From d28fd93a5841d594ab9da7ca9384f39996fbb79f Mon Sep 17 00:00:00 2001
From: Aram Sargsyan <aram@isc.org>
Date: Thu, 14 Dec 2023 13:14:44 +0000
Subject: [PATCH] Use trust anchors with 'dnssec-validation yes' in system
 tests

Explicitly use an empty 'trust-anchors' statement in the system
tests where it was used implicitly before.

In resolver/ns5/named.conf.in use the trust anchor in 'trusted.conf',
which was supposed to be used there.
---
 bin/tests/system/additional/ns3/named.conf.in                 | 2 ++
 bin/tests/system/cacheclean/ns2/named.conf.in                 | 2 ++
 bin/tests/system/chain/ns1/named.conf.in                      | 2 ++
 bin/tests/system/chain/ns7/named.conf.in                      | 2 ++
 bin/tests/system/checknames/ns2/named.conf.in                 | 2 ++
 bin/tests/system/checknames/ns3/named.conf.in                 | 2 ++
 bin/tests/system/checknames/ns4/named.conf.in                 | 2 ++
 bin/tests/system/checknames/ns5/named.conf.in                 | 2 ++
 bin/tests/system/cipher-suites/ns1/named.conf.in              | 2 ++
 bin/tests/system/cipher-suites/ns2/named.conf.in              | 2 ++
 bin/tests/system/cipher-suites/ns3/named.conf.in              | 2 ++
 bin/tests/system/cipher-suites/ns4/named.conf.in              | 2 ++
 bin/tests/system/cipher-suites/ns5/named.conf.in              | 2 ++
 bin/tests/system/cookie/ns1/named.conf.in                     | 2 ++
 bin/tests/system/cookie/ns3/named.conf.in                     | 2 ++
 bin/tests/system/cookie/ns4/named.conf.in                     | 2 ++
 bin/tests/system/cookie/ns5/named.conf.in                     | 2 ++
 bin/tests/system/cookie/ns6/named.conf.in                     | 2 ++
 bin/tests/system/cookie/ns8/named.conf.in                     | 2 ++
 bin/tests/system/database/ns1/named1.conf.in                  | 2 ++
 bin/tests/system/database/ns1/named2.conf.in                  | 2 ++
 bin/tests/system/dns64/ns1/named.conf1.in                     | 2 ++
 bin/tests/system/dns64/ns1/named.conf2.in                     | 2 ++
 bin/tests/system/dns64/ns1/named.conf3.in                     | 2 ++
 bin/tests/system/dns64/ns2/named.conf.in                      | 2 ++
 bin/tests/system/dns64/ns3/named.conf.in                      | 2 ++
 bin/tests/system/dns64/ns4/named.conf.in                      | 2 ++
 bin/tests/system/dnstap/ns1/named.conf.in                     | 2 ++
 bin/tests/system/dnstap/ns2/named.conf.in                     | 2 ++
 bin/tests/system/dnstap/ns3/named.conf.in                     | 2 ++
 bin/tests/system/dnstap/ns4/named.conf.in                     | 2 ++
 bin/tests/system/doth/ns1/named.conf.in                       | 2 ++
 bin/tests/system/doth/ns2/named.conf.in                       | 2 ++
 bin/tests/system/doth/ns3/named.conf.in                       | 2 ++
 bin/tests/system/doth/ns4/named.conf.in                       | 2 ++
 bin/tests/system/doth/ns5/named.conf.in                       | 2 ++
 bin/tests/system/fetchlimit/ns3/named1.conf.in                | 2 ++
 bin/tests/system/fetchlimit/ns3/named2.conf.in                | 2 ++
 bin/tests/system/fetchlimit/ns3/named3.conf.in                | 2 ++
 bin/tests/system/fetchlimit/ns5/named1.conf.in                | 2 ++
 bin/tests/system/fetchlimit/ns5/named2.conf.in                | 2 ++
 bin/tests/system/filter-aaaa/ns1/named1.conf.in               | 2 ++
 bin/tests/system/filter-aaaa/ns1/named2.conf.in               | 2 ++
 bin/tests/system/forward/ns3/named1.conf.in                   | 2 ++
 bin/tests/system/forward/ns4/named.conf.in                    | 2 ++
 bin/tests/system/forward/ns5/named.conf.in                    | 2 ++
 bin/tests/system/forward/ns7/named.conf.in                    | 2 ++
 bin/tests/system/forward/ns8/named.conf.in                    | 2 ++
 bin/tests/system/hooks/ns1/named.conf.in                      | 2 ++
 bin/tests/system/legacy/ns1/named1.conf.in                    | 2 ++
 bin/tests/system/masterfile/ns2/named.conf.in                 | 2 ++
 bin/tests/system/mkeys/ns1/named1.conf.in                     | 2 ++
 bin/tests/system/mkeys/ns1/named2.conf.in                     | 2 ++
 bin/tests/system/mkeys/ns1/named3.conf.in                     | 2 ++
 bin/tests/system/nsupdate/ns3/named.conf.in                   | 2 ++
 bin/tests/system/pipelined/ns2/named.conf.in                  | 2 ++
 bin/tests/system/pipelined/ns3/named.conf.in                  | 2 ++
 bin/tests/system/pipelined/ns4/named.conf.in                  | 2 ++
 bin/tests/system/proxy/ns1/named.conf.in                      | 2 ++
 bin/tests/system/proxy/ns3/named.conf.in                      | 2 ++
 bin/tests/system/reclimit/ns3/named1.conf.in                  | 2 ++
 bin/tests/system/reclimit/ns3/named2.conf.in                  | 2 ++
 bin/tests/system/reclimit/ns3/named3.conf.in                  | 2 ++
 bin/tests/system/reclimit/ns3/named4.conf.in                  | 2 ++
 bin/tests/system/redirect/ns1/named.conf.in                   | 4 ++--
 bin/tests/system/redirect/ns2/named.conf.in                   | 2 ++
 bin/tests/system/redirect/ns3/named.conf.in                   | 4 ++--
 bin/tests/system/redirect/ns4/named.conf.in                   | 2 ++
 bin/tests/system/resolver/ns1/named.conf.in                   | 2 ++
 bin/tests/system/resolver/ns5/named.conf.in                   | 2 ++
 bin/tests/system/resolver/ns7/named1.conf.in                  | 2 ++
 bin/tests/system/resolver/ns7/named2.conf.in                  | 2 ++
 bin/tests/system/resolver/ns9/named.conf.in                   | 2 ++
 bin/tests/system/rndc/ns4/named.conf.in                       | 2 ++
 bin/tests/system/rpz/ns3/named.conf.in                        | 2 ++
 bin/tests/system/rpz/ns8/named.conf.in                        | 2 ++
 bin/tests/system/rpz/ns9/named.conf.in                        | 2 ++
 bin/tests/system/rpzrecurse/ns2/named.conf.header.in          | 2 ++
 bin/tests/system/rpzrecurse/ns3/named1.conf.in                | 2 ++
 bin/tests/system/rpzrecurse/ns3/named2.conf.in                | 2 ++
 bin/tests/system/rpzrecurse/ns3/named3.conf.in                | 2 ++
 bin/tests/system/rrl/ns1/named.conf.in                        | 2 ++
 bin/tests/system/rrl/ns2/named.conf.in                        | 2 ++
 bin/tests/system/rrl/ns3/named.conf.in                        | 2 ++
 bin/tests/system/rrl/ns4/named.conf.in                        | 2 ++
 bin/tests/system/rrsetorder/ns3/named.conf.in                 | 2 ++
 bin/tests/system/rrsetorder/ns4/named.conf.in                 | 2 ++
 bin/tests/system/rrsetorder/ns5/named.conf.in                 | 2 ++
 bin/tests/system/statistics/ns2/named.conf.in                 | 2 ++
 bin/tests/system/statistics/ns3/named.conf.in                 | 2 ++
 bin/tests/system/stress/ns3/named.conf.in                     | 2 ++
 bin/tests/system/stress/ns4/named.conf.in                     | 2 ++
 bin/tests/system/transport-acl/ns1/named.conf.in              | 2 ++
 .../transport-change/ns1/named-http-plain-proxy.conf.in       | 2 ++
 .../system/transport-change/ns1/named-http-plain.conf.in      | 2 ++
 .../transport-change/ns1/named-https-proxy-encrypted.conf.in  | 2 ++
 .../transport-change/ns1/named-https-proxy-plain.conf.in      | 2 ++
 bin/tests/system/transport-change/ns1/named-https.conf.in     | 2 ++
 bin/tests/system/transport-change/ns1/named-proxy.conf.in     | 2 ++
 .../transport-change/ns1/named-tls-proxy-encrypted.conf.in    | 2 ++
 .../system/transport-change/ns1/named-tls-proxy-plain.conf.in | 2 ++
 bin/tests/system/transport-change/ns1/named-tls.conf.in       | 2 ++
 bin/tests/system/transport-change/ns1/named.conf.in           | 2 ++
 bin/tests/system/zero/ns3/named.conf.in                       | 2 ++
 bin/tests/system/zero/ns4/named.conf.in                       | 2 ++
 bin/tests/system/zonechecks/ns1/named.conf.in                 | 2 ++
 bin/tests/system/zonechecks/ns2/named.conf.in                 | 2 ++
 107 files changed, 214 insertions(+), 4 deletions(-)

