diff --git a/Sanity/caching-resolver-dnssec/test.sh b/Sanity/caching-resolver-dnssec/test.sh
index 60f4cab..57faeef 100755
--- a/Sanity/caching-resolver-dnssec/test.sh
+++ b/Sanity/caching-resolver-dnssec/test.sh
@@ -3,6 +3,13 @@
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
 : ${CLEAN_ANCHORS:=y}
+: ${NAMED_OPTIONS:=}
+# How many times to check basic root check
+: ${BASIC_TRIES:=3}
+# How many times to check host checks
+: ${HOSTS_TRIES:=3}
+# On which host check pass require successful responses?
+: ${HOSTS_PASSING:=2}
 
 bu_FALLBACK_SERVERS="8.8.8.8 8.8.4.4 9.9.9.9"
 bu_DELV=$(type -p delv 2>/dev/null)
@@ -191,6 +198,12 @@ buDigGetField1()
 	grep "^;\s\(.*\s\)\?${FIELD}:" | sed -e "s/.*\s${FIELD}:\s*\([^;,]*\)\([;,].*\|$\)/\1/"
 }
 
+# just receive any response, no matter what status
+buDig()
+{
+	rlRun -s "dig $*"
+}
+
 # Ensure reply has noerror status
 buDigSuccess()
 {
@@ -237,15 +250,48 @@ rlJournalStart
 	rlRun "named-checkconf" 0 "Test generated configuration is acccepted"
 	rlRun "rlServiceStop named"
 	if [ "$CLEAN_ANCHORS" = y ]; then
-	    rlFileBackup --missing-ok /var/named/dynamic/managed-keys.bind{,.jnl}
+	    rlFileBackup --clean /var/named/dynamic/managed-keys.bind{,.jnl}
 	    rlRun "rm -f /var/named/dynamic/managed-keys.bind{,.jnl}"
 	fi
 	rlAssertExists $bu_ROOT_HINTS
 	# use buCheckSecureNameservers
 	rlRun "HINTS4=\"$(buGetRootServerAddresses4 $bu_ROOT_HINTS)\""
 	rlRun "HINTS6=\"$(buGetRootServerAddresses6 $bu_ROOT_HINTS)\""
+	rlRun "HINTS4_NUM=$(echo \"$HINTS4\" | wc -l)"
+	rlRun "HINTS6_NUM=$(echo \"$HINTS6\" | wc -l)"
+	HINTS4_WORKS=''
+	HINTS6_WORKS=''
+	if [ "$NAMED_OPTIONS" = auto ]; then
+		# TODO: is this complication desirable?
+		if [ "$HINTS4_NUM" -gt 0 ] && buCheckSecureNameservers "$HINTS4"; then
+			SECURE_SERVERS4="$bu_SECURE_SERVERS"
+			FAILED_SERVERS4="$bu_FAILED_SERVERS"
+			HINTS4_WORKS=y
+		fi
+		if [ "$HINTS6_NUM" -gt 0 ] && buCheckSecureNameservers "$HINTS6"; then
+			SECURE_SERVERS6="$bu_SECURE_SERVERS"
+			FAILED_SERVERS6="$bu_FAILED_SERVERS"
+			[ -n "$FAILED_SERVERS4" ] && bu_FAILED_SERVERS+=" $FAILED_SERVERS4"
+			[ -n "$SECURE_SERVERS4" ] && bu_SECURE_SERVERS+=" $SECURE_SERVERS4"
+			HINTS6_WORKS=y
+		fi
+		if [ "$HINTS4_WORKS" = y ] && [ -z "$HINTS6_WORKS" ]; then
+			rlRun "NAMED_OPTIONS='-4'"
+		elif [ "$HINTS6_WORKS" = y ] && [ -z "$HINTS4_WORKS" ]; then 
+			rlRun "NAMED_OPTIONS='-6'"
+		else
+			rlRun "NAMED_OPTIONS=''"
+		fi
+	else
+		rlRun "buCheckSecureNameservers \"$HINTS4 $HINTS6\"" && HINTS4_WORKS=y && HINTS4_WORKS=y
+	fi
+	if [ -n "$NAMED_OPTIONS" ]; then
+		rlFileBackup /etc/sysconfig/named
+		echo "OPTIONS+=\"$NAMED_OPTIONS\"" >> /etc/sysconfig/named
+		rlRun "grep OPTIONS /etc/sysconfig/named"
+	fi
 	SKIP_TEST=''
-	if ! rlRun "buCheckSecureNameservers \"$HINTS4 $HINTS6\""
+	if [ -z "$HINTS6_WORKS" ] && [ -z "$HINTS4_WORKS" ]
 	then
 		SKIP_TEST=y
 		rlLogWarning "No root-servers reachable, skipping the test."
@@ -254,7 +300,7 @@ rlJournalStart
 	for NSIP in ${bu_SECURE_SERVERS}; do
 		WORKING_NUM=$((WORKING_NUM+1))
 	done
-	rlAssertGreater "Check we have at least some working servers" "$WORKING_NUM" 3
+	rlAssertGreater "Check we have at least some working root servers" "$WORKING_NUM" 5
 	rlLog "Working root-servers: $bu_SECURE_SERVERS"
 	[ -n "$bu_FAILED_SERVERS" ] && rlLogWarning "Failed root-servers: $bu_FAILED_SERVERS"	
 
@@ -282,23 +328,33 @@ for I in {1..3}; do
     sleep 5
 done
 
+DIG_SEC=buDig
+DIG_INSEC=buDig
+
+for I in $(seq $HOSTS_TRIES); do
     rlPhaseStartTest "Host tests #$I"
+    if [ "$I" = "$HOSTS_PASSING" ]; then
+        DIG_SEC=buDigSuccessSecure
+        DIG_INSEC=buDigSuccessInsecure
+    fi
 	for H in example.{org,com,net} fedoraproject.org isc.org
 	do
-		buDigSuccessSecure @localhost $H A
-		buDigSuccessSecure @localhost $H AAAA
+		$DIG_SEC @localhost $H A
+		$DIG_SEC @localhost $H AAAA
 	done
 	for H in {org,com,net}
 	do
-		buDigSuccessSecure @localhost $H NS
-		buDigSuccessSecure @localhost $H DS
+		$DIG_SEC @localhost $H NS
+		$DIG_SEC @localhost $H DS
 	done
 	for H in {a,d,f}.root-servers.net ipv4only.arpa
 	do
-		buDigSuccessInsecure @localhost $H A
-		buDigSuccessInsecure @localhost $H AAAA
+		$DIG_INSEC @localhost $H A
+		$DIG_INSEC @localhost $H AAAA
 	done
     rlPhaseEnd
+    sleep 5
+done
 fi
 
     rlPhaseStartCleanup