Add an NSEC3PARAM RR to the apex of genzone.sh. Run the zonechecks system test. It prints a failure log message, but the test itself fails sometimes, passes sometimes. Mukund