There is a trick:
Original answer to query `. NS` contains a lot of NS names which are not
interesting for the test itself. The additional section supplies just
single IP address and the test does not contain root-servers.net. domain
and related infrastructure. This works with current kresd but might
break in future if kresd starts to require all names (or IPv6 or so).