Ghost User
--- a/src/knot/dnssec/nsec3-chain.c
+++ b/src/knot/dnssec/nsec3-chain.c
 		return false;
 	}

-	knot_rrset_t *a_rrset = a->rrset_tree[0];
-	knot_rrset_t *b_rrset = b->rrset_tree[0];
+	const knot_rrset_t *a_rrset = knot_node_rrset(a, KNOT_RRTYPE_NSEC3);
+	const knot_rrset_t *b_rrset = knot_node_rrset(b, KNOT_RRTYPE_NSEC3);
--- a/src/knot/dnssec/nsec3-chain.c
+++ b/src/knot/dnssec/nsec3-chain.c
-
-	assert(to_rrset->rrsigs == NULL);
-
-	to_rrset->rrsigs = from_rrset->rrsigs;
+	knot_rrset_t *from_sig = knot_node_get_rrset(from, KNOT_RRTYPE_RRSIG);
+	if (from_sig == NULL) {
+		return KNOT_EOK;
+	}
+	return knot_node_add_rrset(to, from_sig);
 }

 /*!
 * \brief Reuse signatatures by shallow copying them from one tree to another.
 */
-static void copy_signatures(const knot_zone_tree_t *from, knot_zone_tree_t *to)
+static int copy_signatures(const knot_zone_tree_t *from, knot_zone_tree_t *to)
--- a/src/knot/dnssec/nsec3-chain.c
+++ b/src/knot/dnssec/nsec3-chain.c
+		 * Remove possible NSEC from the node. (Do not allow both NSEC
+		 * and NSEC3 in the zone at once.)
+		 */
+		result = knot_nsec_changeset_remove(knot_node_rrset(node,
+		                                    KNOT_RRTYPE_NSEC),
+		                                    knot_node_rrset(node,
+		                                    KNOT_RRTYPE_RRSIG),
+		                                    chgset);
+		if (result != KNOT_EOK) {
+			break;
+		}
+		if (knot_node_rrset(node, KNOT_RRTYPE_NSEC)) {
+			knot_node_set_replaced_nsec(node);
+		}
+
+		if (knot_node_is_non_auth(node)) {
--- a/src/knot/dnssec/zone-sign.c
+++ b/src/knot/dnssec/zone-sign.c
+	return add_missing_rrsigs(covered, rrsigs, zone_keys, policy,
 	                          changeset);
 }

+static int remove_standalone_rrsigs(const knot_node_t *node,
+                                   const knot_rrset_t *rrsigs,
+                                   knot_changeset_t *changeset)
+{
+	if (rrsigs == NULL) {
+		return KNOT_EOK;
+	}
+
+	for (size_t i = 0; i < rrsigs->rdata_count; ++i) {
+		uint16_t type_covered = knot_rdata_rrsig_type_covered(rrsigs, i);
+		if (!knot_node_rrset(node, type_covered)) {
+			knot_rrset_t *to_remove = knot_rrset_new_from(rrsigs, NULL);
--- a/src/knot/dnssec/zone-sign.c
+++ b/src/knot/dnssec/zone-sign.c
 		}
 	}

-	return result;
+	if (result != KNOT_EOK) {
--- a/src/knot/nameserver/internet.c
+++ b/src/knot/nameserver/internet.c
 			return KNOT_ESPACE;
 		}
 		for (unsigned i = 0; i < knot_node_rrset_count(qdata->node); ++i) {
-			ret = put_rr(pkt, rrsets[i], compr_hint, 0, qdata);
+			ret = put_rr(pkt, rrsets[i], NULL, compr_hint, 0, qdata);
 			if (ret != KNOT_EOK) {
 				break;
 			}
 		}
 		break;
-	case KNOT_RRTYPE_RRSIG: /* Append all RRSIGs. */
--- a/src/knot/zone/zone-contents.c
+++ b/src/knot/zone/zone-contents.c

 /*----------------------------------------------------------------------------*/

+static int insert_rr(knot_zone_contents_t *z, knot_rrset_t *rr, knot_node_t **n,
--- a/src/knot/zone/zone-create.c
+++ b/src/knot/zone/zone-create.c
+}
+
+int zcreator_step(zcreator_t *zc, knot_rrset_t *rr)
+{
+	assert(zc && rr);
+
+	if (rr->type == KNOT_RRTYPE_SOA &&
+	    knot_node_rrset(zc->z->apex, KNOT_RRTYPE_SOA)) {
+		// Ignore extra SOA
+		knot_rrset_deep_free(&rr, true, NULL);
+		return KNOT_EOK;
+	}
+
+	knot_node_t *n;
+	if (zc->last_node &&
+	    knot_dname_is_equal(zc->last_node->owner, rr->owner)) {
--- a/src/knot/zone/zone-create.c
+++ b/src/knot/zone/zone-create.c
+		knot_rrset_deep_free(&rr, true, NULL);
+	}
+	assert(n);
+	zc->last_node = n;
+
+	bool sem_fatal_error = false;
+	err_handler_t err_handler;
+	err_handler_init(&err_handler);
+	ret = sem_check_node_plain(zc->z, n,
+	                           &err_handler, true,
+	                           &sem_fatal_error);
+	if (ret != KNOT_EOK) {
+		return ret;
+	}
+
+	return sem_fatal_error ? KNOT_EMALF : KNOT_EOK;
--- a/src/knot/zone/zone-create.h
+++ b/src/knot/zone/zone-create.h
+#ifndef _KNOT_ZONELOAD_H_
+#define _KNOT_ZONELOAD_H_
+
+#include <stdio.h>
+
+#include "knot/zone/zone.h"
+#include "knot/zone/semantic-check.h"
+#include "zscanner/zscanner.h"
+/*!
+* \brief Zone creator structure.
+*/
+typedef struct zone_creator {
+	knot_zone_contents_t *z;  /*!< Created zone. */
+	knot_node_t *last_node;   /*!< Last used node, use to save zone lookup. */
+	int ret;                  /*!< Return value. */
+} zcreator_t;
--- a/src/knot/zone/zone-create.h
+++ b/src/knot/zone/zone-create.h
+*
+* \retval Loaded zone contents on success.
+* \retval NULL otherwise.
+*/
+knot_zone_contents_t *zonefile_load(zloader_t *loader);
+
+/*!
+* \brief Close zone file loader.
+*
+* \param loader Zone loader instance.
+*/
+void zonefile_close(zloader_t *loader);
+
+knot_zone_contents_t *create_zone_from_name(const char *origin);
+
+int zcreator_step(zcreator_t *zl, knot_rrset_t *rr);