anchor.diff:  		    dnsxd:log(MsgCtx, [{zone, ZoneName},
   				       {tsig_err, badkey}|LogProps])
   	    end,
  -	    Reply = ReplyTmpl#dns_message{rc = notauth},
   	    RespMsg = dns:add_tsig(Reply, Alg, <<>>, <<>>, badkey),
   	    dnsxd_op_ctx:to_wire(MsgCtx, RespMsg)
       end.
  
positive.code:     #dns_rrdata_tsig{alg = AlgM, msgid = MsgId} = Data,
      Alg = dns:dname_to_lower(AlgM),
      KeyName = dns:dname_to_lower(KeyNameM),
      ReplyTmpl = ReqMsg#dns_message{qr = true,
  				   anc = 0, answers = [],
  				   auc = 0, authority = [],
  				   adc = 0, additional = []},
      LogProps = [{op, OC}, {rc, notauth}, {keyname, KeyName}],
      case dnsxd:get_key(KeyName) of
  	{ZoneName, #dnsxd_tsig_key{secret = Secret}} ->
  
negative.code: 		    NewMsgCtx = dnsxd_op_ctx:tsig(MsgCtx, TSIGCtx),
  		    dispatch(NewMsgCtx, ReqMsg);
  		{ok, badtime} ->
  		    RespMsg = dns:add_tsig(Reply, Alg, <<>>, <<>>, badtime,
  					   [{other, <<(dns:unix_time()):32>>}]),
  		    dnsxd:log(MsgCtx, [{tsig_err, badtime}|LogPropsZone]),
  		    dnsxd_op_ctx:to_wire(MsgCtx, RespMsg);
  		{ok, TSIGRC} ->
  		    RespMsg = dns:add_tsig(Reply, Alg, <<>>, <<>>, TSIGRC),
  		    dnsxd:log(MsgCtx, [{tsig_err, TSIGRC}|LogPropsZone]),
  		    dnsxd_op_ctx:to_wire(MsgCtx, RespMsg);
  		{error, bad_alg} ->
  		    RespMsg = dns:add_tsig(Reply, Alg, <<>>, <<>>, badsig),
  		    dnsxd:log(MsgCtx, [{tsig_err, badalg}|LogPropsZone]),
  		    dnsxd_op_ctx:to_wire(MsgCtx, RespMsg)
  