# Specification of Test Scenarios for DNSSEC10


## Table of contents

* [Background](#background)
* [Test Case](#test-case)
* [Test scenarios](#test-scenarios)
* [Test zone names](#test-zone-names)
* [All message tags](#all-message-tags)
* [Test scenarios and message tags](#test-scenarios-and-message-tags)
* [Test scenarios and setup of test zones]


## Background

See the [test scenario README file].


## Test Case
This document specifies defined test scenarios for test case [DNSSEC10].


## Test scenarios

The purpose of the test scenarios is to cover all reasonable contexts where
different message tags are outputted when [DNSSEC10] is run on a test zone.
The message tags are defined in the test case ([DNSSEC10]) and the scenarios
are defined below.

The test scenarios are structured as stated in the [test scenario README file].

## Test zone names

The test zone or zones for each test scenario in this document is a subdomain
(or lower zone) delegated from the base name (`dnssec10.xa`) and that subdomain
having the same name as the scenario. The names of those zones are given in
section "[Test scenarios and setup of test zones]" below.


## All message tags
The test case can output any of these message tags, but not necessarily in any
combination. See [DNSSEC10] for the specification of the tags.

* DS10_ALGO_NOT_SUPPORTED_BY_ZM
* DS10_ERR_MULT_NSEC
* DS10_ERR_MULT_NSEC3
* DS10_ERR_MULT_NSEC3PARAM
* DS10_EXPECTED_NSEC_NSEC3_MISSING
* DS10_HAS_NSEC
* DS10_HAS_NSEC3
* DS10_INCONSISTENT_NSEC
* DS10_INCONSISTENT_NSEC3
* DS10_INCONSISTENT_NSEC_NSEC3
* DS10_MIXED_NSEC_NSEC3
* DS10_NSEC3PARAM_GIVES_ERR_ANSWER
* DS10_NSEC3PARAM_MISMATCHES_APEX
* DS10_NSEC3PARAM_QUERY_RESPONSE_ERR
* DS10_NSEC3_ERR_TYPE_LIST
* DS10_NSEC3_MISMATCHES_APEX
* DS10_NSEC3_MISSING_SIGNATURE
* DS10_NSEC3_NODATA_MISSING_SOA
* DS10_NSEC3_NODATA_WRONG_SOA
* DS10_NSEC3_NO_VERIFIED_SIGNATURE
* DS10_NSEC3_RRSIG_EXPIRED
* DS10_NSEC3_RRSIG_NOT_YET_VALID
* DS10_NSEC3_RRSIG_NO_DNSKEY
* DS10_NSEC3_RRSIG_VERIFY_ERROR
* DS10_NSEC_ERR_TYPE_LIST
* DS10_NSEC_GIVES_ERR_ANSWER
* DS10_NSEC_MISMATCHES_APEX
* DS10_NSEC_MISSING_SIGNATURE
* DS10_NSEC_NODATA_MISSING_SOA
* DS10_NSEC_NODATA_WRONG_SOA
* DS10_NSEC_NO_VERIFIED_SIGNATURE
* DS10_NSEC_QUERY_RESPONSE_ERR
* DS10_NSEC_RRSIG_EXPIRED
* DS10_NSEC_RRSIG_NOT_YET_VALID
* DS10_NSEC_RRSIG_NO_DNSKEY
* DS10_NSEC_RRSIG_VERIFY_ERROR
* DS10_SERVER_NO_DNSSEC
* DS10_ZONE_NO_DNSSEC


## Test scenarios and message tags

If a message tag is not listed for the scenario, its presence or non-presence is
irrelevant to the test scenario and must be ignored.