diff --git a/bin/tests/system/additional/ns3/named.conf.in b/bin/tests/system/additional/ns3/named.conf.in
index 2bd01c945d..f47a380628 100644
--- a/bin/tests/system/additional/ns3/named.conf.in
+++ b/bin/tests/system/additional/ns3/named.conf.in
@@ -26,6 +26,8 @@ options {
 	minimal-responses no;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/cacheclean/ns2/named.conf.in b/bin/tests/system/cacheclean/ns2/named.conf.in
index 6ffa0737b2..418209cf04 100644
--- a/bin/tests/system/cacheclean/ns2/named.conf.in
+++ b/bin/tests/system/cacheclean/ns2/named.conf.in
@@ -25,6 +25,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/chain/ns1/named.conf.in b/bin/tests/system/chain/ns1/named.conf.in
index 550426126f..95ccf89206 100644
--- a/bin/tests/system/chain/ns1/named.conf.in
+++ b/bin/tests/system/chain/ns1/named.conf.in
@@ -24,4 +24,6 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "." { type primary; file "root.db"; };
diff --git a/bin/tests/system/chain/ns7/named.conf.in b/bin/tests/system/chain/ns7/named.conf.in
index 32c9b5f569..87931179d2 100644
--- a/bin/tests/system/chain/ns7/named.conf.in
+++ b/bin/tests/system/chain/ns7/named.conf.in
@@ -30,6 +30,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/checknames/ns2/named.conf.in b/bin/tests/system/checknames/ns2/named.conf.in
index 3ba62e1a8d..105a88dd5f 100644
--- a/bin/tests/system/checknames/ns2/named.conf.in
+++ b/bin/tests/system/checknames/ns2/named.conf.in
@@ -25,6 +25,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hints";
diff --git a/bin/tests/system/checknames/ns3/named.conf.in b/bin/tests/system/checknames/ns3/named.conf.in
index 7c0cacb5ae..487cecca28 100644
--- a/bin/tests/system/checknames/ns3/named.conf.in
+++ b/bin/tests/system/checknames/ns3/named.conf.in
@@ -25,6 +25,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hints";
diff --git a/bin/tests/system/checknames/ns4/named.conf.in b/bin/tests/system/checknames/ns4/named.conf.in
index f0cb87093b..841bb5904e 100644
--- a/bin/tests/system/checknames/ns4/named.conf.in
+++ b/bin/tests/system/checknames/ns4/named.conf.in
@@ -26,6 +26,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hints";
diff --git a/bin/tests/system/checknames/ns5/named.conf.in b/bin/tests/system/checknames/ns5/named.conf.in
index 1797aa1eb2..dec85ec498 100644
--- a/bin/tests/system/checknames/ns5/named.conf.in
+++ b/bin/tests/system/checknames/ns5/named.conf.in
@@ -26,6 +26,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hints";
diff --git a/bin/tests/system/cipher-suites/ns1/named.conf.in b/bin/tests/system/cipher-suites/ns1/named.conf.in
index 77186a6e63..8de44d1cb4 100644
--- a/bin/tests/system/cipher-suites/ns1/named.conf.in
+++ b/bin/tests/system/cipher-suites/ns1/named.conf.in
@@ -69,6 +69,8 @@ options {
 	transfers-out 100;
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/cipher-suites/ns2/named.conf.in b/bin/tests/system/cipher-suites/ns2/named.conf.in
index 58189524b8..c81429c902 100644
--- a/bin/tests/system/cipher-suites/ns2/named.conf.in
+++ b/bin/tests/system/cipher-suites/ns2/named.conf.in
@@ -39,6 +39,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/cipher-suites/ns3/named.conf.in b/bin/tests/system/cipher-suites/ns3/named.conf.in
index 9a78903d98..ab642f92ce 100644
--- a/bin/tests/system/cipher-suites/ns3/named.conf.in
+++ b/bin/tests/system/cipher-suites/ns3/named.conf.in
@@ -39,6 +39,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/cipher-suites/ns4/named.conf.in b/bin/tests/system/cipher-suites/ns4/named.conf.in
index cf52f98b0d..a690cf5c78 100644
--- a/bin/tests/system/cipher-suites/ns4/named.conf.in
+++ b/bin/tests/system/cipher-suites/ns4/named.conf.in
@@ -39,6 +39,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/cipher-suites/ns5/named.conf.in b/bin/tests/system/cipher-suites/ns5/named.conf.in
index 9187d0e94a..c36b374a19 100644
--- a/bin/tests/system/cipher-suites/ns5/named.conf.in
+++ b/bin/tests/system/cipher-suites/ns5/named.conf.in
@@ -39,6 +39,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/cookie/ns1/named.conf.in b/bin/tests/system/cookie/ns1/named.conf.in
index 20ebca30c0..0bd93c93de 100644
--- a/bin/tests/system/cookie/ns1/named.conf.in
+++ b/bin/tests/system/cookie/ns1/named.conf.in
@@ -49,6 +49,8 @@ options {
 	nocookie-udp-size 512;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/cookie/ns3/named.conf.in b/bin/tests/system/cookie/ns3/named.conf.in
index 090d528ba3..cbebd07433 100644
--- a/bin/tests/system/cookie/ns3/named.conf.in
+++ b/bin/tests/system/cookie/ns3/named.conf.in
@@ -41,6 +41,8 @@ options {
 	require-server-cookie yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/cookie/ns4/named.conf.in b/bin/tests/system/cookie/ns4/named.conf.in
index c49b87ec10..592be13ed0 100644
--- a/bin/tests/system/cookie/ns4/named.conf.in
+++ b/bin/tests/system/cookie/ns4/named.conf.in
@@ -35,6 +35,8 @@ options {
 	require-server-cookie yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/cookie/ns5/named.conf.in b/bin/tests/system/cookie/ns5/named.conf.in
index 87210adbf8..2f51e1be94 100644
--- a/bin/tests/system/cookie/ns5/named.conf.in
+++ b/bin/tests/system/cookie/ns5/named.conf.in
@@ -36,6 +36,8 @@ options {
 	require-server-cookie yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/cookie/ns6/named.conf.in b/bin/tests/system/cookie/ns6/named.conf.in
index 158d8988c5..56c5e04857 100644
--- a/bin/tests/system/cookie/ns6/named.conf.in
+++ b/bin/tests/system/cookie/ns6/named.conf.in
@@ -35,6 +35,8 @@ options {
 	require-server-cookie yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/cookie/ns8/named.conf.in b/bin/tests/system/cookie/ns8/named.conf.in
index 693f06a81e..36f052b8e4 100644
--- a/bin/tests/system/cookie/ns8/named.conf.in
+++ b/bin/tests/system/cookie/ns8/named.conf.in
@@ -33,6 +33,8 @@ options {
 	require-server-cookie yes;
 };
 
