diff --git a/src/clients/iterative-query-controller.cpp b/src/clients/iterative-query-controller.cpp
index 54bbb9a..908b499 100644
--- a/src/clients/iterative-query-controller.cpp
+++ b/src/clients/iterative-query-controller.cpp
@@ -214,13 +214,7 @@
     query.setRrType(label::NS_RR_TYPE);
     break;
   case QUERY_STEP_QUERY_RR:
-    if (m_rrType == label::CERT_RR_TYPE) {
-      // this only works for dsk, and ksk needs different mechanism
-      query.setQueryType(label::NDNS_CERT_QUERY);
-    }
-    else {
-      query.setQueryType(label::NDNS_ITERATIVE_QUERY);
-    }
+    query.setQueryType(label::NDNS_ITERATIVE_QUERY);
     query.setRrLabel(m_dstLabel.getSubName(m_nFinishedComps));
     query.setRrType(m_rrType);
     break;
diff --git a/src/clients/query.cpp b/src/clients/query.cpp
index 8a133bb..ab70fff 100644
--- a/src/clients/query.cpp
+++ b/src/clients/query.cpp
@@ -64,7 +64,7 @@
 Interest
 Query::toInterest() const
 {
-  // <zone> [<KEY>|<NDNS>|<NDNS-R>] <rrLabel> <rrType>
+  // <zone> [<NDNS>|<NDNS-R>] <rrLabel> <rrType>
   Name name;
 
   name.append(this->m_zone)
diff --git a/src/clients/query.hpp b/src/clients/query.hpp
index f933eeb..6f8222b 100644
--- a/src/clients/query.hpp
+++ b/src/clients/query.hpp
@@ -34,7 +34,7 @@
  *
  * Query is an Interest whose name follows the format:
  *
- *      <zone> [<KEY>|<NDNS>|<NDNS-R>] <rrLabel> <rrType>
+ *      <zone> [<NDNS>|<NDNS-R>] <rrLabel> <rrType>
  */
 class Query : noncopyable
 {
diff --git a/src/daemon/rrset-factory.cpp b/src/daemon/rrset-factory.cpp
index da7ffde..f82e831 100644
--- a/src/daemon/rrset-factory.cpp
+++ b/src/daemon/rrset-factory.cpp
@@ -40,7 +40,7 @@
   , m_dskCertName(inputDskCertName)
   , m_checked(false)
 {
-  Name identityName = Name(zoneName).append(label::NDNS_CERT_QUERY);
+  Name identityName = Name(zoneName).append(label::NDNS_ITERATIVE_QUERY);
   if (m_dskCertName == DEFAULT_CERT) {
     m_dskName = CertHelper::getDefaultKeyNameOfIdentity(m_keyChain, identityName);
     m_dskCertName = CertHelper::getDefaultCertificateNameOfIdentity(m_keyChain, identityName);
@@ -51,7 +51,7 @@
 RrsetFactory::checkZoneKey()
 {
   onlyCheckZone();
-  Name zoneIdentityName = Name(m_zone.getName()).append(label::NDNS_CERT_QUERY);
+  Name zoneIdentityName = Name(m_zone.getName()).append(label::NDNS_ITERATIVE_QUERY);
   if (m_dskCertName != DEFAULT_CERT &&
       !matchCertificate(m_dskCertName, zoneIdentityName)) {
     BOOST_THROW_EXCEPTION(Error("Cannot verify certificate"));
@@ -86,17 +86,9 @@
   rrset.setType(type);
   rrset.setTtl(ttl);
 
