From: Nicki Křížek <nicki@isc.org>
Date: Wed, 8 Jul 2026 18:29:39 +0000 (+0000)
Subject: Provide a control channel on named instances that had none
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c9530375691489115fe101da9100512b20370096;p=thirdparty%2Fbind9.git

Provide a control channel on named instances that had none

Insert _common/controls.conf.j2 right after the options block in every
started named instance config that declared no control channel at all.
This ensure that each named instance exposes its control channel for the
tests.

Note that some configs may include the control channel via a named.conf
include mechanism. Those are left as is, since the control channel is
already configured via that include mechanism -- and those configs
aren't part of this commit at all.

Assisted-by: Claude:claude-fable-5
---

diff --git a/bin/tests/system/additional/ns2/named.conf.j2 b/bin/tests/system/additional/ns2/named.conf.j2
index e1fefc00a50..4229330f360 100644
--- a/bin/tests/system/additional/ns2/named.conf.j2
+++ b/bin/tests/system/additional/ns2/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/allow_query/ns1/named.conf.j2 b/bin/tests/system/allow_query/ns1/named.conf.j2
index 6dbda639578..85c9c9234bb 100644
--- a/bin/tests/system/allow_query/ns1/named.conf.j2
+++ b/bin/tests/system/allow_query/ns1/named.conf.j2
@@ -7,6 +7,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/auth/ns1/named.conf.j2 b/bin/tests/system/auth/ns1/named.conf.j2
index 88a54c7d51e..49b50163782 100644
--- a/bin/tests/system/auth/ns1/named.conf.j2
+++ b/bin/tests/system/auth/ns1/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	send-report-channel "example.rad";
 };
 
+{% include "_common/controls.conf.j2" %}
+
 view main in {
 	allow-transfer { any; };
 
