diff --git a/Sanity/utils/pkcs11-tools/main.fmf b/Sanity/utils/pkcs11-tools/main.fmf
new file mode 100644
index 0000000..7c0daf1
--- /dev/null
+++ b/Sanity/utils/pkcs11-tools/main.fmf
@@ -0,0 +1,21 @@
+summary: PKCS11 tools and operations test
+description: |
+    Bug summary: PKCS11 key operations using tools
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1578128
+contact: Petr Sklenar <psklenar@redhat.com>
+test: ./runtest.sh
+framework: beakerlib
+duration: 15m
+enabled: true
+tag:
+  - TIPpass
+link:
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1578128
+adjust+:
+  - enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6
+    continue: false
+recommends+:
+  - bind-utils
+  - softhsm
+  - opensc
diff --git a/Sanity/utils/pkcs11-tools/runtest.sh b/Sanity/utils/pkcs11-tools/runtest.sh
new file mode 100755
index 0000000..737f6e2
--- /dev/null
+++ b/Sanity/utils/pkcs11-tools/runtest.sh
@@ -0,0 +1,104 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/bind/Sanity/delv-smoke-test
+#   Description: Test for BZ#1578128 ([RFE] Provide delv functionality)
+#   Author: Petr Sklenar <psklenar@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2019 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+: ${PACKAGE:=bind}
+BACKUP_RESOLV=""
+SOURCE_RESOLV="/etc/resolv.conf"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE-utils
+	rlRun "REAL_RESOLV=$(realpath /etc/resolv.conf)"
+	rlRun "BACKUP_RESOLV=$(mktemp /etc/resolv-XXXXXX.conf)"
+	rlRun "rm -f $BACKUP_RESOLV"
+	rlRun -l "hostnamectl" 0-255 "Record type of used machine"
+	if [ "$REAL_RESOLV" = /run/systemd/resolve/stub-resolv.conf ]; then
+		rlWarning "systemd-resolved stub detected, temporary switching..."
+		rlRun "mv /etc/resolv.conf $BACKUP_RESOLV"
+		SOURCE_RESOLV="/run/systemd/resolve/resolv.conf"
+	else
+		rlRun "mv /etc/resolv.conf $BACKUP_RESOLV"
+		SOURCE_RESOLV="$BACKUP_RESOLV"
+	fi
+	rlRun "cp $SOURCE_RESOLV /etc/resolv.conf"
+	rlRun -l "cat /etc/resolv.conf"
+	DNSSEC=""
+	for NS in $(awk '$1 == "nameserver" { print $2 }' /etc/resolv.conf)
+	do
+		if dig +dnssec @$NS | grep -q RRSIG; then
+			rlLog "nameserver $NS supports DNSSEC"
+			DNSSEC=yes
+		else
+			rlLogWarning "nameserver $NS does not support DNSSEC!"
+			rlRun -l "dig +short @$NS -t txt -c ch -q version.bind" 0 "Query version of server $NS"
+			rlRun "sed -e '/$NS/ d' -i /etc/resolv.conf"
+		fi
+		rlRun -c "dig @$NS | grep -w RRSIG" 1 "Check signatures are not present always on $NS"
+	done
+	if [ -z "$DNSSEC" ]; then
+		DNSSEC=no
+		rlLogWarning "Infrastructure does not support DNSSEC at all!"
+		rlRun "cp $SOURCE_RESOLV /etc/resolv.conf"
+	fi
+	rlRun -l "cat /etc/resolv.conf" 0 "after modifications"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+	rlRun -l -s "delv redhat.com"
+	rlAssertGrep 'IN' $rlRun_LOG
+	rlRun -s "delv redhat.com soa +multi"
+	rlAssertGrep 'serial' $rlRun_LOG
+	rlRun -s "delv +multi +vtrace"
+	rlRun "LINES=$(wc -l <$rlRun_LOG)"
+	rlRun -l "cat $rlRun_LOG"
+	rlAssertGreater "delv +vtrace should show few lines" "$LINES" "10"
+	rlRun "delv +vtrace | grep 'fully validated'"
+	if [ "$DNSSEC" = yes ]; then
+		rlRun -s "delv"
+		rlAssertGrep 'fully validated' $rlRun_LOG
+		rlRun -s "delv example.net"
+		rlAssertGrep 'fully validated' $rlRun_LOG
+		rlRun -s "delv +vtrace fedoraproject.org"
+		rlAssertGrep 'fully validated' $rlRun_LOG
+		rlAssertGrep 'marking as secure' $rlRun_LOG
+
+	fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+	rlRun "rm -f $rlRun_LOG"
+	if [ -n "$BACKUP_RESOLV" ]; then
+		rlRun "rm -f /etc/resolv.conf"
+		rlRun "mv $BACKUP_RESOLV /etc/resolv.conf"
+	fi
+    rlPhaseEnd
+
+rlJournalPrintText
+rlJournalEnd
diff --git a/Sanity/utils/pkcs11-tools/setup-named-softhsm.sh b/Sanity/utils/pkcs11-tools/setup-named-softhsm.sh
new file mode 100755
index 0000000..a13c91e
--- /dev/null
+++ b/Sanity/utils/pkcs11-tools/setup-named-softhsm.sh
@@ -0,0 +1,123 @@
+#!/bin/sh
+#
+# This script will initialise token storage of softhsm PKCS11 provider
+# in custom location. Is useful to store tokens in non-standard location.