Scenario name                  | Mandatory message tag                                                        | Forbidden message tags
:------------------------------|:-----------------------------------------------------------------------------|:--------------------
GOOD-NSEC-1                    | DS10_HAS_NSEC                                                                | 2)
GOOD-NSEC-2                    | DS10_HAS_NSEC                                                                | 2)
GOOD-NSEC-3                    | DS10_HAS_NSEC                                                                | 2)
GOOD-NSEC3-1                   | DS10_HAS_NSEC3                                                               | 2)
GOOD-NSEC3-2                   | DS10_HAS_NSEC3                                                               | 2)
GOOD-NSEC3-3                   | DS10_HAS_NSEC3                                                               | 2)
ALGO-NOT-SUPP-BY-ZM-1          | DS10_ALGO_NOT_SUPPORTED_BY_ZM, DS10_HAS_NSEC                                 | 2)
ALGO-NOT-SUPP-BY-ZM-2          | DS10_ALGO_NOT_SUPPORTED_BY_ZM, DS10_HAS_NSEC3                                | 2)
BAD-SERVERS-BUT-GOOD-NSEC-1    | DS10_HAS_NSEC                                                                | 2)
ERR-MULT-NSEC-1                | DS10_ERR_MULT_NSEC, DS10_HAS_NSEC                                            | 2)
ERR-MULT-NSEC-2                | DS10_ERR_MULT_NSEC, DS10_HAS_NSEC                                            | 2)
ERR-MULT-NSEC3-1               | DS10_ERR_MULT_NSEC3, DS10_HAS_NSEC3                                          | 2)
ERR-MULT-NSEC3PARAM-1          | DS10_ERR_MULT_NSEC3PARAM, DS10_HAS_NSEC3                                     | 2)
EXP-NSEC-NSEC3-MISS-1          | DS10_EXPECTED_NSEC_NSEC3_MISSING                                             | 2)
INCONSISTENT-NSEC-1            | DS10_INCONSISTENT_NSEC, DS10_HAS_NSEC                                        | 2)
INCONSISTENT-NSEC3-1           | DS10_INCONSISTENT_NSEC3, DS10_HAS_NSEC3                                      | 2)
INCONSIST-NSEC-NSEC3-1         | DS10_INCONSISTENT_NSEC_NSEC3                                                 | 2)
INCONSIST-NSEC-NSEC3-2         | DS10_INCONSISTENT_NSEC_NSEC3, DS10_INCONSISTENT_NSEC, DS10_INCONSISTENT_NSEC3| 2)
MIXED-NSEC-NSEC3-1             | DS10_MIXED_NSEC_NSEC3                                                        | 2)
MIXED-NSEC-NSEC3-2             | DS10_MIXED_NSEC_NSEC3                                                        | 2)
NSEC3PARAM-GIVES-ERR-ANSWER-1  | DS10_NSEC3PARAM_GIVES_ERR_ANSWER, DS10_HAS_NSEC3, DS10_INCONSISTENT_NSEC3    | 2)
NSEC3PARAM-GIVES-ERR-ANSWER-2  | DS10_NSEC3PARAM_GIVES_ERR_ANSWER, DS10_EXPECTED_NSEC_NSEC3_MISSING, DS10_INCONSISTENT_NSEC3, DS10_HAS_NSEC3 | 2)
NSEC3PARAM-MISMATCHES-APEX-1   | DS10_NSEC3PARAM_MISMATCHES_APEX, DS10_HAS_NSEC3                              | 2)
NSEC3PARAM-Q-RESPONSE-ERR-1    | DS10_NSEC3PARAM_QUERY_RESPONSE_ERR, DS10_HAS_NSEC3, DS10_INCONSISTENT_NSEC3  | 2)
NSEC3PARAM-Q-RESPONSE-ERR-2    | DS10_NSEC3PARAM_QUERY_RESPONSE_ERR, DS10_HAS_NSEC3, DS10_INCONSISTENT_NSEC3  | 2)
NSEC3PARAM-Q-RESPONSE-ERR-3    | DS10_NSEC3PARAM_QUERY_RESPONSE_ERR, DS10_EXPECTED_NSEC_NSEC3_MISSING, DS10_INCONSISTENT_NSEC3 | 2)