diff --git a/bin/tests/system/auth/ns2/named.conf.j2 b/bin/tests/system/auth/ns2/named.conf.j2
index c8f99bc47da..bb4233c4189 100644
--- a/bin/tests/system/auth/ns2/named.conf.j2
+++ b/bin/tests/system/auth/ns2/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone example.net {
 	type secondary;
 	primaries { 10.53.0.1; };
diff --git a/bin/tests/system/auth_res_deleg/ns1/named.conf.j2 b/bin/tests/system/auth_res_deleg/ns1/named.conf.j2
index 7838ea9fb87..9c0ed7e16e3 100644
--- a/bin/tests/system/auth_res_deleg/ns1/named.conf.j2
+++ b/bin/tests/system/auth_res_deleg/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/auth_res_deleg/ns3/named.conf.j2 b/bin/tests/system/auth_res_deleg/ns3/named.conf.j2
index 87267126c04..6d85d35f7bc 100644
--- a/bin/tests/system/auth_res_deleg/ns3/named.conf.j2
+++ b/bin/tests/system/auth_res_deleg/ns3/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "sub.example.db";
diff --git a/bin/tests/system/autosign/ns4/named.conf.j2 b/bin/tests/system/autosign/ns4/named.conf.j2
index d9487ffeb70..bd0d44a1190 100644
--- a/bin/tests/system/autosign/ns4/named.conf.j2
+++ b/bin/tests/system/autosign/ns4/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	dnssec-validation yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/autosign/ns5/named.conf.j2 b/bin/tests/system/autosign/ns5/named.conf.j2
index 711c172c633..35afb28c32f 100644
--- a/bin/tests/system/autosign/ns5/named.conf.j2
+++ b/bin/tests/system/autosign/ns5/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	dnssec-validation yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/cache_delegns/ns1/named.conf.j2 b/bin/tests/system/cache_delegns/ns1/named.conf.j2
index 81f7b54f347..ed2f15cadd3 100644
--- a/bin/tests/system/cache_delegns/ns1/named.conf.j2
+++ b/bin/tests/system/cache_delegns/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/cacheclean/ns1/named.conf.j2 b/bin/tests/system/cacheclean/ns1/named.conf.j2
index 96d4877a296..f85984516f1 100644
--- a/bin/tests/system/cacheclean/ns1/named.conf.j2
+++ b/bin/tests/system/cacheclean/ns1/named.conf.j2
@@ -14,6 +14,8 @@ options {
 	minimal-responses no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/cacheclean/ns3/named.conf.j2 b/bin/tests/system/cacheclean/ns3/named.conf.j2
index df8e0ac5ceb..09aa76dfcf9 100644
--- a/bin/tests/system/cacheclean/ns3/named.conf.j2
+++ b/bin/tests/system/cacheclean/ns3/named.conf.j2
@@ -14,8 +14,9 @@ options {
 	minimal-responses no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "foo.bar.com" {
 	type primary;
 	file "foo.bar.com.db";
 };
-
diff --git a/bin/tests/system/camp/ns1/named.conf.j2 b/bin/tests/system/camp/ns1/named.conf.j2
index 0db89861dbb..ca214d5f921 100644
--- a/bin/tests/system/camp/ns1/named.conf.j2
+++ b/bin/tests/system/camp/ns1/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/camp/ns2/named.conf.j2 b/bin/tests/system/camp/ns2/named.conf.j2
index ccf5f4d7cd9..4b3a05a5cdb 100644
--- a/bin/tests/system/camp/ns2/named.conf.j2
+++ b/bin/tests/system/camp/ns2/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "tld0" {
 	type primary;
 	file "tld0.db";
diff --git a/bin/tests/system/cap_glues/ns1/named.conf.j2 b/bin/tests/system/cap_glues/ns1/named.conf.j2
index 1b3caaff9c7..ef0f9a93838 100644
--- a/bin/tests/system/cap_glues/ns1/named.conf.j2
+++ b/bin/tests/system/cap_glues/ns1/named.conf.j2
@@ -9,6 +9,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/cap_glues/ns2/named.conf.j2 b/bin/tests/system/cap_glues/ns2/named.conf.j2
index ab242e2c092..958f0a2f66c 100644
--- a/bin/tests/system/cap_glues/ns2/named.conf.j2
+++ b/bin/tests/system/cap_glues/ns2/named.conf.j2
@@ -9,6 +9,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "tld" {
 	type primary;
 	file "tld.db";
diff --git a/bin/tests/system/case/ns1/named.conf.j2 b/bin/tests/system/case/ns1/named.conf.j2
index e0888c24abd..873733f2291 100644
--- a/bin/tests/system/case/ns1/named.conf.j2
+++ b/bin/tests/system/case/ns1/named.conf.j2
@@ -15,6 +15,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/case/ns2/named.conf.j2 b/bin/tests/system/case/ns2/named.conf.j2
index b8c800716eb..85bb3753bf5 100644
--- a/bin/tests/system/case/ns2/named.conf.j2
+++ b/bin/tests/system/case/ns2/named.conf.j2
@@ -16,6 +16,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example" {
 	type secondary;
 	file "example.bk";
diff --git a/bin/tests/system/chain/ns1/named.conf.j2 b/bin/tests/system/chain/ns1/named.conf.j2
index 286fd2f5251..81eaf4c9a22 100644
--- a/bin/tests/system/chain/ns1/named.conf.j2
+++ b/bin/tests/system/chain/ns1/named.conf.j2
@@ -11,5 +11,6 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." { type primary; file "root.db"; };
diff --git a/bin/tests/system/chain/ns2/named.conf.j2 b/bin/tests/system/chain/ns2/named.conf.j2
index 72973fd34f9..98ce052d16b 100644
--- a/bin/tests/system/chain/ns2/named.conf.j2
+++ b/bin/tests/system/chain/ns2/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone . {
        type hint;
        file "../../_common/root.hint";
diff --git a/bin/tests/system/chain/ns5/named.conf.j2 b/bin/tests/system/chain/ns5/named.conf.j2
index 7162e450a83..47adb9926f0 100644
--- a/bin/tests/system/chain/ns5/named.conf.j2
+++ b/bin/tests/system/chain/ns5/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/chase_ds/ns1/named.conf.j2 b/bin/tests/system/chase_ds/ns1/named.conf.j2
index 7c45a46235a..b2126e0f77a 100644
--- a/bin/tests/system/chase_ds/ns1/named.conf.j2
+++ b/bin/tests/system/chase_ds/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	dnssec-validation yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db.signed";
diff --git a/bin/tests/system/chase_ds/ns2/named.conf.j2 b/bin/tests/system/chase_ds/ns2/named.conf.j2
index 55036d27427..17086676a90 100644
--- a/bin/tests/system/chase_ds/ns2/named.conf.j2
+++ b/bin/tests/system/chase_ds/ns2/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example" {
 	type primary;
 	file "example.db.signed";
diff --git a/bin/tests/system/checkds/ns1/named.conf.j2 b/bin/tests/system/checkds/ns1/named.conf.j2
index 723e1ccdd16..4a858d5fc78 100644
--- a/bin/tests/system/checkds/ns1/named.conf.j2
+++ b/bin/tests/system/checkds/ns1/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db.signed";
diff --git a/bin/tests/system/checknames/ns1/named.conf.j2 b/bin/tests/system/checknames/ns1/named.conf.j2
index 56b63e80d9c..a50be2c4904 100644
--- a/bin/tests/system/checknames/ns1/named.conf.j2
+++ b/bin/tests/system/checknames/ns1/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	check-integrity no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/checknames/ns2/named.conf.j2 b/bin/tests/system/checknames/ns2/named.conf.j2
index bac9992cf33..0bddeee2350 100644
--- a/bin/tests/system/checknames/ns2/named.conf.j2
+++ b/bin/tests/system/checknames/ns2/named.conf.j2
@@ -12,6 +12,7 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/checknames/ns3/named.conf.j2 b/bin/tests/system/checknames/ns3/named.conf.j2
index 7385246fb17..4631725c478 100644
--- a/bin/tests/system/checknames/ns3/named.conf.j2
+++ b/bin/tests/system/checknames/ns3/named.conf.j2
@@ -12,6 +12,7 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/checknames/ns4/named.conf.j2 b/bin/tests/system/checknames/ns4/named.conf.j2
index f79e5b820b3..f87d60ca49b 100644
--- a/bin/tests/system/checknames/ns4/named.conf.j2
+++ b/bin/tests/system/checknames/ns4/named.conf.j2
@@ -14,6 +14,7 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/checknames/ns5/named.conf.j2 b/bin/tests/system/checknames/ns5/named.conf.j2
index 55ceaa8df13..d0a89a74342 100644
--- a/bin/tests/system/checknames/ns5/named.conf.j2
+++ b/bin/tests/system/checknames/ns5/named.conf.j2
@@ -14,6 +14,7 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/cookie/ns2/named.conf.j2 b/bin/tests/system/cookie/ns2/named.conf.j2
index e2d0494255f..ad9e6a81088 100644
--- a/bin/tests/system/cookie/ns2/named.conf.j2
+++ b/bin/tests/system/cookie/ns2/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	nocookie-udp-size 512;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/cookie/ns7/named.conf.j2 b/bin/tests/system/cookie/ns7/named.conf.j2
index bc81bfc77cd..b1769fd78f3 100644
--- a/bin/tests/system/cookie/ns7/named.conf.j2
+++ b/bin/tests/system/cookie/ns7/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/cpu/ns1/named.conf.j2 b/bin/tests/system/cpu/ns1/named.conf.j2
index 4494215cdb6..5bb320848c5 100644
--- a/bin/tests/system/cpu/ns1/named.conf.j2
+++ b/bin/tests/system/cpu/ns1/named.conf.j2
@@ -5,3 +5,5 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 };
+
+{% include "_common/controls.conf.j2" %}
diff --git a/bin/tests/system/cyclic_glue/ns2/named.conf.j2 b/bin/tests/system/cyclic_glue/ns2/named.conf.j2
index 6acab2ecb50..6b913d96587 100644
--- a/bin/tests/system/cyclic_glue/ns2/named.conf.j2
+++ b/bin/tests/system/cyclic_glue/ns2/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	minimal-responses no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "test" {
 	type primary;
 	file "test.db";
diff --git a/bin/tests/system/cyclic_glue/ns3/named.conf.j2 b/bin/tests/system/cyclic_glue/ns3/named.conf.j2
index 5bc355ce265..0d081ec8c6f 100644
--- a/bin/tests/system/cyclic_glue/ns3/named.conf.j2
+++ b/bin/tests/system/cyclic_glue/ns3/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "foo.test" {
 	type primary;
 	file "zones.db";
diff --git a/bin/tests/system/delegation_ttl/ns1/named.conf.j2 b/bin/tests/system/delegation_ttl/ns1/named.conf.j2
index 1b3caaff9c7..ef0f9a93838 100644
--- a/bin/tests/system/delegation_ttl/ns1/named.conf.j2
+++ b/bin/tests/system/delegation_ttl/ns1/named.conf.j2
@@ -9,6 +9,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/digdelv/ns1/named.conf.j2 b/bin/tests/system/digdelv/ns1/named.conf.j2
index 1b3f74bfd8f..c94b855a8b8 100644
--- a/bin/tests/system/digdelv/ns1/named.conf.j2
+++ b/bin/tests/system/digdelv/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/digdelv/ns2/named.conf.j2 b/bin/tests/system/digdelv/ns2/named.conf.j2
index 90889a22274..4fa3afd7493 100644
--- a/bin/tests/system/digdelv/ns2/named.conf.j2
+++ b/bin/tests/system/digdelv/ns2/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	minimal-any no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/digdelv/ns3/named.conf.j2 b/bin/tests/system/digdelv/ns3/named.conf.j2
index 504f6658f25..bc7f2470154 100644
--- a/bin/tests/system/digdelv/ns3/named.conf.j2
+++ b/bin/tests/system/digdelv/ns3/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	minimal-any no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/dns64/ns2/named.conf.j2 b/bin/tests/system/dns64/ns2/named.conf.j2
index 7a2bdb529d3..38ede07c096 100644
--- a/bin/tests/system/dns64/ns2/named.conf.j2
+++ b/bin/tests/system/dns64/ns2/named.conf.j2
@@ -47,6 +47,7 @@ options {
 	response-policy { zone "rpz"; };
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/dns64/ns3/named.conf.j2 b/bin/tests/system/dns64/ns3/named.conf.j2
index b3a3d926f09..96bef6e0809 100644
--- a/bin/tests/system/dns64/ns3/named.conf.j2
+++ b/bin/tests/system/dns64/ns3/named.conf.j2
@@ -27,6 +27,7 @@ options {
 	};
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/dns64/ns4/named.conf.j2 b/bin/tests/system/dns64/ns4/named.conf.j2
index 0a74455c939..0e461df50dd 100644
--- a/bin/tests/system/dns64/ns4/named.conf.j2
+++ b/bin/tests/system/dns64/ns4/named.conf.j2
@@ -17,6 +17,7 @@ options {
 	recursion no;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type master;
diff --git a/bin/tests/system/dns64_dname/ns1/named.conf.j2 b/bin/tests/system/dns64_dname/ns1/named.conf.j2
index c65897087af..29d15a1a4c8 100644
--- a/bin/tests/system/dns64_dname/ns1/named.conf.j2
+++ b/bin/tests/system/dns64_dname/ns1/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/dns64_dname/ns2/named.conf.j2 b/bin/tests/system/dns64_dname/ns2/named.conf.j2
index f785ba3c835..f9fd7df3718 100644
--- a/bin/tests/system/dns64_dname/ns2/named.conf.j2
+++ b/bin/tests/system/dns64_dname/ns2/named.conf.j2
@@ -14,6 +14,8 @@ options {
 	dns64 64:ff9b::/96 { };
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/dnssec/ns1/named.conf.j2 b/bin/tests/system/dnssec/ns1/named.conf.j2
index e5ef55d4c75..6e444773751 100644
--- a/bin/tests/system/dnssec/ns1/named.conf.j2
+++ b/bin/tests/system/dnssec/ns1/named.conf.j2
@@ -17,6 +17,8 @@ options {
 	trust-anchor-telemetry no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db.signed";
diff --git a/bin/tests/system/dnssec/ns6/named.conf.j2 b/bin/tests/system/dnssec/ns6/named.conf.j2
index 0c260f2c202..79d0be40f9a 100644
--- a/bin/tests/system/dnssec/ns6/named.conf.j2
+++ b/bin/tests/system/dnssec/ns6/named.conf.j2
@@ -15,6 +15,8 @@ options {
 	dnssec-validation yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/dnssec_bypass/ns1/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns1/named.conf.j2
index 59ced1831a1..1cb517b6985 100644
--- a/bin/tests/system/dnssec_bypass/ns1/named.conf.j2
+++ b/bin/tests/system/dnssec_bypass/ns1/named.conf.j2
@@ -20,6 +20,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "test." {
 	type primary;
 	file "test.db.signed";
diff --git a/bin/tests/system/dnssec_bypass/ns2/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns2/named.conf.j2
index e81cee7cac2..bdc53423989 100644
--- a/bin/tests/system/dnssec_bypass/ns2/named.conf.j2
+++ b/bin/tests/system/dnssec_bypass/ns2/named.conf.j2
@@ -20,6 +20,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "victim.test." {
 	type primary;
 	file "victim.db.signed";
diff --git a/bin/tests/system/dnssec_bypass/ns3/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns3/named.conf.j2
index 17d3e18e4e1..d5d4a2be920 100644
--- a/bin/tests/system/dnssec_bypass/ns3/named.conf.j2
+++ b/bin/tests/system/dnssec_bypass/ns3/named.conf.j2
@@ -20,6 +20,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "evil.test." {
 	type primary;
 	file "evil.db.signed";
diff --git a/bin/tests/system/dnssec_bypass/ns4/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns4/named.conf.j2
index 039695d9b79..065dcf1ce41 100644
--- a/bin/tests/system/dnssec_bypass/ns4/named.conf.j2
+++ b/bin/tests/system/dnssec_bypass/ns4/named.conf.j2
@@ -25,6 +25,8 @@ options {
 	synth-from-dnssec yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 trust-anchors {
 	@root.domain@ @root.type@ @root.contents@;
 };
diff --git a/bin/tests/system/dnssec_cname_response/ns3/named.conf.j2 b/bin/tests/system/dnssec_cname_response/ns3/named.conf.j2
index fbabe4ce838..786530ca352 100644
--- a/bin/tests/system/dnssec_cname_response/ns3/named.conf.j2
+++ b/bin/tests/system/dnssec_cname_response/ns3/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	recursion yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example." {
 	type static-stub;
 	server-addresses { 10.53.0.2; };
diff --git a/bin/tests/system/ednscompliance/ns1/named.conf.j2 b/bin/tests/system/ednscompliance/ns1/named.conf.j2
index 8be5df6d0a8..1c10d0fce2c 100644
--- a/bin/tests/system/ednscompliance/ns1/named.conf.j2
+++ b/bin/tests/system/ednscompliance/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	server-id "ns1";
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/fetchlimit/ns1/named.conf.j2 b/bin/tests/system/fetchlimit/ns1/named.conf.j2
index c4e161a7959..c68ddd0467a 100644
--- a/bin/tests/system/fetchlimit/ns1/named.conf.j2
+++ b/bin/tests/system/fetchlimit/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/formerr/ns1/named.conf.j2 b/bin/tests/system/formerr/ns1/named.conf.j2
index f78a62a9bdc..0cc901254d0 100644
--- a/bin/tests/system/formerr/ns1/named.conf.j2
+++ b/bin/tests/system/formerr/ns1/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/forward/ns1/named.conf.j2 b/bin/tests/system/forward/ns1/named.conf.j2
index 3383ef974a4..f0bf86ba7f9 100644
--- a/bin/tests/system/forward/ns1/named.conf.j2
+++ b/bin/tests/system/forward/ns1/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db.signed";
diff --git a/bin/tests/system/forward/ns10/named.conf.j2 b/bin/tests/system/forward/ns10/named.conf.j2
index d12882ef764..815d92305a1 100644
--- a/bin/tests/system/forward/ns10/named.conf.j2
+++ b/bin/tests/system/forward/ns10/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "net." {
 	type master;
 	file "fakenet.db";
diff --git a/bin/tests/system/forward/ns2/named.conf.j2 b/bin/tests/system/forward/ns2/named.conf.j2
index 0a13edc736e..af7033b5d50 100644
--- a/bin/tests/system/forward/ns2/named.conf.j2
+++ b/bin/tests/system/forward/ns2/named.conf.j2
@@ -26,6 +26,8 @@ options {
 
