Disable DNSSEC validation instead of enabling it with empty TAs in tests

There are many system tests where we set `dnssec-validation yes;` only
to also set `trust-anchors { };` which effectively disables the
validation.

This commit replaces this convoluted setup with just
`dnssec-validation no;`.

bin/tests/system/additional/ns3/named.conf.in

@@ -22,11 +22,10 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	minimal-responses no;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/cacheclean/ns2/named.conf.j2

@@ -22,10 +22,9 @@ options {
 	notify yes;
 	disable-empty-zone 127.IN-ADDR.ARPA;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/chain/ns1/named.conf.in

@@ -20,10 +20,9 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 };
 
-trust-anchors { };
 
 zone "." { type primary; file "root.db"; };

bin/tests/system/chain/ns7/named.conf.in

@@ -22,7 +22,7 @@ options {
 	listen-on-v6 { fd92:7065:b8e:ffff::7; };
 	recursion yes;
 	allow-recursion { any; };
-	dnssec-validation yes;
+	dnssec-validation no;
 	deny-answer-aliases {
 		"example";
 	} except-from {
@@ -31,7 +31,6 @@ options {
 	qname-minimization disabled;  // Regression test for GL #4652
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/checknames/ns2/named.conf.j2

@@ -20,12 +20,11 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	check-names response warn;
 	notify yes;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/checknames/ns3/named.conf.j2

@@ -20,12 +20,11 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	check-names response fail;
 	notify yes;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/checknames/ns4/named.conf.j2

@@ -21,13 +21,12 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	check-names primary ignore;
 	check-names secondary ignore;
 	notify yes;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/checknames/ns5/named.conf.j2

@@ -21,13 +21,12 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	check-names master ignore;
 	check-names slave ignore;
 	notify yes;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/cipher-suites/ns1/named.conf.in

@@ -63,13 +63,12 @@ options {
 	notify explicit;
 	also-notify { 10.53.0.2 port @PORT@; };
 	statistics-file "named.stats";
-	dnssec-validation yes;
+	dnssec-validation no;
 	tcp-initial-timeout 1200;
 	transfers-in 100;
 	transfers-out 100;
 };
 
-trust-anchors { };
 
 zone "." {
 	type primary;

bin/tests/system/cipher-suites/ns2/named.conf.in

@@ -36,10 +36,9 @@ options {
 	notify no;
 	ixfr-from-differences yes;
 	check-integrity no;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/cipher-suites/ns3/named.conf.in

@@ -36,10 +36,9 @@ options {
 	notify no;
 	ixfr-from-differences yes;
 	check-integrity no;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/cipher-suites/ns4/named.conf.in

@@ -36,10 +36,9 @@ options {
 	notify no;
 	ixfr-from-differences yes;
 	check-integrity no;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/cipher-suites/ns5/named.conf.in

@@ -36,10 +36,9 @@ options {
 	notify no;
 	ixfr-from-differences yes;
 	check-integrity no;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/cookie/ns1/named.conf.j2

@@ -38,7 +38,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
 		 except-from { "example.org"; };
 	deny-answer-aliases { "example.org"; }
@@ -49,7 +49,6 @@ options {
 	nocookie-udp-size 512;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/cookie/ns3/named.conf.j2

@@ -29,7 +29,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
 		 except-from { "example.org"; };
 	deny-answer-aliases { "example.org"; }
@@ -41,7 +41,6 @@ options {
 	require-server-cookie yes;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/cookie/ns4/named.conf.j2

@@ -29,13 +29,12 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	cookie-algorithm siphash24;
 	cookie-secret "569d36a6cc27d6bf55502183302ba352";
 	require-server-cookie yes;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/cookie/ns5/named.conf.j2

@@ -29,14 +29,13 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	cookie-algorithm siphash24;
 	cookie-secret "569d36a6cc27d6bf55502183302ba352";
 	cookie-secret "6b300e27a0db46d4b046e4189790fa7d";
 	require-server-cookie yes;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/cookie/ns6/named.conf.j2

@@ -29,13 +29,12 @@ options {
 	listen-on { 10.53.0.6; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	cookie-algorithm siphash24;
 	cookie-secret "6b300e27a0db46d4b046e4189790fa7d";
 	require-server-cookie yes;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/cookie/ns8/named.conf.j2

