Adding upstream version 2.7.6.upstream/2.7.6 upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
author: Daniel Baumann <daniel.baumann@progress-linux.org> 2024-05-06 00:53:35 +0000
committer: Daniel Baumann <daniel.baumann@progress-linux.org> 2024-05-06 00:53:35 +0000
commit: 69c6a41ffb878ef98c9378ed4b1634a404cfaa7f (patch)
tree: b2a4f704565d62fbb129ab9dc3b35977c50e6e7f /tests/knot
parent: Initial commit. (diff)
download: knot-upstream/2.7.6.tar.xz
knot-upstream/2.7.6.zip
71 files changed, 7743 insertions, 0 deletions
diff --git a/tests/knot/semantic_check_data/cdnskey.cds b/tests/knot/semantic_check_data/cdnskey.cds
new file mode 100644
index 0000000..354ad81
--- /dev/null
+++ b/tests/knot/semantic_check_data/cdnskey.cds
@@ -0,0 +1,10 @@
+;; Zone dump (Knot DNS 2.5.0-dev)
+example.com.        	3600	SOA	dns2.example.com. hostmaster.example.com. 2010135808 10800 3600 1209600 7200
+example.com.        	3600	NS	dns2.example.com.
+example.com.        	3600	MX	10 mail.example.com.
+example.com.        	3600	DNSKEY	256 3 8 AwEAAdKraxDdGTL4HDOkXTDI1Md1UdHuYhVwYkB+u2umVjTJ1H9Qb2oBryqwXI+gklnuCqrH1znkDvzGEAeHRQUCbtKbjmqErTAcRRHW3D+6jsOGXzbyGCfbyzRBwsbNCLWr3ONpPi5JOWEeCUJfyc/mRXcmh5uYl1JvzAM1zprtljZt
+example.com.        	3600	DNSKEY	257 3 8 AwEAAcQ1EqTPebcJyUnpxO3Xjx6ehRtsiZYToARoJsJG12XR6Ci9yy4SCCsejtaWIFO4XVfM2BHzFWqmABtQHtN7AazXAFMLsrSE4DYbgk5WmnQv5Jloi6jhhmmXwr8EOi3HR2jdG0gVq/Tax7ztNNZsflJrs3rZs2TVO00BkyyOkmO35jCNbGPUwm5cW1vse137BMa7jAcMyNLPIiQubj1/mJcIyzF2duvfpjBTgEmSvNcXqLfYFjK8lG4NodQG8AcK0MvWqN4mxW/hK0U9nMSjhCnfzPg5tjyqdheWRyhkLGjM/mR7gBhtqoSPMr+2KMJQEHYAd/AP8YgaovS8N1fJyh0=
+example.com.        	3600	DNSKEY	257 3 8 AwEAAetE6qfN/GbtMmvM0PXUTyskauES2FKfjqLVz7EQlfS8iAFWLi1eHjHXDkueZ1OYRzQ4IBy6MIsce4XVXLQoS8njtfaU7c5NZvktH5la7JuH32KYr3PdWL5KDsUdED3GSxfNV+DbcYU80AZxTxy6Bm6EP+DztL1dpYrmqr8JRl+qlSbmLIrPemZFUEQzhiepcYMWviDUz+ixSVzjEzpMCLsrNxA30Ziiq9GKA8KKlFHdAmxuNcH0TzRndpo6bu5nKyJHiREIazHVuPBEzUmHtcWETCDs9UVsbji2Z2ozqLz9cqnfYV/kOD+OZBAqvZ0n/4lgdSiBtvByLCXoWEYIGRs=
+example.com.        	3600	CDNSKEY	257 3 8 AwEAAcQ1EqTPebcJyUnpxO3Xjx6ehRtsiZYToARoJsJG12XR6Ci9yy4SCCsejtaWIFO4XVfM2BHzFWqmABtQHtN7AazXAFMLsrSE4DYbgk5WmnQv5Jloi6jhhmmXwr8EOi3HR2jdG0gVq/Tax7ztNNZsflJrs3rZs2TVO00BkyyOkmO35jCNbGPUwm5cW1vse137BMa7jAcMyNLPIiQubj1/mJcIyzF2duvfpjBTgEmSvNcXqLfYFjK8lG4NodQG8AcK0MvWqN4mxW/hK0U9nMSjhCnfzPg5tjyqdheWRyhkLGjM/mR7gBhtqoSPMr+2KMJQEHYAd/AP8YgaovS8N1fJyh0=
+example.com.        	3600	CDS	53851 8 2 6F8129D687EC387C948E6F4B0AC9AA01481CCEBF7570AFEC582897E7725122D6
+dns2.example.com.   	3600	A	192.0.2.1
diff --git a/tests/knot/semantic_check_data/cdnskey.invalid b/tests/knot/semantic_check_data/cdnskey.invalid
new file mode 100644
index 0000000..9c971ab
--- /dev/null
+++ b/tests/knot/semantic_check_data/cdnskey.invalid
@@ -0,0 +1,10 @@
+;; Zone dump (Knot DNS 2.5.0-dev)
+example.com.        	3600	SOA	dns2.example.com. hostmaster.example.com. 2010135808 10800 3600 1209600 7200
+example.com.        	3600	NS	dns2.example.com.
+example.com.        	3600	MX	10 mail.example.com.
+example.com.        	3600	DNSKEY	256 3 8 AwEAAdKraxDdGTL4HDOkXTDI1Md1UdHuYhVwYkB+u2umVjTJ1H9Qb2oBryqwXI+gklnuCqrH1znkDvzGEAeHRQUCbtKbjmqErTAcRRHW3D+6jsOGXzbyGCfbyzRBwsbNCLWr3ONpPi5JOWEeCUJfyc/mRXcmh5uYl1JvzAM1zprtljZt
+example.com.        	3600	DNSKEY	257 3 8 AwEAAcQ1EqTPebcJyUnpxO3Xjx6ehRtsiZYToARoJsJG12XR6Ci9yy4SCCsejtaWIFO4XVfM2BHzFWqmABtQHtN7AazXAFMLsrSE4DYbgk5WmnQv5Jloi6jhhmmXwr8EOi3HR2jdG0gVq/Tax7ztNNZsflJrs3rZs2TVO00BkyyOkmO35jCNbGPUwm5cW1vse137BMa7jAcMyNLPIiQubj1/mJcIyzF2duvfpjBTgEmSvNcXqLfYFjK8lG4NodQG8AcK0MvWqN4mxW/hK0U9nMSjhCnfzPg5tjyqdheWRyhkLGjM/mR7gBhtqoSPMr+2KMJQEHYAd/AP8YgaovS8N1fJyh0=
+example.com.        	3600	DNSKEY	257 3 8 AwEAAetE6qfN/GbtMmvM0PXUTyskauES2FKfjqLVz7EQlfS8iAFWLi1eHjHXDkueZ1OYRzQ4IBy6MIsce4XVXLQoS8njtfaU7c5NZvktH5la7JuH32KYr3PdWL5KDsUdED3GSxfNV+DbcYU80AZxTxy6Bm6EP+DztL1dpYrmqr8JRl+qlSbmLIrPemZFUEQzhiepcYMWviDUz+ixSVzjEzpMCLsrNxA30Ziiq9GKA8KKlFHdAmxuNcH0TzRndpo6bu5nKyJHiREIazHVuPBEzUmHtcWETCDs9UVsbji2Z2ozqLz9cqnfYV/kOD+OZBAqvZ0n/4lgdSiBtvByLCXoWEYIGRs=
+example.com.        	3600	CDNSKEY	257 3 8 AwEAAcQ1EqTPebcJyUnpxO3Xjx6ehRtsiZYToARoJsJG12XR6Ci9yy4SCCsejtaWIFO4XVfM2BHzFWqmABtQHtN7AazXAFMLsrSE4DYbgk5WmnQv5Jloi6jhhmmXwr8EOi3HR2jdG0gVq/Tax7ztNNZsflJrs3rZs2TVO00BkyyOkmO35jCNbGPUwm5cW1vse137BMa7jAcMyNLPIiQubj1/mJcIyzF2duvfpjBTgEmSvNcXqLfYFjK8lG4NodQG8AcK0MvWqN4mxW/hK0U9nMSjhCnfzPg5tjyqdheWRyhkLGjM/mR7gBhtqoSPMr+2KMJQEHYAd/AP8YgaovS8N1fJyh0=
+example.com.        	3600	CDS	53851 8 2 668159D684EC387C948E6F4B0AC9AA01481CCEBF7570AFEC582897E7725122D6
+dns2.example.com.   	3600	A	192.0.2.1
diff --git a/tests/knot/semantic_check_data/cdnskey.invalid.param b/tests/knot/semantic_check_data/cdnskey.invalid.param
new file mode 100644
index 0000000..07f78db
--- /dev/null
+++ b/tests/knot/semantic_check_data/cdnskey.invalid.param
@@ -0,0 +1,10 @@
+;; Zone dump (Knot DNS 2.5.0-dev)
+example.com.        	3600	SOA	dns2.example.com. hostmaster.example.com. 2010135808 10800 3600 1209600 7200
+example.com.        	3600	NS	dns2.example.com.
+example.com.        	3600	MX	10 mail.example.com.
+example.com.        	3600	DNSKEY	256 3 8 AwEAAdKraxDdGTL4HDOkXTDI1Md1UdHuYhVwYkB+u2umVjTJ1H9Qb2oBryqwXI+gklnuCqrH1znkDvzGEAeHRQUCbtKbjmqErTAcRRHW3D+6jsOGXzbyGCfbyzRBwsbNCLWr3ONpPi5JOWEeCUJfyc/mRXcmh5uYl1JvzAM1zprtljZt
+example.com.        	3600	DNSKEY	257 3 8 AwEAAcQ1EqTPebcJyUnpxO3Xjx6ehRtsiZYToARoJsJG12XR6Ci9yy4SCCsejtaWIFO4XVfM2BHzFWqmABtQHtN7AazXAFMLsrSE4DYbgk5WmnQv5Jloi6jhhmmXwr8EOi3HR2jdG0gVq/Tax7ztNNZsflJrs3rZs2TVO00BkyyOkmO35jCNbGPUwm5cW1vse137BMa7jAcMyNLPIiQubj1/mJcIyzF2duvfpjBTgEmSvNcXqLfYFjK8lG4NodQG8AcK0MvWqN4mxW/hK0U9nMSjhCnfzPg5tjyqdheWRyhkLGjM/mR7gBhtqoSPMr+2KMJQEHYAd/AP8YgaovS8N1fJyh0=
+example.com.        	3600	DNSKEY	257 3 8 AwEAAetE6qfN/GbtMmvM0PXUTyskauES2FKfjqLVz7EQlfS8iAFWLi1eHjHXDkueZ1OYRzQ4IBy6MIsce4XVXLQoS8njtfaU7c5NZvktH5la7JuH32KYr3PdWL5KDsUdED3GSxfNV+DbcYU80AZxTxy6Bm6EP+DztL1dpYrmqr8JRl+qlSbmLIrPemZFUEQzhiepcYMWviDUz+ixSVzjEzpMCLsrNxA30Ziiq9GKA8KKlFHdAmxuNcH0TzRndpo6bu5nKyJHiREIazHVuPBEzUmHtcWETCDs9UVsbji2Z2ozqLz9cqnfYV/kOD+OZBAqvZ0n/4lgdSiBtvByLCXoWEYIGRs=
+example.com.        	3600	CDNSKEY	257 3 8 AwEAAcQ1EqTPebcJyUnpxO3Xjx6ehRtsiZYToARoJsJG12XR6Ci9yy4SCCsejtaWIFO4XVfM2BHzFWqmABtQHtN7AazXAFMLsrSE4DYbgk5WmnQv5Jloi6jhhmmXwr8EOi3HR2jdG0gVq/Tax7ztNNZsflJrs3rZs2TVO00BkyyOkmO35jCNbGPUwm5cW1vse137BMa7jAcMyNLPIiQubj1/mJcIyzF2duvfpjBTgEmSvNcXqLfYFjK8lG4NodQG8AcK0MvWqN4mxW/hK0U9nMSjhCnfzPg5tjyqdheWRyhkLGjM/mR7gBhtqoSPMr+2KMJQEHYAd/AP8YgaovS8N1fJyh0=
+example.com.        	3600	CDS	53851 4 2 6F8129D687EC387C948E6F4B0AC9AA01481CCEBF7570AFEC582897E7725122D6
+dns2.example.com.   	3600	A	192.0.2.1
diff --git a/tests/knot/semantic_check_data/cdnskey.nocdnskey b/tests/knot/semantic_check_data/cdnskey.nocdnskey
new file mode 100644
index 0000000..40c3096
--- /dev/null
+++ b/tests/knot/semantic_check_data/cdnskey.nocdnskey
@@ -0,0 +1,9 @@
+;; Zone dump (Knot DNS 2.5.0-dev)
+example.com.        	3600	SOA	dns2.example.com. hostmaster.example.com. 2010135808 10800 3600 1209600 7200
+example.com.        	3600	NS	dns2.example.com.
+example.com.        	3600	MX	10 mail.example.com.
+example.com.        	3600	DNSKEY	256 3 8 AwEAAdKraxDdGTL4HDOkXTDI1Md1UdHuYhVwYkB+u2umVjTJ1H9Qb2oBryqwXI+gklnuCqrH1znkDvzGEAeHRQUCbtKbjmqErTAcRRHW3D+6jsOGXzbyGCfbyzRBwsbNCLWr3ONpPi5JOWEeCUJfyc/mRXcmh5uYl1JvzAM1zprtljZt
+example.com.        	3600	DNSKEY	257 3 8 AwEAAcQ1EqTPebcJyUnpxO3Xjx6ehRtsiZYToARoJsJG12XR6Ci9yy4SCCsejtaWIFO4XVfM2BHzFWqmABtQHtN7AazXAFMLsrSE4DYbgk5WmnQv5Jloi6jhhmmXwr8EOi3HR2jdG0gVq/Tax7ztNNZsflJrs3rZs2TVO00BkyyOkmO35jCNbGPUwm5cW1vse137BMa7jAcMyNLPIiQubj1/mJcIyzF2duvfpjBTgEmSvNcXqLfYFjK8lG4NodQG8AcK0MvWqN4mxW/hK0U9nMSjhCnfzPg5tjyqdheWRyhkLGjM/mR7gBhtqoSPMr+2KMJQEHYAd/AP8YgaovS8N1fJyh0=
+example.com.        	3600	DNSKEY	257 3 8 AwEAAetE6qfN/GbtMmvM0PXUTyskauES2FKfjqLVz7EQlfS8iAFWLi1eHjHXDkueZ1OYRzQ4IBy6MIsce4XVXLQoS8njtfaU7c5NZvktH5la7JuH32KYr3PdWL5KDsUdED3GSxfNV+DbcYU80AZxTxy6Bm6EP+DztL1dpYrmqr8JRl+qlSbmLIrPemZFUEQzhiepcYMWviDUz+ixSVzjEzpMCLsrNxA30Ziiq9GKA8KKlFHdAmxuNcH0TzRndpo6bu5nKyJHiREIazHVuPBEzUmHtcWETCDs9UVsbji2Z2ozqLz9cqnfYV/kOD+OZBAqvZ0n/4lgdSiBtvByLCXoWEYIGRs=
+example.com.        	3600	CDS	53851 8 2 6F8129D687EC387C948E6F4B0AC9AA01481CCEBF7570AFEC582897E7725122D6
+dns2.example.com.   	3600	A	192.0.2.1
diff --git a/tests/knot/semantic_check_data/cdnskey.nocds b/tests/knot/semantic_check_data/cdnskey.nocds
new file mode 100644
index 0000000..8966caf
--- /dev/null
+++ b/tests/knot/semantic_check_data/cdnskey.nocds
@@ -0,0 +1,9 @@
+;; Zone dump (Knot DNS 2.5.0-dev)
+example.com.        	3600	SOA	dns2.example.com. hostmaster.example.com. 2010135808 10800 3600 1209600 7200
+example.com.        	3600	NS	dns2.example.com.
+example.com.        	3600	MX	10 mail.example.com.
+example.com.        	3600	DNSKEY	256 3 8 AwEAAdKraxDdGTL4HDOkXTDI1Md1UdHuYhVwYkB+u2umVjTJ1H9Qb2oBryqwXI+gklnuCqrH1znkDvzGEAeHRQUCbtKbjmqErTAcRRHW3D+6jsOGXzbyGCfbyzRBwsbNCLWr3ONpPi5JOWEeCUJfyc/mRXcmh5uYl1JvzAM1zprtljZt
+example.com.        	3600	DNSKEY	257 3 8 AwEAAcQ1EqTPebcJyUnpxO3Xjx6ehRtsiZYToARoJsJG12XR6Ci9yy4SCCsejtaWIFO4XVfM2BHzFWqmABtQHtN7AazXAFMLsrSE4DYbgk5WmnQv5Jloi6jhhmmXwr8EOi3HR2jdG0gVq/Tax7ztNNZsflJrs3rZs2TVO00BkyyOkmO35jCNbGPUwm5cW1vse137BMa7jAcMyNLPIiQubj1/mJcIyzF2duvfpjBTgEmSvNcXqLfYFjK8lG4NodQG8AcK0MvWqN4mxW/hK0U9nMSjhCnfzPg5tjyqdheWRyhkLGjM/mR7gBhtqoSPMr+2KMJQEHYAd/AP8YgaovS8N1fJyh0=
+example.com.        	3600	DNSKEY	257 3 8 AwEAAetE6qfN/GbtMmvM0PXUTyskauES2FKfjqLVz7EQlfS8iAFWLi1eHjHXDkueZ1OYRzQ4IBy6MIsce4XVXLQoS8njtfaU7c5NZvktH5la7JuH32KYr3PdWL5KDsUdED3GSxfNV+DbcYU80AZxTxy6Bm6EP+DztL1dpYrmqr8JRl+qlSbmLIrPemZFUEQzhiepcYMWviDUz+ixSVzjEzpMCLsrNxA30Ziiq9GKA8KKlFHdAmxuNcH0TzRndpo6bu5nKyJHiREIazHVuPBEzUmHtcWETCDs9UVsbji2Z2ozqLz9cqnfYV/kOD+OZBAqvZ0n/4lgdSiBtvByLCXoWEYIGRs=
+example.com.        	3600	CDNSKEY	257 3 8 AwEAAcQ1EqTPebcJyUnpxO3Xjx6ehRtsiZYToARoJsJG12XR6Ci9yy4SCCsejtaWIFO4XVfM2BHzFWqmABtQHtN7AazXAFMLsrSE4DYbgk5WmnQv5Jloi6jhhmmXwr8EOi3HR2jdG0gVq/Tax7ztNNZsflJrs3rZs2TVO00BkyyOkmO35jCNbGPUwm5cW1vse137BMa7jAcMyNLPIiQubj1/mJcIyzF2duvfpjBTgEmSvNcXqLfYFjK8lG4NodQG8AcK0MvWqN4mxW/hK0U9nMSjhCnfzPg5tjyqdheWRyhkLGjM/mR7gBhtqoSPMr+2KMJQEHYAd/AP8YgaovS8N1fJyh0=
+dns2.example.com.   	3600	A	192.0.2.1
diff --git a/tests/knot/semantic_check_data/cdnskey.nodnskey b/tests/knot/semantic_check_data/cdnskey.nodnskey
new file mode 100644
index 0000000..8f8e458
--- /dev/null
+++ b/tests/knot/semantic_check_data/cdnskey.nodnskey
@@ -0,0 +1,9 @@
+;; Zone dump (Knot DNS 2.5.0-dev)
+example.com.        	3600	SOA	dns2.example.com. hostmaster.example.com. 2010135808 10800 3600 1209600 7200
+example.com.        	3600	NS	dns2.example.com.
+example.com.        	3600	MX	10 mail.example.com.
+example.com.        	3600	DNSKEY	256 3 8 AwEAAdKraxDdGTL4HDOkXTDI1Md1UdHuYhVwYkB+u2umVjTJ1H9Qb2oBryqwXI+gklnuCqrH1znkDvzGEAeHRQUCbtKbjmqErTAcRRHW3D+6jsOGXzbyGCfbyzRBwsbNCLWr3ONpPi5JOWEeCUJfyc/mRXcmh5uYl1JvzAM1zprtljZt
+example.com.        	3600	DNSKEY	257 3 8 AwEAAetE6qfN/GbtMmvM0PXUTyskauES2FKfjqLVz7EQlfS8iAFWLi1eHjHXDkueZ1OYRzQ4IBy6MIsce4XVXLQoS8njtfaU7c5NZvktH5la7JuH32KYr3PdWL5KDsUdED3GSxfNV+DbcYU80AZxTxy6Bm6EP+DztL1dpYrmqr8JRl+qlSbmLIrPemZFUEQzhiepcYMWviDUz+ixSVzjEzpMCLsrNxA30Ziiq9GKA8KKlFHdAmxuNcH0TzRndpo6bu5nKyJHiREIazHVuPBEzUmHtcWETCDs9UVsbji2Z2ozqLz9cqnfYV/kOD+OZBAqvZ0n/4lgdSiBtvByLCXoWEYIGRs=
+example.com.        	3600	CDNSKEY	257 3 8 AwEAAcQ1EqTPebcJyUnpxO3Xjx6ehRtsiZYToARoJsJG12XR6Ci9yy4SCCsejtaWIFO4XVfM2BHzFWqmABtQHtN7AazXAFMLsrSE4DYbgk5WmnQv5Jloi6jhhmmXwr8EOi3HR2jdG0gVq/Tax7ztNNZsflJrs3rZs2TVO00BkyyOkmO35jCNbGPUwm5cW1vse137BMa7jAcMyNLPIiQubj1/mJcIyzF2duvfpjBTgEmSvNcXqLfYFjK8lG4NodQG8AcK0MvWqN4mxW/hK0U9nMSjhCnfzPg5tjyqdheWRyhkLGjM/mR7gBhtqoSPMr+2KMJQEHYAd/AP8YgaovS8N1fJyh0=
+example.com.        	3600	CDS	53851 8 2 6F8129D687EC387C948E6F4B0AC9AA01481CCEBF7570AFEC582897E7725122D6
+dns2.example.com.   	3600	A	192.0.2.1
diff --git a/tests/knot/semantic_check_data/cdnskey.two b/tests/knot/semantic_check_data/cdnskey.two
new file mode 100644
index 0000000..81c4a1f
--- /dev/null
+++ b/tests/knot/semantic_check_data/cdnskey.two
@@ -0,0 +1,13 @@
+;; Zone dump (Knot DNS 2.5.0-dev)
+example.com.        	3600	SOA	dns2.example.com. hostmaster.example.com. 2010135808 10800 3600 1209600 7200
+example.com.        	3600	NS	dns2.example.com.
+example.com.        	3600	MX	10 mail.example.com.
+example.com.        	3600	DNSKEY	256 3 8 AwEAAdKraxDdGTL4HDOkXTDI1Md1UdHuYhVwYkB+u2umVjTJ1H9Qb2oBryqwXI+gklnuCqrH1znkDvzGEAeHRQUCbtKbjmqErTAcRRHW3D+6jsOGXzbyGCfbyzRBwsbNCLWr3ONpPi5JOWEeCUJfyc/mRXcmh5uYl1JvzAM1zprtljZt
+example.com.        	3600	DNSKEY	257 3 8 AwEAAcQ1EqTPebcJyUnpxO3Xjx6ehRtsiZYToARoJsJG12XR6Ci9yy4SCCsejtaWIFO4XVfM2BHzFWqmABtQHtN7AazXAFMLsrSE4DYbgk5WmnQv5Jloi6jhhmmXwr8EOi3HR2jdG0gVq/Tax7ztNNZsflJrs3rZs2TVO00BkyyOkmO35jCNbGPUwm5cW1vse137BMa7jAcMyNLPIiQubj1/mJcIyzF2duvfpjBTgEmSvNcXqLfYFjK8lG4NodQG8AcK0MvWqN4mxW/hK0U9nMSjhCnfzPg5tjyqdheWRyhkLGjM/mR7gBhtqoSPMr+2KMJQEHYAd/AP8YgaovS8N1fJyh0=
+example.com.        	3600	DNSKEY	257 3 8 AwEAAetE6qfN/GbtMmvM0PXUTyskauES2FKfjqLVz7EQlfS8iAFWLi1eHjHXDkueZ1OYRzQ4IBy6MIsce4XVXLQoS8njtfaU7c5NZvktH5la7JuH32KYr3PdWL5KDsUdED3GSxfNV+DbcYU80AZxTxy6Bm6EP+DztL1dpYrmqr8JRl+qlSbmLIrPemZFUEQzhiepcYMWviDUz+ixSVzjEzpMCLsrNxA30Ziiq9GKA8KKlFHdAmxuNcH0TzRndpo6bu5nKyJHiREIazHVuPBEzUmHtcWETCDs9UVsbji2Z2ozqLz9cqnfYV/kOD+OZBAqvZ0n/4lgdSiBtvByLCXoWEYIGRs=
+example.com.        	3600	CDNSKEY	257 3 8 AwEAAcQ1EqTPebcJyUnpxO3Xjx6ehRtsiZYToARoJsJG12XR6Ci9yy4SCCsejtaWIFO4XVfM2BHzFWqmABtQHtN7AazXAFMLsrSE4DYbgk5WmnQv5Jloi6jhhmmXwr8EOi3HR2jdG0gVq/Tax7ztNNZsflJrs3rZs2TVO00BkyyOkmO35jCNbGPUwm5cW1vse137BMa7jAcMyNLPIiQubj1/mJcIyzF2duvfpjBTgEmSvNcXqLfYFjK8lG4NodQG8AcK0MvWqN4mxW/hK0U9nMSjhCnfzPg5tjyqdheWRyhkLGjM/mR7gBhtqoSPMr+2KMJQEHYAd/AP8YgaovS8N1fJyh0=
+example.com.        	3600	CDNSKEY	257 3 8 AwEAAetE6qfN/GbtMmvM0PXUTyskauES2FKfjqLVz7EQlfS8iAFWLi1eHjHXDkueZ1OYRzQ4IBy6MIsce4XVXLQoS8njtfaU7c5NZvktH5la7JuH32KYr3PdWL5KDsUdED3GSxfNV+DbcYU80AZxTxy6Bm6EP+DztL1dpYrmqr8JRl+qlSbmLIrPemZFUEQzhiepcYMWviDUz+ixSVzjEzpMCLsrNxA30Ziiq9GKA8KKlFHdAmxuNcH0TzRndpo6bu5nKyJHiREIazHVuPBEzUmHtcWETCDs9UVsbji2Z2ozqLz9cqnfYV/kOD+OZBAqvZ0n/4lgdSiBtvByLCXoWEYIGRs=
+
+example.com.        	3600	CDS	53851 8 2 6F8129D687EC387C948E6F4B0AC9AA01481CCEBF7570AFEC582897E7725122D6
+example.com.        	3600	CDS	53852 8 2 6F8129D687EC387C948E6F4B0AC9AA01481CCEBF7570AFEC582897E7725122D6
+dns2.example.com.   	3600	A	192.0.2.1
diff --git a/tests/knot/semantic_check_data/cname_extra_01.zone b/tests/knot/semantic_check_data/cname_extra_01.zone
new file mode 100644
index 0000000..ae3f27a
--- /dev/null
+++ b/tests/knot/semantic_check_data/cname_extra_01.zone
@@ -0,0 +1,18 @@
+$ORIGIN example.com.
+$TTL 3600
+
+@	IN	SOA	dns1.example.com. hostmaster.example.com. (
+		2010111218	; serial
+		6h		; refresh
+		1h		; retry
+		1w		; expire
+		1d )		; minimum
+
+	NS	dns1
+	MX	10 mail
+
+dns1	A	192.0.2.1
+
+; error CNAME, node contains other records
+email	CNAME	mail
+	A	192.0.2.2
diff --git a/tests/knot/semantic_check_data/cname_extra_02.signed b/tests/knot/semantic_check_data/cname_extra_02.signed
new file mode 100644
index 0000000..724a8da
--- /dev/null
+++ b/tests/knot/semantic_check_data/cname_extra_02.signed
@@ -0,0 +1,76 @@
+email.example.com.	3600	IN CNAME mail.example.com.
+			3600	RRSIG	CNAME 7 3 3600 (
+					20840201000000 20160224073150 29600 example.com.
+					IxkF8oqOEzhlZDSRBIi4448EGvQwxm0QDFE3
+					JExA4Byx2QaJvXo8LoCeyQxS/f9E6bXpXQk2
+					4dgQxUrRZqnKEA== )
+			86400	NSEC	example.com. CNAME RRSIG NSEC A
+			86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224073150 29600 example.com.
+					iKA+5qsYA7A7JN7Df99aJnToYESjqordQgVj
+					yMS/1RVBYEGE4y3ggehzAxvc8bsNYnUwGeGt
+					vse5dMVKCcIaPA== )
+; CNAME extra record A
+email.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224073150 29600 example.com.
+					DummySignatureDEADBEEFToYESjqordQgVj
+					yMS/1RVBYEGE4y3ggehzAxvc8bsNYnUwGeGt
+					vse5dMVKCcIaPA== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160224073150 29600 example.com.
+					MT+QgXcsDzkrFgncNwFyH8lwXiOTpj1rnPgs
+					OUIOfIhyJyzT1hpozAHt+IWOPHUkKjBN1C5y
+					SwyTnlqwJtG0yw== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160224073150 29600 example.com.
+					Mr0Gu7PUu9PsUBflhd8tMhcQ9+ve+z561/ml
+					kP6PL0MHgLg7V8KVmL2tc7+JAhSOVSpJ4BGQ
+					c9HKD15lFDFEgw== )
+			86400	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+			86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160224073150 29600 example.com.
+					oEMpoEhi86OM/SdyobPEh90zF3c3FhOgv68j
+					paD5BLUsAntf3qU+KoIMb9iVglp+VTGrg0Ol
+					XdJ2D/xSMA+XHA== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224073150 29600 example.com.
+					WOtx+LBKbS2MOahlpDJMqgeH1TI5dZoQitmA
+					SOkDRlJgfPsiKeiaGMrnWN9xnPZOVr9MsInE
+					sKYjh6EZM1nuBQ== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224073150 31323 example.com.
+					nL4eJLv62C56wexu10DMPHqXCXSE/3vRe4es
+					4e0e1CkY9bdj+LgLfgs7CH7UDNXFX2CxKxHd
+					mL4sp5AtaA8fnQ== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224073150 29600 example.com.
+					nn2dG+ORbcNQWHT87ijfOddx0SKCSE+8hAxt
+					SiQQpxAzPw13CZmnbYas8uvFFtth6U689V3h
+					rMzzZcxQEA1z8w== )
+			86400	NSEC	email.example.com. A RRSIG NSEC
+			86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224073150 29600 example.com.
+					BFz1Z7dbBNgHXDOaufuCoIzGHbwyLUrA+Wad
+					QBPD9xCYkXHoHfvVOhtEeMR19Rz+fi6ottJI
+					4AWItiobBC/DAQ== )
diff --git a/tests/knot/semantic_check_data/cname_multiple.zone b/tests/knot/semantic_check_data/cname_multiple.zone
new file mode 100644
index 0000000..971c34f
--- /dev/null
+++ b/tests/knot/semantic_check_data/cname_multiple.zone
@@ -0,0 +1,15 @@
+$ORIGIN example.com.
+$TTL 3600
+
+@	IN	SOA	dns1.example.com. hostmaster.example.com. (
+		2010111214	; serial
+		6h		; refresh
+		1h		; retry
+		1w		; expire
+		1d )		; minimum
+	NS	dns1
+
+dns1	A	192.0.2.1
+
+email	CNAME	mail
+email	CNAME	mail2
diff --git a/tests/knot/semantic_check_data/different_signer_name.signed b/tests/knot/semantic_check_data/different_signer_name.signed
new file mode 100644
index 0000000..60a7f08
--- /dev/null
+++ b/tests/knot/semantic_check_data/different_signer_name.signed
@@ -0,0 +1,58 @@
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224081051 29600 example.com.
+					fEcJTvz6hu2rhfrdc/pS2/P/OWhq1dZhnUGS
+					6+bamvMIqfNuYasJzeMZp1zneEETiMf7h+0E
+					cdmHKHKdVTukCA== )
+			86400	NSEC	example.com. A RRSIG NSEC
+; different signer name in RRSIG
+			86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224081051 29600 different.com.
+					V6veOuBzm7n82hwIBbln9lY3pxKR/h8d7okC
+					deEeaF6jpDt8aoTJjo0UbtEJJwBNKARKfe4F
+					9U0NVIL0HnN2/Q== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160224081051 29600 example.com.
+					Pej4N9K4S9PA8wV0Ks6KtqAblfd05eRmv8T9
+					fBnR8V3vCtYONryKOP3cFlMXr2quWDCh5iwF
+					CQU98zle4CI9fg== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160224081051 29600 example.com.
+					UY1XRRhfD6a9xOm/+FsAo2/uYG/HRWR4k33B
+					amre+LBqabcXm9qX8wOU2W1h/sK/v8WFRjIn
+					dnCCjY/iwixfGg== )
+			86400	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+			86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160224081051 29600 example.com.
+					IWxMxnZfLFFrQ3xOujrKKedNvIiIXN9QCL/G
+					Y615FWxxQcufNEZmlRILStAKtVsRJTFSInBP
+					NoTix1W8vttyeA== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224081051 29600 example.com.
+					dA9WweUpYtqqCm18zk+Jv3Md7WtVlXuvSeX3
+					5IHmbezmlzrPpHBs+gWdD6bnGwlRRcea7FkS
+					u0Nt96PkXVuXPA== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224081051 31323 example.com.
+					nvruQZ5cZZ9+/I6wAh5AjWlxomueuuFiFoZe
+					XYBFmB+VH+eWpWL2Lp4hgaQ6UyKaHAKqtzMC
+					pqVA7Vwz4HEftQ== )
diff --git a/tests/knot/semantic_check_data/dname_apex_nsec3.signed b/tests/knot/semantic_check_data/dname_apex_nsec3.signed
new file mode 100644
index 0000000..287fe35
--- /dev/null
+++ b/tests/knot/semantic_check_data/dname_apex_nsec3.signed
@@ -0,0 +1,23 @@
+;; Zone dump (Knot DNS 2.6.0)
+example.com.        	3600	SOA	dns1.com. hostmaster.com. 2010111216 21600 3600 604800 86400
+example.com.        	3600	NS	dns1.com.
+example.com.        	3600	DNAME	bar.example.com.
+example.com.        	0	CDNSKEY	257 3 13 p3J5T0YFTf9IGjHFhS5oFGGBDOjs25Tz29eT5sAK7WxXoapa4Vw3C9zBH/BdDH1RmeUR6OHPY1+x2NiouNm05g==
+example.com.        	0	CDS	2073 13 2 B345AF792A41656301EC57A4CE7E03C02A5E3C8F422FAB2FCD67C25649DB1285
+example.com.        	3600	DNSKEY	256 3 13 UthmrB0FXNo/yZ3N0cnG/OJxG0FR7CT6KadbK4n22rMzfwq87jnobJ0xOpC7aEpGgDbypR0rK+KIAbRv4Prfeg==
+example.com.        	3600	DNSKEY	257 3 13 p3J5T0YFTf9IGjHFhS5oFGGBDOjs25Tz29eT5sAK7WxXoapa4Vw3C9zBH/BdDH1RmeUR6OHPY1+x2NiouNm05g==
+example.com.        	0	NSEC3PARAM	1 0 10 90E4D95759B9FB50
+;; DNSSEC signatures
+example.com.        	3600	RRSIG	NS 13 2 3600 20670924135857 20171006122857 46856 example.com. I2YeGSYvj56eHe7bkbnOpziu18gAdwMGEH5ZAGiuZzL37M2lRB/2rtAxWpxP1G1+idFXahAx6q2X5pK1o/yZWQ==
+example.com.        	3600	RRSIG	SOA 13 2 3600 20670924135857 20171006122857 46856 example.com. NULugLRW6r+y6AAJS2tcFt5BBWJMMxq3q0wvYirSvzzt5A6vwWC2ocJ2A2kftoDrIQWYHl1ppsxHTMsvw3NKfQ==
+example.com.        	3600	RRSIG	DNAME 13 2 3600 20670924135857 20171006122857 46856 example.com. PhUAnuLYFE3ySc9mMoExr+WoGf6it4/571GhjYyhgfUWQs1pE8WJismYG9NFle6Q3OlmDJSEWQwHBHxQmOeyKw==
+example.com.        	3600	RRSIG	DNSKEY 13 2 3600 20670924135857 20171006122857 2073 example.com. ZnhiPDiX/3RUW5rdLO8pKcIe+orbYloDD1mxhmfvfJ52IGdCV+okDu2M559pUB8Ihb/6H9DDl1qO5lTVGpVEMg==
+example.com.        	0	RRSIG	NSEC3PARAM 13 2 0 20670924135857 20171006122857 46856 example.com. DxyzDQGkONU+NTxBswKZRWc3kPQxH929PaD5S4g6MoH6EJ/X52mb5om0oXpXLuOTEo2Cij8c3aghLN2h3eiw5Q==
+example.com.        	0	RRSIG	CDS 13 2 0 20670924135857 20171006122857 46856 example.com. 8tPTolSZPvZUSpIs+nb4x/QRrNFgZG0jqqWWnQH8zy3CRS4L91SU5Z08aVz632n35toWv+uqG8LXI0sLKm6M4g==
+example.com.        	0	RRSIG	CDNSKEY 13 2 0 20670924135857 20171006122857 46856 example.com. 80MTgMHXqc8Eb+3LPjl9fJ6sjNR40MPVKUfD/Qw0mzWHjz8ZOUDxNZViHnmyoz4JoorrO5b2yAx+ojpt+FyQLg==
+;; DNSSEC NSEC3 chain
+9sq7g935u0bb7md3rn34uh1aknnjhf1k.example.com. 86400	NSEC3	1 0 10 90E4D95759B9FB50 9SQ7G935U0BB7MD3RN34UH1AKNNJHF1K NS SOA DNAME RRSIG DNSKEY NSEC3PARAM CDS CDNSKEY
+;; DNSSEC NSEC3 signatures
+9sq7g935u0bb7md3rn34uh1aknnjhf1k.example.com. 86400	RRSIG	NSEC3 13 3 86400 20670924135857 20171006122857 46856 example.com. sFlwNYgq6HoBDlXp9vC0Ck5uJ76rJyf4zfdQmTnJ8aB/44XvDoQ+tGIn4ilVN2SxzyT1A4c/nWOyMMCVhjXARg==
+;; Written 17 records
+;; Time 2017-10-06 15:58:57 CEST
diff --git a/tests/knot/semantic_check_data/dname_children.zone b/tests/knot/semantic_check_data/dname_children.zone
new file mode 100644
index 0000000..5758833
--- /dev/null
+++ b/tests/knot/semantic_check_data/dname_children.zone
@@ -0,0 +1,16 @@
+$ORIGIN example.com.
+$TTL 3600
+
+@	IN	SOA	dns1.example.com. hostmaster.example.com. (
+		2010111214	; serial
+		6h		; refresh
+		1h		; retry
+		1w		; expire
+		1d )		; minimum
+	NS	dns1
+
+dns1	A	192.0.2.1
+	AAAA	2001:DB8::1
+
+foo	DNAME	bar
+bar.foo	A	192.0.0.1
diff --git a/tests/knot/semantic_check_data/dnskey_param_error.signed b/tests/knot/semantic_check_data/dnskey_param_error.signed
new file mode 100644
index 0000000..1a2e936
--- /dev/null
+++ b/tests/knot/semantic_check_data/dnskey_param_error.signed
@@ -0,0 +1,70 @@
+; Zone without any semantic error
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					W9EprjaR4loSnNW96h4rLsquPDw3LHYvD05k
+					djkQofHSkMNZAJ7Q+eA3Fs2ik5fnJFM7wi5C
+					MtFsV2TfqMJFmg== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					I9Je1S7XhZIW9C0fWE8NwFLC2rhHklddNYBO
+					dxVKL/lxENU4jPPBwZBGrcYn2WVHgkIzjG0n
+					EOHONAgRFPi3Xw== )
+			3600	DNSKEY	1 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 5 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					vO2UQiTN/CNUZOmSEg8kJlR/UqiAZHc4qMwj
+					9u31sbPmOMuni+ZGuVCFFoEMtZerIkkQowkB
+					sXJFkvCP5oF2rA== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160229083110 31323 example.com.
+					Z+aaLu4rmzekfhlj6A0ClREloRi8MloRHf/3
+					Dlw/RYY1hrOCfcZKEY6AXeVdUwESEsSkSOco
+					CbhyGHH10dKAAg== )
+			0	NSEC3PARAM 1 0 10 -
+			0	RRSIG	NSEC3PARAM 7 2 0 (
+					20840201000000 20160229083110 29600 example.com.
+					d69kc52VdALI8fbdbflsVsltc1m7bI6QsJ5U
+					IDE9fy5VqcufZecZMKuozPDuF2vBA8ADFIRU
+					OfYgKs6YNIOLWg== )
+deleg.example.com.	3600	IN NS	deleg.example.com.
+			3600	A	192.0.2.1
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400 IN NSEC3 1 1 10 - (
+					UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A
+					A RRSIG )
+			86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160229083110 29600 example.com.
+					D24JCtCcNzwsY1FXVliAjxMm+x95N2eUTXn0
+					M8NK5glSk1yLtnAUKzHxpRExAJLGUiaG4yPu
+					2yGZuqwNvJztzw== )
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400 IN NSEC3 1 0 10 - (
+					20G1GOL477RO51RK9A9NFD54TFQAL7IQ
+					NS SOA RRSIG DNSKEY NSEC3PARAM )
+			86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160229083110 29600 example.com.
+					F7y+xW/C7iICgmZeYrF4e7Yx4kWZAZPAMzlu
+					PtWVuf37ySg1VfEWcQcDP04vF2rXVUqSMEcj
+					bqUVN5W8Hoazxw== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					MoYrL/lToC4AHo6KCZRiBRmCMWHUAx2Xt32A
+					P4lDpwA+wiBWkCZSfVTh60AosS/BIGtBb2BK
+					mszMx8CLBvkjRg== )
diff --git a/tests/knot/semantic_check_data/duplicate.signature b/tests/knot/semantic_check_data/duplicate.signature
new file mode 100644
index 0000000..77bf21f
--- /dev/null
+++ b/tests/knot/semantic_check_data/duplicate.signature
@@ -0,0 +1,19 @@
+;; Zone dump (Knot DNS 2.5.0-dev)
+example.com.        	3600	SOA	dns1.example.com. hostmaster.example.com. 2010112269 10800 3600 1209600 7200
+example.com.        	3600	NS	dns1.example.com.