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "root.db";
diff --git a/bin/tests/system/forward/ns4/named.conf.j2 b/bin/tests/system/forward/ns4/named.conf.j2
index e2a381cd4cd..5854c30999a 100644
--- a/bin/tests/system/forward/ns4/named.conf.j2
+++ b/bin/tests/system/forward/ns4/named.conf.j2
@@ -20,6 +20,8 @@ options {
 
 };
 
+{% include "_common/controls.conf.j2" %}
+
 {% if FEATURE_JSON_C == "1" %}
 statistics-channels { inet 10.53.0.4 port @EXTRAPORT1@ allow { localhost; }; };
 {% endif %}
diff --git a/bin/tests/system/forward/ns5/named.conf.j2 b/bin/tests/system/forward/ns5/named.conf.j2
index 02b8b7ed2b8..bf7ce3cb528 100644
--- a/bin/tests/system/forward/ns5/named.conf.j2
+++ b/bin/tests/system/forward/ns5/named.conf.j2
@@ -12,6 +12,7 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/forward/ns7/named.conf.j2 b/bin/tests/system/forward/ns7/named.conf.j2
index 3fc932af227..fc392c37d4f 100644
--- a/bin/tests/system/forward/ns7/named.conf.j2
+++ b/bin/tests/system/forward/ns7/named.conf.j2
@@ -11,6 +11,7 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/forward/ns8/named.conf.j2 b/bin/tests/system/forward/ns8/named.conf.j2
index bed7c17240b..0d44e5f900a 100644
--- a/bin/tests/system/forward/ns8/named.conf.j2
+++ b/bin/tests/system/forward/ns8/named.conf.j2
@@ -11,6 +11,7 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/glue/ns1/named.conf.j2 b/bin/tests/system/glue/ns1/named.conf.j2
index b38108410bc..684150bfe19 100644
--- a/bin/tests/system/glue/ns1/named.conf.j2
+++ b/bin/tests/system/glue/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/host/ns1/named.conf.j2 b/bin/tests/system/host/ns1/named.conf.j2
index 5e63f8a07c3..3a5a0a02752 100644
--- a/bin/tests/system/host/ns1/named.conf.j2
+++ b/bin/tests/system/host/ns1/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/idna/ns1/named.conf.j2 b/bin/tests/system/idna/ns1/named.conf.j2
index 1b3f74bfd8f..c94b855a8b8 100644
--- a/bin/tests/system/idna/ns1/named.conf.j2
+++ b/bin/tests/system/idna/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/include_multiplecfg/ns2/named.conf.j2 b/bin/tests/system/include_multiplecfg/ns2/named.conf.j2
index 418ed68c31f..641dcd88b13 100644
--- a/bin/tests/system/include_multiplecfg/ns2/named.conf.j2
+++ b/bin/tests/system/include_multiplecfg/ns2/named.conf.j2
@@ -8,9 +8,10 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 # Should include all files matching pattern.
 include "zone*.conf";
 
