diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
index b82bae6ac4..b69db64d3c 100755
--- a/bin/tests/system/nsupdate/tests.sh
+++ b/bin/tests/system/nsupdate/tests.sh
@@ -330,7 +330,7 @@ $NSUPDATE -k ns1/ddns.key <<END >nsupdate.out 2>&1 || ret=1
     prereq nxrrset example.nil. type0
     send
 END
-$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n
+$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n || ret=1
 grep "status: NOERROR" dig.out.ns1.$n >/dev/null || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -342,7 +342,7 @@ ret=0
 echo_i "check that TYPE=0 update is handled ($n)"
 echo "a0e4280000010000000100000000060001c00c000000fe000000000000" \
   | $PERL ../packet.pl -a 10.53.0.1 -p ${PORT} -t tcp >/dev/null || ret=1
-$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n
+$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n || ret=1
 grep "status: NOERROR" dig.out.ns1.$n >/dev/null || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -354,7 +354,7 @@ ret=0
 echo_i "check that TYPE=0 additional data is handled ($n)"
 echo "a0e4280000010000000000010000060001c00c000000fe000000000000" \
   | $PERL ../packet.pl -a 10.53.0.1 -p ${PORT} -t tcp >/dev/null || ret=1
-$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n
+$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n || ret=1
 grep "status: NOERROR" dig.out.ns1.$n >/dev/null || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -366,7 +366,7 @@ ret=0
 echo_i "check that update to undefined class is handled ($n)"
 echo "a0e4280000010001000000000000060101c00c000000fe000000000000" \
   | $PERL ../packet.pl -a 10.53.0.1 -p ${PORT} -t tcp >/dev/null || ret=1
-$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n
+$DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 >dig.out.ns1.$n || ret=1
 grep "status: NOERROR" dig.out.ns1.$n >/dev/null || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -890,7 +890,7 @@ zone denyname.example
 update add foo.denyname.example 3600 IN TXT added
 send
 EOF
-$DIG $DIGOPTS +tcp @10.53.0.9 foo.denyname.example TXT >dig.out.ns9.test$n
+$DIG $DIGOPTS +tcp @10.53.0.9 foo.denyname.example TXT >dig.out.ns9.test$n || ret=1
 grep "added" dig.out.ns9.test$n >/dev/null || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -907,7 +907,7 @@ zone denyname.example
 update add denyname.example 3600 IN TXT added
 send
 EOF
-$DIG $DIGOPTS +tcp @10.53.0.9 denyname.example TXT >dig.out.ns9.test$n
+$DIG $DIGOPTS +tcp @10.53.0.9 denyname.example TXT >dig.out.ns9.test$n || ret=1
 grep "added" dig.out.ns9.test$n >/dev/null && ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -921,11 +921,11 @@ $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd dnskey.test. \
   @10.53.0.3 dnskey \
   | awk -v port="${PORT}" 'BEGIN { print "server 10.53.0.3", port; }
 	$2 == 10 && $3 == "IN" && $4 == "DNSKEY" { $2 = 600; print "update add", $0 }
-	END { print "send" }' >update.in.$n
+	END { print "send" }' >update.in.$n || ret=1
 $NSUPDATE update.in.$n
 
 $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd dnskey.test. \
-  @10.53.0.3 any >dig.out.ns3.$n
+  @10.53.0.3 any >dig.out.ns3.$n || ret=1
 
 grep "600.*DNSKEY" dig.out.ns3.$n >/dev/null || ret=1
 grep TYPE65534 dig.out.ns3.$n >/dev/null && ret=1
@@ -1126,7 +1126,7 @@ n=$((n + 1))
 ret=0
 echo_i "add a record which is truncated when logged. ($n)"
 $NSUPDATE verylarge || ret=1
-$DIG $DIGOPTS +tcp @10.53.0.1 txt txt.update.nil >dig.out.ns1.test$n
+$DIG $DIGOPTS +tcp @10.53.0.1 txt txt.update.nil >dig.out.ns1.test$n || ret=1
 grep "ANSWER: 1," dig.out.ns1.test$n >/dev/null || ret=1
 grep "adding an RR at 'txt.update.nil' TXT .* \[TRUNCATED\]" ns1/named.run >/dev/null || ret=1
 if [ $ret -ne 0 ]; then
@@ -1270,7 +1270,7 @@ update add child.delegation.test. 3600 NS foo.example.net.