+example.com.        	3600	DNSKEY	256 3 7 AwEAAd0e6EjJ0PgChDpbjB9QtvJ0ZqwKC/j7wlEOOB9owqefH/taZ37w6QR8Ysvvv2058AflDcCP3qlaOXp+ogq7AhayA+K4kc/UQyTPCe2jXKlX9IB0KAsr8nO9UEXzjYuyBw80Ry86Xxmj7OGYRu8eRm3ruOjVJy8hCrEQ7680an303Iu3Ixnmo8lPTPPMg4dbFXZ/RW6Sanrr/Sy6fre87XY58yywqX9lZOh5eqBeZG9WvU/HycrDkx5AcwD5etVk98tVTnofShY34ePZWDmRHEtvBpMzNObdomgM5we+DawC6P+Z8PFeGz+OgN7WVzkjm+MmYAk1aIeLQyNIE8SyMts=
+example.com.        	3600	DNSKEY	257 3 7 AwEAAea81n0wL09ZMejh806rJ0Km3MYC+ySPWnOmV70nEmONbnduRPpXWjYSqFmH5kldfNdCH403kI/YCMYDYBAPFPbhxuZuVBaJJqOQVsI4rpwj+XiANfGFAq9pZ0oA8iH7gSoNUCf6+g2hcP0ajYoqCjUZ7ZZQNytV/x6foW5t5PbyPNeAU1AEKxk2VSg1TMfkccZqTIx1ofS0N102Z4tOBn26judPqLc0tXMCJc7wgekqG04IGe7UWfk9xWtwo2SbtX9diErF8DJ93C17OWkb04n1xCm3i8/XZadA/HrBjfX/NvlHF8qnUQzzxN7UGrvBD4hE12R9ICj4YNFZViOTdvs=
+dns1.example.com.   	3600	A	192.0.2.1
+;; DNSSEC signatures
+example.com.        	3600	RRSIG	NS 7 2 3600 20170403124401 20170403124311 40703 example.com. ltKNDw2O/sIwQUsv3UCKqOtZYvWNJ0mHo2xDxpzZXfAiMbgR4k7jBIkpSEpcBiBlH7EvWom7CYVigPu8Y+j/Jq4uv+wmVF47OVY3YZvuzfprWj+iOQwPlfDJfUPx+U+73SSsZ21B5/+auB5cada730B4gQKmldleVGg5aov4H2+BpEyrsSs2o79qiXNBzLPqrZEmT0nfUAvQC8xhFV/71I8Q5qtfa3vO6DLSOBmBUtAlGKqfpWoZ2w+QDdA6rtOe0haizTZUtghL2ut47bdTR253brhUccL6nnLc5//jTUBToIhmG/p698xLnU9BYnuHIi74xsb3hVr5b46W5gAGKw==
+example.com.        	3600	RRSIG	SOA 7 2 3600 20170403124401 20170403124311 40703 example.com. E9a+I8HDh6ycTVkFgOWkzbH7PWds7ewp1M5lUci13ZzMVWsJeFW7t1tLnnOtvz2H8pq5/BevPB8iZBA7rHH7GxoQ5P8xrxAO6HvuRZT8O4kYAWRZ0QHhMIvY8f6VqTyoOmzgIGt0nJ3BL/XJgxIiFrsiLyih6+dkckEu62F22+FFvlv49ufKkCo+EUQPCzo7ZYODc8xKWo97SmaADzjfz7Hq9UPHraUgLhNkfBDbI9YPCGKaJaAiqCBy/6ih3SyHxVPLcIz95okeo5AJVszFIS+8pNPZssJBpWsLKYyAGzs2dsliRwS9z+a3wkHXJIfbLX+r3kGhcG4lQMYDz9SrFA==
+example.com.        	7200	RRSIG	NSEC 7 2 7200 20170403124401 20170403124311 40703 example.com. poh0BT+nUD3sM05axVGC+k7jj1r3YVNcx4bn/0cviNxzCqLY9RGgImPWsmkTgbJpmCox9SHzpTqL8acIQDNZaciNH9WeYKvn7wkap3z6jtCuQRezM3nUx7E37fzbnNC8MUoWkV37y3FSmtiza9l1isrE5dGkNMOsBcPvIp5wrbQ+dH4cMdcgQuW+NDjee6czIeeYtyarBWhq30S2lxroh8VXlrFDTcbiIY4UoGzJDfevvsonNFQXc+p7qq2fU1fyU1e3Ugty9I23g6fLhLcrmflVbYpcgE8/02K4asu5D7x/dOq21OU/jJfeudk66l6CVw7c3Qh/N63jRn8SsCj0Sg==
+example.com.        	3600	RRSIG	DNSKEY 7 2 3600 20170403124401 20170403124311 5154 example.com. RmAPllqg+CEX+vj5KKmXGYsF8vqbqLoXSYqSOSWbvgWRazKaQU98fpJWdrmqylkR6Xa1fnbvliP4N/0MGremNejsNPvMsJ4GvpyM75Mb4BEf5mwwikW6xov9V/n1AN9grWofj/r5evsZYcxIR7naM9oxV6qJvy8fFIjthG805MO18bYk1/Och2x9TgUf6DTqKNBHQjk1AfrhVvpuLjdNnNT16Ak3izrCLOm2tuNTaflkYkD0n06ZIAsz1krJWztpncA2csnKQmdybSL95wZnFeb6nkmq+P5vk3PuTENIMURYMCNfzBHogLfbVG5HpDhaHkcM2zSe1qATbp9xRZujLw==
+dns1.example.com.   	3600	RRSIG	A 7 3 3600 20170403124401 20170403124311 40703 example.com. iYfVT+HPDqMyH9f8aLrzNK6sOCoo38tlRJ5tjiko0DOpsWp20LLgVQLvKsTs3SfdC0gYzMVQCgzfDMbAgrEvmm4ZEQT/NSUhcO2t08f6pABn6GSdoswFupi0LGdQmgj/MbOET02OTALh9I6g3Ir1+bF+C10GS/8CYqffO/52IEJylc6AzDCwAjfkI/55hsuv2H8Wp5cqEG5yAlL4fK+U2zQWEuAGOtGbEuzeKcEDV6iiAuFge7ClW+CbB3gQxEhDdx5TQNNAcpzHmum5yfsfcFkIezZqIzEvOQWg1nJVcLvYnuBqyMWv/uGbG4CxTDy49U9JB/6QfilMk38VVcitZA==
+dns1.example.com.   	7200	RRSIG	NSEC 7 3 7200 20170403124401 20170403124311 40703 example.com. gtRE8TafAp50tzk3rAub93X69pp4J7uPzXPM0UAAp97oVMqcqvuZh80fICLmKl7xShvBx+AYfV+2CoeMW66CXVHTP8CyIjLyi32EGgL75Y2xs55/lEOaMl8hREgxniopCWGX/5vjmY0SBdGWVQVyeQeb0DbTXFWQNw/1LUPueoM1zqGcHFKFt5Y1GidboUEDsNeCmG3ZzGV9/v9sVUezzDK53uaHm8Ojz6E4N7kg6qXDF32ZAxs0dDjh46bsaTNvMLCEXqO2imHx9Omc2wYyCt/roMoeYiulXQ7yHYt0yQuCYwqxxMqJ4z9jvLNdLxH3YZYV0CVUrNgNC/5vtUILsQ==
+dns1.example.com.   	3600	RRSIG	A 7 3 3600 20170216152943 20170216152853 45258 example.com. j7H3N22L+tqfwuSd4GhIwMyjrFSY3+kypIcOvg0Ipbj4pAHsJOJTiW454Ueq54G/0ntoHxgmGLv3d/EV9prMPPQz8eqtRcYFip2NuEF9bJsIG3SMy+0HolPK+8D7B0MOGFA2TExKNknS7sJy/Jn/yQrf7BHubC61zWnqB+vN7MNlJASXEvy3008oi4FScSsrAVIrZK+z7utY4exkCVfELC7flGenoyPDFR12y8WpN/Tk6q1H37x+EKaQgFj361Bm6f/InPKW8Npn/SNCIJ2DvSWAnj6+2n1mse0sC+rKhRIDMDopu7JzTjpVs9U/p9BY5dtH/3YvST4Vz3syqd1unA==
+;; DNSSEC NSEC chain
+example.com.        	7200	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+dns1.example.com.   	7200	NSEC	example.com. A RRSIG NSEC
+;; Written 13 records
+;; Time 2017-04-03 14:43:12 CEST
diff --git a/tests/knot/semantic_check_data/invalid_ds.signed b/tests/knot/semantic_check_data/invalid_ds.signed
new file mode 100644
index 0000000..2435014
--- /dev/null
+++ b/tests/knot/semantic_check_data/invalid_ds.signed
@@ -0,0 +1,106 @@
+
+
+deleg.example.com.	3600	IN NS	deleg.example.com.
+			3600	A	192.0.2.1
+			3600	IN	DS 60485 5 3 ( 2BB183AF5F22588179A53B0A
+					               98631FAD1A292118 )
+			3600	IN	DS 60485 5 7 ( 2BB183AF5F22588179A53B0A
+					               98631FAD1A292118 )
+
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400 IN NSEC3 1 0 10 - (
+					6DFJITU5VML86QNKU9FO2LJDDQQTQPVT 
+					A RRSIG )
+6DFJITU5VML86QNKU9FO2LJDDQQTQPVT.example.com. 86400 IN NSEC3 1 1 10 - (
+					UI312KQOP1NG8IQEIEFNPSLA94KB5Q92
+					A RRSIG )
+UI312KQOP1NG8IQEIEFNPSLA94KB5Q92.example.com. 86400 IN NSEC3 1 0 10 - (
+					UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A 
+					A RRSIG)
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400 IN NSEC3 1 0 10 - (
+					20G1GOL477RO51RK9A9NFD54TFQAL7IQ
+					NS SOA RRSIG DNSKEY NSEC3PARAM )
+
+UI312KQOP1NG8IQEIEFNPSLA94KB5Q92.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DummySignatureDummySignature4ey0Qcln
+					uquQZT+z2HIdCE9HeslAkTlu/Xt78vF4+3db
+					t2Vno21DkteA+w== )
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DummySignatureDummySignature4ey0Qcln
+					uquQZT+z2HIdCE9HeslAkTlu/Xt78vF4+3db
+					t2Vno21DkteA+w== )
+6DFJITU5VML86QNKU9FO2LJDDQQTQPVT.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					KElp8dLKBKFzgEFV8r5aP9pCyYUD+Z8rLBA9
+					KkCDm1y82x5T/Cu5UXuZJwhvDGDzwPqoY5Dr
+					Qbiek52n6umbEw== )
+
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DPwNyH7r/4wIBfTGxikNv4pY7omY6IqpQS6Q
+					jtTNuStA+5gk98dvcgRjluxqo/+ZlZz4V53f
+					1y506ytGbX/q4Q== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					bGk1vLxVuJpcEy7n0gPvQVzfanbvINLJLcbD
+					eeie4sXZZAOwu6oQZy6kd8tvKtV4mL0OJzpH
+					XCO6BdZkmk/aQA== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					roe4aBp4G3TqQ4x5eRxbVIjApIh17gXDjfOY
+					zvRFLOkrwqKz3eX9WrRiCk3bYNn8s1fuenaQ
+					OSV1D5SL7utX5w== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					c1yhXb8wRGYndpVqG61+lHAAbZg+JcVYGPX3
+					Fw0jYigN4G+P0+VUCqPLkC4yfJylzuefyGfk
+					TUmriM3ihfXxIg== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160302125715 31323 example.com.
+					mZiLLTzbdaj7EJ8uj3TwvcvAfaMxYjyavlGT
+					qpa+cElfvBDm7R6MF4MaEQ9aZ2ylMt1lppjq
+					YyYRaaQC6yhm4g== )
+			0	NSEC3PARAM 1 0 10 -
+			0	RRSIG	NSEC3PARAM 7 2 0 (
+					20840201000000 20160302125715 29600 example.com.
+					K3PkVYZZV8QvZFtDsz9+ZfiM9wDkFu/eO2S5
+					tAtCXd1fktcW44TLWL0qADfFEEcMotvzLqv1
+					YJrD7TvrFDot8Q== )
+
+
+
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					vlzRtVFa44pRtdD8XZcgDa6021uA9A3TnNEw
+					5jRnor4aoftUuVQNAanQMCgrWk63d14XZ2d0
+					lqhxunAbh08dsQ== )
+
+www.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					NWFuYaSEg3z3K4l/fHu/X9dK+rDZ177BbCNN
+					ZeFTPCAdOnX0nw1CQys629k7Vzdv1pHaanmy
+					0Ru0tX9R65NlKw== )
+
+
diff --git a/tests/knot/semantic_check_data/missing.signed b/tests/knot/semantic_check_data/missing.signed
new file mode 100644
index 0000000..75c7d22
--- /dev/null
+++ b/tests/knot/semantic_check_data/missing.signed
@@ -0,0 +1,20 @@
+;; Zone dump (Knot DNS 2.5.0-dev)
+example.com.        	3600	SOA	dns1.example.com. hostmaster.example.com. 1081539379 3600 300 3600000 3600
+example.com.        	3600	NS	dns1.example.com.
+example.com.        	3600	DNSKEY	256 3 7 AwEAAaBgc4O+4UWd7mzSyelnPb/le/x0q/E90B/xnlf56kgEFMvEGz++o6CMRXr5JfgyxDDsahxTwFoWu30KJry4MjgcwlETM63DFpIYtyDBsi8TlQFEp5NDrlYUWlPGiPfywZBVkHGFMcFct+5/ZalTzYIP39tDytZcPZ/IgQRQZA9qeHYIw51YX9IlNMalHFCtJyrpzCdo22FY/vwBwSbdCa+vzkH1Uu8JkIqyAvAGkuwVisgpMpzWhvJNi5WSAnQfwOcsYCftINAHdRXtuqyG+uU/RDcZ2psx+woi+mYzEPeYV9MEqWpDyIz7jS7e1hK/1o05+qY8Eu2gt4enRj9BQr0=
+example.com.        	3600	DNSKEY	256 3 7 AwEAAfcfJSUnim+cR3YEc4VfdJ5W65GNlK0LQaAh6vAejH7uol8VYmXdlyz+wlhad+DyRM5Jl+XJVFMMyFUqWx+Q63DPRtl+TlN/2pWU2gsNHUoovFhFpdX1cQMVoxr2QLgsm1ASTeqvZV8Dn0xAlNRihNv877sTySjveaH0JpuVCMpe5DB1zVbAzLgDqFKAvwJCumdycp7RzMi9PqS1XtsEInKi+X/zZteTJbDO7l+tFt9/NgFxiaLgNo8Gz2oVBTQvAbjCDEi2mPA/YJrpOGZWNkB2L9HFSfzZih8BbgUI3Fh4lhS8XCVrfVV7K9YR2F5NBVi7h0Mk15hzNsSS7tRK1FM=
+example.com.        	3600	DNSKEY	257 3 7 AwEAAcjdwuJkjM8G5rk967z1cJqF88BqpvN2GN/6Tj1XA5AbIx+33qy5JI6K43ehlT/neLizOCk/JyXaw8gcjQaDKcIy0vKysXvI6yK4PNgHTdzQunBqGTfvPDlXKCle550R/DJF2OZH/T7jgX2GhQlem6UB3A23n24YP50IzAmXK9RYdE/dMFXU5jEz+CjcHNkB8ZCb2VrKE9RDjY88vr6lyM2kPbvBtx4UaUSEzwlDMRc3Wf+dBWKm6mKWAPsHZM/cux+S2mca/cxEA1ngCgBBbm7824WjTXgDs14QWuwruMTqLPDujUYND5kbsiuhQsfEFGVq2UyhGEZG/NoIEEg7qLc=
+dns1.example.com.   	3600	AAAA	2001:db8::3
+;; DNSSEC signatures
+example.com.        	3600	RRSIG	NS 7 2 3600 20840201000000 20160302125715 7242 example.com. B/6k7YAQGkiz6IkssLZblExgMZBE+Flkhv/leVgvM4RLPPpQ2znouYyrSbVCcU5irA7PFLbee5Mn1aWj2S57L8yGJjHBuamQSIO0GcvGcmXi1CrdaYXSofo3PtnKpM8/mG3+8RCUL5YhoxhTK4Y5gJrYGPkRPKsBTw2Qd2TUJFebtYgCuGN8Q3UwbeYPw89rNbqC3a7zsGwJoZKgDnm3NwCWcv6NRTcQA/H5v6T0/QvYbZpBMrjl3EiAWOccdUlQnALngGSzbJ2GnmK933VXYhuAoSKEN6thauOBSLkdCh9afkUzo/t7xhTJszo0F1uuavs8PYf3HjmdnMwdPMkUuQ==
+example.com.        	3600	RRSIG	SOA 7 2 3600 20840201000000 20160302125715 7242 example.com. dHmPqRl9snHFavwkkAFZqHDmvUrI3+e+dmEexqgW9txr30fbrkeGAp6ApdZlqJiDTJ/2q0UoyQxSYe/BzgV4gEBgTTgfmC7m9eHVLTD70KMlNuvwC4jkh1vWT1Zn6IFUsQtJ+54XfRTe/2VHyeK7saqsA/ARRZGOzk6To8CWxNCApUdLZMQO9UTX7uVcXKkPvfMvlhx1fmn4OE8ntwbY1oPosQb987N8V8x9Rb2hINr4DCkXNDydDZAh4vsZO0DHPlmyfkyNguQDmdgnDz1CVbJzguy8tqeMGT7CrwU8AmX3JADQTHoxjnWEidLLUa/gNDRFcRc5YMcdZyImHqdNZQ==
+example.com.        	3600	RRSIG	NSEC 7 2 3600 20840201000000 20160302125715 7242 example.com. bjw2G/BwF2xTP/QSkKqdr7byUS+nqMvfppuhZmH0VcysAKN2oqsV51bn7gWej6dnx0svtX7nCOlwdDFSCMJld5BGZFnAfhS+XVc/wTeZGMi1BkeJxlT3UbGLhf2DuLLyL969HPltL527vSysjBEmi7OsTlH+wXD6SW35ZClajNSRLjxrRpVHTGpA5uyyysHRYNXAKS3+SSc1N/Fovjgzi68exWD0BKTGia7Nf9Fn+bqvhbYh+pMHA7djPFJIsER3OCBx7H1KMxl6rap7Q3rC0I289xnnsOqRh/GnzSVgvobKWozOOs9XXNg+w9ioSos+kbzTxxSEvLKqNBgCbLjUHg==
+example.com.        	3600	RRSIG	DNSKEY 7 2 3600 20840201000000 20160302125715 37855 example.com. EHXazcQ27b5Cjqd1T8TAui2PrUqEq7cBxk45OA8BfBDmOuH2vXFVL+juCM2gCvQ+0oZmcJmpkjMCxUqQekXgxRy21PlEzJfR3VHRDSYCSogR9cCLw9T9OiFXugZAtYcLVXVHddKu0+t5yeQqdStgLBiz9EmeuPFYd/h/BxKI8FGx/TjHNzd06SKgxlZAT/vCGhEswgSIpxJm4Ju561vT2/Hh+NmD4jIKVf0OUSkfRVRbxpzMs0HaZx6s0T2mcL8so/rEXjSIORkw56Q7x3EmYQDxNJjoNo4nHKT0/pciCey+vHj9pxxaiave8wLBG96JpgJgSV7BG8TTbE2q62wX1Q==
+dns1.example.com.   	3600	RRSIG	AAAA 7 3 3600 20840201000000 20160302125715 7242 example.com. h0oZ7ghuhANB27zD+M1m0NyVUHND7g2qI1IfEKDjMzZ34wyqM0xWLm/Izln86ol4naDvJU3a7hsJS/95DdvW/s711Oi2nKhX/Hkjvnzu8WVcf5DvEKYQe/fyZ676hnwviKqFzwmfTAKgIuSvt2uZzJkpcyL8ZE6O/GdPrcR6rTuuDI30F4zXIWPmuMNLR2qJv59DwM0tZScLdmRGKGnZNpdxDvtbCsZrXBUPrOE5XpAw+fe8+oL3UEeKQZq8qFhVvegl4TAuk1a8CS+zG4E1ABQKp86J1h0G4l/ajmWqq2T59lHsBAOuX0IbKHEHIJzwRd9EV7LM59EtJVacx8ZCkw==
+dns1.example.com.   	3600	RRSIG	NSEC 7 3 3600 20840201000000 20160302125715 7242 example.com. Pq6F6akEhyIqch7vwWJ5C53FW1UW/Y8vseFqB6tzql5bnIYjEwikgiWR85uvSUNGvsjHbadBYiVh2i68k80ws/2LecQCvguSH+rMkqqY9go+pBh3pdiNlJaJZp3zJQ6+E35xOA+p0G5t84Et3satJl3OcpVthrdBKuotpDg4P+nOpfLHkI3FO5vehxs71HmESQli5JllhPNMH6WZfWsP74D4DgRjUpIK9hGznCeuZxJT5+S5wL4fzqb+P20W30bsQqMbo9GNdPy5AdbwZoEKJVoN3HC/sv03ScQzWUxjamHCQOeZFys25fFlh7+JU1xYSb3V/fPhUUuf7OsBVvn7+g==
+mail.example.com.   	7200	RRSIG	NSEC 7 3 7200 20840201000000 20160302125715 19578 example.com. gjNXoKVddN+Z3MmHXxs0v4Gv/3zaTAg0mBSLkSp8Ion6qKj/aR2y50QhNfZGVEZSmyerDiaVpfPMN+q9mwx+6xmv4/G97DkadXBYt5IXGR1fXhMCF+RLJb5ePYjQKSk2TfRMJAlk1Mowfvlp8rXFrT576y2F+IXKbpiJOdRt/13Wo5IUbw6LLFDOeZ3fUiZtBmoWTTjBnrGWYdb+ePcSXID+qM5TmRXqIOFceJvt/RhGZ5LYAchgM2sZDf4Asacxg6Z6vS2cA1opTLMAIu+cuEmq61cSJxWHblfXIpPMXFG+4i+nkCxEFxWyxt9edlAeHS/l2AiHQl5QeuzwEjFI2g==
+;; DNSSEC NSEC chain
+example.com.        	3600	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+dns1.example.com.   	3600	NSEC	example.com. AAAA RRSIG NSEC
+;; Written 14 records
+;; Time 2017-03-31 15:38:20 CEST
diff --git a/tests/knot/semantic_check_data/missing_glue_01.zone b/tests/knot/semantic_check_data/missing_glue_01.zone
new file mode 100644
index 0000000..6900d0e
--- /dev/null
+++ b/tests/knot/semantic_check_data/missing_glue_01.zone
@@ -0,0 +1,14 @@
+$ORIGIN example.com.
+$TTL 3600
+
+@	IN	SOA	dns1.example.com. hostmaster.example.com. (
+		2010111217	; serial
+		6h		; refresh
+		1h		; retry
+		1w		; expire
+		1d )		; minimum
+
+	NS	dns1
+	NS	dns2
+
+; no A records for NS
diff --git a/tests/knot/semantic_check_data/missing_glue_02.zone b/tests/knot/semantic_check_data/missing_glue_02.zone
new file mode 100644
index 0000000..1fcbc1f
--- /dev/null
+++ b/tests/knot/semantic_check_data/missing_glue_02.zone
@@ -0,0 +1,16 @@
+$ORIGIN example.com.
+$TTL 3600
+
+@	IN	SOA	dns1.example.com. hostmaster.example.com. (
+		2010111217	; serial
+		6h		; refresh
+		1h		; retry
+		1w		; expire
+		1d )		; minimum
+
+	NS	dns1
+	NS	dns2
+
+dns1	A	192.0.2.1
+
+; missing A record for dns2
diff --git a/tests/knot/semantic_check_data/missing_glue_03.zone b/tests/knot/semantic_check_data/missing_glue_03.zone
new file mode 100644
index 0000000..4485d43
--- /dev/null
+++ b/tests/knot/semantic_check_data/missing_glue_03.zone
@@ -0,0 +1,15 @@
+$ORIGIN example.com.
+$TTL 3600
+
+@	IN	SOA	dns1.example.com. hostmaster.example.com. (
+		2010111217	; serial
+		6h		; refresh
+		1h		; retry
+		1w		; expire
+		1d )		; minimum
+	NS	dns1
+
+dns1	A	192.0.2.1
+
+deleg	NS	ns1.deleg
+; missing A record for ns1.deleg
diff --git a/tests/knot/semantic_check_data/missing_ns.zone b/tests/knot/semantic_check_data/missing_ns.zone
new file mode 100644
index 0000000..7d71d78
--- /dev/null
+++ b/tests/knot/semantic_check_data/missing_ns.zone
@@ -0,0 +1,10 @@
+$ORIGIN example.com.
+$TTL 3600
+
+@	IN	SOA	dns1.example.com. hostmaster.example.com. (
+		2010111214	; serial
+		6h		; refresh
+		1h		; retry
+		1w		; expire
+		1d )		; minimum
+; missing NS in SOA
diff --git a/tests/knot/semantic_check_data/no_error_delegaton_bitmap.signed b/tests/knot/semantic_check_data/no_error_delegaton_bitmap.signed
new file mode 100644
index 0000000..82f4261
--- /dev/null
+++ b/tests/knot/semantic_check_data/no_error_delegaton_bitmap.signed
@@ -0,0 +1,66 @@
+; Zone without any semantic error
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160224170742 29600 example.com.
+					imfvFljZ29MFD+AVQgb8/jeBgRPGJHXWw7jv
+					lCijFIMnH2gvHeUbKZTQLuxegeQ62ZJsu7w6
+					RI4aS0fffncK8g== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160224170742 29600 example.com.
+					pnKWGmJdaur8QVQQ+xo9SbpDvC4E1lvSW1o6
+					wOUdzE5AMqy9+jB73BCC6Ota+Bt7vBCpAU2L
+					WFq6sB7oFj3vUA== )
+			86400	NSEC	deleg.example.com. NS SOA RRSIG NSEC DNSKEY
+			86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160224170742 29600 example.com.
+					b5bzGxN44wwyABHRjgBSY+YhN+mWbFJsyWJ0
+					e7FQ3QGKwQkgKiOnUOElGu9qWy5KinPOvTTm
+					96SOBVuVxfTK3Q== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224170742 29600 example.com.
+					rHeZv1qbt/28Nu44kYsoQdawfXdiWzq0YM7f
+					mI6QevXbyLx2QvgwlhSCc+sAoVkmQg+448M8
+					N7CcSooQE6z1eg== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224170742 31323 example.com.
+					TlUfbDLPLMwqxeiDwqX3vtN5HGxL8+JnEpF7
+					rgE6Knf3I0oI3oBYBPKpMBYnQXQHUPqoK3uo
+					MLngsROcqxwi6w== )
+deleg.example.com.	3600	IN NS	deleg.example.com.
+			3600	A	192.0.2.1
+			86400	NSEC	dns1.example.com. NS RRSIG NSEC
+			86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224170742 29600 example.com.
+					O81uip6/VmZE6dhWYNNj5FH2CnatytEgFiLW
+					k886unXnF4/pXpSlwUfZ4iIcA8qY6BRw+AS+
+					97Y6p2ACTw1/KA== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224170742 29600 example.com.
+					qrtmPmS7uGQS9Ytb25zLhyfajR7X7sZWXcIU
+					T61PSMeJyAYsOHdPB7VHxCRSv7QWYyrK9mh2
+					ohpYTvvvo1iptg== )
+			86400	NSEC	example.com. A RRSIG NSEC
+			86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224170742 29600 example.com.
+					NJ0Z8NZPBykmhuU/fb4x3AVOdZc6YebfQyYD
+					PaDTxHpquIh5ThfVtmawIpA6eVFkSscbUFEL
+					rjeRsepFYI3uig== )
diff --git a/tests/knot/semantic_check_data/no_error_nsec3_delegation.signed b/tests/knot/semantic_check_data/no_error_nsec3_delegation.signed
new file mode 100644
index 0000000..8585171
--- /dev/null
+++ b/tests/knot/semantic_check_data/no_error_nsec3_delegation.signed
@@ -0,0 +1,78 @@
+; Zone without any semantic error
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					W9EprjaR4loSnNW96h4rLsquPDw3LHYvD05k
+					djkQofHSkMNZAJ7Q+eA3Fs2ik5fnJFM7wi5C
+					MtFsV2TfqMJFmg== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					I9Je1S7XhZIW9C0fWE8NwFLC2rhHklddNYBO
+					dxVKL/lxENU4jPPBwZBGrcYn2WVHgkIzjG0n
+					EOHONAgRFPi3Xw== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					vO2UQiTN/CNUZOmSEg8kJlR/UqiAZHc4qMwj
+					9u31sbPmOMuni+ZGuVCFFoEMtZerIkkQowkB
+					sXJFkvCP5oF2rA== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160229083110 31323 example.com.
+					Z+aaLu4rmzekfhlj6A0ClREloRi8MloRHf/3
+					Dlw/RYY1hrOCfcZKEY6AXeVdUwESEsSkSOco
+					CbhyGHH10dKAAg== )
+			0	NSEC3PARAM 1 0 10 -
+			0	RRSIG	NSEC3PARAM 7 2 0 (
+					20840201000000 20160229083110 29600 example.com.
+					d69kc52VdALI8fbdbflsVsltc1m7bI6QsJ5U
+					IDE9fy5VqcufZecZMKuozPDuF2vBA8ADFIRU
+					OfYgKs6YNIOLWg== )
+deleg.example.com.	3600	IN NS	deleg.example.com.
+			3600	A	192.0.2.1
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400 IN NSEC3 1 0 10 - (
+					MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938
+					A RRSIG )
+			86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160229083110 29600 example.com.
+					D24JCtCcNzwsY1FXVliAjxMm+x95N2eUTXn0
+					M8NK5glSk1yLtnAUKzHxpRExAJLGUiaG4yPu
+					2yGZuqwNvJztzw== )
+MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938.example.com. 86400 IN NSEC3 1 0 10 - (
+					UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A
+					NS )
+			86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160229083110 29600 example.com.
+					jRNMrWLfS4yzRHQOBxs6/GKWIzx6AZV5lyCm
+					7bYTV9wS3owDJSQhJ7lft0WbBmUMtV3tP9Xr
+					Yc+yW48p2Vr+QQ== )
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400 IN NSEC3 1 0 10 - (
+					20G1GOL477RO51RK9A9NFD54TFQAL7IQ
+					NS SOA RRSIG DNSKEY NSEC3PARAM )
+			86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160229083110 29600 example.com.
+					F7y+xW/C7iICgmZeYrF4e7Yx4kWZAZPAMzlu
+					PtWVuf37ySg1VfEWcQcDP04vF2rXVUqSMEcj
+					bqUVN5W8Hoazxw== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					MoYrL/lToC4AHo6KCZRiBRmCMWHUAx2Xt32A
+					P4lDpwA+wiBWkCZSfVTh60AosS/BIGtBb2BK
+					mszMx8CLBvkjRg== )
diff --git a/tests/knot/semantic_check_data/no_error_nsec3_optout.signed b/tests/knot/semantic_check_data/no_error_nsec3_optout.signed
new file mode 100644
index 0000000..4fde7f5
--- /dev/null
+++ b/tests/knot/semantic_check_data/no_error_nsec3_optout.signed
@@ -0,0 +1,98 @@
+; Zone without any semantic error
+example.com.        	3600		SOA	dns1.example.com. hostmaster.example.com. 2010111221 21600 3600 604800 86400
+		       	3600		NS	dns1.example.com.
+			432000000	DNSKEY	256 3 7 (
+						AwEAAdwI5CT9W2+RYXwUeD9m4LT1dLInHKLynsjrIzNTgbLmr5bqC/eWE8c0OsZpZmUbY0u04CzO
+						2SXnk7zsDzH8GvcUfJHFnC+ZGuK45DChwv+k6kUmwm5nJUVD2qye3mucPvHX1Ss2NOrd+xqKu/t2
+						fVAOWKAh+r4XNN5eKg5rmkl38/A90JtiLg6Imp/O83ZG//ZUykFal0sujTbVP8MaLTMsXwHE46xf
+						i1tZDqObyY8TQTf0CtDm7d3LJvlDT1IST5NRU32fOtRUqdnTiMLbQQufwe1cCreZ+P4ej8DeI4gv
+						N/8lRCSnBBOnmwIPq4bjEdxnK9WRKmfLIpoK+fdO3dk= )
+			432000000	DNSKEY	257 3 7 (
+						AwEAAbWZLegQDKxDkaW1NvVwZ/nn0qsLEPW3nO+sJpExg52NvM5eugR02H0mwrULG5jAAHaAZ5C9
+						eXE3i3asxiyUIygx+/8n2VQIVml/iKfRgqoS6tEAZzL11DL0q/dWf8dF5A6yJQWqifGBXGRms3AU
+						Ec7pri7LfX3CBSqieiuHBAkqJVrJm6I73kduk4/tUEVEzJEmoNEHDDAAhpHhDo6g6ytzmdfTTNyz
+						VSWyAzn65+Eg2F3MaQOptoPsrIUdAud0UPCk49tdLUgaCAT0Kd1NICD9ANd+ba1mWmsWXkudAPsw
+						4WNLFZQUxlEsVPg4IsxZyrl3cyGDeLnXLLg0lWTGgJE= )
+			0		CDNSKEY	257 3 7 (
+						AwEAAbWZLegQDKxDkaW1NvVwZ/nn0qsLEPW3nO+sJpExg52NvM5eugR02H0mwrULG5jAAHaAZ5C9
+						eXE3i3asxiyUIygx+/8n2VQIVml/iKfRgqoS6tEAZzL11DL0q/dWf8dF5A6yJQWqifGBXGRms3AU
+						Ec7pri7LfX3CBSqieiuHBAkqJVrJm6I73kduk4/tUEVEzJEmoNEHDDAAhpHhDo6g6ytzmdfTTNyz
+						VSWyAzn65+Eg2F3MaQOptoPsrIUdAud0UPCk49tdLUgaCAT0Kd1NICD9ANd+ba1mWmsWXkudAPsw
+						4WNLFZQUxlEsVPg4IsxZyrl3cyGDeLnXLLg0lWTGgJE= )
+	        	0		CDS	53991 7 2 E97D72CCA0AC77B5515FF2DBE9A662B55E2647A47497A1166696BF94A9E02DE6
+	        	0		NSEC3PARAM	1 0 10 7A148F1404032E16
+deleg.example.com.  	3600		NS	deleg.example.com.
+		  	3600		A	192.0.2.1
+dns1.example.com.   	3600		A	192.0.2.1
+;; DNSSEC signatures
+example.com.        	3600		RRSIG	NS 7 2 3600 (
+						20670913080225 20170912080225 13839 example.com. VxLYvx9K8iCokjVJRDJbj8dyc6kinzf6
+						/iM/kjDSKQoSBlCRR3+pczeq9NE/qUWQkLzqGd8sTfaatXD8/8UW1L9v5wToxoBPnhfO92V1ExTCq1uH
+						cUeuAs5FEPRzHZDXyHD2P5/lOzVI3YjTaH5Ub9uIvpELNGpA3P+AWfyr2agglRAAcf8eFbjzUd6U1kjX
+						L7SuLz/XChsWlAvwPNj932nyZrqlce1m0AOVFkF/YriZ/uGrRnSioAXOEW7HaV9KNmCqx4qks1qfSjEH
+						B/AwIsrk+ZWfVsR/0EaAWnXcjd/RWe+4jN9aKWX9tomSC6G7TL71fiKwPZ4C0/mkwp1LaA== )
+	        	3600		RRSIG	SOA 7 2 3600 (
+						20670913080225 20170912080225 13839 example.com. IcI4kyxzAAKDj9skK4/OcTdyOfxS
+						+O3Y+kSuPOQnO1fFcJV0ZWOxGc2ElO4ecKyiYdwlEU0WRuSy5JEnfEqzFGjdUmmhmI95w61KdbGk
+						VCsSyGV0AsSSVNrIo0KNXAhfcoWkULXk0CsRc/5Fglt7bzaArdd5nyeNLHP26zcFdGhZAZDOS13o
+						7g/mHrV2dqQZl1VTxvURoW20uAmVX48koPEeOz70Yh+YKG0z1209YhN4ASB57l26bxjdzS1FIaul
+						Wu+OZr7JmfDuQMkVdWJG31jmXeLDiEUhFFD6Po2cijr1xvvxE6cmedjabCTCT0+U5mnHVAlxGhdw
+						0jBF3ec5ZQ== )
+        		432000000	RRSIG	DNSKEY 7 2 432000000 (
+						20670913080225 20170912080225 53991 example.com. DCBKQjY99s29NtqD3/+zoMpL5vh2
+						mvgufudFWkBl2tmiH90SPe7BTUaMCu+kwiOSJh3U6ToywvKG7i8Tn820BleAC78c8TDtSxrJdzTlxhOm
+						o29dUObmvwKzMBsyAaj/2mQfY9GZNYxem7OyaZjbdrV4Rb4ghyy7Rttg+xle6tVH76+/MCcsdBur1NrR
+						r8HXtV8Sd+h0GCYeQvhMi5btIJK0OAHStTyU5iCmLIh28rxxHfmU5aRFkzanT83Xj7VdoF3fmjIE9Uww
+						fWX6PUzIoxEfm5a+v0EGbzqGOEgCnQ7cJo3DQkx0ouZT1bWTJQ2Hv9i323aAB/boGLR7b2wHrg== )
+	        	0		RRSIG	NSEC3PARAM 7 2 0 (
+						20670913080225 20170912080225 13839 example.com. bOrMfjlEwZhfbcGmy4XYve/qZ8BV
+						n0t7JIBlKP/t9oFeukvxSHZnj3iT3sXq94Ck2DTDhRSw98rKG5V0tlAR/XGOz9Mx/nrY/NW5zX+1
+						zty1+6naf09QQsWUwseuUPu5uz1aEB6sIGj2V9bQWuHZdkIQkiVzN9SgD3olKmjOLsJxRS/ycJ59
+						I5so/g4wfC/jD7+NE8clkLJ5ME226brQOv/3xEFJC/IGR92uSvkzN1r7F0UZEozgu1UGykj16HU7
+						x/8YqT57xWiTcuZoSP1KoU494nO47dDhvO0pdMnIvozFnSI3heEJSVcZFxtePJ5gIUEp+wxGrayb
+						N0dQmCmrzg== )
+	        	0		RRSIG	CDS 7 2 0 (
+						20670913080225 20170912080225 13839 example.com. jckEGuG5vvRBpT0GIj/XXctC
+						TfcWnGRZv2Lj4kwZk14yKqrfFSB9G8glilIDdWeM0AvBYPFuEMTj34+HJxPbnTxaYYiX4wBpJfKB
+						mNbcVsJZeK5DtnuvOvCrTwdiEFqR+tG04uTVAh9TEBHude3zatgbbzYzFMP/N+XlERw7qm2im9iB
+						Jq++HjD+etKI7qYlJmcFzLvVNPR/sIHdDvl9tbwrjNpv/s2Df/KO1lrtMERiZMXHLWV70CstuDGj
+						fIM/dAV06MShs38qwaCC/CeLtKkj6pvOJqIJciRnc+7Ln86iSdSDyczD+Yp6aTsRpoIUgswU7FkS
+						pSKmkZdhW6+jmQ== )
+	        	0		RRSIG	CDNSKEY 7 2 0 (
+						20670913080225 20170912080225 13839 example.com. ALnyl9KnQ/zTbq/OSzJ5k7I2JqjD
+						JGbxu7Kuzbh2fAG7RHnN7INvaK+YhZX7w9sUHQSIj62u37wr5HS+1zgAfSKTd5k/OQC6y2FB4c2A
+						D4MCb5FaE0zJ1KmjFc3uZnEKfTl8b30A0dunRLgVHZHSmd4R/nJ3yAvm2+LumW0htP5lhcc7Xoi8
+						FJQ6KYg/ske0GCsMm5Ye+xO7m2QPbkgyOgq901rTBRMLbodbRXb8ZAFJGtl/iYmKG6pqxzQadeFQ
+						PxsL1bsdTvYsxIicQ6CpIOmvx/hl2aDi2f+vvfA4dHd2W2EDB4mMvRK09HadmBXimEkVJ+Tl++rg
+						WpiekXzI1g== )
+dns1.example.com.   	3600		RRSIG	A 7 3 3600 (
+						20670913080225 20170912080225 13839 example.com. tBFbAbT4K6Uv9LlTfGb+2jkg3vJm
+						D+PAqNW5PGhP26b+AMxOaVKPEVLD9oLhyrJv0Pt2IN/VVIvQ04fdqPwvS+z4XqZ4R5X5jb+vh5WY
+						1UsprBwkx5gViGlv9tcjB1ryg+U5A6e7VYccYMSVc0qB8trbk+z9TBbFFs5cXNUDLrCLQQm2TVTq
+						zKvxASK6/DdI+ZQd9RHDCd7im4pVYBA+R/QgQzzNhyhzqXoKzy3AFvxPWw6MX+ugX9Ea5HAF4uUx
+						xQmXEKmPMQey95WKk9ruqLRuaxGlDUWSq355ppGVppiN2oa53w00oUfacwo9MNIgiDi9Av5EG5EC
+						gbvq8Ze8jw== )
+;; DNSSEC NSEC3 chain
+036n766anb525cqa642tmm3r4occikb7.example.com. 86400	NSEC3	1 0 10 7A148F1404032E16 BGV0LKAMJSOEC22ARUGDNLTTCB70AF7U A RRSIG
+bgv0lkamjsoec22arugdnlttcb70af7u.example.com. 86400	NSEC3	1 0 10 7A148F1404032E16 S57MPBJ9OEOU9OH6HSV2ANMCV8BHLRMR NS SOA RRSIG DNSKEY NSEC3PARAM CDS CDNSKEY
+s57mpbj9oeou9oh6hsv2anmcv8bhlrmr.example.com. 86400	NSEC3	1 0 10 7A148F1404032E16 036N766ANB525CQA642TMM3R4OCCIKB7 NS
+;; DNSSEC NSEC3 signatures
+036n766anb525cqa642tmm3r4occikb7.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+						20670913080225 20170912080225 13839 example.com. Ej5/ql3a/6yjyk2PZfX9MhlnzclyrCnj
+						DpCF9dg2pqf/G4Z3rKef/PNbUPYgvvS/tmwyP+qb10BYvpH1Lp2bxSGrdPAfs5ge5KyCxa6rmwwP0eEc
+						C2AviCdbtJceB4fmxTvCt+2pgTCrWTnoWsaJYHlj5BRjaFXbqkCi954rIAy/YJoU9vqjysCZbfARastK
+						yt9rpeDePnKLsZRDP2ENi45m5dHLQQ6t3j45MCZXLi2Qp6Kh1FCkU6mYQNRhGpi2bi3dUCJYLp3CpchG
+						kQxFV3Jik0g0vMcpEW31rzx7WgWMpjAbW5DahIDd9f2Do/OmyjAjYZYFBPJtz2QV1PBNeg== )
+bgv0lkamjsoec22arugdnlttcb70af7u.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+						20670913080225 20170912080225 13839 example.com. huMYkoTMTSZdLdr06vWbvGaSih5L+pxc
+						fSMlmfww1NCJtJwm4WAyzegR2VAaGpok1gDxfhyPEpdO0WHZe2UbRpVMq/xuOWXCBXrHPzg9825687su
+						q4T+WY2nenwxi5bLs8S/v+w3VjOh6NlldNg9gg9xsmhcOghoBS2xpS9Mmj23y8U/J19uuTrQL4gb/Olz
+						gfGQ9JeLGArJfr7Sj+KcpLLqGolja0xdeWClCoDtcgZ3DilxpKuPkbQ/Dr1ejWOPXJIFaBaOV58CdpEK
+						omvQ5VMmdWaKZx+Uku/JELkeSiSJVxaC69JKAjDddbNUKHUnktJBFKHpsbRPAO1zHbxF8A== )
+s57mpbj9oeou9oh6hsv2anmcv8bhlrmr.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+						20670913080225 20170912080225 13839 example.com. NOIPazxgOpFTiExjI/CArS9iu1C0ZnXg
+						M9vEt1n/OX5g0HT0YLrvifSqLw/MN8W4t4xrSM+n/cGLUFcwP9+Zk3NeLrz9gCBmrneYZn+DCV3LF+lU
+						nKNc2lu9khFAHLwZCR+Wtj3bUpQREywqT7mmthlYGlN0wLfSTMSRc4HXlEzELx00tENA4kJy8HnPOdJU
+						rDjJPMa4mSxDBbgoGRkd6EhWtaUep1kQOR3sKqLYOBq8U1yARkGQuuLI/xcItjqRnVw5KYoUzyPtKoVg
+						1RyCcQxd9wZp06joiMKKQhQCo2/S2Ez1pkBhc7GNxJ7wT1rLQbl2yf7Lupf2YFpfQkWzBQ== )
+
diff --git a/tests/knot/semantic_check_data/no_error_wildcard_glue.zone b/tests/knot/semantic_check_data/no_error_wildcard_glue.zone
new file mode 100644
index 0000000..3cf1e9f
--- /dev/null
+++ b/tests/knot/semantic_check_data/no_error_wildcard_glue.zone
@@ -0,0 +1,18 @@
+$ORIGIN example.com.
+$TTL 3600
+
+@	IN	SOA	dns1.example.com. hostmaster.example.com. (
+		2010111217	; serial
+		6h		; refresh
+		1h		; retry
+		1w		; expire
+		1d )		; minimum
+
+	NS	dns1
+
+dns1	A	1.2.3.4
+
+abc	NS	a.ns.abc
+0.ns.abc	A	1.2.3.4
+*.ns.abc	AAAA	::1
+
diff --git a/tests/knot/semantic_check_data/no_rrsig.signed b/tests/knot/semantic_check_data/no_rrsig.signed
new file mode 100644
index 0000000..6a3161b
--- /dev/null
+++ b/tests/knot/semantic_check_data/no_rrsig.signed
@@ -0,0 +1,48 @@
+dns1.example.com.	3600	IN A	192.0.2.1
+			86400	NSEC	example.com. A NSEC
+; missing RRSIGs
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160224081310 29600 example.com.
+					ieEKhIV69ywg+YFSqdz0t17eE+PLl1eR4kpv
+					Mq6Q6TfjC7V5/PcFW6KRoP50RFp4m4cD0E7T
+					GpmpnPF++QV1Vw== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160224081310 29600 example.com.
+					kYbAbCGzyWPBEfc0TH1calUiKsZi12MH3TNV
+					7vtjOvIYEqeNmuJkrw899a7nOPNoahB6h7o/
+					DXuRlFqYYCC16Q== )
+			86400	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+			86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160224081310 29600 example.com.
+					PchT9RWRkLCMxWAQ3ut6LZlh4MYT4CkAPThQ
+					cnIn0ORi/fVgGzlifQ88xfEdEr1ZoXk9PlhT
+					5b+wocBOl2HhGg== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224081310 29600 example.com.
+					JLcSyR8KgSicUou0c7Zs7Ol1DYiaQ8Lfyort
+					8a+5OP3em3r3NH1nJkiVfs8+xdvUcGlGkbib
+					RKlfRWiIcOEalQ== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224081310 31323 example.com.
