqcwp7DFKvkkj7yU84zlDXtT7RuF21OCACAUseiCX/GOTGf 8OvZp8Rdfs1wT5LjjWl5Gb23Arr9o4soGsyEbXeaoyw7OVYZzXlEko1l yBm5+g==
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR RD AA AD NOERROR
SECTION QUESTION
net.   IN      NS
SECTION AUTHORITY
.                       86400   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2017030902 1800 900 604800 86400
22n8oi3qtiud0dier2bbl2ktforlp60c. 86400 IN NSEC3 1 1 10 AE83CC9CD22A4A92 8HBQQS31TETVRFABEIIF3K7LHPOL93GD 
.                       86400   IN      RRSIG   SOA 8 0 86400 20170901125744 20170802125744 20661 . uhdJY+sNwlQSb8TtF3WffXadfjNp3/XguyeJ7FKF1Rxr7WPG2asG70U+ Ltj1GFZkpcS+75ifMTJ7Ykc082KSRyh1pmMKQSiY9lPdiOX6muq+kBdX h6jkwI+FrCcrBDzhrH6A4XMcTlNj3lBxrUI7lsQyw2I/nwzsTEiTI+1/ mK5zQKA/pnMepKr4CUSS78f/tT955wm3slms5laQSfxqrakPCSwkRtlM xrXPJnjc34MLVpiItgzuQqCrCb+Rak2QNAVkNKfkvBMxJDmRXoz5BTTQ 4huaJWeOFyvIomZwBseFBDSyS5QYCEfMLo0+R/xc/KjzfVuYG8J0dClM kjnMEw==
22n8oi3qtiud0dier2bbl2ktforlp60c. 86400 IN RRSIG NSEC3 8 1 86400 20170901125744 20170802125744 20661 . K4bXakkrwj5gxNs4JzI/vEjHAKIyT5uYmh56g1pN8r/fOpiarYqtCAue 9oRIK7uk9p3R75n/HYZGfZnF8sfxPKOdTmFDhHtdNbQsqzAz1AOzk1bD 6US62xZQHApINFCHSLJzBch2V3o4/Vb2k5aQQp2mGe5HQzTvCn9JKgRY eRgfJbnN3acVtjT46ggIp7wqQAWNKNakaV2+ad9TgyoOO9/64IDF9Z4a oehlzT+iMHzDk9noOlf67Qvmx79x1pvUCRVA57VQpw0mNnDQCvVQ2Avq IJGiM4SQxyGyeSFqJpLTzboCl8uLy6DaSaeJvtAYIRj3x2kDrW9NfUL3 EQHBOg==


ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR RD AA AD NOERROR
SECTION QUESTION
root-servers.net.   IN      NS
SECTION AUTHORITY
.                       86400   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2017030902 1800 900 604800 86400
22n8oi3qtiud0dier2bbl2ktforlp60c. 86400 IN NSEC3 1 1 10 AE83CC9CD22A4A92 8HBQQS31TETVRFABEIIF3K7LHPOL93GD 
.                       86400   IN      RRSIG   SOA 8 0 86400 20170901125744 20170802125744 20661 . uhdJY+sNwlQSb8TtF3WffXadfjNp3/XguyeJ7FKF1Rxr7WPG2asG70U+ Ltj1GFZkpcS+75ifMTJ7Ykc082KSRyh1pmMKQSiY9lPdiOX6muq+kBdX h6jkwI+FrCcrBDzhrH6A4XMcTlNj3lBxrUI7lsQyw2I/nwzsTEiTI+1/ mK5zQKA/pnMepKr4CUSS78f/tT955wm3slms5laQSfxqrakPCSwkRtlM xrXPJnjc34MLVpiItgzuQqCrCb+Rak2QNAVkNKfkvBMxJDmRXoz5BTTQ 4huaJWeOFyvIomZwBseFBDSyS5QYCEfMLo0+R/xc/KjzfVuYG8J0dClM kjnMEw==
22n8oi3qtiud0dier2bbl2ktforlp60c. 86400 IN RRSIG NSEC3 8 1 86400 20170901125744 20170802125744 20661 . K4bXakkrwj5gxNs4JzI/vEjHAKIyT5uYmh56g1pN8r/fOpiarYqtCAue 9oRIK7uk9p3R75n/HYZGfZnF8sfxPKOdTmFDhHtdNbQsqzAz1AOzk1bD 6US62xZQHApINFCHSLJzBch2V3o4/Vb2k5aQQp2mGe5HQzTvCn9JKgRY eRgfJbnN3acVtjT46ggIp7wqQAWNKNakaV2+ad9TgyoOO9/64IDF9Z4a oehlzT+iMHzDk9noOlf67Qvmx79x1pvUCRVA57VQpw0mNnDQCvVQ2Avq IJGiM4SQxyGyeSFqJpLTzboCl8uLy6DaSaeJvtAYIRj3x2kDrW9NfUL3 EQHBOg==

ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR RD AA AD NOERROR
SECTION QUESTION
ns.net.   IN      A
SECTION ANSWER
ns.net.                 600     IN      A       1.1.1.1
ns.net.                 600     IN      RRSIG   A 8 2 600 20170901125744 20170802125744 20661 . Z0VIqlE9FUERy2IRsAQ5Nv8JYhr4Mn6kz29NyAaxVQqokEf3pF760PyA UEpSoBENsnWU+x/2XDSkdlyyJQbUpwZhLDAdXgLQUCg+E+1CFFj1A9Zg zCf0oZ6PsCKyTrHCshyHDQNe+iIWO8Qn3qwoAeytIc3ztSQTkP2s8Tys ZoG/+5dqaCICPOoiVVh7usl7WC8SZn4hVRnU64w+Wxziy3anROZ/pUq9 9DI+7+zb2vEteA0sM151akjAtekFiRuqzjgnBpUiH6j4hgGkoH5NCvkD HD37jMZg4D9jmE7O7X3puAuson2DURvjuoHtZRsLRypglRDmlaRThoff l0BmAw==
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR RD AA AD NOERROR
SECTION QUESTION
k.root-servers.net.   IN      A
SECTION ANSWER
k.root-servers.net.     3600000 IN      A       193.0.14.129
k.root-servers.net.     2592000 IN      RRSIG   A 8 3 3600000 20170901125744 20170802125744 20661 . s+A2gmeRqZMgJZsuv7hn8qeHk/DIpoH1ZC5resAX7yhZwCxcQM+mNJ7E Jy7qC9PYBrta7rdeNuDKYuHJBlFZECaV/HZ7+f3SBPEiW9DYUI3SnNOR qyBaJGvuTjoQTWU4FVGe2T/ybroq6HzSx0xKSSHyMQeQFxk9wI86npjF cWm19ddCCwJ2uOrJspZwN8jidDbR//G8ntolmU2RzLKDqInLLqoBs1VF SE5Dqzx9eg4boKmUM3IQIJkVQppyGuMSIDNTh1IbPxZrtMgsh3+o9rds ZcIe5A8TRumEaRrXyJiTXQ25kZkZ0ilPyxWrjFRhjfHFcNX+aFpvwhtH cU6BSw==
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR RD AA AD NXDOMAIN
SECTION QUESTION
k.root-servers.net.   IN      AAAA
SECTION AUTHORITY
.                       86400   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2017030902 1800 900 604800 86400
c27sd6l4gd20p5e9ttq5br5a4q7scnf7. 86400 IN NSEC3 1 1 10 AE83CC9CD22A4A92 CA5QLOT3GSOBIJFASUSG7DVC5KDTGP4E A RRSIG
.                       86400   IN      RRSIG   SOA 8 0 86400 20170901125744 20170802125744 20661 . uhdJY+sNwlQSb8TtF3WffXadfjNp3/XguyeJ7FKF1Rxr7WPG2asG70U+ Ltj1GFZkpcS+75ifMTJ7Ykc082KSRyh1pmMKQSiY9lPdiOX6muq+kBdX h6jkwI+FrCcrBDzhrH6A4XMcTlNj3lBxrUI7lsQyw2I/nwzsTEiTI+1/ mK5zQKA/pnMepKr4CUSS78f/tT955wm3slms5laQSfxqrakPCSwkRtlM xrXPJnjc34MLVpiItgzuQqCrCb+Rak2QNAVkNKfkvBMxJDmRXoz5BTTQ 4huaJWeOFyvIomZwBseFBDSyS5QYCEfMLo0+R/xc/KjzfVuYG8J0dClM kjnMEw==
c27sd6l4gd20p5e9ttq5br5a4q7scnf7. 86400 IN RRSIG NSEC3 8 1 86400 20170901125744 20170802125744 20661 . NN5tdEbFFwesLYRPUETJb3VNm+90RDAG2OmIvAIheZ8aD3rHp+n3WpWm xoQKDjYBLN49jLBz6zutZVdk5xJ4xfeuyKpckwn3L/sz0ej7XTTZrlpP yvatidBHR7MAwqUiGBLWOLtU2xt+DpIp5GLDLVlQs/pE/kfO/0WF7xZB 8Cf9QFl+eGSAOcsKK5aS0evT4PCM/YMpdzVcUhbS13apzEtyroAghpoy gOx6rNc3svzYYpRpt7Is9qlAY+d7EiFUCv0hnx7MwqkGuRqZFonA4dzt D5ds/+VwPvbo5o1TPQ74ZrToiD9Lkv/x/+qRYR3z1iKaXrUWEh5kLTpb UzSJ8A==

ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR RD AA AD NOERROR
SECTION QUESTION
.   IN      NSEC3PARAM
SECTION ANSWER
.                       0       IN      NSEC3PARAM 1 0 10 AE83CC9CD22A4A92
.                       0       IN      RRSIG   NSEC3PARAM 8 0 0 20170901125744 20170802125744 20661 . A11gI2rfHcW4SLbUVRCc2sg9wtgzICywN1hQNTyI2Un880S7PKiVzjEW woCBfSK/t1hMTtGOxSnkSGT7OILY200HZo3fJ9xEhXoeamdrtV2Ht7y2 GIO+MQ9B6y95y/N6PGNTDQIY7LC4D6JNeiSDg1j6joEiQ2LV4vwmYGQt Dl6N+Qx6S2ZSCiXCL4Gg1wvSGQK4DyDGDjYQd9KHsFnHjL6sqwHS5G09 s0JHvigAuYR0sG9/mqb0t+JyKXazpUS/MeaMYIIQnmQqDh37IZSDEPy9 IMbNd8x6El+DtCjC5TQGfDE1iCBr8NTxgkIM5zGLxl5pLzo5H4Z5QYZ2 TUy7DA==

ENTRY_END
RANGE_END

RANGE_BEGIN 1 2
	ADDRESS 1.1.1.1 ;ns.net
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR RD AA NOERROR
SECTION QUESTION
li.	IN	SOA
SECTION ANSWER
li.                       86400   IN      SOA     ns.net. hostmaster.example.com. 1234 1800 900 604800 86400
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR RD AA NOERROR
SECTION QUESTION
li.   IN      NS
SECTION ANSWER
li.   IN      NS      ns.net
ENTRY_END

ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR RD AA NOERROR
SECTION QUESTION
ns.net.   IN      A
SECTION ANSWER
ns.net.			86400   IN      A     1.1.1.1
ENTRY_END
RANGE_END

STEP 1 QUERY
ENTRY_BEGIN
REPLY RD AD DO
SECTION QUESTION
li.	IN	NS
ENTRY_END

STEP 2 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NXDOMAIN ; AD flag is not set
SECTION QUESTION
li.	IN	NS
SECTION ANSWER
SECTION AUTHORITY
.                       86400   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2017030902 1800 900 604800 86400
.                       86400   IN      RRSIG   SOA 8 0 86400 20170901125744 20170802125744 20661 . uhdJY+sNwlQSb8TtF3WffXadfjNp3/XguyeJ7FKF1Rxr7WPG2asG70U+ Ltj1GFZkpcS+75ifMTJ7Ykc082KSRyh1pmMKQSiY9lPdiOX6muq+kBdX h6jkwI+FrCcrBDzhrH6A4XMcTlNj3lBxrUI7lsQyw2I/nwzsTEiTI+1/ mK5zQKA/pnMepKr4CUSS78f/tT955wm3slms5laQSfxqrakPCSwkRtlM xrXPJnjc34MLVpiItgzuQqCrCb+Rak2QNAVkNKfkvBMxJDmRXoz5BTTQ 4huaJWeOFyvIomZwBseFBDSyS5QYCEfMLo0+R/xc/KjzfVuYG8J0dClM kjnMEw==
ca5qlot3gsobijfasusg7dvc5kdtgp4e. 86400 IN NSEC3 1 1 10 AE83CC9CD22A4A92 QVMFNLQ9AOEGUQEMOCFD5HGN8L8VAPHO NS SOA RRSIG DNSKEY NSEC3PARAM
ca5qlot3gsobijfasusg7dvc5kdtgp4e. 86400 IN RRSIG NSEC3 8 1 86400 20170901125744 20170802125744 20661 . TLye07FnnjtPSZ0pUMJ4OToH9evHpuj7Yb6ktj1W1bDLqxYcmbTc1jZu IWe4wn/pLz5/78sigR+KKkP6L/Ki0ZVG8fcmR546Jp4o0+fGVkAqbRyc /kckl4QsHqR4UiMrIDhc/MQHnaje/bNrGka+7pQOnvmRyUo0jSHuVfFI LdKMZpk5seTZKI0k/WgmrDYuFii4HqT8+RB9/uoFVPlSSI/rYJ2G4Wgt t81732pO5Kqcwp7DFKvkkj7yU84zlDXtT7RuF21OCACAUseiCX/GOTGf 8OvZp8Rdfs1wT5LjjWl5Gb23Arr9o4soGsyEbXeaoyw7OVYZzXlEko1l yBm5+g==
ENTRY_END

SCENARIO_END