 update add child.delegation.test. 3600 NS bar.example.net.
 send
 EOF
-$DIG $DIGOPTS +tcp @10.53.0.3 ns child.delegation.test >dig.out.ns1.test$n
+$DIG $DIGOPTS +tcp @10.53.0.3 ns child.delegation.test >dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n >/dev/null 2>&1 || ret=1
 grep "AUTHORITY: 2" dig.out.ns1.test$n >/dev/null 2>&1 || ret=1
 [ $ret = 0 ] || {
@@ -1288,7 +1288,7 @@ update del child.delegation.test. 3600 NS foo.example.net.
 update del child.delegation.test. 3600 NS bar.example.net.
 send
 EOF
-$DIG $DIGOPTS +tcp @10.53.0.3 ns child.delegation.test >dig.out.ns1.test$n
+$DIG $DIGOPTS +tcp @10.53.0.3 ns child.delegation.test >dig.out.ns1.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns1.test$n >/dev/null 2>&1 || ret=1
 [ $ret = 0 ] || {
   echo_i "failed"
@@ -1305,7 +1305,7 @@ update add r1.too-big.test 3600 IN TXT r1.too-big.test
 send
 EOF
 grep "update failed: SERVFAIL" nsupdate.out.test$n >/dev/null || ret=1
-$DIG $DIGOPTS +tcp @10.53.0.3 r1.too-big.test TXT >dig.out.ns3.test$n
+$DIG $DIGOPTS +tcp @10.53.0.3 r1.too-big.test TXT >dig.out.ns3.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns3.test$n >/dev/null || ret=1
 grep "records in zone (4) exceeds max-records (3)" ns3/named.run >/dev/null || ret=1
 [ $ret = 0 ] || {
@@ -1560,7 +1560,7 @@ send
 END
 $DIG $DIGOPTS @10.53.0.6 \
   +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
-  -x 10.53.0.5 >dig.out.ns6.$n
+  -x 10.53.0.5 >dig.out.ns6.$n || ret=1
 # the policy is 'grant * tcp-self . PTR(1) ANY(2) A;' so only the
 # first PTR record should be added.
 grep localhost. dig.out.ns6.$n >/dev/null 2>&1 || ret=1
@@ -1590,7 +1590,7 @@ send
 END
 $DIG $DIGOPTS @10.53.0.6 \
   +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
-  ANY -x 10.53.0.5 >dig.out.ns6.test$n
+  ANY -x 10.53.0.5 >dig.out.ns6.test$n || ret=1
 nextpart ns6/named.run >nextpart.out.test$n
 grep "attempt to add more records than permitted by policy" nextpart.out.test$n >/dev/null || ret=1
 # the policy is 'grant * tcp-self . PTR(1) ANY(2) A;' so all the A
@@ -1815,7 +1815,7 @@ EOF
   update add machine.example.com 3600 IN A 10.53.0.7
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 machine.example.com A >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 machine.example.com A >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "machine.example.com..*A.*10.53.0.7" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -1837,7 +1837,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 foo.example.com A >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 foo.example.com A >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -1857,7 +1857,7 @@ EOF
   update add _xxx._tcp.example.com 3600 IN SRV 0 0 0 machine.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx._tcp.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx._tcp.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "_xxx._tcp.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -1879,7 +1879,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx._udp.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx._udp.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -1899,7 +1899,7 @@ EOF
   update add 4.3.2.1.in-addr.arpa 3600 IN PTR machine.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 4.3.2.1.in-addr.arpa PTR >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 4.3.2.1.in-addr.arpa PTR >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "4.3.2.1.in-addr.arpa.*PTR.*machine.example.com" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -1921,7 +1921,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 5.3.2.1.in-addr.arpa PTR >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 5.3.2.1.in-addr.arpa PTR >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -1941,7 +1941,7 @@ EOF
   update add _xxx.self-srv.example.com 3600 IN SRV 0 0 0 machine.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx.self-srv.example.com ANY >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx.self-srv.example.com ANY >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "_xxx.self-srv.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -1963,7 +1963,7 @@ EOF
   update add _xxx.self-srv-no-type.example.com 3600 IN TXT a txt record
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx.self-srv-no-type.example.com ANY >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx.self-srv-no-type.example.com ANY >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep '_xxx.self-srv-no-type.example.com.*SRV.*0 0 0 machine.example.com' dig.out.ns7.test$n >/dev/null || ret=1
   grep '_xxx.self-srv-no-type.example.com.*TXT.*"a" "txt" "record"' dig.out.ns7.test$n >/dev/null || ret=1
@@ -1986,7 +1986,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 _yyy.self-srv.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 _yyy.self-srv.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2007,7 +2007,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 _yyy.self-srv.example.com TXT >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 _yyy.self-srv.example.com TXT >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2017,7 +2017,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check krb5-subdomain-self-rhs delete PTR (matching PTR) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns7.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns7.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns7.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
