diff --git a/src/clients/iterative-query-controller.cpp b/src/clients/iterative-query-controller.cpp
index 2b56426..442f9dc 100644
--- a/src/clients/iterative-query-controller.cpp
+++ b/src/clients/iterative-query-controller.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2017, Regents of the University of California.
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -68,11 +68,22 @@
 
   NDNS_LOG_TRACE("[* -> *] get a " << contentType
                  << " Response: " << data.getName());
-  if (m_validator == nullptr) {
-    this->onDataValidated(data, contentType);
+
+  const Data* toBeValidatedData = nullptr;
+  if (contentType == NDNS_NACK) {
+    m_doe = Data(data.getContent().blockFromValue());
+    toBeValidatedData = &m_doe;
+    contentType = NDNS_DOE;
   }
   else {
-    m_validator->validate(data,
+    toBeValidatedData = &data;
+  }
+
+  if (m_validator == nullptr) {
+    this->onDataValidated(*toBeValidatedData, contentType);
+  }
+  else {
+    m_validator->validate(*toBeValidatedData,
                           bind(&IterativeQueryController::onDataValidated, this, _1, contentType),
                           [this] (const Data& data, const security::v2::ValidationError& err) {
                             NDNS_LOG_WARN("data: " << data.getName() << " fails verification");
@@ -81,6 +92,7 @@
                           );
   }
 }
+
 void
 IterativeQueryController::onDataValidated(const Data& data, NdnsContentType contentType)
 {
@@ -90,8 +102,18 @@
 
   switch (m_step) {
   case QUERY_STEP_QUERY_NS:
-    if (contentType == NDNS_NACK) {
-      m_step = QUERY_STEP_QUERY_RR;
+    if (contentType == NDNS_DOE) {
+      // check if requested record is absent by looking up in doe
+      if (isAbsentByDoe(data)) {
+        m_step = QUERY_STEP_QUERY_RR;
+      }
+      else {
+        std::ostringstream oss;
+        oss << "In onDataValidated, absence of record can not be infered from DoE.";
+        oss << " Last query:" << m_lastLabelType << " ";
+        oss << *this;
+        BOOST_THROW_EXCEPTION(std::runtime_error(oss.str()));
+      }
     }
     else if (contentType == NDNS_LINK) {
       Link link(data.wireEncode());
@@ -236,10 +258,27 @@
                                              + oss.str()));
   }
 
+  m_lastLabelType = Name(query.getRrLabel()).append(query.getRrType());
   Interest interest = query.toInterest();
   return interest;
 }
 
+bool
+IterativeQueryController::isAbsentByDoe(const Data& data) const
+{
+  std::pair<Name, Name> range = Response::wireDecodeDoe(data.getContent());
+
+  // should not be simple <, use our own definition of compare
+  if (range.first < m_lastLabelType && m_lastLabelType < range.second) {
+    return true;
+  }
+  if (range.second < range.first &&
+      (m_lastLabelType < range.first || range.second < m_lastLabelType)) {
+    return true;
+  }
+  return false;
+}
+
 std::ostream&
 operator<<(std::ostream& os, const IterativeQueryController::QueryStep step)
 {
diff --git a/src/clients/iterative-query-controller.hpp b/src/clients/iterative-query-controller.hpp
index 83bf856..a04424e 100644
--- a/src/clients/iterative-query-controller.hpp
+++ b/src/clients/iterative-query-controller.hpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2017, Regents of the University of California.
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -79,6 +79,11 @@
   void
   onData(const ndn::Interest& interest, const Data& data);
 
+  /**
+   * @brief called when any data are validated.
+   * It will unwrap the NACK record,
+   * so onSucceed callback will be called with only inner DoE
+   */
   void
   onDataValidated(const Data& data, NdnsContentType contentType);
 
@@ -130,6 +135,10 @@
     return m_nTryComps;
   }
 
+private:
+  bool
+  isAbsentByDoe(const Data& data) const;
+
 protected:
   security::v2::Validator* m_validator;
   /**
@@ -151,6 +160,8 @@
 
 private:
   Block m_lastLink;
+  Data m_doe;
+  Name m_lastLabelType;
   ndn::InMemoryStorage* m_nsCache;
 };
 
diff --git a/src/clients/response.cpp b/src/clients/response.cpp
index a23bc3c..5f223d3 100644
--- a/src/clients/response.cpp
+++ b/src/clients/response.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2017, Regents of the University of California.
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -93,6 +93,16 @@
   }
 }
 
+std::pair<Name, Name>
+Response::wireDecodeDoe(const Block& wire)
+{
+  wire.parse();
+  if (wire.elements().size() != 2) {
+    BOOST_THROW_EXCEPTION(Error("Unexpected number of components while decoding DOE record"));
+  }
+  return std::make_pair(Name(wire.elements().front()), Name(wire.elements().back()));
+}
+
 bool
 Response::fromData(const Name& zone, const Data& data)
 {
diff --git a/src/clients/response.hpp b/src/clients/response.hpp
index a33e42a..a97fb76 100644
--- a/src/clients/response.hpp
+++ b/src/clients/response.hpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2017, Regents of the University of California.
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -40,7 +40,7 @@
 /**
  * @brief Default life time of resource record
  */
-const time::seconds DEFAULT_RR_FRESHNESS_PERIOD(3600);
+const time::seconds DEFAULT_RR_FRESHNESS_PERIOD = 3600_s;
 
 
 /**
@@ -50,6 +50,12 @@
 class Response
 {
 public:
+  class Error : public ndn::tlv::Error
+  {
+  public:
+    using ndn::tlv::Error::Error;
+  };
+
   Response();
 
   Response(const Name& zone, const name::Component& queryType);
@@ -112,6 +118,9 @@
   size_t
   wireEncode(EncodingImpl<T>& block) const;
 
+  static std::pair<Name, Name>
+  wireDecodeDoe(const Block& wire);
+
 public:
   ///////////////////////////////////////////////
   // getter and setter
diff --git a/src/daemon/db-mgr.cpp b/src/daemon/db-mgr.cpp
index b925f2d..5652de2 100644
--- a/src/daemon/db-mgr.cpp
+++ b/src/daemon/db-mgr.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2017, Regents of the University of California.
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -125,6 +125,37 @@
   NDNS_LOG_INFO("clear all the data in the database: " << m_dbFile);
 }
 