 # Shouldn't break standard file pattern.
 include "mars.conf";
-
diff --git a/bin/tests/system/inline/ns4/named.conf.j2 b/bin/tests/system/inline/ns4/named.conf.j2
index 5c795759e7a..f20f7807b32 100644
--- a/bin/tests/system/inline/ns4/named.conf.j2
+++ b/bin/tests/system/inline/ns4/named.conf.j2
@@ -15,6 +15,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "noixfr" {
 	type primary;
 	file "noixfr.db";
diff --git a/bin/tests/system/integrity/ns1/named.conf.j2 b/bin/tests/system/integrity/ns1/named.conf.j2
index cc1474604b4..134fda0e628 100644
--- a/bin/tests/system/integrity/ns1/named.conf.j2
+++ b/bin/tests/system/integrity/ns1/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/kasp/ns1/named.conf.j2 b/bin/tests/system/kasp/ns1/named.conf.j2
index 4280a2829cf..d99ee3c39b3 100644
--- a/bin/tests/system/kasp/ns1/named.conf.j2
+++ b/bin/tests/system/kasp/ns1/named.conf.j2
@@ -13,6 +13,8 @@ options {
         allow-transfer { any; };
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/legacy/ns10/named.conf.j2 b/bin/tests/system/legacy/ns10/named.conf.j2
index 38eb4992e14..094e6f14e15 100644
--- a/bin/tests/system/legacy/ns10/named.conf.j2
+++ b/bin/tests/system/legacy/ns10/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "ednsrefused" {
 	type primary;
 	file "ednsrefused.db";
diff --git a/bin/tests/system/legacy/ns2/named.conf.j2 b/bin/tests/system/legacy/ns2/named.conf.j2
index 81701dc5281..38a165bbd37 100644
--- a/bin/tests/system/legacy/ns2/named.conf.j2
+++ b/bin/tests/system/legacy/ns2/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "dropedns" {
 	type primary;
 	file "dropedns.db";
diff --git a/bin/tests/system/legacy/ns3/named.conf.j2 b/bin/tests/system/legacy/ns3/named.conf.j2
index 6f43e65e654..1a77304d632 100644
--- a/bin/tests/system/legacy/ns3/named.conf.j2
+++ b/bin/tests/system/legacy/ns3/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "dropedns-notcp" {
 	type primary;
 	file "dropedns-notcp.db";
diff --git a/bin/tests/system/legacy/ns4/named.conf.j2 b/bin/tests/system/legacy/ns4/named.conf.j2
index 9a5bca99a05..e90fa7f8dd2 100644
--- a/bin/tests/system/legacy/ns4/named.conf.j2
+++ b/bin/tests/system/legacy/ns4/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "plain" {
 	type primary;
 	file "plain.db";
diff --git a/bin/tests/system/legacy/ns5/named.conf.j2 b/bin/tests/system/legacy/ns5/named.conf.j2
index 28d93c0f7c2..7f84ed4a3ce 100644
--- a/bin/tests/system/legacy/ns5/named.conf.j2
+++ b/bin/tests/system/legacy/ns5/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "plain-notcp" {
 	type primary;
 	file "plain-notcp.db";
diff --git a/bin/tests/system/legacy/ns6/named.conf.j2 b/bin/tests/system/legacy/ns6/named.conf.j2
index b6cb3f6ea48..340f0665747 100644
--- a/bin/tests/system/legacy/ns6/named.conf.j2
+++ b/bin/tests/system/legacy/ns6/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "edns512" {
 	type primary;
 	file "edns512.db.signed";
diff --git a/bin/tests/system/legacy/ns7/named.conf.j2 b/bin/tests/system/legacy/ns7/named.conf.j2
index 474fdc08553..d141a6366c8 100644
--- a/bin/tests/system/legacy/ns7/named.conf.j2
+++ b/bin/tests/system/legacy/ns7/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "edns512-notcp" {
 	type primary;
 	file "edns512-notcp.db.signed";
diff --git a/bin/tests/system/legacy/ns8/named.conf.j2 b/bin/tests/system/legacy/ns8/named.conf.j2
index 153a9af0c4c..4a759fcd5d3 100644
--- a/bin/tests/system/legacy/ns8/named.conf.j2
+++ b/bin/tests/system/legacy/ns8/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "ednsformerr" {
 	type primary;
 	file "ednsformerr.db";
diff --git a/bin/tests/system/legacy/ns9/named.conf.j2 b/bin/tests/system/legacy/ns9/named.conf.j2
index 415c6ad4d9b..21843140738 100644
--- a/bin/tests/system/legacy/ns9/named.conf.j2
+++ b/bin/tests/system/legacy/ns9/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "ednsnotimp" {
 	type primary;
 	file "ednsnotimp.db";
diff --git a/bin/tests/system/limits/ns1/named.conf.j2 b/bin/tests/system/limits/ns1/named.conf.j2
index 61e23062ba8..ebf502dae5f 100644
--- a/bin/tests/system/limits/ns1/named.conf.j2
+++ b/bin/tests/system/limits/ns1/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	max-records-per-type 0;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/masterfile/ns1/named.conf.j2 b/bin/tests/system/masterfile/ns1/named.conf.j2
index 9fb80ce5fda..8e9b7b01dc2 100644
--- a/bin/tests/system/masterfile/ns1/named.conf.j2
+++ b/bin/tests/system/masterfile/ns1/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "include" {
 	type primary;
 	file "include.db";
diff --git a/bin/tests/system/masterfile/ns2/named.conf.j2 b/bin/tests/system/masterfile/ns2/named.conf.j2
index 72fa31d161b..0653e1b987a 100644
--- a/bin/tests/system/masterfile/ns2/named.conf.j2
+++ b/bin/tests/system/masterfile/ns2/named.conf.j2
@@ -14,6 +14,7 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/masterformat/ns2/named.conf.j2 b/bin/tests/system/masterformat/ns2/named.conf.j2
index 8dd7731d47a..8981f999038 100644
--- a/bin/tests/system/masterformat/ns2/named.conf.j2
+++ b/bin/tests/system/masterformat/ns2/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	max-types-per-name 200;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/mirror/ns1/named.conf.j2 b/bin/tests/system/mirror/ns1/named.conf.j2
index 7b3ecfc772c..bcb8c46c7d4 100644
--- a/bin/tests/system/mirror/ns1/named.conf.j2
+++ b/bin/tests/system/mirror/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db.signed";
diff --git a/bin/tests/system/multisigner/ns1/named.conf.j2 b/bin/tests/system/multisigner/ns1/named.conf.j2
index 23ae26b2754..dacf753f207 100644
--- a/bin/tests/system/multisigner/ns1/named.conf.j2
+++ b/bin/tests/system/multisigner/ns1/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db.signed";
diff --git a/bin/tests/system/names/ns1/named.conf.j2 b/bin/tests/system/names/ns1/named.conf.j2
index 157f95f3c0f..b97647f5719 100644
--- a/bin/tests/system/names/ns1/named.conf.j2
+++ b/bin/tests/system/names/ns1/named.conf.j2
@@ -13,6 +13,7 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 view compress {
 	match-clients { 10.53.0.1/32; };
diff --git a/bin/tests/system/notify/ns1/named.conf.j2 b/bin/tests/system/notify/ns1/named.conf.j2
index 20a0ef7cb76..ca9e1b81d88 100644
--- a/bin/tests/system/notify/ns1/named.conf.j2
+++ b/bin/tests/system/notify/ns1/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/notify/ns3/named.conf.j2 b/bin/tests/system/notify/ns3/named.conf.j2
index b583c775a4c..b63243a02fe 100644
--- a/bin/tests/system/notify/ns3/named.conf.j2
+++ b/bin/tests/system/notify/ns3/named.conf.j2
@@ -22,6 +22,8 @@ options {
 