@@ -28,12 +28,11 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.8; };
 	listen-on-v6 { none; };
-	dnssec-validation yes;
+	dnssec-validation no;
 	rate-limit {};
 	require-server-cookie yes;
 };
 
-trust-anchors { };
 
 server 10.53.0.7 { require-cookie yes; };
 

bin/tests/system/database/ns1/named.conf.j2

@@ -32,10 +32,9 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 zone "database" {
 	type primary;

bin/tests/system/dns64/ns1/named.conf1.in

@@ -31,7 +31,7 @@ options {
 	listen-on-v6 { none; };
 	allow-recursion { 10.53.0.1; };
 	notify yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 
 	dns64 2001:bbbb::/96 {
 		clients { any; };
@@ -42,8 +42,6 @@ options {
 	};
 };
 
-trust-anchors { };
-
 zone "." {
 	type primary;
 	file "root.db";

bin/tests/system/dns64/ns1/named.conf2.in

@@ -31,7 +31,7 @@ options {
 	listen-on-v6 { none; };
 	allow-recursion { 10.53.0.1; };
 	notify yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 
 	dns64 2001:bbbb::/96 {
 		clients { any; };
@@ -45,8 +45,6 @@ options {
 	};
 };
 
-trust-anchors { };
-
 zone "." {
 	type primary;
 	file "root.db";

bin/tests/system/dns64/ns1/named.conf3.in

@@ -31,11 +31,9 @@ options {
 	listen-on-v6 { none; };
 	allow-recursion { 10.53.0.1; };
 	notify yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
-
 zone "." {
 	type primary;
 	file "root.db";

bin/tests/system/dns64/ns2/named.conf.in

@@ -25,7 +25,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 
 	dns64 2001:aaaa::/96 {
 		clients { 10.53.0.2; };
@@ -60,7 +60,6 @@ options {
 	response-policy { zone "rpz"; };
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/dns64/ns3/named.conf.in

@@ -29,7 +29,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { fd92:7065:b8e:ffff::3; };
 	notify yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	allow-recursion { any; };
 	resolver-use-dns64 yes;
 
@@ -40,7 +40,6 @@ options {
 	};
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/dns64/ns4/named.conf.in

@@ -26,11 +26,10 @@ options {
 	listen-on port @PORT@ { 10.53.0.4; };	// for start.pl
 	listen-on-v6 { fd92:7065:b8e:fffe::10.53.0.4; };
 	notify yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	recursion no;
 };
 
-trust-anchors { };
 
 zone "." {
 	type master;

bin/tests/system/dnstap/ns1/named.conf.j2

@@ -28,11 +28,10 @@ options {
 	dnstap { all; };
 	send-cookie no;
 	require-server-cookie no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	qname-minimization disabled;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/dnstap/ns2/named.conf.j2

@@ -28,11 +28,10 @@ options {
 	dnstap { all; };
 	send-cookie no;
 	require-server-cookie no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	qname-minimization disabled;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/dnstap/ns3/named.conf.j2

@@ -29,11 +29,10 @@ options {
 	send-cookie no;
 	require-server-cookie no;
 	minimal-responses no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	qname-minimization disabled;
 };
 
-trust-anchors { };
 
 server 10.53.0.1 { tcp-only yes; };
 

bin/tests/system/dnstap/ns4/named.conf.j2

@@ -28,11 +28,10 @@ options {
 	dnstap { all; };
 	send-cookie no;
 	require-server-cookie no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	qname-minimization disabled;
 };
 
-trust-anchors { };
 
 server 10.53.0.1 { tcp-only yes; };
 

bin/tests/system/doth/ns1/named.conf.in

@@ -94,14 +94,13 @@ options {
 	notify explicit;
 	also-notify { 10.53.0.2 port @PORT@; };
 	statistics-file "named.stats";
-	dnssec-validation yes;
+	dnssec-validation no;
 	tcp-initial-timeout 1200;
 	transfers-in 100;
 	transfers-out 100;
 	max-records-per-type 0;
 };
 
