From: Aram Sargsyan <aram@isc.org>
Date: Thu, 14 Dec 2023 13:14:44 +0000 (+0000)
Subject: Use trust anchors with 'dnssec-validation yes' in system tests
X-Git-Tag: v9.19.22~61^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d28fd93a5841d594ab9da7ca9384f39996fbb79f;p=thirdparty%2Fbind9.git

Use trust anchors with 'dnssec-validation yes' in system tests

Explicitly use an empty 'trust-anchors' statement in the system
tests where it was used implicitly before.

In resolver/ns5/named.conf.in use the trust anchor in 'trusted.conf',
which was supposed to be used there.
---

diff --git a/bin/tests/system/additional/ns3/named.conf.in b/bin/tests/system/additional/ns3/named.conf.in
index 2bd01c945d6..f47a3806289 100644
--- a/bin/tests/system/additional/ns3/named.conf.in
+++ b/bin/tests/system/additional/ns3/named.conf.in
@@ -26,6 +26,8 @@ options {
 	minimal-responses no;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/cacheclean/ns2/named.conf.in b/bin/tests/system/cacheclean/ns2/named.conf.in
index 6ffa0737b22..418209cf04d 100644
--- a/bin/tests/system/cacheclean/ns2/named.conf.in
+++ b/bin/tests/system/cacheclean/ns2/named.conf.in
@@ -25,6 +25,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/chain/ns1/named.conf.in b/bin/tests/system/chain/ns1/named.conf.in
index 550426126f3..95ccf892063 100644
--- a/bin/tests/system/chain/ns1/named.conf.in
+++ b/bin/tests/system/chain/ns1/named.conf.in
@@ -24,4 +24,6 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "." { type primary; file "root.db"; };
diff --git a/bin/tests/system/chain/ns7/named.conf.in b/bin/tests/system/chain/ns7/named.conf.in
index 32c9b5f5699..87931179d22 100644
--- a/bin/tests/system/chain/ns7/named.conf.in
+++ b/bin/tests/system/chain/ns7/named.conf.in
@@ -30,6 +30,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/checknames/ns2/named.conf.in b/bin/tests/system/checknames/ns2/named.conf.in
index 3ba62e1a8d2..105a88dd5f2 100644
--- a/bin/tests/system/checknames/ns2/named.conf.in
+++ b/bin/tests/system/checknames/ns2/named.conf.in
@@ -25,6 +25,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hints";
diff --git a/bin/tests/system/checknames/ns3/named.conf.in b/bin/tests/system/checknames/ns3/named.conf.in
index 7c0cacb5aeb..487cecca282 100644
--- a/bin/tests/system/checknames/ns3/named.conf.in
+++ b/bin/tests/system/checknames/ns3/named.conf.in
@@ -25,6 +25,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hints";
diff --git a/bin/tests/system/checknames/ns4/named.conf.in b/bin/tests/system/checknames/ns4/named.conf.in
index f0cb87093bf..841bb5904ec 100644
--- a/bin/tests/system/checknames/ns4/named.conf.in
+++ b/bin/tests/system/checknames/ns4/named.conf.in
@@ -26,6 +26,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hints";
diff --git a/bin/tests/system/checknames/ns5/named.conf.in b/bin/tests/system/checknames/ns5/named.conf.in
index 1797aa1eb21..dec85ec498c 100644
--- a/bin/tests/system/checknames/ns5/named.conf.in
+++ b/bin/tests/system/checknames/ns5/named.conf.in
@@ -26,6 +26,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hints";
diff --git a/bin/tests/system/cipher-suites/ns1/named.conf.in b/bin/tests/system/cipher-suites/ns1/named.conf.in
index 77186a6e63f..8de44d1cb48 100644
--- a/bin/tests/system/cipher-suites/ns1/named.conf.in
+++ b/bin/tests/system/cipher-suites/ns1/named.conf.in
@@ -69,6 +69,8 @@ options {
 	transfers-out 100;
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/cipher-suites/ns2/named.conf.in b/bin/tests/system/cipher-suites/ns2/named.conf.in
index 58189524b87..c81429c9025 100644
--- a/bin/tests/system/cipher-suites/ns2/named.conf.in
+++ b/bin/tests/system/cipher-suites/ns2/named.conf.in
@@ -39,6 +39,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/cipher-suites/ns3/named.conf.in b/bin/tests/system/cipher-suites/ns3/named.conf.in
index 9a78903d983..ab642f92cef 100644
--- a/bin/tests/system/cipher-suites/ns3/named.conf.in
+++ b/bin/tests/system/cipher-suites/ns3/named.conf.in
@@ -39,6 +39,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/cipher-suites/ns4/named.conf.in b/bin/tests/system/cipher-suites/ns4/named.conf.in
index cf52f98b0da..a690cf5c783 100644
--- a/bin/tests/system/cipher-suites/ns4/named.conf.in
+++ b/bin/tests/system/cipher-suites/ns4/named.conf.in
@@ -39,6 +39,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/cipher-suites/ns5/named.conf.in b/bin/tests/system/cipher-suites/ns5/named.conf.in
index 9187d0e94a4..c36b374a19e 100644
--- a/bin/tests/system/cipher-suites/ns5/named.conf.in
+++ b/bin/tests/system/cipher-suites/ns5/named.conf.in
@@ -39,6 +39,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/cookie/ns1/named.conf.in b/bin/tests/system/cookie/ns1/named.conf.in
index 20ebca30c0f..0bd93c93de1 100644
--- a/bin/tests/system/cookie/ns1/named.conf.in
+++ b/bin/tests/system/cookie/ns1/named.conf.in
@@ -49,6 +49,8 @@ options {
 	nocookie-udp-size 512;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/cookie/ns3/named.conf.in b/bin/tests/system/cookie/ns3/named.conf.in
index 090d528ba31..cbebd074331 100644
--- a/bin/tests/system/cookie/ns3/named.conf.in
+++ b/bin/tests/system/cookie/ns3/named.conf.in
@@ -41,6 +41,8 @@ options {
 	require-server-cookie yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/cookie/ns4/named.conf.in b/bin/tests/system/cookie/ns4/named.conf.in
index c49b87ec10a..592be13ed07 100644
--- a/bin/tests/system/cookie/ns4/named.conf.in
+++ b/bin/tests/system/cookie/ns4/named.conf.in
@@ -35,6 +35,8 @@ options {
 	require-server-cookie yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/cookie/ns5/named.conf.in b/bin/tests/system/cookie/ns5/named.conf.in
index 87210adbf8b..2f51e1be944 100644
--- a/bin/tests/system/cookie/ns5/named.conf.in
+++ b/bin/tests/system/cookie/ns5/named.conf.in
@@ -36,6 +36,8 @@ options {
 	require-server-cookie yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/cookie/ns6/named.conf.in b/bin/tests/system/cookie/ns6/named.conf.in
index 158d8988c5f..56c5e048579 100644
--- a/bin/tests/system/cookie/ns6/named.conf.in
+++ b/bin/tests/system/cookie/ns6/named.conf.in
@@ -35,6 +35,8 @@ options {
 	require-server-cookie yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/cookie/ns8/named.conf.in b/bin/tests/system/cookie/ns8/named.conf.in
index 693f06a81ed..36f052b8e40 100644
--- a/bin/tests/system/cookie/ns8/named.conf.in
+++ b/bin/tests/system/cookie/ns8/named.conf.in
@@ -33,6 +33,8 @@ options {
 	require-server-cookie yes;
 };
 