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/notify/ns4/named.conf.j2 b/bin/tests/system/notify/ns4/named.conf.j2
index 4c6703c6d2e..99306c65b36 100644
--- a/bin/tests/system/notify/ns4/named.conf.j2
+++ b/bin/tests/system/notify/ns4/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/notify/ns5/named.conf.j2 b/bin/tests/system/notify/ns5/named.conf.j2
index 8c2c85ddc21..8979a067bfa 100644
--- a/bin/tests/system/notify/ns5/named.conf.j2
+++ b/bin/tests/system/notify/ns5/named.conf.j2
@@ -27,6 +27,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 view "a" {
 	match-clients { key "a"; };
 	zone "x21" {
diff --git a/bin/tests/system/nsec/ns1/named.conf.j2 b/bin/tests/system/nsec/ns1/named.conf.j2
index 237e29805fb..49dbe6cbeab 100644
--- a/bin/tests/system/nsec/ns1/named.conf.j2
+++ b/bin/tests/system/nsec/ns1/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/nsec/ns2/named.conf.j2 b/bin/tests/system/nsec/ns2/named.conf.j2
index a2e2981603a..1a41313ddfa 100644
--- a/bin/tests/system/nsec/ns2/named.conf.j2
+++ b/bin/tests/system/nsec/ns2/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "excessive-nsec-rrsigs" {
 	type primary;
 	file "excessive-nsec-rrsigs.db.signed";
diff --git a/bin/tests/system/nsec/ns3/named.conf.j2 b/bin/tests/system/nsec/ns3/named.conf.j2
index 6fddf827c88..d07e16e1d9e 100644
--- a/bin/tests/system/nsec/ns3/named.conf.j2
+++ b/bin/tests/system/nsec/ns3/named.conf.j2
@@ -14,6 +14,8 @@ options {
 	max-records-per-type 2;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
         type hint;
         file "../../_common/root.hint";
diff --git a/bin/tests/system/nsec3/ns4/named.conf.j2 b/bin/tests/system/nsec3/ns4/named.conf.j2
index 938d6687b86..83a3e1bb3c9 100644
--- a/bin/tests/system/nsec3/ns4/named.conf.j2
+++ b/bin/tests/system/nsec3/ns4/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 remote-servers "ns3" {
 	10.53.0.3 port @PORT@;
 };
diff --git a/bin/tests/system/nsec3/ns5/named.conf.j2 b/bin/tests/system/nsec3/ns5/named.conf.j2
index f12ff649ac1..deec62de8ce 100644
--- a/bin/tests/system/nsec3/ns5/named.conf.j2
+++ b/bin/tests/system/nsec3/ns5/named.conf.j2
@@ -14,6 +14,8 @@ options {
 	send-cookie no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 trust-anchors {
     evil.test. static-key 257 3 13 "yh1W7zgrqOsAZdKAh597SI7F2ye4ReiLmBNsDg+TDLJQ+3C2fXfrsQyY MvA+hmzTQdKX24zlVlD3YAVA6+VmrQ==";
 };
diff --git a/bin/tests/system/nsec3/ns6/named.conf.j2 b/bin/tests/system/nsec3/ns6/named.conf.j2
index 9093e6d2bd7..7be0738383a 100644
--- a/bin/tests/system/nsec3/ns6/named.conf.j2
+++ b/bin/tests/system/nsec3/ns6/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "evil.test" {
     type primary;
     file "evil.test.db.signed";
diff --git a/bin/tests/system/nslimit_outdomain/ns1/named.conf.j2 b/bin/tests/system/nslimit_outdomain/ns1/named.conf.j2
index fd83fc3c196..987693a98b6 100644
--- a/bin/tests/system/nslimit_outdomain/ns1/named.conf.j2
+++ b/bin/tests/system/nslimit_outdomain/ns1/named.conf.j2
@@ -22,6 +22,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/nslimit_outdomain/ns2/named.conf.j2 b/bin/tests/system/nslimit_outdomain/ns2/named.conf.j2
index 037ac60fe07..f1d7a2e8333 100644
--- a/bin/tests/system/nslimit_outdomain/ns2/named.conf.j2
+++ b/bin/tests/system/nslimit_outdomain/ns2/named.conf.j2
@@ -30,6 +30,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "tld." {
 	type primary;
 	file "tld.db";
diff --git a/bin/tests/system/nslimit_outdomain/ns3/named.conf.j2 b/bin/tests/system/nslimit_outdomain/ns3/named.conf.j2
index f7e03a82e76..75df06ea6dc 100644
--- a/bin/tests/system/nslimit_outdomain/ns3/named.conf.j2
+++ b/bin/tests/system/nslimit_outdomain/ns3/named.conf.j2
@@ -24,6 +24,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example4.tld." {
 	type primary;
 	file "example4.tld.db";
diff --git a/bin/tests/system/nslookup/ns1/named.conf.j2 b/bin/tests/system/nslookup/ns1/named.conf.j2
index 5e63f8a07c3..3a5a0a02752 100644
--- a/bin/tests/system/nslookup/ns1/named.conf.j2
+++ b/bin/tests/system/nslookup/ns1/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/nta/ns1/named.conf.j2 b/bin/tests/system/nta/ns1/named.conf.j2
index d8fa84e94ea..04d6f7dfbb4 100644
--- a/bin/tests/system/nta/ns1/named.conf.j2
+++ b/bin/tests/system/nta/ns1/named.conf.j2
@@ -15,6 +15,8 @@ options {
 	trust-anchor-telemetry no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db.signed";
diff --git a/bin/tests/system/pending/ns1/named.conf.j2 b/bin/tests/system/pending/ns1/named.conf.j2
index 86d9f94d8e4..1b6058a1e5b 100644
--- a/bin/tests/system/pending/ns1/named.conf.j2
+++ b/bin/tests/system/pending/ns1/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db.signed";
diff --git a/bin/tests/system/pending/ns2/named.conf.j2 b/bin/tests/system/pending/ns2/named.conf.j2
index 454bbd05abf..139b79936c1 100644
--- a/bin/tests/system/pending/ns2/named.conf.j2
+++ b/bin/tests/system/pending/ns2/named.conf.j2
@@ -15,6 +15,8 @@ options {
 	dnssec-validation yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/pending/ns3/named.conf.j2 b/bin/tests/system/pending/ns3/named.conf.j2
index ce879474e66..3443c5cbee9 100644
--- a/bin/tests/system/pending/ns3/named.conf.j2
+++ b/bin/tests/system/pending/ns3/named.conf.j2
@@ -15,6 +15,8 @@ options {
 	dnssec-validation yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/pending/ns4/named.conf.j2 b/bin/tests/system/pending/ns4/named.conf.j2
index 3d26b39e483..357672b9589 100644
--- a/bin/tests/system/pending/ns4/named.conf.j2
+++ b/bin/tests/system/pending/ns4/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	dnssec-validation yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/qmin/ns1/named.conf.j2 b/bin/tests/system/qmin/ns1/named.conf.j2
index edc0892b3d0..22c124ba0f2 100644
--- a/bin/tests/system/qmin/ns1/named.conf.j2
+++ b/bin/tests/system/qmin/ns1/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/randomizens/ns1/named.conf.j2 b/bin/tests/system/randomizens/ns1/named.conf.j2
index 237e29805fb..49dbe6cbeab 100644
--- a/bin/tests/system/randomizens/ns1/named.conf.j2
+++ b/bin/tests/system/randomizens/ns1/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/reclimit/ns1/named.conf.j2 b/bin/tests/system/reclimit/ns1/named.conf.j2
index f665d3c913d..1a3b89bd0f3 100644
--- a/bin/tests/system/reclimit/ns1/named.conf.j2
+++ b/bin/tests/system/reclimit/ns1/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	max-types-per-name 0;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." { type primary; file "root.db"; };
 
 zone "big." {
diff --git a/bin/tests/system/redirect/ns1/named.conf.j2 b/bin/tests/system/redirect/ns1/named.conf.j2
index fa99ecb4529..e402dde16a5 100644
--- a/bin/tests/system/redirect/ns1/named.conf.j2
+++ b/bin/tests/system/redirect/ns1/named.conf.j2
@@ -15,6 +15,7 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type primary;
diff --git a/bin/tests/system/redirect/ns10/named.conf.j2 b/bin/tests/system/redirect/ns10/named.conf.j2
index 9e019cc5173..7a0ea44d3fb 100644
--- a/bin/tests/system/redirect/ns10/named.conf.j2
+++ b/bin/tests/system/redirect/ns10/named.conf.j2
@@ -16,6 +16,8 @@ options {
 	};
 };
 