+					EQMX5DPXhwa+blMRkzl+swUW3BtzpGJ5tGEU
+					hkH7bJfM51gIAO5qnUO/mMPnEA8b4dc20nnZ
+					8j8lETDjqBLgDQ== )
diff --git a/tests/knot/semantic_check_data/no_rrsig_with_delegation.signed b/tests/knot/semantic_check_data/no_rrsig_with_delegation.signed
new file mode 100644
index 0000000..2c36b9b
--- /dev/null
+++ b/tests/knot/semantic_check_data/no_rrsig_with_delegation.signed
@@ -0,0 +1,61 @@
+ns.deleg.example.com.	3600	IN A	192.168.0.2
+deleg.example.com.	3600	IN NS	ns.deleg.example.com.
+			86400	NSEC	dns1.example.com. NS NSEC
+; missing RRSIG for NSEC record
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160224081610 29600 example.com.
+					HhnlCtlIaZFVklpzVUnzm6AzFd65CSc4WCJL
+					f2o7Gkevu+HTnkiPN6gqtERC/BKJz1EKd2fC
+					KDyLxXw6KeTRAw== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160224081610 29600 example.com.
+					rcHuZd9wTYykzis+9Z8uyqD8V9h22szf2bmE
+					GYNyJBlHZO0sOmys31xnvDfQ9sdk9hf1TUfB
+					9ACGIF5lDHBEog== )
+			86400	NSEC	deleg.example.com. NS SOA RRSIG NSEC DNSKEY
+			86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160224081610 29600 example.com.
+					YGSe1OINjOY3I8BY1EoxcOJsDZ/DjGCT5nqY
+					J6BBjTcbT5S1W61SN50xc2sGB4Q8F2KTotAe
+					arzn4DGDt9mOMw== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224081610 29600 example.com.
+					rdmqHOUXqhwrJusNt/7FTV+AtO/v6Md3LXzj
+					/QzR/pCADNC6ZA+FvqaOycnUxoryKk7PY3pM
+					5ispCMuEx/1OGA== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224081610 31323 example.com.
+					jELyXsaJx+G4heZJ96dyE12hSyTNFazwWDkq
+					1Mkja9/bTTdYAd+t8fhf/c35bUiTVJWMivJe
+					+YcCwqGf2U+2zw== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224081610 29600 example.com.
+					ln2xuvghOWBDOfyk19Wwtv3oc8+1go3WQuMf
+					vel5x/uHVx6voNA25cpFIQ6nPlCo8pmd5R3w
+					paMxgoQtBkzBcA== )
+			86400	NSEC	example.com. A RRSIG NSEC
+			86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224081610 29600 example.com.
+					EEKcIegUeyn/1FIgxHV+gSX3b/ygQPAcjD8g
+					aCt1yiO0B1xmVm09RJNxzCLaTKxQENhxIoUZ
+					2l7250pBQnrlAQ== )
diff --git a/tests/knot/semantic_check_data/nsec3_chain_01.signed b/tests/knot/semantic_check_data/nsec3_chain_01.signed
new file mode 100644
index 0000000..cd90b9f
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec3_chain_01.signed
@@ -0,0 +1,80 @@
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400 IN NSEC3 1 0 10 - (
+					MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938
+					A RRSIG )
+MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938.example.com. 86400 IN NSEC3 1 0 10 - (
+					20G1GOL477RO51RK9A9NFD54TFQAL7IQ ; wrong next record
+					NS )
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400 IN NSEC3 1 0 10 - (
+					20G1GOL477RO51RK9A9NFD54TFQAL7IQ
+					NS SOA RRSIG DNSKEY NSEC3PARAM )
+; RRSIGs for NSEC3s
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160229140652 29600 example.com.
+					PjEM7Bxxb7w67366fKCLkR9BVFAL0RI8RJCZ
+					5aqoMVuy+ui7MLKxKT2LfeTHgBw1Cww1bbJw
+					Ip2zu0/ZGPfKzA== )
+MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160229140652 29600 example.com.
+					DUMMYDUMMYDUMMYgc7Jx/FgAlruRjwsS/YJa
+					sZRspDGZhSqK2daV5K0lmK+XL8BoOtp7aXtq
+					VER5XcWLOebCdw== )
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160229140652 29600 example.com.
+					XsJa0IUE2ddTohJmiuNVd/Po1ZOK0PDCuU7/
+					CS0/wiZ5ZlxPdVUAYXuC7HhGH+ZPsqwZ4oUU
+					ToDbFqfdzmC1XQ== )
+
+; other zone data without error
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160229140652 29600 example.com.
+					u5QMvOSkZBUM5tLiEAq3A+x4Ha17ZsNUYqeI
+					SuYA1+NbaBDxAtT6scB9aeA4lOTQ0TZvpGFE
+					YF/XxGtqvwdZ8g== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160229140652 29600 example.com.
+					ELZOh4iS9DpAafa8NTaI/eNL3Qwy+lsmgrzF
+					7jaoR5yOURl/RZSJY+m9Peaq4ALcROdGJ0O4
+					miSpdTIZsBSGZg== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160229140652 29600 example.com.
+					sjxCP/grgOR+4vmXw7HU/hGSx5dS5QxM00IA
+					gZNJ6Lqf+4OSL3TEa1/qqRSFTl5uv3rqh5W4
+					8p2JoT1ZkcJj6w== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160229140652 31323 example.com.
+					jrH48r1iPFRfbyIZWcARQrejVgrE9v8qqt4R
+					uPHjz5t7PYmZYH544SI9HtaWGkIJ9jzlxr5l
+					ikCWo1we50y9Lg== )
+			0	NSEC3PARAM 1 0 10 -
+			0	RRSIG	NSEC3PARAM 7 2 0 (
+					20840201000000 20160229140652 29600 example.com.
+					yIXzhQw8c/c/in+doXX5JmqoGiqoYD2Hhw6d
+					/aGXc5QLQqxyATXln02vkwt1d7DK/ha1vkfx
+					bvGdduXDQ7YZ+g== )
+deleg.example.com.	3600	IN NS	deleg.example.com.
+			3600	A	192.0.2.1
+
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160229140652 29600 example.com.
+					aMRzV/1+m9wQHWezSiwkmDEbnS85wB9dA5x/
+					u2P7NPsgwMnRdfpVIMfaVhSJH88i5OlLTvL1
+					sSK+RADpuoqnLA== )
diff --git a/tests/knot/semantic_check_data/nsec3_chain_02.signed b/tests/knot/semantic_check_data/nsec3_chain_02.signed
new file mode 100644
index 0000000..ca70cfa
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec3_chain_02.signed
@@ -0,0 +1,94 @@
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400 IN NSEC3 1 0 10 - (
+					6DFJITU5VML86QNKU9FO2LJDDQQTQPVT
+					A RRSIG )
+6DFJITU5VML86QNKU9FO2LJDDQQTQPVT.example.com. 86400 IN NSEC3 1 0 10 - (
+					20G1GOL477RO51RK9A9NFD54TFQAL7IQ ; wrong next
+					A RRSIG )
+MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938.example.com. 86400 IN NSEC3 1 0 10 - (
+					UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A
+					NS )
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400 IN NSEC3 1 0 10 - (
+					MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938 ; wrong next
+					NS SOA RRSIG DNSKEY NSEC3PARAM )
+
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					oErbN3Xw+0zAqkz5KC5nOsINblBc4ey0Qcln
+					uquQZT+z2HIdCE9HeslAkTlu/Xt78vF4+3db
+					t2Vno21DkteA+w== )
+6DFJITU5VML86QNKU9FO2LJDDQQTQPVT.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DummySignatureDummySignature+Z8rLBA9
+					KkCDm1y82x5T/Cu5UXuZJwhvDGDzwPqoY5Dr
+					Qbiek52n6umbEw== )
+MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					ep1TVqEISn2ZOiBtizK2eyuuhsYyD37X9Bw2
+					9JOkecZnmzCwBqfMCBvRYmNRpMd512+ZnW/I
+					1vIViE7CGwkHyA== )
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DummySignatureDummySginature6IqpQS6Q
+					jtTNuStA+5gk98dvcgRjluxqo/+ZlZz4V53f
+					1y506ytGbX/q4Q== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					bGk1vLxVuJpcEy7n0gPvQVzfanbvINLJLcbD
+					eeie4sXZZAOwu6oQZy6kd8tvKtV4mL0OJzpH
+					XCO6BdZkmk/aQA== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					roe4aBp4G3TqQ4x5eRxbVIjApIh17gXDjfOY
+					zvRFLOkrwqKz3eX9WrRiCk3bYNn8s1fuenaQ
+					OSV1D5SL7utX5w== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					c1yhXb8wRGYndpVqG61+lHAAbZg+JcVYGPX3
+					Fw0jYigN4G+P0+VUCqPLkC4yfJylzuefyGfk
+					TUmriM3ihfXxIg== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160302125715 31323 example.com.
+					mZiLLTzbdaj7EJ8uj3TwvcvAfaMxYjyavlGT
+					qpa+cElfvBDm7R6MF4MaEQ9aZ2ylMt1lppjq
+					YyYRaaQC6yhm4g== )
+			0	NSEC3PARAM 1 0 10 -
+			0	RRSIG	NSEC3PARAM 7 2 0 (
+					20840201000000 20160302125715 29600 example.com.
+					K3PkVYZZV8QvZFtDsz9+ZfiM9wDkFu/eO2S5
+					tAtCXd1fktcW44TLWL0qADfFEEcMotvzLqv1
+					YJrD7TvrFDot8Q== )
+deleg.example.com.	3600	IN NS	deleg.example.com.
+			3600	A	192.0.2.1
+
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					vlzRtVFa44pRtdD8XZcgDa6021uA9A3TnNEw
+					5jRnor4aoftUuVQNAanQMCgrWk63d14XZ2d0
+					lqhxunAbh08dsQ== )
+
+www.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					NWFuYaSEg3z3K4l/fHu/X9dK+rDZ177BbCNN
+					ZeFTPCAdOnX0nw1CQys629k7Vzdv1pHaanmy
+					0Ru0tX9R65NlKw== )
diff --git a/tests/knot/semantic_check_data/nsec3_chain_03.signed b/tests/knot/semantic_check_data/nsec3_chain_03.signed
new file mode 100644
index 0000000..80112f8
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec3_chain_03.signed
@@ -0,0 +1,94 @@
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400 IN NSEC3 1 0 10 - (
+					UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A ; wrong next
+					A RRSIG )
+6DFJITU5VML86QNKU9FO2LJDDQQTQPVT.example.com. 86400 IN NSEC3 1 0 10 - (
+					MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938
+					A RRSIG )
+MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938.example.com. 86400 IN NSEC3 1 0 10 - (
+					6DFJITU5VML86QNKU9FO2LJDDQQTQPVT ; wrong next
+					NS )
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400 IN NSEC3 1 0 10 - (
+					20G1GOL477RO51RK9A9NFD54TFQAL7IQ
+					NS SOA RRSIG DNSKEY NSEC3PARAM )
+
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DummySignatureDummySignature4ey0Qcln
+					uquQZT+z2HIdCE9HeslAkTlu/Xt78vF4+3db
+					t2Vno21DkteA+w== )
+6DFJITU5VML86QNKU9FO2LJDDQQTQPVT.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					KElp8dLKBKFzgEFV8r5aP9pCyYUD+Z8rLBA9
+					KkCDm1y82x5T/Cu5UXuZJwhvDGDzwPqoY5Dr
+					Qbiek52n6umbEw== )
+MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DummySignatureDummySignatureD37X9Bw2
+					9JOkecZnmzCwBqfMCBvRYmNRpMd512+ZnW/I
+					1vIViE7CGwkHyA== )
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DPwNyH7r/4wIBfTGxikNv4pY7omY6IqpQS6Q
+					jtTNuStA+5gk98dvcgRjluxqo/+ZlZz4V53f
+					1y506ytGbX/q4Q== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					bGk1vLxVuJpcEy7n0gPvQVzfanbvINLJLcbD
+					eeie4sXZZAOwu6oQZy6kd8tvKtV4mL0OJzpH
+					XCO6BdZkmk/aQA== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					roe4aBp4G3TqQ4x5eRxbVIjApIh17gXDjfOY
+					zvRFLOkrwqKz3eX9WrRiCk3bYNn8s1fuenaQ
+					OSV1D5SL7utX5w== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					c1yhXb8wRGYndpVqG61+lHAAbZg+JcVYGPX3
+					Fw0jYigN4G+P0+VUCqPLkC4yfJylzuefyGfk
+					TUmriM3ihfXxIg== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160302125715 31323 example.com.
+					mZiLLTzbdaj7EJ8uj3TwvcvAfaMxYjyavlGT
+					qpa+cElfvBDm7R6MF4MaEQ9aZ2ylMt1lppjq
+					YyYRaaQC6yhm4g== )
+			0	NSEC3PARAM 1 0 10 -
+			0	RRSIG	NSEC3PARAM 7 2 0 (
+					20840201000000 20160302125715 29600 example.com.
+					K3PkVYZZV8QvZFtDsz9+ZfiM9wDkFu/eO2S5
+					tAtCXd1fktcW44TLWL0qADfFEEcMotvzLqv1
+					YJrD7TvrFDot8Q== )
+deleg.example.com.	3600	IN NS	deleg.example.com.
+			3600	A	192.0.2.1
+
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					vlzRtVFa44pRtdD8XZcgDa6021uA9A3TnNEw
+					5jRnor4aoftUuVQNAanQMCgrWk63d14XZ2d0
+					lqhxunAbh08dsQ== )
+
+www.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					NWFuYaSEg3z3K4l/fHu/X9dK+rDZ177BbCNN
+					ZeFTPCAdOnX0nw1CQys629k7Vzdv1pHaanmy
+					0Ru0tX9R65NlKw== )
diff --git a/tests/knot/semantic_check_data/nsec3_ds.signed b/tests/knot/semantic_check_data/nsec3_ds.signed
new file mode 100644
index 0000000..d37d400
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec3_ds.signed
@@ -0,0 +1,109 @@
+
+
+deleg.example.com.	3600	IN NS	deleg.example.com.
+			3600	A	192.0.2.1
+			3600	IN	DS 60485 5 1 ( 2BB183AF5F22588179A53B0A
+					               98631FAD1A292118 )
+deleg.example.com.	3600	IN	RRSIG DS 7 3 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					DummySignatureDummySignature4ey0Qcln
+					uquQZT+z2HIdCE9HeslAkTlu/Xt78vF4+3db
+					t2Vno21DkteA+w== )
+
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400 IN NSEC3 1 0 10 - (
+					6DFJITU5VML86QNKU9FO2LJDDQQTQPVT 
+					A RRSIG )
+6DFJITU5VML86QNKU9FO2LJDDQQTQPVT.example.com. 86400 IN NSEC3 1 1 10 - (
+					UI312KQOP1NG8IQEIEFNPSLA94KB5Q92
+					A RRSIG )
+UI312KQOP1NG8IQEIEFNPSLA94KB5Q92.example.com. 86400 IN NSEC3 1 0 10 - (
+					UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A 
+					A RRSIG)
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400 IN NSEC3 1 0 10 - (
+					20G1GOL477RO51RK9A9NFD54TFQAL7IQ
+					NS SOA RRSIG DNSKEY NSEC3PARAM )
+
+UI312KQOP1NG8IQEIEFNPSLA94KB5Q92.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DummySignatureDummySignature4ey0Qcln
+					uquQZT+z2HIdCE9HeslAkTlu/Xt78vF4+3db
+					t2Vno21DkteA+w== )
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DummySignatureDummySignature4ey0Qcln
+					uquQZT+z2HIdCE9HeslAkTlu/Xt78vF4+3db
+					t2Vno21DkteA+w== )
+6DFJITU5VML86QNKU9FO2LJDDQQTQPVT.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					KElp8dLKBKFzgEFV8r5aP9pCyYUD+Z8rLBA9
+					KkCDm1y82x5T/Cu5UXuZJwhvDGDzwPqoY5Dr
+					Qbiek52n6umbEw== )
+
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DPwNyH7r/4wIBfTGxikNv4pY7omY6IqpQS6Q
+					jtTNuStA+5gk98dvcgRjluxqo/+ZlZz4V53f
+					1y506ytGbX/q4Q== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					bGk1vLxVuJpcEy7n0gPvQVzfanbvINLJLcbD
+					eeie4sXZZAOwu6oQZy6kd8tvKtV4mL0OJzpH
+					XCO6BdZkmk/aQA== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					roe4aBp4G3TqQ4x5eRxbVIjApIh17gXDjfOY
+					zvRFLOkrwqKz3eX9WrRiCk3bYNn8s1fuenaQ
+					OSV1D5SL7utX5w== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					c1yhXb8wRGYndpVqG61+lHAAbZg+JcVYGPX3
+					Fw0jYigN4G+P0+VUCqPLkC4yfJylzuefyGfk
+					TUmriM3ihfXxIg== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160302125715 31323 example.com.
+					mZiLLTzbdaj7EJ8uj3TwvcvAfaMxYjyavlGT
+					qpa+cElfvBDm7R6MF4MaEQ9aZ2ylMt1lppjq
+					YyYRaaQC6yhm4g== )
+			0	NSEC3PARAM 1 0 10 -
+			0	RRSIG	NSEC3PARAM 7 2 0 (
+					20840201000000 20160302125715 29600 example.com.
+					K3PkVYZZV8QvZFtDsz9+ZfiM9wDkFu/eO2S5
+					tAtCXd1fktcW44TLWL0qADfFEEcMotvzLqv1
+					YJrD7TvrFDot8Q== )
+
+
+
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					vlzRtVFa44pRtdD8XZcgDa6021uA9A3TnNEw
+					5jRnor4aoftUuVQNAanQMCgrWk63d14XZ2d0
+					lqhxunAbh08dsQ== )
+
+www.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					NWFuYaSEg3z3K4l/fHu/X9dK+rDZ177BbCNN
+					ZeFTPCAdOnX0nw1CQys629k7Vzdv1pHaanmy
+					0Ru0tX9R65NlKw== )
+
+
diff --git a/tests/knot/semantic_check_data/nsec3_missing.signed b/tests/knot/semantic_check_data/nsec3_missing.signed
new file mode 100644
index 0000000..4974956
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec3_missing.signed
@@ -0,0 +1,120 @@
+
+; extra record without corresponding NSEC3
+extra.example.com.	3600	IN A	1.2.3.4
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					DummySignatureDummySignature12345678
+					123456789123456789123456789123456789
+					lqhxunAbh08dsQ== )
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400 IN NSEC3 1 0 10 - (
+					6DFJITU5VML86QNKU9FO2LJDDQQTQPVT 
+					A RRSIG )
+6DFJITU5VML86QNKU9FO2LJDDQQTQPVT.example.com. 86400 IN NSEC3 1 0 10 - (
+					MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938
+					A RRSIG )
+MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938.example.com. 86400 IN NSEC3 1 0 10 - (
+					UI312KQOP1NG8IQEIEFNPSLA94KB5Q92 
+					NS )
+UI312KQOP1NG8IQEIEFNPSLA94KB5Q92.example.com. 86400 IN NSEC3 1 0 10 - (
+					UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A 
+					A RRSIG)
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400 IN NSEC3 1 0 10 - (
+					20G1GOL477RO51RK9A9NFD54TFQAL7IQ
+					NS SOA RRSIG DNSKEY NSEC3PARAM )
+
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400 IN A 1.2.3.4
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400	RRSIG	A 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DPwNyH7r/4wIBfTGxikNv4pY7omY6IqpQS6Q
+					jtTNuStA+5gk98dvcgRjluxqo/+ZlZz4V53f
+					1y506ytGbX/q4Q== )
+
+
+UI312KQOP1NG8IQEIEFNPSLA94KB5Q92.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DummySignatureDummySignature4ey0Qcln
+					uquQZT+z2HIdCE9HeslAkTlu/Xt78vF4+3db
+					t2Vno21DkteA+w== )
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DummySignatureDummySignature4ey0Qcln
+					uquQZT+z2HIdCE9HeslAkTlu/Xt78vF4+3db
+					t2Vno21DkteA+w== )
+6DFJITU5VML86QNKU9FO2LJDDQQTQPVT.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					KElp8dLKBKFzgEFV8r5aP9pCyYUD+Z8rLBA9
+					KkCDm1y82x5T/Cu5UXuZJwhvDGDzwPqoY5Dr
+					Qbiek52n6umbEw== )
+MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DummySignatureDummySignatureD37X9Bw2
+					9JOkecZnmzCwBqfMCBvRYmNRpMd512+ZnW/I
+					1vIViE7CGwkHyA== )
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160302125715 29600 example.com.
+					DPwNyH7r/4wIBfTGxikNv4pY7omY6IqpQS6Q
+					jtTNuStA+5gk98dvcgRjluxqo/+ZlZz4V53f
+					1y506ytGbX/q4Q== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					bGk1vLxVuJpcEy7n0gPvQVzfanbvINLJLcbD
+					eeie4sXZZAOwu6oQZy6kd8tvKtV4mL0OJzpH
+					XCO6BdZkmk/aQA== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					roe4aBp4G3TqQ4x5eRxbVIjApIh17gXDjfOY
+					zvRFLOkrwqKz3eX9WrRiCk3bYNn8s1fuenaQ
+					OSV1D5SL7utX5w== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					c1yhXb8wRGYndpVqG61+lHAAbZg+JcVYGPX3
+					Fw0jYigN4G+P0+VUCqPLkC4yfJylzuefyGfk
+					TUmriM3ihfXxIg== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160302125715 31323 example.com.
+					mZiLLTzbdaj7EJ8uj3TwvcvAfaMxYjyavlGT
+					qpa+cElfvBDm7R6MF4MaEQ9aZ2ylMt1lppjq
+					YyYRaaQC6yhm4g== )
+			0	NSEC3PARAM 1 0 10 -
+			0	RRSIG	NSEC3PARAM 7 2 0 (
+					20840201000000 20160302125715 29600 example.com.
+					K3PkVYZZV8QvZFtDsz9+ZfiM9wDkFu/eO2S5
+					tAtCXd1fktcW44TLWL0qADfFEEcMotvzLqv1
+					YJrD7TvrFDot8Q== )
+deleg.example.com.	3600	IN NS	deleg.example.com.
+			3600	A	192.0.2.1
+
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					vlzRtVFa44pRtdD8XZcgDa6021uA9A3TnNEw
+					5jRnor4aoftUuVQNAanQMCgrWk63d14XZ2d0
+					lqhxunAbh08dsQ== )
+
+www.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160302125715 29600 example.com.
+					NWFuYaSEg3z3K4l/fHu/X9dK+rDZ177BbCNN
+					ZeFTPCAdOnX0nw1CQys629k7Vzdv1pHaanmy
+					0Ru0tX9R65NlKw== )
+
+
diff --git a/tests/knot/semantic_check_data/nsec3_optout.signed b/tests/knot/semantic_check_data/nsec3_optout.signed
new file mode 100644
index 0000000..c9caa5d
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec3_optout.signed
@@ -0,0 +1,81 @@
+
+; insecure delegation, not covered by NSEC3 or opt-out
+zzz.example.com.	3600	IN NS	zzz.example.com.
+			3600	A	192.0.2.1
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					W9EprjaR4loSnNW96h4rLsquPDw3LHYvD05k
+					djkQofHSkMNZAJ7Q+eA3Fs2ik5fnJFM7wi5C
+					MtFsV2TfqMJFmg== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					I9Je1S7XhZIW9C0fWE8NwFLC2rhHklddNYBO
+					dxVKL/lxENU4jPPBwZBGrcYn2WVHgkIzjG0n
+					EOHONAgRFPi3Xw== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					vO2UQiTN/CNUZOmSEg8kJlR/UqiAZHc4qMwj
+					9u31sbPmOMuni+ZGuVCFFoEMtZerIkkQowkB
+					sXJFkvCP5oF2rA== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160229083110 31323 example.com.
+					Z+aaLu4rmzekfhlj6A0ClREloRi8MloRHf/3
+					Dlw/RYY1hrOCfcZKEY6AXeVdUwESEsSkSOco
+					CbhyGHH10dKAAg== )
+			0	NSEC3PARAM 1 0 10 -
+			0	RRSIG	NSEC3PARAM 7 2 0 (
+					20840201000000 20160229083110 29600 example.com.
+					d69kc52VdALI8fbdbflsVsltc1m7bI6QsJ5U
+					IDE9fy5VqcufZecZMKuozPDuF2vBA8ADFIRU
+					OfYgKs6YNIOLWg== )
+deleg.example.com.	3600	IN NS	deleg.example.com.
+			3600	A	192.0.2.1
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400 IN NSEC3 1 0 10 - (
+					MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938
+					A RRSIG )
+			86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160229083110 29600 example.com.
+					D24JCtCcNzwsY1FXVliAjxMm+x95N2eUTXn0
+					M8NK5glSk1yLtnAUKzHxpRExAJLGUiaG4yPu
+					2yGZuqwNvJztzw== )
+MJV836RJQEJ5UBGHVKSQ7N44RSO3Q938.example.com. 86400 IN NSEC3 1 0 10 - (
+					UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A
+					NS )
+			86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160229083110 29600 example.com.
+					jRNMrWLfS4yzRHQOBxs6/GKWIzx6AZV5lyCm
+					7bYTV9wS3owDJSQhJ7lft0WbBmUMtV3tP9Xr
+					Yc+yW48p2Vr+QQ== )
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400 IN NSEC3 1 0 10 - (
+					20G1GOL477RO51RK9A9NFD54TFQAL7IQ
+					NS SOA RRSIG DNSKEY NSEC3PARAM )
+			86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160229083110 29600 example.com.
+					F7y+xW/C7iICgmZeYrF4e7Yx4kWZAZPAMzlu
+					PtWVuf37ySg1VfEWcQcDP04vF2rXVUqSMEcj
+					bqUVN5W8Hoazxw== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					MoYrL/lToC4AHo6KCZRiBRmCMWHUAx2Xt32A
+					P4lDpwA+wiBWkCZSfVTh60AosS/BIGtBb2BK
+					mszMx8CLBvkjRg== )
diff --git a/tests/knot/semantic_check_data/nsec3_param_invalid.signed b/tests/knot/semantic_check_data/nsec3_param_invalid.signed
new file mode 100644
index 0000000..c7d8d6d
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec3_param_invalid.signed
@@ -0,0 +1,70 @@
+; Zone without any semantic error
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					W9EprjaR4loSnNW96h4rLsquPDw3LHYvD05k
+					djkQofHSkMNZAJ7Q+eA3Fs2ik5fnJFM7wi5C
+					MtFsV2TfqMJFmg== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					I9Je1S7XhZIW9C0fWE8NwFLC2rhHklddNYBO
+					dxVKL/lxENU4jPPBwZBGrcYn2WVHgkIzjG0n
+					EOHONAgRFPi3Xw== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					vO2UQiTN/CNUZOmSEg8kJlR/UqiAZHc4qMwj
+					9u31sbPmOMuni+ZGuVCFFoEMtZerIkkQowkB
+					sXJFkvCP5oF2rA== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160229083110 31323 example.com.
+					Z+aaLu4rmzekfhlj6A0ClREloRi8MloRHf/3
+					Dlw/RYY1hrOCfcZKEY6AXeVdUwESEsSkSOco
+					CbhyGHH10dKAAg== )
+			0	NSEC3PARAM 1 4 10 -
+			0	RRSIG	NSEC3PARAM 7 2 0 (
+					20840201000000 20160229083110 29600 example.com.
+					d69kc52VdALI8fbdbflsVsltc1m7bI6QsJ5U
+					IDE9fy5VqcufZecZMKuozPDuF2vBA8ADFIRU
+					OfYgKs6YNIOLWg== )
+deleg.example.com.	3600	IN NS	deleg.example.com.
+			3600	A	192.0.2.1
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400 IN NSEC3 1 1 15 - (
+					UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A
+					A RRSIG )
+			86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160229083110 29600 example.com.
+					D24JCtCcNzwsY1FXVliAjxMm+x95N2eUTXn0
+					M8NK5glSk1yLtnAUKzHxpRExAJLGUiaG4yPu
+					2yGZuqwNvJztzw== )
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400 IN NSEC3 4 0 10 - (
+					20G1GOL477RO51RK9A9NFD54TFQAL7IQ
+					NS SOA RRSIG DNSKEY NSEC3PARAM )
+			86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160229083110 29600 example.com.
+					F7y+xW/C7iICgmZeYrF4e7Yx4kWZAZPAMzlu
+					PtWVuf37ySg1VfEWcQcDP04vF2rXVUqSMEcj
+					bqUVN5W8Hoazxw== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160229083110 29600 example.com.
+					MoYrL/lToC4AHo6KCZRiBRmCMWHUAx2Xt32A
+					P4lDpwA+wiBWkCZSfVTh60AosS/BIGtBb2BK
+					mszMx8CLBvkjRg== )
diff --git a/tests/knot/semantic_check_data/nsec3_wrong_bitmap_01.signed b/tests/knot/semantic_check_data/nsec3_wrong_bitmap_01.signed
new file mode 100644
index 0000000..a3024d8
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec3_wrong_bitmap_01.signed
@@ -0,0 +1,70 @@
+; example.com -- missing DNSKEY in type bitmap
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400 IN NSEC3 1 0 10 - (
+					20G1GOL477RO51RK9A9NFD54TFQAL7IQ
+					NS SOA RRSIG NSEC3PARAM )
+; dns1.example.com
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400 IN NSEC3 1 0 10 - (
+					UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A
+					A RRSIG )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160225083237 29600 example.com.
+					li23VC44fumpMHhKwWug2J1C2fwCMiwgofYO
+					DKydNYsJyYTlyi8ezLJ2KoBlCtOc4Fp0NbqS
+					aN8CKWh7fQVnkQ== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160225083237 29600 example.com.
+					Y8olY2OClZgC+QHnOhY52LONVOcctOnl8jNY
+					/c7sCHZO4TdPPDHDhpbVntQD+Vc4fUTx+cXY
+					GrF5sLbhddBJXg== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160225083237 29600 example.com.
+					fx2rZzhyYrp1b4tNH1SmM852VbGEeZdKrD+f
+					ZoInny1m8sovb1J9ORtVbGkOYOnInDMLWMCX
+					fghHC2MafuFV+Q== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160225083237 31323 example.com.
+					TcNU6AlrYhJLrNlkfOPJzO6A77j6C39IPoP4
+					OfmY2ClA5Vx2JO0vQ4bIHR7GIW8fiMe6M6tt
+					ZwQImhVWdG414A== )
+			0	NSEC3PARAM 1 0 10 -
+			0	RRSIG	NSEC3PARAM 7 2 0 (
+					20840201000000 20160225083237 29600 example.com.
+					iY0WB0dN1hQXoctaMwvvXzn7paQt5xUyucT3
+					xwo6HAI8Y+OJlecUfOpkkQ9lqIfsqPTXmgbY
+					RieoZGrWR6ZvaQ== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160225083237 29600 example.com.
+					QptUkTNS7umNQ5V6Z9DyGl6z+rG7G3TFmHG8
+					p9HGaKifSxjwSFW0nZ9/s86XHQ8ql5+bQmPa
+					xw39ntBmQLVxfg== )
+
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160225083237 29600 example.com.
+					CPx6000z5m1zUUpVhki1u9U7P/WMr7PUJAk3
+					G0w3v+/Lw56mDzYzNuTpPzS0noe0LKuecqRu
+					m99KpLyLOx+9QA== )
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160225083237 29600 example.com.
+					m2z+hx+8hTA7Phu6QzGJrq+o4MiURpda3fYm
+					0wTDmXtfPKsHmojGr3kBlvUMg16s2gpvNyCL
+					MSlnJ+7KCkI+Mw== )
diff --git a/tests/knot/semantic_check_data/nsec3_wrong_bitmap_02.signed b/tests/knot/semantic_check_data/nsec3_wrong_bitmap_02.signed
new file mode 100644
index 0000000..e3e4940
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec3_wrong_bitmap_02.signed
@@ -0,0 +1,70 @@
+; example.com
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400 IN NSEC3 1 0 10 - (
+					20G1GOL477RO51RK9A9NFD54TFQAL7IQ
+					NS SOA RRSIG DNSKEY NSEC3PARAM )
+; dns1.example.com -- extra type in bitmap - NSEC
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400 IN NSEC3 1 0 10 - (
+					UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A
+					A RRSIG NSEC)
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160225083237 29600 example.com.
+					li23VC44fumpMHhKwWug2J1C2fwCMiwgofYO
+					DKydNYsJyYTlyi8ezLJ2KoBlCtOc4Fp0NbqS
+					aN8CKWh7fQVnkQ== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160225083237 29600 example.com.
+					Y8olY2OClZgC+QHnOhY52LONVOcctOnl8jNY
+					/c7sCHZO4TdPPDHDhpbVntQD+Vc4fUTx+cXY
+					GrF5sLbhddBJXg== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160225083237 29600 example.com.
+					fx2rZzhyYrp1b4tNH1SmM852VbGEeZdKrD+f
+					ZoInny1m8sovb1J9ORtVbGkOYOnInDMLWMCX
+					fghHC2MafuFV+Q== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160225083237 31323 example.com.
+					TcNU6AlrYhJLrNlkfOPJzO6A77j6C39IPoP4
+					OfmY2ClA5Vx2JO0vQ4bIHR7GIW8fiMe6M6tt
+					ZwQImhVWdG414A== )
+			0	NSEC3PARAM 1 0 10 -
+			0	RRSIG	NSEC3PARAM 7 2 0 (
+					20840201000000 20160225083237 29600 example.com.
+					iY0WB0dN1hQXoctaMwvvXzn7paQt5xUyucT3
+					xwo6HAI8Y+OJlecUfOpkkQ9lqIfsqPTXmgbY
+					RieoZGrWR6ZvaQ== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160225083237 29600 example.com.
+					QptUkTNS7umNQ5V6Z9DyGl6z+rG7G3TFmHG8
+					p9HGaKifSxjwSFW0nZ9/s86XHQ8ql5+bQmPa
+					xw39ntBmQLVxfg== )
+
+20G1GOL477RO51RK9A9NFD54TFQAL7IQ.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160225083237 29600 example.com.
+					CPx6000z5m1zUUpVhki1u9U7P/WMr7PUJAk3
+					G0w3v+/Lw56mDzYzNuTpPzS0noe0LKuecqRu
+					m99KpLyLOx+9QA== )
+UTQVUHU2BLK3DHMRR5T1HD9VTEOHQT0A.example.com. 86400	RRSIG	NSEC3 7 3 86400 (
+					20840201000000 20160225083237 29600 example.com.
+					m2z+hx+8hTA7Phu6QzGJrq+o4MiURpda3fYm
+					0wTDmXtfPKsHmojGr3kBlvUMg16s2gpvNyCL
+					MSlnJ+7KCkI+Mw== )
diff --git a/tests/knot/semantic_check_data/nsec_broken_chain_01.signed b/tests/knot/semantic_check_data/nsec_broken_chain_01.signed
new file mode 100644
index 0000000..cb41dce
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec_broken_chain_01.signed
@@ -0,0 +1,72 @@
+; not coherent NSEC chain
+example.com.		86400	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+dns1.example.com.	86400	NSEC	example.com. A RRSIG NSEC
+www.example.com.	86400	NSEC	example.com. A RRSIG NSEC
+
+; signatures for NSECs
+example.com.		86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					FHLUUQTvnVboNzGoQVLpwQAcB+fUEF5xQqMQ
+					oKhE86sdvlQUiEfUpv2PJ9y3YfXHeYxJUtvm
+					cY14UkYqsdP3fA== )
+dns1.example.com.	86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					FDPJTLixRBZtMFLqk5wfYTSLnLMZiLtN7uTA
+					COEqyphK33oW+7XJzfG6ADvwGewY4hTCPQkk
+					cEg+DBI7qZ88NA== )
+www.example.com.	86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					FDPJTLixRBZtMFLqk5wfYTSLnLMZiLtN7uTA
+					COEqyphK33oW+7XJzfG6ADvwGewY4hTCPQkk
+					cEg+DBI7qZ88NA== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					xJIoENJ4d24FIVd9ZSGpQlcWN4zuriU90r/H
+					+ufcM2qtWcOGR1M1LVNIAWEVJEcD2dBGA2w1
+					B7Cx+BILQRev8w== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					vBffD+/kBuxUHfeXKYBVYxeMIbuW5f8BstRM
+					XJnC1GTGfdNvb8NknHuv5fEytBmnnpH6f9pC
+					iWLeZzFR1+aJBA== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					LMyY8+vWsFB7CziWt8rnR5jfg4Loe/xzy4TQ
+					/ITEDbz5pkoadG+0mqTHQ0F5XCe6ZJPamcyr
+					kcMw0GqUzOVb9w== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224082919 31323 example.com.
+					tpHcGRuIkul47hHXVpNAOL48c5YYMsaIJkFE
+					rlQi9wU4TCiukdJkLuPk7ykk9XrxbiCB/FwD
+					o63Vcqyy3gZfvA== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					HlfZThngg+1xglDUh8kjDtzVn5D5a9T3emMt
+					Uxfryu9va7bj+xoK4gLADGau69GCZxJNSvwK
+					TAGEqGRYFSY9Ew== )
+www.example.com.	3600	IN A	192.0.2.2
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					FLR8e2k6u7dhQA1xZ3YMxkvuktoydXC+ZNwl
+					xzW9hLpF3oKoqqY/V+kw7m2OMgnOEu2jWN4Q
+					EETdmMeQzkiuNw== )
diff --git a/tests/knot/semantic_check_data/nsec_broken_chain_02.signed b/tests/knot/semantic_check_data/nsec_broken_chain_02.signed
new file mode 100644
index 0000000..27d8ebb
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec_broken_chain_02.signed
@@ -0,0 +1,73 @@
+; not coherent NSEC chain
+example.com.		86400	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+dns1.example.com.	86400	NSEC	www.example.com. A RRSIG NSEC
+www.example.com.	86400	NSEC	www.example.com. A RRSIG NSEC
+
+; signatures for NSECs
+example.com.		86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					FHLUUQTvnVboNzGoQVLpwQAcB+fUEF5xQqMQ
+					oKhE86sdvlQUiEfUpv2PJ9y3YfXHeYxJUtvm
+					cY14UkYqsdP3fA== )
+dns1.example.com.	86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					GF3mqBf6Ny481XSbEor1uTzQZtT2DSA/3jU2
+					ZcLXXhlmHG3nI/PB49lG+17O83rDrbhcYc8G
+					cHEbLIGNr/6+Mw== )
+www.example.com.	86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					GF3mqBf6Ny481XSbEor1uTzQZtT2DSA/3jU2
+					ZcLXXhlmHG3nI/PB49lG+17O83rDrbhcYc8G
+					cHEbLIGNr/6+Mw== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					xJIoENJ4d24FIVd9ZSGpQlcWN4zuriU90r/H
+					+ufcM2qtWcOGR1M1LVNIAWEVJEcD2dBGA2w1
+					B7Cx+BILQRev8w== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					vBffD+/kBuxUHfeXKYBVYxeMIbuW5f8BstRM
+					XJnC1GTGfdNvb8NknHuv5fEytBmnnpH6f9pC
+					iWLeZzFR1+aJBA== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					LMyY8+vWsFB7CziWt8rnR5jfg4Loe/xzy4TQ
+					/ITEDbz5pkoadG+0mqTHQ0F5XCe6ZJPamcyr
+					kcMw0GqUzOVb9w== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224082919 31323 example.com.
+					tpHcGRuIkul47hHXVpNAOL48c5YYMsaIJkFE
+					rlQi9wU4TCiukdJkLuPk7ykk9XrxbiCB/FwD
+					o63Vcqyy3gZfvA== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					HlfZThngg+1xglDUh8kjDtzVn5D5a9T3emMt
+					Uxfryu9va7bj+xoK4gLADGau69GCZxJNSvwK
+					TAGEqGRYFSY9Ew== )
+
+www.example.com.	3600	IN A	192.0.2.2
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					FLR8e2k6u7dhQA1xZ3YMxkvuktoydXC+ZNwl
+					xzW9hLpF3oKoqqY/V+kw7m2OMgnOEu2jWN4Q
+					EETdmMeQzkiuNw== )
diff --git a/tests/knot/semantic_check_data/nsec_missing.signed b/tests/knot/semantic_check_data/nsec_missing.signed
new file mode 100644
index 0000000..e901607
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec_missing.signed
@@ -0,0 +1,67 @@
+example.com.		86400	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+dns1.example.com.	86400	NSEC	example.com. A RRSIG NSEC
+; missing NSEC for www.example.com.
+
+; signatures for NSECs
+example.com.		86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					FHLUUQTvnVboNzGoQVLpwQAcB+fUEF5xQqMQ
+					oKhE86sdvlQUiEfUpv2PJ9y3YfXHeYxJUtvm
+					cY14UkYqsdP3fA== )
+dns1.example.com.	86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					GF3mqBf6Ny481XSbEor1uTzQZtT2DSA/3jU2
+					ZcLXXhlmHG3nI/PB49lG+17O83rDrbhcYc8G
+					cHEbLIGNr/6+Mw== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					xJIoENJ4d24FIVd9ZSGpQlcWN4zuriU90r/H
+					+ufcM2qtWcOGR1M1LVNIAWEVJEcD2dBGA2w1
+					B7Cx+BILQRev8w== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					vBffD+/kBuxUHfeXKYBVYxeMIbuW5f8BstRM
+					XJnC1GTGfdNvb8NknHuv5fEytBmnnpH6f9pC
+					iWLeZzFR1+aJBA== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					LMyY8+vWsFB7CziWt8rnR5jfg4Loe/xzy4TQ
+					/ITEDbz5pkoadG+0mqTHQ0F5XCe6ZJPamcyr
+					kcMw0GqUzOVb9w== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224082919 31323 example.com.
+					tpHcGRuIkul47hHXVpNAOL48c5YYMsaIJkFE
+					rlQi9wU4TCiukdJkLuPk7ykk9XrxbiCB/FwD
+					o63Vcqyy3gZfvA== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					HlfZThngg+1xglDUh8kjDtzVn5D5a9T3emMt
+					Uxfryu9va7bj+xoK4gLADGau69GCZxJNSvwK
+					TAGEqGRYFSY9Ew== )
+
+www.example.com.	3600	IN A	192.0.2.2
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					FLR8e2k6u7dhQA1xZ3YMxkvuktoydXC+ZNwl
+					xzW9hLpF3oKoqqY/V+kw7m2OMgnOEu2jWN4Q
+					EETdmMeQzkiuNw== )
diff --git a/tests/knot/semantic_check_data/nsec_multiple.signed b/tests/knot/semantic_check_data/nsec_multiple.signed
new file mode 100644
index 0000000..fc8e41b
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec_multiple.signed
@@ -0,0 +1,74 @@
+; not coherent NSEC chain
+example.com.		86400	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+dns1.example.com.	86400	NSEC	www.example.com. A RRSIG NSEC
+www.example.com.	86400	NSEC	example.com. A RRSIG NSEC
+www.example.com.	86400	NSEC	www.example.com. A RRSIG NSEC
+
+; signatures for NSECs
+example.com.		86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					FHLUUQTvnVboNzGoQVLpwQAcB+fUEF5xQqMQ
+					oKhE86sdvlQUiEfUpv2PJ9y3YfXHeYxJUtvm
+					cY14UkYqsdP3fA== )
+dns1.example.com.	86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					GF3mqBf6Ny481XSbEor1uTzQZtT2DSA/3jU2
+					ZcLXXhlmHG3nI/PB49lG+17O83rDrbhcYc8G
+					cHEbLIGNr/6+Mw== )
+www.example.com.	86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					FDPJTLixRBZtMFLqk5wfYTSLnLMZiLtN7uTA
+					COEqyphK33oW+7XJzfG6ADvwGewY4hTCPQkk
+					cEg+DBI7qZ88NA== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					xJIoENJ4d24FIVd9ZSGpQlcWN4zuriU90r/H
+					+ufcM2qtWcOGR1M1LVNIAWEVJEcD2dBGA2w1
+					B7Cx+BILQRev8w== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					vBffD+/kBuxUHfeXKYBVYxeMIbuW5f8BstRM
+					XJnC1GTGfdNvb8NknHuv5fEytBmnnpH6f9pC
+					iWLeZzFR1+aJBA== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					LMyY8+vWsFB7CziWt8rnR5jfg4Loe/xzy4TQ
+					/ITEDbz5pkoadG+0mqTHQ0F5XCe6ZJPamcyr
+					kcMw0GqUzOVb9w== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224082919 31323 example.com.