-trust-anchors { };
 
 zone "." {
 	type primary;

bin/tests/system/doth/ns2/named.conf.in

@@ -51,13 +51,12 @@ options {
 	notify no;
 	ixfr-from-differences yes;
 	check-integrity no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	max-records-per-type 0;
 	transfers-in 100;
 	transfers-out 100;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/doth/ns3/named.conf.in

@@ -43,11 +43,10 @@ options {
 	notify no;
 	ixfr-from-differences yes;
 	check-integrity no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	max-records-per-type 0;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/doth/ns4/named.conf.in

@@ -51,11 +51,10 @@ options {
 	notify no;
 	ixfr-from-differences yes;
 	check-integrity no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	max-records-per-type 0;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/doth/ns5/named.conf.in

@@ -39,11 +39,10 @@ options {
 	notify no;
 	ixfr-from-differences yes;
 	check-integrity no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	max-records-per-type 0;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/fetchlimit/ns3/named1.conf.in

@@ -23,12 +23,11 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 	fetches-per-server 400;
 };
 
-trust-anchors { };
 
 server 10.53.0.4 {
 	edns no;

bin/tests/system/fetchlimit/ns3/named2.conf.in

@@ -21,12 +21,11 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 	fetches-per-zone 40;
 };
 
-trust-anchors { };
 
 server 10.53.0.4 {
 	edns no;

bin/tests/system/fetchlimit/ns3/named3.conf.in

@@ -21,12 +21,11 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 	recursive-clients 400;
 };
 
-trust-anchors { };
 
 server 10.53.0.4 {
 	edns no;

bin/tests/system/fetchlimit/ns5/named1.conf.in

@@ -21,13 +21,12 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 	clients-per-query 5;
 	max-clients-per-query 10;
 };
 
-trust-anchors { };
 
 server 10.53.0.4 {
 	edns no;

bin/tests/system/fetchlimit/ns5/named2.conf.in

@@ -21,7 +21,7 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 	stale-answer-enable yes;
 	stale-cache-enable yes;
@@ -30,7 +30,6 @@ options {
 	max-clients-per-query 10;
 };
 
-trust-anchors { };
 
 server 10.53.0.4 {
 	edns no;

bin/tests/system/fetchlimit/ns5/named3.conf.in

@@ -21,7 +21,7 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 	stale-answer-enable yes;
 	stale-cache-enable yes;
@@ -31,7 +31,6 @@ options {
 	max-clients-per-query 5;
 };
 
-trust-anchors { };
 
 server 10.53.0.4 {
 	edns no;

bin/tests/system/filter-aaaa/ns1/named1.conf.in

@@ -20,12 +20,11 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { fd92:7065:b8e:ffff::1; };
 	recursion no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 	minimal-responses no;
 };
 
-trust-anchors { };
 
 acl filterees { 10.53.0.1; };
 

bin/tests/system/filter-aaaa/ns1/named2.conf.in

@@ -20,12 +20,11 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { fd92:7065:b8e:ffff::1; };
 	recursion no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 	minimal-responses no;
 };
 
-trust-anchors { };
 
 plugin query "@TOP_BUILDDIR@/filter-aaaa.so" {
 	filter-aaaa-on-v6 yes;

bin/tests/system/forward/ns3/named1.conf.in

@@ -24,10 +24,9 @@ options {
 	listen-on-v6 { fd92:7065:b8e:ffff::3; };
 	forwarders { fd92:7065:b8e:ffff::2; };
 	forward first;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/forward/ns4/named.conf.in

@@ -23,11 +23,10 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	minimal-responses yes;
 };
 
-trust-anchors { };
 
 statistics-channels { inet 10.53.0.4 port @EXTRAPORT1@ allow { localhost; }; };
 

bin/tests/system/forward/ns5/named.conf.in

@@ -22,10 +22,9 @@ options {
 	forward only;
 	forwarders { 10.53.0.4; };
 	deny-answer-aliases { "rebind"; };
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/forward/ns7/named.conf.in

@@ -21,10 +21,9 @@ options {
 	listen-on-v6 { none; };
 	forwarders { 10.53.0.4; };
 	forward first;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/forward/ns8/named.conf.in

