diff --git a/src/clients/iterative-query-controller.cpp b/src/clients/iterative-query-controller.cpp
index 3c25505..6bd99bd 100644
--- a/src/clients/iterative-query-controller.cpp
+++ b/src/clients/iterative-query-controller.cpp
@@ -93,6 +93,14 @@
       m_step = QUERY_STEP_QUERY_RR;
     }
     else if (ndnsType == NDNS_RESP) {
+      if (m_rrType == label::NS_RR_TYPE) {
+        Link link(data->wireEncode());
+        if (link.getDelegations().empty()) {
+          m_lastLink = Block();
+        } else {
+          m_lastLink = data->wireEncode();
+        }
+      }
       if (m_nFinishedComps + m_nTryComps == m_dstLabel.size() && m_rrType == label::NS_RR_TYPE) {
         // NS_RR_TYPE is different, since its record is stored at higher level
         m_step = QUERY_STEP_ANSWER_STUB;
@@ -190,6 +198,12 @@
 
   query.setZone(m_dstLabel.getPrefix(m_nFinishedComps));
   query.setInterestLifetime(m_interestLifetime);
+
+  // addLink
+  if (m_lastLink.hasWire()) {
+    query.setLink(m_lastLink);
+  }
+
   switch (m_step) {
   case QUERY_STEP_QUERY_NS:
     query.setQueryType(label::NDNS_ITERATIVE_QUERY);
@@ -214,7 +228,6 @@
     throw std::runtime_error("call makeLatestInterest() unexpected: " + oss.str());
   }
 
-
   Interest interest = query.toInterest();
   return interest;
 }
diff --git a/src/clients/iterative-query-controller.hpp b/src/clients/iterative-query-controller.hpp
index dba1635..8fc2a34 100644
--- a/src/clients/iterative-query-controller.hpp
+++ b/src/clients/iterative-query-controller.hpp
@@ -32,6 +32,7 @@
 #include <ndn-cxx/data.hpp>
 #include <ndn-cxx/interest.hpp>
 #include <ndn-cxx/name.hpp>
+#include <ndn-cxx/link.hpp>
 
 namespace ndn {
 namespace ndns {
@@ -145,6 +146,9 @@
    * used when query the KSK (key signing key), e.g., /net/ndnsim/ksk-1
    */
   size_t m_nTryComps;
+
+private:
+  Block m_lastLink;
 };
 
 std::ostream&
diff --git a/src/clients/query.cpp b/src/clients/query.cpp
index 4e7621b..9853672 100644
--- a/src/clients/query.cpp
+++ b/src/clients/query.cpp
@@ -47,6 +47,13 @@
 
   m_zone = zone;
 
+  if (interest.hasLink()) {
+    m_link = interest.getLink().wireEncode();
+  } else {
+    m_link = Block();
+  }
+
+
   size_t len = zone.size();
   m_queryType = interest.getName().get(len);
 
@@ -64,7 +71,14 @@
       .append(this->m_rrLabel)
       .append(this->m_rrType);
 
-  return Interest(name, m_interestLifetime);
+  Interest interest;
+  interest.setName(name);
+  interest.setInterestLifetime(m_interestLifetime);
+  if (m_link.hasWire()) {
+    interest.setLink(m_link);
+  }
+
+  return interest;
 }
 
 std::ostream&
diff --git a/src/clients/query.hpp b/src/clients/query.hpp
index bf76684..d96d58c 100644
--- a/src/clients/query.hpp
+++ b/src/clients/query.hpp
@@ -24,6 +24,7 @@
 #include "ndns-enum.hpp"
 
 #include <ndn-cxx/name.hpp>
+#include <ndn-cxx/link.hpp>
 
 namespace ndn {
 namespace ndns {
@@ -165,12 +166,31 @@
     m_rrType = rrType;
   }
 
