diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
index 9977552ef3..3d309d93f1 100755
--- a/bin/tests/system/nsupdate/tests.sh
+++ b/bin/tests/system/nsupdate/tests.sh
@@ -330,7 +330,7 @@ $NSUPDATE -k ns1/ddns.key <<END >nsupdate.out 2>&1 || ret=1
     prereq nxrrset example.nil. type0
     send
 END
-$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n
+$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n || ret=1
 grep "status: NOERROR" dig.out.ns1.$n >/dev/null || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -342,7 +342,7 @@ ret=0
 echo_i "check that TYPE=0 update is handled ($n)"
 echo "a0e4280000010000000100000000060001c00c000000fe000000000000" \
   | $PERL ../packet.pl -a 10.53.0.1 -p ${PORT} -t tcp >/dev/null || ret=1
-$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n
+$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n || ret=1
 grep "status: NOERROR" dig.out.ns1.$n >/dev/null || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -354,7 +354,7 @@ ret=0
 echo_i "check that TYPE=0 additional data is handled ($n)"
 echo "a0e4280000010000000000010000060001c00c000000fe000000000000" \
   | $PERL ../packet.pl -a 10.53.0.1 -p ${PORT} -t tcp >/dev/null || ret=1
-$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n
+$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n || ret=1
 grep "status: NOERROR" dig.out.ns1.$n >/dev/null || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -366,7 +366,7 @@ ret=0
 echo_i "check that update to undefined class is handled ($n)"
 echo "a0e4280000010001000000000000060101c00c000000fe000000000000" \
   | $PERL ../packet.pl -a 10.53.0.1 -p ${PORT} -t tcp >/dev/null || ret=1
-$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n
+$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n || ret=1
 grep "status: NOERROR" dig.out.ns1.$n >/dev/null || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -827,7 +827,7 @@ zone denyname.example
 update add foo.denyname.example 3600 IN TXT added
 send
 EOF
-$DIG $DIGOPTS +tcp @10.53.0.9 foo.denyname.example TXT >dig.out.ns9.test$n
+$DIG $DIGOPTS +tcp @10.53.0.9 foo.denyname.example TXT >dig.out.ns9.test$n || ret=1
 grep "added" dig.out.ns9.test$n >/dev/null || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -844,7 +844,7 @@ zone denyname.example
 update add denyname.example 3600 IN TXT added
 send
 EOF
-$DIG $DIGOPTS +tcp @10.53.0.9 denyname.example TXT >dig.out.ns9.test$n
+$DIG $DIGOPTS +tcp @10.53.0.9 denyname.example TXT >dig.out.ns9.test$n || ret=1
 grep "added" dig.out.ns9.test$n >/dev/null && ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -858,11 +858,11 @@ $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd dnskey.test. \
   @10.53.0.3 dnskey \
   | awk -v port="${PORT}" 'BEGIN { print "server 10.53.0.3", port; }
 	$2 == 10 && $3 == "IN" && $4 == "DNSKEY" { $2 = 600; print "update add", $0 }
-	END { print "send" }' >update.in.$n
+	END { print "send" }' >update.in.$n || ret=1
 $NSUPDATE update.in.$n
 
 $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd dnskey.test. \
-  @10.53.0.3 any >dig.out.ns3.$n
+  @10.53.0.3 any >dig.out.ns3.$n || ret=1
 
 grep "600.*DNSKEY" dig.out.ns3.$n >/dev/null || ret=1
 grep TYPE65534 dig.out.ns3.$n >/dev/null && ret=1
@@ -1279,7 +1279,7 @@ n=$((n + 1))
 ret=0
 echo_i "add a record which is truncated when logged. ($n)"
 $NSUPDATE verylarge || ret=1
-$DIG $DIGOPTS +tcp @10.53.0.1 txt txt.update.nil >dig.out.ns1.test$n
+$DIG $DIGOPTS +tcp @10.53.0.1 txt txt.update.nil >dig.out.ns1.test$n || ret=1
 grep "ANSWER: 1," dig.out.ns1.test$n >/dev/null || ret=1
 grep "adding an RR at 'txt.update.nil' TXT .* \[TRUNCATED\]" ns1/named.run >/dev/null || ret=1
 if [ $ret -ne 0 ]; then
@@ -1453,7 +1453,7 @@ update add child.delegation.test. 3600 NS foo.example.net.
