anchor.diff:                            expected,
                             ["+tcp", "+tls"] + args,
                         )
  +                      query(
  +                          machine,
  +                          remote,
  +                          query_type,
  +                          zone,
  +                          expected,
  +                          ["+https"] + args,
  +                      )
   
   
         client.start()
  
positive.code:         # disable the root anchor update as we do not have internet access during
          # the test execution
          services.unbound.enableRootTrustAnchor = false;
        };
      };
  
  
negative.code:         networking.firewall.allowedTCPPorts = [
            53 # regular DNS
            853 # DNS over TLS
            443 # DNS over HTTPS
          ];
          networking.firewall.allowedUDPPorts = [ 53 ];
  
          services.unbound = {
            enable = true;
            allowedAccess = [ "192.168.0.0/24" "fd21::/64" "::1" "127.0.0.0/8" ];
            interfaces = [ "::1" "127.0.0.1" "192.168.0.2" "fd21::2"
                           "192.168.0.2@853" "fd21::2@853" "::1@853" "127.0.0.1@853"
                           "192.168.0.2@443" "fd21::2@443" "::1@443" "127.0.0.1@443" ];
            forwardAddresses = [
              (lib.head nodes.authoritative.config.networking.interfaces.eth1.ipv6.addresses).address
              (lib.head nodes.authoritative.config.networking.interfaces.eth1.ipv4.addresses).address
  