+trust-anchors { };
+
 server 10.53.0.7 { require-cookie yes; };
 
 zone "example" {
diff --git a/bin/tests/system/database/ns1/named1.conf.in b/bin/tests/system/database/ns1/named1.conf.in
index 5fa7ce5ce4..97c087fccd 100644
--- a/bin/tests/system/database/ns1/named1.conf.in
+++ b/bin/tests/system/database/ns1/named1.conf.in
@@ -35,6 +35,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "database" {
 	type primary;
 	database "_builtin empty localhost. hostmaster.isc.org.";
diff --git a/bin/tests/system/database/ns1/named2.conf.in b/bin/tests/system/database/ns1/named2.conf.in
index 80cfab28b8..8c498a9ae1 100644
--- a/bin/tests/system/database/ns1/named2.conf.in
+++ b/bin/tests/system/database/ns1/named2.conf.in
@@ -35,6 +35,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "database" {
 	type primary;
 	database "_builtin empty localhost. marka.isc.org.";
diff --git a/bin/tests/system/dns64/ns1/named.conf1.in b/bin/tests/system/dns64/ns1/named.conf1.in
index 41950d9f64..bc6c2d2366 100644
--- a/bin/tests/system/dns64/ns1/named.conf1.in
+++ b/bin/tests/system/dns64/ns1/named.conf1.in
@@ -42,6 +42,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/dns64/ns1/named.conf2.in b/bin/tests/system/dns64/ns1/named.conf2.in
index ff39dd1fb6..d7a6d1f80a 100644
--- a/bin/tests/system/dns64/ns1/named.conf2.in
+++ b/bin/tests/system/dns64/ns1/named.conf2.in
@@ -45,6 +45,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/dns64/ns1/named.conf3.in b/bin/tests/system/dns64/ns1/named.conf3.in
index a44c258cc3..393e623b36 100644
--- a/bin/tests/system/dns64/ns1/named.conf3.in
+++ b/bin/tests/system/dns64/ns1/named.conf3.in
@@ -34,6 +34,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/dns64/ns2/named.conf.in b/bin/tests/system/dns64/ns2/named.conf.in
index 263cc8a1b1..49299aaf99 100644
--- a/bin/tests/system/dns64/ns2/named.conf.in
+++ b/bin/tests/system/dns64/ns2/named.conf.in
@@ -60,6 +60,8 @@ options {
 	response-policy { zone "rpz"; };
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/dns64/ns3/named.conf.in b/bin/tests/system/dns64/ns3/named.conf.in
index 4491de1b6e..a86686bdb0 100644
--- a/bin/tests/system/dns64/ns3/named.conf.in
+++ b/bin/tests/system/dns64/ns3/named.conf.in
@@ -40,6 +40,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "hints";
diff --git a/bin/tests/system/dns64/ns4/named.conf.in b/bin/tests/system/dns64/ns4/named.conf.in
index ca831f9264..485cdc82f9 100644
--- a/bin/tests/system/dns64/ns4/named.conf.in
+++ b/bin/tests/system/dns64/ns4/named.conf.in
@@ -30,6 +30,8 @@ options {
 	recursion no;
 };
 
