diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
index 25919f81e3..20758a6926 100644
--- a/bin/tests/system/upforwd/tests.sh
+++ b/bin/tests/system/upforwd/tests.sh
@@ -229,10 +229,12 @@ fi
 n=$((n + 1))
 
 if test -f keyname; then
-  echo_i "checking update forwarding to with sig0 ($n)"
+  echo_i "checking update forwarding to with sig0 (expected to fail) ($n)"
   ret=0
   keyname=$(cat keyname)
-  $NSUPDATE -k $keyname.private -- - <<EOF
+  # SIG(0) is removed, update is expected to fail.
+  {
+    $NSUPDATE -k $keyname.private -- - <<EOF
 	local 10.53.0.1
 	server 10.53.0.3 ${PORT}
 	zone example2
@@ -240,8 +242,9 @@ if test -f keyname; then
 	update add unsigned.example2. 600 TXT Foo
 	send
 EOF
+  } >nsupdate.out.$n 2>&1 && ret=1
   $DIG -p ${PORT} unsigned.example2 A @10.53.0.1 >dig.out.ns1.test$n || ret=1
-  grep "status: NOERROR" dig.out.ns1.test$n >/dev/null || ret=1
+  grep "status: NOERROR" dig.out.ns1.test$n >/dev/null && ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
   status=$((status + ret))
   n=$((n + 1))