diff --git a/lib/dns/tests/Kyuafile b/lib/dns/tests/Kyuafile
index d5f65d4c01..2bd698934a 100644
--- a/lib/dns/tests/Kyuafile
+++ b/lib/dns/tests/Kyuafile
@@ -9,7 +9,7 @@ atf_test_program{name='dbversion_test'}
 tap_test_program{name='dh_test'}
 tap_test_program{name='dispatch_test'}
 tap_test_program{name='dnstap_test'}
-atf_test_program{name='dst_test'}
+tap_test_program{name='dst_test'}
 tap_test_program{name='geoip_test'}
 atf_test_program{name='keytable_test'}
 atf_test_program{name='master_test'}
diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
index 946bb64691..fb58d96f02 100644
--- a/lib/dns/tests/Makefile.in
+++ b/lib/dns/tests/Makefile.in
@@ -138,9 +138,9 @@ dnstap_test@EXEEXT@: dnstap_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 		${DNSLIBS} ${ISCLIBS} ${LIBS} ${CMOCKA_LIBS}
 
 dst_test@EXEEXT@: dst_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
-			dst_test.@O@ dnstest.@O@ ${DNSLIBS} \
-			${ISCLIBS} ${LIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${CMOCKA_CFLAGS} \
+		${LDFLAGS} -o $@ dst_test.@O@ dnstest.@O@ \
+		${DNSLIBS} ${ISCLIBS} ${LIBS} ${CMOCKA_LIBS}
 
 geoip_test@EXEEXT@: geoip_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${CMOCKA_CFLAGS} \
diff --git a/lib/dns/tests/dst_test.c b/lib/dns/tests/dst_test.c
index 7ad69e72aa..1bbf1ecbfa 100644
--- a/lib/dns/tests/dst_test.c
+++ b/lib/dns/tests/dst_test.c
@@ -9,15 +9,23 @@
  * information regarding copyright ownership.
  */
 
-/* ! \file */
-
 #include <config.h>
 
-#include <atf-c.h>
+#if HAVE_CMOCKA
 
+#include <stdarg.h>
+#include <stddef.h>
+#include <setjmp.h>
+
+#include <stdlib.h>
 #include <stdbool.h>
 #include <unistd.h>
 
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/util.h>
+
 #include <isc/file.h>
 #include <isc/hex.h>
 #include <isc/util.h>
@@ -31,14 +39,28 @@
 
 #include "dnstest.h"
 
-ATF_TC(sig);
-ATF_TC_HEAD(sig, tc) {
-	atf_tc_set_md_var(tc, "descr", "signature ineffability");
+static int
+_setup(void **state) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = dns_test_begin(NULL, false);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	return (0);
 }
 
-/*
- * Read sig in file at path to buf.
- */
+static int
+_teardown(void **state) {
+	UNUSED(state);
+
+	dns_test_end();
+
+	return (0);
+}
+
+/* Read sig in file at path to buf. Check signature ineffability */
 static isc_result_t
 sig_fromfile(const char *path, isc_buffer_t *buf) {
 	isc_result_t result;
@@ -49,19 +71,19 @@ sig_fromfile(const char *path, isc_buffer_t *buf) {
 	off_t size;
 
 	result = isc_stdio_open(path, "rb", &fp);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	assert_int_equal(result, ISC_R_SUCCESS);
 
 	result = isc_file_getsizefd(fileno(fp), &size);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	assert_int_equal(result, ISC_R_SUCCESS);
 
 	data = isc_mem_get(mctx, (size + 1));
-	ATF_REQUIRE(data != NULL);
+	assert_non_null(data);
 
 	len = (size_t)size;
 	p = data;
 	while (len != 0U) {
 		result = isc_stdio_read(p, 1, len, fp, &rval);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+		assert_int_equal(result, ISC_R_SUCCESS);
 		len -= rval;
 		p += rval;
 	}
@@ -74,8 +96,9 @@ sig_fromfile(const char *path, isc_buffer_t *buf) {
 			++p;
 			--len;
 			continue;
-		} else if (len < 2U)
+		} else if (len < 2U) {
 		       goto err;
+		}
 		if (('0' <= *p) && (*p <= '9')) {
 			val = *p - '0';
 		} else if (('A' <= *p) && (*p <= 'F')) {
@@ -130,19 +153,19 @@ check_sig(const char *datapath, const char *sigpath, const char *keyname,
 	 * Read data from file in a form usable by dst_verify.
 	 */
 	result = isc_stdio_open(datapath, "rb", &fp);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	assert_int_equal(result, ISC_R_SUCCESS);
 
 	result = isc_file_getsizefd(fileno(fp), &size);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	assert_int_equal(result, ISC_R_SUCCESS);
 
 	data = isc_mem_get(mctx, (size + 1));
-	ATF_REQUIRE(data != NULL);
+	assert_non_null(data);
 
