diff --git a/bin/tests/system/dnssec/README b/bin/tests/system/dnssec/README
new file mode 100644
index 0000000000..fef0827159
--- /dev/null
+++ b/bin/tests/system/dnssec/README
@@ -0,0 +1,12 @@
+
+The test setup for the DNSSEC tests has a secure root.
+
+ns1 is the root server.
+
+ns2 and ns3 are authoritative servers for the various test domains.
+
+ns4 is a caching-only server, configured with the correct trusted key
+for the root.
+
+ns4 is a caching-only server, configured with the an incorrect trusted
+key for the root.  It is used for testing failure cases.