+
+void
+DbMgr::saveName(const Name& name, sqlite3_stmt* stmt, int iCol, bool isStatic)
+{
+  const Block& wire = name.wireEncode();
+  sqlite3_bind_blob(stmt, iCol, wire.value(), wire.value_size(), isStatic ? SQLITE_STATIC : SQLITE_TRANSIENT);
+}
+
+Name
+DbMgr::restoreName(sqlite3_stmt* stmt, int iCol)
+{
+  Name name;
+
+  const uint8_t* buffer = static_cast<const uint8_t*>(sqlite3_column_blob(stmt, iCol));
+  size_t nBytesLeft = sqlite3_column_bytes(stmt, iCol);
+
+  while (nBytesLeft > 0) {
+    bool hasDecodingSucceeded;
+    name::Component component;
+    std::tie(hasDecodingSucceeded, component) = Block::fromBuffer(buffer, nBytesLeft);
+    if (!hasDecodingSucceeded) {
+      BOOST_THROW_EXCEPTION(Error("Error while decoding name from the database"));
+    }
+    name.append(component);
+    buffer += component.size();
+    nBytesLeft -= component.size();
+  }
+
+  return name;
+}
+
 ///////////////////////////////////////////////////////////////////////////////////////////////////
 // Zone
 ///////////////////////////////////////////////////////////////////////////////////////////////////
@@ -142,8 +173,8 @@
     BOOST_THROW_EXCEPTION(PrepareError(sql));
   }
 
-  const Block& zoneName = zone.getName().wireEncode();
-  sqlite3_bind_blob(stmt, 1, zoneName.wire(), zoneName.size(), SQLITE_STATIC);
+
+  saveName(zone.getName(), stmt, 1);
   sqlite3_bind_int(stmt,  2, zone.getTtl().count());
 
   rc = sqlite3_step(stmt);
@@ -233,8 +264,7 @@
     BOOST_THROW_EXCEPTION(PrepareError(sql));
   }
 
-  const Block& zoneName = zone.getName().wireEncode();
-  sqlite3_bind_blob(stmt, 1, zoneName.wire(), zoneName.size(), SQLITE_STATIC);
+  saveName(zone.getName(), stmt, 1);
 
   if (sqlite3_step(stmt) == SQLITE_ROW) {
     zone.setId(sqlite3_column_int64(stmt, 0));
@@ -266,8 +296,7 @@
     Zone& zone = vec.back();
     zone.setId(sqlite3_column_int64(stmt, 0));
     zone.setTtl(time::seconds(sqlite3_column_int(stmt, 2)));
-    zone.setName(Name(Block(static_cast<const uint8_t*>(sqlite3_column_blob(stmt, 1)),
-                            sqlite3_column_bytes(stmt, 1))));
+    zone.setName(restoreName(stmt, 1));
   }
   sqlite3_finalize(stmt);
 
@@ -331,8 +360,7 @@
 
   sqlite3_bind_int64(stmt, 1, rrset.getZone()->getId());
 
-  const Block& label = rrset.getLabel().wireEncode();
-  sqlite3_bind_blob(stmt,  2, label.wire(),              label.size(),              SQLITE_STATIC);
+  saveName(rrset.getLabel(), stmt, 2);
   sqlite3_bind_blob(stmt,  3, rrset.getType().wire(),    rrset.getType().size(),    SQLITE_STATIC);
   sqlite3_bind_blob(stmt,  4, rrset.getVersion().wire(), rrset.getVersion().size(), SQLITE_STATIC);
   sqlite3_bind_int64(stmt, 5, rrset.getTtl().count());
@@ -374,8 +402,52 @@
 
   sqlite3_bind_int64(stmt, 1, rrset.getZone()->getId());
 
-  const Block& label = rrset.getLabel().wireEncode();
-  sqlite3_bind_blob(stmt, 2, label.wire(), label.size(), SQLITE_STATIC);
+  saveName(rrset.getLabel(), stmt, 2);
+  sqlite3_bind_blob(stmt, 3, rrset.getType().wire(), rrset.getType().size(), SQLITE_STATIC);
+
+  if (sqlite3_step(stmt) == SQLITE_ROW) {
+    rrset.setId(sqlite3_column_int64(stmt, 0));
+    rrset.setTtl(time::seconds(sqlite3_column_int64(stmt, 1)));
+    rrset.setVersion(Block(static_cast<const uint8_t*>(sqlite3_column_blob(stmt, 2)),
+                           sqlite3_column_bytes(stmt, 2)));
+    rrset.setData(Block(static_cast<const uint8_t*>(sqlite3_column_blob(stmt, 3)),
+                        sqlite3_column_bytes(stmt, 3)));
+  }
+  else {
+    rrset.setId(0);
+  }
+  sqlite3_finalize(stmt);
+
+  return rrset.getId() != 0;
+}
+
+bool
+DbMgr::findLowerBound(Rrset& rrset)
+{
+  if (rrset.getZone() == 0) {
+    BOOST_THROW_EXCEPTION(RrsetError("Rrset has not been assigned to a zone"));
+  }
+
+  if (rrset.getZone()->getId() == 0) {
+    bool isFound = find(*rrset.getZone());
+    if (!isFound) {
+      return false;
+    }
+  }
+
+  sqlite3_stmt* stmt;
+  const char* sql =
+    "SELECT id, ttl, version, data FROM rrsets"
+    "    WHERE zone_id=? and label<? and type=? ORDER BY label DESC";
+  int rc = sqlite3_prepare_v2(m_conn, sql, -1, &stmt, 0);
+
+  if (rc != SQLITE_OK) {
+    BOOST_THROW_EXCEPTION(PrepareError(sql));
+  }
+
+  sqlite3_bind_int64(stmt, 1, rrset.getZone()->getId());
+
+  saveName(rrset.getLabel(), stmt, 2);
   sqlite3_bind_blob(stmt, 3, rrset.getType().wire(), rrset.getType().size(), SQLITE_STATIC);
 
   if (sqlite3_step(stmt) == SQLITE_ROW) {
@@ -406,7 +478,7 @@
   std::vector<Rrset> vec;
   sqlite3_stmt* stmt;
   const char* sql = "SELECT id, ttl, version, data, label, type "
-                    "FROM rrsets where zone_id=? ";
+                    "FROM rrsets where zone_id=? ORDER BY label";
 
   int rc = sqlite3_prepare_v2(m_conn, sql, -1, &stmt, 0);
   if (rc != SQLITE_OK) {
@@ -424,8 +496,7 @@
                            sqlite3_column_bytes(stmt, 2)));
     rrset.setData(Block(static_cast<const uint8_t*>(sqlite3_column_blob(stmt, 3)),
                         sqlite3_column_bytes(stmt, 3)));
-    rrset.setLabel(Name(Block(static_cast<const uint8_t*>(sqlite3_column_blob(stmt, 4)),
-                         sqlite3_column_bytes(stmt, 4))));
+    rrset.setLabel(restoreName(stmt, 4));
     rrset.setType(Block(static_cast<const uint8_t*>(sqlite3_column_blob(stmt, 5)),
                   sqlite3_column_bytes(stmt, 5)));
   }
@@ -434,6 +505,33 @@
   return vec;
 }
 