 update add child.delegation.test. 3600 NS bar.example.net.
 send
 EOF
-$DIG $DIGOPTS +tcp @10.53.0.3 ns child.delegation.test >dig.out.ns1.test$n
+$DIG $DIGOPTS +tcp @10.53.0.3 ns child.delegation.test >dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n >/dev/null 2>&1 || ret=1
 grep "AUTHORITY: 2" dig.out.ns1.test$n >/dev/null 2>&1 || ret=1
 [ $ret = 0 ] || {
@@ -1471,7 +1471,7 @@ update del child.delegation.test. 3600 NS foo.example.net.
 update del child.delegation.test. 3600 NS bar.example.net.
 send
 EOF
-$DIG $DIGOPTS +tcp @10.53.0.3 ns child.delegation.test >dig.out.ns1.test$n
+$DIG $DIGOPTS +tcp @10.53.0.3 ns child.delegation.test >dig.out.ns1.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns1.test$n >/dev/null 2>&1 || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -1488,7 +1488,7 @@ update add r1.too-big.test 3600 IN TXT r1.too-big.test
 send
 EOF
 grep "update failed: SERVFAIL" nsupdate.out.test$n >/dev/null || ret=1
-$DIG $DIGOPTS +tcp @10.53.0.3 r1.too-big.test TXT >dig.out.ns3.test$n
+$DIG $DIGOPTS +tcp @10.53.0.3 r1.too-big.test TXT >dig.out.ns3.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns3.test$n >/dev/null || ret=1
 grep "records in zone (4) exceeds max-records (3)" ns3/named.run >/dev/null || ret=1
 [ $ret = 0 ] || {
@@ -1743,7 +1743,7 @@ send
 END
 $DIG $DIGOPTS @10.53.0.6 \
   +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
-  -x 10.53.0.5 >dig.out.ns6.$n
+  -x 10.53.0.5 >dig.out.ns6.$n || ret=1
 # the policy is 'grant * tcp-self . PTR(1) ANY(2) A;' so only the
 # first PTR record should be added.
 grep localhost. dig.out.ns6.$n >/dev/null 2>&1 || ret=1
@@ -1773,7 +1773,7 @@ send
 END
 $DIG $DIGOPTS @10.53.0.6 \
   +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
-  ANY -x 10.53.0.5 >dig.out.ns6.test$n
+  ANY -x 10.53.0.5 >dig.out.ns6.test$n || ret=1
 nextpart ns6/named.run >nextpart.out.test$n
 grep "attempt to add more records than permitted by policy" nextpart.out.test$n >/dev/null || ret=1
 # the policy is 'grant * tcp-self . PTR(1) ANY(2) A;' so all the A
@@ -1956,7 +1956,7 @@ check-svcb no
 update add _dns.ns.relaxed 0 in SVCB 1 ns.relaxed dohpath=/{?dns}
 send
 END
-$DIG $DIGOPTS +tcp @10.53.0.3 _dns.ns.relaxed SVCB >dig.out.ns3.test$n
+$DIG $DIGOPTS +tcp @10.53.0.3 _dns.ns.relaxed SVCB >dig.out.ns3.test$n || ret=1
 grep '1 ns.relaxed. key7="/{?dns}"' dig.out.ns3.test$n >/dev/null || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -1992,7 +1992,7 @@ check-svcb no
 update add _dns.ns.relaxed 0 in SVCB 1 ns.relaxed alpn=h2
 send
 END
-$DIG $DIGOPTS +tcp @10.53.0.3 _dns.ns.relaxed SVCB >dig.out.ns3.test$n
+$DIG $DIGOPTS +tcp @10.53.0.3 _dns.ns.relaxed SVCB >dig.out.ns3.test$n || ret=1
 grep '1 ns.relaxed. alpn="h2"' dig.out.ns3.test$n >/dev/null || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -2070,7 +2070,7 @@ EOF
   update add machine.example.com 3600 IN A 10.53.0.7
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 machine.example.com A >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 machine.example.com A >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "machine.example.com..*A.*10.53.0.7" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2092,7 +2092,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 foo.example.com A >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 foo.example.com A >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2112,7 +2112,7 @@ EOF
   update add _xxx._tcp.example.com 3600 IN SRV 0 0 0 machine.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx._tcp.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx._tcp.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "_xxx._tcp.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2134,7 +2134,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx._udp.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx._udp.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2154,7 +2154,7 @@ EOF
   update add 4.3.2.1.in-addr.arpa 3600 IN PTR machine.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 4.3.2.1.in-addr.arpa PTR >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 4.3.2.1.in-addr.arpa PTR >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "4.3.2.1.in-addr.arpa.*PTR.*machine.example.com" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2176,7 +2176,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 5.3.2.1.in-addr.arpa PTR >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 5.3.2.1.in-addr.arpa PTR >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2196,7 +2196,7 @@ EOF
   update add _xxx.self-srv.example.com 3600 IN SRV 0 0 0 machine.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx.self-srv.example.com ANY >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx.self-srv.example.com ANY >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "_xxx.self-srv.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2218,7 +2218,7 @@ EOF
   update add _xxx.self-srv-no-type.example.com 3600 IN TXT a txt record
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx.self-srv-no-type.example.com ANY >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx.self-srv-no-type.example.com ANY >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep '_xxx.self-srv-no-type.example.com.*SRV.*0 0 0 machine.example.com' dig.out.ns7.test$n >/dev/null || ret=1
   grep '_xxx.self-srv-no-type.example.com.*TXT.*"a" "txt" "record"' dig.out.ns7.test$n >/dev/null || ret=1