+trust-anchors { };
+
 server 10.53.0.7 { require-cookie yes; };
 
 zone "example" {
diff --git a/bin/tests/system/database/ns1/named1.conf.in b/bin/tests/system/database/ns1/named1.conf.in
index 5fa7ce5ce4d..97c087fccd1 100644
--- a/bin/tests/system/database/ns1/named1.conf.in
+++ b/bin/tests/system/database/ns1/named1.conf.in
@@ -35,6 +35,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "database" {
 	type primary;
 	database "_builtin empty localhost. hostmaster.isc.org.";
diff --git a/bin/tests/system/database/ns1/named2.conf.in b/bin/tests/system/database/ns1/named2.conf.in
index 80cfab28b88..8c498a9ae15 100644
--- a/bin/tests/system/database/ns1/named2.conf.in
+++ b/bin/tests/system/database/ns1/named2.conf.in
@@ -35,6 +35,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "database" {
 	type primary;
 	database "_builtin empty localhost. marka.isc.org.";
diff --git a/bin/tests/system/dns64/ns1/named.conf1.in b/bin/tests/system/dns64/ns1/named.conf1.in
index 41950d9f64d..bc6c2d23661 100644
--- a/bin/tests/system/dns64/ns1/named.conf1.in
+++ b/bin/tests/system/dns64/ns1/named.conf1.in
@@ -42,6 +42,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/dns64/ns1/named.conf2.in b/bin/tests/system/dns64/ns1/named.conf2.in
index ff39dd1fb63..d7a6d1f80a4 100644
--- a/bin/tests/system/dns64/ns1/named.conf2.in
+++ b/bin/tests/system/dns64/ns1/named.conf2.in
@@ -45,6 +45,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/dns64/ns1/named.conf3.in b/bin/tests/system/dns64/ns1/named.conf3.in
index a44c258cc3e..393e623b366 100644
--- a/bin/tests/system/dns64/ns1/named.conf3.in
+++ b/bin/tests/system/dns64/ns1/named.conf3.in
@@ -34,6 +34,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/dns64/ns2/named.conf.in b/bin/tests/system/dns64/ns2/named.conf.in
index 263cc8a1b1b..49299aaf997 100644
--- a/bin/tests/system/dns64/ns2/named.conf.in
+++ b/bin/tests/system/dns64/ns2/named.conf.in
@@ -60,6 +60,8 @@ options {
 	response-policy { zone "rpz"; };
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/dns64/ns3/named.conf.in b/bin/tests/system/dns64/ns3/named.conf.in
index 4491de1b6e3..a86686bdb0e 100644
--- a/bin/tests/system/dns64/ns3/named.conf.in
+++ b/bin/tests/system/dns64/ns3/named.conf.in
@@ -40,6 +40,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "hints";
diff --git a/bin/tests/system/dns64/ns4/named.conf.in b/bin/tests/system/dns64/ns4/named.conf.in
index ca831f92649..485cdc82f92 100644
--- a/bin/tests/system/dns64/ns4/named.conf.in
+++ b/bin/tests/system/dns64/ns4/named.conf.in
@@ -30,6 +30,8 @@ options {
 	recursion no;
 };
 
