diff --git a/bin/tests/system/conf.sh b/bin/tests/system/conf.sh
index e4f8aad03e..264f7a4d0d 100755
--- a/bin/tests/system/conf.sh
+++ b/bin/tests/system/conf.sh
@@ -9,7 +9,7 @@ NAMED=$TOP/bin/named/named
 KEYGEN=$TOP/bin/dnssec/dnssec-keygen
 SIGNER=$TOP/bin/dnssec/dnssec-signzone
 KEYSIGNER=$TOP/bin/dnssec/dnssec-signkey
-KEYSETTOOL=$TOP/bin/tests/dnssec-makekeyset
+KEYSETTOOL=$TOP/bin/dnssec/dnssec-makekeyset
 
 SUBDIRS="xfer dnssec xferquota"
 
diff --git a/bin/tests/system/digcomp.pl b/bin/tests/system/digcomp.pl
index 844f25ca21..52d4477381 100644
--- a/bin/tests/system/digcomp.pl
+++ b/bin/tests/system/digcomp.pl
@@ -44,7 +44,7 @@ while (<FILE1>) {
     }
     if ($entry{"$name ; $class.$type ; $value"} ne "") {
       $line = $entry{"$name ; $class.$type ; $value"};
-      print ("Duplicate entry:\n> $_\n< $line\n");
+      print ("Duplicate entry in $file1:\n> $_\n< $line\n");
     } else {
       $entry{"$name ; $class.$type ; $value"} = $_;
     }
diff --git a/bin/tests/system/dnssec/ns1/named.conf b/bin/tests/system/dnssec/ns1/named.conf
index 60e7681398..740f08b999 100644
--- a/bin/tests/system/dnssec/ns1/named.conf
+++ b/bin/tests/system/dnssec/ns1/named.conf
@@ -1,3 +1,5 @@
+//NS1
+
 options {
 	directory ".";
 	pid-file "named.pid";
@@ -8,5 +10,7 @@ options {
 
 zone "." {
 	type master;
-	file "root.db";
+	file "root.db.signed";
 };
+
+include "trusted.conf";
diff --git a/bin/tests/system/dnssec/ns2/named.conf b/bin/tests/system/dnssec/ns2/named.conf
index 6d9209e8c8..f989db97af 100644
--- a/bin/tests/system/dnssec/ns2/named.conf
+++ b/bin/tests/system/dnssec/ns2/named.conf
@@ -1,3 +1,5 @@
+// NS2
+
 options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
diff --git a/bin/tests/system/dnssec/ns3/named.conf b/bin/tests/system/dnssec/ns3/named.conf
index 3a5e48df03..c6f1b76ddc 100644
--- a/bin/tests/system/dnssec/ns3/named.conf
+++ b/bin/tests/system/dnssec/ns3/named.conf
@@ -1,3 +1,5 @@
+// NS3
+
 options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.3; };
@@ -12,6 +14,7 @@ zone "." {
 
 zone "example" {
 	type slave;
+	masters { 10.53.0.2; };
 	file "example.bk";
 };
 
diff --git a/bin/tests/system/dnssec/ns4/named.conf b/bin/tests/system/dnssec/ns4/named.conf
index a9b159acdf..4e93547de8 100644
--- a/bin/tests/system/dnssec/ns4/named.conf
+++ b/bin/tests/system/dnssec/ns4/named.conf
@@ -1,3 +1,5 @@
+// NS4
+
 options {
 	directory ".";
 	pid-file "named.pid";
diff --git a/bin/tests/system/dnssec/setup.sh b/bin/tests/system/dnssec/setup.sh
index 84d0c55301..d398e2253c 100644
--- a/bin/tests/system/dnssec/setup.sh
+++ b/bin/tests/system/dnssec/setup.sh
@@ -2,4 +2,4 @@
 
 cd ns1 && sh sign.sh
 
-#echo "a.bogus.example.	A	10.0.0.22" >>../ns3/secure.example.db.signed
+echo "a.bogus.example.	A	10.0.0.22" >>../ns3/bogus.example.db.signed
diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index e306b6c14b..a658d588aa 100644
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -30,8 +30,7 @@ grep ";" dig.out.ns3
 status=`expr $status + $?`
 grep ";" dig.out.ns4
 
-perl ../digcomp.pl dig.out.ns2 dig.out.ns3
-perl ../digcomp.pl dig.out.ns2 dig.out.ns4
+rm -f dig.out.*
 