@@ -2241,7 +2241,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 _yyy.self-srv.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 _yyy.self-srv.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2262,7 +2262,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 _yyy.self-srv.example.com TXT >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 _yyy.self-srv.example.com TXT >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2272,7 +2272,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check krb5-subdomain-self-rhs delete PTR (matching PTR) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns7.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns7.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns7.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
@@ -2285,7 +2285,7 @@ EOF
   update delete single.ptr.self-ptr.in-addr.arpa PTR
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2306,7 +2306,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 many.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 many.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2317,7 +2317,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check krb5-subdomain-self-rhs delete ANY (matching PTR) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns7.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns7.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns7.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
@@ -2330,7 +2330,7 @@ EOF
   update delete single.any.self-ptr.in-addr.arpa
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2351,7 +2351,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 many.any.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 many.any.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2362,7 +2362,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check krb5-subdomain-self-rhs delete SRV (matching SRV) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.srv.self-srv.example.com SRV >dig.out.ns7.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.srv.self-srv.example.com SRV >dig.out.ns7.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns7.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
@@ -2375,7 +2375,7 @@ EOF
   update delete single.srv.self-srv.example.com SRV
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.srv.self-srv.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.srv.self-srv.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2396,7 +2396,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 many.srv.self-srv.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 many.srv.self-srv.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2407,7 +2407,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check krb5-subdomain-self-rhs delete ANY (matching SRV) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-srv.example.com SRV >dig.out.ns7.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-srv.example.com SRV >dig.out.ns7.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns7.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
@@ -2420,7 +2420,7 @@ EOF
   update delete single.any.self-srv.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-srv.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-srv.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2441,7 +2441,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 many.any.self-srv.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 many.any.self-srv.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2462,7 +2462,7 @@ EOF
   update add xxx.machine.example.com 3600 IN A 10.53.0.8
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.8 xxx.machine.example.com A >dig.out.ns8.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.8 xxx.machine.example.com A >dig.out.ns8.test$n || ret=1
   grep "status: NOERROR" dig.out.ns8.test$n >/dev/null || ret=1
   grep "xxx.machine.example.com..*A.*10.53.0.8" dig.out.ns8.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2484,7 +2484,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.8 foo.example.com A >dig.out.ns8.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.8 foo.example.com A >dig.out.ns8.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns8.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2504,7 +2504,7 @@ EOF
   update add machine.example.com 3600 IN A 10.53.0.9
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.9 machine.example.com A >dig.out.ns9.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.9 machine.example.com A >dig.out.ns9.test$n || ret=1
   grep "status: NOERROR" dig.out.ns9.test$n >/dev/null || ret=1
   grep "machine.example.com..*A.*10.53.0.9" dig.out.ns9.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2526,7 +2526,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.9 foo.example.com A >dig.out.ns9.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.9 foo.example.com A >dig.out.ns9.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns9.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2546,7 +2546,7 @@ EOF
   update add _xxx._tcp.example.com 3600 IN SRV 0 0 0 machine.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.9 _xxx._tcp.example.com SRV >dig.out.ns9.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.9 _xxx._tcp.example.com SRV >dig.out.ns9.test$n || ret=1
   grep "status: NOERROR" dig.out.ns9.test$n >/dev/null || ret=1
   grep "_xxx._tcp.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns9.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2568,7 +2568,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.9 _xxx._udp.example.com SRV >dig.out.ns9.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.9 _xxx._udp.example.com SRV >dig.out.ns9.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns9.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2588,7 +2588,7 @@ EOF