+#
+# Output can be evaluated from bash, it will prepare it for usage of temporary tokens.
+# Recommended use:
+# eval $(bash setup-named-softhsm.sh -A)
+#
+
+SOFTHSM2_CONF="$1"
+TOKENPATH="$2"
+GROUPNAME="$3"
+# Do not use this script for real keys worth protection
+# This is intended for crypto accelerators using PKCS11 interface.
+# Uninitialized token would fail any crypto operation.
+PIN=1234
+SO_PIN=1234
+LABEL=rpm
+
+set -e
+
+echo_i()
+{
+	echo "#" $@
+}
+
+random()
+{
+	if [ -x "$(which openssl 2>/dev/null)" ]; then
+		openssl rand -base64 $1
+	else
+		dd if=/dev/urandom bs=1c count=$1 | base64
+	fi
+}
+
+usage()
+{
+	echo "Usage: $0 -A [token directory] [group]"
+	echo "   or: $0 <config file> <token directory> [group]"
+}
+
+if [ "$SOFTHSM2_CONF" = "-A" -a -z "$TOKENPATH" ]; then
+	TOKENPATH=$(mktemp -d /var/tmp/softhsm-XXXXXX)
+fi
+
+if [ -z "$SOFTHSM2_CONF" -o -z "$TOKENPATH" ]; then
+	usage >&2
+	exit 1
+fi
+
+if [ "$SOFTHSM2_CONF" = "-A" ]; then
+	# Automagic mode instead
+	MODE=secure
+	SOFTHSM2_CONF="$TOKENPATH/softhsm2.conf"
+	PIN_SOURCE="$TOKENPATH/pin"
+	SOPIN_SOURCE="$TOKENPATH/so-pin"
+	TOKENPATH="$TOKENPATH/tokens"
+else
+	MODE=legacy
+fi
+
+[ -d "$TOKENPATH" ] || mkdir -p "$TOKENPATH"
+
+umask 0022
+
+if ! [ -f "$SOFTHSM2_CONF" ]; then
+cat  << SED > "$SOFTHSM2_CONF"
+# SoftHSM v2 configuration file
+
+directories.tokendir = ${TOKENPATH}
+objectstore.backend = file
+
+# ERROR, WARNING, INFO, DEBUG
+log.level = ERROR
+
+# If CKF_REMOVABLE_DEVICE flag should be set
+slots.removable = false
+SED
+else
+	echo_i "Config file $SOFTHSM2_CONF already exists" >&2
+fi
+
+if [ -n "$PIN_SOURCE" ]; then
+	touch "$PIN_SOURCE" "$SOPIN_SOURCE"
+	chmod 0600 "$PIN_SOURCE" "$SOPIN_SOURCE"
+	if [ -n "$GROUPNAME" ]; then
+		chgrp "$GROUPNAME" "$PIN_SOURCE" "$SOPIN_SOURCE"
+		chmod g+r "$PIN_SOURCE" "$SOPIN_SOURCE"
+	fi
+fi
+
+export SOFTHSM2_CONF
+
+if softhsm2-util --show-slots | grep 'Initialized:[[:space:]]*yes' > /dev/null
+then
+	echo_i "Token in ${TOKENPATH} is already initialized" >&2
+
+	[ -f "$PIN_SOURCE" ] && PIN=$(cat "$PIN_SOURCE")
+	[ -f "$SOPIN_SOURCE" ] && SO_PIN=$(cat "$SOPIN_SOURCE")
+else
+	PIN=$(random 6)
+	SO_PIN=$(random 18)
+	if [ -n "$PIN_SOURCE" ]; then
+		echo -n "$PIN" > "$PIN_SOURCE"
+		echo -n "$SO_PIN" > "$SOPIN_SOURCE"
+	fi
+
+	echo_i "Initializing tokens to ${TOKENPATH}..."
+	softhsm2-util --init-token --free --label "$LABEL" --pin "$PIN" --so-pin "$SO_PIN" | sed -e 's/^/# /'
+
+	if [ -n "$GROUPNAME" ]; then
+		chgrp -R -- "$GROUPNAME" "$TOKENPATH"
+		chmod -R -- g=rX,o= "$TOKENPATH"
+	fi
+fi
+
+echo "export SOFTHSM2_CONF=\"$SOFTHSM2_CONF\""
+echo "export PIN_SOURCE=\"$PIN_SOURCE\""
+echo "export SOPIN_SOURCE=\"$SOPIN_SOURCE\""
+# These are intentionaly not exported
+echo "PIN=\"$PIN\""
+echo "SO_PIN=\"$SO_PIN\""