+void
+DbMgr::removeRrsetsOfZoneByType(Zone& zone, const name::Component& type)
+{
+  if (zone.getId() == 0)
+    find(zone);
+
+  if (zone.getId() == 0)
+    BOOST_THROW_EXCEPTION(RrsetError("Attempting to find all the rrsets with a zone does not in the database"));
+
+  sqlite3_stmt* stmt;
+  const char* sql = "DELETE FROM rrsets WHERE zone_id = ? AND type = ?";
+  int rc = sqlite3_prepare_v2(m_conn, sql, -1, &stmt, 0);
+
+  if (rc != SQLITE_OK) {
+    BOOST_THROW_EXCEPTION(PrepareError(sql));
+  }
+
+  sqlite3_bind_int64(stmt, 1, zone.getId());
+  sqlite3_bind_blob(stmt,  2, type.wire(), type.size(), SQLITE_STATIC);
+
+  rc = sqlite3_step(stmt);
+  if (rc != SQLITE_DONE) {
+    sqlite3_finalize(stmt);
+    BOOST_THROW_EXCEPTION(ExecuteError(sql));
+  }
+  sqlite3_finalize(stmt);
+}
 
 void
 DbMgr::remove(Rrset& rrset)
diff --git a/src/daemon/db-mgr.hpp b/src/daemon/db-mgr.hpp
index 04b9672..ff0066e 100644
--- a/src/daemon/db-mgr.hpp
+++ b/src/daemon/db-mgr.hpp
@@ -166,6 +166,20 @@
   find(Rrset& rrset);
 
   /**
+   * @brief get the data from db according to `m_zone`, `m_label`, `m_type`.
+   *
+   * The lower bound rrset is the largest label that is less than rrset's label
+   * If record exists, `m_ttl`, `m_version` and `m_data` is set
+   *
+   * @pre m_rrset.getZone().getId() > 0
+   * @post whatever the previous id is,
+   *       m_rrset.getId() > 0 if record exists, otherwise m_rrset.getId() == 0
+   * @return true if the record exist
+   */
+  bool
+  findLowerBound(Rrset& rrset);
+
+  /**
    * @brief get all the rrsets which is stored at given zone
    * @throw RrsetError() if zone does not exist in the database
    * @note if zone.getId() == 0, the function setId for the zone automatically
@@ -183,6 +197,13 @@
   remove(Rrset& rrset);
 
   /**
+   * @brief remove all records of a specific type in a zone
+   */
+  void
+  removeRrsetsOfZoneByType(Zone& zone,
+                           const name::Component& type);
+
+  /**
    * @brief replace ttl, version, and Data with new values
    * @pre m_rrset.getId() > 0
    */
@@ -199,6 +220,19 @@
   }
 
 private:
+  /**
+   * @brief Save @p name to the database in the internal sortable format
+   *
+   * If @p name is not preserved until @p stmt is executed, @p isStatic must be
+   * set to `false`.
+   */
+  void
+  saveName(const Name& name, sqlite3_stmt* stmt, int iCol, bool isStatic = true);
+
+  Name
+  restoreName(sqlite3_stmt* stmt, int iCol);
+
+private:
   std::string m_dbFile;
   sqlite3* m_conn;
 };
diff --git a/src/daemon/name-server.cpp b/src/daemon/name-server.cpp
index 11ad3a8..c7649ef 100644
--- a/src/daemon/name-server.cpp
+++ b/src/daemon/name-server.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2017, Regents of the University of California.
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -91,14 +91,24 @@
     m_face.put(*answer);
   }
   else {
-    // no record, construct NACK
     Name name = interest.getName();
     name.appendVersion();
     shared_ptr<Data> answer = make_shared<Data>(name);
+    Rrset doe(&m_zone);
+    // currently, there is only one DoE record contains everything
+    doe.setLabel(Name(re.rrLabel).append(re.rrType));
+    doe.setType(label::DOE_RR_TYPE);
+    if (!m_dbMgr.findLowerBound(doe)) {
+        NDNS_LOG_FATAL("fail to find DoE record of zone:" + m_zone.getName().toUri());
+        BOOST_THROW_EXCEPTION(std::runtime_error("fail to find DoE record of zone:" + m_zone.getName().toUri()));
+    }
+
+    answer->setContent(doe.getData());
     answer->setFreshnessPeriod(this->getContentFreshness());
     answer->setContentType(NDNS_NACK);
+    // give this NACk a random signature
+    m_keyChain.sign(*answer);
 
-    m_keyChain.sign(*answer, signingByCertificate(m_certName));
     NDNS_LOG_TRACE("answer query with NDNS-NACK: " << answer->getName());
     m_face.put(*answer);
   }
diff --git a/src/daemon/rrset-factory.cpp b/src/daemon/rrset-factory.cpp
index 4351fcd..3bfca03 100644
--- a/src/daemon/rrset-factory.cpp
+++ b/src/daemon/rrset-factory.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2017, Regents of the University of California.
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -77,7 +77,7 @@
 std::pair<Rrset, Name>
 RrsetFactory::generateBaseRrset(const Name& label,
                                 const name::Component& type,
-                                const uint64_t version,
+                                uint64_t version,
                                 const time::seconds& ttl)
 {
   Rrset rrset(&m_zone);
@@ -117,7 +117,7 @@
 
 Rrset
 RrsetFactory::generateNsRrset(const Name& label,
-                              const uint64_t version,
+                              uint64_t version,
                               time::seconds ttl,
                               const ndn::DelegationList& delegations)
 {
@@ -144,7 +144,7 @@
 
 Rrset
 RrsetFactory::generateTxtRrset(const Name& label,
-                               const uint64_t version,
+                               uint64_t version,
                                time::seconds ttl,
                                const std::vector<std::string>& strings)
 {
@@ -178,7 +178,7 @@
 
 Rrset
 RrsetFactory::generateCertRrset(const Name& label,
-                                const uint64_t version,
+                                uint64_t version,
                                 time::seconds ttl,
                                 const ndn::security::v2::Certificate& cert)
 {
@@ -205,7 +205,7 @@
 