NSEC3-ERR-TYPE-LIST-1          | DS10_NSEC3_ERR_TYPE_LIST, DS10_HAS_NSEC3                                     | 2)
NSEC3-ERR-TYPE-LIST-2          | DS10_NSEC3_ERR_TYPE_LIST, DS10_HAS_NSEC3                                     | 2)
NSEC3-MISMATCHES-APEX-1        | DS10_NSEC3_MISMATCHES_APEX, DS10_HAS_NSEC3                                   | 2)
NSEC3-MISSING-SIGNATURE-1      | DS10_NSEC3_MISSING_SIGNATURE, DS10_HAS_NSEC3                                 | 2)
NSEC3-NODATA-MISSING-SOA-1     | DS10_NSEC3_NODATA_MISSING_SOA, DS10_HAS_NSEC3                                | 2)
NSEC3-NODATA-WRONG-SOA-1       | DS10_NSEC3_NODATA_WRONG_SOA, DS10_HAS_NSEC3                                  | 2)
NSEC3-NO-VERIFIED-SIGNATURE-1  | DS10_NSEC3_NO_VERIFIED_SIGNATURE, DS10_HAS_NSEC3, DS10_NSEC3_RRSIG_NO_DNSKEY | 2)
NSEC3-NO-VERIFIED-SIGNATURE-2  | DS10_NSEC3_NO_VERIFIED_SIGNATURE, DS10_HAS_NSEC3, DS10_NSEC3_RRSIG_EXPIRED   | 2)
NSEC3-NO-VERIFIED-SIGNATURE-3  | DS10_NSEC3_NO_VERIFIED_SIGNATURE, DS10_HAS_NSEC3, DS10_NSEC3_RRSIG_NOT_YET_VALID | 2)
NSEC3-NO-VERIFIED-SIGNATURE-4  | DS10_NSEC3_NO_VERIFIED_SIGNATURE, DS10_HAS_NSEC3, DS10_NSEC3_RRSIG_VERIFY_ERROR  | 2)
NSEC-ERR-TYPE-LIST-1           | DS10_NSEC_ERR_TYPE_LIST, DS10_HAS_NSEC                                       | 2)
NSEC-ERR-TYPE-LIST-2           | DS10_NSEC_ERR_TYPE_LIST, DS10_HAS_NSEC                                       | 2)
NSEC-GIVES-ERR-ANSWER-1        | DS10_NSEC_GIVES_ERR_ANSWER, DS10_HAS_NSEC, DS10_INCONSISTENT_NSEC            | 2)
NSEC-GIVES-ERR-ANSWER-2        | DS10_NSEC_GIVES_ERR_ANSWER, DS10_EXPECTED_NSEC_NSEC3_MISSING, DS10_INCONSISTENT_NSEC, DS10_HAS_NSEC | 2)
NSEC-MISMATCHES-APEX-1         | DS10_NSEC_MISMATCHES_APEX, DS10_HAS_NSEC                                     | 2)
NSEC-MISMATCHES-APEX-2         | DS10_NSEC_MISMATCHES_APEX, DS10_HAS_NSEC                                     | 2)
NSEC-MISSING-SIGNATURE-1       | DS10_NSEC_MISSING_SIGNATURE, DS10_HAS_NSEC                                   | 2)
NSEC-NODATA-MISSING-SOA-1      | DS10_NSEC_NODATA_MISSING_SOA, DS10_HAS_NSEC                                  | 2)
NSEC-NODATA-WRONG-SOA-1        | DS10_NSEC_NODATA_WRONG_SOA, DS10_HAS_NSEC                                    | 2)
NSEC-NO-VERIFIED-SIGNATURE-1   | DS10_NSEC_NO_VERIFIED_SIGNATURE, DS10_HAS_NSEC, DS10_NSEC_RRSIG_NO_DNSKEY    | 2)
NSEC-NO-VERIFIED-SIGNATURE-2   | DS10_NSEC_NO_VERIFIED_SIGNATURE, DS10_HAS_NSEC, DS10_NSEC_RRSIG_EXPIRED      | 2)
NSEC-NO-VERIFIED-SIGNATURE-3   | DS10_NSEC_NO_VERIFIED_SIGNATURE, DS10_HAS_NSEC, DS10_NSEC_RRSIG_NOT_YET_VALID| 2)
NSEC-NO-VERIFIED-SIGNATURE-4   | DS10_NSEC_NO_VERIFIED_SIGNATURE, DS10_HAS_NSEC, DS10_NSEC_RRSIG_VERIFY_ERROR | 2)
NSEC-QUERY-RESPONSE-ERR-1      | DS10_NSEC_QUERY_RESPONSE_ERR, DS10_HAS_NSEC, DS10_INCONSISTENT_NSEC          | 2)
NSEC-QUERY-RESPONSE-ERR-2      | DS10_NSEC_QUERY_RESPONSE_ERR, DS10_HAS_NSEC, DS10_INCONSISTENT_NSEC          | 2)
NSEC-QUERY-RESPONSE-ERR-3      | DS10_NSEC_QUERY_RESPONSE_ERR, DS10_EXPECTED_NSEC_NSEC3_MISSING, DS10_INCONSISTENT_NSEC | 2)
SERVER-NO-DNSSEC-1             | DS10_SERVER_NO_DNSSEC, DS10_HAS_NSEC                                         | 2)
SERVER-NO-DNSSEC-2             | DS10_SERVER_NO_DNSSEC, DS10_HAS_NSEC3                                        | 2)
ZONE-NO-DNSSEC-1               | DS10_ZONE_NO_DNSSEC                                                          | 2)