   update add 4.3.2.1.in-addr.arpa 3600 IN PTR machine.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 4.3.2.1.in-addr.arpa PTR >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 4.3.2.1.in-addr.arpa PTR >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "4.3.2.1.in-addr.arpa.*PTR.*machine.example.com" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2610,7 +2610,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 5.3.2.1.in-addr.arpa PTR >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 5.3.2.1.in-addr.arpa PTR >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2630,7 +2630,7 @@ EOF
   update add _xxx.self-srv.example.com 3600 IN SRV 0 0 0 machine.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 _xxx.self-srv.example.com SRV >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 _xxx.self-srv.example.com SRV >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "_xxx.self-srv.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2652,7 +2652,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 _yyy.self-srv.example.com SRV >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 _yyy.self-srv.example.com SRV >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2662,7 +2662,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check ms-subdomain-self-rhs delete SRV (matching SRV) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.srv.self-srv.example.com SRV >dig.out.ns10.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.srv.self-srv.example.com SRV >dig.out.ns10.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns10.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
@@ -2675,7 +2675,7 @@ EOF
   update delete single.srv.self-srv.example.com SRV
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.srv.self-srv.example.com SRV >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.srv.self-srv.example.com SRV >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2696,7 +2696,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 many.srv.self-srv.example.com SRV >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 many.srv.self-srv.example.com SRV >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2707,7 +2707,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check ms-subdomain-self-rhs delete PTR (matching PTR) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns10.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns10.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns10.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
@@ -2720,7 +2720,7 @@ EOF
   update delete single.ptr.self-ptr.in-addr.arpa PTR
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2741,7 +2741,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 many.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 many.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2752,7 +2752,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check ms-subdomain-self-rhs delete ANY (matching PTR) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns10.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns10.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns10.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
@@ -2765,7 +2765,7 @@ EOF
   update delete single.any.self-ptr.in-addr.arpa
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2786,7 +2786,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 many.any.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 many.any.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2797,7 +2797,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check ms-subdomain-self-rhs delete ANY (matching SRV) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-srv.example.com SRV >dig.out.ns10.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-srv.example.com SRV >dig.out.ns10.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns10.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
@@ -2810,7 +2810,7 @@ EOF
   update delete single.any.self-srv.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-srv.example.com SRV >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-srv.example.com SRV >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2831,7 +2831,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 many.any.self-srv.example.com SRV >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 many.any.self-srv.example.com SRV >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2852,7 +2852,7 @@ EOF
   update add xxx.machine.example.com 3600 IN A 10.53.0.10
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 xxx.machine.example.com A >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 xxx.machine.example.com A >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "xxx.machine.example.com..*A.*10.53.0.10" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2874,7 +2874,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 foo.example.com A >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 foo.example.com A >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2894,7 +2894,7 @@ EOF
   update add dot.machine.example.com 3600 IN A 10.53.0.10
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 dot.machine.example.com A >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 dot.machine.example.com A >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "dot.machine.example.com..*A.*10.53.0.10" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {