diff --git a/src/clients/iterative-query-controller.cpp b/src/clients/iterative-query-controller.cpp
index 54bbb9a..908b499 100644
--- a/src/clients/iterative-query-controller.cpp
+++ b/src/clients/iterative-query-controller.cpp
@@ -214,13 +214,7 @@
     query.setRrType(label::NS_RR_TYPE);
     break;
   case QUERY_STEP_QUERY_RR:
-    if (m_rrType == label::CERT_RR_TYPE) {
-      // this only works for dsk, and ksk needs different mechanism
-      query.setQueryType(label::NDNS_CERT_QUERY);
-    }
-    else {
-      query.setQueryType(label::NDNS_ITERATIVE_QUERY);
-    }
+    query.setQueryType(label::NDNS_ITERATIVE_QUERY);
     query.setRrLabel(m_dstLabel.getSubName(m_nFinishedComps));
     query.setRrType(m_rrType);
     break;
diff --git a/src/clients/query.cpp b/src/clients/query.cpp
index 8a133bb..ab70fff 100644
--- a/src/clients/query.cpp
+++ b/src/clients/query.cpp
@@ -64,7 +64,7 @@
 Interest
 Query::toInterest() const
 {
-  // <zone> [<KEY>|<NDNS>|<NDNS-R>] <rrLabel> <rrType>
+  // <zone> [<NDNS>|<NDNS-R>] <rrLabel> <rrType>
   Name name;
 
   name.append(this->m_zone)
diff --git a/src/clients/query.hpp b/src/clients/query.hpp
index f933eeb..6f8222b 100644
--- a/src/clients/query.hpp
+++ b/src/clients/query.hpp
@@ -34,7 +34,7 @@
  *
  * Query is an Interest whose name follows the format:
  *
- *      <zone> [<KEY>|<NDNS>|<NDNS-R>] <rrLabel> <rrType>
+ *      <zone> [<NDNS>|<NDNS-R>] <rrLabel> <rrType>
  */
 class Query : noncopyable
 {
diff --git a/src/daemon/rrset-factory.cpp b/src/daemon/rrset-factory.cpp
index da7ffde..f82e831 100644
--- a/src/daemon/rrset-factory.cpp
+++ b/src/daemon/rrset-factory.cpp
@@ -40,7 +40,7 @@
   , m_dskCertName(inputDskCertName)
   , m_checked(false)
 {
-  Name identityName = Name(zoneName).append(label::NDNS_CERT_QUERY);
+  Name identityName = Name(zoneName).append(label::NDNS_ITERATIVE_QUERY);
   if (m_dskCertName == DEFAULT_CERT) {
     m_dskName = CertHelper::getDefaultKeyNameOfIdentity(m_keyChain, identityName);
     m_dskCertName = CertHelper::getDefaultCertificateNameOfIdentity(m_keyChain, identityName);
@@ -51,7 +51,7 @@
 RrsetFactory::checkZoneKey()
 {
   onlyCheckZone();
-  Name zoneIdentityName = Name(m_zone.getName()).append(label::NDNS_CERT_QUERY);
+  Name zoneIdentityName = Name(m_zone.getName()).append(label::NDNS_ITERATIVE_QUERY);
   if (m_dskCertName != DEFAULT_CERT &&
       !matchCertificate(m_dskCertName, zoneIdentityName)) {
     BOOST_THROW_EXCEPTION(Error("Cannot verify certificate"));
@@ -86,17 +86,9 @@
   rrset.setType(type);
   rrset.setTtl(ttl);
 
-  name::Component qType;
-  if (type == label::CERT_RR_TYPE) {
-    qType = label::NDNS_CERT_QUERY;
-  }
-  else {
-    qType = label::NDNS_ITERATIVE_QUERY;
-  }
-
   Name name;
   name.append(m_zone.getName())
-      .append(qType)
+      .append(label::NDNS_ITERATIVE_QUERY)
       .append(label)
       .append(type);
 
diff --git a/src/mgmt/management-tool.cpp b/src/mgmt/management-tool.cpp
index 6610a13..b0bd7b4 100644
--- a/src/mgmt/management-tool.cpp
+++ b/src/mgmt/management-tool.cpp
@@ -67,7 +67,7 @@
                            const Name& dkeyCertName)
 {
   bool isRoot = zoneName == ROOT_ZONE;
-  Name zoneIdentityName = Name(zoneName).append(label::NDNS_CERT_QUERY);
+  Name zoneIdentityName = Name(zoneName).append(label::NDNS_ITERATIVE_QUERY);
 
   //check preconditions
   Zone zone(zoneName, cacheTtl);
@@ -103,7 +103,7 @@
   // This D-key will be passed to parent zone and resigned.
   Name dkeyIdentityName;
   if (dkeyCertName == DEFAULT_CERT) {
-    dkeyIdentityName = Name(parentZoneName).append(label::NDNS_CERT_QUERY)
+    dkeyIdentityName = Name(parentZoneName).append(label::NDNS_ITERATIVE_QUERY)
       .append(zoneName.getSubName(parentZoneName.size()));
   }
   else {
@@ -220,7 +220,7 @@
   }
 
   Name zoneName = regex->expand("\\1");
-  Name identityName = Name(zoneName).append(label::NDNS_CERT_QUERY);
+  Name identityName = Name(zoneName).append(label::NDNS_ITERATIVE_QUERY);
   Name label = regex->expand("\\2");
 
   Zone zone(zoneName);
@@ -326,7 +326,7 @@
 {
   //check precondition
   Zone zone(zoneName);
-  Name zoneIdentityName = Name(zoneName).append(label::NDNS_CERT_QUERY);
+  Name zoneIdentityName = Name(zoneName).append(label::NDNS_ITERATIVE_QUERY);
   if (!m_dbMgr.find(zone)) {
     BOOST_THROW_EXCEPTION(Error(zoneName.toUri() + " is not presented in the NDNS db"));
   }
@@ -528,7 +528,7 @@
     os.setf(os.left);
     os.width(nameWidth + 2);
     os << zone.getName().toUri();
-    Name zoneIdentity = Name(zone.getName()).append(label::NDNS_CERT_QUERY);
+    Name zoneIdentity = Name(zone.getName()).append(label::NDNS_ITERATIVE_QUERY);
 
     os << "; default-ttl=" << zone.getTtl().count();
     os << " default-key=" << CertHelper::getDefaultKeyNameOfIdentity(m_keyChain, zoneIdentity);
diff --git a/src/ndns-label.cpp b/src/ndns-label.cpp
index 9386452..747f13a 100644
--- a/src/ndns-label.cpp
+++ b/src/ndns-label.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /**
- * Copyright (c) 2014-2016, Regents of the University of California.
+ * Copyright (c) 2014-2017, Regents of the University of California.
  *
  * This file is part of NDNS (Named Data Networking Domain Name Service).
  * See AUTHORS.md for complete list of NDNS authors and contributors.
@@ -36,8 +36,7 @@
   BOOST_ASSERT(name.size() > skip);
   BOOST_ASSERT(name.getPrefix(zone.size()) == zone);
 
-  BOOST_ASSERT(name.get(skip) == NDNS_ITERATIVE_QUERY ||
-               name.get(skip) == NDNS_CERT_QUERY);
+  BOOST_ASSERT(name.get(skip) == NDNS_ITERATIVE_QUERY);
 
   ++skip;
   return skip;
diff --git a/src/ndns-label.hpp b/src/ndns-label.hpp
index 93713d7..066ee94 100644
--- a/src/ndns-label.hpp
+++ b/src/ndns-label.hpp
@@ -44,11 +44,6 @@
 // it is not supported now
 // const name::Component NDNS_RECURSIVE_QUERY("NDNS-R");
 
-/**
- * @brief NDNS CERT query type
- */
-const name::Component NDNS_CERT_QUERY("NDNS");
-
 /////////////////////////////////////////////
 
 /**
diff --git a/tests/unit/daemon/name-server.cpp b/tests/unit/daemon/name-server.cpp
index 9391cab..707ff95 100644
--- a/tests/unit/daemon/name-server.cpp
+++ b/tests/unit/daemon/name-server.cpp
@@ -90,7 +90,6 @@
 BOOST_AUTO_TEST_CASE(KeyQuery)
 {
   Query q(zone, ndns::label::NDNS_ITERATIVE_QUERY);
-  q.setQueryType(ndns::label::NDNS_CERT_QUERY);
   q.setRrType(ndns::label::CERT_RR_TYPE);
 
   size_t nDataBack = 0;
diff --git a/tests/unit/database-test-data.cpp b/tests/unit/database-test-data.cpp
index 712a312..93815ec 100644
--- a/tests/unit/database-test-data.cpp
+++ b/tests/unit/database-test-data.cpp
@@ -98,7 +98,6 @@
     NdnsContentType contentType = NDNS_RESP;
     if (type == label::CERT_RR_TYPE) {
       contentType = NDNS_KEY;
-      qType = label::NDNS_CERT_QUERY;
     }
     else if (type == label::NS_RR_TYPE) {
       contentType = NDNS_LINK;
diff --git a/tests/unit/mgmt/management-tool.cpp b/tests/unit/mgmt/management-tool.cpp
index 93eec1c..7c9e726 100644
--- a/tests/unit/mgmt/management-tool.cpp
+++ b/tests/unit/mgmt/management-tool.cpp
@@ -319,7 +319,7 @@
   Name zoneName = Name(parentZoneName).append("child-zone");
 
