From: Evan Hunt <each@isc.org>
Date: Fri, 2 Jun 2023 00:14:49 +0000 (-0700)
Subject: explicitly set dnssec-validation in system tests
X-Git-Tag: v9.19.15~18^2
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=0b09ee8cdc83f27a244681bfdbc97ed81dc07708;p=thirdparty%2Fbind9.git

explicitly set dnssec-validation in system tests

the default value of dnssec-validation is 'auto', which causes
a server to send a key refresh query to the root zone when starting
up. this is undesirable behavior in system tests, so this commit
sets dnssec-validation to either 'yes' or 'no' in all tests where
it had not previously been set.

this change had the mostly-harmless side effect of changing the cached
trust level of unvalidated answer data from 'answer' to 'authanswer',
which caused a few test cases in which dumped cache data was examined in
the serve-stale system test to fail. those test cases have now been
updated to expect 'authanswer'.
---

diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
index 682ba97f577..cbf461bcf09 100644
--- a/bin/tests/system/acl/ns2/named1.conf.in
+++ b/bin/tests/system/acl/ns2/named1.conf.in
@@ -32,6 +32,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 key one {
diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
index 7b1cea6fcdd..bb03efd75d7 100644
--- a/bin/tests/system/acl/ns2/named2.conf.in
+++ b/bin/tests/system/acl/ns2/named2.conf.in
@@ -32,6 +32,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 key one {
diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
index 6b35ba5a98b..b4e20d5ebd2 100644
--- a/bin/tests/system/acl/ns2/named3.conf.in
+++ b/bin/tests/system/acl/ns2/named3.conf.in
@@ -32,6 +32,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 key one {
diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
index b23a1cab58e..868d46492f9 100644
--- a/bin/tests/system/acl/ns2/named4.conf.in
+++ b/bin/tests/system/acl/ns2/named4.conf.in
@@ -32,6 +32,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 key one {
diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
index 52791aa2a1a..e24080f064a 100644
--- a/bin/tests/system/acl/ns2/named5.conf.in
+++ b/bin/tests/system/acl/ns2/named5.conf.in
@@ -32,6 +32,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 	allow-query-on { 10.53.0.2; };
 	blackhole { 10.53.0.8; };
 };
diff --git a/bin/tests/system/acl/ns3/named.conf.in b/bin/tests/system/acl/ns3/named.conf.in
index 396b1a9eb1e..31d3526b769 100644
--- a/bin/tests/system/acl/ns3/named.conf.in
+++ b/bin/tests/system/acl/ns3/named.conf.in
@@ -23,6 +23,7 @@ options {
 	notify no;
 	allow-new-zones yes;
 	allow-transfer { none; };
+	dnssec-validation no;
 };
 
 controls {
diff --git a/bin/tests/system/acl/ns4/named.conf.in b/bin/tests/system/acl/ns4/named.conf.in
index 951c61e8f50..9b769d1849b 100644
--- a/bin/tests/system/acl/ns4/named.conf.in
+++ b/bin/tests/system/acl/ns4/named.conf.in
@@ -23,6 +23,7 @@ options {
 	notify no;
 	allow-new-zones yes;
 	allow-transfer { none; };
+	dnssec-validation no;
 };
 
 controls {
diff --git a/bin/tests/system/additional/ns2/named.conf.in b/bin/tests/system/additional/ns2/named.conf.in
index dae255dca36..ed43ca66274 100644
--- a/bin/tests/system/additional/ns2/named.conf.in
+++ b/bin/tests/system/additional/ns2/named.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	notify no;
 	minimal-responses yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/addzone/ns1/named.conf.in b/bin/tests/system/addzone/ns1/named.conf.in
index b2d5e05dbba..9015e1b9d97 100644
--- a/bin/tests/system/addzone/ns1/named.conf.in
+++ b/bin/tests/system/addzone/ns1/named.conf.in
@@ -28,6 +28,7 @@ options {
 	allow-query { any; };
 	allow-new-zones yes;
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/addzone/ns2/named1.conf.in b/bin/tests/system/addzone/ns2/named1.conf.in
index eb8519a5902..23be60ef701 100644
--- a/bin/tests/system/addzone/ns2/named1.conf.in
+++ b/bin/tests/system/addzone/ns2/named1.conf.in
@@ -19,6 +19,7 @@ options {
 	allow-query { any; };
 	recursion no;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
 
 include "../../common/rndc.key";
diff --git a/bin/tests/system/addzone/ns2/named2.conf.in b/bin/tests/system/addzone/ns2/named2.conf.in
index 33e45b9bb78..8b0f23de2c1 100644
--- a/bin/tests/system/addzone/ns2/named2.conf.in
+++ b/bin/tests/system/addzone/ns2/named2.conf.in
@@ -24,6 +24,7 @@ options {
 	listen-on { 10.53.0.2; 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 view internal {
diff --git a/bin/tests/system/addzone/ns2/named3.conf.in b/bin/tests/system/addzone/ns2/named3.conf.in
index 697d279a42f..7078ce989e4 100644
--- a/bin/tests/system/addzone/ns2/named3.conf.in
+++ b/bin/tests/system/addzone/ns2/named3.conf.in
@@ -24,6 +24,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	new-zones-directory "new-zones";
+	dnssec-validation no;
 };
 