 Rrset
 RrsetFactory::generateAuthRrset(const Name& label,
-                                const uint64_t version,
+                                uint64_t version,
                                 time::seconds ttl)
 {
   if (!m_checked) {
@@ -228,6 +228,39 @@
   return rrset;
 }
 
+Rrset
+RrsetFactory::generateDoeRrset(const Name& label,
+                               uint64_t version,
+                               time::seconds ttl,
+                               const Name& lowerLabel,
+                               const Name& upperLabel)
+{
+  if (!m_checked) {
+    BOOST_THROW_EXCEPTION(Error("You have to call checkZoneKey before call generate functions"));
+  }
+
+  if (ttl == DEFAULT_RR_TTL)
+    ttl = m_zone.getTtl();
+
+  Name name;
+  Rrset rrset;
+  std::tie(rrset, name) = generateBaseRrset(label, label::DOE_RR_TYPE, version, ttl);
+
+  std::vector<Block> range;
+  range.push_back(lowerLabel.wireEncode());
+  range.push_back(upperLabel.wireEncode());
+
+  Data data(name);
+  data.setContent(wireEncode(range));
+
+  setContentType(data, NDNS_DOE, ttl);
+  sign(data);
+  rrset.setData(data.wireEncode());
+
+  return rrset;
+}
+
+
 void
 RrsetFactory::sign(Data& data)
 {
diff --git a/src/daemon/rrset-factory.hpp b/src/daemon/rrset-factory.hpp
index 59b3b09..e8babc7 100644
--- a/src/daemon/rrset-factory.hpp
+++ b/src/daemon/rrset-factory.hpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2017, Regents of the University of California.
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -61,27 +61,38 @@
 
   Rrset
   generateNsRrset(const Name& label,
-                  const uint64_t version,
+                  uint64_t version,
                   time::seconds ttl,
                   const ndn::DelegationList& delegations);
 
   Rrset
   generateTxtRrset(const Name& label,
-                   const uint64_t version,
+                   uint64_t version,
                    time::seconds ttl,
                    const std::vector<std::string>& contents);
 
   Rrset
   generateAuthRrset(const Name& label,
-                    const uint64_t version,
+                    uint64_t version,
                     time::seconds ttl);
 
   Rrset
   generateCertRrset(const Name& label,
-                    const uint64_t version,
+                    uint64_t version,
                     time::seconds ttl,
                     const ndn::security::v2::Certificate& cert);
 
+  /**
+   * @brief DoE records are just txt records of all entries of a zone
+   * which means the any range showed in this record does not exist
+   */
+  Rrset
+  generateDoeRrset(const Name& label,
+                   uint64_t version,
+                   time::seconds ttl,
+                   const Name& lowerLabel,
+                   const Name& upperLabel);
+
   static std::vector<std::string>
   wireDecodeTxt(const Block& wire);
 
@@ -94,7 +105,7 @@
   std::pair<Rrset, Name>
   generateBaseRrset(const Name& label,
                     const name::Component& type,
-                    const uint64_t version,
+                    uint64_t version,
                     const time::seconds& ttl);
 
   bool
diff --git a/src/daemon/rrset.cpp b/src/daemon/rrset.cpp
index 96ffce7..75c4d81 100644
--- a/src/daemon/rrset.cpp
+++ b/src/daemon/rrset.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
-/**
- * Copyright (c) 2014, Regents of the University of California.
+/*
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -57,5 +57,25 @@
 
 }
 
+bool
+Rrset::operator<(const Rrset& other) const
+{
+  if (getZone() != other.getZone() ||
+      (getZone() != nullptr && *getZone() != *other.getZone())) {
+    BOOST_THROW_EXCEPTION(std::runtime_error("Cannot compare Rrset that belong to different zones"));
+  }
+
+  bool isLess = getLabel() < other.getLabel();
+  if (!isLess && getLabel() == other.getLabel()) {
+    isLess = getType() < other.getType();
+
+    if (!isLess && getType() == other.getType()) {
+      isLess = getVersion() < other.getVersion();
+    }
+  }
+  return isLess;
+}
+
+
 } // namespace ndns
 } // namespace ndn
diff --git a/src/daemon/rrset.hpp b/src/daemon/rrset.hpp
index aaedcfe..0e4b883 100644
--- a/src/daemon/rrset.hpp
+++ b/src/daemon/rrset.hpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
-/**
- * Copyright (c) 2014, Regents of the University of California.
+/*
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -187,6 +187,9 @@
     return !(*this == other);
   }
 
+  bool
+  operator<(const Rrset& other) const;
+
 private:
   uint64_t m_id;
   Zone* m_zone;
diff --git a/src/mgmt/management-tool.cpp b/src/mgmt/management-tool.cpp
index 8d01211..5407427 100644
--- a/src/mgmt/management-tool.cpp
+++ b/src/mgmt/management-tool.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2017, Regents of the University of California.
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -186,6 +186,7 @@
   NDNS_LOG_INFO("Start saving DKEY certificate id to ZoneInfo");
   m_dbMgr.setZoneInfo(zone, "dkey", dkeyCert.wireEncode());
 
+  generateDoe(zone);
   return zone;
 }
 
@@ -293,6 +294,7 @@
   checkRrsetVersion(rrset);
   NDNS_LOG_INFO("Adding " << rrset);
   m_dbMgr.insert(rrset);
+  generateDoe(*rrset.getZone());
 }
 
 void
@@ -310,6 +312,7 @@
   checkRrsetVersion(rrset);
   NDNS_LOG_INFO("Added " << rrset);
   m_dbMgr.insert(rrset);
+  generateDoe(*rrset.getZone());
 }
 
 void
@@ -384,6 +387,7 @@
   checkRrsetVersion(rrset);
   NDNS_LOG_INFO("Adding rrset from file " << rrset);
   m_dbMgr.insert(rrset);
+  generateDoe(*rrset.getZone());
 }
 
 security::v2::Certificate
@@ -552,6 +556,7 @@
   NDNS_LOG_INFO("Remove rrset with zone-id: " << zone.getId() << " label: " << label << " type: "
                 << type);
   m_dbMgr.remove(rrset);
+  generateDoe(zone);
 }
 