 # Check the example. domain
 ../../../dig/dig +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
@@ -44,10 +43,70 @@ grep ";" dig.out.ns2
 status=`expr $status + $?`
 grep ";" dig.out.ns3
 
-../../../dig/dig +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
+perl ../digcomp.pl dig.out.ns2 dig.out.ns3
+status=`expr $status + $?`
+
+rm -f dig.out.*
+
+../../../dig/dig +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd +noauth \
+	a.example. @10.53.0.2 a > dig.out.ns2
+status=`expr $status + $?`
+grep ";" dig.out.ns2
+
+../../../dig/dig +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd +noauth \
 	a.example. @10.53.0.4 a > dig.out.ns4
 status=`expr $status + $?`
+grep ";" dig.out.ns2
+
+perl ../digcomp.pl dig.out.ns2 dig.out.ns4
+status=`expr $status + $?`
+
+# Check the insecure.example domain
+
+rm -f dig.out.*
+
+../../../dig/dig +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
+	a.insecure.example. @10.53.0.3 a > dig.out.ns3
+status=`expr $status + $?`
+grep ";" dig.out.ns3
+
+../../../dig/dig +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
+	a.insecure.example. @10.53.0.4 a > dig.out.ns4
+status=`expr $status + $?`
 grep ";" dig.out.ns4
 
-perl ../digcomp.pl dig.out.ns2 dig.out.ns3
-perl ../digcomp.pl dig.out.ns2 dig.out.ns4
+perl ../digcomp.pl dig.out.ns3 dig.out.ns4
+status=`expr $status + $?`
+
+# Check the secure.example domain
+
+rm -f dig.out.*
+
+../../../dig/dig +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
+	a.secure.example. @10.53.0.3 a > dig.out.ns3
+status=`expr $status + $?`
+grep ";" dig.out.ns3
+
+../../../dig/dig +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
+	a.secure.example. @10.53.0.4 a > dig.out.ns4
+status=`expr $status + $?`
+grep ";" dig.out.ns4
+
+perl ../digcomp.pl dig.out.ns3 dig.out.ns4
+status=`expr $status + $?`
+
+# Check the bogus domain
+
+rm -f dig.out.*
+
+../../../dig/dig +tcp +noadd +nosea +nostat +noquest +nocmd \
+	a.bogus.example. @10.53.0.4 a > dig.out.ns4
+grep "SERVFAIL" dig.out.ns4 > /dev/null
+status=`expr $status + $?`
+echo "SERVFAIL is expected in the following:"
+grep ";" dig.out.ns4
+
+if [ $status != 0 ]; then
+	echo "FAILED with status $status"
+fi
+
diff --git a/bin/tests/system/ifconfig.sh b/bin/tests/system/ifconfig.sh
index d5c065828a..f528694636 100644
--- a/bin/tests/system/ifconfig.sh
+++ b/bin/tests/system/ifconfig.sh
@@ -4,33 +4,76 @@
 #
 