 view internal {
diff --git a/bin/tests/system/addzone/ns3/named1.conf.in b/bin/tests/system/addzone/ns3/named1.conf.in
index f1488f472bb..6c512a670c3 100644
--- a/bin/tests/system/addzone/ns3/named1.conf.in
+++ b/bin/tests/system/addzone/ns3/named1.conf.in
@@ -25,6 +25,7 @@ options {
 	allow-query { any; };
 	recursion no;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/addzone/ns3/named2.conf.in b/bin/tests/system/addzone/ns3/named2.conf.in
index 3b56d640a91..6ca25f1a195 100644
--- a/bin/tests/system/addzone/ns3/named2.conf.in
+++ b/bin/tests/system/addzone/ns3/named2.conf.in
@@ -25,4 +25,5 @@ options {
 	allow-query { any; };
 	recursion no;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/allow-query/ns1/named.conf.in b/bin/tests/system/allow-query/ns1/named.conf.in
index a72cc87f46b..dd786e27801 100644
--- a/bin/tests/system/allow-query/ns1/named.conf.in
+++ b/bin/tests/system/allow-query/ns1/named.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/allow-query/ns2/named01.conf.in b/bin/tests/system/allow-query/ns2/named01.conf.in
index 1f7ab40edb1..3069010dfb1 100644
--- a/bin/tests/system/allow-query/ns2/named01.conf.in
+++ b/bin/tests/system/allow-query/ns2/named01.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named02.conf.in b/bin/tests/system/allow-query/ns2/named02.conf.in
index 3e24bdc3599..678c41779c0 100644
--- a/bin/tests/system/allow-query/ns2/named02.conf.in
+++ b/bin/tests/system/allow-query/ns2/named02.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { any; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named03.conf.in b/bin/tests/system/allow-query/ns2/named03.conf.in
index dd5985b036a..cdc64ff98fd 100644
--- a/bin/tests/system/allow-query/ns2/named03.conf.in
+++ b/bin/tests/system/allow-query/ns2/named03.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { none; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named04.conf.in b/bin/tests/system/allow-query/ns2/named04.conf.in
index f61447e092f..05446627d6b 100644
--- a/bin/tests/system/allow-query/ns2/named04.conf.in
+++ b/bin/tests/system/allow-query/ns2/named04.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { 10.53.0.2; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named05.conf.in b/bin/tests/system/allow-query/ns2/named05.conf.in
index 53c31a35b57..6f92049f96c 100644
--- a/bin/tests/system/allow-query/ns2/named05.conf.in
+++ b/bin/tests/system/allow-query/ns2/named05.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { 10.53.0.1; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named06.conf.in b/bin/tests/system/allow-query/ns2/named06.conf.in
index 49d9e426f1f..261c75b9883 100644
--- a/bin/tests/system/allow-query/ns2/named06.conf.in
+++ b/bin/tests/system/allow-query/ns2/named06.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query {! 10.53.0.2; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named07.conf.in b/bin/tests/system/allow-query/ns2/named07.conf.in
index a40cadeb779..8050fa22048 100644
--- a/bin/tests/system/allow-query/ns2/named07.conf.in
+++ b/bin/tests/system/allow-query/ns2/named07.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { accept; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named08.conf.in b/bin/tests/system/allow-query/ns2/named08.conf.in
index 413878b81d9..ffa4cdc8d66 100644
--- a/bin/tests/system/allow-query/ns2/named08.conf.in
+++ b/bin/tests/system/allow-query/ns2/named08.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { accept; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named09.conf.in b/bin/tests/system/allow-query/ns2/named09.conf.in
index b2d900efe3e..49166e64fd9 100644
--- a/bin/tests/system/allow-query/ns2/named09.conf.in
+++ b/bin/tests/system/allow-query/ns2/named09.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query {! accept; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
index ae485e82add..a9cb0b21f3c 100644
--- a/bin/tests/system/allow-query/ns2/named10.conf.in
+++ b/bin/tests/system/allow-query/ns2/named10.conf.in
@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { key one; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
index 8a5e806745e..372f4f3655d 100644
--- a/bin/tests/system/allow-query/ns2/named11.conf.in
+++ b/bin/tests/system/allow-query/ns2/named11.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { key one; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
index a10c6d0f98f..5dc3e776ea1 100644
--- a/bin/tests/system/allow-query/ns2/named12.conf.in
+++ b/bin/tests/system/allow-query/ns2/named12.conf.in
@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query {! key one; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named21.conf.in b/bin/tests/system/allow-query/ns2/named21.conf.in
index 311eaf79aa4..c6204a3b6c2 100644
--- a/bin/tests/system/allow-query/ns2/named21.conf.in
+++ b/bin/tests/system/allow-query/ns2/named21.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named22.conf.in b/bin/tests/system/allow-query/ns2/named22.conf.in
index 1c191da5f30..454f24a59c2 100644
--- a/bin/tests/system/allow-query/ns2/named22.conf.in
+++ b/bin/tests/system/allow-query/ns2/named22.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named23.conf.in b/bin/tests/system/allow-query/ns2/named23.conf.in
index e0cd0696685..f62337bc286 100644
--- a/bin/tests/system/allow-query/ns2/named23.conf.in
+++ b/bin/tests/system/allow-query/ns2/named23.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named24.conf.in b/bin/tests/system/allow-query/ns2/named24.conf.in
index 33f03b02e62..1e277a95aa4 100644
--- a/bin/tests/system/allow-query/ns2/named24.conf.in
+++ b/bin/tests/system/allow-query/ns2/named24.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named25.conf.in b/bin/tests/system/allow-query/ns2/named25.conf.in
index 28cadd0a40a..0548af24889 100644
--- a/bin/tests/system/allow-query/ns2/named25.conf.in
+++ b/bin/tests/system/allow-query/ns2/named25.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named26.conf.in b/bin/tests/system/allow-query/ns2/named26.conf.in
index 52b915da8f9..40e5dfd175f 100644
--- a/bin/tests/system/allow-query/ns2/named26.conf.in
+++ b/bin/tests/system/allow-query/ns2/named26.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named27.conf.in b/bin/tests/system/allow-query/ns2/named27.conf.in
index c95838c0e87..92fa1f8bd1e 100644
--- a/bin/tests/system/allow-query/ns2/named27.conf.in
+++ b/bin/tests/system/allow-query/ns2/named27.conf.in
@@ -19,6 +19,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named28.conf.in b/bin/tests/system/allow-query/ns2/named28.conf.in
index 06d9b919e5e..2ecac7ce833 100644
--- a/bin/tests/system/allow-query/ns2/named28.conf.in
+++ b/bin/tests/system/allow-query/ns2/named28.conf.in
@@ -19,6 +19,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named29.conf.in b/bin/tests/system/allow-query/ns2/named29.conf.in
index acd1b413d57..9a6c9e5a0e1 100644
--- a/bin/tests/system/allow-query/ns2/named29.conf.in
+++ b/bin/tests/system/allow-query/ns2/named29.conf.in
@@ -19,6 +19,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
index 52981a7a0bb..975b039a5f7 100644
--- a/bin/tests/system/allow-query/ns2/named30.conf.in
+++ b/bin/tests/system/allow-query/ns2/named30.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
index f6278703d77..c9b11aee826 100644
--- a/bin/tests/system/allow-query/ns2/named31.conf.in
+++ b/bin/tests/system/allow-query/ns2/named31.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { key one; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
index 6fd516bcedd..54a45f22ea1 100644
--- a/bin/tests/system/allow-query/ns2/named32.conf.in
+++ b/bin/tests/system/allow-query/ns2/named32.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named33.conf.in b/bin/tests/system/allow-query/ns2/named33.conf.in
index be1e160f788..be31b720516 100644
--- a/bin/tests/system/allow-query/ns2/named33.conf.in
+++ b/bin/tests/system/allow-query/ns2/named33.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { none; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named34.conf.in b/bin/tests/system/allow-query/ns2/named34.conf.in
index d35ac3e0278..165ff06b05a 100644
--- a/bin/tests/system/allow-query/ns2/named34.conf.in
+++ b/bin/tests/system/allow-query/ns2/named34.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { any; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
index de37915e678..2eb9191a374 100644
--- a/bin/tests/system/allow-query/ns2/named40.conf.in
+++ b/bin/tests/system/allow-query/ns2/named40.conf.in
@@ -31,6 +31,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named53.conf.in b/bin/tests/system/allow-query/ns2/named53.conf.in
index 41ac6d33037..bd0af284203 100644
--- a/bin/tests/system/allow-query/ns2/named53.conf.in
+++ b/bin/tests/system/allow-query/ns2/named53.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { none; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named54.conf.in b/bin/tests/system/allow-query/ns2/named54.conf.in
index 64a3f69d532..a6ca42442db 100644
--- a/bin/tests/system/allow-query/ns2/named54.conf.in
+++ b/bin/tests/system/allow-query/ns2/named54.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { any; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named55.conf.in b/bin/tests/system/allow-query/ns2/named55.conf.in
index 642e4c99ca7..6bcba0771c6 100644
--- a/bin/tests/system/allow-query/ns2/named55.conf.in
+++ b/bin/tests/system/allow-query/ns2/named55.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named56.conf.in b/bin/tests/system/allow-query/ns2/named56.conf.in
index 187d69701ac..d89a5fbabc2 100644
--- a/bin/tests/system/allow-query/ns2/named56.conf.in
+++ b/bin/tests/system/allow-query/ns2/named56.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named57.conf.in b/bin/tests/system/allow-query/ns2/named57.conf.in
index 1502b12c739..bcc3a85dcaf 100644
--- a/bin/tests/system/allow-query/ns2/named57.conf.in
+++ b/bin/tests/system/allow-query/ns2/named57.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/auth/ns1/named.conf.in b/bin/tests/system/auth/ns1/named.conf.in
index db7570e5531..9d0a517b68d 100644
--- a/bin/tests/system/auth/ns1/named.conf.in
+++ b/bin/tests/system/auth/ns1/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 view main in {
diff --git a/bin/tests/system/auth/ns2/named.conf.in b/bin/tests/system/auth/ns2/named.conf.in
index 126d5769e20..9b82c5005b7 100644
--- a/bin/tests/system/auth/ns2/named.conf.in
+++ b/bin/tests/system/auth/ns2/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify no;
+	dnssec-validation no;
 };
 
 zone example.net {
diff --git a/bin/tests/system/builtin/ns1/named.conf.in b/bin/tests/system/builtin/ns1/named.conf.in
index fd6569d4f2c..723e6b20c0f 100644
--- a/bin/tests/system/builtin/ns1/named.conf.in
+++ b/bin/tests/system/builtin/ns1/named.conf.in
@@ -27,4 +27,5 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify no;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/builtin/ns2/named.conf.in b/bin/tests/system/builtin/ns2/named.conf.in
index 3275b0629d1..38b95f00367 100644
--- a/bin/tests/system/builtin/ns2/named.conf.in
+++ b/bin/tests/system/builtin/ns2/named.conf.in
@@ -28,4 +28,5 @@ options {
 	recursion yes;
 	notify no;
 	server-id hostname;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/builtin/ns3/named.conf.in b/bin/tests/system/builtin/ns3/named.conf.in
index acde3a50e7f..df538dbbc8a 100644
--- a/bin/tests/system/builtin/ns3/named.conf.in
+++ b/bin/tests/system/builtin/ns3/named.conf.in
@@ -30,4 +30,5 @@ options {
 	hostname "this.is.a.test.of.hostname";
 	server-id "this.is.a.test.of.server-id";
 	version "this is a test of version";
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/case/ns1/named.conf.in b/bin/tests/system/case/ns1/named.conf.in
index 076b9d01334..fa0d8084d8f 100644
--- a/bin/tests/system/case/ns1/named.conf.in
+++ b/bin/tests/system/case/ns1/named.conf.in
@@ -24,6 +24,7 @@ options {
 	ixfr-from-differences yes;
 	check-integrity no;
 	minimal-responses no;
+	dnssec-validation no;
 };
 
 zone "example" {
diff --git a/bin/tests/system/case/ns2/named.conf.in b/bin/tests/system/case/ns2/named.conf.in
index 0a5c76fbb76..fe0b52ca7a2 100644
--- a/bin/tests/system/case/ns2/named.conf.in
+++ b/bin/tests/system/case/ns2/named.conf.in
@@ -25,6 +25,7 @@ options {
 	check-integrity no;
 	no-case-compress { 10.53.0.2; };
 	minimal-responses no;
+	dnssec-validation no;
 };
 
 zone "example" {
diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
index 2d1696b0a08..7ffec5a809a 100644
--- a/bin/tests/system/catz/ns1/named.conf.in
+++ b/bin/tests/system/catz/ns1/named.conf.in
@@ -33,6 +33,7 @@ options {
 	notify-delay 0;
 	recursion no;
 	allow-transfer { any; };
+	dnssec-validation no;
 };
 
 view "default" {
diff --git a/bin/tests/system/catz/ns2/named1.conf.in b/bin/tests/system/catz/ns2/named1.conf.in
index 99b6f440472..2ee9da4d313 100644
--- a/bin/tests/system/catz/ns2/named1.conf.in
+++ b/bin/tests/system/catz/ns2/named1.conf.in
@@ -29,6 +29,7 @@ options {
 	notify-delay 0;
 	recursion no;
 	serial-query-rate 100;
+	dnssec-validation no;
 };
 