+{% include "_common/controls.conf.j2" %}
+
 include "trusted.conf";
 
 zone "." {
diff --git a/bin/tests/system/redirect/ns3/named.conf.j2 b/bin/tests/system/redirect/ns3/named.conf.j2
index 7ceb49f78d5..72992a5f50a 100644
--- a/bin/tests/system/redirect/ns3/named.conf.j2
+++ b/bin/tests/system/redirect/ns3/named.conf.j2
@@ -13,6 +13,7 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type primary;
diff --git a/bin/tests/system/redirect/ns5/named.conf.j2 b/bin/tests/system/redirect/ns5/named.conf.j2
index dcf90f410fa..4a3374083e7 100644
--- a/bin/tests/system/redirect/ns5/named.conf.j2
+++ b/bin/tests/system/redirect/ns5/named.conf.j2
@@ -8,6 +8,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
         type primary;
         file "root.db.signed";
diff --git a/bin/tests/system/redirect/ns6/named.conf.j2 b/bin/tests/system/redirect/ns6/named.conf.j2
index a521a6b95af..18bdc770245 100644
--- a/bin/tests/system/redirect/ns6/named.conf.j2
+++ b/bin/tests/system/redirect/ns6/named.conf.j2
@@ -8,6 +8,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
         type primary;
         file "root.db";
diff --git a/bin/tests/system/redirect/ns7/named.conf.j2 b/bin/tests/system/redirect/ns7/named.conf.j2
index 0ceb769ac0f..acdca57fd2a 100644
--- a/bin/tests/system/redirect/ns7/named.conf.j2
+++ b/bin/tests/system/redirect/ns7/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	};
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
         type primary;
         file "root.db";
diff --git a/bin/tests/system/redirect/ns8/named.conf.j2 b/bin/tests/system/redirect/ns8/named.conf.j2
index d1513b31bba..92ffea0d466 100644
--- a/bin/tests/system/redirect/ns8/named.conf.j2
+++ b/bin/tests/system/redirect/ns8/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	};
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
         type hint;
         file "root.hints";
diff --git a/bin/tests/system/redirect/ns9/named.conf.j2 b/bin/tests/system/redirect/ns9/named.conf.j2
index 1001396a443..583c8cc0c21 100644
--- a/bin/tests/system/redirect/ns9/named.conf.j2
+++ b/bin/tests/system/redirect/ns9/named.conf.j2
@@ -9,6 +9,8 @@ options {
 	recursion no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db.signed";
diff --git a/bin/tests/system/resend_loop/ns1/named.conf.j2 b/bin/tests/system/resend_loop/ns1/named.conf.j2
index 4ef0c35531b..23ce10ae0b4 100644
--- a/bin/tests/system/resend_loop/ns1/named.conf.j2
+++ b/bin/tests/system/resend_loop/ns1/named.conf.j2
@@ -11,3 +11,5 @@ options {
 	forwarders { 10.53.0.3 port @PORT@; };
 	forward only;
 };
+
+{% include "_common/controls.conf.j2" %}
diff --git a/bin/tests/system/resend_loop/ns4/named.conf.j2 b/bin/tests/system/resend_loop/ns4/named.conf.j2
index e686eaaa42f..86c074af8a7 100644
--- a/bin/tests/system/resend_loop/ns4/named.conf.j2
+++ b/bin/tests/system/resend_loop/ns4/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." IN {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/resolver/ns11/named.conf.j2 b/bin/tests/system/resolver/ns11/named.conf.j2
index d2b13c476bc..ccccce2ba03 100644
--- a/bin/tests/system/resolver/ns11/named.conf.j2
+++ b/bin/tests/system/resolver/ns11/named.conf.j2
@@ -10,3 +10,5 @@ options {
 	dnssec-validation no;
 	minimal-any no;
 };
+
+{% include "_common/controls.conf.j2" %}
diff --git a/bin/tests/system/rollover/ns1/named.conf.j2 b/bin/tests/system/rollover/ns1/named.conf.j2
index 092df199404..6822276f08d 100644
--- a/bin/tests/system/rollover/ns1/named.conf.j2
+++ b/bin/tests/system/rollover/ns1/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db.signed";
diff --git a/bin/tests/system/rootkeysentinel/ns1/named.conf.j2 b/bin/tests/system/rootkeysentinel/ns1/named.conf.j2
index 7c45a46235a..b2126e0f77a 100644
--- a/bin/tests/system/rootkeysentinel/ns1/named.conf.j2
+++ b/bin/tests/system/rootkeysentinel/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	dnssec-validation yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db.signed";
diff --git a/bin/tests/system/rootkeysentinel/ns2/named.conf.j2 b/bin/tests/system/rootkeysentinel/ns2/named.conf.j2
index 6166771083a..3450bbd7c50 100644
--- a/bin/tests/system/rootkeysentinel/ns2/named.conf.j2
+++ b/bin/tests/system/rootkeysentinel/ns2/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	dnssec-validation yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example" {
 	type primary;
 	file "example.db.signed";
diff --git a/bin/tests/system/rootkeysentinel/ns3/named.conf.j2 b/bin/tests/system/rootkeysentinel/ns3/named.conf.j2
index da5b74ce430..b1d5efa246f 100644
--- a/bin/tests/system/rootkeysentinel/ns3/named.conf.j2
+++ b/bin/tests/system/rootkeysentinel/ns3/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	root-key-sentinel yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "hint.db";
diff --git a/bin/tests/system/rootkeysentinel/ns4/named.conf.j2 b/bin/tests/system/rootkeysentinel/ns4/named.conf.j2
index 2755f6fef2b..81c6648918d 100644
--- a/bin/tests/system/rootkeysentinel/ns4/named.conf.j2
+++ b/bin/tests/system/rootkeysentinel/ns4/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	root-key-sentinel no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "hint.db";
diff --git a/bin/tests/system/rrl/ns1/named.conf.j2 b/bin/tests/system/rrl/ns1/named.conf.j2
index a29c8b4fbe9..18ba4156332 100644
--- a/bin/tests/system/rrl/ns1/named.conf.j2
+++ b/bin/tests/system/rrl/ns1/named.conf.j2
@@ -12,5 +12,6 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {type primary; file "root.db";};
diff --git a/bin/tests/system/rrl/ns3/named.conf.j2 b/bin/tests/system/rrl/ns3/named.conf.j2
index fb3cba9dcc8..20fff8ff646 100644
--- a/bin/tests/system/rrl/ns3/named.conf.j2
+++ b/bin/tests/system/rrl/ns3/named.conf.j2
@@ -30,6 +30,7 @@ options {
 
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." { type hint; file "hints"; };
 
diff --git a/bin/tests/system/rrsetorder/ns1/named.conf.j2 b/bin/tests/system/rrsetorder/ns1/named.conf.j2
index 56a38e49d22..f200b44eeb7 100644
--- a/bin/tests/system/rrsetorder/ns1/named.conf.j2
+++ b/bin/tests/system/rrsetorder/ns1/named.conf.j2
@@ -18,6 +18,8 @@ options {
 	};
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/rrsetorder/ns2/named.conf.j2 b/bin/tests/system/rrsetorder/ns2/named.conf.j2
index 739183d1454..99f77d8e174 100644
--- a/bin/tests/system/rrsetorder/ns2/named.conf.j2
+++ b/bin/tests/system/rrsetorder/ns2/named.conf.j2
@@ -18,6 +18,8 @@ options {
 	};
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type secondary;
 	primaries { 10.53.0.1; };
diff --git a/bin/tests/system/rrsetorder/ns3/named.conf.j2 b/bin/tests/system/rrsetorder/ns3/named.conf.j2
index 2fa8c08db30..0f45d2ccaa9 100644
--- a/bin/tests/system/rrsetorder/ns3/named.conf.j2
+++ b/bin/tests/system/rrsetorder/ns3/named.conf.j2
@@ -18,6 +18,7 @@ options {
 	};
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/rrsetorder/ns4/named.conf.j2 b/bin/tests/system/rrsetorder/ns4/named.conf.j2
index 4941c353c2b..3a246084f4a 100644
--- a/bin/tests/system/rrsetorder/ns4/named.conf.j2
+++ b/bin/tests/system/rrsetorder/ns4/named.conf.j2
@@ -15,6 +15,7 @@ options {
 