 sys=`../../../config.guess`
-case "$sys" in 
-    sparc-sun-solaris2.[6-8])
-	type="lo0"
+
+case "$1" in
+
+    'start')
+	for ns in 1 2 3 4
+	do
+		case "$sys" in 
+		    sparc-sun-solaris2.[6-8])
+			ifconfig lo0:$ns 10.53.0.$ns up
+			;;
+		    *-pc-linux-gnu)
+			ifconfig lo:$ns 10.53.0.$ns up
+		        ;;
+		    *-unknown-freebsdelf3.4)
+			ifconfig lo0 10.53.0.$ns alias
+			;;
+		    *-unknown-netbsd*)
+			ifconfig lo0 10.53.0.$ns alias
+			;;
+		    *-pc-bsdi3.*)
+			ifconfig lo0 add 10.53.0.$ns
+			;;
+		    *-dec-osf5.*)
+			ifconfig lo0 alias 10.53.0.$ns
+			;;
+		    *-dec-osf4.*)
+			ifconfig lo0 alias 10.53.0.$ns
+			;;
+		    *-pc-bsdi4.*)
+			ifconfig lo0 add 10.53.0.$ns
+			;;
+	            *)
+			echo "Don't know how to set up interface.  Giving up."
+			exit 1
+		esac
+	done
 	;;
-    i686-pc-linux-gnu)
-	type="lo"
-        ;;
-    i386-unknown-freebsdelf3.4|*-unknown-netbsd*)
-	type="alias"
+
+    'stop')
+	for ns in 4 3 2 1
+	do
+		case "$sys" in 
+		    sparc-sun-solaris2.[6-8])
+			ifconfig lo0:$ns 10.53.0.$ns down
+			;;
+		    *-pc-linux-gnu)
+			ifconfig lo:$ns 10.53.0.$ns down
+		        ;;
+		    *-unknown-freebsdelf3.4)
+			ifconfig lo0 10.53.0.$ns delete
+			;;
+		    *-unknown-netbsd*)
+			ifconfig lo0 10.53.0.$ns delete
+			;;
+		    *-pc-bsdi3.*)
+			ifconfig lo0 remove 10.53.0.$ns
+			;;
+		    *-dec-osf5.*)
+			ifconfig lo0 -alias 10.53.0.$ns
+			;;
+		    *-dec-osf4.*)
+			ifconfig lo0 -alias 10.53.0.$ns
+			;;
+		    *-pc-bsdi4.*)
+			ifconfig lo0 remove 10.53.0.$ns
+			;;
+	            *)
+			echo "Don't know how to destroy interface.  Giving up."
+			exit 1
+		esac
+	done
 	;;
 esac
-
-for ns in 1 2 3 4
-do
-	case "$type" in
-	    lo0)
-		ifconfig lo0:$ns 10.53.0.$ns up
-		;;
-	    lo)
-		ifconfig lo:$ns 10.53.0.$ns up
-		;;
-	    alias)
-		ifconfig lo0 10.53.0.$ns alias
-		;;
-            *)
-		echo "Don't know how to set up interface.  Giving up."
-		exit 1
-	esac
-
-done
diff --git a/bin/tests/system/run.sh b/bin/tests/system/run.sh
index d9e6826e4a..b0329302e9 100644
--- a/bin/tests/system/run.sh
+++ b/bin/tests/system/run.sh
@@ -4,6 +4,12 @@
 #
 . ./conf.sh
 
+sh ifconfig.sh start
+
+if [ $? != 0 ]; then
+	exit 0
+fi
+
 test $# -gt 0 || { echo "usage: runtest.sh test-directory" >&2; exit 1; }
 
 test=$1
@@ -20,10 +26,19 @@ fi
 # Start name servers running
 sh start.sh $test
 
+sleep 10
+
 # Run the tests
 ( cd $test ; sh tests.sh )
 
-echo "Result code $?"
+status=$_
 
 # Shutdown
 sh stop.sh $test
+
+# Cleanup
+( cd $test ; sh clean.sh )
+
+sh ifconfig.sh stop
+
+exit $status
diff --git a/bin/tests/system/setup.sh b/bin/tests/system/setup.sh
new file mode 100644
index 0000000000..d1b4f24a58
--- /dev/null
+++ b/bin/tests/system/setup.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+#
+# Run a system test.
+#
+. ./conf.sh
+
+test $# -gt 0 || { echo "usage: runtest.sh test-directory" >&2; exit 1; }
+
+test=$1
+shift
+
+test -d $test || { echo "$0: $test: no such test" >&2; exit 1; }
+
+# Set up any dynamically generated test data
+if test -f $test/setup.sh
+then
+   ( cd $test && sh setup.sh "$@" )
+fi
+
+
diff --git a/bin/tests/system/stop.sh b/bin/tests/system/stop.sh
index 394f7e27dc..456688020e 100644
--- a/bin/tests/system/stop.sh
+++ b/bin/tests/system/stop.sh
@@ -12,3 +12,13 @@ do
         kill -TERM `cat $pidfile`
      fi
 done
+
+sleep 5
+
+for d in ns*
+do
+     pidfile="$d/named.pid"
+     if [ -f $pidfile ]; then
+        kill -KILL `cat $pidfile`
+     fi
+done
diff --git a/bin/tests/system/xfer/tests.sh b/bin/tests/system/xfer/tests.sh
index ab7cbf5109..5d209b34dd 100644
--- a/bin/tests/system/xfer/tests.sh
+++ b/bin/tests/system/xfer/tests.sh
@@ -27,3 +27,9 @@ status=`expr $status + $?`
 
 perl ../digcomp.pl knowngood.dig.out dig.out.ns3
 status=`expr $status + $?`
+
+if [ $status != 0 ]; then
+	echo "FAILED with status $status"
+fi
+
+exit $status