 /*
diff --git a/bin/tests/system/catz/ns2/named2.conf.in b/bin/tests/system/catz/ns2/named2.conf.in
index d8fbe08e15d..5ca4e3e7d67 100644
--- a/bin/tests/system/catz/ns2/named2.conf.in
+++ b/bin/tests/system/catz/ns2/named2.conf.in
@@ -29,6 +29,7 @@ options {
 	notify-delay 0;
 	recursion no;
 	serial-query-rate 100;
+	dnssec-validation no;
 };
 
 view "default" {
diff --git a/bin/tests/system/catz/ns3/named.conf.in b/bin/tests/system/catz/ns3/named.conf.in
index bb2121ad1ad..b1bbc1ea196 100644
--- a/bin/tests/system/catz/ns3/named.conf.in
+++ b/bin/tests/system/catz/ns3/named.conf.in
@@ -30,6 +30,7 @@ options {
 	notify no;
 	notify-delay 0;
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "catalog2.example" {
diff --git a/bin/tests/system/catz/ns4/named.conf.in b/bin/tests/system/catz/ns4/named.conf.in
index 73a2bb7b490..2f43c25e183 100644
--- a/bin/tests/system/catz/ns4/named.conf.in
+++ b/bin/tests/system/catz/ns4/named.conf.in
@@ -31,6 +31,7 @@ options {
 	recursion no;
 	serial-query-rate 100;
 	ixfr-from-differences yes; // GL #3777
+	dnssec-validation no;
 
 	catalog-zones {
 		zone "catalog-tls.example"
diff --git a/bin/tests/system/checkds/ns10/named.conf.in b/bin/tests/system/checkds/ns10/named.conf.in
index a4939920a90..ef2ec416e0b 100644
--- a/bin/tests/system/checkds/ns10/named.conf.in
+++ b/bin/tests/system/checkds/ns10/named.conf.in
@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/checkds/ns2/named.conf.in b/bin/tests/system/checkds/ns2/named.conf.in
index ce2c089c427..5d0b0d44081 100644
--- a/bin/tests/system/checkds/ns2/named.conf.in
+++ b/bin/tests/system/checkds/ns2/named.conf.in
@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/checkds/ns4/named.conf.in b/bin/tests/system/checkds/ns4/named.conf.in
index 1d551cfbb5c..75bd470b85d 100644
--- a/bin/tests/system/checkds/ns4/named.conf.in
+++ b/bin/tests/system/checkds/ns4/named.conf.in
@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/checkds/ns5/named.conf.in b/bin/tests/system/checkds/ns5/named.conf.in
index 0648af8c1b4..01a2d11f94f 100644
--- a/bin/tests/system/checkds/ns5/named.conf.in
+++ b/bin/tests/system/checkds/ns5/named.conf.in
@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/checkds/ns6/named.conf.in b/bin/tests/system/checkds/ns6/named.conf.in
index 90c80cce4ce..cc226fbd958 100644
--- a/bin/tests/system/checkds/ns6/named.conf.in
+++ b/bin/tests/system/checkds/ns6/named.conf.in
@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/checkds/ns7/named.conf.in b/bin/tests/system/checkds/ns7/named.conf.in
index dc17b657c8e..f3e562b6973 100644
--- a/bin/tests/system/checkds/ns7/named.conf.in
+++ b/bin/tests/system/checkds/ns7/named.conf.in
@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/checkds/ns8/named.conf.in b/bin/tests/system/checkds/ns8/named.conf.in
index 76690949db2..69e75eecd3c 100644
--- a/bin/tests/system/checkds/ns8/named.conf.in
+++ b/bin/tests/system/checkds/ns8/named.conf.in
@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/checkds/ns9/named.conf.in b/bin/tests/system/checkds/ns9/named.conf.in
index 94d830cd1be..9f3ab8816c6 100644
--- a/bin/tests/system/checkds/ns9/named.conf.in
+++ b/bin/tests/system/checkds/ns9/named.conf.in
@@ -25,6 +25,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation yes;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/cookie/ns7/named.conf.in b/bin/tests/system/cookie/ns7/named.conf.in
index 3437eb65318..9426d233cbc 100644
--- a/bin/tests/system/cookie/ns7/named.conf.in
+++ b/bin/tests/system/cookie/ns7/named.conf.in
@@ -23,6 +23,7 @@ options {
 	answer-cookie no;
 	send-cookie yes;
 	nocookie-udp-size 512;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/dispatch/ns1/named.conf.in b/bin/tests/system/dispatch/ns1/named.conf.in
index 794312497e1..d3337a5db4f 100644
--- a/bin/tests/system/dispatch/ns1/named.conf.in
+++ b/bin/tests/system/dispatch/ns1/named.conf.in
@@ -36,6 +36,7 @@ options {
 
 	recursion no;
 	servfail-ttl 0;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/dispatch/ns2/named.conf.in b/bin/tests/system/dispatch/ns2/named.conf.in
index 8e79ac483d8..50f2c34494a 100644
--- a/bin/tests/system/dispatch/ns2/named.conf.in
+++ b/bin/tests/system/dispatch/ns2/named.conf.in
@@ -36,6 +36,7 @@ options {
 
 	recursion yes;
 	servfail-ttl 0;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/dlzexternal/ns1/named.conf.in b/bin/tests/system/dlzexternal/ns1/named.conf.in
index 87f8a7fe326..f8b36e96204 100644
--- a/bin/tests/system/dlzexternal/ns1/named.conf.in
+++ b/bin/tests/system/dlzexternal/ns1/named.conf.in
@@ -23,6 +23,7 @@ options {
 	allow-transfer { !10.53.0.1; any; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/dnssec/ns4/named5.conf.in b/bin/tests/system/dnssec/ns4/named5.conf.in
index e457062d64c..b9d0ba8025f 100644
--- a/bin/tests/system/dnssec/ns4/named5.conf.in
+++ b/bin/tests/system/dnssec/ns4/named5.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	bindkeys-file "managed.conf";
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/dnssec/ns5/named2.conf.in b/bin/tests/system/dnssec/ns5/named2.conf.in
index 636f4c23fae..6d0474b9d5b 100644
--- a/bin/tests/system/dnssec/ns5/named2.conf.in
+++ b/bin/tests/system/dnssec/ns5/named2.conf.in
@@ -31,6 +31,7 @@ options {
 	listen-on { 10.53.0.5; 127.0.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation yes;
 };
 
 view root {
diff --git a/bin/tests/system/dupsigs/ns1/named.conf.in b/bin/tests/system/dupsigs/ns1/named.conf.in
index 494ecfb9e3d..d35eb791530 100644
--- a/bin/tests/system/dupsigs/ns1/named.conf.in
+++ b/bin/tests/system/dupsigs/ns1/named.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	pid-file "named.pid";
+	dnssec-validation no;
 };
 
 zone "signing.test" {
diff --git a/bin/tests/system/dyndb/ns1/named.conf.in b/bin/tests/system/dyndb/ns1/named.conf.in
index 6bb76ea404e..d319a2a81ef 100644
--- a/bin/tests/system/dyndb/ns1/named.conf.in
+++ b/bin/tests/system/dyndb/ns1/named.conf.in
@@ -24,6 +24,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/ednscompliance/ns1/named.conf.in b/bin/tests/system/ednscompliance/ns1/named.conf.in
index 07aaf218105..1334c85cf27 100644
--- a/bin/tests/system/ednscompliance/ns1/named.conf.in
+++ b/bin/tests/system/ednscompliance/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/emptyzones/ns1/named1.conf.in b/bin/tests/system/emptyzones/ns1/named1.conf.in
index 4275df44ce8..4aad843482c 100644
--- a/bin/tests/system/emptyzones/ns1/named1.conf.in
+++ b/bin/tests/system/emptyzones/ns1/named1.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
 		 except-from { "example.org"; };
 	deny-answer-aliases { "example.org"; }
diff --git a/bin/tests/system/emptyzones/ns1/named2.conf.in b/bin/tests/system/emptyzones/ns1/named2.conf.in
index e330e336bee..89fe2b475c6 100644
--- a/bin/tests/system/emptyzones/ns1/named2.conf.in
+++ b/bin/tests/system/emptyzones/ns1/named2.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
 		 except-from { "example.org"; };
 	deny-answer-aliases { "example.org"; }
diff --git a/bin/tests/system/formerr/ns1/named.conf.in b/bin/tests/system/formerr/ns1/named.conf.in
index 07aaf218105..1334c85cf27 100644
--- a/bin/tests/system/formerr/ns1/named.conf.in
+++ b/bin/tests/system/formerr/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/forward/ns10/named.conf.in b/bin/tests/system/forward/ns10/named.conf.in
index 1f318dd8676..8148d9e8719 100644
--- a/bin/tests/system/forward/ns10/named.conf.in
+++ b/bin/tests/system/forward/ns10/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.10; };
 	listen-on-v6 { none; };
 	minimal-responses no;
+	dnssec-validation no;
 };
 
 zone "net." {
diff --git a/bin/tests/system/glue/ns1/named.conf.in b/bin/tests/system/glue/ns1/named.conf.in
index 61195f91364..19595a9132b 100644
--- a/bin/tests/system/glue/ns1/named.conf.in
+++ b/bin/tests/system/glue/ns1/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/host/ns1/named.conf.in b/bin/tests/system/host/ns1/named.conf.in
index 67b4f4fc766..8338a9cb82c 100644
--- a/bin/tests/system/host/ns1/named.conf.in
+++ b/bin/tests/system/host/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "example" {
diff --git a/bin/tests/system/include-multiplecfg/ns2/named.conf.in b/bin/tests/system/include-multiplecfg/ns2/named.conf.in
index 751200f6f7f..b38c228013e 100644
--- a/bin/tests/system/include-multiplecfg/ns2/named.conf.in
+++ b/bin/tests/system/include-multiplecfg/ns2/named.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
         notify no;
+	dnssec-validation no;
 };
 
