anchor.diff:  
       services.ncdns = {
         enable = true;
  -      dnssec.enable = true;
  +      dnssec.enable = dnssec;
  +      identity.hostname   = "example.com";
  +      identity.hostmaster = "root@example.com";
  +      identity.address    = "1.0.0.1";
       };
   
       services.pdns-recursor = {
         enable = true;
         dns.allowFrom = [ "127.0.0.0/8" ];
  -      settings.loglevel = 8;
         resolveNamecoin = true;
       };
   
  
positive.code: 
    };
  
    testScript = ''
      with subtest("DNSSEC keys have been generated"):
          server.wait_for_unit("ncdns")
          server.wait_for_file("/var/lib/ncdns/bit.key")
          server.wait_for_file("/var/lib/ncdns/bit-zone.key")
  
      with subtest("DNSKEY bit record is present"):
          server.wait_for_unit("pdns-recursor")
          server.wait_for_open_port("53")
          server.succeed("host -t DNSKEY bit")
  
      with subtest("can resolve a .bit name"):
          server.wait_for_unit("namecoind")
          server.wait_for_open_port("8332")
          assert "1.2.3.4" in server.succeed("host -t A test.bit")
    '';
  })
  
negative.code: import ./make-test-python.nix ({ lib, pkgs, ... }:
  let
    fakeReply = pkgs.writeText "namecoin-reply.json" ''
    { "error": null,
  