+trust-anchors { };
+
 zone "." {
 	type master;
 	file "root.db";
diff --git a/bin/tests/system/dnstap/ns1/named.conf.in b/bin/tests/system/dnstap/ns1/named.conf.in
index 7f3fb296d76..daaf88731a3 100644
--- a/bin/tests/system/dnstap/ns1/named.conf.in
+++ b/bin/tests/system/dnstap/ns1/named.conf.in
@@ -32,6 +32,8 @@ options {
 	qname-minimization disabled;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/dnstap/ns2/named.conf.in b/bin/tests/system/dnstap/ns2/named.conf.in
index cc05db02ffa..12ae86322d6 100644
--- a/bin/tests/system/dnstap/ns2/named.conf.in
+++ b/bin/tests/system/dnstap/ns2/named.conf.in
@@ -32,6 +32,8 @@ options {
 	qname-minimization disabled;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/dnstap/ns3/named.conf.in b/bin/tests/system/dnstap/ns3/named.conf.in
index 1626030ba8c..d443c3818ab 100644
--- a/bin/tests/system/dnstap/ns3/named.conf.in
+++ b/bin/tests/system/dnstap/ns3/named.conf.in
@@ -33,6 +33,8 @@ options {
 	qname-minimization disabled;
 };
 
+trust-anchors { };
+
 server 10.53.0.1 { tcp-only yes; };
 
 key rndc_key {
diff --git a/bin/tests/system/dnstap/ns4/named.conf.in b/bin/tests/system/dnstap/ns4/named.conf.in
index 4a1debf6abb..18c4da1100b 100644
--- a/bin/tests/system/dnstap/ns4/named.conf.in
+++ b/bin/tests/system/dnstap/ns4/named.conf.in
@@ -32,6 +32,8 @@ options {
 	qname-minimization disabled;
 };
 
+trust-anchors { };
+
 server 10.53.0.1 { tcp-only yes; };
 
 key rndc_key {
diff --git a/bin/tests/system/doth/ns1/named.conf.in b/bin/tests/system/doth/ns1/named.conf.in
index 6a8bcdbda5d..6a323db68e9 100644
--- a/bin/tests/system/doth/ns1/named.conf.in
+++ b/bin/tests/system/doth/ns1/named.conf.in
@@ -100,6 +100,8 @@ options {
 	transfers-out 100;
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/doth/ns2/named.conf.in b/bin/tests/system/doth/ns2/named.conf.in
index e533f47e4a2..2fa20b193db 100644
--- a/bin/tests/system/doth/ns2/named.conf.in
+++ b/bin/tests/system/doth/ns2/named.conf.in
@@ -53,6 +53,8 @@ options {
 	transfers-out 100;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/doth/ns3/named.conf.in b/bin/tests/system/doth/ns3/named.conf.in
index cd1ab9cfa6e..69de2ca1468 100644
--- a/bin/tests/system/doth/ns3/named.conf.in
+++ b/bin/tests/system/doth/ns3/named.conf.in
@@ -46,6 +46,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/doth/ns4/named.conf.in b/bin/tests/system/doth/ns4/named.conf.in
index c7c6c91a58a..60072ce9c20 100644
--- a/bin/tests/system/doth/ns4/named.conf.in
+++ b/bin/tests/system/doth/ns4/named.conf.in
@@ -54,6 +54,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/doth/ns5/named.conf.in b/bin/tests/system/doth/ns5/named.conf.in
index 6808618882d..e161a3e4cff 100644
--- a/bin/tests/system/doth/ns5/named.conf.in
+++ b/bin/tests/system/doth/ns5/named.conf.in
@@ -42,6 +42,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/fetchlimit/ns3/named1.conf.in b/bin/tests/system/fetchlimit/ns3/named1.conf.in
index e493d8a4d77..da1661d920f 100644
--- a/bin/tests/system/fetchlimit/ns3/named1.conf.in
+++ b/bin/tests/system/fetchlimit/ns3/named1.conf.in
@@ -28,6 +28,8 @@ options {
 	fetches-per-server 400;
 };
 
+trust-anchors { };
+
 server 10.53.0.4 {
 	edns no;
 };
diff --git a/bin/tests/system/fetchlimit/ns3/named2.conf.in b/bin/tests/system/fetchlimit/ns3/named2.conf.in
index 2d0dcef24bc..d354dfd39fb 100644
--- a/bin/tests/system/fetchlimit/ns3/named2.conf.in
+++ b/bin/tests/system/fetchlimit/ns3/named2.conf.in
@@ -26,6 +26,8 @@ options {
 	fetches-per-zone 40;
 };
 
+trust-anchors { };
+
 server 10.53.0.4 {
 	edns no;
 };
diff --git a/bin/tests/system/fetchlimit/ns3/named3.conf.in b/bin/tests/system/fetchlimit/ns3/named3.conf.in
index f056fbbf7bf..db32409ed30 100644
--- a/bin/tests/system/fetchlimit/ns3/named3.conf.in
+++ b/bin/tests/system/fetchlimit/ns3/named3.conf.in
@@ -26,6 +26,8 @@ options {
 	recursive-clients 400;
 };
 
+trust-anchors { };
+
 server 10.53.0.4 {
 	edns no;
 };
diff --git a/bin/tests/system/fetchlimit/ns5/named1.conf.in b/bin/tests/system/fetchlimit/ns5/named1.conf.in
index d3c62c225c9..f26b8a19413 100644
--- a/bin/tests/system/fetchlimit/ns5/named1.conf.in
+++ b/bin/tests/system/fetchlimit/ns5/named1.conf.in
@@ -27,6 +27,8 @@ options {
 	max-clients-per-query 10;
 };
 