 # Should include all files matching pattern.
diff --git a/bin/tests/system/inline/ns2/named.conf.in b/bin/tests/system/inline/ns2/named.conf.in
index 3ad6d966270..38e6e90fbf4 100644
--- a/bin/tests/system/inline/ns2/named.conf.in
+++ b/bin/tests/system/inline/ns2/named.conf.in
@@ -31,6 +31,7 @@ options {
 	notify yes;
 	notify-delay 0;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
 
 zone "bits" {
diff --git a/bin/tests/system/inline/ns3/named.conf.in b/bin/tests/system/inline/ns3/named.conf.in
index 3f6350f0765..6b3b3cd5bc8 100644
--- a/bin/tests/system/inline/ns3/named.conf.in
+++ b/bin/tests/system/inline/ns3/named.conf.in
@@ -32,6 +32,7 @@ options {
 	try-tcp-refresh no;
 	notify-delay 0;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
 
 zone "bits" {
diff --git a/bin/tests/system/inline/ns4/named.conf.in b/bin/tests/system/inline/ns4/named.conf.in
index fed200ab1ae..c0745f40ffb 100644
--- a/bin/tests/system/inline/ns4/named.conf.in
+++ b/bin/tests/system/inline/ns4/named.conf.in
@@ -24,6 +24,7 @@ options {
 	recursion no;
 	notify yes;
 	notify-delay 0;
+	dnssec-validation no;
 };
 
 zone "noixfr" {
diff --git a/bin/tests/system/inline/ns6/named.conf.in b/bin/tests/system/inline/ns6/named.conf.in
index 215fd5848d0..8237f310a9a 100644
--- a/bin/tests/system/inline/ns6/named.conf.in
+++ b/bin/tests/system/inline/ns6/named.conf.in
@@ -30,6 +30,7 @@ options {
 	recursion yes;
 	notify yes;
 	notify-delay 0;
+	dnssec-validation yes;
 };
 
 zone "." {
diff --git a/bin/tests/system/inline/ns8/named.conf.in b/bin/tests/system/inline/ns8/named.conf.in
index 27590daec1b..47bb99151b1 100644
--- a/bin/tests/system/inline/ns8/named.conf.in
+++ b/bin/tests/system/inline/ns8/named.conf.in
@@ -33,6 +33,7 @@ options {
 	try-tcp-refresh no;
 	notify-delay 0;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
 
 zone "example01.com" {
diff --git a/bin/tests/system/integrity/ns1/named.conf.in b/bin/tests/system/integrity/ns1/named.conf.in
index 4009c4f482e..00d9dba3b6b 100644
--- a/bin/tests/system/integrity/ns1/named.conf.in
+++ b/bin/tests/system/integrity/ns1/named.conf.in
@@ -23,6 +23,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/ixfr/ns1/named.conf.in b/bin/tests/system/ixfr/ns1/named.conf.in
index 65f152b471e..48fc1cd01cb 100644
--- a/bin/tests/system/ixfr/ns1/named.conf.in
+++ b/bin/tests/system/ixfr/ns1/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/ixfr/ns3/named.conf.in b/bin/tests/system/ixfr/ns3/named.conf.in
index e9b96124240..40af32492d2 100644
--- a/bin/tests/system/ixfr/ns3/named.conf.in
+++ b/bin/tests/system/ixfr/ns3/named.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/ixfr/ns4/named.conf.in b/bin/tests/system/ixfr/ns4/named.conf.in
index 925a28051b4..ae6657e13e9 100644
--- a/bin/tests/system/ixfr/ns4/named.conf.in
+++ b/bin/tests/system/ixfr/ns4/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/ixfr/ns5/named.conf.in b/bin/tests/system/ixfr/ns5/named.conf.in
index 45d4f97bf4b..e1056fc589a 100644
--- a/bin/tests/system/ixfr/ns5/named.conf.in
+++ b/bin/tests/system/ixfr/ns5/named.conf.in
@@ -22,6 +22,7 @@ options {
 	recursion no;
 	notify yes;
 	provide-ixfr no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/kasp/ns2/named.conf.in b/bin/tests/system/kasp/ns2/named.conf.in
index f90fce86737..bdbacc2c3da 100644
--- a/bin/tests/system/kasp/ns2/named.conf.in
+++ b/bin/tests/system/kasp/ns2/named.conf.in
@@ -24,6 +24,7 @@ options {
 	allow-transfer { any; };
 	recursion no;
 	dnssec-policy "none";
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/kasp/ns3/named-fips.conf.in b/bin/tests/system/kasp/ns3/named-fips.conf.in
index 6199b0496b5..b610d9847f8 100644
--- a/bin/tests/system/kasp/ns3/named-fips.conf.in
+++ b/bin/tests/system/kasp/ns3/named-fips.conf.in
@@ -27,6 +27,7 @@ options {
 	allow-transfer { any; };
 	recursion no;
 	dnssec-policy "rsasha256";
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/kasp/ns4/named.conf.in b/bin/tests/system/kasp/ns4/named.conf.in
index 4ded7a22189..459ea73a892 100644
--- a/bin/tests/system/kasp/ns4/named.conf.in
+++ b/bin/tests/system/kasp/ns4/named.conf.in
@@ -66,6 +66,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	dnssec-policy "test";
+	dnssec-validation no;
 };
 
 view "inherit" {
diff --git a/bin/tests/system/kasp/ns5/named.conf.in b/bin/tests/system/kasp/ns5/named.conf.in
index dfa5bb1d474..44855b92d56 100644
--- a/bin/tests/system/kasp/ns5/named.conf.in
+++ b/bin/tests/system/kasp/ns5/named.conf.in
@@ -51,6 +51,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	dnssec-policy "none";
+	dnssec-validation no;
 };
 
 view "inherit" {
diff --git a/bin/tests/system/kasp/ns6/named.conf.in b/bin/tests/system/kasp/ns6/named.conf.in
index f00594b784d..c339c447db2 100644
--- a/bin/tests/system/kasp/ns6/named.conf.in
+++ b/bin/tests/system/kasp/ns6/named.conf.in
@@ -27,6 +27,7 @@ options {
 	allow-transfer { any; };
 	recursion no;
 	key-directory ".";
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/kasp/ns6/named2.conf.in b/bin/tests/system/kasp/ns6/named2.conf.in
index 1bb6242b6d2..4d48fd9a7e3 100644
--- a/bin/tests/system/kasp/ns6/named2.conf.in
+++ b/bin/tests/system/kasp/ns6/named2.conf.in
@@ -26,6 +26,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/keepalive/ns1/named.conf.in b/bin/tests/system/keepalive/ns1/named.conf.in
index 696dc48f987..32dbf90056e 100644
--- a/bin/tests/system/keepalive/ns1/named.conf.in
+++ b/bin/tests/system/keepalive/ns1/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/keepalive/ns2/named.conf.in b/bin/tests/system/keepalive/ns2/named.conf.in
index 5fbd453f873..8ccf1c43432 100644
--- a/bin/tests/system/keepalive/ns2/named.conf.in
+++ b/bin/tests/system/keepalive/ns2/named.conf.in
@@ -31,6 +31,7 @@ options {
 	recursion yes;
 	send-cookie yes;
 	tcp-advertised-timeout 150;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/keepalive/ns3/named.conf.in b/bin/tests/system/keepalive/ns3/named.conf.in
index 873617b6005..3713f130997 100644
--- a/bin/tests/system/keepalive/ns3/named.conf.in
+++ b/bin/tests/system/keepalive/ns3/named.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	dnssec-validation no;
 };
 
 server 10.53.0.2 {
diff --git a/bin/tests/system/keymgr2kasp/ns3/named.conf.in b/bin/tests/system/keymgr2kasp/ns3/named.conf.in
index c1e8a30e20a..40104c1b863 100644
--- a/bin/tests/system/keymgr2kasp/ns3/named.conf.in
+++ b/bin/tests/system/keymgr2kasp/ns3/named.conf.in
@@ -24,6 +24,7 @@ options {
 	allow-transfer { any; };
 	recursion no;
 	key-directory ".";
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/keymgr2kasp/ns3/named2.conf.in b/bin/tests/system/keymgr2kasp/ns3/named2.conf.in
index f0147b36705..3eb1adf9dd8 100644
--- a/bin/tests/system/keymgr2kasp/ns3/named2.conf.in
+++ b/bin/tests/system/keymgr2kasp/ns3/named2.conf.in
@@ -25,6 +25,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/keymgr2kasp/ns4/named.conf.in b/bin/tests/system/keymgr2kasp/ns4/named.conf.in
index fda402ca316..ac25806e2da 100644
--- a/bin/tests/system/keymgr2kasp/ns4/named.conf.in
+++ b/bin/tests/system/keymgr2kasp/ns4/named.conf.in
@@ -24,6 +24,7 @@ options {
 	allow-transfer { any; };
 	recursion no;
 	key-directory ".";
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/keymgr2kasp/ns4/named2.conf.in b/bin/tests/system/keymgr2kasp/ns4/named2.conf.in
index eb7a6538bbf..fb533f94cab 100644
--- a/bin/tests/system/keymgr2kasp/ns4/named2.conf.in
+++ b/bin/tests/system/keymgr2kasp/ns4/named2.conf.in
@@ -24,6 +24,7 @@ options {
 	allow-transfer { any; };
 	recursion no;
 	key-directory ".";
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/limits/ns1/named.conf.in b/bin/tests/system/limits/ns1/named.conf.in
index 118fdbd9b19..780f9e21cba 100644
--- a/bin/tests/system/limits/ns1/named.conf.in
+++ b/bin/tests/system/limits/ns1/named.conf.in
@@ -22,6 +22,7 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/masterfile/ns1/named.conf.in b/bin/tests/system/masterfile/ns1/named.conf.in
index 5ab72a5851c..4203aae917c 100644
--- a/bin/tests/system/masterfile/ns1/named.conf.in
+++ b/bin/tests/system/masterfile/ns1/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 zone "include" {
diff --git a/bin/tests/system/masterformat/ns1/named.conf.in b/bin/tests/system/masterformat/ns1/named.conf.in
index 28687feda40..a0d054fc6e0 100644
--- a/bin/tests/system/masterformat/ns1/named.conf.in
+++ b/bin/tests/system/masterformat/ns1/named.conf.in
@@ -22,6 +22,7 @@ options {
 	notify no;
 	session-keyfile "session.key";
 	servfail-ttl 0;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/masterformat/ns2/named.conf.in b/bin/tests/system/masterformat/ns2/named.conf.in
index c0f29873181..db68aef4d06 100644
--- a/bin/tests/system/masterformat/ns2/named.conf.in
+++ b/bin/tests/system/masterformat/ns2/named.conf.in
@@ -21,6 +21,7 @@ options {
 	recursion no;
 	notify no;
 	servfail-ttl 0;
+	dnssec-validation no;
 };
 