 	p = data;
 	len = (size_t)size;
 	do {
 		result = isc_stdio_read(p, 1, len, fp, &rval);
-		ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+		assert_int_equal(result, ISC_R_SUCCESS);
 		len -= rval;
 		p += rval;
 	} while (len);
@@ -155,10 +178,10 @@ check_sig(const char *datapath, const char *sigpath, const char *keyname,
 	isc_buffer_constinit(&b, keyname, strlen(keyname));
 	isc_buffer_add(&b, strlen(keyname));
 	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	assert_int_equal(result, ISC_R_SUCCESS);
 	result = dst_key_fromfile(name, id, alg, type, "testdata/dst",
 				  mctx, &key);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	assert_int_equal(result, ISC_R_SUCCESS);
 
 	isc_buffer_init(&databuf, data, (unsigned int)size);
 	isc_buffer_add(&databuf, (unsigned int)size);
@@ -171,7 +194,7 @@ check_sig(const char *datapath, const char *sigpath, const char *keyname,
 	 * Read precomputed signature from file in a form usable by dst_verify.
 	 */
 	result = sig_fromfile(sigpath, &sigbuf);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	assert_int_equal(result, ISC_R_SUCCESS);
 
 	/*
 	 * Verify that the key signed the data.
@@ -180,27 +203,27 @@ check_sig(const char *datapath, const char *sigpath, const char *keyname,
 
 	result = dst_context_create(key, mctx, DNS_LOGCATEGORY_GENERAL,
 				    false, 0, &ctx);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	assert_int_equal(result, ISC_R_SUCCESS);
 
 	result = dst_context_adddata(ctx, &datareg);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	assert_int_equal(result, ISC_R_SUCCESS);
 	result = dst_context_verify(ctx, &sigreg);
 
 	if (expect && result != ISC_R_SUCCESS) {
 		isc_result_t result2;
 		result2 = dst_context_create(key, mctx, DNS_LOGCATEGORY_GENERAL,
 					    false, 0, &ctx);
-		ATF_REQUIRE_EQ(result2, ISC_R_SUCCESS);
+		assert_int_equal(result2, ISC_R_SUCCESS);
 
 		result2 = dst_context_adddata(ctx, &datareg);
-		ATF_REQUIRE_EQ(result2, ISC_R_SUCCESS);
+		assert_int_equal(result2, ISC_R_SUCCESS);
 
 		char sigbuf2[4096];
 		isc_buffer_t sigb;
 		isc_buffer_init(&sigb, sigbuf2, sizeof(sigbuf2));
 
 		result2 = dst_context_sign(ctx, &sigb);
-		ATF_REQUIRE_EQ(result2, ISC_R_SUCCESS);
+		assert_int_equal(result2, ISC_R_SUCCESS);
 
 		isc_region_t r;
 		isc_buffer_usedregion(&sigb, &r);
@@ -216,7 +239,7 @@ check_sig(const char *datapath, const char *sigpath, const char *keyname,
 		dst_context_destroy(&ctx);
 	}
 
-	ATF_REQUIRE((expect && (result == ISC_R_SUCCESS)) ||
+	assert_true((expect && (result == ISC_R_SUCCESS)) ||
 		    (!expect && (result != ISC_R_SUCCESS)));
 
 	isc_mem_put(mctx, data, size + 1);
@@ -226,13 +249,10 @@ check_sig(const char *datapath, const char *sigpath, const char *keyname,
 	return;
 }
 
-ATF_TC_BODY(sig, tc) {
-	isc_result_t result;
+static void
+sig_test(void **state) {
+	UNUSED(state);
 
-	UNUSED(tc);
-
-	result = dns_test_begin(NULL, false);
-	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 	struct {
 		const char *datapath;
 		const char *sigpath;
@@ -241,7 +261,7 @@ ATF_TC_BODY(sig, tc) {
 		dns_secalg_t alg;
 		bool expect;
 	} testcases[] = {
-		/* XXXOND: Why the heck isn't this failing? */
+		/* XXXOND: Why isn't this failing? */
 		{
 			"testdata/dst/test1.data",
 			"testdata/dst/test1.ecdsa256sig",
@@ -280,15 +300,25 @@ ATF_TC_BODY(sig, tc) {
 			  DST_TYPE_PRIVATE|DST_TYPE_PUBLIC,
 			  testcases[i].expect);
 	}
-
-	dns_test_end();
 }
 
-/*
- * Main
- */
-ATF_TP_ADD_TCS(tp) {
-	ATF_TP_ADD_TC(tp, sig);
+int
+main(void) {
+	const struct CMUnitTest tests[] = {
+		cmocka_unit_test_setup_teardown(sig_test, _setup, _teardown),
+	};
 
-	return (atf_no_error());
+	return (cmocka_run_group_tests(tests, NULL, NULL));
 }
+
+#else /* HAVE_CMOCKA */
+
+#include <stdio.h>
+
+int
+main(void) {
+	printf("1..0 # Skipped: cmocka not available\n");
+	return (0);
+}
+
+#endif