@@ -21,10 +21,9 @@ options {
 	listen-on-v6 { none; };
 	forwarders { 10.53.0.2; };	// returns referrals
 	forward first;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/hooks/ns1/named.conf.j2

@@ -19,12 +19,11 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	recursion no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 	minimal-responses no;
 };
 
-trust-anchors { };
 
 plugin query "@TOP_BUILDDIR@/testlib-driver-async.so";
 

bin/tests/system/legacy/ns1/named1.conf.in

@@ -20,10 +20,9 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/masterfile/ns2/named.conf.j2

@@ -24,10 +24,9 @@ options {
 	allow-transfer { any; };
 	recursion no;
 	notify yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/mkeys/ns1/named1.conf.in

@@ -28,11 +28,10 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	allow-query { allowed; };
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/mkeys/ns1/named2.conf.in

@@ -28,11 +28,10 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify no;
-	dnssec-validation yes;
+	dnssec-validation no;
 	allow-query { allowed; };
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/mkeys/ns1/named3.conf.in

@@ -23,10 +23,9 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify no;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/nsupdate/ns3/named.conf.in

@@ -23,10 +23,9 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/pipelined/ns2/named.conf.j2

@@ -20,11 +20,10 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/pipelined/ns3/named.conf.j2

@@ -20,11 +20,10 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/pipelined/ns4/named.conf.j2

@@ -21,11 +21,10 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/proxy/ns1/named.conf.in

@@ -50,11 +50,10 @@ options {
 	recursion no;
 	notify explicit;
 	statistics-file "named.stats";
-	dnssec-validation yes;
+	dnssec-validation no;
 	tcp-initial-timeout 1200;
 };
 
-trust-anchors { };
 
 zone "example0" {
 	type primary;

bin/tests/system/proxy/ns3/named.conf.in

@@ -45,11 +45,10 @@ options {
 	recursion no;
 	notify explicit;
 	statistics-file "named.stats";
-	dnssec-validation yes;
+	dnssec-validation no;
 	tcp-initial-timeout 1200;
 };
 
-trust-anchors { };
 
 zone "example" {
 	type primary;

bin/tests/system/reclimit/ns3/named1.conf.in

@@ -25,10 +25,9 @@ options {
 	max-recursion-queries 50;
 	max-recursion-depth 12;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/reclimit/ns3/named2.conf.in

@@ -24,10 +24,9 @@ options {
 	qname-minimization disabled;
 	max-recursion-depth 5;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/reclimit/ns3/named3.conf.in

@@ -25,10 +25,9 @@ options {
 	max-recursion-depth 100;
 	max-recursion-queries 50;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/reclimit/ns3/named4.conf.in

@@ -25,10 +25,9 @@ options {
 	max-recursion-depth 100;
 	max-recursion-queries 40;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/reclimit/ns3/named5.conf.in

@@ -24,12 +24,11 @@ options {
 	qname-minimization disabled;
 	max-recursion-depth 12;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	max-records-per-type 0;
 	max-types-per-name 10;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/reclimit/ns3/named6.conf.in

@@ -24,12 +24,11 @@ options {
 	qname-minimization disabled;
 	max-recursion-depth 12;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	max-records-per-type 0;
 	max-types-per-name 0;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/redirect/ns1/named.conf.in

@@ -25,10 +25,9 @@ options {
 	listen-on-v6 { none; };
 	allow-recursion { 10.53.0.1; };
 	notify yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 zone "." {
 	type primary;

bin/tests/system/redirect/ns2/named.conf.in

@@ -27,11 +27,10 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/redirect/ns3/named.conf.in

@@ -23,10 +23,9 @@ options {
 	listen-on-v6 { none; };
 	allow-recursion { 10.53.0.3; };
 	notify yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 zone "." {
 	type primary;

bin/tests/system/redirect/ns4/named.conf.in

@@ -27,11 +27,10 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	nxdomain-redirect "redirect";
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/resolver/ns1/named.conf.in

@@ -20,7 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
 		 except-from { "example.org"; };
 	deny-answer-aliases { "example.org"; }
@@ -34,7 +34,6 @@ options {
 	request-zoneversion yes;
 };
 