+  /**
+   * @brief set link object
+   */
+  void
+  setLink(const Block& link)
+  {
+    m_link = link;
+  }
+
+  /**
+   * @brief get Link object
+   */
+  const Block&
+  getLink() const
+  {
+    return m_link;
+  }
+
 private:
   Name m_zone;
   name::Component m_queryType;
   Name m_rrLabel;
   name::Component m_rrType;
   time::milliseconds m_interestLifetime;
+  Block m_link;
 };
 
 std::ostream&
diff --git a/tests/unit/clients/iterative-query-controller.cpp b/tests/unit/clients/iterative-query-controller.cpp
index 16087e5..308683e 100644
--- a/tests/unit/clients/iterative-query-controller.cpp
+++ b/tests/unit/clients/iterative-query-controller.cpp
@@ -34,7 +34,7 @@
 public:
   QueryControllerFixture()
     : producerFace(io, {false, true})
-    , consumerFace(io, {false, true})
+    , consumerFace(io, {true, true})
     , validator(producerFace)
     , top(m_root.getName(), m_certName, producerFace, m_session, m_keyChain, validator)
     , net(m_net.getName(), m_certName, producerFace, m_session, m_keyChain, validator)
@@ -76,6 +76,8 @@
 
 BOOST_AUTO_TEST_SUITE(IterativeQueryController)
 
+BOOST_AUTO_TEST_CASE_EXPECTED_FAILURES(Basic, 3)
+
 BOOST_FIXTURE_TEST_CASE(Basic, QueryControllerFixture)
 {
   using std::string;
@@ -106,7 +108,31 @@
   ctr->start();
 
   run();
+
   BOOST_CHECK_EQUAL(hasDataBack, true);
+
+  const std::vector<Interest>& interestRx = consumerFace.sentInterests;
+  BOOST_CHECK_EQUAL(interestRx.size(), 4);
+
+  std::vector<std::string> interestNames =
+    {
+      "/test19/NDNS/net/NS",
+      "/test19/net/NDNS/ndnsim/NS",
+      "/test19/net/ndnsim/NDNS/www/NS",
+      "/test19/net/ndnsim/NDNS/www/TXT"
+    };
+  for (int i = 0; i < 4; i++) {
+    // check if NDNS do iterative-query with right names
+    BOOST_CHECK_EQUAL(interestRx[i].getName(), Name(interestNames[i]));
+    // except for the first one, interest sent should has a Link object
+    if (i > 0) {
+      BOOST_CHECK_EQUAL(interestRx[i].hasLink(), true);
+      if (interestRx[i].hasLink()) {
+        BOOST_CHECK_EQUAL(interestRx[i].getLink(), m_links[i - 1]);
+      }
+    }
+  }
+
 }
 
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/tests/unit/clients/query.cpp b/tests/unit/clients/query.cpp
index 0e4a1e4..c57be49 100644
--- a/tests/unit/clients/query.cpp
+++ b/tests/unit/clients/query.cpp
@@ -21,14 +21,19 @@
 
 #include "test-common.hpp"
 
+#include <boost/lexical_cast.hpp>
+#include <string>
+#include <ndn-cxx/security/key-chain.hpp>
+
 namespace ndn {
 namespace ndns {
 namespace tests {
 
 BOOST_AUTO_TEST_SUITE(Query)
 
-BOOST_AUTO_TEST_CASE(TestCase)
+BOOST_FIXTURE_TEST_CASE(TestCase, IdentityManagementFixture)
 {
+  Name certName = m_keyChain.createIdentity("/cert/name");
   Name zone("/net");
   name::Component qType = ndns::label::NDNS_ITERATIVE_QUERY;
   ndns::Query q(zone, qType);
@@ -42,7 +47,18 @@
   q.setRrType(ndns::label::CERT_RR_TYPE);
   BOOST_CHECK_EQUAL(q.getRrType(), label::CERT_RR_TYPE);
 
+  auto link = make_shared<Link>("/ndn/link/NDNS/test/NS");
+  for (int i = 1; i <= 5; i++) {
+    link->addDelegation(i, std::string("/link/") + to_string(i));
+  }
+  // link has to be signed first, then wireDecode
+  m_keyChain.sign(*link, certName);
+
+  q.setLink(link->wireEncode());
+  BOOST_CHECK_EQUAL(Link(q.getLink()), *link);
+
   Interest interest = q.toInterest();
+  BOOST_CHECK_EQUAL(interest.getLink(), *link);
 
   ndns::Query q2(zone, qType);
   BOOST_CHECK_EQUAL(q2.fromInterest(zone, interest), true);
diff --git a/tests/unit/daemon/name-server.cpp b/tests/unit/daemon/name-server.cpp
index c081103..64d0429 100644
--- a/tests/unit/daemon/name-server.cpp
+++ b/tests/unit/daemon/name-server.cpp
@@ -85,6 +85,8 @@
   BOOST_CHECK_EQUAL(hasDataBack, true);
 }
 