 void
@@ -651,5 +656,51 @@
   }
 }
 
+void
+ManagementTool::generateDoe(Zone& zone)
+{
+  // check zone existence
+  if (!m_dbMgr.find(zone)) {
+    BOOST_THROW_EXCEPTION(Error(zone.getName().toUri() + " is not presented in the NDNS db"));
+  }
+
+  // remove all the Doe records
+  m_dbMgr.removeRrsetsOfZoneByType(zone, label::DOE_RR_TYPE);
+
+  // get the records out
+  std::vector<Rrset> allRecords = m_dbMgr.findRrsets(zone);
+
+  // sort them by DoE label name (same as in the database)
+  std::sort(allRecords.begin(), allRecords.end());
+
+  RrsetFactory factory(m_dbMgr.getDbFile(), zone.getName(), m_keyChain, DEFAULT_CERT);
+  factory.checkZoneKey();
+
+  for (size_t i = 0; i < allRecords.size() - 1; i++) {
+    Name lowerLabel = Name(allRecords[i].getLabel()).append(allRecords[i].getType());
+    Name upperLabel = Name(allRecords[i + 1].getLabel()).append(allRecords[i + 1].getType());
+    Rrset doe = factory.generateDoeRrset(lowerLabel,
+                                         VERSION_USE_UNIX_TIMESTAMP,
+                                         DEFAULT_CACHE_TTL, lowerLabel, upperLabel);
+    m_dbMgr.insert(doe);
+  }
+
+  Name lastLabel = Name(allRecords.back().getLabel()).append(allRecords.back().getType());
+  Name firstLabel = Name(allRecords.front().getLabel()).append(allRecords.front().getType());
+  Rrset lastRange = factory.generateDoeRrset(lastLabel,
+                                             VERSION_USE_UNIX_TIMESTAMP,
+                                             DEFAULT_CACHE_TTL, lastLabel, firstLabel);
+  m_dbMgr.insert(lastRange);
+
+  // This guard will be the lowest label-ranked record
+  // so if requested label+type is less than the lowest label except for this one, it will be choosed
+  // by findLowerBound. This small trick avoids complicated SQL query in findLowerBound
+  Rrset guardRange = factory.generateDoeRrset(Name(""),
+                                              VERSION_USE_UNIX_TIMESTAMP,
+                                              DEFAULT_CACHE_TTL, lastLabel, firstLabel);
+  m_dbMgr.insert(guardRange);
+  NDNS_LOG_INFO("DoE record updated");
+}
+
 } // namespace ndns
 } // namespace ndn
diff --git a/src/mgmt/management-tool.hpp b/src/mgmt/management-tool.hpp
index 715ee18..a113ee9 100644
--- a/src/mgmt/management-tool.hpp
+++ b/src/mgmt/management-tool.hpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2017, Regents of the University of California.
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -252,6 +252,11 @@
   void
   checkRrsetVersion(const Rrset& rrset);
 
+  /**
+     @brief generate all Doe records
+   */
+  void generateDoe(Zone& zone);
+
 private:
   KeyChain& m_keyChain;
   DbMgr m_dbMgr;
diff --git a/src/ndns-enum.cpp b/src/ndns-enum.cpp
index 383eb95..37a5b7d 100644
--- a/src/ndns-enum.cpp
+++ b/src/ndns-enum.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
-/**
- * Copyright (c) 2014-2016, Regents of the University of California.
+/*
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -35,6 +35,9 @@
   case NDNS_NACK:
     os << "NACK";
     break;
+  case NDNS_DOE:
+    os << "DOE";
+    break;
   case NDNS_KEY:
     os << "KEY";
     break;
diff --git a/src/ndns-enum.hpp b/src/ndns-enum.hpp
index 89ad87d..eb4ea35 100644
--- a/src/ndns-enum.hpp
+++ b/src/ndns-enum.hpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
-/**
- * Copyright (c) 2014-2016, Regents of the University of California.
+/*
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -34,6 +34,7 @@
   NDNS_LINK = ndn::tlv::ContentType_Link,
   NDNS_KEY  = ndn::tlv::ContentType_Key,
   NDNS_NACK = ndn::tlv::ContentType_Nack,
+  NDNS_DOE  = 1085,
   NDNS_AUTH = 1086, ///< only has RR for detailed (longer) label
   NDNS_RESP = 1087, ///< response type means there are requested RR
   NDNS_UNKNOWN = 1088,  ///< this is not a real type, just mean that contentType is unknown
diff --git a/src/ndns-label.hpp b/src/ndns-label.hpp
index 8ce7d34..076d06c 100644
--- a/src/ndns-label.hpp
+++ b/src/ndns-label.hpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2017, Regents of the University of California.
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -74,6 +74,10 @@
  */
 const name::Component TXT_RR_TYPE("TXT");
 
+/**
+ * @brief Denial of Existance record type
+ */
+const name::Component DOE_RR_TYPE("DOE");
 
 //////////////////////////////////////////
 
@@ -115,7 +119,6 @@
           const Name& zone,
           MatchResult& result);
 
-
 } // namespace label
 } // namespace ndns
 } // namespace ndn
diff --git a/tests/unit/daemon/rrset.cpp b/tests/unit/daemon/rrset.cpp
index c71fe0b..d202e78 100644
--- a/tests/unit/daemon/rrset.cpp
+++ b/tests/unit/daemon/rrset.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
-/**
- * Copyright (c) 2014-2016, Regents of the University of California.
+/*
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -50,6 +50,9 @@
   // rrset2.setZone(nullptr);
   BOOST_CHECK_EQUAL(rrset1, rrset2); // zone point to nullptr
 
+  bool isLess = rrset1 < rrset2;
+  BOOST_CHECK_EQUAL(isLess, false);
+
   rrset2.setId(2);
   BOOST_CHECK_EQUAL(rrset1, rrset2); // with different Id
 
@@ -58,9 +61,14 @@
   rrset2.setZone(&zone);
   BOOST_CHECK_NE(rrset1, rrset2); // with different zone name
 
+  BOOST_CHECK_THROW(isLess = rrset1 < rrset2, std::runtime_error);
+
   rrset1.setZone(&zone);
   BOOST_CHECK_EQUAL(rrset1, rrset2);
 
+  isLess = rrset1 < rrset2;
+  BOOST_CHECK_EQUAL(isLess, false);
+
   Zone zone3("/ndn");
   rrset1.setZone(&zone3);
   BOOST_CHECK_EQUAL(rrset1, rrset2);
@@ -71,14 +79,26 @@
   rrset2 = rrset1;
   rrset2.setLabel(Name("/www/2"));
   BOOST_CHECK_NE(rrset1, rrset2);
+
+  isLess = rrset1 < rrset2;
+  BOOST_CHECK_EQUAL(isLess, true);
+
   rrset2 = rrset1;
 
   rrset2.setType(name::Component("TXT"));
   BOOST_CHECK_NE(rrset1, rrset2);
+
+  isLess = rrset1 < rrset2;
+  BOOST_CHECK_EQUAL(isLess, true);
+
   rrset2 = rrset1;
 
   rrset2.setVersion(name::Component::fromVersion(2));
   BOOST_CHECK_NE(rrset1, rrset2);
+
+  isLess = rrset1 < rrset2;
+  BOOST_CHECK_EQUAL(isLess, true);
+
   rrset2 = rrset1;
 
   rrset2.setTtl(time::seconds(1));
diff --git a/tests/unit/database-test-data.cpp b/tests/unit/database-test-data.cpp
index 92865d4..11d2ff8 100644
--- a/tests/unit/database-test-data.cpp
+++ b/tests/unit/database-test-data.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2017, Regents of the University of California.
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -161,7 +161,9 @@
 
   security::verifySignature(*data, m_cert);
 