-trust-anchors { };
 
 server 10.53.0.3 {
 	tcp-only yes;

bin/tests/system/resolver/ns7/named1.conf.in

@@ -22,7 +22,7 @@ options {
 	listen-on { 10.53.0.7; };
 	listen-on-v6 { fd92:7065:b8e:ffff::7; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	empty-zones-enable yes;
 	disable-empty-zone 20.172.in-addr.arpa;
 	/*
@@ -34,7 +34,6 @@ options {
 	edns-udp-size 4096;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/resolver/ns7/named2.conf.in

@@ -22,7 +22,7 @@ options {
 	listen-on { 10.53.0.7; };
 	listen-on-v6 { fd92:7065:b8e:ffff::7; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	empty-zones-enable yes;
 	disable-empty-zone 20.172.in-addr.arpa;
 	/*
@@ -34,7 +34,6 @@ options {
 	edns-udp-size 4096;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/resolver/ns9/named.conf.in

@@ -20,12 +20,11 @@ options {
 	listen-on-v6 { fd92:7065:b8e:ffff::9; };
 	recursion yes;
 	recursive-clients 0; // regression test for [GL #4987]
-	dnssec-validation yes;
+	dnssec-validation no;
 	dual-stack-servers { fd92:7065:b8e:ffff::7; };
 	qname-minimization off;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/rndc/ns4/named.conf.in

@@ -17,10 +17,9 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 view normal {
 	match-clients { any; };

bin/tests/system/rpz/ns3/named.conf.in

@@ -29,7 +29,7 @@ options {
 	notify yes;
 	minimal-responses no;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	min-refresh-time 1;
 	min-retry-time 1;
 
@@ -64,7 +64,6 @@ options {
 	notify-delay 0;
 };
 
-trust-anchors { };
 
 logging { category rpz { default_debug; }; };
 

bin/tests/system/rpz/ns8/named.conf.in

@@ -29,7 +29,7 @@ options {
 	notify yes;
 	minimal-responses no;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 
 	response-policy {
 	    zone "manual-update-rpz";
@@ -46,7 +46,6 @@ options {
 	notify-delay 0;
 };
 
-trust-anchors { };
 
 logging { category rpz { default_debug; }; };
 

bin/tests/system/rpz/ns9/named.conf.in

@@ -29,7 +29,7 @@ options {
 	notify yes;
 	minimal-responses no;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	dns64-server "example.localdomain.";
 	dns64 64:ff9b::/96 { };
 	response-policy {
@@ -40,7 +40,6 @@ options {
 	notify-delay 0;
 };
 
-trust-anchors { };
 
 logging { category rpz { default_debug; }; };
 

bin/tests/system/rpzrecurse/ns2/named.clientip.conf

@@ -33,5 +33,4 @@ view "recursive" {
     zone "clientip2" { type primary; file "db.clientip2"; };
 
     recursion yes;
-    dnssec-validation yes;
 };

bin/tests/system/rpzrecurse/ns2/named.clientip2.conf

@@ -33,5 +33,4 @@ view "recursive" {
     zone "clientip21" { type primary; file "db.clientip21"; };
 
     recursion yes;
-    dnssec-validation yes;
 };

bin/tests/system/rpzrecurse/ns2/named.conf.header.in

@@ -23,11 +23,10 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	querylog yes;
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/rpzrecurse/ns2/named.default.conf

@@ -21,5 +21,4 @@ view "recursive" {
     };
 
     recursion yes;
-    dnssec-validation yes;
 };

bin/tests/system/rpzrecurse/ns2/named.log.conf

@@ -35,5 +35,4 @@ view "recursive" {
     zone "log3" { type primary; file "db.log3"; };
 
     recursion yes;
-    dnssec-validation yes;
 };

bin/tests/system/rpzrecurse/ns2/named.max.conf

@@ -157,5 +157,4 @@ view "recursive" {
     zone "max64" { type primary; file "db.max64.local"; };
 
     recursion yes;
-    dnssec-validation yes;
 };

bin/tests/system/rpzrecurse/ns2/named.wildcard1.conf

@@ -31,5 +31,4 @@ view "recursive" {
     zone "wildcard1" { type primary; file "db.wildcard1"; };
 