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/rrsetorder/ns5/named.conf.j2 b/bin/tests/system/rrsetorder/ns5/named.conf.j2
index 502563131e4..84355fe4f58 100644
--- a/bin/tests/system/rrsetorder/ns5/named.conf.j2
+++ b/bin/tests/system/rrsetorder/ns5/named.conf.j2
@@ -11,6 +11,7 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/rsabigexponent/ns1/named.conf.j2 b/bin/tests/system/rsabigexponent/ns1/named.conf.j2
index 85cd432f8d8..166e79fa1d4 100644
--- a/bin/tests/system/rsabigexponent/ns1/named.conf.j2
+++ b/bin/tests/system/rsabigexponent/ns1/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	dnssec-validation yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db.signed";
diff --git a/bin/tests/system/rsabigexponent/ns2/named.conf.j2 b/bin/tests/system/rsabigexponent/ns2/named.conf.j2
index 6b7884c4691..128b3c42870 100644
--- a/bin/tests/system/rsabigexponent/ns2/named.conf.j2
+++ b/bin/tests/system/rsabigexponent/ns2/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/runtime/ns2/named2.conf.j2 b/bin/tests/system/runtime/ns2/named2.conf.j2
index 76fcbead8a5..bdef0b33e17 100644
--- a/bin/tests/system/runtime/ns2/named2.conf.j2
+++ b/bin/tests/system/runtime/ns2/named2.conf.j2
@@ -7,3 +7,5 @@ options {
 	recursion no;
 	dnssec-validation no;
 };
+
+{% include "_common/controls.conf.j2" %}
diff --git a/bin/tests/system/runtime/ns2/named3.conf.j2 b/bin/tests/system/runtime/ns2/named3.conf.j2
index c05d82b4d39..d65d2dc441d 100644
--- a/bin/tests/system/runtime/ns2/named3.conf.j2
+++ b/bin/tests/system/runtime/ns2/named3.conf.j2
@@ -7,3 +7,5 @@ options {
 	recursion no;
 	dnssec-validation no;
 };
+
+{% include "_common/controls.conf.j2" %}
diff --git a/bin/tests/system/runtime/ns2/named4.conf.j2 b/bin/tests/system/runtime/ns2/named4.conf.j2
index 1de369c9a0d..24074e78f6d 100644
--- a/bin/tests/system/runtime/ns2/named4.conf.j2
+++ b/bin/tests/system/runtime/ns2/named4.conf.j2
@@ -7,3 +7,5 @@ options {
 	recursion no;
 	dnssec-validation no;
 };
+
+{% include "_common/controls.conf.j2" %}
diff --git a/bin/tests/system/runtime/ns2/named5.conf.j2 b/bin/tests/system/runtime/ns2/named5.conf.j2
index cf897a04a32..1c4f1e04f73 100644
--- a/bin/tests/system/runtime/ns2/named5.conf.j2
+++ b/bin/tests/system/runtime/ns2/named5.conf.j2
@@ -5,3 +5,5 @@ options {
 	listen-on-v6 { fd92:7065:b8e:ffff::2; };
 	dnssec-validation no;
 };
+
+{% include "_common/controls.conf.j2" %}
diff --git a/bin/tests/system/runtime/ns2/named6.conf.j2 b/bin/tests/system/runtime/ns2/named6.conf.j2
index 632221f3b0e..ff624ce11e9 100644
--- a/bin/tests/system/runtime/ns2/named6.conf.j2
+++ b/bin/tests/system/runtime/ns2/named6.conf.j2
@@ -6,6 +6,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "ipv4-only-servers" {
 	type secondary;
 	primaries { 10.53.0.3; };
diff --git a/bin/tests/system/runtime/ns2/named7.conf.j2 b/bin/tests/system/runtime/ns2/named7.conf.j2
index 1959b3d18c0..f54099868b7 100644
--- a/bin/tests/system/runtime/ns2/named7.conf.j2
+++ b/bin/tests/system/runtime/ns2/named7.conf.j2
@@ -6,3 +6,5 @@ options {
 	recursion no;
 	dnssec-validation no;
 };
+
+{% include "_common/controls.conf.j2" %}
diff --git a/bin/tests/system/selfpointedglue/ns1/named.conf.j2 b/bin/tests/system/selfpointedglue/ns1/named.conf.j2
index fd83fc3c196..987693a98b6 100644
--- a/bin/tests/system/selfpointedglue/ns1/named.conf.j2
+++ b/bin/tests/system/selfpointedglue/ns1/named.conf.j2
@@ -22,6 +22,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/selfpointedglue/ns2/named.conf.j2 b/bin/tests/system/selfpointedglue/ns2/named.conf.j2
index 2993832da2e..080731257f7 100644
--- a/bin/tests/system/selfpointedglue/ns2/named.conf.j2
+++ b/bin/tests/system/selfpointedglue/ns2/named.conf.j2
@@ -22,6 +22,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "tld." {
 	type primary;
 	file "tld.db";
diff --git a/bin/tests/system/selfpointedglue/ns3/named.conf.j2 b/bin/tests/system/selfpointedglue/ns3/named.conf.j2
index 0c50ca86589..366a9479b31 100644
--- a/bin/tests/system/selfpointedglue/ns3/named.conf.j2
+++ b/bin/tests/system/selfpointedglue/ns3/named.conf.j2
@@ -33,6 +33,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example.tld." {
 	type primary;
 	file "example.tld.db";
diff --git a/bin/tests/system/sfcache/ns1/named.conf.j2 b/bin/tests/system/sfcache/ns1/named.conf.j2
index 85cd432f8d8..166e79fa1d4 100644
--- a/bin/tests/system/sfcache/ns1/named.conf.j2
+++ b/bin/tests/system/sfcache/ns1/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	dnssec-validation yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db.signed";
diff --git a/bin/tests/system/sfcache_cname/ns1/named.conf.j2 b/bin/tests/system/sfcache_cname/ns1/named.conf.j2
index 9f2271e7092..88617a89c69 100644
--- a/bin/tests/system/sfcache_cname/ns1/named.conf.j2
+++ b/bin/tests/system/sfcache_cname/ns1/named.conf.j2
@@ -10,6 +10,8 @@ options {
     dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
     type primary;
     file "root.db";
diff --git a/bin/tests/system/sfcache_cname/ns2/named.conf.j2 b/bin/tests/system/sfcache_cname/ns2/named.conf.j2
index 8bc955aceb5..4fb0b54296a 100644
--- a/bin/tests/system/sfcache_cname/ns2/named.conf.j2
+++ b/bin/tests/system/sfcache_cname/ns2/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	max-query-count 2;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "tld1." {
 	type static-stub;
 	server-addresses { 10.53.0.1; };
diff --git a/bin/tests/system/spf/ns1/named.conf.j2 b/bin/tests/system/spf/ns1/named.conf.j2
index 1be3fff34a3..a0a410d24b9 100644
--- a/bin/tests/system/spf/ns1/named.conf.j2
+++ b/bin/tests/system/spf/ns1/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	ixfr-from-differences yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "spf" {
 	type primary;
 	file "spf.db";
diff --git a/bin/tests/system/srtt/ns1/named.conf.j2 b/bin/tests/system/srtt/ns1/named.conf.j2
index eb079c95ab8..248175c337c 100644
--- a/bin/tests/system/srtt/ns1/named.conf.j2
+++ b/bin/tests/system/srtt/ns1/named.conf.j2
@@ -23,6 +23,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/staticstub/ns1/named.conf.j2 b/bin/tests/system/staticstub/ns1/named.conf.j2
index 4d0a7c6d130..cb43a331348 100644
--- a/bin/tests/system/staticstub/ns1/named.conf.j2
+++ b/bin/tests/system/staticstub/ns1/named.conf.j2
@@ -9,4 +9,6 @@ options {
 	notify no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." { type primary; file "root.db"; };
diff --git a/bin/tests/system/staticstub/ns4/named.conf.j2 b/bin/tests/system/staticstub/ns4/named.conf.j2
index bfcfaae9492..530e4af37fc 100644
--- a/bin/tests/system/staticstub/ns4/named.conf.j2
+++ b/bin/tests/system/staticstub/ns4/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	notify no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example.com" {
 	type primary;
 	file "example.com.db";
diff --git a/bin/tests/system/statistics/ns1/named.conf.j2 b/bin/tests/system/statistics/ns1/named.conf.j2
index 7e7e977b22e..ed0ede2af33 100644
--- a/bin/tests/system/statistics/ns1/named.conf.j2
+++ b/bin/tests/system/statistics/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 {% if FEATURE_LIBXML2 == "1" or FEATURE_JSON_C == "1" %}
 statistics-channels {
 	inet 10.53.0.1 port @EXTRAPORT1@ allow { any; };
diff --git a/bin/tests/system/stub/ns1/named.conf.j2 b/bin/tests/system/stub/ns1/named.conf.j2
index 36d5c6e9f77..8da1242510e 100644
--- a/bin/tests/system/stub/ns1/named.conf.j2
+++ b/bin/tests/system/stub/ns1/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	minimal-responses no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/stub/ns2/named.conf.j2 b/bin/tests/system/stub/ns2/named.conf.j2
index e6bf52a5720..46d7c78de69 100644
--- a/bin/tests/system/stub/ns2/named.conf.j2
+++ b/bin/tests/system/stub/ns2/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	minimal-responses no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/stub/ns4/named.conf.j2 b/bin/tests/system/stub/ns4/named.conf.j2
index 719c341a131..83aee968275 100644
--- a/bin/tests/system/stub/ns4/named.conf.j2
+++ b/bin/tests/system/stub/ns4/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/stub/ns5/named.conf.j2 b/bin/tests/system/stub/ns5/named.conf.j2
index b509f6d1ea4..d6ca0448246 100644
--- a/bin/tests/system/stub/ns5/named.conf.j2
+++ b/bin/tests/system/stub/ns5/named.conf.j2
@@ -9,6 +9,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/tkey/ns1/named.conf.j2 b/bin/tests/system/tkey/ns1/named.conf.j2
index 3556ff5ca57..fed3f3c7973 100644
--- a/bin/tests/system/tkey/ns1/named.conf.j2
+++ b/bin/tests/system/tkey/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	notify no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 key "test-key" {
 	algorithm "hmac-sha256";
 	secret "R16NojROxtxH/xbDl//ehDsHm5DjWTQ2YXV+hGC2iBY=";
diff --git a/bin/tests/system/tsig/ns1/named.conf.j2 b/bin/tests/system/tsig/ns1/named.conf.j2
index 1d2dcd27fc0..a4afed8c654 100644
--- a/bin/tests/system/tsig/ns1/named.conf.j2
+++ b/bin/tests/system/tsig/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	notify no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 {% if FEATURE_MD5 == "1" %}
 include "named-md5.conf";
 {% endif %}
diff --git a/bin/tests/system/unknown/ns1/named.conf.j2 b/bin/tests/system/unknown/ns1/named.conf.j2
index c5b17c2a27c..8b2f73ec0a9 100644
--- a/bin/tests/system/unknown/ns1/named.conf.j2
+++ b/bin/tests/system/unknown/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	notify no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 view "in" {
 	allow-transfer { any; };
 
