Avoid reserved test zone in SMTP DNSSEC fixture

contrib/testing/smtp-dane-mta-sts-check.py

@@ -31,7 +31,10 @@ import time
 
 
 TOKEN = f"smtp27-{os.getpid()}-{int(time.time())}"
-ZONE = "smtp27.test"
+# libunbound correctly synthesizes NXDOMAIN for the RFC 6761 .test zone
+# before consulting forwarders.  Use a disposable private test TLD so the
+# embedded resolver exercises the same validating path as an Internet domain.
+ZONE = "smtp27.bongo-test"
 DNS_RESOLVER = "127.0.0.53"
 DNS_AUTHORITY = "127.0.0.1"
 # Avoid mDNS' wildcard UDP/5353 listener, which may be active on desktops.
@@ -121,11 +124,11 @@ ROUTES = (
     Route("sts-testing", "127.0.0.5", None,
           sts_mode="testing"),
     Route("sts-mismatch", "127.0.0.6", "trusted",
-          sts_mode="enforce", sts_mx="other.smtp27.test"),
+          sts_mode="enforce", sts_mx=f"other.{ZONE}"),
     Route("dane-precedence", "127.0.0.7", "trusted",
           sts_mode="enforce", tlsa="invalid"),
     Route("sts-cache", "127.0.0.8", "trusted",
-          sts_mode="enforce", sts_mx="*.smtp27.test"),
+          sts_mode="enforce", sts_mx=f"*.{ZONE}"),
     Route("sts-plain", "127.0.0.10", None,
           sts_mode="enforce"),
 )
@@ -394,7 +397,6 @@ def write_dns_configs(directory: Path, trust_anchor: str) -> None:
         f'  pidfile: "{directory / "unbound.pid"}"\n'
         f'  logfile: "{directory / "unbound.log"}"\n'
         "  use-syslog: no\n"
-        '  local-zone: "test." nodefault\n'
         f'  trust-anchor-file: "{directory / "anchor"}"\n'
         "stub-zone:\n"
         f'  name: "{ZONE}."\n'