* (1) All tags except for those specified as "Forbidden message tags" (no instances for these test scenarios)
* (2) All tags except for those specified as "Mandatory message tags"


## Test scenarios and setup of test zones

### Default zone configuration
Unless otherwise specified in the specific scenario specification, the test zone
or zones for the scenario will follow the default setup as stated below. The
`child zone` is the zone to be tested for the scenario.

* The child zone is `SCENARIO.dnssec10.xa`.
  * It is delegated to two name servers, `ns1.SCENARIO.dnssec10.xa`
    and `ns2.SCENARIO.dnssec10.xa`.
    * The name server names have A and AAAA records to avoid non-relevant error
      messages.
    * The delegation of the child zone is complete with glue records.
  * There is a zone file for the child zone.
  * All child zone servers give the same response.
  * The responses are either with NSEC record (NSEC zone) or NSEC3 record (NSEC3
    zone), not mixed.
* The parent zone is `dnssec10.xa`.
  * It is served by two in-bailiwick NS (ns1 and ns2).
  * ns1 and ns2 have the same zone content.
  * ns1 and ns2 have both IPv4 and IPv6 glue.
  * The records matching glue in the zone are complete.
* If the child zone is an NSEC zone:
  * Responds with an NSEC response on the NSEC3PARAM query.
  * Responds with an NSEC record in answer section on the NSEC query.
* If the child zone is an NSEC3 zone:
  * Responds with an NSEC3 response on the NSEC query.
  * Responds with an NSEC3PARAM record in answer section on the NSEC3PARAM query.
* All responses will have the AA bit set.
* All responses will have the [RCODE Name] "NoError".

### GOOD-NSEC-1
An NSEC zone and a "happy path". Everything is fine.

* Zone: good-nsec-1.dnssec10.xa

### GOOD-NSEC-2
An NSEC zone and a "happy path". Everything is fine besides that the zone
is served on NS names with the same IP addresses which is fine for this test
case.

* Zone: good-nsec-2.dnssec10.xa
  * The zone is delegated to ns1a, ns1b and ns1c.
    * All three share the same IPv4 and IPv6 address, respectively.

### GOOD-NSEC-3
An NSEC zone and a "happy path". Everything is fine besides that the NS names
in delegation and zone are different. Fine for this test case.

* Zone: good-nsec-3.dnssec10.xa
  * Zone NS are to dns1 and dns2.
    * dns1 has the same IP addresses as ns1
    * dns2 has the same IP addresses as ns2

### GOOD-NSEC3-1
An NSEC3 zone and a "happy path". Everything is fine.

* Zone: good-nsec3-1.dnssec10.xa

### GOOD-NSEC3-2
An NSEC3 zone and a "happy path". Everything is fine besides that the zone
is served on NS names with the same IP addresses which is fine for this test
case.

* Zone: good-nsec3-2.dnssec10.xa
  * The zone is delegated to ns1a, ns1b and ns1c.
    * All three share the same IPv4 and IPv6 address, respectively.

### GOOD-NSEC3-3
An NSEC3 zone and a "happy path". Everything is fine besides that the NS names
in delegation and zone are different. Fine for this test case.

* Zone: good-nsec3-3.dnssec10.xa
  * Zone NS are to dns1 and dns2.
    * dns1 has the same IP addresses as ns1
    * dns2 has the same IP addresses as ns2

### ALGO-NOT-SUPP-BY-ZM-1
An NSEC zone. Unknown algorithm of a DNSKEY.

* Zone: algo-not-supp-by-zm-1.dnssec10.xa
  * There is an extra RRSIG for the NSEC record (as the response to the
    NSEC3PARAM query).
    * That RRSIG has been created by [algorithm 255][IANA registry], which is
      an unsupported private algorithm.
    * A matching DNSKEY ([algorithm 255][IANA registry]) is available.
    * For this test scenario a fake signature and a fake public key are used.
  * The extra DNSKEY is in the DNSKEY RRset which is resigned by the valid
    KSK.

### ALGO-NOT-SUPP-BY-ZM-2
An NSEC3 zone. Unknown algorithm of a DNSKEY.

* Zone: algo-not-supp-by-zm-2.dnssec10.xa
  * There is an extra RRSIG for the NSEC3 record (as the response to the
    NSEC query).
    * That RRSIG has been created by [algorithm 255][IANA registry], which is
      an unsupported private algorithm.
    * A matching DNSKEY ([algorithm 255][IANA registry]) is available.
  * For this test scenario a fake signature and a fake public key are used.
  * The extra DNSKEY is in the DNSKEY RRset which is resigned by the valid
    KSK.