+trust-anchors { };
+
 zone "." {
 	type master;
 	file "root.db";
diff --git a/bin/tests/system/dnstap/ns1/named.conf.in b/bin/tests/system/dnstap/ns1/named.conf.in
index 7f3fb296d7..daaf88731a 100644
--- a/bin/tests/system/dnstap/ns1/named.conf.in
+++ b/bin/tests/system/dnstap/ns1/named.conf.in
@@ -32,6 +32,8 @@ options {
 	qname-minimization disabled;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/dnstap/ns2/named.conf.in b/bin/tests/system/dnstap/ns2/named.conf.in
index cc05db02ff..12ae86322d 100644
--- a/bin/tests/system/dnstap/ns2/named.conf.in
+++ b/bin/tests/system/dnstap/ns2/named.conf.in
@@ -32,6 +32,8 @@ options {
 	qname-minimization disabled;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/dnstap/ns3/named.conf.in b/bin/tests/system/dnstap/ns3/named.conf.in
index 1626030ba8..d443c3818a 100644
--- a/bin/tests/system/dnstap/ns3/named.conf.in
+++ b/bin/tests/system/dnstap/ns3/named.conf.in
@@ -33,6 +33,8 @@ options {
 	qname-minimization disabled;
 };
 
+trust-anchors { };
+
 server 10.53.0.1 { tcp-only yes; };
 
 key rndc_key {
diff --git a/bin/tests/system/dnstap/ns4/named.conf.in b/bin/tests/system/dnstap/ns4/named.conf.in
index 4a1debf6ab..18c4da1100 100644
--- a/bin/tests/system/dnstap/ns4/named.conf.in
+++ b/bin/tests/system/dnstap/ns4/named.conf.in
@@ -32,6 +32,8 @@ options {
 	qname-minimization disabled;
 };
 
+trust-anchors { };
+
 server 10.53.0.1 { tcp-only yes; };
 
 key rndc_key {
diff --git a/bin/tests/system/doth/ns1/named.conf.in b/bin/tests/system/doth/ns1/named.conf.in
index 6a8bcdbda5..6a323db68e 100644
--- a/bin/tests/system/doth/ns1/named.conf.in
+++ b/bin/tests/system/doth/ns1/named.conf.in
@@ -100,6 +100,8 @@ options {
 	transfers-out 100;
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
diff --git a/bin/tests/system/doth/ns2/named.conf.in b/bin/tests/system/doth/ns2/named.conf.in
index e533f47e4a..2fa20b193d 100644
--- a/bin/tests/system/doth/ns2/named.conf.in
+++ b/bin/tests/system/doth/ns2/named.conf.in
@@ -53,6 +53,8 @@ options {
 	transfers-out 100;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/doth/ns3/named.conf.in b/bin/tests/system/doth/ns3/named.conf.in
index cd1ab9cfa6..69de2ca146 100644
--- a/bin/tests/system/doth/ns3/named.conf.in
+++ b/bin/tests/system/doth/ns3/named.conf.in
@@ -46,6 +46,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/doth/ns4/named.conf.in b/bin/tests/system/doth/ns4/named.conf.in
index c7c6c91a58..60072ce9c2 100644
--- a/bin/tests/system/doth/ns4/named.conf.in
+++ b/bin/tests/system/doth/ns4/named.conf.in
@@ -54,6 +54,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/doth/ns5/named.conf.in b/bin/tests/system/doth/ns5/named.conf.in
index 6808618882..e161a3e4cf 100644
--- a/bin/tests/system/doth/ns5/named.conf.in
+++ b/bin/tests/system/doth/ns5/named.conf.in
@@ -42,6 +42,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/fetchlimit/ns3/named1.conf.in b/bin/tests/system/fetchlimit/ns3/named1.conf.in
index e493d8a4d7..da1661d920 100644
--- a/bin/tests/system/fetchlimit/ns3/named1.conf.in
+++ b/bin/tests/system/fetchlimit/ns3/named1.conf.in
@@ -28,6 +28,8 @@ options {
 	fetches-per-server 400;
 };
 
+trust-anchors { };
+
 server 10.53.0.4 {
 	edns no;
 };
diff --git a/bin/tests/system/fetchlimit/ns3/named2.conf.in b/bin/tests/system/fetchlimit/ns3/named2.conf.in
index 2d0dcef24b..d354dfd39f 100644
--- a/bin/tests/system/fetchlimit/ns3/named2.conf.in
+++ b/bin/tests/system/fetchlimit/ns3/named2.conf.in
@@ -26,6 +26,8 @@ options {
 	fetches-per-zone 40;
 };
 
+trust-anchors { };
+
 server 10.53.0.4 {
 	edns no;
 };
diff --git a/bin/tests/system/fetchlimit/ns3/named3.conf.in b/bin/tests/system/fetchlimit/ns3/named3.conf.in
index f056fbbf7b..db32409ed3 100644
--- a/bin/tests/system/fetchlimit/ns3/named3.conf.in
+++ b/bin/tests/system/fetchlimit/ns3/named3.conf.in
@@ -26,6 +26,8 @@ options {
 	recursive-clients 400;
 };
 
+trust-anchors { };
+
 server 10.53.0.4 {
 	edns no;
 };
diff --git a/bin/tests/system/fetchlimit/ns5/named1.conf.in b/bin/tests/system/fetchlimit/ns5/named1.conf.in
index d3c62c225c..f26b8a1941 100644
--- a/bin/tests/system/fetchlimit/ns5/named1.conf.in
+++ b/bin/tests/system/fetchlimit/ns5/named1.conf.in
@@ -27,6 +27,8 @@ options {
 	max-clients-per-query 10;
 };
 
+trust-anchors { };
+
 server 10.53.0.4 {
 	edns no;
 };
diff --git a/bin/tests/system/fetchlimit/ns5/named2.conf.in b/bin/tests/system/fetchlimit/ns5/named2.conf.in
index cb33d30716..ba5ef64009 100644
--- a/bin/tests/system/fetchlimit/ns5/named2.conf.in
+++ b/bin/tests/system/fetchlimit/ns5/named2.conf.in
@@ -30,6 +30,8 @@ options {
 	max-clients-per-query 10;
 };
 
+trust-anchors { };
+
 server 10.53.0.4 {
 	edns no;
 };
diff --git a/bin/tests/system/filter-aaaa/ns1/named1.conf.in b/bin/tests/system/filter-aaaa/ns1/named1.conf.in
index f5f0905512..c4e6eacc8c 100644
--- a/bin/tests/system/filter-aaaa/ns1/named1.conf.in
+++ b/bin/tests/system/filter-aaaa/ns1/named1.conf.in
@@ -25,6 +25,8 @@ options {
 	minimal-responses no;
 };
 
+trust-anchors { };
+
 acl filterees { 10.53.0.1; };
 
 plugin query "../../../../plugins/.libs/filter-aaaa.so" {
diff --git a/bin/tests/system/filter-aaaa/ns1/named2.conf.in b/bin/tests/system/filter-aaaa/ns1/named2.conf.in
index 3152f96f0e..d82ed2d50f 100644
--- a/bin/tests/system/filter-aaaa/ns1/named2.conf.in
+++ b/bin/tests/system/filter-aaaa/ns1/named2.conf.in
@@ -25,6 +25,8 @@ options {
 	minimal-responses no;
 };
 
+trust-anchors { };
+
 plugin query "../../../../plugins/.libs/filter-aaaa.so" {
 	filter-aaaa-on-v6 yes;
 	filter-aaaa { fd92:7065:b8e:ffff::1; };
diff --git a/bin/tests/system/forward/ns3/named1.conf.in b/bin/tests/system/forward/ns3/named1.conf.in
index ffc0718bfc..91de8f8540 100644
--- a/bin/tests/system/forward/ns3/named1.conf.in
+++ b/bin/tests/system/forward/ns3/named1.conf.in
@@ -27,6 +27,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/forward/ns4/named.conf.in b/bin/tests/system/forward/ns4/named.conf.in
index f6524d5858..e8d3bbb8a5 100644
--- a/bin/tests/system/forward/ns4/named.conf.in
+++ b/bin/tests/system/forward/ns4/named.conf.in
@@ -27,6 +27,8 @@ options {
 	minimal-responses yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.db";
diff --git a/bin/tests/system/forward/ns5/named.conf.in b/bin/tests/system/forward/ns5/named.conf.in
index 024f49be16..15b89dd0e7 100644
--- a/bin/tests/system/forward/ns5/named.conf.in
+++ b/bin/tests/system/forward/ns5/named.conf.in
@@ -25,6 +25,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.db";
diff --git a/bin/tests/system/forward/ns7/named.conf.in b/bin/tests/system/forward/ns7/named.conf.in
index 302bb55e5d..c6e55a89bc 100644
--- a/bin/tests/system/forward/ns7/named.conf.in
+++ b/bin/tests/system/forward/ns7/named.conf.in
@@ -24,6 +24,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.db";
diff --git a/bin/tests/system/forward/ns8/named.conf.in b/bin/tests/system/forward/ns8/named.conf.in
index 2de656fe2f..13c38594e0 100644
--- a/bin/tests/system/forward/ns8/named.conf.in
+++ b/bin/tests/system/forward/ns8/named.conf.in
@@ -24,6 +24,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.db";
diff --git a/bin/tests/system/hooks/ns1/named.conf.in b/bin/tests/system/hooks/ns1/named.conf.in
index 956bf41ef4..30ae85ae84 100644
--- a/bin/tests/system/hooks/ns1/named.conf.in
+++ b/bin/tests/system/hooks/ns1/named.conf.in
@@ -24,6 +24,8 @@ options {
 	minimal-responses no;
 };
 
+trust-anchors { };
+
 plugin query "../driver/.libs/test-async.so";
 
 key rndc_key {
diff --git a/bin/tests/system/legacy/ns1/named1.conf.in b/bin/tests/system/legacy/ns1/named1.conf.in
index 5c4b1c400b..bada7eb630 100644
--- a/bin/tests/system/legacy/ns1/named1.conf.in
+++ b/bin/tests/system/legacy/ns1/named1.conf.in
@@ -23,6 +23,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/masterfile/ns2/named.conf.in b/bin/tests/system/masterfile/ns2/named.conf.in
index 2a84f86f26..e1e8dc2bf6 100644
--- a/bin/tests/system/masterfile/ns2/named.conf.in
+++ b/bin/tests/system/masterfile/ns2/named.conf.in
@@ -26,6 +26,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/mkeys/ns1/named1.conf.in b/bin/tests/system/mkeys/ns1/named1.conf.in
index 4271668ea9..d45e98d768 100644
--- a/bin/tests/system/mkeys/ns1/named1.conf.in
+++ b/bin/tests/system/mkeys/ns1/named1.conf.in
@@ -32,6 +32,8 @@ options {
 	allow-query { allowed; };
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/mkeys/ns1/named2.conf.in b/bin/tests/system/mkeys/ns1/named2.conf.in
index 4271668ea9..d45e98d768 100644
--- a/bin/tests/system/mkeys/ns1/named2.conf.in
+++ b/bin/tests/system/mkeys/ns1/named2.conf.in
@@ -32,6 +32,8 @@ options {
 	allow-query { allowed; };
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/mkeys/ns1/named3.conf.in b/bin/tests/system/mkeys/ns1/named3.conf.in
index 686177edb0..12b8c71c54 100644
--- a/bin/tests/system/mkeys/ns1/named3.conf.in
+++ b/bin/tests/system/mkeys/ns1/named3.conf.in
@@ -26,6 +26,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/nsupdate/ns3/named.conf.in b/bin/tests/system/nsupdate/ns3/named.conf.in
index 5473b7eea0..b62885111a 100644
--- a/bin/tests/system/nsupdate/ns3/named.conf.in
+++ b/bin/tests/system/nsupdate/ns3/named.conf.in
@@ -26,6 +26,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/pipelined/ns2/named.conf.in b/bin/tests/system/pipelined/ns2/named.conf.in
index 98026893f6..8cb605c8bd 100644
--- a/bin/tests/system/pipelined/ns2/named.conf.in
+++ b/bin/tests/system/pipelined/ns2/named.conf.in
@@ -24,6 +24,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/pipelined/ns3/named.conf.in b/bin/tests/system/pipelined/ns3/named.conf.in
index 3fe8f56422..96a9a92b6c 100644
--- a/bin/tests/system/pipelined/ns3/named.conf.in
+++ b/bin/tests/system/pipelined/ns3/named.conf.in
@@ -24,6 +24,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/pipelined/ns4/named.conf.in b/bin/tests/system/pipelined/ns4/named.conf.in
index c36ec91db5..3a187bf935 100644
--- a/bin/tests/system/pipelined/ns4/named.conf.in
+++ b/bin/tests/system/pipelined/ns4/named.conf.in
@@ -25,6 +25,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/proxy/ns1/named.conf.in b/bin/tests/system/proxy/ns1/named.conf.in
index 0be6c355f8..4e2c620cd7 100644
--- a/bin/tests/system/proxy/ns1/named.conf.in
+++ b/bin/tests/system/proxy/ns1/named.conf.in
@@ -54,6 +54,8 @@ options {
 	tcp-initial-timeout 1200;
 };
 
+trust-anchors { };
+
 zone "example0" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/proxy/ns3/named.conf.in b/bin/tests/system/proxy/ns3/named.conf.in
index 5583eb2c9b..db1c3467e6 100644
--- a/bin/tests/system/proxy/ns3/named.conf.in
+++ b/bin/tests/system/proxy/ns3/named.conf.in
@@ -49,6 +49,8 @@ options {
 	tcp-initial-timeout 1200;
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/reclimit/ns3/named1.conf.in b/bin/tests/system/reclimit/ns3/named1.conf.in
index 58b5d02514..7771d834a2 100644
--- a/bin/tests/system/reclimit/ns3/named1.conf.in
+++ b/bin/tests/system/reclimit/ns3/named1.conf.in
@@ -27,6 +27,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/reclimit/ns3/named2.conf.in b/bin/tests/system/reclimit/ns3/named2.conf.in
index b5389f4ff9..974b24bcff 100644
--- a/bin/tests/system/reclimit/ns3/named2.conf.in
+++ b/bin/tests/system/reclimit/ns3/named2.conf.in
@@ -27,6 +27,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/reclimit/ns3/named3.conf.in b/bin/tests/system/reclimit/ns3/named3.conf.in
index f356f2487f..38a77ae35c 100644
--- a/bin/tests/system/reclimit/ns3/named3.conf.in
+++ b/bin/tests/system/reclimit/ns3/named3.conf.in
@@ -28,6 +28,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/reclimit/ns3/named4.conf.in b/bin/tests/system/reclimit/ns3/named4.conf.in
index 728f00bb26..5a0660766f 100644
--- a/bin/tests/system/reclimit/ns3/named4.conf.in
+++ b/bin/tests/system/reclimit/ns3/named4.conf.in
@@ -28,6 +28,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/redirect/ns1/named.conf.in b/bin/tests/system/redirect/ns1/named.conf.in
index 412b874240..3b4ccad028 100644
--- a/bin/tests/system/redirect/ns1/named.conf.in
+++ b/bin/tests/system/redirect/ns1/named.conf.in
@@ -28,6 +28,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
@@ -53,5 +55,3 @@ zone "." {
 	file "redirect.db";
 	allow-query { !10.53.0.2; !10.53.0.4; any; };
 };
-
-// include "trusted.conf";
diff --git a/bin/tests/system/redirect/ns2/named.conf.in b/bin/tests/system/redirect/ns2/named.conf.in
index 881a81f9d1..e07d75bdfe 100644
--- a/bin/tests/system/redirect/ns2/named.conf.in
+++ b/bin/tests/system/redirect/ns2/named.conf.in
@@ -31,6 +31,8 @@ options {
 
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/redirect/ns3/named.conf.in b/bin/tests/system/redirect/ns3/named.conf.in
index 2113dd5923..51e590f630 100644
--- a/bin/tests/system/redirect/ns3/named.conf.in
+++ b/bin/tests/system/redirect/ns3/named.conf.in
@@ -26,6 +26,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type primary;
 	file "root.db";
@@ -50,5 +52,3 @@ zone "redirect" {
 	type primary;
 	file "redirect.db";
 };
-
-// include "trusted.conf";
diff --git a/bin/tests/system/redirect/ns4/named.conf.in b/bin/tests/system/redirect/ns4/named.conf.in
index 1650e99a7b..8937453ace 100644
--- a/bin/tests/system/redirect/ns4/named.conf.in
+++ b/bin/tests/system/redirect/ns4/named.conf.in
@@ -31,6 +31,8 @@ options {
 	nxdomain-redirect "redirect";
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/resolver/ns1/named.conf.in b/bin/tests/system/resolver/ns1/named.conf.in
index f0f9571209..fbcb6c1dd3 100644
--- a/bin/tests/system/resolver/ns1/named.conf.in
+++ b/bin/tests/system/resolver/ns1/named.conf.in
@@ -31,6 +31,8 @@ options {
 	attach-cache "globalcache";
 };
 
+trust-anchors { };
+
 server 10.53.0.3 {
 	tcp-only yes;
 };
diff --git a/bin/tests/system/resolver/ns5/named.conf.in b/bin/tests/system/resolver/ns5/named.conf.in
index 9856d8e5b1..dc1704fd28 100644
--- a/bin/tests/system/resolver/ns5/named.conf.in
+++ b/bin/tests/system/resolver/ns5/named.conf.in
@@ -27,6 +27,8 @@ options {
 	prefetch 4 10;
 };
 
+include "trusted.conf";
+
 server 10.53.0.7 {
 	edns-version 0;
 };
diff --git a/bin/tests/system/resolver/ns7/named1.conf.in b/bin/tests/system/resolver/ns7/named1.conf.in
index 1d32ae9745..170ce62716 100644
--- a/bin/tests/system/resolver/ns7/named1.conf.in
+++ b/bin/tests/system/resolver/ns7/named1.conf.in
@@ -34,6 +34,8 @@ options {
 	edns-udp-size 4096;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/resolver/ns7/named2.conf.in b/bin/tests/system/resolver/ns7/named2.conf.in
index 1d32ae9745..170ce62716 100644
--- a/bin/tests/system/resolver/ns7/named2.conf.in
+++ b/bin/tests/system/resolver/ns7/named2.conf.in
@@ -34,6 +34,8 @@ options {
 	edns-udp-size 4096;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/resolver/ns9/named.conf.in b/bin/tests/system/resolver/ns9/named.conf.in
index 3be31db6f8..140cd26b58 100644
--- a/bin/tests/system/resolver/ns9/named.conf.in
+++ b/bin/tests/system/resolver/ns9/named.conf.in
@@ -24,6 +24,8 @@ options {
 	qname-minimization off;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/rndc/ns4/named.conf.in b/bin/tests/system/rndc/ns4/named.conf.in
index 6dc37ec3b2..0ec0cc7bf8 100644
--- a/bin/tests/system/rndc/ns4/named.conf.in
+++ b/bin/tests/system/rndc/ns4/named.conf.in
@@ -20,6 +20,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 view normal {
 	match-clients { any; };
 
diff --git a/bin/tests/system/rpz/ns3/named.conf.in b/bin/tests/system/rpz/ns3/named.conf.in
index 80a9d832f0..b2ba42720c 100644
--- a/bin/tests/system/rpz/ns3/named.conf.in
+++ b/bin/tests/system/rpz/ns3/named.conf.in
@@ -64,6 +64,8 @@ options {
 	notify-delay 0;
 };
 