+					tpHcGRuIkul47hHXVpNAOL48c5YYMsaIJkFE
+					rlQi9wU4TCiukdJkLuPk7ykk9XrxbiCB/FwD
+					o63Vcqyy3gZfvA== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					HlfZThngg+1xglDUh8kjDtzVn5D5a9T3emMt
+					Uxfryu9va7bj+xoK4gLADGau69GCZxJNSvwK
+					TAGEqGRYFSY9Ew== )
+
+www.example.com.	3600	IN A	192.0.2.2
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					FLR8e2k6u7dhQA1xZ3YMxkvuktoydXC+ZNwl
+					xzW9hLpF3oKoqqY/V+kw7m2OMgnOEu2jWN4Q
+					EETdmMeQzkiuNw== )
diff --git a/tests/knot/semantic_check_data/nsec_wrong_bitmap_01.signed b/tests/knot/semantic_check_data/nsec_wrong_bitmap_01.signed
new file mode 100644
index 0000000..058a0a3
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec_wrong_bitmap_01.signed
@@ -0,0 +1,73 @@
+example.com.		86400	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+dns1.example.com.	86400	NSEC	www.example.com. A RRSIG NSEC
+
+; extra AAAA type in NSEC bitmap
+www.example.com.	86400	NSEC	example.com. A RRSIG NSEC AAAA
+www.example.com.	3600	IN A	192.0.2.2
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					FLR8e2k6u7dhQA1xZ3YMxkvuktoydXC+ZNwl
+					xzW9hLpF3oKoqqY/V+kw7m2OMgnOEu2jWN4Q
+					EETdmMeQzkiuNw== )
+
+; signatures for NSECs
+example.com.		86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					FHLUUQTvnVboNzGoQVLpwQAcB+fUEF5xQqMQ
+					oKhE86sdvlQUiEfUpv2PJ9y3YfXHeYxJUtvm
+					cY14UkYqsdP3fA== )
+dns1.example.com.	86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					GF3mqBf6Ny481XSbEor1uTzQZtT2DSA/3jU2
+					ZcLXXhlmHG3nI/PB49lG+17O83rDrbhcYc8G
+					cHEbLIGNr/6+Mw== )
+www.example.com.	86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					FDPJTLixRBZtMFLqk5wfYTSLnLMZiLtN7uTA
+					COEqyphK33oW+7XJzfG6ADvwGewY4hTCPQkk
+					cEg+DBI7qZ88NA== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					xJIoENJ4d24FIVd9ZSGpQlcWN4zuriU90r/H
+					+ufcM2qtWcOGR1M1LVNIAWEVJEcD2dBGA2w1
+					B7Cx+BILQRev8w== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					vBffD+/kBuxUHfeXKYBVYxeMIbuW5f8BstRM
+					XJnC1GTGfdNvb8NknHuv5fEytBmnnpH6f9pC
+					iWLeZzFR1+aJBA== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					LMyY8+vWsFB7CziWt8rnR5jfg4Loe/xzy4TQ
+					/ITEDbz5pkoadG+0mqTHQ0F5XCe6ZJPamcyr
+					kcMw0GqUzOVb9w== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224082919 31323 example.com.
+					tpHcGRuIkul47hHXVpNAOL48c5YYMsaIJkFE
+					rlQi9wU4TCiukdJkLuPk7ykk9XrxbiCB/FwD
+					o63Vcqyy3gZfvA== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					HlfZThngg+1xglDUh8kjDtzVn5D5a9T3emMt
+					Uxfryu9va7bj+xoK4gLADGau69GCZxJNSvwK
+					TAGEqGRYFSY9Ew== )
diff --git a/tests/knot/semantic_check_data/nsec_wrong_bitmap_02.signed b/tests/knot/semantic_check_data/nsec_wrong_bitmap_02.signed
new file mode 100644
index 0000000..dafdc92
--- /dev/null
+++ b/tests/knot/semantic_check_data/nsec_wrong_bitmap_02.signed
@@ -0,0 +1,73 @@
+example.com.		86400	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+dns1.example.com.	86400	NSEC	www.example.com. A RRSIG NSEC
+
+; missing A type in NSEC bitmap
+www.example.com.	86400	NSEC	example.com. RRSIG NSEC
+www.example.com.	3600	IN A	192.0.2.2
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					FLR8e2k6u7dhQA1xZ3YMxkvuktoydXC+ZNwl
+					xzW9hLpF3oKoqqY/V+kw7m2OMgnOEu2jWN4Q
+					EETdmMeQzkiuNw== )
+
+; signatures for NSECs
+example.com.		86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					FHLUUQTvnVboNzGoQVLpwQAcB+fUEF5xQqMQ
+					oKhE86sdvlQUiEfUpv2PJ9y3YfXHeYxJUtvm
+					cY14UkYqsdP3fA== )
+dns1.example.com.	86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					GF3mqBf6Ny481XSbEor1uTzQZtT2DSA/3jU2
+					ZcLXXhlmHG3nI/PB49lG+17O83rDrbhcYc8G
+					cHEbLIGNr/6+Mw== )
+www.example.com.	86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160224082919 29600 example.com.
+					FDPJTLixRBZtMFLqk5wfYTSLnLMZiLtN7uTA
+					COEqyphK33oW+7XJzfG6ADvwGewY4hTCPQkk
+					cEg+DBI7qZ88NA== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					xJIoENJ4d24FIVd9ZSGpQlcWN4zuriU90r/H
+					+ufcM2qtWcOGR1M1LVNIAWEVJEcD2dBGA2w1
+					B7Cx+BILQRev8w== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					vBffD+/kBuxUHfeXKYBVYxeMIbuW5f8BstRM
+					XJnC1GTGfdNvb8NknHuv5fEytBmnnpH6f9pC
+					iWLeZzFR1+aJBA== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					LMyY8+vWsFB7CziWt8rnR5jfg4Loe/xzy4TQ
+					/ITEDbz5pkoadG+0mqTHQ0F5XCe6ZJPamcyr
+					kcMw0GqUzOVb9w== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160224082919 31323 example.com.
+					tpHcGRuIkul47hHXVpNAOL48c5YYMsaIJkFE
+					rlQi9wU4TCiukdJkLuPk7ykk9XrxbiCB/FwD
+					o63Vcqyy3gZfvA== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160224082919 29600 example.com.
+					HlfZThngg+1xglDUh8kjDtzVn5D5a9T3emMt
+					Uxfryu9va7bj+xoK4gLADGau69GCZxJNSvwK
+					TAGEqGRYFSY9Ew== )
diff --git a/tests/knot/semantic_check_data/rrsig_rdata_ttl.signed b/tests/knot/semantic_check_data/rrsig_rdata_ttl.signed
new file mode 100644
index 0000000..b626b45
--- /dev/null
+++ b/tests/knot/semantic_check_data/rrsig_rdata_ttl.signed
@@ -0,0 +1,58 @@
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 600 (
+					20840201000000 20160201000000 29600 example.com.
+					f24sVhH1P/0mEMYTMbFLrWmJtl6kqZF6yzaS
+					TcyK6JhVM4sDT//YnjizJGsTVGSCelz3FxMj
+					LdiUm9AD05uY6A== )
+
+dns1.example.com.	86400	NSEC	example.com. A RRSIG NSEC
+			86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160201000000 29600 example.com.
+					FgQ4VD1yDeA+uvJ+o8e1F28ijooV1IMfEtki
+					kLbaIvFcgZbPvTnXXHyesHO2OPiRsc7zF576
+					Z6prBT8CkMM7bw== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160201000000 29600 example.com.
+					kINKkWiBvb9Dpb0vghlLhXyObSzsYYNsOqe9
+					pWJN4lI4F2O3T6biPTQPsq3mYMR+6x9gPr6v
+					ysEPHlGtLdTLag== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160201000000 29600 example.com.
+					LkagMndC+wJGlQycPDvNmCZ0/QuBB7Zo4UVZ
+					He5jzQrE3Hnq8tn+/QfJ/yn62qCZ87DETwTT
+					rGaLqOTYRb1isg== )
+			86400	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+			86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160201000000 29600 example.com.
+					YDJ1tQvNlv8Y7cGioq8nkbaETx7wmyJKqa0B
+					8hDLClYA4nf9UtyVXqZCISa2PlgRdBc5GEEh
+					U5BuLr4wYXqEFA== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160201000000 29600 example.com.
+					FPOm8y3e09jh0fv0ZaOecWbdIXDAoERVKdjz
+					qsg1Etop1n6nDhO/lW3pwOUe02Zq2vretu2W
+					DozlDr5E6ZoqPA== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160201000000 31323 example.com.
+					cZTevjvA8UO9Tqet/pbsN0Peep6aN8heyxMK
+					XP/Twsj4u0DeClKeIN7pd7Gi7Aac/UV2dev/
+					x/90SM22VQVpeQ== )
diff --git a/tests/knot/semantic_check_data/rrsig_signed.signed b/tests/knot/semantic_check_data/rrsig_signed.signed
new file mode 100644
index 0000000..2798026
--- /dev/null
+++ b/tests/knot/semantic_check_data/rrsig_signed.signed
@@ -0,0 +1,62 @@
+dns1.example.com.	86400	RRSIG	RRSIG 7 3 86400 (
+					20840201000000 20160201000000 29600 example.com.
+					DummySignatureDEADBEEF8ijooV1IMfEtki
+					kLbaIvFcgZbPvTnXXHyesHO2OPiRsc7zF576
+					Z6prBT8CkMM7bw== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160201000000 29600 example.com.
+					kINKkWiBvb9Dpb0vghlLhXyObSzsYYNsOqe9
+					pWJN4lI4F2O3T6biPTQPsq3mYMR+6x9gPr6v
+					ysEPHlGtLdTLag== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160201000000 29600 example.com.
+					LkagMndC+wJGlQycPDvNmCZ0/QuBB7Zo4UVZ
+					He5jzQrE3Hnq8tn+/QfJ/yn62qCZ87DETwTT
+					rGaLqOTYRb1isg== )
+			86400	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+			86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160201000000 29600 example.com.
+					YDJ1tQvNlv8Y7cGioq8nkbaETx7wmyJKqa0B
+					8hDLClYA4nf9UtyVXqZCISa2PlgRdBc5GEEh
+					U5BuLr4wYXqEFA== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160201000000 29600 example.com.
+					FPOm8y3e09jh0fv0ZaOecWbdIXDAoERVKdjz
+					qsg1Etop1n6nDhO/lW3pwOUe02Zq2vretu2W
+					DozlDr5E6ZoqPA== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160201000000 31323 example.com.
+					cZTevjvA8UO9Tqet/pbsN0Peep6aN8heyxMK
+					XP/Twsj4u0DeClKeIN7pd7Gi7Aac/UV2dev/
+					x/90SM22VQVpeQ== )
+dns1.example.com.	3600	IN A	192.0.2.1
+			3600	RRSIG	A 7 3 3600 (
+					20840201000000 20160201000000 29600 example.com.
+					f24sVhH1P/0mEMYTMbFLrWmJtl6kqZF6yzaS
+					TcyK6JhVM4sDT//YnjizJGsTVGSCelz3FxMj
+					LdiUm9AD05uY6A== )
+			86400	NSEC	example.com. A RRSIG NSEC
+			86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160201000000 29600 example.com.
+					FgQ4VD1yDeA+uvJ+o8e1F28ijooV1IMfEtki
+					kLbaIvFcgZbPvTnXXHyesHO2OPiRsc7zF576
+					Z6prBT8CkMM7bw== )
diff --git a/tests/knot/semantic_check_data/rrsig_ttl.signed b/tests/knot/semantic_check_data/rrsig_ttl.signed
new file mode 100644
index 0000000..04be771
--- /dev/null
+++ b/tests/knot/semantic_check_data/rrsig_ttl.signed
@@ -0,0 +1,58 @@
+dns1.example.com.	3600	IN A	192.0.2.1
+			600	RRSIG	A 7 3 3600 (
+					20840201000000 20160201000000 29600 example.com.
+					f24sVhH1P/0mEMYTMbFLrWmJtl6kqZF6yzaS
+					TcyK6JhVM4sDT//YnjizJGsTVGSCelz3FxMj
+					LdiUm9AD05uY6A== )
+
+dns1.example.com.	86400	NSEC	example.com. A RRSIG NSEC
+			86400	RRSIG	NSEC 7 3 86400 (
+					20840201000000 20160201000000 29600 example.com.
+					FgQ4VD1yDeA+uvJ+o8e1F28ijooV1IMfEtki
+					kLbaIvFcgZbPvTnXXHyesHO2OPiRsc7zF576
+					Z6prBT8CkMM7bw== )
+
+example.com.		3600	IN SOA	dns1.example.com. hostmaster.example.com. (
+					2010111220 ; serial
+					21600      ; refresh (6 hours)
+					3600       ; retry (1 hour)
+					604800     ; expire (1 week)
+					86400      ; minimum (1 day)
+					)
+			3600	RRSIG	SOA 7 2 3600 (
+					20840201000000 20160201000000 29600 example.com.
+					kINKkWiBvb9Dpb0vghlLhXyObSzsYYNsOqe9
+					pWJN4lI4F2O3T6biPTQPsq3mYMR+6x9gPr6v
+					ysEPHlGtLdTLag== )
+			3600	NS	dns1.example.com.
+			3600	RRSIG	NS 7 2 3600 (
+					20840201000000 20160201000000 29600 example.com.
+					LkagMndC+wJGlQycPDvNmCZ0/QuBB7Zo4UVZ
+					He5jzQrE3Hnq8tn+/QfJ/yn62qCZ87DETwTT
+					rGaLqOTYRb1isg== )
+			86400	NSEC	dns1.example.com. NS SOA RRSIG NSEC DNSKEY
+			86400	RRSIG	NSEC 7 2 86400 (
+					20840201000000 20160201000000 29600 example.com.
+					YDJ1tQvNlv8Y7cGioq8nkbaETx7wmyJKqa0B
+					8hDLClYA4nf9UtyVXqZCISa2PlgRdBc5GEEh
+					U5BuLr4wYXqEFA== )
+			3600	DNSKEY	256 3 7 (
+					AwEAAcvvW/oJAjcRdntRC8J52baXoNFVWOFz
+					oVFe3Vgl8aBBiGh3gnbuNt7xKmy9z2qc2/35
+					MFwieWYfDdgUnPxyKMM=
+					) ; ZSK; alg = NSEC3RSASHA1; key id = 29600
+			3600	DNSKEY	257 3 7 (
+					AwEAAeXCF7sHLcFiaCwCFH4xh2CJcCp55i04
+					exG41EtzILS2waabEM5byhRkoylbv91q6HY+
+					JH9YXitS21LMD0Hqp1s=
+					) ; KSK; alg = NSEC3RSASHA1; key id = 31323
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160201000000 29600 example.com.
+					FPOm8y3e09jh0fv0ZaOecWbdIXDAoERVKdjz
+					qsg1Etop1n6nDhO/lW3pwOUe02Zq2vretu2W
+					DozlDr5E6ZoqPA== )
+			3600	RRSIG	DNSKEY 7 2 3600 (
+					20840201000000 20160201000000 31323 example.com.
+					cZTevjvA8UO9Tqet/pbsN0Peep6aN8heyxMK
+					XP/Twsj4u0DeClKeIN7pd7Gi7Aac/UV2dev/
+					x/90SM22VQVpeQ== )
diff --git a/tests/knot/test_acl.c b/tests/knot/test_acl.c
new file mode 100644
index 0000000..be35607
--- /dev/null
+++ b/tests/knot/test_acl.c
@@ -0,0 +1,200 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <tap/basic.h>
+
+#include "test_conf.h"
+#include "libknot/libknot.h"
+#include "knot/updates/acl.h"
+#include "contrib/sockaddr.h"
+
+#define ZONE	"example.zone"
+#define KEY1	"key1_md5"
+#define KEY2	"key2_md5"
+#define KEY3	"key3_sha256"
+
+static void check_sockaddr_set(struct sockaddr_storage *ss, int family,
+                               const char *straddr, int port)
+{
+	int ret = sockaddr_set(ss, family, straddr, port);
+	ok(ret == 0, "set address '%s'", straddr);
+}
+
+static void test_acl_allowed(void)
+{
+	int ret;
+	conf_val_t acl;
+	struct sockaddr_storage addr = { 0 };
+
+	knot_dname_t *zone_name = knot_dname_from_str_alloc(ZONE);
+	ok(zone_name != NULL, "create zone dname");
+	knot_dname_t *key1_name = knot_dname_from_str_alloc(KEY1);
+	ok(key1_name != NULL, "create "KEY1);
+	knot_dname_t *key2_name = knot_dname_from_str_alloc(KEY2);
+	ok(key2_name != NULL, "create "KEY2);
+	knot_dname_t *key3_name = knot_dname_from_str_alloc(KEY3);
+	ok(key3_name != NULL, "create "KEY3);
+
+	knot_tsig_key_t key0 = { 0 };
+	knot_tsig_key_t key1 = { DNSSEC_TSIG_HMAC_MD5,    key1_name };
+	knot_tsig_key_t key2 = { DNSSEC_TSIG_HMAC_MD5,    key2_name };
+	knot_tsig_key_t key3 = { DNSSEC_TSIG_HMAC_SHA256, key3_name };
+
+	const char *conf_str =
+		"key:\n"
+		"  - id: "KEY1"\n"
+		"    algorithm: hmac-md5\n"
+		"    secret: Zm9v\n"
+		"  - id: "KEY2"\n"
+		"    algorithm: hmac-md5\n"
+		"    secret: Zm9v\n"
+		"  - id: "KEY3"\n"
+		"    algorithm: hmac-sha256\n"
+		"    secret: Zm8=\n"
+		"\n"
+		"acl:\n"
+		"  - id: acl_key_addr\n"
+		"    address: [ 2001::1 ]\n"
+		"    key: [ key1_md5 ]\n"
+		"    action: [ transfer ]\n"
+		"  - id: acl_deny\n"
+		"    address: [ 240.0.0.2 ]\n"
+		"    action: [ notify ]\n"
+		"    deny: on\n"
+		"  - id: acl_no_action_deny\n"
+		"    address: [ 240.0.0.3 ]\n"
+		"    deny: on\n"
+		"  - id: acl_multi_addr\n"
+		"    address: [ 192.168.1.1, 240.0.0.0/24 ]\n"
+		"    action: [ notify, update ]\n"
+		"  - id: acl_multi_key\n"
+		"    key: [ key2_md5, key3_sha256 ]\n"
+		"    action: [ notify, update ]\n"
+		"  - id: acl_range_addr\n"
+		"    address: [ 100.0.0.0-100.0.0.5, ::0-::5 ]\n"
+		"    action: [ transfer ]\n"
+		"\n"
+		"zone:\n"
+		"  - domain: "ZONE"\n"
+		"    acl: [ acl_key_addr, acl_deny, acl_no_action_deny ]\n"
+		"    acl: [ acl_multi_addr, acl_multi_key ]\n"
+		"    acl: [ acl_range_addr ]";
+
+	ret = test_conf(conf_str, NULL);
+	is_int(KNOT_EOK, ret, "Prepare configuration");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET6, "2001::1", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_NONE, &addr, &key1);
+	ok(ret == true, "Address, key, empty action");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET6, "2001::1", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_TRANSFER, &addr, &key1);
+	ok(ret == true, "Address, key, action match");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET6, "2001::2", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_TRANSFER, &addr, &key1);
+	ok(ret == false, "Address not match, key, action match");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET6, "2001::1", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_TRANSFER, &addr, &key0);
+	ok(ret == false, "Address match, no key, action match");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET6, "2001::1", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_TRANSFER, &addr, &key2);
+	ok(ret == false, "Address match, key not match, action match");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET6, "2001::1", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_NOTIFY, &addr, &key1);
+	ok(ret == false, "Address, key match, action not match");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET, "240.0.0.1", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_NOTIFY, &addr, &key0);
+	ok(ret == true, "Second address match, no key, action match");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET, "240.0.0.1", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_NOTIFY, &addr, &key1);
+	ok(ret == false, "Second address match, extra key, action match");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET, "240.0.0.2", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_NOTIFY, &addr, &key0);
+	ok(ret == false, "Denied address match, no key, action match");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET, "240.0.0.2", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_UPDATE, &addr, &key0);
+	ok(ret == true, "Denied address match, no key, action not match");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET, "240.0.0.3", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_UPDATE, &addr, &key0);
+	ok(ret == false, "Denied address match, no key, no action");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET, "1.1.1.1", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_UPDATE, &addr, &key3);
+	ok(ret == true, "Arbitrary address, second key, action match");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET, "100.0.0.1", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_TRANSFER, &addr, &key0);
+	ok(ret == true, "IPv4 address from range, no key, action match");
+
+	acl = conf_zone_get(conf(), C_ACL, zone_name);
+	ok(acl.code == KNOT_EOK, "Get zone ACL");
+	check_sockaddr_set(&addr, AF_INET6, "::1", 0);
+	ret = acl_allowed(conf(), &acl, ACL_ACTION_TRANSFER, &addr, &key0);
+	ok(ret == true, "IPv6 address from range, no key, action match");
+
+	conf_free(conf());
+	knot_dname_free(zone_name, NULL);
+	knot_dname_free(key1_name, NULL);
+	knot_dname_free(key2_name, NULL);
+	knot_dname_free(key3_name, NULL);
+}
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	diag("acl_allowed");
+	test_acl_allowed();
+
+	return 0;
+}
diff --git a/tests/knot/test_changeset.c b/tests/knot/test_changeset.c
new file mode 100644
index 0000000..16179ec
--- /dev/null
+++ b/tests/knot/test_changeset.c
@@ -0,0 +1,188 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <config.h>
+#include <assert.h>
+#include <tap/basic.h>
+
+#include "libknot/errcode.h"
+#include "libknot/error.h"
+#include "knot/updates/changesets.h"
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	// Test with NULL changeset
+	ok(changeset_size(NULL) == 0, "changeset: NULL size");
+	ok(changeset_empty(NULL), "changeset: NULL empty");
+
+	// Test creation.
+	knot_dname_t *d = knot_dname_from_str_alloc("test.");
+	assert(d);
+	changeset_t *ch = changeset_new(d);
+	knot_dname_free(d, NULL);
+	ok(ch != NULL, "changeset: new");
+	if (!ch) {
+		return 1;
+	}
+	ok(changeset_empty(ch), "changeset: empty");
+	ch->soa_to = (knot_rrset_t *)0xdeadbeef;
+	ok(!changeset_empty(ch), "changseset: empty SOA");
+	ch->soa_to = NULL;
+	ok(changeset_size(ch) == 0, "changeset: empty size");
+
+	// Test additions.
+	d = knot_dname_from_str_alloc("non.terminals.test.");
+	assert(d);
+	knot_rrset_t *apex_txt_rr = knot_rrset_new(d, KNOT_RRTYPE_TXT, KNOT_CLASS_IN, 3600, NULL);
+	assert(apex_txt_rr);
+	uint8_t data[8] = "\7teststr";
+	knot_rrset_add_rdata(apex_txt_rr, data, sizeof(data), NULL);
+
+	int ret = changeset_add_addition(ch, apex_txt_rr, CHANGESET_CHECK);
+	is_int(KNOT_EOK, ret, "changeset: add RRSet");
+	ok(changeset_size(ch) == 1, "changeset: size add");
+	ret = changeset_add_removal(ch, apex_txt_rr, CHANGESET_CHECK);
+	is_int(KNOT_EOK, ret, "changeset: rem RRSet");
+	ok(changeset_size(ch) == 1, "changeset: size remove");
+	ok(!changeset_empty(ch), "changeset: empty");
+	changeset_add_addition(ch, apex_txt_rr, CHANGESET_CHECK);
+
+	// Add another RR to node.
+	knot_rrset_t *apex_spf_rr = knot_rrset_new(d, KNOT_RRTYPE_SPF, KNOT_CLASS_IN, 3600, NULL);
+	assert(apex_spf_rr);
+	knot_rrset_add_rdata(apex_spf_rr, data, sizeof(data), NULL);
+	ret = changeset_add_addition(ch, apex_spf_rr, CHANGESET_CHECK);
+	is_int(KNOT_EOK, ret, "changeset: add multiple");
+
+	// Add another node.
+	knot_dname_free(d, NULL);
+	d = knot_dname_from_str_alloc("here.come.more.non.terminals.test");
+	assert(d);
+	knot_rrset_t *other_rr = knot_rrset_new(d, KNOT_RRTYPE_TXT, KNOT_CLASS_IN, 3600, NULL);
+	assert(other_rr);
+	knot_rrset_add_rdata(other_rr, data, sizeof(data), NULL);
+	ret = changeset_add_addition(ch, other_rr, CHANGESET_CHECK);
+	is_int(KNOT_EOK, ret, "changeset: remove multiple");
+
+	// Test add traversal.
+	changeset_iter_t it;
+	ret = changeset_iter_add(&it, ch);
+	is_int(KNOT_EOK, ret, "changeset: create iter add");
+	// Order: non.terminals.test. TXT, SPF, here.come.more.non.terminals.test. TXT.
+	knot_rrset_t iter = changeset_iter_next(&it);
+	bool trav_ok = knot_rrset_equal(&iter, apex_txt_rr, KNOT_RRSET_COMPARE_WHOLE);
+	iter = changeset_iter_next(&it);
+	trav_ok = trav_ok && knot_rrset_equal(&iter, apex_spf_rr, KNOT_RRSET_COMPARE_WHOLE);
+	iter = changeset_iter_next(&it);
+	trav_ok = trav_ok && knot_rrset_equal(&iter, other_rr, KNOT_RRSET_COMPARE_WHOLE);
+
+	ok(trav_ok, "changeset: add traversal");
+
+	iter = changeset_iter_next(&it);
+	changeset_iter_clear(&it);
+	ok(knot_rrset_empty(&iter), "changeset: traversal: skip non-terminals");
+
+	changeset_add_removal(ch, apex_txt_rr, CHANGESET_CHECK);
+	changeset_add_removal(ch, apex_txt_rr, CHANGESET_CHECK);
+
+	// Test remove traversal.
+	ret = changeset_iter_rem(&it, ch);
+	is_int(KNOT_EOK, ret, "changeset: create iter rem");
+	iter = changeset_iter_next(&it);
+	ok(knot_rrset_equal(&iter, apex_txt_rr, KNOT_RRSET_COMPARE_WHOLE),
+	   "changeset: rem traversal");
+	changeset_iter_clear(&it);
+
+	// Test all traversal - just count.
+	ret = changeset_iter_all(&it, ch);
+	is_int(KNOT_EOK, ret, "changest: create iter all");
+	size_t size = 0;
+	iter = changeset_iter_next(&it);
+	while (!knot_rrset_empty(&iter)) {
+		++size;
+		iter = changeset_iter_next(&it);
+	}
+	changeset_iter_clear(&it);
+	ok(size == 3, "changeset: iter all");
+
+	// Create new changeset.
+	knot_dname_free(d, NULL);
+	d = knot_dname_from_str_alloc("test.");
+	assert(d);
+	changeset_t *ch2 = changeset_new(d);
+	knot_dname_free(d, NULL);
+	assert(ch2);
+	// Add something to add section.
+	knot_dname_free(apex_txt_rr->owner, NULL);
+	apex_txt_rr->owner = knot_dname_from_str_alloc("something.test.");
+	assert(apex_txt_rr->owner);
+	ret = changeset_add_addition(ch2, apex_txt_rr, CHANGESET_CHECK);
+	assert(ret == KNOT_EOK);
+
+	// Add something to remove section.
+	knot_dname_free(apex_txt_rr->owner, NULL);
+	apex_txt_rr->owner =
+		knot_dname_from_str_alloc("and.now.for.something.completely.different.test.");
+	assert(apex_txt_rr->owner);
+	ret = changeset_add_removal(ch2, apex_txt_rr, CHANGESET_CHECK);
+	assert(ret == KNOT_EOK);
+
+	// Test merge.
+	ret = changeset_merge(ch, ch2, 0);
+	ok(ret == KNOT_EOK && changeset_size(ch) == 5, "changeset: merge");
+
+	// Test preapply fix.
+	zone_contents_t *z = zone_contents_new((const knot_dname_t *)"\x04""test");
+	knot_dname_free(apex_txt_rr->owner, NULL);
+	apex_txt_rr->owner = knot_dname_from_str_alloc("something.test.");
+	assert(apex_txt_rr->owner);
+	zone_node_t *znode = NULL;
+	ret = zone_contents_add_rr(z, apex_txt_rr, &znode);
+	assert(ret == KNOT_EOK);
+	ret = changeset_preapply_fix(z, ch2);
+	ok(ret == KNOT_EOK, "changeset: preapply fix ok (%s)", knot_strerror(ret));
+	ok(changeset_empty(ch2), "changeset: preapply fix works");
+	zone_contents_deep_free(z);
+
+	// Test cancelout.
+	ret = changeset_add_removal(ch2, apex_txt_rr, 0);
+	assert(ret == KNOT_EOK);
+	ret = changeset_add_addition(ch2, apex_txt_rr, 0);
+	assert(ret == KNOT_EOK);
+	ret = changeset_cancelout(ch2);
+	ok(ret == KNOT_EOK, "changeset: cancelout ok (%s)", knot_strerror(ret));
+	ok(changeset_empty(ch2), "changeset: cancelout works");
+
+	// Test cleanup.
+	changeset_clear(ch);
+	ok(changeset_empty(ch), "changeset: clear");
+	free(ch);
+
+	list_t chgs;
+	init_list(&chgs);
+	add_head(&chgs, &ch2->n);
+	changesets_clear(&chgs);
+	ok(changeset_empty(ch2), "changeset: clear list");
+	free(ch2);
+
+	knot_rrset_free(apex_txt_rr, NULL);
+	knot_rrset_free(apex_spf_rr, NULL);
+	knot_rrset_free(other_rr, NULL);
+
+	return 0;
+}
diff --git a/tests/knot/test_conf.c b/tests/knot/test_conf.c
new file mode 100644
index 0000000..59ae4dd
--- /dev/null
+++ b/tests/knot/test_conf.c
@@ -0,0 +1,210 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <tap/basic.h>
+
+#include "knot/conf/conf.c"
+#include "test_conf.h"
+
+#define ZONE_ARPA	"0/25.2.0.192.in-addr.arpa."
+#define ZONE_ROOT	"."
+#define ZONE_1LABEL	"x."
+#define ZONE_3LABEL	"abc.ab.a."
+#define ZONE_UNKNOWN	"unknown."
+
+static void check_name(const char *zone, const char *name, const char *ref)
+{
+	knot_dname_t *z = knot_dname_from_str_alloc(zone);
+
+	char *file = get_filename(NULL, NULL, z, name);
+	ok(file != NULL, "Get zonefile path for %s", zone);
+	if (file != NULL) {
+		ok(strcmp(file, ref) == 0, "Zonefile path compare %s", name);
+		free(file);
+	}
+
+	knot_dname_free(z, NULL);
+}
+
+static void check_name_err(const char *zone, const char *name)
+{
+	knot_dname_t *z = knot_dname_from_str_alloc(zone);
+
+	ok(get_filename(NULL, NULL, z, name) == NULL, "Invalid name %s", name);
+
+	knot_dname_free(z, NULL);
+}
+
+static void test_get_filename(void)
+{
+	// Name formatter.
+	char *zone = "abc";
+	check_name(zone, "/%s", "/abc");
+
+	zone = ".";
+	check_name(zone, "/%s", "/");
+
+	// Char formatter.
+	zone = "abc.def.g";
+	check_name(zone, "/%c[0]", "/a");
+	check_name(zone, "/%c[3]", "/.");
+	check_name(zone, "/%c[8]", "/g");
+	check_name(zone, "/%c[9]", "/.");
+	check_name(zone, "/%c[10]", "/");
+	check_name(zone, "/%c[255]", "/");
+	check_name(zone, "/%c[0-1]", "/ab");
+	check_name(zone, "/%c[1-1]", "/b");
+	check_name(zone, "/%c[1-3]", "/bc.");
+	check_name(zone, "/%c[1-4]", "/bc.d");
+	check_name(zone, "/%c[254-255]", "/");
+	check_name_err(zone, "/%c");
+	check_name_err(zone, "/%cx");
+	check_name_err(zone, "/%c[a]");
+	check_name_err(zone, "/%c[:]");
+	check_name_err(zone, "/%c[/]");
+	check_name_err(zone, "/%c[-1]");
+	check_name_err(zone, "/%c[256]");
+	check_name_err(zone, "/%c[");
+	check_name_err(zone, "/%c[1");
+	check_name_err(zone, "/%c[1-");
+	check_name_err(zone, "/%c[1-2");
+	check_name_err(zone, "/%c[1-b]");
+	check_name_err(zone, "/%c[8-0]");
+
+	zone = "abcd";
+	check_name(zone, "/%c[2-9]", "/cd.");
+	check_name(zone, "/%c[3]", "/d");
+	check_name(zone, "/%c[4]", "/.");
+
+	zone = ".";
+	check_name(zone, "/%c[0]", "/.");
+	check_name(zone, "/%c[1]", "/");
+
+	// Label formatter.
+	zone = "abc.def.gh";
+	check_name(zone, "/%l[0]", "/gh");
+	check_name(zone, "/%l[1]", "/def");
+	check_name(zone, "/%l[2]", "/abc");
+	check_name(zone, "/%l[3]", "/");
+	check_name(zone, "/%l[255]", "/");
+	check_name(zone, "/%l[0]-%l[1]-%l[2]", "/gh-def-abc");
+	check_name_err(zone, "/%l[0-1]");
+	check_name_err(zone, "/%l[-1]");
+	check_name_err(zone, "/%l[256]");
+
+	zone = ".";
+	check_name(zone, "/%l[0]", "/");
+	check_name(zone, "/%l[1]", "/");
+}
+
+static void test_conf_zonefile(void)
+{
+	int ret;
+	char *file;
+
+	knot_dname_t *zone_arpa = knot_dname_from_str_alloc(ZONE_ARPA);
+	ok(zone_arpa != NULL, "create dname "ZONE_ARPA);
+	knot_dname_t *zone_root = knot_dname_from_str_alloc(ZONE_ROOT);
+	ok(zone_root != NULL, "create dname "ZONE_ROOT);
+	knot_dname_t *zone_1label = knot_dname_from_str_alloc(ZONE_1LABEL);
+	ok(zone_1label != NULL, "create dname "ZONE_1LABEL);
+	knot_dname_t *zone_3label = knot_dname_from_str_alloc(ZONE_3LABEL);
+	ok(zone_3label != NULL, "create dname "ZONE_3LABEL);
+	knot_dname_t *zone_unknown = knot_dname_from_str_alloc(ZONE_UNKNOWN);
+	ok(zone_unknown != NULL, "create dname "ZONE_UNKNOWN);
+
+	const char *conf_str =
+		"template:\n"
+		"  - id: default\n"
+		"    storage: /tmp\n"
+		"\n"
+		"zone:\n"
+		"  - domain: "ZONE_ARPA"\n"
+		"    file: dir/a%%b/%s.suffix/%a\n"
+		"  - domain: "ZONE_ROOT"\n"
+		"    file: /%s\n"
+		"  - domain: "ZONE_1LABEL"\n"
+		"    file: /%s\n"
+		"  - domain: "ZONE_3LABEL"\n";
+
+	ret = test_conf(conf_str, NULL);
+	is_int(KNOT_EOK, ret, "Prepare configuration");
+
+	// Relative path with formatters.
+	file = conf_zonefile(conf(), zone_arpa);
+	ok(file != NULL, "Get zonefile path for "ZONE_ARPA);
+	if (file != NULL) {
+		ok(strcmp(file, "/tmp/dir/a%b/0_25.2.0.192.in-addr.arpa.suffix/") == 0,
+		          "Zonefile path compare for "ZONE_ARPA);
+		free(file);
+	}
+
+	// Absolute path without formatters - root zone.
+	file = conf_zonefile(conf(), zone_root);
+	ok(file != NULL, "Get zonefile path for "ZONE_ROOT);
+	if (file != NULL) {
+		ok(strcmp(file, "/") == 0,
+		          "Zonefile path compare for "ZONE_ROOT);
+		free(file);
+	}
+
+	// Absolute path without formatters - non-root zone.
+	file = conf_zonefile(conf(), zone_1label);
+	ok(file != NULL, "Get zonefile path for "ZONE_1LABEL);
+	if (file != NULL) {
+		ok(strcmp(file, "/x") == 0,
+		          "Zonefile path compare for "ZONE_1LABEL);
+		free(file);
+	}
+
+	// Default zonefile path.
+	file = conf_zonefile(conf(), zone_3label);
+	ok(file != NULL, "Get zonefile path for "ZONE_3LABEL);
+	if (file != NULL) {
+		ok(strcmp(file, "/tmp/abc.ab.a.zone") == 0,
+		          "Zonefile path compare for "ZONE_3LABEL);
+		free(file);
+	}
+
+	// Unknown zone zonefile path.
+	file = conf_zonefile(conf(), zone_unknown);
+	ok(file != NULL, "Get zonefile path for "ZONE_UNKNOWN);
+	if (file != NULL) {
+		ok(strcmp(file, "/tmp/unknown.zone") == 0,
+		          "Zonefile path compare for "ZONE_UNKNOWN);
+		free(file);
+	}
+
+	conf_free(conf());
+	knot_dname_free(zone_arpa, NULL);
+	knot_dname_free(zone_root, NULL);
+	knot_dname_free(zone_1label, NULL);
+	knot_dname_free(zone_3label, NULL);
+	knot_dname_free(zone_unknown, NULL);
+}
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	diag("get_filename");
+	test_get_filename();
+
+	diag("conf_zonefile");
+	test_conf_zonefile();
+
+	return 0;
+}
diff --git a/tests/knot/test_conf.h b/tests/knot/test_conf.h
new file mode 100644
index 0000000..708692a
--- /dev/null
+++ b/tests/knot/test_conf.h
@@ -0,0 +1,45 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#pragma once
+
+#include "knot/conf/conf.h"
+#include "libknot/errcode.h"
+
+/* Prepare server configuration. */
+static inline int test_conf(const char *conf_str, const yp_item_t *schema)
+{
+	// Use default schema if not specified.
+	if (schema == NULL) {
+		schema = conf_schema;
+	}
+
+	conf_t *new_conf = NULL;
+	int ret = conf_new(&new_conf, schema, NULL, 2 * 1024 * 1024, CONF_FNONE);
+	if (ret != KNOT_EOK) {
+		return ret;
+	}
+
+	ret = conf_import(new_conf, conf_str, false);
+	if (ret != KNOT_EOK) {
+		conf_free(new_conf);
+		return ret;
+	}
+
+	conf_update(new_conf, CONF_UPD_FNONE);
+
+	return KNOT_EOK;
+}
diff --git a/tests/knot/test_conf_tools.c b/tests/knot/test_conf_tools.c
new file mode 100644
index 0000000..178b269
--- /dev/null
+++ b/tests/knot/test_conf_tools.c
@@ -0,0 +1,123 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <tap/basic.h>
+
+#include "libknot/yparser/yptrafo.h"
+#include "knot/conf/tools.h"
+#include "libknot/libknot.h"
+
+static void mod_id_test(const char *txt, const char *val)
+{
+	int ret;
+	uint8_t b[64];
+	size_t b_len = sizeof(b);
+	char t[64];
+	size_t t_len = sizeof(t);
+	yp_item_t i = { NULL, YP_TDATA, YP_VDATA = { 0, NULL,
+	                                             mod_id_to_bin,
+	                                             mod_id_to_txt } };
+
+	diag("module id \"%s\":", txt);
+	ret = yp_item_to_bin(&i, txt, strlen(txt), b, &b_len);
+	is_int(KNOT_EOK, ret, "txt to bin");
+	ok(memcmp(b, val, b_len) == 0, "compare");
+	ret = yp_item_to_txt(&i, b, b_len, t, &t_len, YP_SNOQUOTE);
+	is_int(KNOT_EOK, ret, "bin to txt");
+	ok(strlen(t) == t_len, "txt ret length");
+	ok(strlen(txt) == t_len, "txt length");
+	ok(memcmp(txt, t, t_len) == 0, "compare");
+}
+
+static void mod_id_bad_test(const char *txt, int code)
+{
+	int ret;
+	uint8_t b[64];
+	size_t b_len = sizeof(b);
+	yp_item_t i = { NULL, YP_TDATA, YP_VDATA = { 0, NULL,
+	                                             mod_id_to_bin,
+	                                             mod_id_to_txt } };
+
+	diag("module id \"%s\":", txt);
+	ret = yp_item_to_bin(&i, txt, strlen(txt), b, &b_len);
+	ok(ret == code, "invalid txt to bin");
+}
+
+static void edns_opt_test(const char *txt, uint16_t code, const char *val)
+{
+	int ret;
+	uint8_t b[64];
+	size_t b_len = sizeof(b);
+	char t[64];
+	size_t t_len = sizeof(t);
+	yp_item_t i = { NULL, YP_TDATA, YP_VDATA = { 0, NULL,
+	                                             edns_opt_to_bin,
+	                                             edns_opt_to_txt } };
+
+	diag("edns option \"%s\":", txt);
+	ret = yp_item_to_bin(&i, txt, strlen(txt), b, &b_len);
+	is_int(KNOT_EOK, ret, "txt to bin");
+	uint64_t c = knot_wire_read_u64(b);
+	ok(c == code, "compare code");
+	ok(memcmp(yp_bin(b + sizeof(uint64_t)), val,
+	          yp_bin_len(b + sizeof(uint64_t))) == 0, "compare");
+	ret = yp_item_to_txt(&i, b, b_len, t, &t_len, YP_SNOQUOTE);
+	is_int(KNOT_EOK, ret, "bin to txt");
+	ok(strlen(t) == t_len, "txt ret length");
+	ok(strlen(txt) == t_len, "txt length");
+	ok(memcmp(txt, t, t_len) == 0, "compare");
+}
+
+static void edns_opt_bad_test(const char *txt, int code)
+{
+	int ret;
+	uint8_t b[64];
+	size_t b_len = sizeof(b);
+	yp_item_t i = { NULL, YP_TDATA, YP_VDATA = { 0, NULL,
+	                                             edns_opt_to_bin,
+	                                             edns_opt_to_txt } };
+
+	diag("edns option \"%s\":", txt);
+	ret = yp_item_to_bin(&i, txt, strlen(txt), b, &b_len);
+	ok(ret == code, "invalid txt to bin");
+}
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	/* Module id tests. */
+	mod_id_test("module/id", "\x06moduleid");
+	mod_id_test("module", "\x06module");
+	mod_id_bad_test("module/", KNOT_EINVAL);
+	mod_id_bad_test("/", KNOT_EINVAL);
+	mod_id_bad_test("/id", KNOT_EINVAL);
+
+	/* EDNS option tests. */
+	edns_opt_test("0:", 0, "");
+	edns_opt_test("65535:", 65535, "");
+	edns_opt_test("1:abc", 1, "abc");
+	edns_opt_test("1:0x0102", 1, "\x01\x02");
+	edns_opt_bad_test("0", KNOT_EINVAL);
+	edns_opt_bad_test("-1:a", KNOT_ERANGE);
+	edns_opt_bad_test("65536:a", KNOT_ERANGE);
+	edns_opt_bad_test("0:0xa", KNOT_EINVAL);
+
+	return 0;
+}
diff --git a/tests/knot/test_confdb.c b/tests/knot/test_confdb.c
new file mode 100644
index 0000000..a650872
--- /dev/null
+++ b/tests/knot/test_confdb.c
@@ -0,0 +1,489 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <tap/basic.h>
+
+#include "test_conf.h"
+#include "knot/conf/confdb.c"
+
+static void check_db_content(conf_t *conf, knot_db_txn_t *txn, int count)
+{
+	ok(db_check_version(conf, txn) == KNOT_EOK, "Version check");
+	if (count >= 0) {
+		ok(conf->api->count(txn) == 1 + count, "Check DB entries count");
+	}
+}
+
+static void check_code(
+	conf_t *conf,
+	knot_db_txn_t *txn,
+	uint8_t section_code,
+	const yp_name_t *name,
+	db_action_t action,
+	int ret,
+	uint8_t ref_code)
+{
+	uint8_t code = 0;
+	ok(db_code(conf, txn, section_code, name, action, &code) == ret,
+	   "Compare DB code return");
+
+	if (ret != KNOT_EOK) {
+		return;
+	}
+
+	uint8_t k[64] = { section_code, 0 };
+	memcpy(k + 2, name + 1, name[0]);
+	knot_db_val_t key = { .data = k, .len = 2 + name[0] };
+	knot_db_val_t val;
+
+	ret = conf->api->find(txn, &key, &val, 0);
+	switch (action) {
+	case DB_GET:
+	case DB_SET:
+		ok(code == ref_code, "Compare DB code");
+		is_int(KNOT_EOK, ret, "Find DB code");
+		ok(val.len == 1, "Compare DB code length");
+		ok(((uint8_t *)val.data)[0] == code, "Compare DB code value");
+		break;
+	case DB_DEL:
+		is_int(KNOT_ENOENT, ret, "Find item code");
+		break;
+	}
+}
+
+static void test_db_code(conf_t *conf, knot_db_txn_t *txn)
+{
+	// Add codes.
+	check_code(conf, txn, 0, C_SERVER, DB_SET, KNOT_EOK, KEY1_FIRST);
+	check_db_content(conf, txn, 1);
+	check_code(conf, txn, 0, C_LOG, DB_SET, KNOT_EOK, KEY1_FIRST + 1);
+	check_db_content(conf, txn, 2);
+	check_code(conf, txn, 2, C_IDENT, DB_SET, KNOT_EOK, KEY1_FIRST);
+	check_db_content(conf, txn, 3);
+	check_code(conf, txn, 0, C_ZONE, DB_SET, KNOT_EOK, KEY1_FIRST + 2);
+	check_db_content(conf, txn, 4);
+	check_code(conf, txn, 2, C_VERSION, DB_SET, KNOT_EOK, KEY1_FIRST + 1);
+	check_db_content(conf, txn, 5);
+
+	// Add existing code (no change).
+	check_code(conf, txn, 0, C_SERVER, DB_SET, KNOT_EOK, KEY1_FIRST);
+	check_db_content(conf, txn, 5);
+
+	// Get codes.
+	check_code(conf, txn, 0, C_SERVER, DB_GET, KNOT_EOK, KEY1_FIRST);
+	check_db_content(conf, txn, 5);
+	check_code(conf, txn, 0, C_RMT, DB_GET, KNOT_ENOENT, 0);
+	check_db_content(conf, txn, 5);
+
+	// Delete not existing code.
+	check_code(conf, txn, 0, C_COMMENT, DB_DEL, KNOT_ENOENT, 0);
+	check_db_content(conf, txn, 5);
+
+	// Delete codes.
+	check_code(conf, txn, 0, C_SERVER, DB_DEL, KNOT_EOK, 0);
+	check_db_content(conf, txn, 4);
+	check_code(conf, txn, 2, C_IDENT, DB_DEL, KNOT_EOK, 0);
+	check_db_content(conf, txn, 3);
+
+	// Reuse deleted codes.
+	check_code(conf, txn, 0, C_ACL, DB_SET, KNOT_EOK, KEY1_FIRST);
+	check_db_content(conf, txn, 4);
+	check_code(conf, txn, 2, C_NSID, DB_SET, KNOT_EOK, KEY1_FIRST);
+	check_db_content(conf, txn, 5);
+}
+
+static void check_set(
+	conf_t *conf,
+	knot_db_txn_t *txn,
+	const yp_name_t *key0,
+	const yp_name_t *key1,
+	const uint8_t *id,
+	size_t id_len,
+	int ret,
+	const uint8_t *data,
+	size_t data_len,
+	const uint8_t *exp_data,
+	size_t exp_data_len)
+{
+	ok(conf_db_set(conf, txn, key0, key1, id, id_len, data, data_len) == ret,
+	   "Check set return");
+
+	if (ret != KNOT_EOK || (key1 == NULL && id == NULL)) {
+		return;
+	}
+
+	uint8_t section_code, item_code;
+	section_code = 0, item_code = 0; // prevents Wuninitialized
+	ok(db_code(conf, txn, KEY0_ROOT, key0, DB_GET, &section_code) == KNOT_EOK,
+	   "Get DB section code");
+	if (key1 != NULL) {
+		ok(db_code(conf, txn, section_code, key1, DB_GET, &item_code) == KNOT_EOK,
+		   "Get DB item code");
+	} else {
+		item_code = KEY1_ID;
+	}
+
+	uint8_t k[64] = { section_code, item_code };
+	if (id != NULL) {
+		memcpy(k + 2, id, id_len);
+	}
+	knot_db_val_t key = { .data = k, .len = 2 + id_len };
+	knot_db_val_t val;
+
+	ok(conf->api->find(txn, &key, &val, 0) == KNOT_EOK, "Get inserted data");
+	ok(val.len == exp_data_len, "Compare data length");
+	ok(memcmp(val.data, exp_data, exp_data_len) == 0, "Compare data");
+
+	check_db_content(conf, txn, -1);
+}
+
+static void test_conf_db_set(conf_t *conf, knot_db_txn_t *txn)
+{
+	// Set section without item - noop.
+	check_set(conf, txn, C_INCL, NULL, NULL, 0, KNOT_EOK, NULL, 0, NULL, 0);
+
+	// Set singlevalued item.
+	check_set(conf, txn, C_SERVER, C_RUNDIR, NULL, 0, KNOT_EOK,
+	          (uint8_t *)"\0", 1, (uint8_t *)"\0", 1);
+	check_set(conf, txn, C_SERVER, C_RUNDIR, NULL, 0, KNOT_EOK,
+	          (uint8_t *)"a b\0", 4, (uint8_t *)"a b\0", 4);
+
+	// Set multivalued item.
+	check_set(conf, txn, C_SERVER, C_LISTEN, NULL, 0, KNOT_EOK,
+	          (uint8_t *)"\0", 1, (uint8_t *)"\x00\x01""\0", 3);
+	check_set(conf, txn, C_SERVER, C_LISTEN, NULL, 0, KNOT_EOK,
+	          (uint8_t *)"a\0", 2, (uint8_t *)"\x00\x01""\0""\x00\x02""a\0", 7);
+	check_set(conf, txn, C_SERVER, C_LISTEN, NULL, 0, KNOT_EOK,
+	          (uint8_t *)"b\0", 2, (uint8_t *)"\x00\x01""\0""\x00\x02""a\0""\x00\x02""b\0", 11);
+
+	// Set group id.
+	check_set(conf, txn, C_ZONE, NULL, (uint8_t *)"id", 2, KNOT_EOK,
+	          NULL, 0, (uint8_t *)"", 0);
+
+	// Set singlevalued item with id.
+	check_set(conf, txn, C_ZONE, C_FILE, (uint8_t *)"id", 2, KNOT_EOK,
+	          (uint8_t *)"\0", 1, (uint8_t *)"\0", 1);
+	check_set(conf, txn, C_ZONE, C_FILE, (uint8_t *)"id", 2, KNOT_EOK,
+	          (uint8_t *)"a b\0", 4, (uint8_t *)"a b\0", 4);
+
+	// Set multivalued item with id.
+	check_set(conf, txn, C_ZONE, C_MASTER, (uint8_t *)"id", 2, KNOT_EOK,
+	          (uint8_t *)"\0", 1, (uint8_t *)"\x00\x01""\0", 3);
+	check_set(conf, txn, C_ZONE, C_MASTER, (uint8_t *)"id", 2, KNOT_EOK,
+	          (uint8_t *)"a\0", 2, (uint8_t *)"\x00\x01""\0""\x00\x02""a\0", 7);
+	check_set(conf, txn, C_ZONE, C_MASTER, (uint8_t *)"id", 2, KNOT_EOK,
+	          (uint8_t *)"b\0", 2, (uint8_t *)"\x00\x01""\0""\x00\x02""a\0""\x00\x02""b\0", 11);
+
+	// ERR set invalid section.
+	check_set(conf, txn, C_MASTER, NULL, NULL, 0, KNOT_YP_EINVAL_ITEM,
+	          NULL, 0, NULL, 0);
+
+	// ERR set invalid item.
+	check_set(conf, txn, C_SERVER, C_DOMAIN, NULL, 0, KNOT_YP_EINVAL_ITEM,
+	          NULL, 0, NULL, 0);
+
+	// ERR redefine section id.
+	check_set(conf, txn, C_ZONE, NULL, (uint8_t *)"id", 2, KNOT_CONF_EREDEFINE,
+	          NULL, 0, NULL, 0);
+
+	// ERR set singlevalued item with non-existing id.
+	check_set(conf, txn, C_ZONE, C_FILE, (uint8_t *)"idx", 3, KNOT_YP_EINVAL_ID,
+	          NULL, 0, NULL, 0);
+}
+
+static void check_get(
+	conf_t *conf,
+	knot_db_txn_t *txn,
+	const yp_name_t *key0,
+	const yp_name_t *key1,
+	const uint8_t *id,
+	size_t id_len,
+	int ret,
+	const uint8_t *exp_data,
+	size_t exp_data_len)
+{
+	conf_val_t val;
+	ok(conf_db_get(conf, txn, key0, key1, id, id_len, &val) == ret,
+	   "Check get return");
+
+	if (ret != KNOT_EOK) {
+		return;
+	}
+
+	ok(val.blob_len == exp_data_len, "Compare data length");
+	ok(val.blob != NULL && memcmp(val.blob, exp_data, exp_data_len) == 0,
+	   "Compare data");
+
+	check_db_content(conf, txn, -1);
+}
+
+static void test_conf_db_get(conf_t *conf, knot_db_txn_t *txn)
+{
+	// Get singlevalued item.
+	check_get(conf, txn, C_SERVER, C_RUNDIR, NULL, 0, KNOT_EOK,
+	          (uint8_t *)"a b\0", 4);
+
+	// Get multivalued item.
+	check_get(conf, txn, C_SERVER, C_LISTEN, NULL, 0, KNOT_EOK,
+	          (uint8_t *)"\x00\x01""\0""\x00\x02""a\0""\x00\x02""b\0", 11);
+
+	// Get group id.
+	check_get(conf, txn, C_ZONE, NULL, (uint8_t *)"id", 2, KNOT_EOK,
+	          (uint8_t *)"", 0);
+
+	// Get singlevalued item with id.
+	check_get(conf, txn, C_ZONE, C_FILE, (uint8_t *)"id", 2, KNOT_EOK,
+	          (uint8_t *)"a b\0", 4);
+
+	// Get multivalued item with id.
+	check_get(conf, txn, C_ZONE, C_MASTER, (uint8_t *)"id", 2, KNOT_EOK,
+	          (uint8_t *)"\x00\x01""\0""\x00\x02""a\0""\x00\x02""b\0", 11);
+
+	// ERR get section without item.
+	check_get(conf, txn, C_INCL, NULL, NULL, 0, KNOT_EINVAL, NULL, 0);
+
+	// ERR get invalid section.
+	check_get(conf, txn, C_MASTER, NULL, NULL, 0, KNOT_YP_EINVAL_ITEM,
+	          NULL, 0);
+
+	// ERR get invalid item.
+	check_get(conf, txn, C_SERVER, C_DOMAIN, NULL, 0, KNOT_YP_EINVAL_ITEM,
+	          NULL, 0);
+
+	// ERR get singlevalued item with non-existing id.
+	check_get(conf, txn, C_ZONE, C_FILE, (uint8_t *)"idx", 3, KNOT_YP_EINVAL_ID,
+	          NULL, 0);
+}
+
+static void check_unset(
+	conf_t *conf,
+	knot_db_txn_t *txn,
+	const yp_name_t *key0,
+	const yp_name_t *key1,
+	const uint8_t *id,
+	size_t id_len,
+	int ret,
+	const uint8_t *data,
+	size_t data_len,
+	const uint8_t *exp_data,
+	size_t exp_data_len)
+{
+	ok(conf_db_unset(conf, txn, key0, key1, id, id_len, data, data_len, false) == ret,
+	   "Check unset return");
+
+	if (ret != KNOT_EOK) {
+		return;
+	}
+
+	uint8_t section_code, item_code;
+	ok(db_code(conf, txn, KEY0_ROOT, key0, DB_GET, &section_code) == KNOT_EOK,
+	   "Get DB section code");
+	if (key1 != NULL) {
+		ok(db_code(conf, txn, section_code, key1, DB_GET, &item_code) == KNOT_EOK,
+		   "Get DB item code");
+	} else {
+		item_code = KEY1_ID;
+	}
+
+	uint8_t k[64] = { section_code, item_code };
+	if (id != NULL) {
+		memcpy(k + 2, id, id_len);
+	}
+	knot_db_val_t key = { .data = k, .len = 2 + id_len };
+	knot_db_val_t val;
+
+	ret = conf->api->find(txn, &key, &val, 0);
+	if (exp_data != NULL) {
+		is_int(KNOT_EOK, ret, "Get deleted data");
+		ok(val.len == exp_data_len, "Compare data length");
+		ok(memcmp(val.data, exp_data, exp_data_len) == 0, "Compare data");
+	} else {
+		is_int(KNOT_ENOENT, ret, "Get deleted data");
+	}
+
+	check_db_content(conf, txn, -1);
+}
+
+static void check_unset_key(
+	conf_t *conf,
+	knot_db_txn_t *txn,
+	const yp_name_t *key0,
+	const yp_name_t *key1,
+	const uint8_t *id,
+	size_t id_len,
+	int ret)
+{
+	ok(conf_db_unset(conf, txn, key0, key1, id, id_len, NULL, 0, true) == ret,
+	   "Check unset return");
+
+	if (ret != KNOT_EOK) {
+		return;
+	}
+
+	uint8_t section_code, item_code;
+	ret = db_code(conf, txn, KEY0_ROOT, key0, DB_GET, &section_code);
+	if (key1 == NULL && id_len == 0) {
+		is_int(KNOT_ENOENT, ret, "Get DB section code");
+	} else {
+		is_int(KNOT_EOK, ret, "Get DB section code");
+		ret = db_code(conf, txn, section_code, key1, DB_GET, &item_code);
+		is_int(KNOT_ENOENT, ret, "Get DB item code");
+	}
+
+	check_db_content(conf, txn, -1);
+}
+
+static void test_conf_db_unset(conf_t *conf, knot_db_txn_t *txn)
+{
+	// ERR unset section without item.
+	check_unset(conf, txn, C_INCL, NULL, NULL, 0, KNOT_ENOENT,
+	            NULL, 0, NULL, 0);
+
+	// ERR unset invalid section.
+	check_unset(conf, txn, C_MASTER, NULL, NULL, 0, KNOT_YP_EINVAL_ITEM,
+	            NULL, 0, NULL, 0);
+
+	// ERR unset invalid item.
+	check_unset(conf, txn, C_SERVER, C_DOMAIN, NULL, 0, KNOT_YP_EINVAL_ITEM,
+	            NULL, 0, NULL, 0);
+
+	// ERR unset singlevalued item with non-existing id.
+	check_unset(conf, txn, C_ZONE, C_FILE, (uint8_t *)"idx", 3, KNOT_YP_EINVAL_ID,
+	            NULL, 0, NULL, 0);
+
+	// ERR unset singlevalued item invalid value.
+	check_unset(conf, txn, C_SERVER, C_RUNDIR, NULL, 0, KNOT_ENOENT,
+	            (uint8_t *)"x\0", 2, NULL, 0);
+
+	// Unset singlevalued item data.
+	check_unset(conf, txn, C_SERVER, C_RUNDIR, NULL, 0, KNOT_EOK,
+	            (uint8_t *)"a b\0", 4, NULL, 0);
+	// Unset item.
+	check_unset_key(conf, txn, C_SERVER, C_RUNDIR, NULL, 0, KNOT_EOK);
+
+	// Unset multivalued item.
+	check_unset(conf, txn, C_SERVER, C_LISTEN, NULL, 0, KNOT_EOK,
+	            (uint8_t *)"a", 2, (uint8_t *)"\x00\x01""\0""\x00\x02""b\0", 7);
+	check_unset(conf, txn, C_SERVER, C_LISTEN, NULL, 0, KNOT_EOK,
+	            (uint8_t *)"", 1, (uint8_t *)"\x00\x02""b\0", 4);
+	check_unset(conf, txn, C_SERVER, C_LISTEN, NULL, 0, KNOT_EOK,
+	            (uint8_t *)"b", 2, NULL, 0);
+	// Unset item.
+	check_unset_key(conf, txn, C_SERVER, C_LISTEN, NULL, 0, KNOT_EOK);
+	// Unset section.
+	check_unset_key(conf, txn, C_SERVER, NULL, NULL, 0, KNOT_EOK);
+
+	// Unset singlevalued item with id - all data at one step.
+	check_unset(conf, txn, C_ZONE, C_FILE, (uint8_t *)"id", 2, KNOT_EOK,
+	            NULL, 0, NULL, 0);
+
+	// Unset multivalued item with id - all data at one step (non-null data!).
+	check_unset(conf, txn, C_ZONE, C_MASTER, (uint8_t *)"id", 2, KNOT_EOK,
+	          NULL + 1, 0, NULL, 0);
+
+	// Unset group id.
+	check_unset(conf, txn, C_ZONE, NULL, (uint8_t *)"id", 2, KNOT_EOK,
+	            NULL, 0, NULL, 0);
+}
+
+static void test_conf_db_iter(conf_t *conf, knot_db_txn_t *txn)
+{
+	const size_t total = 4;
+	char names[][10] = { "alfa", "beta", "delta", "epsilon" };
+
+	// Prepare identifiers to iterate through.
+	for (size_t i = 0; i < total; i++) {
+		check_set(conf, txn, C_RMT, NULL, (uint8_t *)names[i],
+		          strlen(names[i]), KNOT_EOK, NULL, 0, (uint8_t *)"", 0);
+	}
+
+	// Create section iterator.
+	conf_iter_t iter;
+	int ret = conf_db_iter_begin(conf, txn, C_RMT, &iter);
+	is_int(KNOT_EOK, ret, "Create iterator");
+
+	// Iterate through the section.
+	size_t count = 0;
+	while (ret == KNOT_EOK) {
+		const uint8_t *id;
+		size_t id_len;
+		id = NULL, id_len = 0; // prevents Wuinitialized
+		ret = conf_db_iter_id(conf, &iter, &id, &id_len);
+		is_int(KNOT_EOK, ret, "Get iteration id");
+		ok(id_len == strlen(names[count]), "Compare iteration id length");
+		ok(memcmp(id, names[count], id_len) == 0, "Compare iteration id");
+
+		ok(conf_db_iter_del(conf, &iter) == KNOT_EOK, "Delete iteration key");
+
+		count++;
+		ret = conf_db_iter_next(conf, &iter);
+	}
+	is_int(KNOT_EOF, ret, "Finished iteration");
+	ok(count == total, "Check iteration count");
+
+	// Check empty section.
+	ret = conf_db_iter_begin(conf, txn, C_RMT, &iter);
+	is_int(KNOT_ENOENT, ret, "Create iterator");
+
+	// ERR non-iterable section.
+	ok(conf_db_iter_begin(conf, txn, C_SERVER, &iter) == KNOT_ENOTSUP, "Create iterator");
+
+	// ERR empty section.
+	ok(conf_db_iter_begin(conf, txn, C_ZONE, &iter) == KNOT_ENOENT, "Create iterator");
+
+	// ERR section with no code.
+	ok(conf_db_iter_begin(conf, txn, C_LOG, &iter) == KNOT_ENOENT, "Create iterator");
+}
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	ok(test_conf("", NULL) == KNOT_EOK, "Prepare configuration");
+	check_db_content(conf(), &conf()->read_txn, 0);
+
+	knot_db_txn_t txn;
+	ok(conf()->api->txn_begin(conf()->db, &txn, 0) == KNOT_EOK, "Begin transaction");
+
+	diag("db_code");
+	test_db_code(conf(), &txn);
+
+	conf()->api->txn_abort(&txn);
+
+	ok(conf()->api->txn_begin(conf()->db, &txn, 0) == KNOT_EOK, "Begin transaction");
+
+	diag("conf_db_set");
+	test_conf_db_set(conf(), &txn);
+
+	diag("conf_db_get");
+	test_conf_db_get(conf(), &txn);
+
+	diag("conf_db_unset");
+	test_conf_db_unset(conf(), &txn);
+
+	conf()->api->txn_abort(&txn);
+
+	ok(conf()->api->txn_begin(conf()->db, &txn, 0) == KNOT_EOK, "Begin transaction");
+
+	diag("conf_db_iter");
+	test_conf_db_iter(conf(), &txn);
+
+	conf()->api->txn_abort(&txn);
+
+	conf_free(conf());
+
+	return 0;
+}
diff --git a/tests/knot/test_confio.c b/tests/knot/test_confio.c
new file mode 100644
index 0000000..6519d22
--- /dev/null
+++ b/tests/knot/test_confio.c
@@ -0,0 +1,1009 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <tap/basic.h>
+
+#include "test_conf.h"
+#include "knot/conf/confio.h"
+#include "knot/conf/tools.h"
+#include "libknot/yparser/yptrafo.h"
+#include "contrib/string.h"
+#include "contrib/openbsd/strlcat.h"
+
+#define SKIP_OPENBSD	skip("Nested transactions are not supported on OpenBSD");
+#define OUT_LEN		1024
+#define ZONE1		"zone1"
+#define ZONE2		"zone2"
+#define ZONE3		"zone3"
+
+char *format_key(conf_io_t *io)
+{
+	char id[KNOT_DNAME_TXT_MAXLEN + 1] = "\0";
+	size_t id_len = sizeof(id);
+
+	// Get the textual item id.
+	if (io->id_len > 0 && !io->id_as_data) {
+		if (yp_item_to_txt(io->key0->var.g.id, io->id, io->id_len, id,
+		                   &id_len, YP_SNOQUOTE) != KNOT_EOK) {
+			return NULL;
+		}
+	}
+
+	// Get the item prefix.
+	const char *prefix = "";
+	switch (io->type) {
+	case NEW: prefix = "+"; break;
+	case OLD: prefix = "-"; break;
+	default: break;
+	}
+
+	// Format the item key.
+	return sprintf_alloc(
+		"%s%.*s%s%.*s%s%s%.*s",
+		prefix, (int)io->key0->name[0], io->key0->name + 1,
+		(io->id_len > 0 && !io->id_as_data ? "[" : ""),
+		(io->id_len > 0 && !io->id_as_data ? (int)id_len : 0), id,
+		(io->id_len > 0 && !io->id_as_data ? "]" : ""),
+		(io->key1 != NULL ? "." : ""),
+		(io->key1 != NULL ? (int)io->key1->name[0] : 0),
+		(io->key1 != NULL ? io->key1->name + 1 : ""));
+}
+
+static int append_data(const yp_item_t *item, const uint8_t *bin, size_t bin_len,
+                       char *out, size_t out_len)
+{
+	char buf[YP_MAX_TXT_DATA_LEN + 1] = "\0";
+	size_t buf_len = sizeof(buf);
+
+	int ret = yp_item_to_txt(item, bin, bin_len, buf, &buf_len, YP_SNONE);
+	if (ret != KNOT_EOK) {
+		return ret;
+	}
+
+	if (strlcat(out, buf, out_len) >= out_len) {
+		return KNOT_ESPACE;
+	}
+
+	return KNOT_EOK;
+}
+
+char *format_data(conf_io_t *io)
+{
+	char out[YP_MAX_TXT_DATA_LEN + 1] = "\0";
+
+	// Return the item identifier as the item data.
+	if (io->id_as_data) {
+		if (append_data(io->key0->var.g.id, io->id, io->id_len, out,
+		                sizeof(out)) != KNOT_EOK) {
+			return NULL;
+		}
+
+		return strdup(out);
+	}
+
+	// Check for no data.
+	if (io->data.val == NULL && io->data.bin == NULL) {
+		return NULL;
+	}
+
+	const yp_item_t *item = (io->key1 != NULL) ? io->key1 : io->key0;
+
+	// Format explicit binary data value.
+	if (io->data.bin != NULL) {
+		if (append_data(item, io->data.bin, io->data.bin_len, out,
+		                sizeof(out)) != KNOT_EOK) {
+			return NULL;
+		}
+	// Format multivalued item data.
+	} else if (item->flags & YP_FMULTI) {
+		size_t values = conf_val_count(io->data.val);
+		for (size_t i = 0; i < values; i++) {
+			// Skip other values if known index (counted from 1).
+			if (io->data.index > 0 &&
+			    io->data.index != i + 1) {
+				conf_val_next(io->data.val);
+				continue;
+			}
+
+			if (i > 0) {
+				if (strlcat(out, " ", sizeof(out)) >= sizeof(out)) {
+					return NULL;
+				}
+			}
+
+			conf_val(io->data.val);
+			if (append_data(item, io->data.val->data, io->data.val->len,
+			                out, sizeof(out)) != KNOT_EOK) {
+				return NULL;
+			}
+
+			conf_val_next(io->data.val);
+		}
+	// Format singlevalued item data.
+	} else {
+		conf_val(io->data.val);
+		if (append_data(item, io->data.val->data, io->data.val->len, out,
+		                sizeof(out)) != KNOT_EOK) {
+			return NULL;
+		}
+	}
+
+	return strdup(out);
+}
+
+static int format_item(conf_io_t *io)
+{
+	char *out = (char *)io->misc;
+
+	// Get the item key and data strings.
+	char *key = format_key(io);
+	char *data = format_data(io);
+
+	// Format the item.
+	char *item = sprintf_alloc(
+		"%s%s%s%s",
+		(*out != '\0' ? "\n" : ""),
+		(key != NULL ? key : ""),
+		(data != NULL ? " = " : ""),
+		(data != NULL ? data : ""));
+	free(key);
+	free(data);
+	if (item == NULL) {
+		return KNOT_ENOMEM;
+	}
+
+	// Append the item.
+	if (strlcat(out, item, OUT_LEN) >= OUT_LEN) {
+		free(item);
+		return KNOT_ESPACE;
+	}
+
+	free(item);
+
+	return KNOT_EOK;
+}
+
+static void test_conf_io_begin(void)
+{
+	ok(conf_io_begin(true) == KNOT_TXN_ENOTEXISTS, "begin child txn with no parent");
+	ok(conf()->io.txn == NULL, "check txn depth");
+
+#if defined(__OpenBSD__)
+	SKIP_OPENBSD
+#else
+	ok(conf_io_begin(false) == KNOT_EOK, "begin parent txn");
+	ok(conf()->io.txn == &(conf()->io.txn_stack[0]), "check txn depth");
+
+	ok(conf_io_begin(false) == KNOT_TXN_EEXISTS, "begin another parent txn");
+	ok(conf()->io.txn == &(conf()->io.txn_stack[0]), "check txn depth");
+
+	for (int i = 1; i < CONF_MAX_TXN_DEPTH; i++) {
+		ok(conf_io_begin(true) == KNOT_EOK, "begin child txn");
+		ok(conf()->io.txn == &(conf()->io.txn_stack[i]), "check txn depth");
+	}
+	ok(conf_io_begin(true) == KNOT_TXN_EEXISTS, "begin another child txn");
+	ok(conf()->io.txn == &(conf()->io.txn_stack[CONF_MAX_TXN_DEPTH - 1]),
+	   "check txn depth");
+
+	conf_io_abort(false);
+	ok(conf()->io.txn == NULL, "check txn depth");
+#endif
+}
+
+static void test_conf_io_abort(void)
+{
+#if defined(__OpenBSD__)
+	SKIP_OPENBSD
+#else
+	// Test child persistence after subchild abort.
+
+	ok(conf_io_begin(false) == KNOT_EOK, "begin parent txn");
+	char idx[2] = { '0' };
+	ok(conf_io_set("server", "version", NULL, idx) ==
+	   KNOT_EOK, "set single value '%s'", idx);
+
+	for (int i = 1; i < CONF_MAX_TXN_DEPTH; i++) {
+		char idx[2] = { '0' + i };
+		ok(conf_io_begin(true) == KNOT_EOK, "begin child txn %s", idx);
+		ok(conf_io_set("server", "version", NULL, idx) ==
+		   KNOT_EOK, "set single value '%s'", idx);
+	}
+
+	for (int i = CONF_MAX_TXN_DEPTH - 1; i > 0; i--) {
+		char idx[2] = { '0' + i };
+		conf_io_abort(true);
+		conf_val_t val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_VERSION);
+		ok(val.code == KNOT_EOK, "check entry");
+		const char *data = conf_str(&val);
+		ok(*data == (idx[0] - 1), "compare txn data '%s'", data);
+	}
+
+	conf_io_abort(false);
+	ok(conf()->io.txn == NULL, "check txn depth");
+
+	// Test child abort with committed subchild.
+	ok(conf_io_begin(false) == KNOT_EOK, "begin new parent txn");
+	ok(conf_io_begin(true) == KNOT_EOK, "begin child txn");
+	ok(conf_io_begin(true) == KNOT_EOK, "begin subchild txn");
+	ok(conf_io_set("server", "version", NULL, "text") ==
+	   KNOT_EOK, "set single value");
+	ok(conf_io_commit(true) == KNOT_EOK, "commit subchild txn");
+	conf_val_t val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_VERSION);
+	ok(val.code == KNOT_EOK, "check entry");
+	const char *data = conf_str(&val);
+	ok(strcmp(data, "text") == 0, "compare subchild txn data '%s'", data);
+	conf_io_abort(true);
+	val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_VERSION);
+	ok(val.code == KNOT_ENOENT, "check entry");
+	conf_io_abort(false);
+
+	// Test unchanged read_txn.
+	val = conf_get_txn(conf(), &conf()->read_txn, C_SERVER, C_VERSION);
+	ok(val.code == KNOT_ENOENT, "check entry");
+#endif
+}
+
+static void test_conf_io_commit(void)
+{
+	ok(conf_io_commit(false) == KNOT_TXN_ENOTEXISTS, "commit no txt txn");
+	ok(conf_io_commit(true) == KNOT_TXN_ENOTEXISTS, "commit no txt txn");
+
+#if defined(__OpenBSD__)
+	SKIP_OPENBSD
+#else
+	// Test subchild persistence after commit.
+
+	ok(conf_io_begin(false) == KNOT_EOK, "begin parent txn");
+	char idx[2] = { '0' };
+	ok(conf_io_set("server", "version", NULL, idx) ==
+	   KNOT_EOK, "set single value '%s'", idx);
+
+	for (int i = 1; i < CONF_MAX_TXN_DEPTH; i++) {
+		char idx[2] = { '0' + i };
+		ok(conf_io_begin(true) == KNOT_EOK, "begin child txn %s", idx);
+		ok(conf_io_set("server", "version", NULL, idx) ==
+		   KNOT_EOK, "set single value '%s'", idx);
+	}
+
+	for (int i = CONF_MAX_TXN_DEPTH - 1; i > 0; i--) {
+		char idx[2] = { '0' + i };
+		ok(conf_io_commit(true) == KNOT_EOK, "commit child txn %s", idx);
+		conf_val_t val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_VERSION);
+		ok(val.code == KNOT_EOK, "check entry");
+		const char *data = conf_str(&val);
+		ok(*data == ('0' + CONF_MAX_TXN_DEPTH - 1), "compare txn data '%s'", data);
+	}
+
+	ok(conf_io_commit(false) == KNOT_EOK, "commit parent txn");
+	ok(conf()->io.txn == NULL, "check txn depth");
+
+	// Test child persistence after parent commit.
+	ok(conf_io_begin(false) == KNOT_EOK, "begin new parent txn");
+	conf_val_t val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_VERSION);
+	ok(val.code == KNOT_EOK, "check entry");
+	idx[0] = '0' + CONF_MAX_TXN_DEPTH - 1;
+	const char *data = conf_str(&val);
+	ok(strcmp(data, idx) == 0, "compare final data '%s'", data);
+	conf_io_abort(false);
+
+	// Test unchanged read_txn.
+	val = conf_get_txn(conf(), &conf()->read_txn, C_SERVER, C_VERSION);
+	ok(val.code == KNOT_ENOENT, "check entry");
+#endif
+}
+
+static void test_conf_io_check(void)
+{
+	conf_io_t io = { NULL };
+
+	// ERR no txn.
+	ok(conf_io_check(&io) ==
+	   KNOT_TXN_ENOTEXISTS, "check without active txn");
+
+	ok(conf_io_begin(false) == KNOT_EOK, "begin txn");
+
+	// Section check.
+	ok(conf_io_set("remote", "id", NULL, "remote1") ==
+	   KNOT_EOK, "set remote id");
+	ok(conf_io_check(&io) ==
+	   KNOT_EINVAL, "check missing remote address");
+	ok(io.error.code == KNOT_EINVAL, "compare error code");
+
+	ok(conf_io_set("remote", "address", "remote1", "1.1.1.1") ==
+	   KNOT_EOK, "set remote address");
+	ok(conf_io_check(&io) ==
+	   KNOT_EOK, "check remote address");
+	ok(io.error.code == KNOT_EOK, "compare error code");
+
+	// Item check.
+	ok(conf_io_set("zone", "domain", NULL, ZONE1) ==
+	   KNOT_EOK, "set zone domain "ZONE1);
+	ok(conf_io_set("zone", "master", ZONE1, "remote1") ==
+	   KNOT_EOK, "set zone master");
+
+	ok(conf_io_check(&io) ==
+	   KNOT_EOK, "check all");
+
+	ok(conf_io_unset("remote", NULL, NULL, NULL) ==
+	   KNOT_EOK, "unset remotes");
+
+	ok(conf_io_check(&io) ==
+	   KNOT_ENOENT, "check missing master remote");
+	ok(io.error.code == KNOT_ENOENT, "compare error code");
+
+	conf_io_abort(false);
+}
+
+static void test_conf_io_set(void)
+{
+	// ERR no txn.
+	ok(conf_io_set("server", "version", NULL, "text") ==
+	   KNOT_TXN_ENOTEXISTS, "set without active txn");
+
+	ok(conf_io_begin(false) == KNOT_EOK, "begin txn");
+
+	// ERR.
+	ok(conf_io_set(NULL, NULL, NULL, NULL) ==
+	   KNOT_EINVAL, "set NULL key0");
+	ok(conf_io_set("", NULL, NULL, NULL) ==
+	   KNOT_YP_EINVAL_ITEM, "set empty key0");
+	ok(conf_io_set("uknown", NULL, NULL, NULL) ==
+	   KNOT_YP_EINVAL_ITEM, "set unknown key0");
+	ok(conf_io_set("server", "unknown", NULL, NULL) ==
+	   KNOT_YP_EINVAL_ITEM, "set unknown key1");
+	ok(conf_io_set("include", NULL, NULL, NULL) ==
+	   KNOT_YP_ENODATA, "set non-group without data");
+	ok(conf_io_set("server", "background-workers", NULL, "x") ==
+	   KNOT_EINVAL, "set invalid data");
+
+	// ERR callback
+	ok(conf_io_set("include", NULL, NULL, "invalid") ==
+	   KNOT_EFILE, "set invalid callback value");
+
+	// Single group, no item, no value.
+	ok(conf_io_set("server", NULL, NULL, NULL) ==
+	   KNOT_ENOTSUP, "set group no value");
+	// Single group, no item, value.
+	ok(conf_io_set("server", NULL, NULL, "text") ==
+	   KNOT_YP_ENOTSUP_DATA, "set group value");
+	// Single group, item, no value.
+	ok(conf_io_set("server", "version", NULL, NULL) ==
+	   KNOT_YP_ENODATA, "set group item no value");
+
+	// Single group, single value.
+	ok(conf_io_set("server", "version", NULL, "text") ==
+	   KNOT_EOK, "set single value");
+	conf_val_t val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_VERSION);
+	ok(val.code == KNOT_EOK, "check entry");
+	ok(strcmp(conf_str(&val), "text") == 0, "check entry value");
+
+	// Single group, multi value.
+	ok(conf_io_set("server", "listen", NULL, "1.1.1.1") ==
+	   KNOT_EOK, "set multivalue 1");
+	ok(conf_io_set("server", "listen", NULL, "1.1.1.2") ==
+	   KNOT_EOK, "set multivalue 2");
+	val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_LISTEN);
+	ok(val.code == KNOT_EOK, "check entry");
+	ok(conf_val_count(&val) == 2, "check entry value count");
+
+	// Prepare dnames.
+	knot_dname_t *zone1 = knot_dname_from_str_alloc(ZONE1);
+	ok(zone1 != NULL, "create dname "ZONE1);
+	knot_dname_t *zone2 = knot_dname_from_str_alloc(ZONE2);
+	ok(zone2 != NULL, "create dname "ZONE2);
+	knot_dname_t *zone3 = knot_dname_from_str_alloc(ZONE3);
+	ok(zone3 != NULL, "create dname "ZONE3);
+
+	// Multi group no id.
+	ok(conf_io_set("zone", "domain", NULL, NULL) ==
+	   KNOT_YP_ENOID, "set zone empty domain");
+
+	// Multi group ids.
+	ok(conf_io_set("zone", "domain", NULL, ZONE1) ==
+	   KNOT_EOK, "set zone domain "ZONE1);
+	ok(conf_io_set("zone", NULL, ZONE2, NULL) ==
+	   KNOT_EOK, "set zone domain "ZONE2);
+
+	// Multi group, single value.
+	ok(conf_io_set("zone", "file", ZONE1, "name") ==
+	   KNOT_EOK, "set zone file");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_FILE, zone1);
+	ok(val.code == KNOT_EOK, "check entry");
+	ok(strcmp(conf_str(&val), "name") == 0, "check entry value");
+
+	// Multi group, single value, bad id.
+	ok(conf_io_set("zone", "file", ZONE3, "name") ==
+	   KNOT_YP_EINVAL_ID, "set zone file");
+
+	// Multi group, single value, all ids.
+	ok(conf_io_set("zone", "comment", NULL, "abc") ==
+	   KNOT_EOK, "set zones comment");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone1);
+	ok(val.code == KNOT_EOK, "check entry");
+	ok(strcmp(conf_str(&val), "abc") == 0, "check entry value");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone2);
+	ok(val.code == KNOT_EOK, "check entry");
+	ok(strcmp(conf_str(&val), "abc") == 0, "check entry value");
+
+	// Prepare different comment.
+	ok(conf_io_set("zone", "domain", NULL, ZONE3) ==
+	   KNOT_EOK, "set zone domain "ZONE3);
+	ok(conf_io_set("zone", "comment", ZONE3, "xyz") ==
+	   KNOT_EOK, "set zone comment");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone3);
+	ok(val.code == KNOT_EOK, "check entry");
+	ok(strcmp(conf_str(&val), "xyz") == 0, "check entry value");
+
+	knot_dname_free(zone1, NULL);
+	knot_dname_free(zone2, NULL);
+	knot_dname_free(zone3, NULL);
+
+	ok(conf_io_commit(false) == KNOT_EOK, "commit txn");
+
+	// Update read-only transaction.
+	ok(conf_refresh_txn(conf()) == KNOT_EOK, "update read-only txn");
+}
+
+static void test_conf_io_unset(void)
+{
+	// ERR no txn.
+	ok(conf_io_unset("server", "version", NULL, "text") ==
+	   KNOT_TXN_ENOTEXISTS, "unset without active txn");
+
+	ok(conf_io_begin(false) == KNOT_EOK, "begin txn");
+
+	// ERR.
+	ok(conf_io_unset("", NULL, NULL, NULL) ==
+	   KNOT_YP_EINVAL_ITEM, "unset unknown key0");
+	ok(conf_io_unset("uknown", NULL, NULL, NULL) ==
+	   KNOT_YP_EINVAL_ITEM, "unset unknown key0");
+	ok(conf_io_unset("server", "unknown", NULL, NULL) ==
+	   KNOT_YP_EINVAL_ITEM, "unset unknown key1");
+	ok(conf_io_unset("include", NULL, NULL, "file") ==
+	   KNOT_ENOTSUP, "unset non-group item");
+	ok(conf_io_unset("server", "background-workers", NULL, "x") ==
+	   KNOT_EINVAL, "unset invalid data");
+
+	// Single group, single value.
+	ok(conf_io_unset("server", "version", NULL, "") ==
+	   KNOT_ENOENT, "unset zero length text value");
+	conf_val_t val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_VERSION);
+	ok(val.code == KNOT_EOK, "check entry");
+
+	ok(conf_io_unset("server", "version", NULL, "bad text") ==
+	   KNOT_ENOENT, "unset bad value");
+	val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_VERSION);
+	ok(val.code == KNOT_EOK, "check entry");
+
+	ok(conf_io_unset("server", "version", NULL, "text") ==
+	   KNOT_EOK, "unset explicit value");
+	val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_VERSION);
+	ok(val.code == KNOT_ENOENT, "check entry");
+
+	// Restart transaction.
+	conf_io_abort(false);
+	ok(conf_io_begin(false) == KNOT_EOK, "restart txn");
+
+	ok(conf_io_unset("server", "version", NULL, NULL) ==
+	   KNOT_EOK, "unset value");
+	val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_VERSION);
+	ok(val.code == KNOT_ENOENT, "check entry");
+
+	// Single group, multi value.
+	ok(conf_io_unset("server", "listen", NULL, "9.9.9.9") ==
+	   KNOT_ENOENT, "unset bad value");
+	val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_LISTEN);
+	ok(val.code == KNOT_EOK, "check entry");
+
+	ok(conf_io_unset("server", "listen", NULL, "1.1.1.1") ==
+	   KNOT_EOK, "unset explicit value");
+	val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_LISTEN);
+	ok(val.code == KNOT_EOK, "check entry");
+	ok(conf_val_count(&val) == 1, "check entry value count");
+
+	ok(conf_io_unset("server", "listen", NULL, NULL) ==
+	   KNOT_EOK, "unset value");
+	val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_LISTEN);
+	ok(val.code == KNOT_ENOENT, "check entry");
+
+	// Restart transaction.
+	conf_io_abort(false);
+	ok(conf_io_begin(false) == KNOT_EOK, "restart txn");
+
+	// Whole section items.
+	ok(conf_io_unset("server", NULL, NULL, NULL) ==
+	   KNOT_EOK, "unset section");
+	val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_VERSION);
+	ok(val.code == KNOT_ENOENT, "check entry");
+	val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_LISTEN);
+	ok(val.code == KNOT_ENOENT, "check entry");
+
+	// Restart transaction.
+	conf_io_abort(false);
+	ok(conf_io_begin(false) == KNOT_EOK, "restart txn");
+
+	// Prepare dnames.
+	knot_dname_t *zone1 = knot_dname_from_str_alloc(ZONE1);
+	ok(zone1 != NULL, "create dname "ZONE1);
+	knot_dname_t *zone2 = knot_dname_from_str_alloc(ZONE2);
+	ok(zone2 != NULL, "create dname "ZONE2);
+	knot_dname_t *zone3 = knot_dname_from_str_alloc(ZONE3);
+	ok(zone3 != NULL, "create dname "ZONE3);
+
+	// Multi group, single value.
+	ok(conf_io_unset("zone", "file", ZONE1, "name") ==
+	   KNOT_EOK, "unset zone file");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_FILE, zone1);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+
+	// Multi group, single bad value, all ids.
+	ok(conf_io_unset("zone", "comment", NULL, "other") ==
+	   KNOT_EOK, "unset zones comment");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone1);
+	ok(val.code == KNOT_EOK, "check entry");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone2);
+	ok(val.code == KNOT_EOK, "check entry");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone3);
+	ok(val.code == KNOT_EOK, "check entry");
+
+	// Restart transaction.
+	conf_io_abort(false);
+	ok(conf_io_begin(false) == KNOT_EOK, "restart txn");
+
+	// Multi group, single value (not all match), all ids.
+	ok(conf_io_unset("zone", "comment", NULL, "abc") ==
+	   KNOT_EOK, "unset some zones comment");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone1);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone2);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone3);
+	ok(val.code == KNOT_EOK, "check entry");
+
+	// Restart transaction.
+	conf_io_abort(false);
+	ok(conf_io_begin(false) == KNOT_EOK, "restart txn");
+
+	// Multi group, single value (all match), all ids.
+	ok(conf_io_unset("zone", "comment", NULL, NULL) ==
+	   KNOT_EOK, "unset all zones comment");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone1);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone2);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone3);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+
+	// Restart transaction.
+	conf_io_abort(false);
+	ok(conf_io_begin(false) == KNOT_EOK, "restart txn");
+
+	// Multi group, all items, specific id.
+	ok(conf_io_unset("zone", NULL, ZONE1, NULL) ==
+	   KNOT_EOK, "unset zone items");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_FILE, zone1);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone1);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone2);
+	ok(val.code == KNOT_EOK, "check entry");
+
+	// Restart transaction.
+	conf_io_abort(false);
+	ok(conf_io_begin(false) == KNOT_EOK, "restart txn");
+
+	// Multi group, all items, all ids.
+	ok(conf_io_unset("zone", NULL, NULL, NULL) ==
+	   KNOT_EOK, "unset zone items");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_FILE, zone1);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone1);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone2);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+
+	// Restart transaction.
+	conf_io_abort(false);
+	ok(conf_io_begin(false) == KNOT_EOK, "restart txn");
+
+	// All groups.
+	ok(conf_io_unset(NULL, NULL, NULL, NULL) ==
+	   KNOT_EOK, "unset all");
+	val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_VERSION);
+	ok(val.code == KNOT_ENOENT, "check entry");
+	val = conf_get_txn(conf(), conf()->io.txn, C_SERVER, C_LISTEN);
+	ok(val.code == KNOT_ENOENT, "check entry");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_FILE, zone1);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone1);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+	val = conf_zone_get_txn(conf(), conf()->io.txn, C_COMMENT, zone2);
+	ok(val.code == KNOT_YP_EINVAL_ID, "check entry");
+
+	knot_dname_free(zone1, NULL);
+	knot_dname_free(zone2, NULL);
+	knot_dname_free(zone3, NULL);
+
+	conf_io_abort(false);
+}
+
+static void test_conf_io_get(void)
+{
+	const char *ref;
+	char out[OUT_LEN];
+
+	conf_io_t io = {
+		.fcn = format_item,
+		.misc = out
+	};
+
+	// ERR no txn.
+	ok(conf_io_get("server", "version", NULL, false, &io) ==
+	   KNOT_TXN_ENOTEXISTS, "get without active txn");
+
+	// Get current, no active txn.
