diff --git a/mio/bin/t01.c b/mio/bin/t01.c
index c89db2c..7c6e512 100644
--- a/mio/bin/t01.c
+++ b/mio/bin/t01.c
@@ -709,6 +709,7 @@ static void on_dnc_resolve(mio_svc_dnc_t* dnc, mio_dns_msg_t* reqmsg, mio_errnum
 		if (pi->hdr.rcode == MIO_DNS_RCODE_BADCOOKIE)
 		{
 			/* TODO: must retry?? there shoudl be no RRs in the payload */
+			//if (mio_svc_dnc_resolve(dnc, mio_svc_dnc_getqnamefromreqmsg(reqmsg), mio_svc_dnc_getqtypefromreqmsg(qtype), mio_svc_dnc_getresolflagsfromreqmsg(resolve_flags), on_dnc_resolve, 0) >= 0) return;
 		}
 
 		if (mio_svc_dnc_checkclientcookie(dnc, reqmsg, pi) == 0)
@@ -1003,12 +1004,12 @@ static int schedule_timer_job_after (mio_t* mio, const mio_ntime_t* fire_after,
 static void send_test_query (mio_t* mio, const mio_ntime_t* now, mio_tmrjob_t* job)
 {
 	//if (!mio_svc_dnc_resolve((mio_svc_dnc_t*)job->ctx, "www.microsoft.com", MIO_DNS_RRT_CNAME, MIO_SVC_DNC_RESOLVE_FLAG_COOKIE, on_dnc_resolve, 0))
-	if (!mio_svc_dnc_resolve((mio_svc_dnc_t*)job->ctx, "mailserver.manyhost.net", MIO_DNS_RRT_A, MIO_SVC_DNC_RESOLVE_FLAG_COOKIE, on_dnc_resolve, 0))
+	if (!mio_svc_dnc_resolve((mio_svc_dnc_t*)job->ctx, "mailserver.manyhost.net", MIO_DNS_RRT_A, MIO_SVC_DNC_RESOLVE_FLAG_COOKIE | MIO_SVC_DNC_RESOLVE_FLAG_DNSSEC, on_dnc_resolve, 0))
 	{
 		printf ("resolve attempt failure ---> mailserver.manyhost.net\n");
 	}
 
-	if (!mio_svc_dnc_resolve((mio_svc_dnc_t*)job->ctx, "ns2.switch.ch", MIO_DNS_RRT_A, MIO_SVC_DNC_RESOLVE_FLAG_COOKIE, on_dnc_resolve, 0))
+	if (!mio_svc_dnc_resolve((mio_svc_dnc_t*)job->ctx, "ns2.switch.ch", MIO_DNS_RRT_A, MIO_SVC_DNC_RESOLVE_FLAG_COOKIE | MIO_SVC_DNC_RESOLVE_FLAG_DNSSEC, on_dnc_resolve, 0))
 	{
 		printf ("resolve attempt failure ---> ns2.switch.ch\n");
 	}
@@ -1227,7 +1228,8 @@ for (i = 0; i < 5; i++)
 	reply_tmout.nsec = 0;
 
 	//mio_bcstrtoskad (mio, "8.8.8.8:53", &servaddr);
-	mio_bcstrtoskad (mio, "130.59.31.29:53", &servaddr); // ns2.switch.ch
+	mio_bcstrtoskad (mio, "198.41.0.4:53", &servaddr); // a.root-servers.net
+	//mio_bcstrtoskad (mio, "130.59.31.29:53", &servaddr); // ns2.switch.ch
 	//mio_bcstrtoskad (mio, "134.119.216.86:53", &servaddr); // ns.manyhost.net
 	//mio_bcstrtoskad (mio, "[fe80::c7e2:bd6e:1209:ac1b]:1153", &servaddr);
 	//mio_bcstrtoskad (mio, "[fe80::c7e2:bd6e:1209:ac1b%eno1]:1153", &servaddr);
diff --git a/mio/lib/dns-cli.c b/mio/lib/dns-cli.c
index c2f2db4..b1d7453 100644
--- a/mio/lib/dns-cli.c
+++ b/mio/lib/dns-cli.c
@@ -884,28 +884,12 @@ static void on_dnc_resolve (mio_svc_dnc_t* dnc, mio_dns_msg_t* reqmsg, mio_errnu
 
