anchor.diff:                {_,valid} ->
                     send_zone(Zone#rpz.cache,Socket,{Question,DNSId,OptB,OptE,<<QDCOUNT:2,ANCOUNT:2,NSCOUNT:2,ARCOUNT:2>>,Rest,Zone,QType,NSServ,MailAddr,TSIG1,SOA}, Proto),
                     ioc2rpz_fun:logMessageCEF(ioc2rpz_fun:msg_CEF(201),[ip_to_str(Proto#proto.rip),Proto#proto.rport,Proto#proto.proto,QStr, ioc2rpz_fun:q_type(QType), ioc2rpz_fun:q_class(QClass),dombin_to_str(TSIG#dns_TSIG_RR.name),(erlang:system_time(millisecond)-STime)]);
  +                  %%%%%%%%%% double check TSIG1 was replaced with TSIG
                 {_,TSIGV} -> send_TSIG_error(TSIGV, Socket, DNSId, OptB, OptE, Question, TSIG1, ["zone transfer failed ~n",[Zone#rpz.zone_str,TSIGV],QStr, QType, QClass], Proto)
               end;
           _ ->
  
positive.code: 
  
  send_TSIG_error(notsig, Socket, DNSId, OptB, OptE, Question, TSIG, [MSG,_TSGV,QStr, QType, QClass], Proto) ->
   %%% to check TSIG name --- dombin_to_str(TSIG#dns_TSIG_RR.name)
    ioc2rpz_fun:logMessageCEF(ioc2rpz_fun:msg_CEF(103),[ip_to_str(Proto#proto.rip),Proto#proto.rport,Proto#proto.proto,QStr, ioc2rpz_fun:q_type(QType), ioc2rpz_fun:q_class(QClass),<<>>,MSG]),
    send_REQST(Socket, DNSId, <<1:1,OptB:7, 0:1, OptE:3,?REFUSED:4>>, <<1:16,0:16,0:16,0:16>>, Question, [], Proto);
  
  
negative.code:           "sha512" -> crypto:hmac(sha512,KEY,PKT)
          end,
          case CH_MAC == TSIG#dns_TSIG_RR.mac of
            true when LTime >= RTimeL, LTime =< RTimeH -> ?logDebugMSG("Good timestamp ... Valid MAC~n",[]),      {valid,TSIG#dns_TSIG_RR{alg_str=Alg,key=KEY}};
            false when LTime >= RTimeL, LTime =< RTimeH -> ?logDebugMSG("Good timestamp ... NOT Valid MAC~n",[]), {badmac,[]};
              %TODO 4.5.2 cache client time and if later request contains early time -> BADTIME
            true -> ?logDebugMSG("Bad timestamp ... Valid MAC ~n",[]),  {badtimegoodmac,TSIG#dns_TSIG_RR{alg_str=Alg,key=KEY}};
            false -> ?logDebugMSG("Bad timestamp ... NOT Valid MAC ~n",[]), {badmac,[]}
          end;
      {_,_} ->
          ?logDebugMSG("Key NOT found ~p ~p~n",[dombin_to_str(TSIG#dns_TSIG_RR.name), dombin_to_str(TSIG#dns_TSIG_RR.alg)]),
  