+	*out = '\0';
+	ok(conf_io_get("server", "version", NULL, true, &io) ==
+	   KNOT_EOK, "get current without active txn");
+	ref = "server.version = \"text\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	ok(conf_io_begin(false) == KNOT_EOK, "begin txn");
+
+	// ERR.
+	ok(conf_io_get("", NULL, NULL, true, &io) ==
+	   KNOT_YP_EINVAL_ITEM, "get empty key0");
+	ok(conf_io_get("uknown", NULL, NULL, true, &io) ==
+	   KNOT_YP_EINVAL_ITEM, "get unknown key0");
+	ok(conf_io_get("server", "unknown", NULL, true, &io) ==
+	   KNOT_YP_EINVAL_ITEM, "get unknown key1");
+	ok(conf_io_get("include", NULL, NULL, true, &io) ==
+	   KNOT_ENOTSUP, "get non-group item");
+
+	// Update item in the active txn.
+	ok(conf_io_set("server", "version", NULL, "new text") ==
+	   KNOT_EOK, "set single value");
+
+	// Get new, active txn.
+	*out = '\0';
+	ok(conf_io_get("server", "version", NULL, false, &io) ==
+	   KNOT_EOK, "get with active txn");
+	ref = "server.version = \"new text\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	// Get current, active txn.
+	*out = '\0';
+	ok(conf_io_get("server", "version", NULL, true, &io) ==
+	   KNOT_EOK, "get with active txn");
+	ref = "server.version = \"text\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	// Multi value.
+	*out = '\0';
+	ok(conf_io_get("server", "listen", NULL, true, &io) ==
+	   KNOT_EOK, "get with active txn");
+	ref = "server.listen = \"1.1.1.1\" \"1.1.1.2\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	// Single group.
+	*out = '\0';
+	ok(conf_io_get("server", NULL, NULL, true, &io) ==
+	   KNOT_EOK, "get with active txn");
+	ref = "server.version = \"text\"\n"
+	      "server.listen = \"1.1.1.1\" \"1.1.1.2\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	// Prepare dnames.
+	knot_dname_t *zone1 = knot_dname_from_str_alloc(ZONE1);
+	ok(zone1 != NULL, "create dname "ZONE1);
+
+	// Multi group, all values, all ids.
+	*out = '\0';
+	ok(conf_io_get("zone", NULL, NULL, true, &io) ==
+	   KNOT_EOK, "get with active txn");
+	ref = "zone.domain = \"zone1.\"\n"
+	      "zone[zone1.].file = \"name\"\n"
+	      "zone[zone1.].comment = \"abc\"\n"
+	      "zone.domain = \"zone2.\"\n"
+	      "zone[zone2.].comment = \"abc\"\n"
+	      "zone.domain = \"zone3.\"\n"
+	      "zone[zone3.].comment = \"xyz\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	// Multi group ids.
+	*out = '\0';
+	ok(conf_io_get("zone", "domain", NULL, true, &io) ==
+	   KNOT_EOK, "get with active txn");
+	ref = "zone.domain = \"zone1.\"\n"
+	      "zone.domain = \"zone2.\"\n"
+	      "zone.domain = \"zone3.\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	// Multi group, all values, single id.
+	*out = '\0';
+	ok(conf_io_get("zone", NULL, ZONE1, true, &io) ==
+	   KNOT_EOK, "get with active txn");
+	ref = "zone.domain = \"zone1.\"\n"
+	      "zone[zone1.].file = \"name\"\n"
+	      "zone[zone1.].comment = \"abc\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	// Multi group, single value, single id.
+	*out = '\0';
+	ok(conf_io_get("zone", "file", ZONE1, true, &io) ==
+	   KNOT_EOK, "get with active txn");
+	ref = "zone[zone1.].file = \"name\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	// All groups.
+	*out = '\0';
+	ok(conf_io_get(NULL, NULL, NULL, true, &io) ==
+	   KNOT_EOK, "get with active txn");
+	ref = "server.version = \"text\"\n"
+	      "server.listen = \"1.1.1.1\" \"1.1.1.2\"\n"
+	      "zone.domain = \"zone1.\"\n"
+	      "zone[zone1.].file = \"name\"\n"
+	      "zone[zone1.].comment = \"abc\"\n"
+	      "zone.domain = \"zone2.\"\n"
+	      "zone[zone2.].comment = \"abc\"\n"
+	      "zone.domain = \"zone3.\"\n"
+	      "zone[zone3.].comment = \"xyz\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	knot_dname_free(zone1, NULL);
+
+	conf_io_abort(false);
+}
+
+static void test_conf_io_diff(void)
+{
+	const char *ref;
+	char out[OUT_LEN];
+
+	conf_io_t io = {
+		.fcn = format_item,
+		.misc = out
+	};
+
+	// ERR no txn.
+	ok(conf_io_diff("server", "version", NULL, &io) ==
+	   KNOT_TXN_ENOTEXISTS, "diff without active txn");
+
+	ok(conf_io_begin(false) == KNOT_EOK, "begin txn");
+
+	// ERR.
+	ok(conf_io_diff("", NULL, NULL, &io) ==
+	   KNOT_YP_EINVAL_ITEM, "diff empty key0");
+	ok(conf_io_diff("uknown", NULL, NULL, &io) ==
+	   KNOT_YP_EINVAL_ITEM, "diff unknown key0");
+	ok(conf_io_diff("server", "unknown", NULL, &io) ==
+	   KNOT_YP_EINVAL_ITEM, "diff unknown key1");
+	ok(conf_io_diff("include", NULL, NULL, &io) ==
+	   KNOT_ENOTSUP, "diff non-group item");
+
+	*out = '\0';
+	ok(conf_io_diff(NULL, NULL, NULL, &io) == KNOT_EOK, "diff no change");
+	ref = "";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	// Update singlevalued item.
+	ok(conf_io_set("server", "version", NULL, "new text") ==
+	   KNOT_EOK, "set single value");
+
+	*out = '\0';
+	ok(conf_io_diff("server", "version", NULL, &io) == KNOT_EOK, "diff single item");
+	ref = "-server.version = \"text\"\n"
+	      "+server.version = \"new text\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	// Update multivalued item.
+	ok(conf_io_unset("server", "listen", NULL, "1.1.1.1") ==
+	   KNOT_EOK, "unset multivalue");
+	ok(conf_io_set("server", "listen", NULL, "1.1.1.3") ==
+	   KNOT_EOK, "set multivalue");
+
+	*out = '\0';
+	ok(conf_io_diff("server", "listen", NULL, &io) == KNOT_EOK, "diff multi item");
+	ref = "-server.listen = \"1.1.1.1\" \"1.1.1.2\"\n"
+	      "+server.listen = \"1.1.1.2\" \"1.1.1.3\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	// Unset single item.
+	ok(conf_io_unset("zone", "comment", ZONE3, NULL) ==
+	   KNOT_EOK, "unset multivalue");
+
+	*out = '\0';
+	ok(conf_io_diff("zone", NULL, ZONE3, &io) == KNOT_EOK, "diff section");
+	ref = "-zone[zone3.].comment = \"xyz\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	// Unset id.
+	ok(conf_io_unset("zone", NULL, ZONE1, NULL) ==
+	   KNOT_EOK, "unset id");
+	ok(conf_io_unset("zone", NULL, ZONE2, NULL) ==
+	   KNOT_EOK, "unset id");
+
+	*out = '\0';
+	ok(conf_io_diff("zone", NULL, ZONE2, &io) == KNOT_EOK, "diff id section");
+	ref = "-zone.domain = \"zone2.\"\n"
+	      "-zone[zone2.].comment = \"abc\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	*out = '\0';
+	ok(conf_io_diff("zone", "domain", NULL, &io) == KNOT_EOK, "diff id");
+	ref = "-zone.domain = \"zone1.\"\n"
+	      "-zone.domain = \"zone2.\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	*out = '\0';
+	ok(conf_io_diff(NULL, NULL, NULL, &io) == KNOT_EOK, "diff whole change");
+	ref = "-server.version = \"text\"\n"
+	      "+server.version = \"new text\"\n"
+	      "-server.listen = \"1.1.1.1\" \"1.1.1.2\"\n"
+	      "+server.listen = \"1.1.1.2\" \"1.1.1.3\"\n"
+	      "-zone.domain = \"zone1.\"\n"
+	      "-zone[zone1.].file = \"name\"\n"
+	      "-zone[zone1.].comment = \"abc\"\n"
+	      "-zone.domain = \"zone2.\"\n"
+	      "-zone[zone2.].comment = \"abc\"\n"
+	      "-zone[zone3.].comment = \"xyz\"";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	conf_io_abort(false);
+}
+
+static void test_conf_io_list(void)
+{
+	const char *ref;
+	char out[OUT_LEN];
+
+	conf_io_t io = {
+		.fcn = format_item,
+		.misc = out
+	};
+
+	// ERR.
+	ok(conf_io_list("", &io) ==
+	   KNOT_YP_EINVAL_ITEM, "list empty key0");
+	ok(conf_io_list("uknown", &io) ==
+	   KNOT_YP_EINVAL_ITEM, "list unknown key0");
+	ok(conf_io_list("include", &io) ==
+	   KNOT_ENOTSUP, "list non-group item");
+
+	// Desc schema.
+	*out = '\0';
+	ok(conf_io_list(NULL, &io) ==
+	   KNOT_EOK, "list schema");
+	ref = "server\n"
+	      "control\n"
+	      "remote\n"
+	      "template\n"
+	      "zone\n"
+	      "include";
+	ok(strcmp(ref, out) == 0, "compare result");
+
+	// Desc group.
+	*out = '\0';
+	ok(conf_io_list("server", &io) ==
+	   KNOT_EOK, "list group");
+	ref = "server.version\n"
+	      "server.background-workers\n"
+	      "server.listen\n"
+	      "server.tcp-handshake-timeout\n"
+	      "server.tcp-idle-timeout\n"
+	      "server.tcp-reply-timeout\n"
+	      "server.max-tcp-clients\n"
+	      "server.max-udp-payload\n"
+	      "server.max-ipv4-udp-payload\n"
+	      "server.max-ipv6-udp-payload\n"
+	      "server.edns-client-subnet\n"
+	      "server.answer-rotation";
+	ok(strcmp(ref, out) == 0, "compare result");
+}
+
+static const yp_item_t desc_server[] = {
+	{ C_VERSION,              YP_TSTR,  YP_VNONE },
+	{ C_BG_WORKERS,           YP_TINT,  YP_VNONE },
+	{ C_LISTEN,               YP_TADDR, YP_VNONE, YP_FMULTI },
+	// Required config cache items - assert fix.
+	{ C_TCP_HSHAKE_TIMEOUT,   YP_TINT,  YP_VNONE },
+	{ C_TCP_IDLE_TIMEOUT,	  YP_TINT,  YP_VNONE },
+	{ C_TCP_REPLY_TIMEOUT,	  YP_TINT,  YP_VNONE },
+	{ C_MAX_TCP_CLIENTS,	  YP_TINT,  YP_VNONE },
+	{ C_MAX_UDP_PAYLOAD,      YP_TINT,  YP_VNONE },
+	{ C_MAX_IPV4_UDP_PAYLOAD, YP_TINT,  YP_VNONE },
+	{ C_MAX_IPV6_UDP_PAYLOAD, YP_TINT,  YP_VNONE },
+	{ C_ECS,                  YP_TBOOL, YP_VNONE },
+	{ C_ANS_ROTATION,         YP_TBOOL, YP_VNONE },
+	{ NULL }
+};
+
+static const yp_item_t desc_control[] = {
+	{ C_TIMEOUT, YP_TINT, YP_VNONE },
+	{ NULL }
+};
+
+static const yp_item_t desc_remote[] = {
+	{ C_ID,   YP_TSTR,  YP_VNONE },
+	{ C_ADDR, YP_TADDR, YP_VNONE, YP_FMULTI },
+	{ NULL }
+};
+
+#define ZONE_ITEMS \
+	{ C_FILE,           YP_TSTR,  YP_VNONE }, \
+	{ C_MASTER,         YP_TREF,  YP_VREF = { C_RMT }, YP_FMULTI, { check_ref } }, \
+	{ C_DNSSEC_SIGNING, YP_TBOOL, YP_VNONE }, \
+	{ C_COMMENT,        YP_TSTR,  YP_VNONE },
+
+static const yp_item_t desc_template[] = {
+	{ C_ID, YP_TSTR, YP_VNONE },
+	ZONE_ITEMS
+	{ NULL }
+};
+
+static const yp_item_t desc_zone[] = {
+	{ C_DOMAIN, YP_TDNAME, YP_VNONE },
+	ZONE_ITEMS
+	{ NULL }
+};
+
+const yp_item_t test_schema[] = {
+	{ C_SRV,  YP_TGRP, YP_VGRP = { desc_server } },
+	{ C_CTL,  YP_TGRP, YP_VGRP = { desc_control } },
+	{ C_RMT,  YP_TGRP, YP_VGRP = { desc_remote }, YP_FMULTI, { check_remote } },
+	{ C_TPL,  YP_TGRP, YP_VGRP = { desc_template }, YP_FMULTI, { check_template } },
+	{ C_ZONE, YP_TGRP, YP_VGRP = { desc_zone }, YP_FMULTI, { check_zone } },
+	{ C_INCL, YP_TSTR, YP_VNONE, YP_FNONE, { include_file } },
+	{ NULL }
+};
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	ok(test_conf("", test_schema) == KNOT_EOK, "Prepare configuration");
+
+	diag("conf_io_begin");
+	test_conf_io_begin();
+
+	diag("conf_io_abort");
+	test_conf_io_abort();
+
+	diag("conf_io_commit");
+	test_conf_io_commit();
+
+	diag("conf_io_check");
+	test_conf_io_check();
+
+	diag("conf_io_set");
+	test_conf_io_set();
+
+	diag("conf_io_unset");
+	test_conf_io_unset();
+
+	diag("conf_io_get");
+	test_conf_io_get();
+
+	diag("conf_io_diff");
+	test_conf_io_diff();
+
+	diag("conf_io_list");
+	test_conf_io_list();
+
+	conf_free(conf());
+
+	return 0;
+}
diff --git a/tests/knot/test_dthreads.c b/tests/knot/test_dthreads.c
new file mode 100644
index 0000000..0637e7c
--- /dev/null
+++ b/tests/knot/test_dthreads.c
@@ -0,0 +1,145 @@
+/*  Copyright (C) 2011 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <pthread.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <tap/basic.h>
+
+#include "knot/server/dthreads.h"
+
+/* Unit runnable data. */
+static pthread_mutex_t _runnable_mx;
+static volatile int _runnable_i = 0;
+static const int _runnable_cycles = 10000;
+
+/*! \brief Unit runnable. */
+int runnable(struct dthread *thread)
+{
+	for (int i = 0; i < _runnable_cycles; ++i) {
+
+		// Increase counter
+		pthread_mutex_lock(&_runnable_mx);
+		++_runnable_i;
+		pthread_mutex_unlock(&_runnable_mx);
+
+		// Cancellation point
+		if (dt_is_cancelled(thread)) {
+			break;
+		}
+
+		// Yield
+		sched_yield();
+	}
+
+	return 0;
+}
+
+/* Destructor data. */
+static volatile int _destructor_data = 0;
+static pthread_mutex_t _destructor_mx;
+
+/*! \brief Thread destructor. */
+int destruct(struct dthread *thread)
+{
+	pthread_mutex_lock(&_destructor_mx);
+	_destructor_data += 1;
+	pthread_mutex_unlock(&_destructor_mx);
+
+	return 0;
+}
+
+// Signal handler
+static void interrupt_handle(int s)
+{
+}
+
+/*! API: run tests. */
+int main(int argc, char *argv[])
+{
+	plan(8);
+
+	// Register service and signal handler
+	struct sigaction sa;
+	sa.sa_handler = interrupt_handle;
+	sigemptyset(&sa.sa_mask);
+	sa.sa_flags = 0;
+	sigaction(SIGALRM, &sa, NULL); // Interrupt
+
+	/* Initialize */
+	srand(time(NULL));
+	pthread_mutex_init(&_runnable_mx, NULL);
+	pthread_mutex_init(&_destructor_mx, NULL);
+
+	/* Test 1: Create unit */
+	int size = 2;
+	dt_unit_t *unit = dt_create(size, &runnable, NULL, NULL);
+	ok(unit != NULL, "dthreads: create unit (size %d)", size);
+	if (unit == NULL) {
+		skip_block(7, "No dthreads unit");
+		goto skip_all;
+	}
+
+	/* Test 2: Start tasks. */
+	_runnable_i = 0;
+	ok(dt_start(unit) == 0, "dthreads: start single task");
+
+	/* Test 3: Wait for tasks. */
+	ok(dt_join(unit) == 0, "dthreads: join threads");
+
+	/* Test 4: Compare counter. */
+	int expected = _runnable_cycles * 2;
+	is_int(expected, _runnable_i, "dthreads: result ok");
+
+	/* Test 5: Deinitialize */
+	dt_delete(&unit);
+	ok(unit == NULL, "dthreads: delete unit");
+
+	/* Test 6: Wrong values. */
+	unit = dt_create(-1, NULL, NULL, NULL);
+	ok(unit == NULL, "dthreads: create with negative count");
+
+	/* Test 7: NULL operations crashing. */
+	int ret = 0;
+	ret += dt_activate(0);
+	ret += dt_cancel(0);
+	ret += dt_compact(0);
+	dt_delete(0);
+	ret += dt_is_cancelled(0);
+	ret += dt_join(0);
+	ret += dt_signalize(0, SIGALRM);
+	ret += dt_start(0);
+	ret += dt_stop(0);
+	ret += dt_unit_lock(0);
+	ret += dt_unit_unlock(0);
+	is_int(-198, ret, "dthreads: correct values when passed NULL context");
+
+	/* Test 8: Thread destructor. */
+	_destructor_data = 0;
+	unit = dt_create(2, 0, destruct, 0);
+	dt_start(unit);
+	dt_stop(unit);
+	dt_join(unit);
+	is_int(2, _destructor_data, "dthreads: destructor with dt_create_coherent()");
+	dt_delete(&unit);
+
+skip_all:
+
+	pthread_mutex_destroy(&_runnable_mx);
+	pthread_mutex_destroy(&_destructor_mx);
+	return 0;
+}
diff --git a/tests/knot/test_fdset.c b/tests/knot/test_fdset.c
new file mode 100644
index 0000000..181838c
--- /dev/null
+++ b/tests/knot/test_fdset.c
@@ -0,0 +1,152 @@
+/*  Copyright (C) 2011 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <stdlib.h>
+#include <stdint.h>
+#include <sys/time.h>
+#include <pthread.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <tap/basic.h>
+#include <time.h>
+
+#include "knot/common/fdset.h"
+
+#define WRITE_PATTERN ((char) 0xde)
+#define WRITE_PATTERN_LEN sizeof(char)
+
+/* Subtract the `struct timeval' values X and Y,
+   storing the result in RESULT.
+   Return 1 if the difference is negative, otherwise 0.
+   Copyright http://www.delorie.com/gnu/docs/glibc/libc_428.html
+*/
+static int timeval_subtract (struct timeval *result, struct timeval *x,  struct timeval* y)
+{
+  /* Perform the carry for the later subtraction by updating y. */
+  if (x->tv_usec < y->tv_usec) {
+    int nsec = (y->tv_usec - x->tv_usec) / 1000000 + 1;
+    y->tv_usec -= 1000000 * nsec;
+    y->tv_sec += nsec;
+  }
+  if (x->tv_usec - y->tv_usec > 1000000) {
+    int nsec = (x->tv_usec - y->tv_usec) / 1000000;
+    y->tv_usec += 1000000 * nsec;
+    y->tv_sec -= nsec;
+  }
+
+  /* Compute the time remaining to wait.
+     tv_usec is certainly positive. */
+  result->tv_sec = x->tv_sec - y->tv_sec;
+  result->tv_usec = x->tv_usec - y->tv_usec;
+
+  /* Return 1 if result is negative. */
+  return x->tv_sec < y->tv_sec;
+}
+
+static size_t timeval_diff(struct timeval *from, struct timeval *to) {
+	struct timeval res;
+	timeval_subtract(&res, to, from);
+	return res.tv_sec*1000 + res.tv_usec/1000;
+}
+
+void* thr_action(void *arg)
+{
+	int *fd = (int *)arg;
+
+	/* Sleep for 100ms. */
+	struct timespec ts = { .tv_nsec = 1e8 };
+	nanosleep(&ts, NULL);
+
+	/* Write pattern. */
+	char pattern = WRITE_PATTERN;
+	if (write(*fd, &pattern, WRITE_PATTERN_LEN) == -1) {
+		// Error.
+	}
+
+	return NULL;
+}
+
+int main(int argc, char *argv[])
+{
+	plan(12);
+
+	/* 1. Create fdset. */
+	fdset_t set;
+	int ret = fdset_init(&set, 32);
+	is_int(0, ret, "fdset: init");
+
+	/* 2. Create pipe. */
+	int fds[2], tmpfds[2];
+	ret = pipe(fds);
+	ok(ret >= 0, "fdset: pipe() works");
+	ret = pipe(tmpfds);
+	ok(ret >= 0, "fdset: 2nd pipe() works");
+
+	/* 3. Add fd to set. */
+	ret = fdset_add(&set, fds[0], POLLIN, NULL);
+	is_int(0, ret, "fdset: add to set works");
+	fdset_add(&set, tmpfds[0], POLLIN, NULL);
+
+	/* Schedule write. */
+	struct timeval ts, te;
+	gettimeofday(&ts, 0);
+	pthread_t t;
+	pthread_create(&t, 0, thr_action, &fds[1]);
+
+	/* 4. Watch fdset. */
+	int nfds = poll(set.pfd, set.n, 60 * 1000);
+	gettimeofday(&te, 0);
+	size_t diff = timeval_diff(&ts, &te);
+
+	ok(nfds > 0, "fdset: poll returned %d events in %zu ms", nfds, diff);
+
+	/* 5. Prepare event set. */
+	ok(set.pfd[0].revents & POLLIN, "fdset: pipe is active");
+
+	/* 6. Receive data. */
+	char buf = 0x00;
+	ret = read(set.pfd[0].fd, &buf, WRITE_PATTERN_LEN);
+	ok(ret >= 0 && buf == WRITE_PATTERN, "fdset: contains valid data");
+
+	/* 7-9. Remove from event set. */
+	ret = fdset_remove(&set, 0);
+	is_int(0, ret, "fdset: remove from fdset works");
+	close(fds[0]);
+	close(fds[1]);
+	ret = fdset_remove(&set, 0);
+	close(tmpfds[1]);
+	close(tmpfds[1]);
+	is_int(0, ret, "fdset: remove from fdset works (2)");
+	ret = fdset_remove(&set, 0);
+	ok(ret != 0, "fdset: removing nonexistent item");
+
+	/* 10. Crash test. */
+	fdset_init(0, 0);
+	fdset_add(0, 1, 1, 0);
+	fdset_add(0, 0, 1, 0);
+	fdset_remove(0, 1);
+	fdset_remove(0, 0);
+	ok(1, "fdset: crash test successful");
+
+	/* 11. Destroy fdset. */
+	ret = fdset_clear(&set);
+	is_int(0, ret, "fdset: destroyed");
+
+	/* Cleanup. */
+	pthread_join(t, 0);
+
+	return 0;
+}
diff --git a/tests/knot/test_journal.c b/tests/knot/test_journal.c
new file mode 100644
index 0000000..e12cc84
--- /dev/null
+++ b/tests/knot/test_journal.c
@@ -0,0 +1,746 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <assert.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <limits.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <tap/basic.h>
+#include <tap/files.h>
+
+#include "libknot/libknot.h"
+#include "knot/journal/journal.c"
+#include "knot/zone/zone.h"
+#include "knot/zone/zone-diff.h"
+#include "libknot/rrtype/soa.h"
+#include "test_conf.h"
+
+#define RAND_RR_LABEL 16
+#define RAND_RR_PAYLOAD 64
+#define MIN_SOA_SIZE 22
+
+char *test_dir_name;
+journal_db_t *db;
+journal_t *j;
+const knot_dname_t *apex = (const uint8_t *)"\4test";
+
+static void set_conf(int zonefile_sync, size_t journal_usage)
+{
+	char conf_str[512];
+	snprintf(conf_str, sizeof(conf_str),
+	         "zone:\n"
+	         " - domain: %s\n"
+	         "   zonefile-sync: %d\n"
+	         "   max-journal-usage: %zu\n"
+	         "   max-journal-depth: 1000\n",
+	         (const char *)(apex + 1), zonefile_sync, journal_usage);
+	int ret = test_conf(conf_str, NULL);
+	(void)ret;
+	assert(ret == KNOT_EOK);
+}
+
+static void unset_conf(void)
+{
+	conf_update(NULL, CONF_UPD_FNONE);
+}
+
+/*! \brief Generate random string with given length. */
+static int randstr(char* dst, size_t len)
+{
+	for (int i = 0; i < len - 1; ++i) {
+		dst[i] = '0' + (int) (('Z'-'0') * (rand() / (RAND_MAX + 1.0)));
+	}
+	dst[len - 1] = '\0';
+
+	return 0;
+}
+
+/*! \brief Init RRSet with type SOA and given serial. */
+static void init_soa(knot_rrset_t *rr, const uint32_t serial, const knot_dname_t *apex)
+{
+	knot_rrset_init(rr, knot_dname_copy(apex, NULL), KNOT_RRTYPE_SOA, KNOT_CLASS_IN, 3600);
+
+	uint8_t soa_data[MIN_SOA_SIZE] = { 0 };
+	int ret = knot_rrset_add_rdata(rr, soa_data, sizeof(soa_data), NULL);
+	knot_soa_serial_set(rr->rrs.rdata, serial);
+	(void)ret;
+	assert(ret == KNOT_EOK);
+}
+
+/*! \brief Init RRSet with type TXT, random owner and random payload. */
+static void init_random_rr(knot_rrset_t *rr , const knot_dname_t *apex)
+{
+	/* Create random label. */
+	char owner[RAND_RR_LABEL + knot_dname_size(apex)];
+	owner[0] = RAND_RR_LABEL - 1;
+	randstr(owner + 1, RAND_RR_LABEL);
+
+	/* Append zone apex. */
+	memcpy(owner + RAND_RR_LABEL, apex, knot_dname_size(apex));
+	knot_rrset_init(rr, knot_dname_copy((knot_dname_t *)owner, NULL),
+			KNOT_RRTYPE_TXT, KNOT_CLASS_IN, 3600);
+
+	/* Create random RDATA. */
+	uint8_t txt[RAND_RR_PAYLOAD + 1];
+	txt[0] = RAND_RR_PAYLOAD - 1;
+	randstr((char *)(txt + 1), RAND_RR_PAYLOAD);
+
+	int ret = knot_rrset_add_rdata(rr, txt, RAND_RR_PAYLOAD, NULL);
+	(void)ret;
+	assert(ret == KNOT_EOK);
+}
+
+/*! \brief Init changeset with random changes. */
+static void init_random_changeset(changeset_t *ch, const uint32_t from, const uint32_t to,
+                                  const size_t size, const knot_dname_t *apex, bool is_bootstrap)
+{
+	// Add SOAs
+	knot_rrset_t soa;
+
+	if (is_bootstrap) {
+		ch->soa_from = NULL;
+	} else {
+		init_soa(&soa, from, apex);
+		ch->soa_from = knot_rrset_copy(&soa, NULL);
+		assert(ch->soa_from);
+		knot_rrset_clear(&soa, NULL);
+	}
+
+	init_soa(&soa, to, apex);
+	ch->soa_to = knot_rrset_copy(&soa, NULL);
+	assert(ch->soa_to);
+	knot_rrset_clear(&soa, NULL);
+
+	// Add RRs to add section
+	for (size_t i = 0; i < size / 2; ++i) {
+		knot_rrset_t rr;
+		init_random_rr(&rr, apex);
+		int ret = changeset_add_addition(ch, &rr, 0);
+		(void)ret;
+		assert(ret == KNOT_EOK);
+		knot_rrset_clear(&rr, NULL);
+	}
+
+	// Add RRs to remove section
+	for (size_t i = 0; i < size / 2 && !is_bootstrap; ++i) {
+		knot_rrset_t rr;
+		init_random_rr(&rr, apex);
+		int ret = changeset_add_removal(ch, &rr, 0);
+		(void)ret;
+		assert(ret == KNOT_EOK);
+		knot_rrset_clear(&rr, NULL);
+	}
+}
+
+static void changeset_set_soa_serials(changeset_t *ch, uint32_t from, uint32_t to,
+				      const knot_dname_t *apex)
+{
+	knot_rrset_t soa;
+
+	init_soa(&soa, from, apex);
+	knot_rrset_free(ch->soa_from, NULL);
+	ch->soa_from = knot_rrset_copy(&soa, NULL);
+	assert(ch->soa_from);
+	knot_rrset_clear(&soa, NULL);
+
+	init_soa(&soa, to, apex);
+	knot_rrset_free(ch->soa_to, NULL);
+	ch->soa_to = knot_rrset_copy(&soa, NULL);
+	assert(ch->soa_to);
+	knot_rrset_clear(&soa, NULL);
+}
+
+/*! \brief Compare two changesets for equality. */
+static bool changesets_eq(const changeset_t *ch1, changeset_t *ch2)
+{
+	if (changeset_size(ch1) != changeset_size(ch2)) {
+		return false;
+	}
+
+	changeset_iter_t it1;
+	changeset_iter_all(&it1, ch1);
+	changeset_iter_t it2;
+	changeset_iter_all(&it2, ch2);
+
+	knot_rrset_t rr1 = changeset_iter_next(&it1);
+	knot_rrset_t rr2 = changeset_iter_next(&it2);
+	bool ret = true;
+	while (!knot_rrset_empty(&rr1)) {
+		if (!knot_rrset_equal(&rr1, &rr2, KNOT_RRSET_COMPARE_WHOLE)) {
+			ret = false;
+			break;
+		}
+		rr1 = changeset_iter_next(&it1);
+		rr2 = changeset_iter_next(&it2);
+	}
+
+	changeset_iter_clear(&it1);
+	changeset_iter_clear(&it2);
+
+	return ret;
+}
+
+static bool changesets_list_eq(list_t *l1, list_t *l2)
+{
+	node_t *n = NULL;
+	node_t *k = HEAD(*l2);
+	WALK_LIST(n, *l1) {
+		if (k == NULL) {
+			return false;
+		}
+
+		changeset_t *ch1 = (changeset_t *) n;
+		changeset_t *ch2 = (changeset_t *) k;
+		if (!changesets_eq(ch1, ch2)) {
+			return false;
+		}
+
+		k = k->next;
+	}
+
+	if (k->next != NULL) {
+		return false;
+	}
+
+	return true;
+}
+
+/*! \brief Test a list of changesets for continuity. */
+static bool test_continuity(list_t *l)
+{
+	node_t *n = NULL;
+	uint32_t key1, key2;
+	WALK_LIST(n, *l) {
+		if (n == TAIL(*l)) {
+			break;
+		}
+		changeset_t *ch1 = (changeset_t *) n;
+		changeset_t *ch2 = (changeset_t *) n->next;
+		key1 = knot_soa_serial(ch1->soa_to->rrs.rdata);
+		key2 = knot_soa_serial(ch2->soa_from->rrs.rdata);
+		if (key1 != key2) {
+			return KNOT_EINVAL;
+		}
+	}
+
+	return KNOT_EOK;
+}
+
+static void test_journal_db(void)
+{
+	int ret, ret2 = KNOT_EOK;
+
+	ret = journal_db_init(&db, test_dir_name, 2 * 1024 * 1024, JOURNAL_MODE_ASYNC);
+	is_int(KNOT_EOK, ret, "journal: init db (%d)", ret);
+
+	ret = journal_open_db(&db);
+	is_int(KNOT_EOK, ret, "journal: open db (%d)", ret);
+
+	journal_db_close(&db);
+	ok(db == NULL, "journal: close and destroy db");
+
+	ret = journal_db_init(&db, test_dir_name, 4 * 1024 * 1024, JOURNAL_MODE_ASYNC);
+	if (ret == KNOT_EOK) ret2 = journal_open_db(&db);
+	ok(ret == KNOT_EOK && ret2 == KNOT_EOK, "journal: open with bigger mapsize (%d, %d)", ret, ret2);
+	journal_db_close(&db);
+
+	ret = journal_db_init(&db, test_dir_name, 1024 * 1024, JOURNAL_MODE_ASYNC);
+	if (ret == KNOT_EOK) ret2 = journal_open_db(&db);
+	ok(ret == KNOT_EOK && ret2 == KNOT_EOK, "journal: open with smaller mapsize (%d, %d)", ret, ret2);
+	journal_db_close(&db);
+}
+
+/*! \brief Test behavior with real changesets. */
+static void test_store_load(void)
+{
+	int ret, ret2 = KNOT_EOK;
+
+	set_conf(1000, 512 * 1024);
+
+	j = journal_new();
+	ok(j != NULL, "journal: new");
+
+	ret = journal_db_init(&db, test_dir_name, (512 + 1024) * 1024, JOURNAL_MODE_ASYNC);
+	if (ret == KNOT_EOK) ret2 = journal_open(j, &db, apex);
+	is_int(KNOT_EOK, ret, "journal: open (%d, %d)", ret, ret2);
+
+	/* Save and load changeset. */
+	changeset_t *m_ch = changeset_new(apex);
+	init_random_changeset(m_ch, 0, 1, 128, apex, false);
+	ret = journal_store_changeset(j, m_ch);
+	is_int(KNOT_EOK, ret, "journal: store changeset (%d)", ret);
+	ret = journal_check(j, JOURNAL_CHECK_INFO);
+	is_int(KNOT_EOK, ret, "journal check (%d)", ret);
+	list_t l, k;
+	init_list(&l);
+	init_list(&k);
+	ret = journal_load_changesets(j, &l, 0);
+	add_tail(&k, &m_ch->n);
+	ok(ret == KNOT_EOK && changesets_list_eq(&l, &k), "journal: load changeset (%d)", ret);
+	ret = journal_check(j, JOURNAL_CHECK_STDERR);
+	is_int(KNOT_EOK, ret, "journal check (%d)", ret);
+
+	/* Load ctx's. */
+	chgset_ctx_list_t cl = { { 0 }, 0 };
+	ret = journal_load_chgset_ctx(j, &cl, 0);
+	ok(ret == KNOT_EOK, "journal: chgset_ctx: load (%s)", knot_strerror(ret));
+	chgset_ctx_list_close(&cl);
+
+	changesets_free(&l);
+	changesets_free(&k);
+
+	/* Flush the journal. */
+	ret = journal_flush(j);
+	is_int(KNOT_EOK, ret, "journal: first and simple flush (%d)", ret);
+	ret = journal_check(j, JOURNAL_CHECK_STDERR);
+	is_int(KNOT_EOK, ret, "journal check (%d)", ret);
+	init_list(&l);
+	init_list(&k);
+
+	/* Fill the journal. */
+	ret = KNOT_EOK;
+	uint32_t serial = 1;
+	for (; ret == KNOT_EOK && serial < 40000; ++serial) {
+		changeset_t *m_ch2 = changeset_new(apex);
+		init_random_changeset(m_ch2, serial, serial + 1, 128, apex, false);
+		ret = journal_store_changeset(j, m_ch2);
+		if (ret != KNOT_EOK) {
+			changeset_free(m_ch2);
+			break;
+		}
+		add_tail(&k, &m_ch2->n);
+	}
+	is_int(KNOT_EBUSY, ret, "journal: overfill with changesets (%d inserted) (%d should= %d)",
+	   serial, ret, KNOT_EBUSY);
+	ret = journal_check(j, JOURNAL_CHECK_STDERR);
+	is_int(KNOT_EOK, ret, "journal check (%d)", ret);
+
+	/* Load all changesets stored until now. */
+	ret = journal_load_changesets(j, &l, 1);
+	ok(ret == KNOT_EOK && changesets_list_eq(&l, &k), "journal: load changesets (%d)", ret);
+
+	changesets_free(&l);
+	init_list(&l);
+	ret = journal_load_changesets(j, &l, 1);
+	ok(ret == KNOT_EOK && changesets_list_eq(&l, &k), "journal: re-load changesets (%d)", ret);
+
+	ret = journal_load_chgset_ctx(j, &cl, 1);
+	ok(ret == KNOT_EOK, "journal: chgset_ctx: load 2 (%s)", knot_strerror(ret));
+	ok(list_size(&cl.l) == list_size(&l), "journal: chgset_ctx: load size %zu ?== %zu", list_size(&cl.l), list_size(&l));
+	chgset_ctx_list_close(&cl);
+
+	changesets_free(&l);
+	init_list(&l);
+
+	/* Flush the journal. */
+	ret = journal_flush(j);
+	is_int(KNOT_EOK, ret, "journal: second flush (%d)", ret);
+	ret = journal_check(j, JOURNAL_CHECK_STDERR);
+	is_int(KNOT_EOK, ret, "journal check (%d)", ret);
+
+	/* Test whether the journal kept changesets after flush. */
+	ret = journal_load_changesets(j, &l, 1);
+	ok(ret == KNOT_EOK && changesets_list_eq(&l, &k), "journal: load right after flush (%d)", ret);
+
+	changesets_free(&k);
+	changesets_free(&l);
+	init_list(&k);
+	init_list(&l);
+
+	/* Store next changeset. */
+	changeset_t ch;
+	ret = changeset_init(&ch, apex);
+	ok(ret == KNOT_EOK, "journal: changeset init (%d)", ret);
+	init_random_changeset(&ch, serial, serial + 1, 128, apex, false);
+	ret = journal_store_changeset(j, &ch);
+	changeset_clear(&ch);
+	is_int(KNOT_EOK, ret, "journal: store after flush (%d)", ret);
+	ret = journal_check(j, JOURNAL_CHECK_STDERR);
+	is_int(KNOT_EOK, ret, "journal check (%d)", ret);
+
+	/* Load last changesets. */
+	init_list(&l);
+	ret = journal_load_changesets(j, &l, serial);
+	changesets_free(&l);
+	is_int(KNOT_EOK, ret, "journal: load changesets after flush (%d)", ret);
+
+	/* Flush the journal again. */
+	ret = journal_flush(j);
+	is_int(KNOT_EOK, ret, "journal: flush again (%d)", ret);
+	ret = journal_check(j, JOURNAL_CHECK_STDERR);
+	is_int(KNOT_EOK, ret, "journal check (%d)", ret);
+
+	/* Fill the journal using a list. */
+	uint32_t m_serial = 1;
+	for (; m_serial < serial / 2; ++m_serial) {
+		changeset_t *m_ch7 = changeset_new(apex);
+		init_random_changeset(m_ch7, m_serial, m_serial + 1, 128, apex, false);
+		add_tail(&l, &m_ch7->n);
+	}
+	ret = journal_store_changesets(j, &l);
+	is_int(KNOT_EOK, ret, "journal: fill with changesets using a list (%d inserted)", m_serial);
+	ret = journal_check(j, JOURNAL_CHECK_STDERR);
+	is_int(KNOT_EOK, ret, "journal check (%d)", ret);
+
+	/* Cleanup. */
+	changesets_free(&l);
+	init_list(&l);
+
+	/* Load all previous changesets. */
+	ret = journal_load_changesets(j, &l, 1);
+	ok(ret == KNOT_EOK && knot_soa_serial(((changeset_t *)TAIL(l))->soa_to->rrs.rdata) == m_serial,
+	   "journal: load all changesets");
+
+	/* Check for changeset ordering. */
+	ok(test_continuity(&l) == KNOT_EOK, "journal: changesets are in order");
+
+	/* Cleanup. */
+	changesets_free(&l);
+	init_list(&l);
+	ret = journal_flush(j);
+	is_int(KNOT_EOK, ret, "journal: allways ok journal_flush 0");
+	ret = journal_drop_changesets(j); /* Clear the journal for the collision test */
+	is_int(KNOT_EOK, ret, "journal: allways ok journal_drop_changesets");
+
+	/* Test for serial number collision handling. We insert changesets
+	 * with valid serial sequence that overflows and then collides with itself.