+trust-anchors { };
+
 logging { category rpz { default_debug; }; };
 
 key rndc_key {
diff --git a/bin/tests/system/rpz/ns8/named.conf.in b/bin/tests/system/rpz/ns8/named.conf.in
index aa8b342d99..87f6c8e352 100644
--- a/bin/tests/system/rpz/ns8/named.conf.in
+++ b/bin/tests/system/rpz/ns8/named.conf.in
@@ -46,6 +46,8 @@ options {
 	notify-delay 0;
 };
 
+trust-anchors { };
+
 logging { category rpz { default_debug; }; };
 
 key rndc_key {
diff --git a/bin/tests/system/rpz/ns9/named.conf.in b/bin/tests/system/rpz/ns9/named.conf.in
index 0d3fce7852..6010082c8f 100644
--- a/bin/tests/system/rpz/ns9/named.conf.in
+++ b/bin/tests/system/rpz/ns9/named.conf.in
@@ -40,6 +40,8 @@ options {
 	notify-delay 0;
 };
 
+trust-anchors { };
+
 logging { category rpz { default_debug; }; };
 
 key rndc_key {
diff --git a/bin/tests/system/rpzrecurse/ns2/named.conf.header.in b/bin/tests/system/rpzrecurse/ns2/named.conf.header.in
index 90a17b7a37..3973eba5ee 100644
--- a/bin/tests/system/rpzrecurse/ns2/named.conf.header.in
+++ b/bin/tests/system/rpzrecurse/ns2/named.conf.header.in
@@ -30,6 +30,8 @@ options {
 	include "../dnsrps.conf";
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/rpzrecurse/ns3/named1.conf.in b/bin/tests/system/rpzrecurse/ns3/named1.conf.in
index 6a1bd11658..3159c63e7b 100644
--- a/bin/tests/system/rpzrecurse/ns3/named1.conf.in
+++ b/bin/tests/system/rpzrecurse/ns3/named1.conf.in
@@ -36,6 +36,8 @@ options {
 	include "../dnsrps.conf";
 };
 
+trust-anchors { };
+
 zone "policy" { type primary; file "policy.db"; };
 
 zone "example.tld" { type primary; file "example.db"; };
diff --git a/bin/tests/system/rpzrecurse/ns3/named2.conf.in b/bin/tests/system/rpzrecurse/ns3/named2.conf.in
index 06b2536e80..2370b4371a 100644
--- a/bin/tests/system/rpzrecurse/ns3/named2.conf.in
+++ b/bin/tests/system/rpzrecurse/ns3/named2.conf.in
@@ -35,6 +35,8 @@ options {
 	include "../dnsrps.conf";
 };
 
+trust-anchors { };
+
 zone "policy" { type primary; file "policy.db"; };
 
 zone "example.tld" { type primary; file "example.db"; };
diff --git a/bin/tests/system/rpzrecurse/ns3/named3.conf.in b/bin/tests/system/rpzrecurse/ns3/named3.conf.in
index ac2e19cac0..af57689b9a 100644
--- a/bin/tests/system/rpzrecurse/ns3/named3.conf.in
+++ b/bin/tests/system/rpzrecurse/ns3/named3.conf.in
@@ -33,6 +33,8 @@ options {
 	include "../dnsrps.conf";
 };
 
+trust-anchors { };
+
 zone "policy" { type primary; file "policy.db"; };
 
 zone "example.tld" { type primary; file "example.db"; };
diff --git a/bin/tests/system/rrl/ns1/named.conf.in b/bin/tests/system/rrl/ns1/named.conf.in
index e4da6efcc9..a71e1ee215 100644
--- a/bin/tests/system/rrl/ns1/named.conf.in
+++ b/bin/tests/system/rrl/ns1/named.conf.in
@@ -25,4 +25,6 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "." {type primary; file "root.db";};
diff --git a/bin/tests/system/rrl/ns2/named.conf.in b/bin/tests/system/rrl/ns2/named.conf.in
index abe4f9cea3..298d37050a 100644
--- a/bin/tests/system/rrl/ns2/named.conf.in
+++ b/bin/tests/system/rrl/ns2/named.conf.in
@@ -36,6 +36,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/rrl/ns3/named.conf.in b/bin/tests/system/rrl/ns3/named.conf.in
index 8807f44b6e..4bc0d6fc4a 100644
--- a/bin/tests/system/rrl/ns3/named.conf.in
+++ b/bin/tests/system/rrl/ns3/named.conf.in
@@ -43,6 +43,8 @@ options {
 
 };
 
+trust-anchors { };
+
 zone "." { type hint; file "hints"; };
 
 zone "tld3."{ type primary; file "tld3.db"; };
diff --git a/bin/tests/system/rrl/ns4/named.conf.in b/bin/tests/system/rrl/ns4/named.conf.in
index 3cd598e63b..bb169f047d 100644
--- a/bin/tests/system/rrl/ns4/named.conf.in
+++ b/bin/tests/system/rrl/ns4/named.conf.in
@@ -38,6 +38,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/rrsetorder/ns3/named.conf.in b/bin/tests/system/rrsetorder/ns3/named.conf.in
index 807fa37820..cdab83ed24 100644
--- a/bin/tests/system/rrsetorder/ns3/named.conf.in
+++ b/bin/tests/system/rrsetorder/ns3/named.conf.in
@@ -32,6 +32,8 @@ options {
 	};
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/rrsetorder/ns4/named.conf.in b/bin/tests/system/rrsetorder/ns4/named.conf.in
index d5fc5274ae..5187aa8fb1 100644
--- a/bin/tests/system/rrsetorder/ns4/named.conf.in
+++ b/bin/tests/system/rrsetorder/ns4/named.conf.in
@@ -28,6 +28,8 @@ options {
 
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/rrsetorder/ns5/named.conf.in b/bin/tests/system/rrsetorder/ns5/named.conf.in
index c0836d320a..f7a2486ad6 100644
--- a/bin/tests/system/rrsetorder/ns5/named.conf.in
+++ b/bin/tests/system/rrsetorder/ns5/named.conf.in
@@ -24,6 +24,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "../../_common/root.hint";
diff --git a/bin/tests/system/statistics/ns2/named.conf.in b/bin/tests/system/statistics/ns2/named.conf.in
index 30c46518f8..877e26a16f 100644
--- a/bin/tests/system/statistics/ns2/named.conf.in
+++ b/bin/tests/system/statistics/ns2/named.conf.in
@@ -24,6 +24,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 statistics-channels {
 	inet 10.53.0.2 port @EXTRAPORT1@ allow { any; };
 };
diff --git a/bin/tests/system/statistics/ns3/named.conf.in b/bin/tests/system/statistics/ns3/named.conf.in
index 4cc712d46b..1726d1d381 100644
--- a/bin/tests/system/statistics/ns3/named.conf.in
+++ b/bin/tests/system/statistics/ns3/named.conf.in
@@ -27,6 +27,8 @@ options {
 	zone-statistics yes;
 };
 