+trust-anchors { };
+
 server 10.53.0.4 {
 	edns no;
 };
diff --git a/bin/tests/system/fetchlimit/ns5/named2.conf.in b/bin/tests/system/fetchlimit/ns5/named2.conf.in
index cb33d307168..ba5ef64009d 100644
--- a/bin/tests/system/fetchlimit/ns5/named2.conf.in
+++ b/bin/tests/system/fetchlimit/ns5/named2.conf.in
@@ -30,6 +30,8 @@ options {
 	max-clients-per-query 10;
 };
 
+trust-anchors { };
+
 server 10.53.0.4 {
 	edns no;
 };
diff --git a/bin/tests/system/filter-aaaa/ns1/named1.conf.in b/bin/tests/system/filter-aaaa/ns1/named1.conf.in
index f5f09055126..c4e6eacc8c3 100644
--- a/bin/tests/system/filter-aaaa/ns1/named1.conf.in
+++ b/bin/tests/system/filter-aaaa/ns1/named1.conf.in
@@ -25,6 +25,8 @@ options {
 	minimal-responses no;
 };
 
+trust-anchors { };
+
 acl filterees { 10.53.0.1; };
 
 plugin query "../../../../plugins/.libs/filter-aaaa.so" {
diff --git a/bin/tests/system/filter-aaaa/ns1/named2.conf.in b/bin/tests/system/filter-aaaa/ns1/named2.conf.in
index 3152f96f0ef..d82ed2d50fb 100644
--- a/bin/tests/system/filter-aaaa/ns1/named2.conf.in
+++ b/bin/tests/system/filter-aaaa/ns1/named2.conf.in
@@ -25,6 +25,8 @@ options {
 	minimal-responses no;
 };
 
+trust-anchors { };
+
 plugin query "../../../../plugins/.libs/filter-aaaa.so" {
 	filter-aaaa-on-v6 yes;
 	filter-aaaa { fd92:7065:b8e:ffff::1; };
diff --git a/bin/tests/system/forward/ns3/named1.conf.in b/bin/tests/system/forward/ns3/named1.conf.in
index ffc0718bfc0..91de8f85403 100644
--- a/bin/tests/system/forward/ns3/named1.conf.in
+++ b/bin/tests/system/forward/ns3/named1.conf.in
@@ -27,6 +27,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/forward/ns4/named.conf.in b/bin/tests/system/forward/ns4/named.conf.in
index f6524d5858b..e8d3bbb8a5c 100644
--- a/bin/tests/system/forward/ns4/named.conf.in
+++ b/bin/tests/system/forward/ns4/named.conf.in
@@ -27,6 +27,8 @@ options {
 	minimal-responses yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.db";
diff --git a/bin/tests/system/forward/ns5/named.conf.in b/bin/tests/system/forward/ns5/named.conf.in
index 024f49be16f..15b89dd0e7c 100644
--- a/bin/tests/system/forward/ns5/named.conf.in
+++ b/bin/tests/system/forward/ns5/named.conf.in
@@ -25,6 +25,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.db";
diff --git a/bin/tests/system/forward/ns7/named.conf.in b/bin/tests/system/forward/ns7/named.conf.in
index 302bb55e5d9..c6e55a89bc1 100644
--- a/bin/tests/system/forward/ns7/named.conf.in
+++ b/bin/tests/system/forward/ns7/named.conf.in
@@ -24,6 +24,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.db";
diff --git a/bin/tests/system/forward/ns8/named.conf.in b/bin/tests/system/forward/ns8/named.conf.in
index 2de656fe2ff..13c38594e09 100644
--- a/bin/tests/system/forward/ns8/named.conf.in
+++ b/bin/tests/system/forward/ns8/named.conf.in
@@ -24,6 +24,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.db";
diff --git a/bin/tests/system/hooks/ns1/named.conf.in b/bin/tests/system/hooks/ns1/named.conf.in
index 956bf41ef44..30ae85ae848 100644
--- a/bin/tests/system/hooks/ns1/named.conf.in
+++ b/bin/tests/system/hooks/ns1/named.conf.in
@@ -24,6 +24,8 @@ options {
 	minimal-responses no;
 };
 
+trust-anchors { };
+
 plugin query "../driver/.libs/test-async.so";
 