-  m_session.insert(rrset);
+  ManagementTool tool(TEST_DATABASE.string(), m_keyChain);
+  tool.addRrset(rrset);
+
   m_rrsets.push_back(rrset);
 }
 
diff --git a/tests/unit/mgmt/management-tool.cpp b/tests/unit/mgmt/management-tool.cpp
index f0a6c7d..040bf38 100644
--- a/tests/unit/mgmt/management-tool.cpp
+++ b/tests/unit/mgmt/management-tool.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2014-2017, Regents of the University of California.
+ * Copyright (c) 2014-2018, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -25,7 +25,10 @@
 #include "ndns-label.hpp"
 #include "ndns-tlv.hpp"
 
+#include <random>
+
 #include <boost/algorithm/string/replace.hpp>
+#include <boost/range/adaptors.hpp>
 
 #include <ndn-cxx/util/io.hpp>
 #include <ndn-cxx/util/regex.hpp>
@@ -285,6 +288,78 @@
 //   std::cout << "Manually copy contents of /tmp/.ndn into tests/unit/mgmt/.ndn" << std::endl;
 // }
 
+BOOST_AUTO_TEST_CASE(SqliteLabelOrder)
+{
+  // the correctness of our DoE design rely on the ordering of SQLite
+  // this unit test make sure that our label::isSmallerInLabelOrder
+  // is the same as the ordering of BLOB in SQLite
+
+  std::random_device seed;
+  std::mt19937 gen(seed());
+
+  auto genRandomString = [&] (int length) -> std::string {
+    std::string charset =
+    "0123456789"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+    "abcdefghijklmnopqrstuvwxyz";
+    std::uniform_int_distribution<size_t> dist(0, charset.size() - 1);
+
+    std::string str(length, 0);
+    std::generate_n(str.begin(), length, [&] { return charset[dist(gen)];} );
+    return str;
+  };
+
+  auto genRandomLabel = [&]() -> Name {
+    std::uniform_int_distribution<size_t> numberOfLabelsDist(1, 5);
+    std::uniform_int_distribution<size_t> labelSizeDist(1, 10);
+    Name nm;
+    size_t length = numberOfLabelsDist(gen);
+    for (size_t i = 0; i < length; i++) {
+      nm.append(genRandomString(labelSizeDist(gen)));
+    }
+    return nm;
+  };
+
+  const size_t NGENERATED_LABELS = 10;
+
+  Zone zone = m_tool.createZone("/net/ndnsim", "/net");
+  RrsetFactory rrsetFactory(TEST_DATABASE.string(), zone.getName(),
+                            m_keyChain, DEFAULT_CERT);
+  rrsetFactory.checkZoneKey();
+  std::vector<Rrset> rrsets;
+  std::vector<Name> names;
+  for (size_t i = 0; i < NGENERATED_LABELS; i++) {
+    Name randomLabel = genRandomLabel();
+    Rrset randomTxt = rrsetFactory.generateTxtRrset(randomLabel,
+                                                    VERSION_USE_UNIX_TIMESTAMP,
+                                                    DEFAULT_CACHE_TTL,
+                                                    {});
+
+    rrsets.push_back(randomTxt);
+    m_dbMgr.insert(randomTxt);
+    names.push_back(randomLabel);
+  }
+
+  std::sort(rrsets.begin(), rrsets.end());
+
+  using boost::adaptors::filtered;
+  using boost::adaptors::transformed;
+
+  std::vector<Rrset> rrsetsFromDb = m_dbMgr.findRrsets(zone);
+  auto fromDbFiltered = rrsetsFromDb | filtered([] (const Rrset& rrset) {
+      return rrset.getType() == label::TXT_RR_TYPE;
+    });
+
+  auto extractLabel = [] (const Rrset& rr) {
+    return rr.getLabel();
+  };
+  auto expected = rrsets | transformed(extractLabel);
+  auto actual = fromDbFiltered | transformed(extractLabel);
+
+  BOOST_CHECK_EQUAL_COLLECTIONS(expected.begin(), expected.end(),
+                                actual.begin(), actual.end());
+}
+
 BOOST_AUTO_TEST_CASE(CreateDeleteRootFixture)
 {
   // creating root_zone need a rootDkey
@@ -820,96 +895,139 @@
   BOOST_CHECK(testOutput.is_equal(expectedValue));
 }
 
-// will be fixed after updating to new naming convention
-BOOST_AUTO_TEST_CASE_EXPECTED_FAILURES(ListZone, 1)
+// Test need to fix values of keys, otherwise it produces different values every time
 
-BOOST_AUTO_TEST_CASE(ListZone)
-{
-  m_tool.createZone("/ndns-test", ROOT_ZONE, time::seconds(10), time::days(1), otherKsk, otherDsk);
+// BOOST_AUTO_TEST_CASE(ListZone)
+// {
+//   m_tool.createZone("/ndns-test", ROOT_ZONE, time::seconds(10), time::days(1), otherKsk, otherDsk);
 
-  RrsetFactory rf(TEST_DATABASE, "/ndns-test", m_keyChain, DEFAULT_CERT);
-  rf.checkZoneKey();
+//   RrsetFactory rf(TEST_DATABASE, "/ndns-test", m_keyChain, DEFAULT_CERT);
+//   rf.checkZoneKey();
 
-  // Add NS with NDNS_RESP
-  Delegation del;
-  del.preference = 10;
-  del.name = Name("/get/link");
-  DelegationList ds = {del};
-  Rrset rrset1 = rf.generateNsRrset("/label1", 100, DEFAULT_RR_TTL, ds);
-  m_tool.addRrset(rrset1);
+//   // Add NS with NDNS_RESP
+//   Delegation del;
+//   del.preference = 10;
+//   del.name = Name("/get/link");
+//   DelegationList ds = {del};
+//   Rrset rrset1 = rf.generateNsRrset("/label1", 100, DEFAULT_RR_TTL, ds);
+//   m_tool.addRrset(rrset1);
 