 zone "example" {
diff --git a/bin/tests/system/masterformat/ns3/named.conf.in b/bin/tests/system/masterformat/ns3/named.conf.in
index eca537d93ec..deaed8bd01a 100644
--- a/bin/tests/system/masterformat/ns3/named.conf.in
+++ b/bin/tests/system/masterformat/ns3/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/mirror/ns1/named.conf.in b/bin/tests/system/mirror/ns1/named.conf.in
index 5334786840c..22173f7996c 100644
--- a/bin/tests/system/mirror/ns1/named.conf.in
+++ b/bin/tests/system/mirror/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/mirror/ns2/named.conf.in b/bin/tests/system/mirror/ns2/named.conf.in
index 52999c53250..7eaed5b11f2 100644
--- a/bin/tests/system/mirror/ns2/named.conf.in
+++ b/bin/tests/system/mirror/ns2/named.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "example" {
diff --git a/bin/tests/system/mirror/ns3/named.conf.in b/bin/tests/system/mirror/ns3/named.conf.in
index a22835019f5..50f6158e62c 100644
--- a/bin/tests/system/mirror/ns3/named.conf.in
+++ b/bin/tests/system/mirror/ns3/named.conf.in
@@ -32,6 +32,7 @@ options {
 	allow-query-cache { 10.53.0.1; };
 	trust-anchor-telemetry yes;
 	allow-new-zones yes;
+	dnssec-validation yes;
 };
 
 zone "." {
diff --git a/bin/tests/system/multisigner/ns3/named.conf.in b/bin/tests/system/multisigner/ns3/named.conf.in
index ce570696b6d..7cf25bbc448 100644
--- a/bin/tests/system/multisigner/ns3/named.conf.in
+++ b/bin/tests/system/multisigner/ns3/named.conf.in
@@ -26,6 +26,7 @@ options {
 	allow-transfer { any; };
 	recursion no;
 	key-directory ".";
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/multisigner/ns4/named.conf.in b/bin/tests/system/multisigner/ns4/named.conf.in
index e19fd35f0d0..3f36f76cd57 100644
--- a/bin/tests/system/multisigner/ns4/named.conf.in
+++ b/bin/tests/system/multisigner/ns4/named.conf.in
@@ -26,6 +26,7 @@ options {
 	allow-transfer { any; };
 	recursion no;
 	key-directory ".";
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/multisigner/ns5/named.conf.in b/bin/tests/system/multisigner/ns5/named.conf.in
index 3518fe38f8a..0a8e4f556c6 100644
--- a/bin/tests/system/multisigner/ns5/named.conf.in
+++ b/bin/tests/system/multisigner/ns5/named.conf.in
@@ -26,6 +26,7 @@ options {
 	allow-transfer { any; };
 	recursion no;
 	key-directory ".";
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/names/ns1/named.conf.in b/bin/tests/system/names/ns1/named.conf.in
index 50211bccc38..c065e38f1b1 100644
--- a/bin/tests/system/names/ns1/named.conf.in
+++ b/bin/tests/system/names/ns1/named.conf.in
@@ -23,6 +23,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 
diff --git a/bin/tests/system/notify/ns1/named.conf.in b/bin/tests/system/notify/ns1/named.conf.in
index eb079c95ab8..41a46be0d07 100644
--- a/bin/tests/system/notify/ns1/named.conf.in
+++ b/bin/tests/system/notify/ns1/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/notify/ns2/named.conf.in b/bin/tests/system/notify/ns2/named.conf.in
index abfdc102e2c..bc5af9d1b0f 100644
--- a/bin/tests/system/notify/ns2/named.conf.in
+++ b/bin/tests/system/notify/ns2/named.conf.in
@@ -22,6 +22,7 @@ options {
 	recursion no;
 	notify yes;
 	startup-notify-rate 5;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/notify/ns3/named.conf.in b/bin/tests/system/notify/ns3/named.conf.in
index 687d9f1b2c0..ee21f92c0e7 100644
--- a/bin/tests/system/notify/ns3/named.conf.in
+++ b/bin/tests/system/notify/ns3/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/notify/ns4/named.conf.in b/bin/tests/system/notify/ns4/named.conf.in
index f20d2eb587d..95a0ff9c6b5 100644
--- a/bin/tests/system/notify/ns4/named.conf.in
+++ b/bin/tests/system/notify/ns4/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
index 4660fa21699..3104bc7b6ae 100644
--- a/bin/tests/system/notify/ns5/named.conf.in
+++ b/bin/tests/system/notify/ns5/named.conf.in
@@ -36,6 +36,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	dnssec-validation no;
 };
 
 view "a" {
diff --git a/bin/tests/system/nsec3/ns2/named.conf.in b/bin/tests/system/nsec3/ns2/named.conf.in
index d6caf15615e..f4cc1b0e5cc 100644
--- a/bin/tests/system/nsec3/ns2/named.conf.in
+++ b/bin/tests/system/nsec3/ns2/named.conf.in
@@ -27,6 +27,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/nsec3/ns3/named-fips.conf.in b/bin/tests/system/nsec3/ns3/named-fips.conf.in
index 0235f0c1e7e..183b31590ac 100644
--- a/bin/tests/system/nsec3/ns3/named-fips.conf.in
+++ b/bin/tests/system/nsec3/ns3/named-fips.conf.in
@@ -40,6 +40,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/nsec3/ns3/named2-fips.conf.in b/bin/tests/system/nsec3/ns3/named2-fips.conf.in
index c5c5ec29692..ef7afeb8ad3 100644
--- a/bin/tests/system/nsec3/ns3/named2-fips.conf.in
+++ b/bin/tests/system/nsec3/ns3/named2-fips.conf.in
@@ -40,6 +40,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/nslookup/ns1/named.conf.in b/bin/tests/system/nslookup/ns1/named.conf.in
index 67b4f4fc766..8338a9cb82c 100644
--- a/bin/tests/system/nslookup/ns1/named.conf.in
+++ b/bin/tests/system/nslookup/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "example" {
diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
index a212d6d5691..0270e8ab4f6 100644
--- a/bin/tests/system/nsupdate/ns1/named.conf.in
+++ b/bin/tests/system/nsupdate/ns1/named.conf.in
@@ -26,6 +26,7 @@ options {
 	notify yes;
 	minimal-responses no;
 	update-quota 1;
+	dnssec-validation no;
 	include "tls.options";
 };
 
diff --git a/bin/tests/system/nsupdate/ns10/named.conf.in b/bin/tests/system/nsupdate/ns10/named.conf.in
index 397501a3525..a186d14114b 100644
--- a/bin/tests/system/nsupdate/ns10/named.conf.in
+++ b/bin/tests/system/nsupdate/ns10/named.conf.in
@@ -24,6 +24,7 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	dnssec-validation no;
 	@TKEY_CONFIGURATION@
 };
 
diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
index 0c6decfb579..023adf7ad01 100644
--- a/bin/tests/system/nsupdate/ns2/named.conf.in
+++ b/bin/tests/system/nsupdate/ns2/named.conf.in
@@ -22,6 +22,7 @@ options {
 	recursion yes;
 	notify yes;
 	serial-query-rate 1; // workaround for KB AA-01213
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/nsupdate/ns5/named.conf.in b/bin/tests/system/nsupdate/ns5/named.conf.in
index 39dec512c4f..e3c4d1b33d0 100644
--- a/bin/tests/system/nsupdate/ns5/named.conf.in
+++ b/bin/tests/system/nsupdate/ns5/named.conf.in
@@ -22,6 +22,7 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/nsupdate/ns6/named.conf.in b/bin/tests/system/nsupdate/ns6/named.conf.in
index 82bc015ce43..c636cfc7542 100644
--- a/bin/tests/system/nsupdate/ns6/named.conf.in
+++ b/bin/tests/system/nsupdate/ns6/named.conf.in
@@ -22,6 +22,7 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/nsupdate/ns7/named.conf.in b/bin/tests/system/nsupdate/ns7/named.conf.in
index 7a484c7f2e3..e5886e9acdd 100644
--- a/bin/tests/system/nsupdate/ns7/named.conf.in
+++ b/bin/tests/system/nsupdate/ns7/named.conf.in
@@ -22,6 +22,7 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	dnssec-validation no;
 	tkey-gssapi-keytab "dns.keytab";
 };
 