 key rndc_key {
diff --git a/bin/tests/system/legacy/ns1/named1.conf.in b/bin/tests/system/legacy/ns1/named1.conf.in
index 5c4b1c400bc..bada7eb6307 100644
--- a/bin/tests/system/legacy/ns1/named1.conf.in
+++ b/bin/tests/system/legacy/ns1/named1.conf.in
@@ -23,6 +23,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/masterfile/ns2/named.conf.in b/bin/tests/system/masterfile/ns2/named.conf.in
index 2a84f86f26d..e1e8dc2bf6b 100644
--- a/bin/tests/system/masterfile/ns2/named.conf.in
+++ b/bin/tests/system/masterfile/ns2/named.conf.in
@@ -26,6 +26,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/mkeys/ns1/named1.conf.in b/bin/tests/system/mkeys/ns1/named1.conf.in
index 4271668ea97..d45e98d768c 100644
--- a/bin/tests/system/mkeys/ns1/named1.conf.in
+++ b/bin/tests/system/mkeys/ns1/named1.conf.in
@@ -32,6 +32,8 @@ options {
 	allow-query { allowed; };
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/mkeys/ns1/named2.conf.in b/bin/tests/system/mkeys/ns1/named2.conf.in
index 4271668ea97..d45e98d768c 100644
--- a/bin/tests/system/mkeys/ns1/named2.conf.in
+++ b/bin/tests/system/mkeys/ns1/named2.conf.in
@@ -32,6 +32,8 @@ options {
 	allow-query { allowed; };
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/mkeys/ns1/named3.conf.in b/bin/tests/system/mkeys/ns1/named3.conf.in
index 686177edb02..12b8c71c546 100644
--- a/bin/tests/system/mkeys/ns1/named3.conf.in
+++ b/bin/tests/system/mkeys/ns1/named3.conf.in
@@ -26,6 +26,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/nsupdate/ns3/named.conf.in b/bin/tests/system/nsupdate/ns3/named.conf.in
index 5473b7eea04..b62885111a5 100644
--- a/bin/tests/system/nsupdate/ns3/named.conf.in
+++ b/bin/tests/system/nsupdate/ns3/named.conf.in
@@ -26,6 +26,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/pipelined/ns2/named.conf.in b/bin/tests/system/pipelined/ns2/named.conf.in
index 98026893f68..8cb605c8bd9 100644
--- a/bin/tests/system/pipelined/ns2/named.conf.in
+++ b/bin/tests/system/pipelined/ns2/named.conf.in
@@ -24,6 +24,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/pipelined/ns3/named.conf.in b/bin/tests/system/pipelined/ns3/named.conf.in
index 3fe8f56422a..96a9a92b6cb 100644
--- a/bin/tests/system/pipelined/ns3/named.conf.in
+++ b/bin/tests/system/pipelined/ns3/named.conf.in
@@ -24,6 +24,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/pipelined/ns4/named.conf.in b/bin/tests/system/pipelined/ns4/named.conf.in
index c36ec91db54..3a187bf9350 100644
--- a/bin/tests/system/pipelined/ns4/named.conf.in
+++ b/bin/tests/system/pipelined/ns4/named.conf.in
@@ -25,6 +25,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/proxy/ns1/named.conf.in b/bin/tests/system/proxy/ns1/named.conf.in
index 0be6c355f83..4e2c620cd7a 100644
--- a/bin/tests/system/proxy/ns1/named.conf.in
+++ b/bin/tests/system/proxy/ns1/named.conf.in
@@ -54,6 +54,8 @@ options {
 	tcp-initial-timeout 1200;
 };
 
+trust-anchors { };
+
 zone "example0" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/proxy/ns3/named.conf.in b/bin/tests/system/proxy/ns3/named.conf.in
index 5583eb2c9b5..db1c3467e60 100644
--- a/bin/tests/system/proxy/ns3/named.conf.in
+++ b/bin/tests/system/proxy/ns3/named.conf.in
@@ -49,6 +49,8 @@ options {
 	tcp-initial-timeout 1200;
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/reclimit/ns3/named1.conf.in b/bin/tests/system/reclimit/ns3/named1.conf.in
index 58b5d025144..7771d834a2e 100644
--- a/bin/tests/system/reclimit/ns3/named1.conf.in
+++ b/bin/tests/system/reclimit/ns3/named1.conf.in
@@ -27,6 +27,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/reclimit/ns3/named2.conf.in b/bin/tests/system/reclimit/ns3/named2.conf.in
index b5389f4ff9f..974b24bcff0 100644
--- a/bin/tests/system/reclimit/ns3/named2.conf.in
+++ b/bin/tests/system/reclimit/ns3/named2.conf.in
@@ -27,6 +27,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/reclimit/ns3/named3.conf.in b/bin/tests/system/reclimit/ns3/named3.conf.in
index f356f2487f9..38a77ae35c8 100644
--- a/bin/tests/system/reclimit/ns3/named3.conf.in
+++ b/bin/tests/system/reclimit/ns3/named3.conf.in
@@ -28,6 +28,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/reclimit/ns3/named4.conf.in b/bin/tests/system/reclimit/ns3/named4.conf.in
index 728f00bb26c..5a0660766f6 100644
--- a/bin/tests/system/reclimit/ns3/named4.conf.in
+++ b/bin/tests/system/reclimit/ns3/named4.conf.in
@@ -28,6 +28,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/redirect/ns1/named.conf.in b/bin/tests/system/redirect/ns1/named.conf.in
index 412b874240a..3b4ccad0287 100644
--- a/bin/tests/system/redirect/ns1/named.conf.in
+++ b/bin/tests/system/redirect/ns1/named.conf.in
@@ -28,6 +28,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
@@ -53,5 +55,3 @@ zone "." {
 	file "redirect.db";
 	allow-query { !10.53.0.2; !10.53.0.4; any; };
 };
-
-// include "trusted.conf";
diff --git a/bin/tests/system/redirect/ns2/named.conf.in b/bin/tests/system/redirect/ns2/named.conf.in
index 881a81f9d10..e07d75bdfe3 100644
--- a/bin/tests/system/redirect/ns2/named.conf.in
+++ b/bin/tests/system/redirect/ns2/named.conf.in
@@ -31,6 +31,8 @@ options {
 