-  // Add NS with NDNS_AUTH
-  Rrset rrset2 = rf.generateAuthRrset("/label2", 100000, DEFAULT_RR_TTL);
-  m_tool.addRrset(rrset2);
+//   // Add NS with NDNS_AUTH
+//   Rrset rrset2 = rf.generateAuthRrset("/label2", 100000, DEFAULT_RR_TTL);
+//   m_tool.addRrset(rrset2);
 
-  // Add TXT from file
-  std::string output = TEST_CERTDIR.string() + "/a.rrset";
-  Response re1;
-  re1.setZone("/ndns-test");
-  re1.setQueryType(label::NDNS_ITERATIVE_QUERY);
-  re1.setRrLabel("/label2");
-  re1.setRrType(label::TXT_RR_TYPE);
-  re1.setContentType(NDNS_RESP);
-  re1.setVersion(name::Component::fromVersion(654321));
-  re1.addRr("First RR");
-  re1.addRr("Second RR");
-  re1.addRr("Last RR");
-  shared_ptr<Data> data1 = re1.toData();
-  m_keyChain.sign(*data1, security::signingByCertificate(otherDsk));
-  ndn::io::save(*data1, output);
-  m_tool.addRrsetFromFile("/ndns-test", output);
+//   // Add TXT from file
+//   std::string output = TEST_CERTDIR.string() + "/a.rrset";
+//   Response re1;
+//   re1.setZone("/ndns-test");
+//   re1.setQueryType(label::NDNS_ITERATIVE_QUERY);
+//   re1.setRrLabel("/label2");
+//   re1.setRrType(label::TXT_RR_TYPE);
+//   re1.setContentType(NDNS_RESP);
+//   re1.setVersion(name::Component::fromVersion(654321));
+//   re1.addRr("First RR");
+//   re1.addRr("Second RR");
+//   re1.addRr("Last RR");
+//   shared_ptr<Data> data1 = re1.toData();
+//   m_keyChain.sign(*data1, security::signingByCertificate(otherDsk));
+//   ndn::io::save(*data1, output);
+//   m_tool.addRrsetFromFile("/ndns-test", output);
 
-  // Add TXT in normal way
-  Rrset rrset3 = rf.generateTxtRrset("/label3", 3333, DEFAULT_RR_TTL, {"Hello", "World"});
-  m_tool.addRrset(rrset3);
+//   // Add TXT in normal way
+//   Rrset rrset3 = rf.generateTxtRrset("/label3", 3333, DEFAULT_RR_TTL, {"Hello", "World"});
+//   m_tool.addRrset(rrset3);
 
-  m_tool.listZone("/ndns-test", std::cout, true);
+//   m_tool.listZone("/ndns-test", std::cout, true);
 
-  output_test_stream testOutput;
-  m_tool.listZone("/ndns-test", testOutput, true);
+//   output_test_stream testOutput;
+//   m_tool.listZone("/ndns-test", testOutput, true);
 
+//   std::string expectedValue =
+//     R"VALUE(; Zone /ndns-test
 
-  std::string expectedValue =
-    R"VALUE(; Zone /ndns-test
+// ; rrset=/ type=DOE version=%FD%00%00%01b%26e%AE%99 signed-by=/ndns-test/NDNS/KEY/%12%05t%90%3AjvA
+// /                                 3600  DOE   Bw0IBmxhYmVsMwgDVFhU
+// /                                 3600  DOE   BxUIA0tFWQgIEgV0kDpqdkEIBENFUlQ=
 
-; rrset=/label1 type=NS version=%FDd signed-by=/ndns-test/KEY/dsk-1416974006659/CERT
-/label1             10  NS       10,/get/link;
+// /KEY/%12%05t%90%3AjvA             10    CERT  ; content-type=KEY version=%FD%00%00%01b%26e%AEY signed-by=/ndns-test/NDNS/KEY/%8D%1Dj%1E%BE%B0%2A%E4
+// Certificate name:
+//   /ndns-test/NDNS/KEY/%12%05t%90%3AjvA/CERT/%FD%00%00%01b%26e%AEY
+// Validity:
+//   NotBefore: 20180314T212340
+//   NotAfter: 20180324T212340
+// Public key bits:
+//   MIIBSzCCAQMGByqGSM49AgEwgfcCAQEwLAYHKoZIzj0BAQIhAP////8AAAABAAAA
+//   AAAAAAAAAAAA////////////////MFsEIP////8AAAABAAAAAAAAAAAAAAAA////
+//   ///////////8BCBaxjXYqjqT57PrvVV2mIa8ZR0GsMxTsPY7zjw+J9JgSwMVAMSd
+//   NgiG5wSTamZ44ROdJreBn36QBEEEaxfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5
+//   RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP////8AAAAA
+//   //////////+85vqtpxeehPO5ysL8YyVRAgEBA0IABHU62fbCa6KR7G1iyMr6/NtF
+//   5oHrAdzttIgh5pk1VS1YcFO1zhpUnpJS43FlduYHVBLrXwYS6tZ15Ge/D3uy1f4=
+// Signature Information:
+//   Signature Type: SignatureSha256WithEcdsa
+//   Key Locator: Name=/ndns-test/NDNS/KEY/%8D%1Dj%1E%BE%B0%2A%E4
 
-; rrset=/label2 type=NS version=%FD%00%01%86%A0 signed-by=/ndns-test/KEY/dsk-1416974006659/CERT
-/label2             10  NS       NDNS-Auth
+// ; rrset=/KEY/%12%05t%90%3AjvA/CERT type=DOE version=%FD%00%00%01b%26e%AE%91 signed-by=/ndns-test/NDNS/KEY/%12%05t%90%3AjvA
+// /KEY/%12%05t%90%3AjvA/CERT        3600  DOE   BxUIA0tFWQgIEgV0kDpqdkEIBENFUlQ=
+// /KEY/%12%05t%90%3AjvA/CERT        3600  DOE   BxUIA0tFWQgIjR1qHr6wKuQIBENFUlQ=
 