diff --git a/bin/tests/system/nsupdate/ns8/named.conf.in b/bin/tests/system/nsupdate/ns8/named.conf.in
index 042ac468e36..f69d3adacad 100644
--- a/bin/tests/system/nsupdate/ns8/named.conf.in
+++ b/bin/tests/system/nsupdate/ns8/named.conf.in
@@ -22,6 +22,7 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	dnssec-validation no;
 	tkey-gssapi-keytab "dns-other-than-KRB5_KTNAME.keytab";
 };
 
diff --git a/bin/tests/system/nsupdate/ns9/named.conf.in b/bin/tests/system/nsupdate/ns9/named.conf.in
index 0b70745ebd9..2cdc6afa746 100644
--- a/bin/tests/system/nsupdate/ns9/named.conf.in
+++ b/bin/tests/system/nsupdate/ns9/named.conf.in
@@ -22,6 +22,7 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	dnssec-validation no;
 	@TKEY_CONFIGURATION@
 };
 
diff --git a/bin/tests/system/nzd2nzf/ns1/named.conf.in b/bin/tests/system/nzd2nzf/ns1/named.conf.in
index 9b5bf3a82a1..91ebc66e1f8 100644
--- a/bin/tests/system/nzd2nzf/ns1/named.conf.in
+++ b/bin/tests/system/nzd2nzf/ns1/named.conf.in
@@ -19,6 +19,7 @@ options {
 	allow-query { any; };
 	recursion no;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/padding/ns1/named.conf.in b/bin/tests/system/padding/ns1/named.conf.in
index 696dc48f987..32dbf90056e 100644
--- a/bin/tests/system/padding/ns1/named.conf.in
+++ b/bin/tests/system/padding/ns1/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/padding/ns2/named.conf.in b/bin/tests/system/padding/ns2/named.conf.in
index 3f6e0d42c11..10ba86b6242 100644
--- a/bin/tests/system/padding/ns2/named.conf.in
+++ b/bin/tests/system/padding/ns2/named.conf.in
@@ -31,6 +31,7 @@ options {
 	recursion yes;
 	send-cookie yes;
 	response-padding { !10.53.0.8; any; } block-size 64;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/padding/ns3/named.conf.in b/bin/tests/system/padding/ns3/named.conf.in
index 9b7e123bfe0..a719249690b 100644
--- a/bin/tests/system/padding/ns3/named.conf.in
+++ b/bin/tests/system/padding/ns3/named.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	dnssec-validation no;
 };
 
 server 10.53.0.2 {
diff --git a/bin/tests/system/padding/ns4/named.conf.in b/bin/tests/system/padding/ns4/named.conf.in
index 79b7f72c7a5..6828f2ab95a 100644
--- a/bin/tests/system/padding/ns4/named.conf.in
+++ b/bin/tests/system/padding/ns4/named.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	dnssec-validation no;
 };
 
 server 10.53.0.2 {
diff --git a/bin/tests/system/pending/ns1/named.conf.in b/bin/tests/system/pending/ns1/named.conf.in
index f09c3c94423..af5d628495a 100644
--- a/bin/tests/system/pending/ns1/named.conf.in
+++ b/bin/tests/system/pending/ns1/named.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/pending/ns4/named.conf.in b/bin/tests/system/pending/ns4/named.conf.in
index 6be90858dd9..dfb55413f8e 100644
--- a/bin/tests/system/pending/ns4/named.conf.in
+++ b/bin/tests/system/pending/ns4/named.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation yes;
 };
 
 zone "." {
diff --git a/bin/tests/system/redirect/ns5/named.conf.in b/bin/tests/system/redirect/ns5/named.conf.in
index 74df436cc80..2513a451389 100644
--- a/bin/tests/system/redirect/ns5/named.conf.in
+++ b/bin/tests/system/redirect/ns5/named.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on port @PORT@ { 10.53.0.5; };
 	pid-file "named.pid";
 	nxdomain-redirect signed;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/redirect/ns6/named.conf.in b/bin/tests/system/redirect/ns6/named.conf.in
index d2117157253..dee2bcf51ef 100644
--- a/bin/tests/system/redirect/ns6/named.conf.in
+++ b/bin/tests/system/redirect/ns6/named.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on port @PORT@ { 10.53.0.6; };
 	pid-file "named.pid";
 	nxdomain-redirect unsigned;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/rndc/ns2/named.conf.in b/bin/tests/system/rndc/ns2/named.conf.in
index be1af2538ce..97d416c2c1a 100644
--- a/bin/tests/system/rndc/ns2/named.conf.in
+++ b/bin/tests/system/rndc/ns2/named.conf.in
@@ -18,6 +18,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/rndc/ns3/named.conf.in b/bin/tests/system/rndc/ns3/named.conf.in
index fd97ca2c573..20fe0ea1820 100644
--- a/bin/tests/system/rndc/ns3/named.conf.in
+++ b/bin/tests/system/rndc/ns3/named.conf.in
@@ -16,6 +16,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/rndc/ns5/named.conf.in b/bin/tests/system/rndc/ns5/named.conf.in
index 66814297562..e32fa49fdfb 100644
--- a/bin/tests/system/rndc/ns5/named.conf.in
+++ b/bin/tests/system/rndc/ns5/named.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/rndc/ns6/named.conf.in b/bin/tests/system/rndc/ns6/named.conf.in
index 3b09f41668a..a465a205aeb 100644
--- a/bin/tests/system/rndc/ns6/named.conf.in
+++ b/bin/tests/system/rndc/ns6/named.conf.in
@@ -17,6 +17,7 @@ options {
 	listen-on { 10.53.0.6; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/rndc/ns7/named.conf.in b/bin/tests/system/rndc/ns7/named.conf.in
index af3e6fbdd52..2d4bf7f49c6 100644
--- a/bin/tests/system/rndc/ns7/named.conf.in
+++ b/bin/tests/system/rndc/ns7/named.conf.in
@@ -16,6 +16,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.7; };
 	listen-on-v6 { none; };
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/rpz/ns1/named.conf.in b/bin/tests/system/rpz/ns1/named.conf.in
index 4cf402e244f..8b466f0f369 100644
--- a/bin/tests/system/rpz/ns1/named.conf.in
+++ b/bin/tests/system/rpz/ns1/named.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	notify no;
 	minimal-responses no;
+	dnssec-validation no;
 };
 
 key rndc_key {
diff --git a/bin/tests/system/rrl/broken.conf.in b/bin/tests/system/rrl/broken.conf.in
index 9a793c81253..21af240d74e 100644
--- a/bin/tests/system/rrl/broken.conf.in
+++ b/bin/tests/system/rrl/broken.conf.in
@@ -23,6 +23,7 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	notify no;
+	dnssec-validation no;
 