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/redirect/ns3/named.conf.in b/bin/tests/system/redirect/ns3/named.conf.in
index 2113dd59235..51e590f630c 100644
--- a/bin/tests/system/redirect/ns3/named.conf.in
+++ b/bin/tests/system/redirect/ns3/named.conf.in
@@ -26,6 +26,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
@@ -50,5 +52,3 @@ zone "redirect" {
 	type primary;
 	file "redirect.db";
 };
-
-// include "trusted.conf";
diff --git a/bin/tests/system/redirect/ns4/named.conf.in b/bin/tests/system/redirect/ns4/named.conf.in
index 1650e99a7bf..8937453ace8 100644
--- a/bin/tests/system/redirect/ns4/named.conf.in
+++ b/bin/tests/system/redirect/ns4/named.conf.in
@@ -31,6 +31,8 @@ options {
 	nxdomain-redirect "redirect";
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/resolver/ns1/named.conf.in b/bin/tests/system/resolver/ns1/named.conf.in
index f0f95712098..fbcb6c1dd3a 100644
--- a/bin/tests/system/resolver/ns1/named.conf.in
+++ b/bin/tests/system/resolver/ns1/named.conf.in
@@ -31,6 +31,8 @@ options {
 	attach-cache "globalcache";
 };
 
+trust-anchors { };
+
 server 10.53.0.3 {
 	tcp-only yes;
 };
diff --git a/bin/tests/system/resolver/ns5/named.conf.in b/bin/tests/system/resolver/ns5/named.conf.in
index 9856d8e5b1a..dc1704fd28e 100644
--- a/bin/tests/system/resolver/ns5/named.conf.in
+++ b/bin/tests/system/resolver/ns5/named.conf.in
@@ -27,6 +27,8 @@ options {
 	prefetch 4 10;
 };
 
+include "trusted.conf";
+
 server 10.53.0.7 {
 	edns-version 0;
 };
diff --git a/bin/tests/system/resolver/ns7/named1.conf.in b/bin/tests/system/resolver/ns7/named1.conf.in
index 1d32ae97452..170ce62716d 100644
--- a/bin/tests/system/resolver/ns7/named1.conf.in
+++ b/bin/tests/system/resolver/ns7/named1.conf.in
@@ -34,6 +34,8 @@ options {
 	edns-udp-size 4096;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/resolver/ns7/named2.conf.in b/bin/tests/system/resolver/ns7/named2.conf.in
index 1d32ae97452..170ce62716d 100644
--- a/bin/tests/system/resolver/ns7/named2.conf.in
+++ b/bin/tests/system/resolver/ns7/named2.conf.in
@@ -34,6 +34,8 @@ options {
 	edns-udp-size 4096;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/resolver/ns9/named.conf.in b/bin/tests/system/resolver/ns9/named.conf.in
index 3be31db6f82..140cd26b58d 100644
--- a/bin/tests/system/resolver/ns9/named.conf.in
+++ b/bin/tests/system/resolver/ns9/named.conf.in
@@ -24,6 +24,8 @@ options {
 	qname-minimization off;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/rndc/ns4/named.conf.in b/bin/tests/system/rndc/ns4/named.conf.in
index 6dc37ec3b29..0ec0cc7bf88 100644
--- a/bin/tests/system/rndc/ns4/named.conf.in
+++ b/bin/tests/system/rndc/ns4/named.conf.in
@@ -20,6 +20,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 view normal {
 	match-clients { any; };
 
diff --git a/bin/tests/system/rpz/ns3/named.conf.in b/bin/tests/system/rpz/ns3/named.conf.in
index 80a9d832f03..b2ba42720c0 100644
--- a/bin/tests/system/rpz/ns3/named.conf.in
+++ b/bin/tests/system/rpz/ns3/named.conf.in
@@ -64,6 +64,8 @@ options {
 	notify-delay 0;
 };
 
+trust-anchors { };
+
 logging { category rpz { default_debug; }; };
 
 key rndc_key {
diff --git a/bin/tests/system/rpz/ns8/named.conf.in b/bin/tests/system/rpz/ns8/named.conf.in
index aa8b342d99d..87f6c8e3526 100644
--- a/bin/tests/system/rpz/ns8/named.conf.in
+++ b/bin/tests/system/rpz/ns8/named.conf.in
@@ -46,6 +46,8 @@ options {
 	notify-delay 0;
 };
 
+trust-anchors { };
+
 logging { category rpz { default_debug; }; };
 
 key rndc_key {
diff --git a/bin/tests/system/rpz/ns9/named.conf.in b/bin/tests/system/rpz/ns9/named.conf.in
index 0d3fce78524..6010082c8fc 100644
--- a/bin/tests/system/rpz/ns9/named.conf.in
+++ b/bin/tests/system/rpz/ns9/named.conf.in
@@ -40,6 +40,8 @@ options {
 	notify-delay 0;
 };
 
+trust-anchors { };
+
 logging { category rpz { default_debug; }; };
 
 key rndc_key {
diff --git a/bin/tests/system/rpzrecurse/ns2/named.conf.header.in b/bin/tests/system/rpzrecurse/ns2/named.conf.header.in
index 90a17b7a37b..3973eba5ee5 100644
--- a/bin/tests/system/rpzrecurse/ns2/named.conf.header.in
+++ b/bin/tests/system/rpzrecurse/ns2/named.conf.header.in
@@ -30,6 +30,8 @@ options {
 	include "../dnsrps.conf";
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/rpzrecurse/ns3/named1.conf.in b/bin/tests/system/rpzrecurse/ns3/named1.conf.in
index 6a1bd116580..3159c63e7b9 100644
--- a/bin/tests/system/rpzrecurse/ns3/named1.conf.in
+++ b/bin/tests/system/rpzrecurse/ns3/named1.conf.in
@@ -36,6 +36,8 @@ options {
 	include "../dnsrps.conf";
 };
 
