diff --git a/src/mgmt/management-tool.cpp b/src/mgmt/management-tool.cpp
index 6dd2cb9..dc3f971 100644
--- a/src/mgmt/management-tool.cpp
+++ b/src/mgmt/management-tool.cpp
@@ -34,6 +34,7 @@
 #include <ndn-cxx/util/indented-stream.hpp>
 #include <ndn-cxx/encoding/oid.hpp>
 #include <ndn-cxx/security/cryptopp.hpp>
+#include <ndn-cxx/link.hpp>
 
 namespace ndn {
 namespace ndns {
@@ -196,99 +197,8 @@
 }
 
 void
-ManagementTool::addRrSet(const Name& zoneName,
-                         const Name& label,
-                         const name::Component& type,
-                         NdnsType ndnsType,
-                         const uint64_t version,
-                         const std::vector<std::string>& contents,
-                         const Name& inputDskCertName,
-                         const time::seconds& ttl)
+ManagementTool::addRrset(Rrset& rrset)
 {
-  // check pre-condition
-  Zone zone(zoneName);
-  if (!m_dbMgr.find(zone)) {
-    throw Error(zoneName.toUri() + " is not presented in the NDNS db");
-  }
-
-  if (ndnsType == NDNS_UNKNOWN) {
-    throw Error("The ndns type is unknown");
-  }
-
-  if (type == label::CERT_RR_TYPE) {
-    throw Error("It cannot handle ID-CERT rrset type");
-  }
-
-  // check strange rr type and ndns type combination
-  if (type == label::NS_RR_TYPE && ndnsType == NDNS_RAW) {
-    throw Error("NS cannot be of the type NDNS_RAW");
-  }
-
-  if (type == label::TXT_RR_TYPE && ndnsType != NDNS_RESP) {
-    throw Error("TXT cannot be of the type NDNS_RAW or NDNS_AUTH");
-  }
-
-  if (ndnsType == NDNS_RAW && contents.size() != 1) {
-    throw Error("NDNS_RAW must contain a single content element");
-  }
-
-  Name dskName;
-  Name dskCertName = inputDskCertName;
-  if (dskCertName == DEFAULT_CERT) {
-    dskName = m_keyChain.getDefaultKeyNameForIdentity(zoneName);
-    dskCertName = m_keyChain.getDefaultCertificateNameForKey(dskName);
-  }
-  else {
-    if (!matchCertificate(dskCertName, zoneName)) {
-      throw Error("Cannot verify certificate");
-    }
-  }
-
-  time::seconds actualTtl = ttl;
-  if (ttl == DEFAULT_RR_TTL)
-    actualTtl = zone.getTtl();
-
-  // set rrset
-  Rrset rrset(&zone);
-  rrset.setLabel(label);
-  rrset.setType(type);
-  rrset.setTtl(actualTtl);
-
-  // set response
-  Response re;
-  re.setZone(zoneName);
-  re.setQueryType(label::NDNS_ITERATIVE_QUERY);
-  re.setRrLabel(label);
-  re.setRrType(type);
-  re.setNdnsType(ndnsType);
-  re.setFreshnessPeriod(actualTtl);
-
-  //set content according to ndns type
-  if (ndnsType == NDNS_RAW) {
-    Block tmp = makeBinaryBlock(ndn::tlv::Content, contents[0].c_str(), contents[0].length());
-    re.setAppContent(tmp);
-  }
-  else if (ndnsType != NDNS_AUTH) {
-    if (contents.empty()) {
-      re.addRr("");
-    }
-    else {
-      for (const auto& item : contents) {
-        re.addRr(item);
-      }
-    }
-  }
-
-  if (version != VERSION_USE_UNIX_TIMESTAMP) {
-    name::Component tmp = name::Component::fromVersion(version);
-    re.setVersion(tmp);
-  }
-  shared_ptr<Data> data = re.toData();
-  m_keyChain.sign(*data, dskCertName);
-
-  rrset.setVersion(re.getVersion());
-  rrset.setData(data->wireEncode());
-
   checkRrsetVersion(rrset);
   NDNS_LOG_INFO("Added " << rrset);
   m_dbMgr.insert(rrset);
@@ -439,7 +349,7 @@
                       1 : re.getRrs().size();
     const std::vector<Block> &rrs = re.getRrs();
 
-    if (re.getNdnsType() != NDNS_RAW && re.getNdnsType() != NDNS_AUTH) {
+    if (re.getNdnsType() != NDNS_RAW) {
       os << "; rrset=" << rrset.getLabel().toUri()
          << " type=" << rrset.getType().toUri()
          << " version=" << rrset.getVersion().toUri()
@@ -458,14 +368,26 @@
       os.width(typeWidth + 2);
       os << rrset.getType().toUri();
 
-      if (re.getNdnsType() != NDNS_RAW && re.getNdnsType() != NDNS_AUTH) {
+      if (re.getNdnsType() != NDNS_RAW) {
         using namespace CryptoPP;
         if (rrset.getType() == label::TXT_RR_TYPE) {
           os.write(reinterpret_cast<const char*>(rrs[i].value()), rrs[i].value_size());
           os << std::endl;
         }
         else if (rrset.getType() == label::NS_RR_TYPE) {
-          //TODO output the NS data once we have it
+          BOOST_ASSERT(iteration == 1);
+          if (re.getNdnsType() == NDNS_AUTH) {
+            const std::string authStr = "NDNS-Auth";
+            os << authStr;
+          } else {
+            Link link(rrset.getData());
+            const Link::DelegationSet& ds = link.getDelegations();
+            for (const auto& i: ds) {
+              std::string str = boost::lexical_cast<std::string>(i.first)
+                + "," + i.second.toUri() + ";";
+              os << str;
+            }
+          }
           os << std::endl;
         }
         else {
@@ -475,7 +397,7 @@
       }
     }
 
-    if (re.getNdnsType() == NDNS_RAW || re.getNdnsType() == NDNS_AUTH) {
+    if (re.getNdnsType() == NDNS_RAW) {
       os.width();
       os << "; content-type=" << re.getNdnsType()
          << " version=" << rrset.getVersion().toUri()