### BAD-SERVERS-BUT-GOOD-NSEC-1
An NSEC zone. Everything is fine except some non-responsive servers.

* Zone: bad-servers-but-good-nsec-1.dnssec10.xa
  * The child zone is delegated to ns1, ns2, ns3, ns4 and ns5, all
    in-bailiwick with correct glue.
  * ns1 and ns2 are correct and work as they should.
  * ns3 does not respond on DNSKEY query.
  * ns4 responds with REFUSED on DNSKEY query.
  * ns5 responds with AA unset on DNSKEY query.

### ERR-MULT-NSEC-1
An NSEC zone. An extra NSEC record is returned on the NSEC3PARAM query.

* Zone: err-mult-nsec-1.dnssec10.xa
  * An extra NSEC record is returned in the response to the NSEC3PARAM query.
    * The extra NSEC record has the same owner name, but different value in
      "Next Domain Name" field.
  * RRSIG is recalculated.

### ERR-MULT-NSEC-2
An NSEC zone. An extra NSEC record is returned on the NSEC query.

* Zone: err-mult-nsec-2.dnssec10.xa
  * An extra NSEC record is returned in the response to the NSEC query.
    * The extra NSEC record has the same owner name, but different value in
      "Type List" field.
  * RRSIG is recalculated.

### ERR-MULT-NSEC3-1
An NSEC3 zone. An extra NSEC3 record is returned.

* Zone: err-mult-nsec3-1.dnssec10.xa
  * An extra NSEC3 record is returned in the response to the NSEC query.
    * The extra NSEC3 record has the same hash owner name, but different value in
      "Next Hashed Owner Name" field.
  * The NSEC3 RRset has been signed with a valid RRSIG.

### ERR-MULT-NSEC3PARAM-1
An NSEC3 zone. An extra NSEC3PARAM record is returned.

* Zone: err-mult-nsec3param-1.dnssec10.xa
  * An extra NSEC3PARAM record is returned in the response to the NSEC query.
    * The extra NSEC3PARAM record has the same owner name, but different number
      of iterations.
  * The NSEC3PARAM RRset has been signed with a valid RRSIG.

### EXP-NSEC-NSEC3-MISS-1
A zone without NSEC and NSEC3. There is no NSEC or NSEC3 function.

* Zone: exp-nsec-nsec3-miss-1.dnssec10.xa
  * The NSEC query gives a NODATA response with no NSEC or NSEC3 record.
  * The NSEC3PARAM query gives a NODATA response with no NSEC or NSEC3 record.

### INCONSISTENT-NSEC-1
An NSEC zone. Some errors in NSEC handling.

* Zone: inconsistent-nsec-1.dnssec10.xa
  * ns1 includes no NSEC record in the NODATA response on the NSEC3PARAM query.
  * ns2 includes no NSEC record in the NODATA response on the NSEC query.

### INCONSISTENT-NSEC3-1
An NSEC3 zone. Some errors in NSEC3 handling.

* Zone: inconsistent-nsec3-1.dnssec10.xa
  * ns1 includes no NSEC3 record in the NODATA response on the NSEC query.
  * ns2 includes no NSEC3PARAM or NSEC3 record in the NODATA response on the
    NSEC3PARAM query.

### INCONSIST-NSEC-NSEC3-1
Mixing beteen NSEC and NSEC3.

* Zone: inconsist-nsec-nsec3-1.dnssec10.xa
  * ns1 holds an NSEC version of the zone.
  * ns2 holds an NSEC3 version of the zone.

### INCONSIST-NSEC-NSEC3-2
NSEC on one server and NSEC3 on the other plus errors in NSEC and NSEC3 handling.

* Zone: inconsist-nsec-nsec3-2.dnssec10.xa
  * ns1 holds an NSEC version of the zone.
    * It responds with a NODATA respond without NSEC record on the NSEC3PARAM
      query.
    * It does respond with an NSEC record to the NSEC query.
  * ns2 holds an NSEC3 version of the zone.
    * It responds with a NODATA respond without NSEC3 record on the NSEC query.
    * It does respond with an NSEC3PARAM record to the NSEC3PARAM query.

### MIXED-NSEC-NSEC3-1
Servers gives both NSEC and NSEC3

* Zone: mixed-nsec-nsec3-1.dnssec10.xa
  * The zone gives an NSEC record in response to NSEC query.
  * The zone gives an NSEC3PARAM record in response to the NSEC3PARAM query.