@@ -2030,7 +2030,7 @@ EOF
   update delete single.ptr.self-ptr.in-addr.arpa PTR
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2051,7 +2051,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 many.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 many.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2062,7 +2062,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check krb5-subdomain-self-rhs delete ANY (matching PTR) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns7.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns7.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns7.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
@@ -2075,7 +2075,7 @@ EOF
   update delete single.any.self-ptr.in-addr.arpa
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2096,7 +2096,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 many.any.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 many.any.self-ptr.in-addr.arpa PTR >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2107,7 +2107,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check krb5-subdomain-self-rhs delete SRV (matching SRV) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.srv.self-srv.example.com SRV >dig.out.ns7.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.srv.self-srv.example.com SRV >dig.out.ns7.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns7.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
@@ -2120,7 +2120,7 @@ EOF
   update delete single.srv.self-srv.example.com SRV
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.srv.self-srv.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.srv.self-srv.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2141,7 +2141,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 many.srv.self-srv.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 many.srv.self-srv.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2152,7 +2152,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check krb5-subdomain-self-rhs delete ANY (matching SRV) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-srv.example.com SRV >dig.out.ns7.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-srv.example.com SRV >dig.out.ns7.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns7.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
@@ -2165,7 +2165,7 @@ EOF
   update delete single.any.self-srv.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-srv.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-srv.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2186,7 +2186,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.7 many.any.self-srv.example.com SRV >dig.out.ns7.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.7 many.any.self-srv.example.com SRV >dig.out.ns7.test$n || ret=1
   grep "status: NOERROR" dig.out.ns7.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns7.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2207,7 +2207,7 @@ EOF
   update add xxx.machine.example.com 3600 IN A 10.53.0.8
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.8 xxx.machine.example.com A >dig.out.ns8.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.8 xxx.machine.example.com A >dig.out.ns8.test$n || ret=1
   grep "status: NOERROR" dig.out.ns8.test$n >/dev/null || ret=1
   grep "xxx.machine.example.com..*A.*10.53.0.8" dig.out.ns8.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2229,7 +2229,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.8 foo.example.com A >dig.out.ns8.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.8 foo.example.com A >dig.out.ns8.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns8.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2249,7 +2249,7 @@ EOF
   update add machine.example.com 3600 IN A 10.53.0.9
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.9 machine.example.com A >dig.out.ns9.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.9 machine.example.com A >dig.out.ns9.test$n || ret=1
   grep "status: NOERROR" dig.out.ns9.test$n >/dev/null || ret=1
   grep "machine.example.com..*A.*10.53.0.9" dig.out.ns9.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2271,7 +2271,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.9 foo.example.com A >dig.out.ns9.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.9 foo.example.com A >dig.out.ns9.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns9.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2291,7 +2291,7 @@ EOF
   update add _xxx._tcp.example.com 3600 IN SRV 0 0 0 machine.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.9 _xxx._tcp.example.com SRV >dig.out.ns9.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.9 _xxx._tcp.example.com SRV >dig.out.ns9.test$n || ret=1
   grep "status: NOERROR" dig.out.ns9.test$n >/dev/null || ret=1
   grep "_xxx._tcp.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns9.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2313,7 +2313,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.9 _xxx._udp.example.com SRV >dig.out.ns9.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.9 _xxx._udp.example.com SRV >dig.out.ns9.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns9.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2333,7 +2333,7 @@ EOF