+trust-anchors { };
+
 statistics-channels {
 	inet 10.53.0.3 port @EXTRAPORT1@ allow { any; };
 };
diff --git a/bin/tests/system/stress/ns3/named.conf.in b/bin/tests/system/stress/ns3/named.conf.in
index 13e54a54e4..c11aec2d48 100644
--- a/bin/tests/system/stress/ns3/named.conf.in
+++ b/bin/tests/system/stress/ns3/named.conf.in
@@ -26,6 +26,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/stress/ns4/named.conf.in b/bin/tests/system/stress/ns4/named.conf.in
index 26296f52bf..2dd2e50675 100644
--- a/bin/tests/system/stress/ns4/named.conf.in
+++ b/bin/tests/system/stress/ns4/named.conf.in
@@ -26,6 +26,8 @@ options {
 	notify yes;
 };
 
+trust-anchors { };
+
 zone "zone000000.example" {
 	type secondary;
 	file "zone000000.example.bk";
diff --git a/bin/tests/system/transport-acl/ns1/named.conf.in b/bin/tests/system/transport-acl/ns1/named.conf.in
index d2a941a7f2..a1b970fe2a 100644
--- a/bin/tests/system/transport-acl/ns1/named.conf.in
+++ b/bin/tests/system/transport-acl/ns1/named.conf.in
@@ -68,6 +68,8 @@ options {
 	tcp-initial-timeout 1200;
 };
 
+trust-anchors { };
+
 zone "example0" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-http-plain-proxy.conf.in b/bin/tests/system/transport-change/ns1/named-http-plain-proxy.conf.in
index 012b167ae3..374cd06a17 100644
--- a/bin/tests/system/transport-change/ns1/named-http-plain-proxy.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-http-plain-proxy.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-http-plain.conf.in b/bin/tests/system/transport-change/ns1/named-http-plain.conf.in
index 627742920b..5d4b88035a 100644
--- a/bin/tests/system/transport-change/ns1/named-http-plain.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-http-plain.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-https-proxy-encrypted.conf.in b/bin/tests/system/transport-change/ns1/named-https-proxy-encrypted.conf.in
index 8c28c26a8e..45108da9a0 100644
--- a/bin/tests/system/transport-change/ns1/named-https-proxy-encrypted.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-https-proxy-encrypted.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-https-proxy-plain.conf.in b/bin/tests/system/transport-change/ns1/named-https-proxy-plain.conf.in
index 7b5538ce0d..9001c43f45 100644
--- a/bin/tests/system/transport-change/ns1/named-https-proxy-plain.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-https-proxy-plain.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-https.conf.in b/bin/tests/system/transport-change/ns1/named-https.conf.in
index c24346e941..bce99f35ec 100644
--- a/bin/tests/system/transport-change/ns1/named-https.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-https.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-proxy.conf.in b/bin/tests/system/transport-change/ns1/named-proxy.conf.in
index 1b9fb684aa..ff549268d5 100644
--- a/bin/tests/system/transport-change/ns1/named-proxy.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-proxy.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-tls-proxy-encrypted.conf.in b/bin/tests/system/transport-change/ns1/named-tls-proxy-encrypted.conf.in
index 4183fb8a31..98c2bf48b9 100644
--- a/bin/tests/system/transport-change/ns1/named-tls-proxy-encrypted.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-tls-proxy-encrypted.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-tls-proxy-plain.conf.in b/bin/tests/system/transport-change/ns1/named-tls-proxy-plain.conf.in
index 8a283cb21b..20c829f018 100644
--- a/bin/tests/system/transport-change/ns1/named-tls-proxy-plain.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-tls-proxy-plain.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named-tls.conf.in b/bin/tests/system/transport-change/ns1/named-tls.conf.in
index 4bcc976173..a436768d6e 100644
--- a/bin/tests/system/transport-change/ns1/named-tls.conf.in
+++ b/bin/tests/system/transport-change/ns1/named-tls.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/transport-change/ns1/named.conf.in b/bin/tests/system/transport-change/ns1/named.conf.in
index 0ee7fc5d36..e594c6ef06 100644
--- a/bin/tests/system/transport-change/ns1/named.conf.in
+++ b/bin/tests/system/transport-change/ns1/named.conf.in
@@ -40,6 +40,8 @@ options {
 	allow-proxy-on { 10.53.0.1; fd92:7065:b8e:ffff::1; };
 };
 
+trust-anchors { };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/zero/ns3/named.conf.in b/bin/tests/system/zero/ns3/named.conf.in
index 7e0d1d7d16..025dcb46cb 100644
--- a/bin/tests/system/zero/ns3/named.conf.in
+++ b/bin/tests/system/zero/ns3/named.conf.in
@@ -24,6 +24,8 @@ options {
 	servfail-ttl 0;
 };
 
+trust-anchors { };
+
 zone "." {
 	type hint;
 	file "root.hint";
diff --git a/bin/tests/system/zero/ns4/named.conf.in b/bin/tests/system/zero/ns4/named.conf.in
index fc8fec6a5a..037a5e9e47 100644
--- a/bin/tests/system/zero/ns4/named.conf.in
+++ b/bin/tests/system/zero/ns4/named.conf.in
@@ -23,6 +23,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 zone "example" {
 	type secondary;
 	primaries { 10.53.0.2; };
diff --git a/bin/tests/system/zonechecks/ns1/named.conf.in b/bin/tests/system/zonechecks/ns1/named.conf.in
index 6821500147..f563b46d26 100644
--- a/bin/tests/system/zonechecks/ns1/named.conf.in
+++ b/bin/tests/system/zonechecks/ns1/named.conf.in
@@ -26,6 +26,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;
diff --git a/bin/tests/system/zonechecks/ns2/named.conf.in b/bin/tests/system/zonechecks/ns2/named.conf.in
index 5ecf68b56f..8385b5adc8 100644
--- a/bin/tests/system/zonechecks/ns2/named.conf.in
+++ b/bin/tests/system/zonechecks/ns2/named.conf.in
@@ -26,6 +26,8 @@ options {
 	dnssec-validation yes;
 };
 
+trust-anchors { };
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm @DEFAULT_HMAC@;