### MIXED-NSEC-NSEC3-2
Servers gives both NSEC and NSEC3

* Zone: mixed-nsec-nsec3-2.dnssec10.xa
  * The zone gives a NODATA response with NSEC3 record in response to NSEC
    query.
  * The zone gives a NODATA response with NSEC record in response to the
    NSEC3PARAM query.

### NSEC3PARAM-GIVES-ERR-ANSWER-1
An NSEC3 zone. Error in response to NSEC3PARAM query.

* Zone: nsec3param-gives-err-answer-1.dnssec10.xa
  * The zone gives a TXT record, but no NSEC3PARAM record, in response to the
    NSEC3PARAM query.

### NSEC3PARAM-GIVES-ERR-ANSWER-2
An NSEC3 zone. Error in response to NSEC3PARAM query on ns1. No NSEC or NSEC3 on
ns2.

* Zone: nsec3param-gives-err-answer-1.dnssec10.xa
  * On ns1, the zone gives a TXT record, but no NSEC3PARAM record, in response to
    the NSEC3PARAM query.
  * On ns2, the zone gives NODATA responses without NSEC or NSEC3 record for both
    the NSEC3PARAM query and the NSEC query.

### NSEC3PARAM-MISMATCHES-APEX-1
An NSEC3 zone. The owner name of the NSEC3PARAM record is erroneous.

* Zone: nsec3param-mismatches-apex-1.dnssec10.xa
  * The owner name of the NSEC3PARAM record in response to the NSEC3PARAM query is
    erroneous and does not match apex.
    * The owner name is `sub.nsec3param-mismatches-apex-1.dnssec10.xa` instead of
      expected `nsec3param-mismatches-apex-1.dnssec10.xa`.

## NSEC3PARAM-Q-RESPONSE-ERR-1
An NSEC3 zone. Error in response to NSEC3PARAM query.

* Zone: nsec3param-q-response-err-1.dnssec10.xa
  * No DNS response on the NSEC3PARAM query.

## NSEC3PARAM-Q-RESPONSE-ERR-2
An NSEC3 zone. Error in response to NSEC3PARAM query.

* Zone: nsec3param-q-response-err-2.dnssec10.xa
  * The response on the NSEC3PARAM query has the [RCODE Name] "REFUSED".

## NSEC3PARAM-Q-RESPONSE-ERR-3
An NSEC3 zone. Error in response to NSEC3PARAM query on ns1. No NSEC or NSEC3 on
ns2.

* Zone: nsec3param-q-response-err-3.dnssec10.xa
  * The response from ns1 on the NSEC3PARAM query has the AA flag unset.
  * On ns2, the zone gives NODATA responses without NSEC or NSEC3 record for both
    the NSEC3PARAM query and the NSEC query.

### NSEC3-ERR-TYPE-LIST-1
An NSEC3 zone. The type list of the NSEC3 record is erroneous.

* Zone: nsec3-err-type-list-1.dnssec10.xa
  * The type list of the NSEC3 record includes NSEC.

### NSEC3-ERR-TYPE-LIST-2
An NSEC3 zone. The type list of the NSEC3 record is erroneous.

* Zone: nsec3-err-type-list-2.dnssec10.xa
  * The type list of the NSEC3 record misses RRSIG.

### NSEC3-MISMATCHES-APEX-1
An NSEC3 zone. The hash owner name of the NSEC3 record is erroneous.

* Zone: nsec3-mismatches-apex-1.dnssec10.xa
  * The hash owner name of the NSEC3 record in response to the NSEC query is
    erroneous and does not match apex.

### NSEC3-MISSING-SIGNATURE-1
An NSEC3 zone. The RRSIG is missing

* Zone: nsec3-missing-signature-1.dnssec10.xa
  * There is no RRSIG for the NSEC3 record in the response with NSEC3 record.

### NSEC3-NODATA-MISSING-SOA-1
An NSEC3 zone. The SOA record is missing in the NODATA response.

* Zone: nsec3-nodata-missing-soa-1.dnssec10.xa
  * In the NODATA response to the NSEC query the SOA record is missing.

### NSEC3-NODATA-WRONG-SOA-1
An NSEC3 zone. In the NODATA response the SOA record has the wrong owner name.

* Zone: nsec3-nodata-wrong-soa-1.dnssec10.xa
  * The owner name of the SOA record in the NODATA response to the NSEC query
    is `sub.nsec3-nodata-wrong-soa-1.dnssec10.xa` instead of expected
    `nsec3-nodata-wrong-soa-1.dnssec10.xa`.