-; rrset=/label2 type=TXT version=%FD%00%09%FB%F1 signed-by=/ndns-test/KEY/dsk-1416974006659/CERT
-/label2             10  TXT      First RR
-/label2             10  TXT      Second RR
-/label2             10  TXT      Last RR
+// /KEY/%8D%1Dj%1E%BE%B0%2A%E4       10    CERT  ; content-type=KEY version=%FD%00%00%01b%26e%AEX signed-by=/ndns-test/NDNS/KEY/%8D%1Dj%1E%BE%B0%2A%E4
+// Certificate name:
+//   /ndns-test/NDNS/KEY/%8D%1Dj%1E%BE%B0%2A%E4/CERT/%FD%00%00%01b%26e%AEX
+// Validity:
+//   NotBefore: 20180314T212340
+//   NotAfter: 20180324T212340
+// Public key bits:
+//   MIIBSzCCAQMGByqGSM49AgEwgfcCAQEwLAYHKoZIzj0BAQIhAP////8AAAABAAAA
+//   AAAAAAAAAAAA////////////////MFsEIP////8AAAABAAAAAAAAAAAAAAAA////
+//   ///////////8BCBaxjXYqjqT57PrvVV2mIa8ZR0GsMxTsPY7zjw+J9JgSwMVAMSd
+//   NgiG5wSTamZ44ROdJreBn36QBEEEaxfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5
+//   RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP////8AAAAA
+//   //////////+85vqtpxeehPO5ysL8YyVRAgEBA0IABMRVD/FUfCQVvjcwQLe9k1aS
+//   5pZ/xmFndOHn1+a0OYVzxCV1JcxL1eojcij42tCP5mtocrj9DjYyFBv4Atg1RZE=
+// Signature Information:
+//   Signature Type: SignatureSha256WithEcdsa
+//   Key Locator: Self-Signed Name=/ndns-test/NDNS/KEY/%8D%1Dj%1E%BE%B0%2A%E4
 
-; rrset=/label3 type=TXT version=%FD%0D%05 signed-by=/ndns-test/KEY/dsk-1416974006659/CERT
-/label3             10  TXT      Hello
-/label3             10  TXT      World
+// ; rrset=/KEY/%8D%1Dj%1E%BE%B0%2A%E4/CERT type=DOE version=%FD%00%00%01b%26e%AE%93 signed-by=/ndns-test/NDNS/KEY/%12%05t%90%3AjvA
+// /KEY/%8D%1Dj%1E%BE%B0%2A%E4/CERT  3600  DOE   BxUIA0tFWQgIjR1qHr6wKuQIBENFUlQ=
+// /KEY/%8D%1Dj%1E%BE%B0%2A%E4/CERT  3600  DOE   BwwIBmxhYmVsMQgCTlM=
 
-/dsk-1416974006659  10  CERT  ; content-type=KEY version=%FD%00%00%01I%EA%3Bz%0E signed-by=/ndns-test/KEY/ksk-1416974006577/CERT
-; Certificate name:
-;   /ndns-test/KEY/dsk-1416974006659/CERT/%FD%00%00%01I%EA%3Bz%0E
-; Validity:
-;   NotBefore: 19700101T000000
-;   NotAfter: 20380119T031408
-; Subject Description:
-;   2.5.4.41: /ndns-test
-; Public key bits: (RSA)
-;   MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAyBVC+xc/JpscSE/JdxbV
-;   pvgrh/fokNFI/2t9D5inuIFr7cc4W+LyJ4GG1xr9olMx7MHamJU1Xg3VunjhSjL8
-;   mOaeXlbS6gxWexBCtNK6U4euPB4wks/gMIKdp24mAAFb4T+mBfjcRgR+NdrjyO5C
-;   2OqM8qbDZmD/iuEmE6GPXnuMS0o6s13yzMj9YfDh3Df2jZnHESZcmG5Qpgg22T58
-;   7t7bRx8Ha2EC3hb29AeYKwgEKDx8JH8ZBJ80AQP321HbyjXWshJLomzy5SJZo9nA
-;   bZOYlZPCQkomz92Zc9+kpLNQwDvtRLwkZ46B+b2JpKTFARbnvugONCEBuG6zNgoi
-;   EQIB
-; Signature Information:
-;   Signature Type: Unknown Signature Type
+// ; rrset=/label1 type=NS version=%FDd signed-by=/ndns-test/NDNS/KEY/%12%05t%90%3AjvA
+// /label1                           10    NS    10
 
-)VALUE";
+// ; rrset=/label1/NS type=DOE version=%FD%00%00%01b%26e%AE%94 signed-by=/ndns-test/NDNS/KEY/%12%05t%90%3AjvA
+// /label1/NS                        3600  DOE   BwwIBmxhYmVsMQgCTlM=
+// /label1/NS                        3600  DOE   BwwIBmxhYmVsMggCTlM=
 
-  BOOST_CHECK(testOutput.is_equal(expectedValue));
-}
+// ; rrset=/label2 type=NS version=%FD%00%01%86%A0 signed-by=/ndns-test/NDNS/KEY/%12%05t%90%3AjvA
+// /label2                           10    NS    NDNS-Auth
+
+// ; rrset=/label2 type=TXT version=%FD%00%09%FB%F1 signed-by=/ndns-test/NDNS/KEY/%12%05t%90%3AjvA
+// /label2                           10    TXT   First RR
+// /label2                           10    TXT   Second RR
+// /label2                           10    TXT   Last RR
+
+// ; rrset=/label2/NS type=DOE version=%FD%00%00%01b%26e%AE%96 signed-by=/ndns-test/NDNS/KEY/%12%05t%90%3AjvA
+// /label2/NS                        3600  DOE   BwwIBmxhYmVsMggCTlM=
+// /label2/NS                        3600  DOE   Bw0IBmxhYmVsMggDVFhU
+
+// ; rrset=/label2/TXT type=DOE version=%FD%00%00%01b%26e%AE%97 signed-by=/ndns-test/NDNS/KEY/%12%05t%90%3AjvA
+// /label2/TXT                       3600  DOE   Bw0IBmxhYmVsMggDVFhU
+// /label2/TXT                       3600  DOE   Bw0IBmxhYmVsMwgDVFhU
+
+// ; rrset=/label3 type=TXT version=%FD%0D%05 signed-by=/ndns-test/NDNS/KEY/%12%05t%90%3AjvA
+// /label3                           10    TXT   Hello
+// /label3                           10    TXT   World
+
+// ; rrset=/label3/TXT type=DOE version=%FD%00%00%01b%26e%AE%98 signed-by=/ndns-test/NDNS/KEY/%12%05t%90%3AjvA
+// /label3/TXT                       3600  DOE   Bw0IBmxhYmVsMwgDVFhU
+// /label3/TXT                       3600  DOE   BxUIA0tFWQgIEgV0kDpqdkEIBENFUlQ=
+
+// )VALUE";
+
+//   BOOST_CHECK(testOutput.is_equal(expectedValue));
+// }
 
 BOOST_FIXTURE_TEST_CASE(GetRrSet, ManagementToolFixture)
 {