-  name::Component qType;
-  if (type == label::CERT_RR_TYPE) {
-    qType = label::NDNS_CERT_QUERY;
-  }
-  else {
-    qType = label::NDNS_ITERATIVE_QUERY;
-  }
-
   Name name;
   name.append(m_zone.getName())
-      .append(qType)
+      .append(label::NDNS_ITERATIVE_QUERY)
       .append(label)
       .append(type);
 
diff --git a/src/mgmt/management-tool.cpp b/src/mgmt/management-tool.cpp
index 6610a13..b0bd7b4 100644
--- a/src/mgmt/management-tool.cpp
+++ b/src/mgmt/management-tool.cpp
@@ -67,7 +67,7 @@
                            const Name& dkeyCertName)
 {
   bool isRoot = zoneName == ROOT_ZONE;
-  Name zoneIdentityName = Name(zoneName).append(label::NDNS_CERT_QUERY);
+  Name zoneIdentityName = Name(zoneName).append(label::NDNS_ITERATIVE_QUERY);
 
   //check preconditions
   Zone zone(zoneName, cacheTtl);
@@ -103,7 +103,7 @@
   // This D-key will be passed to parent zone and resigned.
   Name dkeyIdentityName;
   if (dkeyCertName == DEFAULT_CERT) {
-    dkeyIdentityName = Name(parentZoneName).append(label::NDNS_CERT_QUERY)
+    dkeyIdentityName = Name(parentZoneName).append(label::NDNS_ITERATIVE_QUERY)
       .append(zoneName.getSubName(parentZoneName.size()));
   }
   else {
@@ -220,7 +220,7 @@
   }
 
   Name zoneName = regex->expand("\\1");
-  Name identityName = Name(zoneName).append(label::NDNS_CERT_QUERY);
+  Name identityName = Name(zoneName).append(label::NDNS_ITERATIVE_QUERY);
   Name label = regex->expand("\\2");
 
   Zone zone(zoneName);
@@ -326,7 +326,7 @@
 {
   //check precondition
   Zone zone(zoneName);
-  Name zoneIdentityName = Name(zoneName).append(label::NDNS_CERT_QUERY);
+  Name zoneIdentityName = Name(zoneName).append(label::NDNS_ITERATIVE_QUERY);
   if (!m_dbMgr.find(zone)) {
     BOOST_THROW_EXCEPTION(Error(zoneName.toUri() + " is not presented in the NDNS db"));
   }
@@ -528,7 +528,7 @@
     os.setf(os.left);
     os.width(nameWidth + 2);
     os << zone.getName().toUri();
-    Name zoneIdentity = Name(zone.getName()).append(label::NDNS_CERT_QUERY);
+    Name zoneIdentity = Name(zone.getName()).append(label::NDNS_ITERATIVE_QUERY);
 
     os << "; default-ttl=" << zone.getTtl().count();
     os << " default-key=" << CertHelper::getDefaultKeyNameOfIdentity(m_keyChain, zoneIdentity);
diff --git a/src/ndns-label.cpp b/src/ndns-label.cpp
index 9386452..747f13a 100644
--- a/src/ndns-label.cpp
+++ b/src/ndns-label.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /**
- * Copyright (c) 2014-2016, Regents of the University of California.
+ * Copyright (c) 2014-2017, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -36,8 +36,7 @@
   BOOST_ASSERT(name.size() > skip);
   BOOST_ASSERT(name.getPrefix(zone.size()) == zone);
 
-  BOOST_ASSERT(name.get(skip) == NDNS_ITERATIVE_QUERY ||
-               name.get(skip) == NDNS_CERT_QUERY);
+  BOOST_ASSERT(name.get(skip) == NDNS_ITERATIVE_QUERY);
 
   ++skip;
   return skip;
diff --git a/src/ndns-label.hpp b/src/ndns-label.hpp
index 93713d7..066ee94 100644
--- a/src/ndns-label.hpp
+++ b/src/ndns-label.hpp
@@ -44,11 +44,6 @@
 // it is not supported now
 // const name::Component NDNS_RECURSIVE_QUERY("NDNS-R");
 
-/**
- * @brief NDNS CERT query type
- */
-const name::Component NDNS_CERT_QUERY("NDNS");
-
 /////////////////////////////////////////////
 
 /**