   update add 4.3.2.1.in-addr.arpa 3600 IN PTR machine.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 4.3.2.1.in-addr.arpa PTR >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 4.3.2.1.in-addr.arpa PTR >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "4.3.2.1.in-addr.arpa.*PTR.*machine.example.com" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2355,7 +2355,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 5.3.2.1.in-addr.arpa PTR >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 5.3.2.1.in-addr.arpa PTR >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2375,7 +2375,7 @@ EOF
   update add _xxx.self-srv.example.com 3600 IN SRV 0 0 0 machine.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 _xxx.self-srv.example.com SRV >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 _xxx.self-srv.example.com SRV >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "_xxx.self-srv.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2397,7 +2397,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 _yyy.self-srv.example.com SRV >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 _yyy.self-srv.example.com SRV >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2407,7 +2407,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check ms-subdomain-self-rhs delete SRV (matching SRV) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.srv.self-srv.example.com SRV >dig.out.ns10.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.srv.self-srv.example.com SRV >dig.out.ns10.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns10.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
@@ -2420,7 +2420,7 @@ EOF
   update delete single.srv.self-srv.example.com SRV
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.srv.self-srv.example.com SRV >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.srv.self-srv.example.com SRV >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2441,7 +2441,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 many.srv.self-srv.example.com SRV >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 many.srv.self-srv.example.com SRV >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2452,7 +2452,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check ms-subdomain-self-rhs delete PTR (matching PTR) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns10.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns10.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns10.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
@@ -2465,7 +2465,7 @@ EOF
   update delete single.ptr.self-ptr.in-addr.arpa PTR
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2486,7 +2486,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 many.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 many.ptr.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2497,7 +2497,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check ms-subdomain-self-rhs delete ANY (matching PTR) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns10.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns10.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns10.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
@@ -2510,7 +2510,7 @@ EOF
   update delete single.any.self-ptr.in-addr.arpa
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2531,7 +2531,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 many.any.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 many.any.self-ptr.in-addr.arpa PTR >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2542,7 +2542,7 @@ EOF
   n=$((n + 1))
   ret=0
   echo_i "check ms-subdomain-self-rhs delete ANY (matching SRV) ($n)"
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-srv.example.com SRV >dig.out.ns10.pre.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-srv.example.com SRV >dig.out.ns10.pre.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.pre.test$n >/dev/null || ret=1
   grep "ANSWER: 1," dig.out.ns10.pre.test$n >/dev/null || ret=1
   KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
@@ -2555,7 +2555,7 @@ EOF
   update delete single.any.self-srv.example.com
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-srv.example.com SRV >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-srv.example.com SRV >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"
@@ -2576,7 +2576,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 many.any.self-srv.example.com SRV >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 many.any.self-srv.example.com SRV >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "ANSWER: 2," dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2597,7 +2597,7 @@ EOF
   update add xxx.machine.example.com 3600 IN A 10.53.0.10
   send
 EOF
-  $DIG $DIGOPTS +tcp @10.53.0.10 xxx.machine.example.com A >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 xxx.machine.example.com A >dig.out.ns10.test$n || ret=1
   grep "status: NOERROR" dig.out.ns10.test$n >/dev/null || ret=1
   grep "xxx.machine.example.com..*A.*10.53.0.10" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
@@ -2619,7 +2619,7 @@ EOF
   send
 EOF
   grep "update failed: REFUSED" nsupdate.out.test$n >/dev/null || ret=1
-  $DIG $DIGOPTS +tcp @10.53.0.10 foo.example.com A >dig.out.ns10.test$n
+  $DIG $DIGOPTS +tcp @10.53.0.10 foo.example.com A >dig.out.ns10.test$n || ret=1
   grep "status: NXDOMAIN" dig.out.ns10.test$n >/dev/null || ret=1
   [ $ret = 0 ] || {
     echo_i "failed"