diff --git a/Sanity/utils/pkcs11-tools/main.fmf b/Sanity/utils/pkcs11-tools/main.fmf
index 5542452..0f36b0f 100644
--- a/Sanity/utils/pkcs11-tools/main.fmf
+++ b/Sanity/utils/pkcs11-tools/main.fmf
@@ -15,8 +15,9 @@ adjust+:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6
     continue: false
-recommends+:
+recommend+:
   - bind-utils
+  - bind-dnssec-utils
   - softhsm
   - opensc
   - pkcs11-provider
diff --git a/Sanity/utils/pkcs11-tools/runtest.sh b/Sanity/utils/pkcs11-tools/runtest.sh
index 98e4251..3502a6c 100755
--- a/Sanity/utils/pkcs11-tools/runtest.sh
+++ b/Sanity/utils/pkcs11-tools/runtest.sh
@@ -31,7 +31,8 @@
 : ${PACKAGE:=bind}
 BACKUP_RESOLV=""
 SOURCE_RESOLV="/etc/resolv.conf"
-: ${ENGINE:=-E pkcs11}
+: ${ENGINE:=pkcs11}
+: ${USE_ENGINE:=y}
 
 make_openssl_conf() {
 	cat << EOF
@@ -107,6 +108,8 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartSetup "Prepare token"
+        # This test prepares token to be used by the root user, not really complicating it with file access rights.
+        # It may not emulare properly what is used by named
 	rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -L" 0 "check slots"
 	rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -T" 0 "check tokens"
 	rlRun "pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN --keypairgen --key-type RSA:2048 --label test-zsk" 0 "generate new pair"
@@ -121,11 +124,15 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartTest "Test DNSSEC operations on token"
-	rlRun "dnssec-keyfromlabel -a RSASHA256 $ENGINE -l \"$ZSK_URI?pin-source=$PIN_SOURCE\" test" 0 "Import dnssec ZSK"
-	rlRun "dnssec-keyfromlabel -a RSASHA256 $ENGINE -l \"$KSK_URI?pin-source=$PIN_SOURCE\" -f KSK test" 0 "Import dnssec KSK"
-        rlRun "dnssec-signzone $ENGINE -S -o test test.zone" 0 "Create zone signatures"
+        DNSSEC_ENGINE=""
+        if [ "$USE_ENGINE" = y ]; then
+            DNSSEC_ENGINE="-E $ENGINE"
+        fi
+	rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$ZSK_URI?pin-source=$PIN_SOURCE\" test" 0 "Import dnssec ZSK"
+	rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$KSK_URI?pin-source=$PIN_SOURCE\" -f KSK test" 0 "Import dnssec KSK"
+        rlRun "dnssec-signzone $DNSSEC_ENGINE -S -o test test.zone" 0 "Create zone signatures"
         rlRun "test -e test.zone.signed" 0 "Check signed zone were created."
-        rlRun "dnssec-verify $ENGINE -o test test.zone.signed" 0 "Check zone were signed ok"
+        rlRun "dnssec-verify $DNSSEC_ENGINE -o test test.zone.signed" 0 "Check zone were signed ok"
         rlRun "named-checkzone test test.zone"
         rlRun "named-checkzone test test.zone.signed"
 	[ "$DEBUG" = y ] && PS1="test-debug $PS1" bash -i