   Zone zone1(zoneName);
-  Name zoneIdentityName = Name(zoneName).append(label::NDNS_CERT_QUERY);
+  Name zoneIdentityName = Name(zoneName).append(label::NDNS_ITERATIVE_QUERY);
   BOOST_REQUIRE_EQUAL(m_dbMgr.find(zone1), false);
 
   // will generate keys automatically
@@ -351,7 +351,7 @@
 {
   Name parentZoneName("/ndns-test");
   Name zoneName = Name(parentZoneName).append("child-zone");
-  Name zoneIdentityName = Name(zoneName).append(label::NDNS_CERT_QUERY);
+  Name zoneIdentityName = Name(zoneName).append(label::NDNS_ITERATIVE_QUERY);
 
   m_tool.createZone(zoneName, parentZoneName, time::seconds(4200), time::days(30));
   BOOST_CHECK_EQUAL(CertHelper::doesIdentityExist(m_keyChain, zoneIdentityName), true);
@@ -665,7 +665,7 @@
 {
   Name parentZoneName("/ndns-test");
   Name zoneName("/ndns-test/child-zone");
-  Name zoneIdentityName = Name(zoneName).append(label::NDNS_CERT_QUERY);
+  Name zoneIdentityName = Name(zoneName).append(label::NDNS_ITERATIVE_QUERY);
 
   m_tool.createZone(parentZoneName, ROOT_ZONE, time::seconds(1), time::days(1), otherKsk, otherDsk);
   m_tool.createZone(zoneName, parentZoneName);
@@ -686,9 +686,9 @@
 {
   //check using user provided certificate
   Name parentZoneName("/ndns-test");
-  Name parentZoneIdentityName = Name(parentZoneName).append(label::NDNS_CERT_QUERY);
+  Name parentZoneIdentityName = Name(parentZoneName).append(label::NDNS_ITERATIVE_QUERY);
   Name zoneName("/ndns-test/child-zone");
-  Name zoneIdentityName = Name(zoneName).append(label::NDNS_CERT_QUERY);
+  Name zoneIdentityName = Name(zoneName).append(label::NDNS_ITERATIVE_QUERY);
 
   // Name dskName = m_keyChain.generateRsaKeyPair(parentZoneName, false);
   Identity id = CertHelper::getIdentity(m_keyChain, parentZoneIdentityName);
@@ -776,6 +776,8 @@
   Certificate cert(findDkeyFromDb(zoneName));
   std::string output = TEST_CERTDIR.string() + "/a.cert";
 
+  Name parentZoneIdentityName = Name(parentZoneName).append(label::NDNS_ITERATIVE_QUERY);
+
   // base64
   ndn::io::save(cert, output, ndn::io::BASE64);
   BOOST_CHECK_NO_THROW(
diff --git a/tests/unit/validator.cpp b/tests/unit/validator.cpp
index 0824d62..c642875 100644
--- a/tests/unit/validator.cpp
+++ b/tests/unit/validator.cpp
@@ -186,7 +186,7 @@
   dataName = Name();
   dataName
     .append(m_testId2)
-    .append("KEY")
+    .append("NDNS")
     .append("rrLabel")
     .append("CERT")
     .appendVersion();
diff --git a/tools/ndns-update.cpp b/tools/ndns-update.cpp
index 743ca5e..5fdbf67 100644
--- a/tools/ndns-update.cpp
+++ b/tools/ndns-update.cpp
@@ -321,8 +321,7 @@
       Response re;
       re.setZone(zone);
       re.setRrLabel(rrLabel);
-      name::Component qType = (rrType == "CERT" ?
-                               ndns::label::NDNS_CERT_QUERY : ndns::label::NDNS_ITERATIVE_QUERY);
+      name::Component qType = ndns::label::NDNS_ITERATIVE_QUERY;
 
       re.setQueryType(qType);
       re.setRrType(name::Component(rrType));
@@ -350,7 +349,7 @@
 
       try {
         // must check the Data is a legal Response with right name
-        shared_ptr<Regex> regex = make_shared<Regex>("(<>*)<KEY>(<>+)<CERT><>*");
+        shared_ptr<Regex> regex = make_shared<Regex>("(<>*)<NDNS>(<>+)<CERT><>*");
         shared_ptr<Regex> regex2 = make_shared<Regex>("(<>*)<NDNS>(<>+)");
 
         Name zone2;