diff --git a/Sanity/named/caching-forwarder-dnssec/test.sh b/Sanity/named/caching-forwarder-dnssec/test.sh
index e0a5aca..d724749 100755
--- a/Sanity/named/caching-forwarder-dnssec/test.sh
+++ b/Sanity/named/caching-forwarder-dnssec/test.sh
@@ -208,7 +208,7 @@ buDigSuccessInsecure()
 # Extract KSK key id from dig
 buDigKskId()
 {
-	dig +nocrypto +short -t dnskey "$@" | awk '$1 == 257 { sub("]", "", $7); print $7 }'
+	dig +nocrypto +short -t dnskey "$@"| tail -n1 | awk '$1 == 257 { sub("]", "", $7); print $7 }'
 }
 
 
@@ -240,6 +240,7 @@ rlJournalStart
 for I in {1..3}; do
     rlPhaseStartTest "Basic test #$I"
         rlRun "rlServiceStart named"
+        sleep 5 # this test works randomly
 	buDigSuccessSecure @localhost . DNSKEY
 	buDigSuccessSecure @localhost
 
@@ -248,7 +249,7 @@ for I in {1..3}; do
 	rlAssertGreater "Check $KEYID is non-zero" "$KEYID" 0
     TEST1=$(dig +multi $KEYID DNSKEY)
     rlLog "`echo dig_for_dnskey;echo $TEST1`"
-	rlRun "rndc secroots"
+    rlRun "rndc secroots"
 	rlRun "grep \"^./RSASHA256/$KEYID\" /var/named/data/named.secroots" 0 "Check trust anchor is trusted"
 	[ "$HAS_MANAGED_KEYS" = y ] && rlRun "rndc managed-keys status"
     rlPhaseEnd