diff --git a/bin/tests/system/unknown/ns2/named.conf.j2 b/bin/tests/system/unknown/ns2/named.conf.j2
index 0a722f6c1cd..332fc6e2c6e 100644
--- a/bin/tests/system/unknown/ns2/named.conf.j2
+++ b/bin/tests/system/unknown/ns2/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	notify no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 view "in" {
 	zone "example." {
 		type secondary;
diff --git a/bin/tests/system/unknown/ns3/named.conf.j2 b/bin/tests/system/unknown/ns3/named.conf.j2
index ee3ba30fff1..3900e932c0c 100644
--- a/bin/tests/system/unknown/ns3/named.conf.j2
+++ b/bin/tests/system/unknown/ns3/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	notify no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 dnssec-policy unknown {
 	keys {
 		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
diff --git a/bin/tests/system/upforwd/ns1/named.conf.j2 b/bin/tests/system/upforwd/ns1/named.conf.j2
index e88a09a3a12..a729ecfc974 100644
--- a/bin/tests/system/upforwd/ns1/named.conf.j2
+++ b/bin/tests/system/upforwd/ns1/named.conf.j2
@@ -19,6 +19,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/upforwd/ns2/named.conf.j2 b/bin/tests/system/upforwd/ns2/named.conf.j2
index 3e568df9c0c..b247793bfaf 100644
--- a/bin/tests/system/upforwd/ns2/named.conf.j2
+++ b/bin/tests/system/upforwd/ns2/named.conf.j2
@@ -12,6 +12,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example" {
 	type secondary;
 	file "example.bk";
diff --git a/bin/tests/system/views/ns1/named.conf.j2 b/bin/tests/system/views/ns1/named.conf.j2
index 84ba9e8fc54..8d7b125a0c7 100644
--- a/bin/tests/system/views/ns1/named.conf.j2
+++ b/bin/tests/system/views/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/wildcard/ns1/named.conf.j2 b/bin/tests/system/wildcard/ns1/named.conf.j2
index bf19cce6532..7679821de2e 100644
--- a/bin/tests/system/wildcard/ns1/named.conf.j2
+++ b/bin/tests/system/wildcard/ns1/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." { type primary; file "root.db.signed"; };
 
 /*
diff --git a/bin/tests/system/wildcard/ns2/named.conf.j2 b/bin/tests/system/wildcard/ns2/named.conf.j2
index c1027bf78ae..478a1758a95 100644
--- a/bin/tests/system/wildcard/ns2/named.conf.j2
+++ b/bin/tests/system/wildcard/ns2/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/wildcard/ns3/named.conf.j2 b/bin/tests/system/wildcard/ns3/named.conf.j2
index e5683755119..341fd030abc 100644
--- a/bin/tests/system/wildcard/ns3/named.conf.j2
+++ b/bin/tests/system/wildcard/ns3/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 include "../ns1/trusted.conf";
 
 zone "." {
diff --git a/bin/tests/system/wildcard/ns4/named.conf.j2 b/bin/tests/system/wildcard/ns4/named.conf.j2
index 49dc6175acc..bc35691c311 100644
--- a/bin/tests/system/wildcard/ns4/named.conf.j2
+++ b/bin/tests/system/wildcard/ns4/named.conf.j2
@@ -13,6 +13,8 @@ options {
 	forwarders { 10.53.0.2; };
 };
 
+{% include "_common/controls.conf.j2" %}
+
 include "../ns1/trusted.conf";
 include "../ns1/private.nsec.conf";
 include "../ns1/private.nsec3.conf";
diff --git a/bin/tests/system/wildcard/ns5/named.conf.j2 b/bin/tests/system/wildcard/ns5/named.conf.j2
index e83c1ea91a5..98e487ef98d 100644
--- a/bin/tests/system/wildcard/ns5/named.conf.j2
+++ b/bin/tests/system/wildcard/ns5/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	notify yes;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 include "../ns1/trusted.conf";
 
 zone "." {
diff --git a/bin/tests/system/xferquota/ns2/named.conf.j2 b/bin/tests/system/xferquota/ns2/named.conf.j2
index 43d32d7442a..66edc6a4d7a 100644
--- a/bin/tests/system/xferquota/ns2/named.conf.j2
+++ b/bin/tests/system/xferquota/ns2/named.conf.j2
@@ -15,6 +15,8 @@ options {
 	transfers-per-ns 5;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/zero/ns1/named.conf.j2 b/bin/tests/system/zero/ns1/named.conf.j2
index f78a62a9bdc..0cc901254d0 100644
--- a/bin/tests/system/zero/ns1/named.conf.j2
+++ b/bin/tests/system/zero/ns1/named.conf.j2
@@ -10,6 +10,8 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/zero/ns2/named.conf.j2 b/bin/tests/system/zero/ns2/named.conf.j2
index 9627421cf76..0aea6abe351 100644
--- a/bin/tests/system/zero/ns2/named.conf.j2
+++ b/bin/tests/system/zero/ns2/named.conf.j2
@@ -11,6 +11,8 @@ options {
 	allow-transfer { any; };
 };
 
+{% include "_common/controls.conf.j2" %}
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/zero/ns3/named.conf.j2 b/bin/tests/system/zero/ns3/named.conf.j2
index 6503e3d1d9d..8e5ddc56b9a 100644
--- a/bin/tests/system/zero/ns3/named.conf.j2
+++ b/bin/tests/system/zero/ns3/named.conf.j2
@@ -11,6 +11,7 @@ options {
 	servfail-ttl 0;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "." {
 	type hint;
diff --git a/bin/tests/system/zero/ns4/named.conf.j2 b/bin/tests/system/zero/ns4/named.conf.j2
index 251849e80ea..e1f32a8b962 100644
--- a/bin/tests/system/zero/ns4/named.conf.j2
+++ b/bin/tests/system/zero/ns4/named.conf.j2
@@ -10,6 +10,7 @@ options {
 	dnssec-validation no;
 };
 
+{% include "_common/controls.conf.j2" %}
 
 zone "example" {
 	type secondary;