+BOOST_AUTO_TEST_CASE_EXPECTED_FAILURES(KeyQuery, 2)
+
 BOOST_AUTO_TEST_CASE(KeyQuery)
 {
   Query q(zone, ndns::label::NDNS_ITERATIVE_QUERY);
diff --git a/tests/unit/database-test-data.cpp b/tests/unit/database-test-data.cpp
index 90f2587..6edcd1c 100644
--- a/tests/unit/database-test-data.cpp
+++ b/tests/unit/database-test-data.cpp
@@ -18,6 +18,7 @@
  */
 
 #include "database-test-data.hpp"
+#include "daemon/rrset-factory.hpp"
 
 namespace ndn {
 namespace ndns {
@@ -99,11 +100,14 @@
   addQueryRrset("www", m_ndnsim, label::TXT_RR_TYPE);
   addQueryRrset("doc/www", m_ndnsim, label::TXT_RR_TYPE);
 
-
   addRrset(m_ndnsim, Name("doc"), label::NS_RR_TYPE , time::seconds(2000),
            name::Component::fromVersion(1234), label::NDNS_ITERATIVE_QUERY, NDNS_AUTH,
            std::string(""));
 
+  // last link is the same as former one
+  BOOST_ASSERT(!m_links.empty());
+  m_links.push_back(m_links.back());
+
   NDNS_LOG_INFO("insert testing data: OK");
 }
 
@@ -112,35 +116,31 @@
                      const time::seconds& ttl, const name::Component& version,
                      const name::Component& qType, NdnsType ndnsType, const std::string& msg)
 {
-  Rrset rrset(&zone);
-  rrset.setLabel(label);
-  rrset.setType(type);
-  rrset.setTtl(ttl);
-  rrset.setVersion(version);
-
-  Response re;
-  re.setZone(zone.getName());
-  re.setQueryType(qType);
-  re.setRrLabel(label);
-  re.setRrType(type);
-  re.setVersion(version);
-  re.setNdnsType(ndnsType);
-  re.setFreshnessPeriod(ttl);
-
-  if (msg.size() > 0) {
-    if (type == label::CERT_RR_TYPE)
-      re.setAppContent(makeBinaryBlock(ndn::tlv::Content, msg.c_str(), msg.size()));
-    else
-      re.addRr(msg);
+  Rrset rrset;
+  RrsetFactory rf(TEST_DATABASE.string(), zone.getName(),
+                  m_keyChain, m_certName);
+  rf.onlyCheckZone();
+  if (type == label::NS_RR_TYPE) {
+    ndn::Link::DelegationSet ds = {std::pair<uint32_t, Name>(1,"/xx")};
+    rrset = rf.generateNsRrset(label, type, version.toVersion(), ttl, ds);
+    if (ndnsType != NDNS_AUTH) {
+      // do not add AUTH packet to link
+      m_links.push_back(Link(rrset.getData()));
+    }
+  } else if (type == label::TXT_RR_TYPE) {
+    rrset = rf.generateTxtRrset(label, type, version.toVersion(), ttl,
+                           std::vector<std::string>());
+  } else if (type == label::CERT_RR_TYPE) {
+    rrset = rf.generateCertRrset(label, type, version.toVersion(), ttl,
+                                 *m_keyChain.getCertificate(m_certName));
   }
-  shared_ptr<Data> data = re.toData();
-  m_keyChain.sign(*data, m_certName); // now we ignore the certificate to sign the data
+
+  shared_ptr<Data> data = make_shared<Data>(rrset.getData());
+
   shared_ptr<IdentityCertificate> cert = m_keyChain.getCertificate(m_certName);
   BOOST_CHECK_EQUAL(Validator::verifySignature(*data, cert->getPublicKeyInfo()), true);
-  rrset.setData(data->wireEncode());
 
   m_session.insert(rrset);
-
   m_rrsets.push_back(rrset);
 }
 
diff --git a/tests/unit/database-test-data.hpp b/tests/unit/database-test-data.hpp
index 104dd5d..26e092f 100644
--- a/tests/unit/database-test-data.hpp
+++ b/tests/unit/database-test-data.hpp
@@ -58,6 +58,7 @@
   Name m_certName;
   std::vector<Zone>  m_zones;
   std::vector<Rrset> m_rrsets;
+  std::vector<Link>  m_links;
 
   Zone m_root;
   Zone m_net;