### NSEC3-NO-VERIFIED-SIGNATURE-1
An NSEC3 zone. The RRSIG for the NSEC3 record cannot be verified.

* Zone: nsec3-no-verified-signature-1.dnssec10.xa
  * The RRSIG record for the NSEC3 record in the NODATA response to the NSEC
    query cannot be verified.
    * There is no matching DNSKEY for the RRSIG for the NSEC3 record.

### NSEC3-NO-VERIFIED-SIGNATURE-2
An NSEC3 zone. The RRSIG for the NSEC3 record cannot be verified.

* Zone: nsec3-no-verified-signature-2.dnssec10.xa
  * The RRSIG record for the NSEC3 record in the NODATA response to the NSEC
    query cannot be verified.
    * The RRSIG has expired, i.e. the current date-time is beyond the last valid
      date-time.

### NSEC3-NO-VERIFIED-SIGNATURE-3
An NSEC3 zone. The RRSIG for the NSEC3 record cannot be verified.

* Zone: nsec3-no-verified-signature-3.dnssec10.xa
  * The RRSIG record for the NSEC3 record in the NODATA response to the NSEC
    query cannot be verified.
    * The RRSIG it not yet valid, i.e. the current date-time is before the first
      valid date-time.

### NSEC3-NO-VERIFIED-SIGNATURE-4
An NSEC3 zone. The RRSIG for the NSEC3 record cannot be verified.

* Zone: nsec3-no-verified-signature-4.dnssec10.xa
  * The RRSIG record for the NSEC3 record in the NODATA response to the NSEC
    query cannot be verified.
    * The RRSIG signature does not match the NSEC record and appointed DNSKEY.

### NSEC-ERR-TYPE-LIST-1
An NSEC zone. The type list of the NSEC record is erroneous.

* Zone: nsec-err-type-list-1.dnssec10.xa
  * The type list of the NSEC record includes NSEC3PARAM.

### NSEC-ERR-TYPE-LIST-2
An NSEC zone. The type list of the NSEC record is erroneous.

* Zone: nsec-err-type-list-2.dnssec10.xa
  * The type list of the NSEC record misses RRSIG.

### NSEC-GIVES-ERR-ANSWER-1
An NSEC zone. Error in response to NSEC query.

* Zone: nsec-gives-err-answer-1.dnssec10.xa
  * The zone gives a TXT record, but no NSEC record, in response to the NSEC
    query.

### NSEC-GIVES-ERR-ANSWER-2
An NSEC zone. Error in response to NSEC query on ns1. No NSEC or NSEC3 on ns2.

* Zone: nsec-gives-err-answer-2.dnssec10.xa
  * On ns1, the zone gives a TXT record, but no NSEC record, in response to the
    NSEC query.
  * On ns2, the zone gives NODATA responses without NSEC or NSEC3 record for both
    the NSEC3PARAM query and the NSEC query.

### NSEC-MISMATCHES-APEX-1
An NSEC zone. The owner name of the NSEC record is errouneous.

* Zone: nsec-mismatches-apex-1.dnssec10.xa
  * The owner name of the NSEC record in response to the NSEC3PARAM query is
    errouneous and does not match apex.
    * The owner name is `sub.nsec-mismatches-apex-1.dnssec10.xa` instead of
      expected `nsec-mismatches-apex-1.dnssec10.xa`.

### NSEC-MISMATCHES-APEX-2
An NSEC zone. The owner name of the NSEC record is errouneous.

* Zone: nsec-mismatches-apex-2.dnssec10.xa
  * The owner name of the NSEC record in response to the NSEC query is
    errouneous and does not match apex.
    * The owner name is `sub.nsec-mismatches-apex-2.dnssec10.xa` instead of
      expected `nsec-mismatches-apex-2.dnssec10.xa`.

### NSEC-MISSING-SIGNATURE-1
An NSEC zone. The RRSIG is missing.

* Zone: nsec-missing-signature-1.dnssec10.xa
  * There is no RRSIG for the NSEC record in the response with NSEC record on the
    NSEC3PARAM query.

### NSEC-NODATA-MISSING-SOA-1
An NSEC zone. The SOA record is missing in the NODATA response.

* Zone: nsec-nodata-missing-soa-1.dnssec10.xa
  * In the NODATA response to the NSEC3PARAM query the SOA record is missing.