+	 * The sequence is 0 -> 1 -> 2 -> 2147483647 -> 4294967294 -> 1 which should
+	 * remove changesets 0->1 and 1->2. */
+	ok(EMPTY_LIST(k), "journal: empty list k");
+	ok(EMPTY_LIST(l), "journal: empty list l");
+	changeset_t *m_ch3 = changeset_new(apex);
+	init_random_changeset(m_ch3, 0, 1, 128, apex, false);
+	ret = journal_store_changeset(j, m_ch3);
+	is_int(KNOT_EOK, ret, "journal: allways ok journal_store_changeset 1");
+	changeset_set_soa_serials(m_ch3, 1, 2, apex);
+	ret = journal_store_changeset(j, m_ch3);
+	is_int(KNOT_EOK, ret, "journal: allways ok journal_store_changeset 2");
+	changeset_set_soa_serials(m_ch3, 2, 2147483647, apex);
+	add_tail(&k, &m_ch3->n);
+	ret = journal_store_changeset(j, m_ch3);
+	is_int(KNOT_EOK, ret, "journal: allways ok journal_store_changeset 3");
+	changeset_t *m_ch4 = changeset_new(apex);
+	init_random_changeset(m_ch4, 2147483647, 4294967294, 128, apex, false);
+	add_tail(&k, &m_ch4->n);
+	ret = journal_store_changeset(j, m_ch4);
+	is_int(KNOT_EOK, ret, "journal: allways ok journal_store_changeset 4");
+	changeset_t *m_ch5 = changeset_new(apex);
+	init_random_changeset(m_ch5, 4294967294, 1, 128, apex, false);
+	add_tail(&k, &m_ch5->n);
+	ret = journal_store_changeset(j, m_ch5);
+	is_int(KNOT_EBUSY, ret, "journal: allways ok journal_store_changeset 5");
+	ret = journal_flush(j);
+	is_int(KNOT_EOK, ret, "journal: allways ok journal_flush 1");
+	ret = journal_store_changeset(j, m_ch5);
+	is_int(KNOT_EOK, ret, "journal: allways ok journal_store_changeset 6");
+	ret = journal_flush(j);
+	is_int(KNOT_EOK, ret, "journal: allways ok journal_flush 2");
+	ret = journal_load_changesets(j, &l, 0);
+	ret2 = journal_load_changesets(j, &l, 1);
+	int ret3 = journal_load_changesets(j, &l, 2);
+	fprintf(stderr, "ret=%d ret2=%d ret3=%d\n", ret, ret2, ret3);
+	ok(ret == KNOT_ENOENT && ret2 == KNOT_ENOENT && ret3 == KNOT_EOK &&
+	   changesets_list_eq(&l, &k), "journal: serial collision");
+	ret = journal_check(j, JOURNAL_CHECK_STDERR);
+	is_int(KNOT_EOK, ret, "journal check (%d)", ret);
+
+	/* Cleanup. */
+	changesets_free(&l);
+	changesets_free(&k);
+
+	init_list(&l);
+	init_list(&k);
+
+	/* Check bootstrap changeset */
+	ret = journal_drop_changesets(j);
+	ok(ret == KNOT_EOK, "journal: journal_drop_changesets must be ok");
+
+	changeset_t *m_ch6 = changeset_new(apex);
+	init_random_changeset(m_ch6, 0, 1, 128, apex, true);
+	ret = journal_store_changeset(j, m_ch6);
+	ok(ret == KNOT_EOK, "journal: store bootstrap (%d)", ret);
+	ret = journal_check(j, JOURNAL_CHECK_STDERR);
+	ok(ret == KNOT_EOK, "journal check (%d)", ret);
+	changeset_t *m_ch7 = changeset_new(apex);
+	init_random_changeset(m_ch7, 1, 2, 128, apex, false);
+	ret = journal_store_changeset(j, m_ch7);
+	ok(ret == KNOT_EOK, "journal: store after bootstrap (%d)", ret);
+	add_tail(&k, &m_ch6->n);
+	add_tail(&k, &m_ch7->n);
+	ret = journal_load_bootstrap(j, &l);
+	ok(ret == KNOT_EOK && changesets_list_eq(&l, &k), "journal: load boostrap (%d)", ret);
+	ret = journal_check(j, JOURNAL_CHECK_STDERR);
+	ok(ret == KNOT_EOK, "journal check (%d)", ret);
+
+	changesets_free(&l);
+	changesets_free(&k);
+
+	init_list(&l);
+	init_list(&k);
+
+	ret = journal_scrape(j);
+	ok(ret == KNOT_EOK, "journal: scrape must be ok");
+
+	unset_conf();
+}
+
+const uint8_t *rdA = (const uint8_t *) "\x01\x02\x03\x04";
+const uint8_t *rdB = (const uint8_t *) "\x01\x02\x03\x05";
+const uint8_t *rdC = (const uint8_t *) "\x01\x02\x03\x06";
+
+// frees owner
+static knot_rrset_t * tm_rrset(knot_dname_t * owner, const uint8_t * rdata)
+{
+	knot_rrset_t * rrs = knot_rrset_new(owner, KNOT_RRTYPE_A, KNOT_CLASS_IN, 3600, NULL);
+	knot_rrset_add_rdata(rrs, rdata, 4, NULL);
+	free(owner);
+	return rrs;
+}
+
+static knot_dname_t * tm_owner(const char * prefix, const knot_dname_t *apex)
+{
+	knot_dname_t * ret = malloc(strlen(prefix) + knot_dname_size(apex) + 2);
+	ret[0] = strlen(prefix);
+	strcpy((char *) (ret + 1), prefix);
+	memcpy(ret + ret[0] + 1, apex, knot_dname_size(apex));
+	return ret;
+}
+
+static knot_rrset_t * tm_rrs(const knot_dname_t * apex, int x)
+{
+	static knot_rrset_t * rrsA = NULL;
+	static knot_rrset_t * rrsB = NULL;
+	static knot_rrset_t * rrsC = NULL;
+
+	if (apex == NULL) {
+		knot_rrset_free(rrsA, NULL);
+		knot_rrset_free(rrsB, NULL);
+		knot_rrset_free(rrsC, NULL);
+		rrsA = rrsB = rrsC = NULL;
+		return NULL;
+	}
+
+	if (rrsA == NULL) rrsA = tm_rrset(tm_owner("aaaaaaaaaaaaaaaaa", apex), rdA);
+	if (rrsB == NULL) rrsB = tm_rrset(tm_owner("bbbbbbbbbbbbbbbbb", apex), rdB);
+	if (rrsC == NULL) rrsC = tm_rrset(tm_owner("ccccccccccccccccc", apex), rdC);
+	switch ((x % 3 + 3) % 3) {
+	case 0: return rrsA;
+	case 1: return rrsB;
+	case 2: return rrsC;
+	}
+	assert(0); return NULL;
+}
+
+int tm_rrcnt(const changeset_t * ch, int flg)
+{
+	changeset_iter_t it;
+	int i = 0;
+	if (flg >= 0) changeset_iter_add(&it, ch);
+	else changeset_iter_rem(&it, ch);
+
+	knot_rrset_t rri;
+	while (rri = changeset_iter_next(&it), !knot_rrset_empty(&rri)) i++;
+
+	changeset_iter_clear(&it);
+	return i;
+}
+
+static changeset_t * tm_chs(const knot_dname_t * apex, int x)
+{
+	static changeset_t * chsI = NULL, * chsX = NULL, * chsY = NULL;
+	static uint32_t serial = 0;
+
+	if (apex == NULL) {
+		changeset_free(chsI);
+		changeset_free(chsX);
+		changeset_free(chsY);
+		chsI = chsX = chsY = NULL;
+		return NULL;
+	}
+
+	if (chsI == NULL) {
+		chsI = changeset_new(apex);
+		assert(chsI != NULL);
+		changeset_add_addition(chsI, tm_rrs(apex, 0), 0);
+		changeset_add_addition(chsI, tm_rrs(apex, 1), 0);
+	}
+	if (chsX == NULL) {
+		chsX = changeset_new(apex);
+		assert(chsX != NULL);
+		changeset_add_removal(chsX, tm_rrs(apex, 1), 0);
+		changeset_add_addition(chsX, tm_rrs(apex, 2), 0);
+	}
+	if (chsY == NULL) {
+		chsY = changeset_new(apex);
+		assert(chsY != NULL);
+		changeset_add_removal(chsY, tm_rrs(apex, 2), 0);
+		changeset_add_addition(chsY, tm_rrs(apex, 1), 0);
+	}
+	assert(x >= 0);
+	changeset_t * ret;
+	if (x == 0) ret = chsI;
+	else if (x % 2 == 1) ret = chsX;
+	else ret = chsY;
+
+	changeset_set_soa_serials(ret, serial, serial + 1, apex);
+	serial++;
+
+	return ret;
+}
+
+static int merged_present(void)
+{
+	local_txn_t(txn, j);
+	txn_begin(txn, 0);
+	int res = md_flag(txn, MERGED_SERIAL_VALID);
+	txn_abort(txn);
+	return res;
+}
+
+static void test_merge(void)
+{
+	int i, ret;
+	list_t l;
+
+	// allow merge
+	set_conf(-1, 512 * 1024);
+	ok(journal_merge_allowed(j), "journal: merge allowed");
+
+	ret = journal_drop_changesets(j);
+	is_int(KNOT_EOK, ret, "journal: journal_drop_changesets must be ok");
+
+	// insert stuff and check the merge
+	for (i = 0; !merged_present() && i < 40000; i++) {
+		ret = journal_store_changeset(j, tm_chs(apex, i));
+		is_int(KNOT_EOK, ret, "journal: journal_store_changeset must be ok");
+	}
+	init_list(&l);
+	ret = journal_load_changesets(j, &l, 0);
+	is_int(KNOT_EOK, ret, "journal: journal_load_changesets must be ok");
+	ok(list_size(&l) == 2, "journal: read the merged and one following");
+	changeset_t * mch = (changeset_t *)HEAD(l);
+	ok(list_size(&l) >= 1 && tm_rrcnt(mch, 1) == 2, "journal: merged additions # = 2");
+	ok(list_size(&l) >= 1 && tm_rrcnt(mch, -1) == 1, "journal: merged removals # = 1");
+	changesets_free(&l);
+
+	// insert one more and check the #s of results
+	journal_store_changeset(j, tm_chs(apex, i));
+	init_list(&l);
+	ret = journal_load_changesets(j, &l, 0);
+	is_int(KNOT_EOK, ret, "journal: journal_load_changesets2 must be ok");
+	ok(list_size(&l) == 3, "journal: read merged together with new changeset");
+	changesets_free(&l);
+	init_list(&l);
+	ret = journal_load_changesets(j, &l, (uint32_t) (i - 3));
+	is_int(KNOT_EOK, ret, "journal: journal_load_changesets3 must be ok");
+	ok(list_size(&l) == 4, "journal: read short history of merged/unmerged changesets");
+	changesets_free(&l);
+
+	ret = journal_drop_changesets(j);
+	assert(ret == KNOT_EOK);
+
+	// disallow merge
+	unset_conf();
+	set_conf(1000, 512 * 1024);
+	ok(!journal_merge_allowed(j), "journal: merge disallowed");
+
+	tm_rrs(NULL, 0);
+	tm_chs(NULL, 0);
+	unset_conf();
+}
+
+static void test_stress_base(journal_t *j, size_t update_size, size_t file_size)
+{
+	int ret;
+	uint32_t serial = 0;
+
+	journal_close(j);
+	journal_db_close(&db);
+	db = NULL;
+	ret = journal_db_init(&db, test_dir_name, file_size, JOURNAL_MODE_ASYNC);
+	assert(ret == KNOT_EOK);
+	ret = journal_open_db(&db);
+	assert(ret == KNOT_EOK);
+	ret = journal_open(j, &db, apex);
+	assert(ret == KNOT_EOK);
+
+	set_conf(1000, file_size / 2);
+
+	changeset_t ch;
+	ret = changeset_init(&ch, apex);
+	ok(ret == KNOT_EOK, "journal: changeset init (%d)", ret);
+	init_random_changeset(&ch, serial, serial + 1, update_size, apex, false);
+
+	for (int i = 1; i <= 6; ++i) {
+		serial = 0;
+		while (true) {
+			changeset_set_soa_serials(&ch, serial, serial + 1, apex);
+			ret = journal_store_changeset(j, &ch);
+			if (ret == KNOT_EOK) {
+				serial++;
+			} else {
+				break;
+			}
+		}
+
+		int ret = journal_flush(j);
+		ok(serial > 0 && ret == KNOT_EOK, "journal: pass #%d fillup run (%d inserts)", i, serial);
+	}
+
+	changeset_clear(&ch);
+
+	unset_conf();
+}
+
+/*! \brief Test behavior when writing to jurnal and flushing it. */
+static void test_stress(journal_t *j)
+{
+	diag("stress test: small data");
+	test_stress_base(j, 40, (1024 + 512) * 1024);
+
+	diag("stress test: medium data");
+	test_stress_base(j, 400, 3 * 1024 * 1024);
+
+	diag("stress test: large data");
+	test_stress_base(j, 4000, 10 * 1024 * 1024);
+}
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	test_dir_name = test_mkdtemp();
+
+	test_journal_db();
+
+	test_store_load();
+
+	test_merge();
+
+	test_stress(j);
+
+	journal_close(j);
+	journal_free(&j);
+	journal_db_close(&db);
+
+	test_rm_rf(test_dir_name);
+	free(test_dir_name);
+
+	return 0;
+}
diff --git a/tests/knot/test_kasp_db.c b/tests/knot/test_kasp_db.c
new file mode 100644
index 0000000..d775d0a
--- /dev/null
+++ b/tests/knot/test_kasp_db.c
@@ -0,0 +1,137 @@
+/*  Copyright (C) 2017 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <assert.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <limits.h>
+
+#include <tap/basic.h>
+#include <tap/files.h>
+
+#include "libknot/libknot.h"
+#include "test_conf.h"
+#include "knot/dnssec/kasp/kasp_db.c"
+
+#define CHARS500_1 "kTZgFfrHPP2EOSK24zRjY9GlgCUEkZNBF5UwqsTWisCxGQT4ieinitjXWT1c" \
+                   "pj+OR8UX/httSugee+MFsm5yOU/4/211BpLKwwOIAt4Yf8K7Bc+oXTdk15cH" \
+                   "TRZtshM1AtfjRsX9rsLDsnaFCyMXzty9AQoRxSphjxnUUC6fszfrSsRx7htl" \
+                   "/Xn1PAuwp9Bfn+FxAws98LYVuwiDqUgn4BR5lELdGd16zNOZnN7v023pmPDM" \
+                   "nGyvIATuqTCPbFeXTfw7aIDyx2DF+y95/kSnPtY3c1b0Yf+oCv4t3Hx2jjWT" \
+                   "9zuC6H+d+PL6HWqilJBs7ysn2FVpnE/Yo44VrQ8orw8QFZr1kR6z7AOVAcMk" \
+                   "ac+44swsc8orGCyJx6OlUfN5oU3YahUfLqg9ewl13+P2chmeI6wUyttKsq/4" \
+                   "Ud0YQAozBabiAKr1O/Eg7sZR6bV1YkCydQyYgmR/+VOu9D8Ld6uO4DcvhiE/" \
+                   "2AmTkLsKLxtpMnQqsTnx"
+#define CHARS500_2 "pzqkMLvpxUYYg0KuMCcBsk9aMm4b5Ny+vJ5UnTq8DVC0jHJJyyGcljKqfpi3" \
+                   "MkjfrWY0rbzXFZbZZ6i8bmhhRBcSxE+tK/3AU1LR7ZJsTuITuoJo5LKRH7Uu" \
+                   "MU7RBAzFuk3o+Pcyk+9UdbiRn9p4QqPTvb+2xfYn1pJvGHofJcQsSsPEe9Hw" \
+                   "ycVW+kdImvWiidn0/e1G6B2xibovnPKDUBFmTbdZIBKHb/eUUoUCNA9CWt5N" \
+                   "g8MutK2ixlBJlOvA6CA1V/VW56EJpLqvMxLaoRks5VY5Ls7zWAy97GEFH0Pl" \
+                   "uO/Rba1du5tsC0MAC08hljlmu9uoPhsvHdBYHUnQ7jDuYnu9GN3DN0Z6oVbV" \
+                   "N01JQZYhKQK/Bl61oM5JubLydtAypryDoG3IH75LhoVC8iGxDoDkxt3zoi/Q" \
+                   "PVfPZZsm5j5UOs3wrQL0KWylm2IDK42mrHK8F/XebnOYLNLQaan2a90C+fhH" \
+                   "a6hvu0RorkZzGNAZkq/D"
+
+const knot_dname_t *zone1 = (const knot_dname_t *)"\x05""zonea";
+const knot_dname_t *zone2 = (const knot_dname_t *)"\x05""zoneb";
+
+kasp_db_t *db;
+
+const key_params_t params1 = { .id = "key id 1", .keytag = 1, .timing = { 1, 11, 111, 1111, 11111 },
+                               .public_key = { 520, (uint8_t *)"pk1 plus 500 chars: " CHARS500_1 } };
+const key_params_t params2 = { .id = "key id 2", .keytag = 2, .timing = { 2, 22, 222, 2222, 22222 },
+                               .public_key = { 520, (uint8_t *)"pk2 plus 500 chars: " CHARS500_2 } };
+
+bool params_eq(const key_params_t *a, const key_params_t *b)
+{
+	return ((a->keytag == b->keytag) && (a->public_key.size == b->public_key.size) &&
+	        (a->timing.retire == b->timing.retire) && (strcmp(a->id, b->id) == 0) &&
+	        (memcmp(a->public_key.data, b->public_key.data, b->public_key.size) == 0));
+}
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	char *test_dir_name = test_mkdtemp();
+	bool ignore = false;
+	
+	list_t l;
+	key_params_t *params;
+#define free_params free(params->id); free(params->public_key.data); params->id = NULL; params->public_key.data = NULL;
+
+	int ret = kasp_db_init(&db, test_dir_name, 500*1024*1024);
+	is_int(KNOT_EOK, ret, "kasp_db: init eok");
+	ret = kasp_db_open(db);
+	is_int(KNOT_EOK, ret, "kasp_db: open eok");
+	ok(db->keys_db != NULL, "kasp_db: keys db notnull");
+
+	ret = kasp_db_add_key(db, zone1, &params1);
+	is_int(KNOT_EOK, ret, "kasp_db: add key 1 eok");
+
+	ret = kasp_db_list_keys(db, zone1, &l);
+	is_int(KNOT_EOK, ret, "kasp_db: list keys 1 eok");
+	is_int(1, list_size(&l), "kasp_db: list keys reports one key 1");
+	params = ((ptrnode_t *)HEAD(l))->d;
+	ok(params_eq(params, &params1), "kasp_db: key params equal 1");
+	free_params
+	ptrlist_deep_free(&l, NULL);
+
+	ret = kasp_db_list_keys(db, zone2, &l);
+	is_int(KNOT_ENOENT, ret, "kasp_db: list keys 1 enoent");
+	is_int(0, list_size(&l), "kasp_db: list keys reports no keys 1");
+	ptrlist_deep_free(&l, NULL);
+
+	ret = kasp_db_share_key(db, zone1, zone2, params1.id);
+	is_int(KNOT_EOK, ret, "kasp_db: share key eok");
+
+	ret = kasp_db_list_keys(db, zone2, &l);
+	is_int(KNOT_EOK, ret, "kasp_db: list keys 3 eok");
+	is_int(1, list_size(&l), "kasp_db: list keys reports one key 2");
+	params = ((ptrnode_t *)HEAD(l))->d;
+	free_params
+	ptrlist_deep_free(&l, NULL);
+
+	ret = kasp_db_add_key(db, zone2, &params2);
+	is_int(KNOT_EOK, ret, "kasp_db: add key 2 eok");
+
+	ret = kasp_db_list_keys(db, zone2, &l);
+	is_int(KNOT_EOK, ret, "kasp_db: list keys 4 eok");
+	is_int(2, list_size(&l), "kasp_db: list keys reports two keys 1");
+	params = ((ptrnode_t *)TAIL(l))->d;
+	ok(params_eq(params, &params2), "kasp_db: key params equal 2");
+	free_params
+	params = ((ptrnode_t *)HEAD(l))->d;
+	free_params
+	ptrlist_deep_free(&l, NULL);
+
+	ret = kasp_db_delete_key(db, zone1, params1.id, &ignore);
+	is_int(KNOT_EOK, ret, "kasp_db: delete key 1 eok");
+
+	ret = kasp_db_list_keys(db, zone1, &l);
+	is_int(KNOT_ENOENT, ret, "kasp_db: list keys 2 enoent");
+	is_int(list_size(&l), 0, "kasp_db: list keys reports no keys 2");
+	ptrlist_deep_free(&l, NULL);
+
+	kasp_db_close(&db);
+
+	test_rm_rf(test_dir_name);
+	free(test_dir_name);
+
+	return 0;
+}
+
diff --git a/tests/knot/test_node.c b/tests/knot/test_node.c
new file mode 100644
index 0000000..ef2a01d
--- /dev/null
+++ b/tests/knot/test_node.c
@@ -0,0 +1,154 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <assert.h>
+#include <tap/basic.h>
+
+#include "knot/zone/node.h"
+#include "libknot/libknot.h"
+
+static knot_rrset_t *create_dummy_rrset(const knot_dname_t *owner, uint16_t type)
+{
+	knot_rrset_t *r = knot_rrset_new(owner, type, KNOT_CLASS_IN, 3600, NULL);
+	assert(r);
+	uint8_t wire[16] = { 0 };
+	memcpy(wire, "testtest", strlen("testtest"));
+	int ret = knot_rrset_add_rdata(r, wire, strlen("testtest"), NULL);
+	assert(ret == KNOT_EOK);
+	(void)ret;
+	return r;
+}
+
+static knot_rrset_t *create_dummy_rrsig(const knot_dname_t *owner, uint16_t type)
+{
+	knot_rrset_t *r = knot_rrset_new(owner, KNOT_RRTYPE_RRSIG, KNOT_CLASS_IN,
+	                                 3600, NULL);
+	assert(r);
+	uint8_t wire[sizeof(uint16_t)];
+	knot_wire_write_u16(wire, type);
+	int ret = knot_rrset_add_rdata(r, wire, sizeof(uint16_t), NULL);
+	assert(ret == KNOT_EOK);
+	(void)ret;
+	return r;
+}
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	knot_dname_t *dummy_owner = knot_dname_from_str_alloc("test.");
+	// Test new
+	zone_node_t *node = node_new(dummy_owner, NULL);
+	ok(node != NULL, "Node: new");
+	assert(node);
+	ok(knot_dname_is_equal(node->owner, dummy_owner), "Node: new - set fields");
+
+	// Test parent setting
+	zone_node_t *parent = node_new(dummy_owner, NULL);
+	assert(parent);
+	node_set_parent(node, parent);
+	ok(node->parent == parent && parent->children == 1, "Node: set parent.");
+
+	node_free(parent, NULL);
+
+	// Test RRSet addition
+	knot_rrset_t *dummy_rrset = create_dummy_rrset(dummy_owner, KNOT_RRTYPE_TXT);
+	int ret = node_add_rrset(node, dummy_rrset, NULL);
+	ok(ret == KNOT_EOK && node->rrset_count == 1 &&
+	   knot_rdataset_eq(&dummy_rrset->rrs, &node->rrs[0].rrs), "Node: add RRSet.");
+
+	// Test shallow copy
+	node->flags |= NODE_FLAGS_DELEG;
+	zone_node_t *copy = node_shallow_copy(node, NULL);
+	ok(copy != NULL, "Node: shallow copy.");
+	assert(copy);
+	const bool copy_ok = knot_dname_is_equal(copy->owner, node->owner) &&
+	                     copy->rrset_count == node->rrset_count &&
+	                     memcmp(copy->rrs, node->rrs,
+	                            copy->rrset_count * sizeof(struct rr_data)) == 0 &&
+	                     copy->flags == node->flags;
+	ok(copy_ok, "Node: shallow copy - set fields.");
+
+	node_free(copy, NULL);
+
+	// Test RRSet getters
+	knot_rrset_t *n_rrset = node_create_rrset(node, KNOT_RRTYPE_TXT);
+	ok(n_rrset && knot_rrset_equal(n_rrset, dummy_rrset, KNOT_RRSET_COMPARE_WHOLE),
+	   "Node: create existing RRSet.");
+
+	knot_rrset_free(n_rrset, NULL);
+
+	n_rrset = node_create_rrset(node, KNOT_RRTYPE_SOA);
+	ok(n_rrset == NULL, "Node: create non-existing RRSet.");
+
+	knot_rrset_t stack_rrset = node_rrset(node, KNOT_RRTYPE_TXT);
+	ok(knot_rrset_equal(&stack_rrset, dummy_rrset,
+	                    KNOT_RRSET_COMPARE_WHOLE), "Node: get existing RRSet.");
+	stack_rrset = node_rrset(node, KNOT_RRTYPE_SOA);
+	ok(knot_rrset_empty(&stack_rrset), "Node: get non-existent RRSet.");
+
+	knot_rdataset_t *n_rdataset = node_rdataset(node, KNOT_RRTYPE_TXT);
+	ok(n_rdataset && knot_rdataset_eq(n_rdataset, &dummy_rrset->rrs),
+	   "Node: get existing rdataset.");
+	n_rdataset = node_rdataset(node, KNOT_RRTYPE_SOA);
+	ok(n_rdataset == NULL, "Node: get non-existing rdataset.");
+
+	stack_rrset = node_rrset_at(node, 0);
+	ok(knot_rrset_equal(&stack_rrset, dummy_rrset, KNOT_RRSET_COMPARE_WHOLE),
+	   "Node: get existing position.");
+	stack_rrset = node_rrset_at(node, 1);
+	ok(knot_rrset_empty(&stack_rrset), "Node: get non-existent position.");
+
+	// Test TTL mismatch
+	dummy_rrset->ttl = 1800;
+	ret = node_add_rrset(node, dummy_rrset, NULL);
+	ok(ret == KNOT_ETTL && node->rrset_count == 1,
+	   "Node: add RRSet, TTL mismatch.");
+
+	knot_rrset_free(dummy_rrset, NULL);
+
+	// Test bool functions
+	ok(node_rrtype_exists(node, KNOT_RRTYPE_TXT), "Node: type exists.");
+	ok(!node_rrtype_exists(node, KNOT_RRTYPE_AAAA), "Node: type does not exist.");
+	ok(!node_rrtype_is_signed(node, KNOT_RRTYPE_TXT), "Node: type is not signed.");
+
+	dummy_rrset = create_dummy_rrsig(dummy_owner, KNOT_RRTYPE_TXT);
+	ret = node_add_rrset(node, dummy_rrset, NULL);
+	assert(ret == KNOT_EOK);
+
+	ok(node_rrtype_is_signed(node, KNOT_RRTYPE_TXT), "Node: type is signed.");
+
+	knot_rrset_free(dummy_rrset, NULL);
+
+	// Test remove RRset
+	node_remove_rdataset(node, KNOT_RRTYPE_AAAA);
+	ok(node->rrset_count == 2, "Node: remove non-existent rdataset.");
+	void *to_free = node_rdataset(node, KNOT_RRTYPE_TXT)->rdata;
+	node_remove_rdataset(node, KNOT_RRTYPE_TXT);
+	ok(node->rrset_count == 1, "Node: remove existing rdataset.");
+
+	free(to_free);
+
+	// "Test" freeing
+	node_free_rrsets(node, NULL);
+	ok(node->rrset_count == 0, "Node: free RRSets.");
+
+	node_free(node, NULL);
+
+	knot_dname_free(dummy_owner, NULL);
+
+	return 0;
+}
diff --git a/tests/knot/test_process_query.c b/tests/knot/test_process_query.c
new file mode 100644
index 0000000..aa67877
--- /dev/null
+++ b/tests/knot/test_process_query.c
@@ -0,0 +1,189 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <assert.h>
+#include <tap/basic.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "libknot/descriptor.h"
+#include "libknot/packet/wire.h"
+#include "knot/nameserver/process_query.h"
+#include "test_server.h"
+#include "contrib/sockaddr.h"
+#include "contrib/ucw/mempool.h"
+
+/* Basic response check (4 TAP tests). */
+static void answer_sanity_check(const uint8_t *query,
+                                const uint8_t *answer, uint16_t answer_len,
+                                uint8_t expected_rcode, const char *name)
+{
+	ok(answer_len >= KNOT_WIRE_HEADER_SIZE, "ns: len(%s answer) >= DNS header", name);
+	if (answer_len >= KNOT_WIRE_HEADER_SIZE) {
+		ok(knot_wire_get_qr(answer), "ns: %s answer has QR=1", name);
+		is_int(expected_rcode, knot_wire_get_rcode(answer), "ns: %s answer RCODE=%d", name, expected_rcode);
+		is_int(knot_wire_get_id(query), knot_wire_get_id(answer), "ns: %s MSGID match", name);
+	} else {
+		skip_block(3, "ns: can't check DNS header");
+	}
+}
+
+/* Resolve query and check answer for sanity (2 TAP tests). */
+static void exec_query(knot_layer_t *layer, const char *name,
+                       knot_pkt_t *query,
+                       uint8_t expected_rcode)
+{
+	knot_pkt_t *answer = knot_pkt_new(NULL, KNOT_WIRE_MAX_PKTSIZE, NULL);
+	assert(answer);
+
+	/* Input packet. */
+	knot_pkt_parse(query, 0);
+	knot_layer_consume(layer, query);
+
+	ok(layer->state == KNOT_STATE_PRODUCE ||
+	   layer->state == KNOT_STATE_FAIL, "ns: process %s query", name);
+
+	/* Create answer. */
+	knot_layer_produce(layer, answer);
+	if (layer->state == KNOT_STATE_FAIL) {
+		/* Allow 1 generic error response. */
+		knot_layer_produce(layer, answer);
+	}
+
+	ok(layer->state == KNOT_STATE_DONE, "ns: answer %s query", name);
+
+	/* Check answer. */
+	answer_sanity_check(query->wire, answer->wire, answer->size, expected_rcode, name);
+
+	knot_pkt_free(answer);
+}
+
+/* \internal Helpers */
+#define WIRE_COPY(dst, dst_len, src, src_len) \
+	memcpy(dst, src, src_len); \
+	dst_len = src_len;
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	knot_mm_t mm;
+	mm_ctx_mempool(&mm, MM_DEFAULT_BLKSIZE);
+
+	/* Create processing context. */
+	knot_layer_t proc;
+	memset(&proc, 0, sizeof(knot_layer_t));
+	knot_layer_init(&proc, &mm, process_query_layer());
+
+	/* Create fake server environment. */
+	server_t server;
+	int ret = create_fake_server(&server, proc.mm);
+	is_int(KNOT_EOK, ret, "ns: fake server initialization");
+
+	zone_t *zone = knot_zonedb_find(server.zone_db, ROOT_DNAME);
+
+	/* Prepare. */
+	knot_pkt_t *query = knot_pkt_new(NULL, KNOT_WIRE_MAX_PKTSIZE, proc.mm);
+
+	/* Create query processing parameter. */
+	struct sockaddr_storage ss;
+	memset(&ss, 0, sizeof(struct sockaddr_storage));
+	sockaddr_set(&ss, AF_INET, "127.0.0.1", 53);
+	knotd_qdata_params_t params = {
+		.remote = &ss,
+		.server = &server
+	};
+
+	/* Query processor (CH zone) */
+	knot_layer_begin(&proc, &params);
+	knot_pkt_clear(query);
+	knot_pkt_put_question(query, IDSERVER_DNAME, KNOT_CLASS_CH, KNOT_RRTYPE_TXT);
+	exec_query(&proc, "CH TXT", query, KNOT_RCODE_NOERROR);
+
+	/* Query processor (valid input). */
+	knot_layer_reset(&proc);
+	knot_pkt_clear(query);
+	knot_pkt_put_question(query, ROOT_DNAME, KNOT_CLASS_IN, KNOT_RRTYPE_SOA);
+	exec_query(&proc, "IN/root", query, KNOT_RCODE_NOERROR);
+
+	/* Query processor (-1 bytes, not enough data). */
+	knot_layer_reset(&proc);
+	query->size -= 1;
+	exec_query(&proc, "IN/few-data", query, KNOT_RCODE_FORMERR);
+	query->size += 1;
+
+	/* Query processor (+1 bytes trailing). */
+	knot_layer_reset(&proc);
+	query->wire[query->size] = '\1'; /* Initialize the "garbage" value. */
+	query->size += 1;
+	exec_query(&proc, "IN/trail-garbage", query, KNOT_RCODE_FORMERR);
+	query->size -= 1;
+
+	/* Forge NOTIFY query from SOA query. */
+	knot_layer_reset(&proc);
+	knot_wire_set_opcode(query->wire, KNOT_OPCODE_NOTIFY);
+	exec_query(&proc, "IN/notify", query, KNOT_RCODE_NOTAUTH);
+
+	/* Forge AXFR query. */
+	knot_layer_reset(&proc);
+	knot_pkt_clear(query);
+	knot_pkt_put_question(query, ROOT_DNAME, KNOT_CLASS_IN, KNOT_RRTYPE_AXFR);
+	exec_query(&proc, "IN/axfr", query, KNOT_RCODE_NOTAUTH);
+
+	/* Forge IXFR query (well formed). */
+	knot_layer_reset(&proc);
+	knot_pkt_clear(query);
+	knot_pkt_put_question(query, ROOT_DNAME, KNOT_CLASS_IN, KNOT_RRTYPE_IXFR);
+	/* Append SOA RR. */
+	knot_rrset_t soa_rr = node_rrset(zone->contents->apex, KNOT_RRTYPE_SOA);
+	knot_pkt_begin(query, KNOT_AUTHORITY);
+	knot_pkt_put(query, KNOT_COMPR_HINT_NONE, &soa_rr, 0);
+	exec_query(&proc, "IN/ixfr", query, KNOT_RCODE_NOTAUTH);
+
+	/* \note Tests below are not possible without proper zone and zone data. */
+	/* #189 Process UPDATE query. */
+	/* #189 Process AXFR client. */
+	/* #189 Process IXFR client. */
+
+	/* Query processor (smaller than DNS header, ignore). */
+	knot_layer_reset(&proc);
+	knot_pkt_clear(query);
+	knot_pkt_put_question(query, ROOT_DNAME, KNOT_CLASS_IN, KNOT_RRTYPE_SOA);
+	size_t orig_query_size = query->size;
+	query->size = KNOT_WIRE_HEADER_SIZE - 1;
+	knot_layer_consume(&proc, query);
+	ok(proc.state == KNOT_STATE_NOOP, "ns: IN/less-than-header query ignored");
+	query->size = orig_query_size;
+
+	/* Query processor (response, ignore). */
+	knot_layer_reset(&proc);
+	knot_wire_set_qr(query->wire);
+	knot_layer_consume(&proc, query);
+	ok(proc.state == KNOT_STATE_NOOP, "ns: IN/less-than-header query ignored");
+
+	/* Finish. */
+	knot_layer_finish(&proc);
+	ok(proc.state == KNOT_STATE_NOOP, "ns: processing end" );
+
+	/* Cleanup. */
+	mp_delete((struct mempool *)mm.ctx);
+	server_deinit(&server);
+	conf_free(conf());
+
+	return 0;
+}
+
+#undef WIRE_COPY
diff --git a/tests/knot/test_query_module.c b/tests/knot/test_query_module.c
new file mode 100644
index 0000000..cb4a606
--- /dev/null
+++ b/tests/knot/test_query_module.c
@@ -0,0 +1,83 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <tap/basic.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "libknot/libknot.h"
+#include "knot/nameserver/query_module.h"
+#include "libknot/packet/pkt.h"
+
+/* Universal processing stage. */
+unsigned state_visit(unsigned state, knot_pkt_t *pkt, knotd_qdata_t *qdata,
+                     knotd_mod_t *mod)
+{
+	/* Visit current state */
+	bool *state_map = (bool *)mod;
+	state_map[state] = true;
+
+	return state + 1;
+}
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	/* Create a map of expected steps. */
+	bool state_map[KNOTD_STAGES] = { false };
+
+	/* Prepare query plan. */
+	struct query_plan *plan = query_plan_create();
+	ok(plan != NULL, "query_plan: create");
+
+	/* Register all stage visits. */
+	int ret = KNOT_EOK;
+	for (unsigned stage = KNOTD_STAGE_BEGIN; stage < KNOTD_STAGES; ++stage) {
+		ret = query_plan_step(plan, stage, state_visit, state_map);
+		if (ret != KNOT_EOK) {
+			break;
+		}
+	}
+	is_int(KNOT_EOK, ret, "query_plan: planned all steps");
+
+	/* Execute the plan. */
+	int state = 0, next_state = 0;
+	for (unsigned stage = KNOTD_STAGE_BEGIN; stage < KNOTD_STAGES; ++stage) {
+		struct query_step *step = NULL;
+		WALK_LIST(step, plan->stage[stage]) {
+			next_state = step->process(state, NULL, NULL, step->ctx);
+			if (next_state != state + 1) {
+				break;
+			}
+			state = next_state;
+		}
+	}
+	ok(state == KNOTD_STAGES, "query_plan: executed all steps");
+
+	/* Verify if all steps executed their callback. */
+	for (state = 0; state < KNOTD_STAGES; ++state) {
+		if (state_map[state] == false) {
+			break;
+		}
+	}
+	ok(state == KNOTD_STAGES, "query_plan: executed all callbacks");
+
+	/* Free the query plan. */
+	query_plan_free(plan);
+
+	return 0;
+}
diff --git a/tests/knot/test_requestor.c b/tests/knot/test_requestor.c
new file mode 100644
index 0000000..ea87fb7
--- /dev/null
+++ b/tests/knot/test_requestor.c
@@ -0,0 +1,164 @@
+/*  Copyright (C) 2013 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <assert.h>
+#include <tap/basic.h>
+#include <pthread.h>
+#include <stdlib.h>
+#include <string.h>
+#include <fcntl.h>
+
+#include "libknot/descriptor.h"
+#include "libknot/errcode.h"
+#include "knot/query/layer.h"
+#include "knot/query/requestor.h"
+#include "contrib/mempattern.h"
+#include "contrib/net.h"
+#include "contrib/sockaddr.h"
+#include "contrib/ucw/mempool.h"
+
+/* @note Purpose of this test is not to verify process_answer functionality,
+ *       but simply if the requesting/receiving works, so mirror is okay. */
+static int reset(knot_layer_t *ctx) { return KNOT_STATE_PRODUCE; }
+static int begin(knot_layer_t *ctx, void *module_param) { return reset(ctx); }
+static int finish(knot_layer_t *ctx) { return reset(ctx); }
+static int in(knot_layer_t *ctx, knot_pkt_t *pkt) { return KNOT_STATE_DONE; }
+static int out(knot_layer_t *ctx, knot_pkt_t *pkt) { return KNOT_STATE_CONSUME; }
+
+static const int TIMEOUT = 2000;
+
+/*! \brief Dummy answer processing module. */
+const knot_layer_api_t dummy_module = {
+        &begin, &reset, &finish, &in, &out
+};
+
+static void set_blocking_mode(int sock)
+{
+	int flags = fcntl(sock, F_GETFL);
+	flags &= ~O_NONBLOCK;
+	fcntl(sock, F_SETFL, flags);
+}
+
+static void *responder_thread(void *arg)
+{
+	int fd = *(int *)arg;
+
+	set_blocking_mode(fd);
+	uint8_t buf[KNOT_WIRE_MAX_PKTSIZE] = { 0 };
+	while (true) {
+		int client = accept(fd, NULL, NULL);
+		if (client < 0) {
+			break;
+		}
+		int len = net_dns_tcp_recv(client, buf, sizeof(buf), -1);
+		if (len < KNOT_WIRE_HEADER_SIZE) {
+			close(client);
+			break;
+		}
+		knot_wire_set_qr(buf);
+		net_dns_tcp_send(client, buf, len, -1);
+		close(client);
+	}
+
+	return NULL;
+}
+
+/* Test implementations. */
+
+static struct knot_request *make_query(struct knot_requestor *requestor,
+                                       const struct sockaddr_storage *dst,
+                                       const struct sockaddr_storage *src)
+{
+	knot_pkt_t *pkt = knot_pkt_new(NULL, KNOT_WIRE_MAX_PKTSIZE, requestor->mm);
+	assert(pkt);
+	static const knot_dname_t *root = (uint8_t *)"";
+	knot_pkt_put_question(pkt, root, KNOT_CLASS_IN, KNOT_RRTYPE_SOA);
+
+	return knot_request_make(requestor->mm, (struct sockaddr *)dst,
+	                         (struct sockaddr *)src, pkt, NULL, 0);
+}
+
+static void test_disconnected(struct knot_requestor *requestor,
+                              const struct sockaddr_storage *dst,
+                              const struct sockaddr_storage *src)
+{
+	struct knot_request *req = make_query(requestor, dst, src);
+	int ret = knot_requestor_exec(requestor, req, TIMEOUT);
+	is_int(KNOT_ECONN, ret, "requestor: disconnected/exec");
+	knot_request_free(req, requestor->mm);
+
+}
+
+static void test_connected(struct knot_requestor *requestor,
+                           const struct sockaddr_storage *dst,
+                           const struct sockaddr_storage *src)
+{
+	/* Enqueue packet. */
+	struct knot_request *req = make_query(requestor, dst, src);
+	int ret = knot_requestor_exec(requestor, req, TIMEOUT);
+	is_int(KNOT_EOK, ret, "requestor: connected/exec");
+	knot_request_free(req, requestor->mm);
+}
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	knot_mm_t mm;
+	mm_ctx_mempool(&mm, MM_DEFAULT_BLKSIZE);
+
+	/* Initialize requestor. */
+	struct knot_requestor requestor;
+	knot_requestor_init(&requestor, &dummy_module, NULL, &mm);
+
+	/* Define endpoints. */
+	struct sockaddr_storage client = { 0 };
+	sockaddr_set(&client, AF_INET, "127.0.0.1", 0);
+	struct sockaddr_storage server = { 0 };
+	sockaddr_set(&server, AF_INET, "127.0.0.1", 0);
+
+	/* Bind to random port. */
+	int responder_fd = net_bound_socket(SOCK_STREAM, (struct sockaddr *)&server, 0);
+	assert(responder_fd >= 0);
+	socklen_t addr_len = sockaddr_len((struct sockaddr *)&server);
+	getsockname(responder_fd, (struct sockaddr *)&server, &addr_len);
+
+	/* Test requestor in disconnected environment. */
+	test_disconnected(&requestor, &server, &client);
+
+	/* Start responder. */
+	int ret = listen(responder_fd, 10);
+	(void)ret;
+	assert(ret == 0);
+	pthread_t thread;
+	pthread_create(&thread, 0, responder_thread, &responder_fd);
+
+	/* Test requestor in connected environment. */
+	test_connected(&requestor, &server, &client);
+
+	/* Terminate responder. */
+	int conn = net_connected_socket(SOCK_STREAM, (struct sockaddr *)&server, NULL);
+	assert(conn > 0);
+	conn = net_dns_tcp_send(conn, (uint8_t *)"", 1, TIMEOUT);
+	assert(conn > 0);
+	pthread_join(thread, NULL);
+	close(responder_fd);
+
+	/* Cleanup. */
+	mp_delete((struct mempool *)mm.ctx);
+
+	return 0;
+}
diff --git a/tests/knot/test_semantic_check.in b/tests/knot/test_semantic_check.in
new file mode 100644
index 0000000..ad65f78
--- /dev/null
+++ b/tests/knot/test_semantic_check.in
@@ -0,0 +1,129 @@
+#!/bin/sh
+
+KZONECHECK="@top_builddir@/src/kzonecheck"
+DATA="@top_srcdir@/tests/knot/semantic_check_data"
+
+. "@top_srcdir@/tests/tap/libtap.sh"
+
+TMPDIR=$(test_tmpdir)
+LOG="$TMPDIR/log"
+
+# Params: zonefile fatal_error expected_erros_count semcheck_err_msg
+expect_error()
+{
+	if [ ! -r "$DATA/$1" ]; then
+		skip_block 4 "missing zone file for test"
+		return
+	fi
+
+	"$KZONECHECK" -o example.com "$DATA/$1" > "$LOG"
+	ok "$1 - check program return" test $? -eq 1
+
+	fatal=$(grep -E "^Serious semantic error detected" $LOG | wc -l)
+	ok "$1 - check fatal" test $fatal -eq $2
+
+	errors=$(grep -E "^\[.+\] $4" $LOG | wc -l)
+	ok "$1 - check errors" test $errors -eq $3
+	if [ $errors != $3 ]; then
+		diag "expected errors $3 but found $errors"
+	fi
+}
+
+#param zonefile
+test_correct()
+{
+	$KZONECHECK -o example.com "$DATA/$1" > /dev/null
+	ok "$1 - correct zone, without error" test $? -eq 0
+}
+
+if [ ! -x $KZONECHECK ]; then
+	skip_all "kzonecheck is missing or is not executable"
+fi
+
+# error messages exported from knot/src/zone/semantic-check.c
+CDNSKEY_MULTIPLE="multiple CDNSKEY records"
+CDNSKEY_NONE="missing CDNSKEY"
+CDS_MULTIPLE="multiple CDS records"
+CDS_NONE="missing CDS"
+CDS_NOT_MATCH="CDS not match CDNSKEY"
+CNAME_EXTRA_RECORDS="more records exist at CNAME"
+CNAME_MULTIPLE="multiple CNAME records"
+DNAME_CHILDREN="child record exists under DNAME"
+DNSKEY_PROTO="invalid protocol in DNSKEY"
+DS_ALG="invalid algorithm in DS"
+NSEC3PARAM_FLAGS="invalid flags in NSEC3PARAM"
+NSEC3_ALG="incorrect algorithm in NSEC3"
+NSEC3_INSECURE_DELEGATION_OPT="insecure delegation outside NSEC3 opt-out"
+NSEC3_ITERS="incorrect number of iterations in NSEC3"
+NSEC3_NONE="missing NSEC3"
+NSEC3_RDATA_BITMAP="incorrect type bitmap in NSEC3"
+NSEC3_RDATA_CHAIN="incoherent NSEC3 chain"
+NSEC_NONE="missing NSEC"
+NSEC_RDATA_BITMAP="incorrect type bitmap in NSEC"
+NSEC_RDATA_CHAIN="incoherent NSEC chain"
+NSEC_RDATA_MULTIPLE="multiple NSEC records"
+NS_APEX="missing NS at the zone apex"
+NS_GLUE="missing glue record"
+RRSIG_EXPIRED="expired RRSIG"
+RRSIG_NO_RRSIG="missing RRSIG"
+RRSIG_RDATA_DNSKEY_OWNER="wrong signer's name in RRSIG"
+RRSIG_RDATA_TTL="wrong original TTL in RRSIG"
+RRSIG_SIGNED="signed RRSIG"
+RRSIG_UNVERIFIABLE="unverifiable signature"
+
+plan_lazy
+
+expect_error "cname_extra_01.zone"   1 1 "$CNAME_EXTRA_RECORDS"
+expect_error "cname_extra_02.signed" 1 1 "$CNAME_EXTRA_RECORDS"
+expect_error "cname_multiple.zone"   1 1 "$CNAME_MULTIPLE"
+expect_error "dname_children.zone"   1 1 "$DNAME_CHILDREN"
+
+expect_error "missing_ns.zone" 0 1 "$NS_APEX"
+expect_error "missing_glue_01.zone" 0 2 "$NS_GLUE"
+expect_error "missing_glue_02.zone" 0 1 "$NS_GLUE"
+expect_error "missing_glue_03.zone" 0 1 "$NS_GLUE"
+expect_error "different_signer_name.signed" 0 1 "$RRSIG_RDATA_DNSKEY_OWNER \(record type NSEC\)"
+expect_error "different_signer_name.signed" 0 1 "$RRSIG_UNVERIFIABLE \(record type NSEC\)"
+expect_error "no_rrsig.signed" 0 1 "$RRSIG_NO_RRSIG \(record type A\)"
+expect_error "no_rrsig.signed" 0 1 "$RRSIG_NO_RRSIG \(record type NSEC\)"
+expect_error "no_rrsig_with_delegation.signed" 0 1 "$RRSIG_NO_RRSIG \(record type NSEC\)"
+expect_error "nsec_broken_chain_01.signed" 0 1 "$NSEC_RDATA_CHAIN"
+expect_error "nsec_broken_chain_02.signed" 0 1 "$NSEC_RDATA_CHAIN"
+expect_error "nsec_missing.signed" 0 1 "$NSEC_NONE"
+expect_error "nsec_multiple.signed" 0 1 "$NSEC_RDATA_MULTIPLE"
+expect_error "nsec_wrong_bitmap_01.signed" 0 1 "$NSEC_RDATA_BITMAP"
+expect_error "nsec_wrong_bitmap_02.signed" 0 1 "$NSEC_RDATA_BITMAP"
+expect_error "nsec3_missing.signed" 0 1 "$NSEC3_NONE"
+expect_error "nsec3_wrong_bitmap_01.signed" 0 1 "$NSEC3_RDATA_BITMAP"
+expect_error "nsec3_wrong_bitmap_02.signed" 0 1 "$NSEC3_RDATA_BITMAP"
+expect_error "nsec3_ds.signed" 0 1 "$NSEC3_NONE"
+expect_error "nsec3_optout.signed" 0 1 "$NSEC3_INSECURE_DELEGATION_OPT"
+expect_error "nsec3_chain_01.signed" 0 1 "$NSEC3_RDATA_CHAIN"
+expect_error "nsec3_chain_02.signed" 0 2 "$NSEC3_RDATA_CHAIN"
+expect_error "nsec3_chain_03.signed" 0 2 "$NSEC3_RDATA_CHAIN"
+expect_error "nsec3_param_invalid.signed" 0 1 "$NSEC3_ALG"
+expect_error "nsec3_param_invalid.signed" 0 1 "$NSEC3_ITERS"
+expect_error "nsec3_param_invalid.signed" 0 1 "$NSEC3PARAM_FLAGS"
+expect_error "rrsig_signed.signed" 0 1 "$RRSIG_SIGNED"
+expect_error "rrsig_rdata_ttl.signed" 0 1 "$RRSIG_RDATA_TTL \(record type A\)"
+expect_error "duplicate.signature" 0 7 "$RRSIG_EXPIRED"
+expect_error "missing.signed" 0 1 "$NSEC_NONE"
+expect_error "dnskey_param_error.signed" 0 1 "$DNSKEY_PROTO"
+expect_error "invalid_ds.signed" 0 2 "$DS_ALG \(keytag 60485\)"
+expect_error "cdnskey.invalid" 0 1 "$CDS_NOT_MATCH"
+expect_error "cdnskey.invalid.param" 0 1 "$CDS_NOT_MATCH"
+expect_error "cdnskey.nocds" 0 1 "$CDS_NONE"
+expect_error "cdnskey.nocdnskey" 0 1 "$CDNSKEY_NONE"
+expect_error "cdnskey.nodnskey" 0 1 "$CDNSKEY_NOT_MATCH"
+expect_error "cdnskey.two" 0 1 "$CDS_MULTIPLE"
+expect_error "cdnskey.two" 0 1 "$CDNSKEY_MULTIPLE"
+
+test_correct "rrsig_ttl.signed"
+test_correct "no_error_delegaton_bitmap.signed"
+test_correct "no_error_nsec3_delegation.signed"
+test_correct "no_error_nsec3_optout.signed"
+test_correct "no_error_wildcard_glue.zone"
+test_correct "cdnskey.cds"
+test_correct "dname_apex_nsec3.signed"
+
+rm $LOG
diff --git a/tests/knot/test_server.c b/tests/knot/test_server.c
new file mode 100644
index 0000000..c1cc2ad
--- /dev/null
+++ b/tests/knot/test_server.c
@@ -0,0 +1,68 @@
+/*  Copyright (C) 2017 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <tap/basic.h>
+#include "knot/server/server.h"
+#include "test_conf.h"
+
+// Signal handler
+static void interrupt_handle(int s)
+{
+}
+
+/*! API: run tests. */
+int main(int argc, char *argv[])
+{
+	plan(2);
+
+	server_t server;
+	int ret = 0;
+
+	/* Some random configuration just to apply the default conf schema */
+	ret = test_conf("", NULL);
+	assert(ret == KNOT_EOK);
+
+	/* Register service and signal handler */
+	struct sigaction sa;
+	sa.sa_handler = interrupt_handle;
+	sigemptyset(&sa.sa_mask);
+	sa.sa_flags = 0;
+	sigaction(SIGALRM, &sa, NULL); // Interrupt
+
+	/* Test server for correct initialization */
+	ret = server_init(&server, 1);
+	is_int(KNOT_EOK, ret, "server: initialized");
+	if (ret != KNOT_EOK) {
+		return 1;
+	}
+
+	/* Test server startup */
+	ret = server_start(&server, false);
+	is_int(KNOT_EOK, ret, "server: started ok");
+	if (ret != KNOT_EOK) {
+	        return 1;
+	}
+
+	server_stop(&server);
+
+	/* Wait for server to finish. */
+	server_wait(&server);
+
+	/* Wait for server to finish. */
+	server_deinit(&server);
+
+	return 0;
+}
diff --git a/tests/knot/test_server.h b/tests/knot/test_server.h
new file mode 100644
index 0000000..4a6e427
--- /dev/null
+++ b/tests/knot/test_server.h
@@ -0,0 +1,86 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include "test_conf.h"
+#include "knot/server/server.h"
+#include "contrib/mempattern.h"
+
+/* Some domain names. */
+#define ROOT_DNAME ((const uint8_t *)"")
+#define EXAMPLE_DNAME ((const uint8_t *)"\x7""example")
+#define IDSERVER_DNAME ((const uint8_t *)"\2""id""\6""server")
+
+/* Create fake root zone. */
+static inline void create_root_zone(server_t *server, knot_mm_t *mm)
+{
+	/* SOA RDATA. */
+	#define SOA_RDLEN 30
+	static const uint8_t SOA_RDATA[SOA_RDLEN] = {
+	        0x02, 'n', 's', 0x00,          /* ns. */
+	        0x04, 'm', 'a', 'i', 'l', 0x00,/* mail. */
+	        0x77, 0xdf, 0x1e, 0x63,        /* serial */
+	        0x00, 0x01, 0x51, 0x80,        /* refresh */
+	        0x00, 0x00, 0x1c, 0x20,        /* retry */
+	        0x00, 0x0a, 0x8c, 0x00,        /* expire */
+	        0x00, 0x00, 0x0e, 0x10         /* min ttl */
+	};
+
+	/* Insert root zone. */
+	zone_t *root = zone_new(ROOT_DNAME);
+	root->journal_db = &server->journal_db;
+	root->contents = zone_contents_new(root->name);
+
+	knot_rrset_t *soa = knot_rrset_new(root->name, KNOT_RRTYPE_SOA, KNOT_CLASS_IN,
+	                                   7200, mm);
+	knot_rrset_add_rdata(soa, SOA_RDATA, SOA_RDLEN, mm);
+	node_add_rrset(root->contents->apex, soa, NULL);
+	knot_rrset_free(soa, mm);
+
+	/* Bake the zone. */
+	zone_contents_adjust_full(root->contents);
+
+	/* Switch zone db. */
+	knot_zonedb_free(&server->zone_db);
+	server->zone_db = knot_zonedb_new();
+	knot_zonedb_insert(server->zone_db, root);
+}
+
+/* Create fake server. */
+static inline int create_fake_server(server_t *server, knot_mm_t *mm)
+{
+	int ret;
+
+	/* Load test configuration. */
+	const char *conf_str = "server:\n identity: bogus.ns\n version: 0.11\n nsid: ""\n"
+	                       "zone:\n - domain: .\n   zonefile-sync: -1\n";
+	ret = test_conf(conf_str, NULL);
+	if (ret != KNOT_EOK) {
+		return ret;
+	}
+
+	/* Create name server. */
+	ret = server_init(server, 1);
+	if (ret != KNOT_EOK) {
+		return ret;
+	}
+
+	/* Insert root zone. */
+	create_root_zone(server, mm);
+
+	return KNOT_EOK;
+}
diff --git a/tests/knot/test_worker_pool.c b/tests/knot/test_worker_pool.c
new file mode 100644
index 0000000..e644aa6
--- /dev/null
+++ b/tests/knot/test_worker_pool.c
@@ -0,0 +1,152 @@
+/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <tap/basic.h>
+
+#include <errno.h>
+#include <pthread.h>
+#include <sched.h>
+#include <signal.h>
+#include <time.h>
+
+#include "knot/worker/pool.h"
+#include "knot/worker/queue.h"
+
+#define THREADS 4
+#define TASKS_BATCH 40
+
+/*!