 	rate-limit {
 	    responses-per-second 2;
diff --git a/bin/tests/system/rsabigexponent/ns2/named.conf.in b/bin/tests/system/rsabigexponent/ns2/named.conf.in
index 7a15fd7ead8..c81b3f68eed 100644
--- a/bin/tests/system/rsabigexponent/ns2/named.conf.in
+++ b/bin/tests/system/rsabigexponent/ns2/named.conf.in
@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/runtime/ns2/named-alt4.conf.in b/bin/tests/system/runtime/ns2/named-alt4.conf.in
index aa3a01035a2..4c0312acd54 100644
--- a/bin/tests/system/runtime/ns2/named-alt4.conf.in
+++ b/bin/tests/system/runtime/ns2/named-alt4.conf.in
@@ -18,4 +18,5 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/runtime/ns2/named-alt5.conf.in b/bin/tests/system/runtime/ns2/named-alt5.conf.in
index 23d09b5e70c..71b7e099a0e 100644
--- a/bin/tests/system/runtime/ns2/named-alt5.conf.in
+++ b/bin/tests/system/runtime/ns2/named-alt5.conf.in
@@ -18,4 +18,5 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/runtime/ns2/named-alt6.conf.in b/bin/tests/system/runtime/ns2/named-alt6.conf.in
index 3ebc1405735..fb79924074f 100644
--- a/bin/tests/system/runtime/ns2/named-alt6.conf.in
+++ b/bin/tests/system/runtime/ns2/named-alt6.conf.in
@@ -18,4 +18,5 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/runtime/ns2/named-alt7.conf.in b/bin/tests/system/runtime/ns2/named-alt7.conf.in
index 49f38b49a6d..722316f725d 100644
--- a/bin/tests/system/runtime/ns2/named-alt7.conf.in
+++ b/bin/tests/system/runtime/ns2/named-alt7.conf.in
@@ -16,4 +16,5 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { fd92:7065:b8e:ffff::2; };
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/runtime/ns2/named-alt9.conf.in b/bin/tests/system/runtime/ns2/named-alt9.conf.in
index 6ae88e5ee52..f0ebcd34627 100644
--- a/bin/tests/system/runtime/ns2/named-alt9.conf.in
+++ b/bin/tests/system/runtime/ns2/named-alt9.conf.in
@@ -17,4 +17,5 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/serve-stale/ns1/named1.conf.in b/bin/tests/system/serve-stale/ns1/named1.conf.in
index a895195be74..d25611db021 100644
--- a/bin/tests/system/serve-stale/ns1/named1.conf.in
+++ b/bin/tests/system/serve-stale/ns1/named1.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	max-stale-ttl 3600;
 	stale-answer-ttl 4;
 	stale-answer-enable yes;
diff --git a/bin/tests/system/serve-stale/ns1/named2.conf.in b/bin/tests/system/serve-stale/ns1/named2.conf.in
index 2696a2b6b36..82e5e76550c 100644
--- a/bin/tests/system/serve-stale/ns1/named2.conf.in
+++ b/bin/tests/system/serve-stale/ns1/named2.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	max-stale-ttl 3600;
 	stale-answer-ttl 4;
 	stale-answer-enable yes;
diff --git a/bin/tests/system/serve-stale/ns1/named3.conf.in b/bin/tests/system/serve-stale/ns1/named3.conf.in
index 846c60c4d2c..4f6f17573a7 100644
--- a/bin/tests/system/serve-stale/ns1/named3.conf.in
+++ b/bin/tests/system/serve-stale/ns1/named3.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	max-stale-ttl 20;
 	stale-answer-ttl 3;
 	stale-answer-enable yes;
diff --git a/bin/tests/system/serve-stale/ns1/named4.conf.in b/bin/tests/system/serve-stale/ns1/named4.conf.in
index 2c8f578e0ff..f2cc2a853c2 100644
--- a/bin/tests/system/serve-stale/ns1/named4.conf.in
+++ b/bin/tests/system/serve-stale/ns1/named4.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	max-stale-ttl 20;
 	stale-answer-ttl 3;
 	stale-answer-enable yes;
diff --git a/bin/tests/system/serve-stale/ns3/named1.conf.in b/bin/tests/system/serve-stale/ns3/named1.conf.in
index 9b6ebc78917..5c7dddd807d 100644
--- a/bin/tests/system/serve-stale/ns3/named1.conf.in
+++ b/bin/tests/system/serve-stale/ns3/named1.conf.in
@@ -31,6 +31,7 @@ options {
 	recursion yes;
 	dump-file "named_dump3.db";
 	stale-cache-enable yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/serve-stale/ns3/named8.conf.in b/bin/tests/system/serve-stale/ns3/named8.conf.in
index cfa60bdad3b..7b5792d12fc 100644
--- a/bin/tests/system/serve-stale/ns3/named8.conf.in
+++ b/bin/tests/system/serve-stale/ns3/named8.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	stale-answer-enable yes;
 	stale-cache-enable yes;
 	stale-answer-client-timeout 1800;
diff --git a/bin/tests/system/serve-stale/ns4/named.conf.in b/bin/tests/system/serve-stale/ns4/named.conf.in
index 85640d8331a..ac7dd997c17 100644
--- a/bin/tests/system/serve-stale/ns4/named.conf.in
+++ b/bin/tests/system/serve-stale/ns4/named.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	dump-file "named_dump.db";
 	stale-answer-enable no;
 	stale-cache-enable yes;
diff --git a/bin/tests/system/serve-stale/ns5/named.conf.in b/bin/tests/system/serve-stale/ns5/named.conf.in
index 74d2156da31..9874728cbe1 100644
--- a/bin/tests/system/serve-stale/ns5/named.conf.in
+++ b/bin/tests/system/serve-stale/ns5/named.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	dump-file "named_dump.db";
 	stale-answer-enable yes;
 	stale-cache-enable no;
diff --git a/bin/tests/system/serve-stale/tests.sh b/bin/tests/system/serve-stale/tests.sh
index 1ba7da8a750..47a63117ee3 100755
--- a/bin/tests/system/serve-stale/tests.sh
+++ b/bin/tests/system/serve-stale/tests.sh
@@ -116,8 +116,8 @@ rndc_dumpdb ns1 || ret=1
 awk '/; stale/ { x=$0; getline; print x, $0}' ns1/named_dump.db.test$n |
     grep "; stale data\.example.*3[56]...*TXT.*A text record with a 2 second ttl" > /dev/null 2>&1 || ret=1
 # Also make sure the not expired data does not have a stale comment.
-awk '/; answer/ { x=$0; getline; print x, $0}' ns1/named_dump.db.test$n |
-    grep "; answer longttl\.example.*[56]...*TXT.*A text record with a 600 second ttl" > /dev/null 2>&1 || ret=1
+awk '/; authanswer/ { x=$0; getline; print x, $0}' ns1/named_dump.db.test$n |
+    grep "; authanswer longttl\.example.*[56]...*TXT.*A text record with a 600 second ttl" > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1600,8 +1600,8 @@ awk '/; expired/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n |
 awk '/; expired/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n |
     grep "; expired since .* (awaiting cleanup) othertype\.example\." > /dev/null 2>&1 || ret=1
 # Also make sure the not expired data does not have an expired comment.
-awk '/; answer/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n |
-    grep "; answer longttl\.example.*A text record with a 600 second ttl" > /dev/null 2>&1 || ret=1
+awk '/; authanswer/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n |
+    grep "; authanswer longttl\.example.*A text record with a 600 second ttl" > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
diff --git a/bin/tests/system/sortlist/ns1/named.conf.in b/bin/tests/system/sortlist/ns1/named.conf.in
index 33081ffe963..1a0b3ad91fe 100644
--- a/bin/tests/system/sortlist/ns1/named.conf.in
+++ b/bin/tests/system/sortlist/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 
 	sortlist {
diff --git a/bin/tests/system/spf/ns1/named.conf.in b/bin/tests/system/spf/ns1/named.conf.in
index f828586df7f..d25251a7a96 100644
--- a/bin/tests/system/spf/ns1/named.conf.in
+++ b/bin/tests/system/spf/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	ixfr-from-differences yes;
 };
diff --git a/bin/tests/system/statistics/ns2/named2.conf.in b/bin/tests/system/statistics/ns2/named2.conf.in
index 1187e10b825..d370931d390 100644
--- a/bin/tests/system/statistics/ns2/named2.conf.in
+++ b/bin/tests/system/statistics/ns2/named2.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/statschannel/ns1/named.conf.in b/bin/tests/system/statschannel/ns1/named.conf.in
index 5781886e397..52fd9fd855e 100644
--- a/bin/tests/system/statschannel/ns1/named.conf.in
+++ b/bin/tests/system/statschannel/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify explicit;
 	minimal-responses no;
 	version none;  // make statistics independent of the version number
diff --git a/bin/tests/system/statschannel/ns2/named.conf.in b/bin/tests/system/statschannel/ns2/named.conf.in
index d1445edd322..0221f3d5962 100644
--- a/bin/tests/system/statschannel/ns2/named.conf.in
+++ b/bin/tests/system/statschannel/ns2/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 	minimal-responses no;
 	version none;  // make statistics independent of the version number
diff --git a/bin/tests/system/statschannel/ns2/named2.conf.in b/bin/tests/system/statschannel/ns2/named2.conf.in
index 65be7a63db9..0f5a2d3f2d8 100644
--- a/bin/tests/system/statschannel/ns2/named2.conf.in
+++ b/bin/tests/system/statschannel/ns2/named2.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 	minimal-responses no;
 	version none;  // make statistics independent of the version number
diff --git a/bin/tests/system/statschannel/ns3/named.conf.in b/bin/tests/system/statschannel/ns3/named.conf.in
index bfd5a8e467f..cf3fc0935b4 100644
--- a/bin/tests/system/statschannel/ns3/named.conf.in
+++ b/bin/tests/system/statschannel/ns3/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 	minimal-responses no;
 	version none;  // make statistics independent of the version number
diff --git a/bin/tests/system/stub/ns1/named.conf.in b/bin/tests/system/stub/ns1/named.conf.in
index 765cf696e8b..2bf1b40b110 100644
--- a/bin/tests/system/stub/ns1/named.conf.in
+++ b/bin/tests/system/stub/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	minimal-responses no;
 };
diff --git a/bin/tests/system/stub/ns2/named.conf.in b/bin/tests/system/stub/ns2/named.conf.in
index 29364822ba9..1f006e0b8f8 100644
--- a/bin/tests/system/stub/ns2/named.conf.in
+++ b/bin/tests/system/stub/ns2/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	minimal-responses no;
 };
diff --git a/bin/tests/system/stub/ns3/named.conf.in b/bin/tests/system/stub/ns3/named.conf.in
index 32368893e62..e8e432f3163 100644
--- a/bin/tests/system/stub/ns3/named.conf.in
+++ b/bin/tests/system/stub/ns3/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 	minimal-responses no;
 };
diff --git a/bin/tests/system/tcp/ns1/named.conf.in b/bin/tests/system/tcp/ns1/named.conf.in
index c042f6a301a..010e75449f9 100644
--- a/bin/tests/system/tcp/ns1/named.conf.in
+++ b/bin/tests/system/tcp/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	statistics-file "named.stats";
 };
diff --git a/bin/tests/system/tcp/ns2/named.conf.in b/bin/tests/system/tcp/ns2/named.conf.in
index 75f039af668..0a97093192f 100644
--- a/bin/tests/system/tcp/ns2/named.conf.in
+++ b/bin/tests/system/tcp/ns2/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 	statistics-file "named.stats";
 };
diff --git a/bin/tests/system/tcp/ns3/named.conf.in b/bin/tests/system/tcp/ns3/named.conf.in
index 7e2ba8b23d8..8516d721bba 100644
--- a/bin/tests/system/tcp/ns3/named.conf.in
+++ b/bin/tests/system/tcp/ns3/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/tcp/ns4/named.conf.in b/bin/tests/system/tcp/ns4/named.conf.in
index 3d4c770d073..a7758cc9e94 100644
--- a/bin/tests/system/tcp/ns4/named.conf.in
+++ b/bin/tests/system/tcp/ns4/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 	forwarders { 10.53.0.2; };
 	forward only;
diff --git a/bin/tests/system/tcp/ns7/named.conf.in b/bin/tests/system/tcp/ns7/named.conf.in
index 1103fce7209..b52891eab01 100644
--- a/bin/tests/system/tcp/ns7/named.conf.in
+++ b/bin/tests/system/tcp/ns7/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.7; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	statistics-file "named.stats";
 	tcp-clients 1;
diff --git a/bin/tests/system/timeouts/ns1/named.conf.in b/bin/tests/system/timeouts/ns1/named.conf.in
index 4b422e22b28..1c4654984a3 100644
--- a/bin/tests/system/timeouts/ns1/named.conf.in
+++ b/bin/tests/system/timeouts/ns1/named.conf.in
@@ -25,6 +25,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
+	dnssec-validation no;
 	recursion no;
 	notify no;
 	tcp-initial-timeout 20;
diff --git a/bin/tests/system/tsig/ns1/named-fips.conf.in b/bin/tests/system/tsig/ns1/named-fips.conf.in
index ab965689627..b783805aac5 100644
--- a/bin/tests/system/tsig/ns1/named-fips.conf.in
+++ b/bin/tests/system/tsig/ns1/named-fips.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify no;
 };
 