 		if (resolxtn->flags & MIO_SVC_DNC_RESOLVE_FLAG_COOKIE)
 		{
-			/* ------------------------------------------------- */
 			if (pi->edns.cookie.server_len > 0)
 			{
-				/* remember the server cookie received to use it with other new requests */
+				/* remember the received server cookie to use it with other new requests */
 				MIO_MEMCPY (dnc->cookie.data.server, pi->edns.cookie.data.server, pi->edns.cookie.server_len);
 				dnc->cookie.server_len = pi->edns.cookie.server_len;
 			}
-
-#if 0
-			if (pi->hdr.rcode == MIO_DNS_RCODE_BADCOOKIE)
-			{
-				/* TODO: retry it */
-#if 0
-				if (mio_svc_dnc_resolve(dnc, qname, resolxtn->qtype, resolxtn->flags, on_dnc_resolve, resolxtn->xtnsize) <= -1)
-				{
-				}
-#endif
-				/*how to retry?*/
-			}
-#endif
-			/* ------------------------------------------------- */
-
 		}
 
 		if (!(resolxtn->flags & MIO_SVC_DNC_RESOLVE_FLAG_BRIEF))
@@ -1031,6 +1015,11 @@ mio_dns_msg_t* mio_svc_dnc_resolve (mio_svc_dnc_t* dnc, const mio_bch_t* qname,
 		qedns.beoptr = &beopt_cookie;
 	}
 
+	if (resolve_flags & MIO_SVC_DNC_RESOLVE_FLAG_DNSSEC)
+	{
+		qedns.dnssecok = 1;
+	}
+
 	reqmsg = make_dns_msg(dnc, &qhdr, &qr, 1, MIO_NULL, 0, &qedns, on_dnc_resolve, MIO_SIZEOF(*resolxtn) + xtnsize);
 	if (reqmsg)
 	{
diff --git a/mio/lib/mio-dns.h b/mio/lib/mio-dns.h
index 786b0c8..8c484d0 100644
--- a/mio/lib/mio-dns.h
+++ b/mio/lib/mio-dns.h
@@ -407,8 +407,9 @@ enum mio_svc_dnc_resolve_flag_t
 	/* the following flag bits are resolver specific. it must not overlap with send flag bits */
 	MIO_SVC_DNC_RESOLVE_FLAG_BRIEF      = (1 << 8),
 	MIO_SVC_DNC_RESOLVE_FLAG_COOKIE     = (1 << 9),
+	MIO_SVC_DNC_RESOLVE_FLAG_DNSSEC     = (1 << 10),
 
-	MIO_SVC_DNC_RESOLVE_FLAG_ALL = (MIO_SVC_DNC_RESOLVE_FLAG_PREFER_TCP | MIO_SVC_DNC_RESOLVE_FLAG_TCP_IF_TC | MIO_SVC_DNC_RESOLVE_FLAG_BRIEF | MIO_SVC_DNC_RESOLVE_FLAG_COOKIE)
+	MIO_SVC_DNC_RESOLVE_FLAG_ALL = (MIO_SVC_DNC_RESOLVE_FLAG_PREFER_TCP | MIO_SVC_DNC_RESOLVE_FLAG_TCP_IF_TC | MIO_SVC_DNC_RESOLVE_FLAG_BRIEF | MIO_SVC_DNC_RESOLVE_FLAG_COOKIE | MIO_SVC_DNC_RESOLVE_FLAG_DNSSEC)
 };
 typedef enum mio_svc_dnc_resolve_flag_t  mio_svc_dnc_resolve_flag_t;