+trust-anchors { };
+
 zone "policy" { type primary; file "policy.db"; };
 
 zone "example.tld" { type primary; file "example.db"; };
diff --git a/bin/tests/system/rpzrecurse/ns3/named2.conf.in b/bin/tests/system/rpzrecurse/ns3/named2.conf.in
index 06b2536e807..2370b4371ab 100644
--- a/bin/tests/system/rpzrecurse/ns3/named2.conf.in
+++ b/bin/tests/system/rpzrecurse/ns3/named2.conf.in
@@ -35,6 +35,8 @@ options {
 	include "../dnsrps.conf";
 };
 
+trust-anchors { };
+
 zone "policy" { type primary; file "policy.db"; };
 
 zone "example.tld" { type primary; file "example.db"; };
diff --git a/bin/tests/system/rpzrecurse/ns3/named3.conf.in b/bin/tests/system/rpzrecurse/ns3/named3.conf.in
index ac2e19cac05..af57689b9a2 100644
--- a/bin/tests/system/rpzrecurse/ns3/named3.conf.in
+++ b/bin/tests/system/rpzrecurse/ns3/named3.conf.in
@@ -33,6 +33,8 @@ options {
 	include "../dnsrps.conf";
 };
 
+trust-anchors { };
+
 zone "policy" { type primary; file "policy.db"; };
 
 zone "example.tld" { type primary; file "example.db"; };
diff --git a/bin/tests/system/rrl/ns1/named.conf.in b/bin/tests/system/rrl/ns1/named.conf.in
index e4da6efcc95..a71e1ee2151 100644
--- a/bin/tests/system/rrl/ns1/named.conf.in
+++ b/bin/tests/system/rrl/ns1/named.conf.in
@@ -25,4 +25,6 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {type primary; file "root.db";};
diff --git a/bin/tests/system/rrl/ns2/named.conf.in b/bin/tests/system/rrl/ns2/named.conf.in
index abe4f9cea39..298d37050aa 100644
--- a/bin/tests/system/rrl/ns2/named.conf.in
+++ b/bin/tests/system/rrl/ns2/named.conf.in
@@ -36,6 +36,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/rrl/ns3/named.conf.in b/bin/tests/system/rrl/ns3/named.conf.in
index 8807f44b6ea..4bc0d6fc4a5 100644
--- a/bin/tests/system/rrl/ns3/named.conf.in
+++ b/bin/tests/system/rrl/ns3/named.conf.in
@@ -43,6 +43,8 @@ options {
 
 };
 
+trust-anchors { };
+
 zone "." { type hint; file "hints"; };
 
 zone "tld3."{ type primary; file "tld3.db"; };
diff --git a/bin/tests/system/rrl/ns4/named.conf.in b/bin/tests/system/rrl/ns4/named.conf.in
index 3cd598e63b1..bb169f047d3 100644
--- a/bin/tests/system/rrl/ns4/named.conf.in
+++ b/bin/tests/system/rrl/ns4/named.conf.in
@@ -38,6 +38,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/rrsetorder/ns3/named.conf.in b/bin/tests/system/rrsetorder/ns3/named.conf.in
index 807fa37820d..cdab83ed24b 100644
--- a/bin/tests/system/rrsetorder/ns3/named.conf.in
+++ b/bin/tests/system/rrsetorder/ns3/named.conf.in
@@ -32,6 +32,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/rrsetorder/ns4/named.conf.in b/bin/tests/system/rrsetorder/ns4/named.conf.in
index d5fc5274aee..5187aa8fb1c 100644
--- a/bin/tests/system/rrsetorder/ns4/named.conf.in
+++ b/bin/tests/system/rrsetorder/ns4/named.conf.in
@@ -28,6 +28,8 @@ options {
 
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/rrsetorder/ns5/named.conf.in b/bin/tests/system/rrsetorder/ns5/named.conf.in
index c0836d320a4..f7a2486ad60 100644
--- a/bin/tests/system/rrsetorder/ns5/named.conf.in
+++ b/bin/tests/system/rrsetorder/ns5/named.conf.in
@@ -24,6 +24,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/statistics/ns2/named.conf.in b/bin/tests/system/statistics/ns2/named.conf.in
index 30c46518f85..877e26a16f8 100644
--- a/bin/tests/system/statistics/ns2/named.conf.in
+++ b/bin/tests/system/statistics/ns2/named.conf.in
@@ -24,6 +24,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 statistics-channels {
 	inet 10.53.0.2 port @EXTRAPORT1@ allow { any; };
 };
diff --git a/bin/tests/system/statistics/ns3/named.conf.in b/bin/tests/system/statistics/ns3/named.conf.in
index 4cc712d46b9..1726d1d381e 100644
--- a/bin/tests/system/statistics/ns3/named.conf.in
+++ b/bin/tests/system/statistics/ns3/named.conf.in
@@ -27,6 +27,8 @@ options {
 	zone-statistics yes;
 };
 
