NSEC3: check NXDOMAIN when query hash is before the first existing hash
Check that an NSEC3 iteration count over the RFC limit throws
NSEC3: Ensure that a missing closest encloser results as bogus
NSEC3: unit test to check that NODATA changed to NXDOMAIN is recognized
NSEC3: tests for behavior when a resolver returns data from the parent
NXD: Treat non-secure, non-insecure responses always as bogus
Add test when the longest common name of two zones is the root zone
NSEC: test NODATA when result is from delegation point
Update todo