+ * Task execution log.
+ */
+typedef struct task_log {
+	pthread_mutex_t mx;
+	unsigned executed;
+} task_log_t;
+
+/*!
+ * Get number of executed tasks and clear.
+ */
+static unsigned executed_reset(task_log_t *log)
+{
+	pthread_mutex_lock(&log->mx);
+	unsigned result = log->executed;
+	log->executed = 0;
+	pthread_mutex_unlock(&log->mx);
+
+	return result;
+}
+
+/*!
+ * Simple task, just increases the counter in the log.
+ */
+static void task_counting(task_t *task)
+{
+	task_log_t *log = task->ctx;
+
+	pthread_mutex_lock(&log->mx);
+	log->executed += 1;
+	pthread_mutex_unlock(&log->mx);
+}
+
+static void interrupt_handle(int s)
+{
+}
+
+int main(void)
+{
+	plan_lazy();
+
+	struct sigaction sa;
+	sa.sa_handler = interrupt_handle;
+	sigemptyset(&sa.sa_mask);
+	sa.sa_flags = 0;
+	sigaction(SIGALRM, &sa, NULL); // Interrupt
+
+	// create pool
+
+	worker_pool_t *pool = worker_pool_create(THREADS);
+	ok(pool != NULL, "create worker pool");
+	if (!pool) {
+		return 1;
+	}
+
+	task_log_t log = {
+		.mx = PTHREAD_MUTEX_INITIALIZER,
+	};
+
+	// schedule jobs while pool is stopped
+
+	task_t task = { .run = task_counting, .ctx = &log };
+	for (int i = 0; i < TASKS_BATCH; i++) {
+		worker_pool_assign(pool, &task);
+	}
+
+	sched_yield();
+	ok(executed_reset(&log) == 0, "executed count before start");
+
+	// start and wait for finish
+
+	worker_pool_start(pool);
+	worker_pool_wait(pool);
+	ok(executed_reset(&log) == TASKS_BATCH, "executed count after start");
+
+	// add additional jobs while pool is running
+
+	for (int i = 0; i < TASKS_BATCH; i++) {
+		worker_pool_assign(pool, &task);
+	}
+
+	worker_pool_wait(pool);
+	ok(executed_reset(&log) == TASKS_BATCH, "executed count after add");
+
+	// temporary suspension
+
+	worker_pool_suspend(pool);
+
+	for (int i = 0; i < TASKS_BATCH; i++) {
+		worker_pool_assign(pool, &task);
+	}
+
+	sched_yield();
+	ok(executed_reset(&log) == 0, "executed count after suspend");
+
+	worker_pool_resume(pool);
+	worker_pool_wait(pool);
+	ok(executed_reset(&log) == TASKS_BATCH, "executed count after resume");
+
+	// try clean
+
+	pthread_mutex_lock(&log.mx);
+	for (int i = 0; i < THREADS + TASKS_BATCH; i++) {
+		worker_pool_assign(pool, &task);
+	}
+	sched_yield();
+	worker_pool_clear(pool);
+	pthread_mutex_unlock(&log.mx);
+
+	worker_pool_wait(pool);
+	ok(executed_reset(&log) <= THREADS, "executed count after clear");
+
+	// cleanup
+
+	worker_pool_stop(pool);
+	worker_pool_join(pool);
+	worker_pool_destroy(pool);
+
+	pthread_mutex_destroy(&log.mx);
+
+	return 0;
+}
diff --git a/tests/knot/test_worker_queue.c b/tests/knot/test_worker_queue.c
new file mode 100644
index 0000000..d35f0aa
--- /dev/null
+++ b/tests/knot/test_worker_queue.c
@@ -0,0 +1,57 @@
+/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <tap/basic.h>
+
+#include "knot/worker/queue.h"
+
+int main(void)
+{
+	plan_lazy();
+
+	task_t task_one = { 0 };
+	task_t task_two = { 0 };
+	task_t task_three = { 0 };
+
+	// init
+
+	worker_queue_t queue;
+	worker_queue_init(&queue);
+	ok(1, "queue init");
+
+	// enqueue
+
+	worker_queue_enqueue(&queue, &task_one);
+	ok(1, "enqueue first");
+	worker_queue_enqueue(&queue, &task_two);
+	ok(1, "enqueue second");
+
+	// dequeue
+
+	ok(worker_queue_dequeue(&queue) == &task_one, "dequeue first");
+	ok(worker_queue_dequeue(&queue) == &task_two, "dequeue second");
+	ok(worker_queue_dequeue(&queue) == NULL, "dequeue from empty");
+
+	// deinit
+
+	worker_queue_enqueue(&queue, &task_three);
+	ok(1, "enqueue third");
+
+	worker_queue_deinit(&queue);
+	ok(1, "queue deinit");
+
+	return 0;
+}
diff --git a/tests/knot/test_zone-tree.c b/tests/knot/test_zone-tree.c
new file mode 100644
index 0000000..a1fab68
--- /dev/null
+++ b/tests/knot/test_zone-tree.c
@@ -0,0 +1,118 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <stdlib.h>
+#include <tap/basic.h>
+
+#include "libknot/errcode.h"
+#include "knot/zone/zone-tree.h"
+
+#define NCOUNT 4
+static knot_dname_t* NAME[NCOUNT];
+static zone_node_t NODE[NCOUNT];
+static knot_dname_t* ORDER[NCOUNT];
+static void ztree_init_data(void)
+{
+	NAME[0] = knot_dname_from_str_alloc(".");
+	NAME[1] = knot_dname_from_str_alloc("master.ac.");
+	NAME[2] = knot_dname_from_str_alloc("ac.");
+	NAME[3] = knot_dname_from_str_alloc("ns.");
+
+	knot_dname_t *order[NCOUNT] = {
+	        NAME[0], NAME[2], NAME[1], NAME[3]
+	};
+	memcpy(ORDER, order, NCOUNT * sizeof(knot_dname_t*));
+
+	for (unsigned i = 0; i < NCOUNT; ++i) {
+		memset(NODE + i, 0, sizeof(zone_node_t));
+		NODE[i].owner = NAME[i];
+		NODE[i].prev = NODE + ((NCOUNT + i - 1) % NCOUNT);
+		NODE[i].rrset_count = 1; /* required for ordered search */
+	}
+}
+
+static void ztree_free_data(void)
+{
+	for (unsigned i = 0; i < NCOUNT; ++i) {
+		knot_dname_free(NAME[i], NULL);
+	}
+}
+
+static int ztree_iter_data(zone_node_t **node, void *data)
+{
+	unsigned *i = (unsigned *)data;
+	knot_dname_t *owner = (*node)->owner;
+	int result = KNOT_EOK;
+	if (owner != ORDER[*i]) {
+		result = KNOT_ERROR;
+		char *exp_s = knot_dname_to_str_alloc(ORDER[*i]);
+		char *owner_s = knot_dname_to_str_alloc(owner);
+		diag("ztree: at index: %u expected '%s' got '%s'\n", *i, exp_s, owner_s);
+		free(exp_s);
+		free(owner_s);
+	}
+	++(*i);
+	return result;
+}
+
+int main(int argc, char *argv[])
+{
+	plan(5);
+
+	ztree_init_data();
+
+	/* 1. create test */
+	zone_tree_t* t = zone_tree_create();
+	ok(t != NULL, "ztree: created");
+
+	/* 2. insert test */
+	unsigned passed = 1;
+	for (unsigned i = 0; i < NCOUNT; ++i) {
+		if (zone_tree_insert(t, NODE + i) != KNOT_EOK) {
+			passed = 0;
+			break;
+		}
+	}
+	ok(passed, "ztree: insertion");
+
+	/* 3. check data test */
+	passed = 1;
+	for (unsigned i = 0; i < NCOUNT; ++i) {
+		zone_node_t *node = zone_tree_get(t, NAME[i]);
+		if (node == NULL || node != NODE + i) {
+			passed = 0;
+			break;
+		}
+	}
+	ok(passed, "ztree: lookup");
+
+	/* 4. ordered lookup */
+	zone_node_t *node = NULL;
+	zone_node_t *prev = NULL;
+	knot_dname_t *tmp_dn = knot_dname_from_str_alloc("z.ac.");
+	zone_tree_get_less_or_equal(t, tmp_dn, &node, &prev);
+	knot_dname_free(tmp_dn, NULL);
+	ok(prev == NODE + 1, "ztree: ordered lookup");
+
+	/* 5. ordered traversal */
+	unsigned i = 0;
+	int ret = zone_tree_apply(t, ztree_iter_data, &i);
+	ok (ret == KNOT_EOK, "ztree: ordered traversal");
+
+	zone_tree_free(&t);
+	ztree_free_data();
+	return 0;
+}
diff --git a/tests/knot/test_zone-update.c b/tests/knot/test_zone-update.c
new file mode 100644
index 0000000..5e528dd
--- /dev/null
+++ b/tests/knot/test_zone-update.c
@@ -0,0 +1,336 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <assert.h>
+#include <tap/basic.h>
+#include <tap/files.h>
+
+#include "test_conf.h"
+#include "contrib/macros.h"
+#include "contrib/getline.h"
+#include "knot/updates/zone-update.h"
+#include "knot/zone/node.h"
+#include "libzscanner/scanner.h"
+#include "knot/server/server.h"
+
+static const char *zone_str1 = "test. 600 IN SOA ns.test. m.test. 1 900 300 4800 900 \n";
+static const char *zone_str2 = "test. IN TXT \"test\"\n";
+static const char *add_str   = "test. IN TXT \"test2\"\n";
+static const char *del_str   = "test. IN TXT \"test\"\n";
+static const char *node_str1 = "node.test. IN TXT \"abc\"\n";
+static const char *node_str2 = "node.test. IN TXT \"def\"\n";
+
+knot_rrset_t rrset;
+
+/*!< \brief Returns true if node contains given RR in its RRSets. */
+static bool node_contains_rr(const zone_node_t *node,
+                             const knot_rrset_t *rrset)
+{
+	const knot_rdataset_t *zone_rrs = node_rdataset(node, rrset->type);
+	if (zone_rrs != NULL) {
+		knot_rdata_t *rr = rrset->rrs.rdata;
+		for (size_t i = 0; i < rrset->rrs.count; ++i) {
+			if (!knot_rdataset_member(zone_rrs, rr)) {
+				return false;
+			}
+			rr = knot_rdataset_next(rr);
+		}
+
+		return true;
+	} else {
+		return false;
+	}
+}
+
+static void process_rr(zs_scanner_t *scanner)
+{
+	knot_rrset_init(&rrset, scanner->r_owner, scanner->r_type, scanner->r_class,
+	                scanner->r_ttl);
+
+	int ret = knot_rrset_add_rdata(&rrset, scanner->r_data,
+	                               scanner->r_data_length, NULL);
+	(void)ret;
+	assert(ret == KNOT_EOK);
+}
+
+void test_full(zone_t *zone, zs_scanner_t *sc)
+{
+	zone_update_t update;
+	/* Init update */
+	int ret = zone_update_init(&update, zone, UPDATE_FULL);
+	is_int(KNOT_EOK, ret, "zone update: init full");
+
+	if (zs_set_input_string(sc, zone_str1, strlen(zone_str1)) != 0 ||
+	    zs_parse_all(sc) != 0) {
+		assert(0);
+	}
+
+	/* First addition */
+	ret = zone_update_add(&update, &rrset);
+	knot_rdataset_clear(&rrset.rrs, NULL);
+	is_int(KNOT_EOK, ret, "full zone update: first addition");
+
+	if (zs_set_input_string(sc, zone_str2, strlen(zone_str2)) != 0 ||
+	    zs_parse_all(sc) != 0) {
+		assert(0);
+	}
+
+	/* Second addition */
+	ret = zone_update_add(&update, &rrset);
+	zone_node_t *node = (zone_node_t *) zone_update_get_node(&update, rrset.owner);
+	bool rrset_present = node_contains_rr(node, &rrset);
+	ok(ret == KNOT_EOK && rrset_present, "full zone update: second addition");
+
+	/* Removal */
+	ret = zone_update_remove(&update, &rrset);
+	node = (zone_node_t *) zone_update_get_node(&update, rrset.owner);
+	rrset_present = node_contains_rr(node, &rrset);
+	ok(ret == KNOT_EOK && !rrset_present, "full zone update: removal");
+
+	/* Last addition */
+	ret = zone_update_add(&update, &rrset);
+	node = (zone_node_t *) zone_update_get_node(&update, rrset.owner);
+	rrset_present = node_contains_rr(node, &rrset);
+	ok(ret == KNOT_EOK && rrset_present, "full zone update: last addition");
+
+	knot_rdataset_clear(&rrset.rrs, NULL);
+
+	/* Prepare node removal */
+	if (zs_set_input_string(sc, node_str1, strlen(node_str1)) != 0 ||
+	    zs_parse_all(sc) != 0) {
+		assert(0);
+	}
+	ret = zone_update_add(&update, &rrset);
+	assert(ret == KNOT_EOK);
+	knot_rdataset_clear(&rrset.rrs, NULL);
+
+	if (zs_set_input_string(sc, node_str2, strlen(node_str2)) != 0 ||
+	    zs_parse_all(sc) != 0) {
+		assert(0);
+	}
+	ret = zone_update_add(&update, &rrset);
+	assert(ret == KNOT_EOK);
+	knot_rdataset_clear(&rrset.rrs, NULL);
+	knot_dname_t *rem_node_name = knot_dname_from_str_alloc("node.test");
+	node = (zone_node_t *) zone_update_get_node(&update, rem_node_name);
+	assert(node && node_rdataset(node, KNOT_RRTYPE_TXT)->count == 2);
+	/* Node removal */
+	ret = zone_update_remove_node(&update, rem_node_name);
+	node = (zone_node_t *) zone_update_get_node(&update, rem_node_name);
+	ok(ret == KNOT_EOK && !node, "full zone update: node removal");
+	knot_dname_free(rem_node_name, NULL);
+
+	/* Test iteration */
+	zone_update_iter_t it;
+	ret = zone_update_iter(&it, &update);
+	is_int(KNOT_EOK, ret, "full zone update: init iter");
+
+	const zone_node_t *iter_node = zone_update_iter_val(&it);
+	assert(iter_node);
+	if (zs_set_input_string(sc, zone_str1, strlen(zone_str1)) != 0 ||
+	    zs_parse_all(sc) != 0) {
+		assert(0);
+	}
+	rrset_present = node_contains_rr(iter_node, &rrset);
+	ok(rrset_present, "full zone update: first iter value check");
+	knot_rdataset_clear(&rrset.rrs, NULL);
+
+	if (zs_set_input_string(sc, zone_str2, strlen(zone_str2)) != 0 ||
+	    zs_parse_all(sc) != 0) {
+		assert(0);
+	}
+	rrset_present = node_contains_rr(iter_node, &rrset);
+	ok(rrset_present, "full zone update: second iter value check");
+	knot_rdataset_clear(&rrset.rrs, NULL);
+
+	ret = zone_update_iter_next(&it);
+	is_int(KNOT_EOK, ret, "full zone update: iter next");
+
+	iter_node = zone_update_iter_val(&it);
+	ok(iter_node == NULL, "full zone update: iter val past end");
+
+	zone_update_iter_finish(&it);
+
+	/* Re-add a node for later incremental functionality test */
+	if (zs_set_input_string(sc, node_str1, strlen(node_str1)) != 0 ||
+	    zs_parse_all(sc) != 0) {
+		assert(0);
+	}
+	ret = zone_update_add(&update, &rrset);
+	assert(ret == KNOT_EOK);
+	knot_rdataset_clear(&rrset.rrs, NULL);
+
+	/* Commit */
+	ret = zone_update_commit(conf(), &update);
+	node = zone_contents_find_node_for_rr(zone->contents, &rrset);
+	rrset_present = node_contains_rr(node, &rrset);
+	ok(ret == KNOT_EOK && rrset_present, "full zone update: commit");
+
+	knot_rdataset_clear(&rrset.rrs, NULL);
+}
+
+void test_incremental(zone_t *zone, zs_scanner_t *sc)
+{
+	int ret = KNOT_EOK;
+
+	/* Init update */
+	zone_update_t update;
+	zone_update_init(&update, zone, UPDATE_INCREMENTAL);
+	ok(update.zone == zone && changeset_empty(&update.change) && update.mm.alloc,
+	   "incremental zone update: init");
+
+	if (zs_set_input_string(sc, add_str, strlen(add_str)) != 0 ||
+	    zs_parse_all(sc) != 0) {
+		assert(0);
+	}
+
+	/* Addition */
+	ret = zone_update_add(&update, &rrset);
+	knot_rdataset_clear(&rrset.rrs, NULL);
+	is_int(KNOT_EOK, ret, "incremental zone update: addition");
+
+	const zone_node_t *synth_node = zone_update_get_apex(&update);
+	ok(synth_node && node_rdataset(synth_node, KNOT_RRTYPE_TXT)->count == 2,
+	   "incremental zone update: add change");
+
+	if (zs_set_input_string(sc, del_str, strlen(del_str)) != 0 ||
+	    zs_parse_all(sc) != 0) {
+		assert(0);
+	}
+	/* Removal */
+	ret = zone_update_remove(&update, &rrset);
+	is_int(KNOT_EOK, ret, "incremental zone update: removal");
+	knot_rdataset_clear(&rrset.rrs, NULL);
+
+	synth_node = zone_update_get_apex(&update);
+	ok(synth_node && node_rdataset(synth_node, KNOT_RRTYPE_TXT)->count == 1,
+	   "incremental zone update: del change");
+
+	/* Prepare node removal */
+	if (zs_set_input_string(sc, node_str2, strlen(node_str2)) != 0 ||
+	    zs_parse_all(sc) != 0) {
+		assert(0);
+	}
+	ret = zone_update_add(&update, &rrset);
+	assert(ret == KNOT_EOK);
+	knot_rdataset_clear(&rrset.rrs, NULL);
+
+	knot_dname_t *rem_node_name = knot_dname_from_str_alloc("node.test");
+	synth_node = zone_update_get_node(&update, rem_node_name);
+	assert(synth_node && node_rdataset(synth_node, KNOT_RRTYPE_TXT)->count == 2);
+	/* Node Removal */
+	ret = zone_update_remove_node(&update, rem_node_name);
+	synth_node = zone_update_get_node(&update, rem_node_name);
+	ok(ret == KNOT_EOK && !synth_node,
+	   "incremental zone update: node removal");
+	knot_dname_free(rem_node_name, NULL);
+
+	/* Test iteration */
+	zone_update_iter_t it;
+	ret = zone_update_iter(&it, &update);
+	is_int(KNOT_EOK, ret, "incremental zone update: init iter");
+
+	if (zs_set_input_string(sc, del_str, strlen(del_str)) != 0 ||
+	    zs_parse_all(sc) != 0) {
+		assert(0);
+	}
+	const zone_node_t *iter_node = zone_update_iter_val(&it);
+	assert(iter_node);
+
+	bool rrset_present = node_contains_rr(iter_node, &rrset);
+	ok(!rrset_present, "incremental zone update: first iter value check");
+
+	knot_rdataset_clear(&rrset.rrs, NULL);
+
+	if (zs_set_input_string(sc, add_str, strlen(add_str)) != 0 ||
+	    zs_parse_all(sc) != 0) {
+		assert(0);
+	}
+	rrset_present = node_contains_rr(iter_node, &rrset);
+	ok(rrset_present, "incremental zone update: second iter value check");
+	knot_rdataset_clear(&rrset.rrs, NULL);
+
+	ret = zone_update_iter_next(&it);
+	is_int(KNOT_EOK, ret, "incremental zone update: iter next");
+	ret = zone_update_iter_next(&it);
+	is_int(KNOT_EOK, ret, "incremental zone update: iter next");
+
+	iter_node = zone_update_iter_val(&it);
+	ok(iter_node == NULL, "incremental zone update: iter val past end");
+
+	zone_update_iter_finish(&it);
+
+	/* Commit */
+	ret = zone_update_commit(conf(), &update);
+	iter_node = zone_contents_find_node_for_rr(zone->contents, &rrset);
+	rrset_present = node_contains_rr(iter_node, &rrset);
+	ok(ret == KNOT_EOK && rrset_present, "incremental zone update: commit");
+
+	knot_rdataset_clear(&rrset.rrs, NULL);
+}
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	char *temp_dir = test_mkdtemp();
+	ok(temp_dir != NULL, "make temporary directory");
+
+	char conf_str[512];
+	snprintf(conf_str, sizeof(conf_str),
+	         "zone:\n"
+	         " - domain: test.\n"
+	         "template:\n"
+	         " - id: default\n"
+		 "   max-journal-db-size: 100M\n"
+	         "   storage: %s\n",
+	         temp_dir);
+
+	/* Load test configuration. */
+	int ret = test_conf(conf_str, NULL);
+	is_int(KNOT_EOK, ret, "load configuration");
+
+	server_t server;
+	ret = server_init(&server, 1);
+	is_int(KNOT_EOK, ret, "server init");
+
+	/* Set up empty zone */
+	knot_dname_t *apex = knot_dname_from_str_alloc("test");
+	assert(apex);
+	zone_t *zone = zone_new(apex);
+	zone->journal_db = &server.journal_db;
+
+	/* Setup zscanner */
+	zs_scanner_t sc;
+	if (zs_init(&sc, "test.", KNOT_CLASS_IN, 3600) != 0 ||
+	    zs_set_processing(&sc, process_rr, NULL, NULL) != 0) {
+		assert(0);
+	}
+
+	/* Test FULL update, commit it and use the result to test the INCREMENTAL update */
+	test_full(zone, &sc);
+	test_incremental(zone, &sc);
+
+	zs_deinit(&sc);
+	zone_free(&zone);
+	server_deinit(&server);
+	knot_dname_free(apex, NULL);
+	conf_free(conf());
+	test_rm_rf(temp_dir);
+	free(temp_dir);
+
+	return 0;
+}
diff --git a/tests/knot/test_zone_events.c b/tests/knot/test_zone_events.c
new file mode 100644
index 0000000..801c2d9
--- /dev/null
+++ b/tests/knot/test_zone_events.c
@@ -0,0 +1,99 @@
+/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <tap/basic.h>
+
+#include "knot/common/evsched.h"
+#include "knot/worker/pool.h"
+#include "knot/events/events.h"
+#include "knot/zone/zone.h"
+
+static void test_scheduling(zone_t *zone)
+{
+	const time_t now = time(NULL);
+	const unsigned offset = 1000;
+
+	time_t timestamp = 0;
+	zone_event_type_t event = 0;
+
+	timestamp = zone_events_get_next(zone, &event);
+	ok(timestamp < 0 && event == ZONE_EVENT_INVALID, "nothing planned");
+
+	// scheduling
+
+	zone_events_schedule_at(zone, ZONE_EVENT_EXPIRE, now + offset);
+	zone_events_schedule_at(zone, ZONE_EVENT_FLUSH,  now + (offset / 2));
+
+	for (int i = 0; i < ZONE_EVENT_COUNT; i++) {
+		time_t t = zone_events_get_time(zone, i);
+		bool scheduled = i == ZONE_EVENT_EXPIRE || i == ZONE_EVENT_FLUSH;
+		const char *name = zone_events_get_name(i);
+
+		ok((t > 0) == scheduled && name, "event %s (%s)", name,
+		   scheduled ? "scheduled" : "not scheduled");
+	}
+
+	// queuing
+
+	timestamp = zone_events_get_next(zone, &event);
+	ok(timestamp >= now + (offset / 2) && event == ZONE_EVENT_FLUSH, "flush is next");
+
+	zone_events_schedule_at(zone, ZONE_EVENT_FLUSH, 0);
+
+	timestamp = zone_events_get_next(zone, &event);
+	ok(timestamp >= now + offset && event == ZONE_EVENT_EXPIRE, "expire is next");
+
+	zone_events_schedule_at(zone, ZONE_EVENT_EXPIRE, 0);
+
+	timestamp = zone_events_get_next(zone, &event);
+	ok(timestamp < 0 && event == ZONE_EVENT_INVALID, "nothing planned");
+
+	// zone_events_enqueue
+
+	// zone_events_freeze
+	// zone_events_start
+}
+
+int main(void)
+{
+	plan_lazy();
+
+	int r;
+
+	evsched_t sched = { 0 };
+	worker_pool_t *pool = NULL;
+	zone_t zone = { 0 };
+
+	r = evsched_init(&sched, NULL);
+	ok(r == KNOT_EOK, "create scheduler");
+
+	pool = worker_pool_create(1);
+	ok(pool != NULL, "create worker pool");
+
+	r = zone_events_init(&zone);
+	ok(r == KNOT_EOK, "zone events init");
+
+	r = zone_events_setup(&zone, pool, &sched, NULL);
+	ok(r == KNOT_EOK, "zone events setup");
+
+	test_scheduling(&zone);
+
+	zone_events_deinit(&zone);
+	worker_pool_destroy(pool);
+	evsched_deinit(&sched);
+
+	return 0;
+}
diff --git a/tests/knot/test_zone_serial.c b/tests/knot/test_zone_serial.c
new file mode 100644
index 0000000..73b7f4c
--- /dev/null
+++ b/tests/knot/test_zone_serial.c
@@ -0,0 +1,134 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <tap/basic.h>
+#include <stdlib.h>
+#include <time.h>
+
+#include "knot/zone/serial.h"
+#include "knot/conf/schema.h"
+#include "contrib/strtonum.h"
+
+enum serials {
+	S_LOWEST = 0,			// lowest value
+	S_2LOWEST = 1,			// second lowest value
+	S_BELOW_MIDDLE = 0x7fffffff,	// one below middle
+	S_ABOVE_MIDDLE = 0x80000000,	// one above middle
+	S_2HIGHEST = 0xffffffff - 1,	// second highest value
+	S_HIGHEST = 0xffffffff		// highest value
+};
+
+static uint32_t random_serial(void)
+{
+	uint32_t s = rand() & 0xff;
+	s |= (rand() & 0xff) << 8;
+	s |= (rand() & 0xff) << 16;
+	s |= (rand() & 0xff) << 24;
+
+	return s;
+}
+
+static void check_dateserial(uint32_t current, uint32_t expected, const char *msg)
+{
+	uint32_t next = serial_next(current, SERIAL_POLICY_DATESERIAL);
+	ok(next == expected, "dateserial: %s", msg);
+}
+
+static void test_dateserial(void)
+{
+	time_t now = time(NULL);
+
+	struct tm *gm_ret = gmtime(&now);
+
+	char str[32];
+	int ret1 = strftime(str, sizeof(str), "%Y%m%d00", gm_ret);
+
+	uint32_t serial0 = 0;
+	int ret2 = str_to_u32(str, &serial0);
+
+	ok(gm_ret != NULL && ret1 > 0 && ret2 == KNOT_EOK,
+	   "dateseril: prepare current value");
+
+	check_dateserial(2000010100, serial0, "from old date");
+	check_dateserial(serial0, serial0 + 1, "today's first increment");
+	check_dateserial(serial0 + 98, serial0 + 99, "today's last increment");
+	check_dateserial(2100010100, 2100010101, "from future date");
+}
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	/* Serial compare test. */
+	ok(serial_compare(S_LOWEST, S_BELOW_MIDDLE) == SERIAL_LOWER,
+	   "serial compare: lowest < below middle");
+	ok(serial_compare(S_BELOW_MIDDLE, S_LOWEST) == SERIAL_GREATER,
+	   "serial compare: below middle > lowest");
+
+	/* Corner-case: these serials' distance is exactly 2^31. */
+	ok(serial_compare(S_LOWEST, S_ABOVE_MIDDLE) == SERIAL_INCOMPARABLE,
+	   "serial compare: lowest < above_middle");
+	ok(serial_compare(S_ABOVE_MIDDLE, S_LOWEST) == SERIAL_INCOMPARABLE,
+	   "serial compare: above_middle < lowest");
+
+	ok(serial_compare(S_LOWEST, S_HIGHEST) == SERIAL_GREATER,
+	   "serial compare: lowest > highest");
+	ok(serial_compare(S_HIGHEST, S_LOWEST) == SERIAL_LOWER,
+	   "serial compare: highest < lowest");
+
+	ok(serial_compare(S_2LOWEST, S_ABOVE_MIDDLE) == SERIAL_LOWER,
+	   "serial compare: 2nd lowest < above middle");
+	ok(serial_compare(S_ABOVE_MIDDLE, S_2LOWEST) == SERIAL_GREATER,
+	   "serial compare: above middle > 2nd lowest");
+
+	/* Corner-case: these serials' distance is exactly 2^31. */
+	ok(serial_compare(S_BELOW_MIDDLE, S_HIGHEST) == SERIAL_INCOMPARABLE,
+	   "serial compare: below middle < highest");
+	ok(serial_compare(S_HIGHEST, S_BELOW_MIDDLE) == SERIAL_INCOMPARABLE,
+	   "serial compare: highest < below middle");
+
+	ok(serial_compare(S_BELOW_MIDDLE, S_2HIGHEST) == SERIAL_LOWER,
+	   "serial compare: below middle < 2nd highest");
+	ok(serial_compare(S_2HIGHEST, S_BELOW_MIDDLE) == SERIAL_GREATER,
+	   "serial compare: 2nd highest > below middle");
+
+	ok(serial_compare(S_ABOVE_MIDDLE, S_HIGHEST) == SERIAL_LOWER,
+	   "serial compare: above middle < highest");
+	ok(serial_compare(S_HIGHEST, S_ABOVE_MIDDLE) == SERIAL_GREATER,
+	   "serial compare: highest > above middle");
+
+	ok(serial_compare(S_LOWEST, S_LOWEST) == SERIAL_EQUAL,
+	   "serial compare: lowest == lowest");
+	ok(serial_compare(S_HIGHEST, S_HIGHEST) == SERIAL_EQUAL,
+	   "serial compare: highest == highest");
+
+	ok(serial_compare(S_LOWEST - 1, S_HIGHEST) == SERIAL_EQUAL,
+	   "serial compare: lowest - 1 == highest");
+	ok(serial_compare(S_LOWEST, S_HIGHEST + 1) == SERIAL_EQUAL,
+	   "serial compare: lowest== highest + 1");
+
+	/* Corner-case: these serials' distance is exactly 2^31. */
+	uint32_t s1 = random_serial();
+	uint32_t s2 = s1 + S_ABOVE_MIDDLE;  // exactly the 'opposite' number
+	ok(serial_compare(s1, s2) == SERIAL_INCOMPARABLE,
+	   "serial compare: random opposites (s1 < s2)");
+	ok(serial_compare(s2, s1) == SERIAL_INCOMPARABLE,
+	   "serial compare: random opposites (s2 < s1)");
+
+	test_dateserial();
+
+	return 0;
+}
diff --git a/tests/knot/test_zone_timers.c b/tests/knot/test_zone_timers.c
new file mode 100644
index 0000000..d60aa8e
--- /dev/null
+++ b/tests/knot/test_zone_timers.c
@@ -0,0 +1,102 @@
+/*  Copyright (C) 2017 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+#include <tap/basic.h>
+#include <tap/files.h>
+
+#include "knot/zone/timers.h"
+#include "libknot/db/db_lmdb.h"
+#include "libknot/dname.h"
+#include "libknot/error.h"
+
+static const zone_timers_t MOCK_TIMERS = {
+	.soa_expire = 3600,
+	.last_refresh = 1474559950,
+	.next_refresh = 1474559960,
+	.last_flush = 1474559900,
+};
+
+static bool keep_all(const knot_dname_t *zone, void *data)
+{
+	return true;
+}
+
+static bool remove_all(const knot_dname_t *zone, void *data)
+{
+	return false;
+}
+
+static bool timers_eq(const zone_timers_t *a, const zone_timers_t *b)
+{
+	return a->soa_expire == b->soa_expire &&
+	       a->last_refresh == b->last_refresh &&
+	       a->next_refresh == b->next_refresh &&
+	       a->last_flush == b->last_flush;
+}
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+	assert(knot_db_lmdb_api());
+
+	char *dbid = test_mkdtemp();
+	if (!dbid) {
+		return EXIT_FAILURE;
+	}
+
+	const knot_dname_t *zone = (uint8_t *)"\x7""example""\x3""com";
+	struct zone_timers timers = MOCK_TIMERS;
+
+	// Create database
+	knot_db_t *db = NULL;
+	int ret = zone_timers_open(dbid, &db, 1024 * 1024);
+	ok(ret == KNOT_EOK && db != NULL, "zone_timers_open()");
+
+	// Lookup nonexistent
+	ret = zone_timers_read(db, zone, &timers);
+	is_int(KNOT_ENOENT, ret, "zone_timer_read() nonexistent");
+
+	// Write timers
+	ret = zone_timers_write(db, zone, &timers, NULL);
+	is_int(KNOT_EOK, ret, "zone_timers_write()");
+
+	// Read timers
+	memset(&timers, 0, sizeof(timers));
+	ret = zone_timers_read(db, zone, &timers);
+	ok(ret == KNOT_EOK && timers_eq(&timers, &MOCK_TIMERS), "zone_timers_read()");
+
+	// Sweep none
+	ret = zone_timers_sweep(db, keep_all, NULL);
+	is_int(KNOT_EOK, ret, "zone_timers_sweep() none");
+	ret = zone_timers_read(db, zone, &timers);
+	is_int(KNOT_EOK, ret, "zone_timers_read()");
+
+	// Sweep all
+	ret = zone_timers_sweep(db, remove_all, NULL);
+	is_int(KNOT_EOK, ret, "zone_timers_sweep() all");
+	ret = zone_timers_read(db, zone, &timers);
+	is_int(KNOT_ENOENT, ret, "zone_timers_read() nonexistent");
+
+	// Clean up.
+	zone_timers_close(db);
+	test_rm_rf(dbid);
+	free(dbid);
+
+	return EXIT_SUCCESS;
+}
diff --git a/tests/knot/test_zonedb.c b/tests/knot/test_zonedb.c
new file mode 100644
index 0000000..3ec2b93
--- /dev/null
+++ b/tests/knot/test_zonedb.c
@@ -0,0 +1,115 @@
+/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <tap/basic.h>
+
+#include "knot/zone/zone.h"
+#include "knot/zone/zonedb.h"
+#include "contrib/openbsd/strlcat.h"
+#include "contrib/openbsd/strlcpy.h"
+
+#define ZONE_COUNT 10
+static const char *zone_list[ZONE_COUNT] = {
+        ".",
+        "com",
+        "net",
+        "c.com",
+        "a.com",
+        "a.net",
+        "b.net",
+        "c.a.com",
+        "b.b.b.com",
+        "b.b.b.b.net",
+};
+
+int main(int argc, char *argv[])
+{
+	plan_lazy();
+
+	/* Create database. */
+	char buf[KNOT_DNAME_MAXLEN];
+	const char *prefix = "zzz.";
+	size_t nr_passed = 0;
+	knot_dname_t *dname = NULL;
+	zone_t *zones[ZONE_COUNT] = {0};
+	knot_zonedb_t *db = knot_zonedb_new();
+	ok(db != NULL, "zonedb: new");
+
+	/* Populate. */
+	for (unsigned i = 0; i < ZONE_COUNT; ++i) {
+		knot_dname_t *zone_name = knot_dname_from_str_alloc(zone_list[i]);
+		zones[i] = zone_new(zone_name);
+		knot_dname_free(zone_name, NULL);
+
+		if (zones[i] == NULL) {
+			goto cleanup;
+		}
+		if (knot_zonedb_insert(db, zones[i]) == KNOT_EOK) {
+			++nr_passed;
+		} else {
+			diag("knot_zonedb_add_zone(%s) failed", zone_list[i]);
+		}
+	}
+	ok(nr_passed == ZONE_COUNT, "zonedb: add zones");
+
+	/* Lookup of exact names. */
+	nr_passed = 0;
+	for (unsigned i = 0; i < ZONE_COUNT; ++i) {
+		dname = knot_dname_from_str_alloc(zone_list[i]);
+		if (knot_zonedb_find(db, dname) == zones[i]) {
+			++nr_passed;
+		} else {
+			diag("knot_zonedb_find(%s) failed", zone_list[i]);
+		}
+		knot_dname_free(dname, NULL);
+	}
+	ok(nr_passed == ZONE_COUNT, "zonedb: find exact zones");
+
+	/* Lookup of sub-names. */
+	nr_passed = 0;
+	for (unsigned i = 0; i < ZONE_COUNT; ++i) {
+		strlcpy(buf, prefix, sizeof(buf));
+		if (strcmp(zone_list[i], ".") != 0) {
+			strlcat(buf, zone_list[i], sizeof(buf));
+		}
+		dname = knot_dname_from_str_alloc(buf);
+		if (knot_zonedb_find_suffix(db, dname) == zones[i]) {
+			++nr_passed;
+		} else {
+			diag("knot_zonedb_find_suffix(%s) failed", buf);
+		}
+		knot_dname_free(dname, NULL);
+	}
+	ok(nr_passed == ZONE_COUNT, "zonedb: find zones for subnames");
+
+	/* Remove all zones. */
+	nr_passed = 0;
+	for (unsigned i = 0; i < ZONE_COUNT; ++i) {
+		dname = knot_dname_from_str_alloc(zone_list[i]);
+		if (knot_zonedb_del(db, dname) == KNOT_EOK) {
+			zone_free(&zones[i]);
+			++nr_passed;
+		} else {
+			diag("knot_zonedb_remove_zone(%s) failed", zone_list[i]);
+		}
+		knot_dname_free(dname, NULL);
+	}
+	ok(nr_passed == ZONE_COUNT, "zonedb: removed all zones");
+
+cleanup:
+	knot_zonedb_deep_free(&db);
+	return 0;
+}
author	Daniel Baumann <daniel.baumann@progress-linux.org>	2024-05-06 00:53:35 +0000
committer	Daniel Baumann <daniel.baumann@progress-linux.org>	2024-05-06 00:53:35 +0000
commit	69c6a41ffb878ef98c9378ed4b1634a404cfaa7f (patch)
tree	b2a4f704565d62fbb129ab9dc3b35977c50e6e7f /tests/knot
parent	Initial commit. (diff)
download	knot-upstream/2.7.6.tar.xz knot-upstream/2.7.6.zip