+trust-anchors { };
+
 statistics-channels {
 	inet 10.53.0.3 port @EXTRAPORT1@ allow { any; };
 };
diff --git a/bin/tests/system/stress/ns3/named.conf.in b/bin/tests/system/stress/ns3/named.conf.in
index 13e54a54e46..c11aec2d488 100644
--- a/bin/tests/system/stress/ns3/named.conf.in
+++ b/bin/tests/system/stress/ns3/named.conf.in
@@ -26,6 +26,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/stress/ns4/named.conf.in b/bin/tests/system/stress/ns4/named.conf.in
index 26296f52bf0..2dd2e50675a 100644
--- a/bin/tests/system/stress/ns4/named.conf.in
+++ b/bin/tests/system/stress/ns4/named.conf.in
@@ -26,6 +26,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "zone000000.example" {
 	type secondary;
 	file "zone000000.example.bk";
diff --git a/bin/tests/system/transport-acl/ns1/named.conf.in b/bin/tests/system/transport-acl/ns1/named.conf.in
index d2a941a7f2d..a1b970fe2aa 100644
--- a/bin/tests/system/transport-acl/ns1/named.conf.in
+++ b/bin/tests/system/transport-acl/ns1/named.conf.in
@@ -68,6 +68,8 @@ options {
 	tcp-initial-timeout 1200;
 };
 
+trust-anchors { };
+
 zone "example0" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-http-plain-proxy.conf.in b/bin/tests/system/transport-change/ns1/named-http-plain-proxy.conf.in
index 012b167ae3f..374cd06a171 100644
--- a/bin/tests/system/transport-change/ns1/named-http-plain-proxy.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-http-plain-proxy.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-http-plain.conf.in b/bin/tests/system/transport-change/ns1/named-http-plain.conf.in
index 627742920bc..5d4b88035a3 100644
--- a/bin/tests/system/transport-change/ns1/named-http-plain.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-http-plain.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-https-proxy-encrypted.conf.in b/bin/tests/system/transport-change/ns1/named-https-proxy-encrypted.conf.in
index 8c28c26a8eb..45108da9a01 100644
--- a/bin/tests/system/transport-change/ns1/named-https-proxy-encrypted.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-https-proxy-encrypted.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-https-proxy-plain.conf.in b/bin/tests/system/transport-change/ns1/named-https-proxy-plain.conf.in
index 7b5538ce0d5..9001c43f45f 100644
--- a/bin/tests/system/transport-change/ns1/named-https-proxy-plain.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-https-proxy-plain.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-https.conf.in b/bin/tests/system/transport-change/ns1/named-https.conf.in
index c24346e941d..bce99f35ec7 100644
--- a/bin/tests/system/transport-change/ns1/named-https.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-https.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-proxy.conf.in b/bin/tests/system/transport-change/ns1/named-proxy.conf.in
index 1b9fb684aa7..ff549268d52 100644
--- a/bin/tests/system/transport-change/ns1/named-proxy.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-proxy.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-tls-proxy-encrypted.conf.in b/bin/tests/system/transport-change/ns1/named-tls-proxy-encrypted.conf.in
index 4183fb8a318..98c2bf48b9d 100644
--- a/bin/tests/system/transport-change/ns1/named-tls-proxy-encrypted.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-tls-proxy-encrypted.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-tls-proxy-plain.conf.in b/bin/tests/system/transport-change/ns1/named-tls-proxy-plain.conf.in
index 8a283cb21b2..20c829f0188 100644
--- a/bin/tests/system/transport-change/ns1/named-tls-proxy-plain.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-tls-proxy-plain.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-tls.conf.in b/bin/tests/system/transport-change/ns1/named-tls.conf.in
index 4bcc9761736..a436768d6e9 100644
--- a/bin/tests/system/transport-change/ns1/named-tls.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-tls.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named.conf.in b/bin/tests/system/transport-change/ns1/named.conf.in
index 0ee7fc5d36c..e594c6ef06f 100644
--- a/bin/tests/system/transport-change/ns1/named.conf.in
+++ b/bin/tests/system/transport-change/ns1/named.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/zero/ns3/named.conf.in b/bin/tests/system/zero/ns3/named.conf.in
index 7e0d1d7d16d..025dcb46cb5 100644
--- a/bin/tests/system/zero/ns3/named.conf.in
+++ b/bin/tests/system/zero/ns3/named.conf.in
@@ -24,6 +24,8 @@ options {
 	servfail-ttl 0;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/zero/ns4/named.conf.in b/bin/tests/system/zero/ns4/named.conf.in
index fc8fec6a5ab..037a5e9e474 100644
--- a/bin/tests/system/zero/ns4/named.conf.in
+++ b/bin/tests/system/zero/ns4/named.conf.in
@@ -23,6 +23,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "example" {
 	type secondary;
 	primaries { 10.53.0.2; };
diff --git a/bin/tests/system/zonechecks/ns1/named.conf.in b/bin/tests/system/zonechecks/ns1/named.conf.in
index 68215001476..f563b46d26a 100644
--- a/bin/tests/system/zonechecks/ns1/named.conf.in
+++ b/bin/tests/system/zonechecks/ns1/named.conf.in
@@ -26,6 +26,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/zonechecks/ns2/named.conf.in b/bin/tests/system/zonechecks/ns2/named.conf.in
index 5ecf68b56f7..8385b5adc81 100644
--- a/bin/tests/system/zonechecks/ns2/named.conf.in
+++ b/bin/tests/system/zonechecks/ns2/named.conf.in
@@ -26,6 +26,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;