     recursion yes;
-    dnssec-validation yes;
 };

bin/tests/system/rpzrecurse/ns2/named.wildcard2.conf

@@ -33,5 +33,4 @@ view "recursive" {
     zone "wildcard2b" { type primary; file "db.wildcard2b"; };
 
     recursion yes;
-    dnssec-validation yes;
 };

bin/tests/system/rpzrecurse/ns2/named.wildcard3.conf

@@ -31,5 +31,4 @@ view "recursive" {
     zone "wildcard3" { type primary; file "db.wildcard3"; };
 
     recursion yes;
-    dnssec-validation yes;
 };

bin/tests/system/rpzrecurse/ns2/named.wildcard4.conf

@@ -33,5 +33,4 @@ view "recursive" {
 	};
 
 	recursion yes;
-	dnssec-validation yes;
 };

bin/tests/system/rpzrecurse/ns3/named1.conf.in

@@ -27,14 +27,13 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	response-policy { zone "policy"; }
 		qname-wait-recurse yes
 		nsip-enable yes
 		nsdname-enable yes;
 };
 
-trust-anchors { };
 
 zone "policy" { type primary; file "policy.db"; };
 

bin/tests/system/rpzrecurse/ns3/named2.conf.in

@@ -26,14 +26,13 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	response-policy { zone "policy"; } nsip-wait-recurse no
 		qname-wait-recurse yes
 		nsip-enable yes
 		nsdname-enable yes;
 };
 
-trust-anchors { };
 
 zone "policy" { type primary; file "policy.db"; };
 

bin/tests/system/rpzrecurse/ns3/named3.conf.in

@@ -26,12 +26,11 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	response-policy { zone "policy"; } nsdname-wait-recurse no
 		nsdname-enable yes;
 };
 
-trust-anchors { };
 
 zone "policy" { type primary; file "policy.db"; };
 

bin/tests/system/rrl/ns1/named.conf.j2

@@ -22,9 +22,8 @@ options {
 	listen-on-v6 { none; };
 	notify no;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 };
 
-trust-anchors { };
 
 zone "." {type primary; file "root.db";};

bin/tests/system/rrl/ns2/named.conf.j2

@@ -23,7 +23,7 @@ options {
 	listen-on-v6 { none; };
 	notify no;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 
 	rate-limit {
 	    responses-per-second 2;
@@ -36,7 +36,6 @@ options {
 	};
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/rrl/ns3/named.conf.j2

@@ -22,7 +22,7 @@ options {
 	listen-on-v6 { none; };
 	notify no;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 
 	// check that all of the options are parsed without limiting anything
 	rate-limit {
@@ -43,7 +43,6 @@ options {
 
 };
 
-trust-anchors { };
 
 zone "." { type hint; file "hints"; };
 

bin/tests/system/rrl/ns4/named.conf.j2

@@ -23,7 +23,7 @@ options {
 	listen-on-v6 { none; };
 	notify no;
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	max-udp-size 4096;
 
 	rate-limit {
@@ -38,7 +38,6 @@ options {
 	};
 };
 
-trust-anchors { };
 
 key rndc_key {
 	secret "1234abcd8765";

bin/tests/system/rrsetorder/ns3/named.conf.j2

@@ -20,7 +20,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 	rrset-order {
 		name "random.example" order random;
@@ -31,7 +31,6 @@ options {
 	};
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/rrsetorder/ns4/named.conf.j2

@@ -20,7 +20,7 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 	rrset-order {
 		class IN type A name "host.example.com" order random;
@@ -28,7 +28,6 @@ options {
 
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/rrsetorder/ns5/named.conf.j2

@@ -20,11 +20,10 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 };
 
-trust-anchors { };
 
 zone "." {
 	type hint;

bin/tests/system/statistics/ns2/named.conf.in

@@ -20,11 +20,10 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 };
 
-trust-anchors { };
 
 include "statistics-channels.conf";
 

bin/tests/system/statistics/ns3/named.conf.in

@@ -21,13 +21,12 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 	notify yes;
 	qname-minimization disabled;
 	zone-statistics yes;
 };
 
-trust-anchors { };
 
 include "statistics-channels.conf";