(dig +dnssec +norec soa $zone @$server) expect: status: NOERROR expect: SOA record to be present expect: OPT record to be present expect: EDNS Version 0 in response expect: DO flag in response if RRSIG is present in response See RFC3225