### NSEC-NODATA-WRONG-SOA-1
An NSEC zone. In the NODATA response the SOA record has the wrong owner name.

* Zone: nsec-nodata-wrong-soa-1.dnssec10.xa
  * The owner name of the SOA record in the NODATA response to the NSEC3PARAM
    query is `sub.nsec-nodata-wrong-soa-1.dnssec10.xa` instead of expected
    `nsec-nodata-wrong-soa-1.dnssec10.xa`.

### NSEC-NO-VERIFIED-SIGNATURE-1
An NSEC zone. The RRSIG for the NSEC record cannot be verified.

* Zone: nsec-no-verified-signature-1.dnssec10.xa
  * The RRSIG record for the NSEC record in the NODATA response to the NSEC3PARAM
    query cannot be verified.
    * There is no matching DNSKEY for the RRSIG for that NSEC record.

### NSEC-NO-VERIFIED-SIGNATURE-2
An NSEC zone. The RRSIG for the NSEC record cannot be verified.

* Zone: nsec-no-verified-signature-2.dnssec10.xa
  * The RRSIG record for the NSEC record in the NODATA response to the NSEC3PARAM
    query cannot be verified.
    * The RRSIG has expired, i.e. the current date-time is beyond the last valid
      date-time.

### NSEC-NO-VERIFIED-SIGNATURE-3
An NSEC zone. The RRSIG for the NSEC record cannot be verified.

* Zone: nsec-no-verified-signature-3.dnssec10.xa
  * The RRSIG record for the NSEC record in the NODATA response to the NSEC3PARAM
    query cannot be verified.
    * The RRSIG it not yet valid, i.e. the current date-time is before the first
      valid date-time.

### NSEC-NO-VERIFIED-SIGNATURE-4
An NSEC zone. The RRSIG for the NSEC record cannot be verified.

* Zone: nsec-no-verified-signature-4.dnssec10.xa
  * The RRSIG record for the NSEC record in the NODATA response to the NSEC3PARAM
    query cannot be verified.
    * The RRSIG signature does not match the RRSIG record and appointed DNSKEY.

### NSEC-QUERY-RESPONSE-ERR-1
An NSEC zone. Error in response to NSEC query.

* Zone: nsec-query-response-err-1.dnssec10.xa
  * No DNS response on the NSEC query.

### NSEC-QUERY-RESPONSE-ERR-2
An NSEC zone. Error in response to NSEC query.

* Zone: nsec-query-response-err-2.dnssec10.xa
  * The response on the NSEC query has the [RCODE Name] "REFUSED".

### NSEC-QUERY-RESPONSE-ERR-3
An NSEC zone. Error in response to NSEC query on ns1. No NSEC or NSEC3 in
responses from ns2.

* Zone: nsec-query-response-err-3.dnssec10.xa
  * The response from ns1 on the NSEC query has the AA flag unset.
  * On ns2, the zone gives NODATA responses without NSEC or NSEC3 record for both
    the NSEC3PARAM query and the NSEC query.

### SERVER-NO-DNSSEC-1
An NSEC zone. No DNSKEY in response from ns1. Normal response from ns2.

* Zone: server-no-dnssec-1.dnssec10.xa
  * The answer section in response from ns1 on the DNSKEY query is empty. Unsigned
    NODATA response without NSEC or NSEC3.
  * The NSEC and NSEC3PARAM queries are irrelevant, but they also give a Unsigned
    NODATA response without NSEC or NSEC3 on ns1.

### SERVER-NO-DNSSEC-2
An NSEC3 zone. No DNSKEY in response from ns1. Normal response from ns2.

* Zone: server-no-dnssec-2.dnssec10.xa
  * The answer section in response from ns1 on the DNSKEY query is empty. Unsigned
    NODATA response without NSEC or NSEC3.
  * The NSEC and NSEC3PARAM queries are irrelevant, but they also give a Unsigned
    NODATA response without NSEC or NSEC3 on ns1.

### ZONE-NO-DNSSEC-1
No DNSKEY in response. 

* Zone: zone-no-dnssec-1.dnssec10.xa
  * The answer section in response on the DNSKEY query is empty. Unsigned NODATA
    response without NSEC or NSEC3.
  * The NSEC and NSEC3PARAM queries are irrelevant, but they also give a Unsigned
    NODATA response without NSEC or NSEC3.


[DNSSEC10]:                                                        ../../tests/DNSSEC-TP/dnssec10.md
[IANA registry]:                                                  https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xml
[RCODE Name]:                                                     https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6
[Test scenario README file]:                                      ../README.md
[Test scenarios and setup of test zones]:                         #test-scenarios-and-setup-of-test-zones