diff --git a/bin/tests/system/tsiggss/ns1/named.conf.in b/bin/tests/system/tsiggss/ns1/named.conf.in
index 1419b59fc80..7b34c3297f8 100644
--- a/bin/tests/system/tsiggss/ns1/named.conf.in
+++ b/bin/tests/system/tsiggss/ns1/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on { 10.53.0.1; 127.0.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	tkey-gssapi-keytab "dns.keytab";
 };
diff --git a/bin/tests/system/ttl/ns1/named.conf.in b/bin/tests/system/ttl/ns1/named.conf.in
index 0a2653fbc2c..51eee0cd336 100644
--- a/bin/tests/system/ttl/ns1/named.conf.in
+++ b/bin/tests/system/ttl/ns1/named.conf.in
@@ -29,6 +29,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	check-integrity no;
 };
 
diff --git a/bin/tests/system/unknown/ns1/named.conf.in b/bin/tests/system/unknown/ns1/named.conf.in
index a240cbeb770..a4b98db7afb 100644
--- a/bin/tests/system/unknown/ns1/named.conf.in
+++ b/bin/tests/system/unknown/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 };
 
diff --git a/bin/tests/system/unknown/ns2/named.conf.in b/bin/tests/system/unknown/ns2/named.conf.in
index 01361c7149b..af818365307 100644
--- a/bin/tests/system/unknown/ns2/named.conf.in
+++ b/bin/tests/system/unknown/ns2/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 };
 
diff --git a/bin/tests/system/unknown/ns3/named.conf.in b/bin/tests/system/unknown/ns3/named.conf.in
index 828d6677b89..ae20a688e46 100644
--- a/bin/tests/system/unknown/ns3/named.conf.in
+++ b/bin/tests/system/unknown/ns3/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 };
 
diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
index a2ae56448cf..721f4fe3407 100644
--- a/bin/tests/system/upforwd/ns1/named.conf.in
+++ b/bin/tests/system/upforwd/ns1/named.conf.in
@@ -27,6 +27,7 @@ options {
 	listen-on tls ephemeral { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/upforwd/ns2/named.conf.in b/bin/tests/system/upforwd/ns2/named.conf.in
index 34d6d520471..2322aa19846 100644
--- a/bin/tests/system/upforwd/ns2/named.conf.in
+++ b/bin/tests/system/upforwd/ns2/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/upforwd/ns3/named1.conf.in b/bin/tests/system/upforwd/ns3/named1.conf.in
index 624fdcef997..b1e42f71cd1 100644
--- a/bin/tests/system/upforwd/ns3/named1.conf.in
+++ b/bin/tests/system/upforwd/ns3/named1.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on tls ephemeral { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	include "dnstap.conf";
 };
diff --git a/bin/tests/system/upforwd/ns3/named2.conf.in b/bin/tests/system/upforwd/ns3/named2.conf.in
index 9d5df0f0291..1fe3e0488a0 100644
--- a/bin/tests/system/upforwd/ns3/named2.conf.in
+++ b/bin/tests/system/upforwd/ns3/named2.conf.in
@@ -22,6 +22,7 @@ options {
 	listen-on tls ephemeral { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	update-quota 1;
 };
diff --git a/bin/tests/system/views/ns1/named.conf.in b/bin/tests/system/views/ns1/named.conf.in
index eb079c95ab8..888b9b0ec39 100644
--- a/bin/tests/system/views/ns1/named.conf.in
+++ b/bin/tests/system/views/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/views/ns2/named1.conf.in b/bin/tests/system/views/ns2/named1.conf.in
index 54c7fe56931..4a257c049eb 100644
--- a/bin/tests/system/views/ns2/named1.conf.in
+++ b/bin/tests/system/views/ns2/named1.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/views/ns2/named2.conf.in b/bin/tests/system/views/ns2/named2.conf.in
index 937e5b06361..8a4d77385e3 100644
--- a/bin/tests/system/views/ns2/named2.conf.in
+++ b/bin/tests/system/views/ns2/named2.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/views/ns2/named3.conf.in b/bin/tests/system/views/ns2/named3.conf.in
index 758e2aab9bd..d84cda96921 100644
--- a/bin/tests/system/views/ns2/named3.conf.in
+++ b/bin/tests/system/views/ns2/named3.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 };
 
diff --git a/bin/tests/system/views/ns3/named1.conf.in b/bin/tests/system/views/ns3/named1.conf.in
index a03551ef51f..b4fbf417cd7 100644
--- a/bin/tests/system/views/ns3/named1.conf.in
+++ b/bin/tests/system/views/ns3/named1.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/views/ns3/named2.conf.in b/bin/tests/system/views/ns3/named2.conf.in
index 6aac6892f9d..0ef20097327 100644
--- a/bin/tests/system/views/ns3/named2.conf.in
+++ b/bin/tests/system/views/ns3/named2.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/views/ns5/named.conf.in b/bin/tests/system/views/ns5/named.conf.in
index d1f294cd4f2..4c4ee4e2713 100644
--- a/bin/tests/system/views/ns5/named.conf.in
+++ b/bin/tests/system/views/ns5/named.conf.in
@@ -21,6 +21,7 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/xfer/ns1/named1.conf.in b/bin/tests/system/xfer/ns1/named1.conf.in
index 6777f5bb8d7..10d670f53e9 100644
--- a/bin/tests/system/xfer/ns1/named1.conf.in
+++ b/bin/tests/system/xfer/ns1/named1.conf.in
@@ -26,6 +26,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/xfer/ns1/named2.conf.in b/bin/tests/system/xfer/ns1/named2.conf.in
index 434743d1017..b349c33934a 100644
--- a/bin/tests/system/xfer/ns1/named2.conf.in
+++ b/bin/tests/system/xfer/ns1/named2.conf.in
@@ -26,6 +26,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/xfer/ns1/named3.conf.in b/bin/tests/system/xfer/ns1/named3.conf.in
index 4f6344c6971..05af9614cb2 100644
--- a/bin/tests/system/xfer/ns1/named3.conf.in
+++ b/bin/tests/system/xfer/ns1/named3.conf.in
@@ -26,6 +26,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/xfer/ns2/named.conf.in b/bin/tests/system/xfer/ns2/named.conf.in
index 7b95f5a6210..3fa20a3d9a9 100644
--- a/bin/tests/system/xfer/ns2/named.conf.in
+++ b/bin/tests/system/xfer/ns2/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
diff --git a/bin/tests/system/xfer/ns3/named.conf.in b/bin/tests/system/xfer/ns3/named.conf.in
index 426c008f10c..6b25c3c61b8 100644
--- a/bin/tests/system/xfer/ns3/named.conf.in
+++ b/bin/tests/system/xfer/ns3/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/xfer/ns6/named.conf.in b/bin/tests/system/xfer/ns6/named.conf.in
index d5b87108964..87397b0619f 100644
--- a/bin/tests/system/xfer/ns6/named.conf.in
+++ b/bin/tests/system/xfer/ns6/named.conf.in
@@ -26,6 +26,7 @@ options {
 	listen-on { 10.53.0.6; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	ixfr-from-differences primary;
 	check-integrity no;
diff --git a/bin/tests/system/xfer/ns7/named.conf.in b/bin/tests/system/xfer/ns7/named.conf.in
index 9bd92b3fd4c..47a9b057677 100644
--- a/bin/tests/system/xfer/ns7/named.conf.in
+++ b/bin/tests/system/xfer/ns7/named.conf.in
@@ -26,6 +26,7 @@ options {
 	listen-on { 10.53.0.7; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	ixfr-from-differences secondary;
 	check-integrity no;
diff --git a/bin/tests/system/xfer/ns8/named.conf.in b/bin/tests/system/xfer/ns8/named.conf.in
index 6acd054196d..17fee1f1255 100644
--- a/bin/tests/system/xfer/ns8/named.conf.in
+++ b/bin/tests/system/xfer/ns8/named.conf.in
@@ -26,6 +26,7 @@ options {
 	listen-on { 10.53.0.8; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 	transfer-message-size 1024;
 };
diff --git a/bin/tests/system/xferquota/ns1/named.conf.in b/bin/tests/system/xferquota/ns1/named.conf.in
index 0d1933f52c3..e868318ae6b 100644
--- a/bin/tests/system/xferquota/ns1/named.conf.in
+++ b/bin/tests/system/xferquota/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/xferquota/ns2/named.conf.in b/bin/tests/system/xferquota/ns2/named.conf.in
index ef55dc6bd7a..f21938e0351 100644
--- a/bin/tests/system/xferquota/ns2/named.conf.in
+++ b/bin/tests/system/xferquota/ns2/named.conf.in
@@ -20,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 
 	transfers-in 5;