$ apps/validate -o 7:stderr -r etc/resolv.conf -v etc/dnsval.conf -i etc/root.hints -F apps/selftests.dist -S : -T 87
Reading root hints from etc/root.hints
Done reading root hints
Reading resolver policy from etc/resolv.conf
Done reading resolver configuration
Reading validator policy from etc/dnsval.conf
Reading next policy fragment
Done reading validator configuration
Context created with etc/dnsval.conf etc/resolv.conf etc/root.hints
Suite '': Running 170 tests
87: Test Case 87: ****START****
val_resolve_and_check(): looking for {nosig-A.good-ns.test.dnssec-tools.org 1 1}
ask_cache(): looking for {nosig-A.good-ns.test.dnssec-tools.org IN(1) A(1)}
ask_resolver(): sending query for {nosig-A.good-ns.test.dnssec-tools.org 1 1}
nosig-A.good-ns.test.dnssec-tools.org requires DNSSEC
Setting D0 bit and using EDNS0
Sending query for nosig-A.good-ns.test.dnssec-tools.org to:
    192.168.1.7
End of Sending query for nosig-A.good-ns.test.dnssec-tools.org
nosig-A.good-ns.test.dnssec-tools.org requires DNSSEC
ask_resolver(): found matching ack/nack response for {nosig-A.good-ns.test.dnssec-tools.org 1 1}
nosig-A.good-ns.test.dnssec-tools.org requires DNSSEC
ask_cache(): looking for {nosig-A.good-ns.test.dnssec-tools.org IN(1) RRSIG(46)}
ask_resolver(): sending query for {nosig-A.good-ns.test.dnssec-tools.org 1 46}
nosig-A.good-ns.test.dnssec-tools.org requires DNSSEC
Setting D0 bit and using EDNS0
Sending query for nosig-A.good-ns.test.dnssec-tools.org to:
    192.168.1.7
End of Sending query for nosig-A.good-ns.test.dnssec-tools.org
nosig-A.good-ns.test.dnssec-tools.org requires DNSSEC
ask_resolver(): found matching ack/nack response for {nosig-A.good-ns.test.dnssec-tools.org 1 46}
ask_cache(): looking for {nosig-A.good-ns.test.dnssec-tools.org IN(1) SOA(6)}
ask_resolver(): sending query for {nosig-A.good-ns.test.dnssec-tools.org 1 6}
Not setting D0 bit nor using EDNS0
Sending query for nosig-A.good-ns.test.dnssec-tools.org to:
    192.168.1.7
End of Sending query for nosig-A.good-ns.test.dnssec-tools.org
nosig-A.good-ns.test.dnssec-tools.org requires DNSSEC
ask_resolver(): found matching ack/nack response for {nosig-A.good-ns.test.dnssec-tools.org 1 6}
proving non-existence for {nosig-A.good-ns.test.dnssec-tools.org, 1, 6}
ask_cache(): looking for {good-ns.test.dnssec-tools.org IN(1) SOA(6)}
ask_resolver(): sending query for {good-ns.test.dnssec-tools.org 1 6}
Not setting D0 bit nor using EDNS0
Sending query for good-ns.test.dnssec-tools.org to:
    192.168.1.7
End of Sending query for good-ns.test.dnssec-tools.org
good-ns.test.dnssec-tools.org requires DNSSEC
ask_resolver(): found matching ack/nack response for {good-ns.test.dnssec-tools.org 1 6}
proving non-existence for {nosig-A.good-ns.test.dnssec-tools.org, 1, 6}
ask_cache(): looking for {good-ns.test.dnssec-tools.org IN(1) DS(43)}
ask_resolver(): sending query for {good-ns.test.dnssec-tools.org 1 43}
good-ns.test.dnssec-tools.org requires DNSSEC
Setting D0 bit and using EDNS0
Sending query for good-ns.test.dnssec-tools.org to:
    192.168.1.7
End of Sending query for good-ns.test.dnssec-tools.org
good-ns.test.dnssec-tools.org requires DNSSEC
ask_resolver(): found matching ack/nack response for {good-ns.test.dnssec-tools.org 1 43}
good-ns.test.dnssec-tools.org requires DNSSEC
ask_cache(): looking for {test.dnssec-tools.org IN(1) DNSKEY(48)}
ask_resolver(): sending query for {test.dnssec-tools.org 1 48}
test.dnssec-tools.org requires DNSSEC
Setting D0 bit and using EDNS0
Sending query for test.dnssec-tools.org to:
    192.168.1.7
End of Sending query for test.dnssec-tools.org
test.dnssec-tools.org requires DNSSEC
ask_resolver(): found matching ack/nack response for {test.dnssec-tools.org 1 48}
test.dnssec-tools.org requires DNSSEC
key test.dnssec-tools.org is trusted
proving non-existence for {nosig-A.good-ns.test.dnssec-tools.org, 1, 6}
verifying next assertion: {good-ns.test.dnssec-tools.org, 1, 43}
rsasha1_sigverify(): parsing the public key...

rsasha1_sigverify(): SHA-1 hash = 0xc5c1bc86050b106c78caee26497cf6cdf9d1b890
rsasha1_sigverify(): verifying RSA signature...

RSA_verify returned SUCCESS

Cannot show that nosig-A.good-ns.test.dnssec-tools.org is provably unsecure.
Test Case 87:   OK
  Result: VAL_BOGUS:2
    name=nosig-A.good-ns.test.dnssec-tools.org class=IN type=A from-server=192.168.1.7 status=VAL_AC_RRSIG_MISSING:14
Test Case 87: ****END****